From ebedb252a47f754575ac2486298ba6912924e4bf Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Sun, 8 Aug 2021 19:00:30 +0300
Subject: [PATCH 0001/1750] rtc: tps65910: Correct driver module alias

commit 8d448fa0a8bb1c8d94eef7647edffe9ac81a281e upstream.

The TPS65910 RTC driver module doesn't auto-load because of the wrong
module alias that doesn't match the device name, fix it.

Cc: stable@vger.kernel.org
Reported-by: Anton Bambura <jenneron@protonmail.com>
Tested-by: Anton Bambura <jenneron@protonmail.com>
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20210808160030.8556-1-digetx@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rtc/rtc-tps65910.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-tps65910.c b/drivers/rtc/rtc-tps65910.c
index e3840386f430..6eec86b0b175 100644
--- a/drivers/rtc/rtc-tps65910.c
+++ b/drivers/rtc/rtc-tps65910.c
@@ -469,6 +469,6 @@ static struct platform_driver tps65910_rtc_driver = {
 };
 
 module_platform_driver(tps65910_rtc_driver);
-MODULE_ALIAS("platform:rtc-tps65910");
+MODULE_ALIAS("platform:tps65910-rtc");
 MODULE_AUTHOR("Venu Byravarasu <vbyravarasu@nvidia.com>");
 MODULE_LICENSE("GPL");

From 5103b733348e2d39ecee5bb37ed6ead10a0a1129 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Mon, 13 Sep 2021 09:35:35 -0600
Subject: [PATCH 0002/1750] io_uring: limit fixed table size by RLIMIT_NOFILE

Limit the number of files in io_uring fixed tables by RLIMIT_NOFILE,
that's the first and the simpliest restriction that we should impose.

Cc: stable@vger.kernel.org
Suggested-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/b2756c340aed7d6c0b302c26dab50c6c5907f4ce.1629451684.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2009d1cda606..0db463599b00 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7579,6 +7579,8 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
 		return -EINVAL;
 	if (nr_args > IORING_MAX_FIXED_FILES)
 		return -EMFILE;
+	if (nr_args > rlimit(RLIMIT_NOFILE))
+		return -EMFILE;
 
 	file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL);
 	if (!file_data)

From a3ed34bcada565ccd33fc61360fd8157c32b5636 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Mon, 13 Sep 2021 09:37:00 -0600
Subject: [PATCH 0003/1750] io_uring: place fixed tables under memcg limits

commit 0bea96f59ba40e63c0ae93ad6a02417b95f22f4d upstream.

Fixed tables may be large enough, place all of them together with
allocated tags under memcg limits.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/b3ac9f5da9821bb59837b5fe25e8ef4be982218c.1629451684.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 0db463599b00..195e26a78597 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7383,7 +7383,7 @@ static int io_sqe_alloc_file_tables(struct fixed_file_data *file_data,
 
 		this_files = min(nr_files, IORING_MAX_FILES_TABLE);
 		table->files = kcalloc(this_files, sizeof(struct file *),
-					GFP_KERNEL);
+					GFP_KERNEL_ACCOUNT);
 		if (!table->files)
 			break;
 		nr_files -= this_files;
@@ -7582,7 +7582,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
 	if (nr_args > rlimit(RLIMIT_NOFILE))
 		return -EMFILE;
 
-	file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL);
+	file_data = kzalloc(sizeof(*ctx->file_data), GFP_KERNEL_ACCOUNT);
 	if (!file_data)
 		return -ENOMEM;
 	file_data->ctx = ctx;
@@ -7592,7 +7592,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
 
 	nr_tables = DIV_ROUND_UP(nr_args, IORING_MAX_FILES_TABLE);
 	file_data->table = kcalloc(nr_tables, sizeof(*file_data->table),
-				   GFP_KERNEL);
+				   GFP_KERNEL_ACCOUNT);
 	if (!file_data->table)
 		goto out_free;
 

From 54eb6211b979f21c4908719e8bfb005a1143e8c3 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Mon, 13 Sep 2021 09:42:47 -0600
Subject: [PATCH 0004/1750] io_uring: add ->splice_fd_in checks

commit 26578cda3db983b17cabe4e577af26306beb9987 upstream.

->splice_fd_in is used only by splice/tee, but no other request checks
it for validity. Add the check for most of request types excluding
reads/writes/sends/recvs, we don't want overhead for them and can leave
them be as is until the field is actually used.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/f44bc2acd6777d932de3d71a5692235b5b2b7397.1629451684.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 40 ++++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 16 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 195e26a78597..dd847d8e79e6 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3746,7 +3746,8 @@ static int io_prep_fsync(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
 	if (unlikely(ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
-	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index))
+	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index ||
+		     sqe->splice_fd_in))
 		return -EINVAL;
 
 	req->sync.flags = READ_ONCE(sqe->fsync_flags);
@@ -3779,7 +3780,8 @@ static int io_fsync(struct io_kiocb *req, bool force_nonblock)
 static int io_fallocate_prep(struct io_kiocb *req,
 			     const struct io_uring_sqe *sqe)
 {
-	if (sqe->ioprio || sqe->buf_index || sqe->rw_flags)
+	if (sqe->ioprio || sqe->buf_index || sqe->rw_flags ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
@@ -3810,7 +3812,7 @@ static int __io_openat_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe
 	const char __user *fname;
 	int ret;
 
-	if (unlikely(sqe->ioprio || sqe->buf_index))
+	if (unlikely(sqe->ioprio || sqe->buf_index || sqe->splice_fd_in))
 		return -EINVAL;
 	if (unlikely(req->flags & REQ_F_FIXED_FILE))
 		return -EBADF;
@@ -3926,7 +3928,8 @@ static int io_remove_buffers_prep(struct io_kiocb *req,
 	struct io_provide_buf *p = &req->pbuf;
 	u64 tmp;
 
-	if (sqe->ioprio || sqe->rw_flags || sqe->addr || sqe->len || sqe->off)
+	if (sqe->ioprio || sqe->rw_flags || sqe->addr || sqe->len || sqe->off ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	tmp = READ_ONCE(sqe->fd);
@@ -4002,7 +4005,7 @@ static int io_provide_buffers_prep(struct io_kiocb *req,
 	struct io_provide_buf *p = &req->pbuf;
 	u64 tmp;
 
-	if (sqe->ioprio || sqe->rw_flags)
+	if (sqe->ioprio || sqe->rw_flags || sqe->splice_fd_in)
 		return -EINVAL;
 
 	tmp = READ_ONCE(sqe->fd);
@@ -4095,7 +4098,7 @@ static int io_epoll_ctl_prep(struct io_kiocb *req,
 			     const struct io_uring_sqe *sqe)
 {
 #if defined(CONFIG_EPOLL)
-	if (sqe->ioprio || sqe->buf_index)
+	if (sqe->ioprio || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL)))
 		return -EINVAL;
@@ -4141,7 +4144,7 @@ static int io_epoll_ctl(struct io_kiocb *req, bool force_nonblock,
 static int io_madvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 #if defined(CONFIG_ADVISE_SYSCALLS) && defined(CONFIG_MMU)
-	if (sqe->ioprio || sqe->buf_index || sqe->off)
+	if (sqe->ioprio || sqe->buf_index || sqe->off || sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
@@ -4176,7 +4179,7 @@ static int io_madvise(struct io_kiocb *req, bool force_nonblock)
 
 static int io_fadvise_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
-	if (sqe->ioprio || sqe->buf_index || sqe->addr)
+	if (sqe->ioprio || sqe->buf_index || sqe->addr || sqe->splice_fd_in)
 		return -EINVAL;
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
@@ -4214,7 +4217,7 @@ static int io_statx_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 {
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL | IORING_SETUP_SQPOLL)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->buf_index)
+	if (sqe->ioprio || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 	if (req->flags & REQ_F_FIXED_FILE)
 		return -EBADF;
@@ -4261,7 +4264,7 @@ static int io_close_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
 		return -EINVAL;
 	if (sqe->ioprio || sqe->off || sqe->addr || sqe->len ||
-	    sqe->rw_flags || sqe->buf_index)
+	    sqe->rw_flags || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 	if (req->flags & REQ_F_FIXED_FILE)
 		return -EBADF;
@@ -4317,7 +4320,8 @@ static int io_prep_sfr(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
 	if (unlikely(ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
-	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index))
+	if (unlikely(sqe->addr || sqe->ioprio || sqe->buf_index ||
+		     sqe->splice_fd_in))
 		return -EINVAL;
 
 	req->sync.off = READ_ONCE(sqe->off);
@@ -4760,7 +4764,7 @@ static int io_accept_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->len || sqe->buf_index)
+	if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->splice_fd_in)
 		return -EINVAL;
 
 	accept->addr = u64_to_user_ptr(READ_ONCE(sqe->addr));
@@ -4801,7 +4805,8 @@ static int io_connect_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
 	if (unlikely(req->ctx->flags & (IORING_SETUP_IOPOLL|IORING_SETUP_SQPOLL)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->rw_flags)
+	if (sqe->ioprio || sqe->len || sqe->buf_index || sqe->rw_flags ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	conn->addr = u64_to_user_ptr(READ_ONCE(sqe->addr));
@@ -5553,7 +5558,8 @@ static int io_timeout_remove_prep(struct io_kiocb *req,
 		return -EINVAL;
 	if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags)
+	if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags |
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	req->timeout_rem.addr = READ_ONCE(sqe->addr);
@@ -5590,7 +5596,8 @@ static int io_timeout_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe,
 
 	if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->buf_index || sqe->len != 1)
+	if (sqe->ioprio || sqe->buf_index || sqe->len != 1 ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 	if (off && is_timeout_link)
 		return -EINVAL;
@@ -5734,7 +5741,8 @@ static int io_async_cancel_prep(struct io_kiocb *req,
 		return -EINVAL;
 	if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->off || sqe->len || sqe->cancel_flags)
+	if (sqe->ioprio || sqe->off || sqe->len || sqe->cancel_flags ||
+	    sqe->splice_fd_in)
 		return -EINVAL;
 
 	req->cancel.addr = READ_ONCE(sqe->addr);

From 548ee201fb4a3c372a332284df3ecc21749918e1 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Mon, 13 Sep 2021 09:45:41 -0600
Subject: [PATCH 0005/1750] io_uring: fail links of cancelled timeouts

commit 2ae2eb9dde18979b40629dd413b9adbd6c894cdf upstream.

When we cancel a timeout we should mark it with REQ_F_FAIL, so
linked requests are cancelled as well, but not queued for further
execution.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/fff625b44eeced3a5cae79f60e6acf3fbdf8f990.1631192135.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index dd847d8e79e6..6978a42fa39b 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1498,6 +1498,8 @@ static void io_kill_timeout(struct io_kiocb *req, int status)
 
 	ret = hrtimer_try_to_cancel(&io->timer);
 	if (ret != -1) {
+		if (status)
+			req_set_fail_links(req);
 		atomic_set(&req->ctx->cq_timeouts,
 			atomic_read(&req->ctx->cq_timeouts) + 1);
 		list_del_init(&req->timeout.list);

From 9ac218642dfc1309682baa708e81935e5cec5ff3 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Mon, 13 Sep 2021 09:20:44 -0600
Subject: [PATCH 0006/1750] io-wq: fix wakeup race when adding new work

commit 87df7fb922d18e96992aa5e824aa34b2065fef59 upstream.

When new work is added, io_wqe_enqueue() checks if we need to wake or
create a new worker. But that check is done outside the lock that
otherwise synchronizes us with a worker going to sleep, so we can end
up in the following situation:

CPU0				CPU1
lock
insert work
unlock
atomic_read(nr_running) != 0
				lock
				atomic_dec(nr_running)
no wakeup needed

Hold the wqe lock around the "need to wakeup" check. Then we can also get
rid of the temporary work_flags variable, as we know the work will remain
valid as long as we hold the lock.

Cc: stable@vger.kernel.org
Reported-by: Andres Freund <andres@anarazel.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io-wq.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/io-wq.c b/fs/io-wq.c
index 8bb17b6d4de3..3d5fc76b92d0 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -895,7 +895,7 @@ static void io_wqe_insert_work(struct io_wqe *wqe, struct io_wq_work *work)
 static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
 {
 	struct io_wqe_acct *acct = io_work_get_acct(wqe, work);
-	int work_flags;
+	bool do_wake;
 	unsigned long flags;
 
 	/*
@@ -909,14 +909,14 @@ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
 		return;
 	}
 
-	work_flags = work->flags;
 	raw_spin_lock_irqsave(&wqe->lock, flags);
 	io_wqe_insert_work(wqe, work);
 	wqe->flags &= ~IO_WQE_FLAG_STALLED;
+	do_wake = (work->flags & IO_WQ_WORK_CONCURRENT) ||
+			!atomic_read(&acct->nr_running);
 	raw_spin_unlock_irqrestore(&wqe->lock, flags);
 
-	if ((work_flags & IO_WQ_WORK_CONCURRENT) ||
-	    !atomic_read(&acct->nr_running))
+	if (do_wake)
 		io_wqe_wake_worker(wqe, acct);
 }
 

From 0901af53da8f4cfee3bb364a35f66d0d4a9b93ba Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Wed, 14 Jul 2021 14:47:17 -0400
Subject: [PATCH 0007/1750] btrfs: wake up async_delalloc_pages waiters after
 submit

commit ac98141d140444fe93e26471d3074c603b70e2ca upstream.

We use the async_delalloc_pages mechanism to make sure that we've
completed our async work before trying to continue our delalloc
flushing.  The reason for this is we need to see any ordered extents
that were created by our delalloc flushing.  However we're waking up
before we do the submit work, which is before we create the ordered
extents.  This is a pretty wide race window where we could potentially
think there are no ordered extents and thus exit shrink_delalloc
prematurely.  Fix this by waking us up after we've done the work to
create ordered extents.

CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/inode.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 69c6786a9fdf..ff3f0638cdb9 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1202,11 +1202,6 @@ static noinline void async_cow_submit(struct btrfs_work *work)
 	nr_pages = (async_chunk->end - async_chunk->start + PAGE_SIZE) >>
 		PAGE_SHIFT;
 
-	/* atomic_sub_return implies a barrier */
-	if (atomic_sub_return(nr_pages, &fs_info->async_delalloc_pages) <
-	    5 * SZ_1M)
-		cond_wake_up_nomb(&fs_info->async_submit_wait);
-
 	/*
 	 * ->inode could be NULL if async_chunk_start has failed to compress,
 	 * in which case we don't have anything to submit, yet we need to
@@ -1215,6 +1210,11 @@ static noinline void async_cow_submit(struct btrfs_work *work)
 	 */
 	if (async_chunk->inode)
 		submit_compressed_extents(async_chunk);
+
+	/* atomic_sub_return implies a barrier */
+	if (atomic_sub_return(nr_pages, &fs_info->async_delalloc_pages) <
+	    5 * SZ_1M)
+		cond_wake_up_nomb(&fs_info->async_submit_wait);
 }
 
 static noinline void async_cow_free(struct btrfs_work *work)

From c1b249e02a80347fe519b761a8c66008e5e7dcbf Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Sat, 21 Aug 2021 01:50:40 +0800
Subject: [PATCH 0008/1750] btrfs: reset replace target device to allocation
 state on close

commit 0d977e0eba234e01a60bdde27314dc21374201b3 upstream.

This crash was observed with a failed assertion on device close:

  BTRFS: Transaction aborted (error -28)
  WARNING: CPU: 1 PID: 3902 at fs/btrfs/extent-tree.c:2150 btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs]
  Modules linked in: btrfs blake2b_generic libcrc32c crc32c_intel xor zstd_decompress zstd_compress xxhash lzo_compress lzo_decompress raid6_pq loop
  CPU: 1 PID: 3902 Comm: kworker/u8:4 Not tainted 5.14.0-rc5-default+ #1532
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014
  Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs]
  RIP: 0010:btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs]
  RSP: 0018:ffffb7a5452d7d80 EFLAGS: 00010282
  RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
  RDX: 0000000000000001 RSI: ffffffffabee13c4 RDI: 00000000ffffffff
  RBP: ffff97834176a378 R08: 0000000000000001 R09: 0000000000000001
  R10: 0000000000000000 R11: 0000000000000001 R12: ffff97835195d388
  R13: 0000000005b08000 R14: ffff978385484000 R15: 000000000000016c
  FS:  0000000000000000(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000056190d003fe8 CR3: 000000002a81e005 CR4: 0000000000170ea0
  Call Trace:
   flush_space+0x197/0x2f0 [btrfs]
   btrfs_async_reclaim_metadata_space+0x139/0x300 [btrfs]
   process_one_work+0x262/0x5e0
   worker_thread+0x4c/0x320
   ? process_one_work+0x5e0/0x5e0
   kthread+0x144/0x170
   ? set_kthread_struct+0x40/0x40
   ret_from_fork+0x1f/0x30
  irq event stamp: 19334989
  hardirqs last  enabled at (19334997): [<ffffffffab0e0c87>] console_unlock+0x2b7/0x400
  hardirqs last disabled at (19335006): [<ffffffffab0e0d0d>] console_unlock+0x33d/0x400
  softirqs last  enabled at (19334900): [<ffffffffaba0030d>] __do_softirq+0x30d/0x574
  softirqs last disabled at (19334893): [<ffffffffab0721ec>] irq_exit_rcu+0x12c/0x140
  ---[ end trace 45939e308e0dd3c7 ]---
  BTRFS: error (device vdd) in btrfs_run_delayed_refs:2150: errno=-28 No space left
  BTRFS info (device vdd): forced readonly
  BTRFS warning (device vdd): failed setting block group ro: -30
  BTRFS info (device vdd): suspending dev_replace for unmount
  assertion failed: !test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state), in fs/btrfs/volumes.c:1150
  ------------[ cut here ]------------
  kernel BUG at fs/btrfs/ctree.h:3431!
  invalid opcode: 0000 [#1] PREEMPT SMP
  CPU: 1 PID: 3982 Comm: umount Tainted: G        W         5.14.0-rc5-default+ #1532
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014
  RIP: 0010:assertfail.constprop.0+0x18/0x1a [btrfs]
  RSP: 0018:ffffb7a5454c7db8 EFLAGS: 00010246
  RAX: 0000000000000068 RBX: ffff978364b91c00 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffffffffabee13c4 RDI: 00000000ffffffff
  RBP: ffff9783523a4c00 R08: 0000000000000001 R09: 0000000000000001
  R10: 0000000000000000 R11: 0000000000000001 R12: ffff9783523a4d18
  R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000003
  FS:  00007f61c8f42800(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 000056190cffa810 CR3: 0000000030b96002 CR4: 0000000000170ea0
  Call Trace:
   btrfs_close_one_device.cold+0x11/0x55 [btrfs]
   close_fs_devices+0x44/0xb0 [btrfs]
   btrfs_close_devices+0x48/0x160 [btrfs]
   generic_shutdown_super+0x69/0x100
   kill_anon_super+0x14/0x30
   btrfs_kill_super+0x12/0x20 [btrfs]
   deactivate_locked_super+0x2c/0xa0
   cleanup_mnt+0x144/0x1b0
   task_work_run+0x59/0xa0
   exit_to_user_mode_loop+0xe7/0xf0
   exit_to_user_mode_prepare+0xaf/0xf0
   syscall_exit_to_user_mode+0x19/0x50
   do_syscall_64+0x4a/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xae

This happens when close_ctree is called while a dev_replace hasn't
completed. In close_ctree, we suspend the dev_replace, but keep the
replace target around so that we can resume the dev_replace procedure
when we mount the root again. This is the call trace:

  close_ctree():
    btrfs_dev_replace_suspend_for_unmount();
    btrfs_close_devices():
      btrfs_close_fs_devices():
        btrfs_close_one_device():
          ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
                 &device->dev_state));

However, since the replace target sticks around, there is a device
with BTRFS_DEV_STATE_REPLACE_TGT set on close, and we fail the
assertion in btrfs_close_one_device.

To fix this, if we come across the replace target device when
closing, we should properly reset it back to allocation state. This
fix also ensures that if a non-target device has a corrupted state and
has the BTRFS_DEV_STATE_REPLACE_TGT bit set, the assertion will still
catch the error.

Reported-by: David Sterba <dsterba@suse.com>
Fixes: b2a616676839 ("btrfs: fix rw device counting in __btrfs_free_extra_devids")
CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/volumes.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d1fccddcf403..b4fcc48f255b 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1129,6 +1129,9 @@ static void btrfs_close_one_device(struct btrfs_device *device)
 		fs_devices->rw_devices--;
 	}
 
+	if (device->devid == BTRFS_DEV_REPLACE_DEVID)
+		clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state);
+
 	if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
 		fs_devices->missing_devices--;
 

From a58f082554906f7ea78b3e3dc729e34a0c10fef8 Mon Sep 17 00:00:00 2001
From: Niklas Cassel <niklas.cassel@wdc.com>
Date: Wed, 11 Aug 2021 11:05:18 +0000
Subject: [PATCH 0009/1750] blk-zoned: allow zone management send operations
 without CAP_SYS_ADMIN

commit ead3b768bb51259e3a5f2287ff5fc9041eb6f450 upstream.

Zone management send operations (BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE
and BLKFINISHZONE) should be allowed under the same permissions as write().
(write() does not require CAP_SYS_ADMIN).

Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check if
the fd was successfully opened with FMODE_WRITE.
(They do not require CAP_SYS_ADMIN).

Currently, zone management send operations require both CAP_SYS_ADMIN
and that the fd was successfully opened with FMODE_WRITE.

Remove the CAP_SYS_ADMIN requirement, so that zone management send
operations match the access control requirement of write(), BLKSECDISCARD
and BLKZEROOUT.

Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls")
Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Aravind Ramesh <aravind.ramesh@wdc.com>
Reviewed-by: Adam Manzanares <a.manzanares@samsung.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Cc: stable@vger.kernel.org # v4.10+
Link: https://lore.kernel.org/r/20210811110505.29649-2-Niklas.Cassel@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-zoned.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index ab7d7ebcf6dd..86965e86da61 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -357,9 +357,6 @@ int blkdev_zone_mgmt_ioctl(struct block_device *bdev, fmode_t mode,
 	if (!blk_queue_is_zoned(q))
 		return -ENOTTY;
 
-	if (!capable(CAP_SYS_ADMIN))
-		return -EACCES;
-
 	if (!(mode & FMODE_WRITE))
 		return -EBADF;
 

From d15554f98597d89bcae43464a2b18b665ca6acfa Mon Sep 17 00:00:00 2001
From: Niklas Cassel <niklas.cassel@wdc.com>
Date: Wed, 11 Aug 2021 11:05:19 +0000
Subject: [PATCH 0010/1750] blk-zoned: allow BLKREPORTZONE without
 CAP_SYS_ADMIN

commit 4d643b66089591b4769bcdb6fd1bfeff2fe301b8 upstream.

A user space process should not need the CAP_SYS_ADMIN capability set
in order to perform a BLKREPORTZONE ioctl.

Getting the zone report is required in order to get the write pointer.
Neither read() nor write() requires CAP_SYS_ADMIN, so it is reasonable
that a user space process that can read/write from/to the device, also
can get the write pointer. (Since e.g. writes have to be at the write
pointer.)

Fixes: 3ed05a987e0f ("blk-zoned: implement ioctls")
Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Aravind Ramesh <aravind.ramesh@wdc.com>
Reviewed-by: Adam Manzanares <a.manzanares@samsung.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Cc: stable@vger.kernel.org # v4.10+
Link: https://lore.kernel.org/r/20210811110505.29649-3-Niklas.Cassel@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/blk-zoned.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/block/blk-zoned.c b/block/blk-zoned.c
index 86965e86da61..61b452272f94 100644
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -296,9 +296,6 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode,
 	if (!blk_queue_is_zoned(q))
 		return -ENOTTY;
 
-	if (!capable(CAP_SYS_ADMIN))
-		return -EACCES;
-
 	if (copy_from_user(&rep, argp, sizeof(struct blk_zone_report)))
 		return -EFAULT;
 

From 5f13c8bae824d491e3e84ebd6efe37d6940792ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek@invisiblethingslab.com>
Date: Thu, 26 Aug 2021 19:03:42 +0200
Subject: [PATCH 0011/1750] PCI/MSI: Skip masking MSI-X on Xen PV
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1a519dc7a73c977547d8b5108d98c6e769c89f4b upstream.

When running as Xen PV guest, masking MSI-X is a responsibility of the
hypervisor. The guest has no write access to the relevant BAR at all - when
it tries to, it results in a crash like this:

    BUG: unable to handle page fault for address: ffffc9004069100c
    #PF: supervisor write access in kernel mode
    #PF: error_code(0x0003) - permissions violation
    RIP: e030:__pci_enable_msix_range.part.0+0x26b/0x5f0
     e1000e_set_interrupt_capability+0xbf/0xd0 [e1000e]
     e1000_probe+0x41f/0xdb0 [e1000e]
     local_pci_probe+0x42/0x80
    (...)

The recently introduced function msix_mask_all() does not check the global
variable pci_msi_ignore_mask which is set by XEN PV to bypass the masking
of MSI[-X] interrupts.

Add the check to make this function XEN PV compatible.

Fixes: 7d5ec3d36123 ("PCI/MSI: Mask all unused MSI-X entries")
Signed-off-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210826170342.135172-1-marmarek@invisiblethingslab.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 2548c64194ca..a7a1c7411348 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -783,6 +783,9 @@ static void msix_mask_all(void __iomem *base, int tsize)
 	u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT;
 	int i;
 
+	if (pci_msi_ignore_mask)
+		return;
+
 	for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE)
 		writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL);
 }

From 37566a343fe9b44bb9bfe42d0fe5edbc87d04098 Mon Sep 17 00:00:00 2001
From: Kajol Jain <kjain@linux.ibm.com>
Date: Fri, 13 Aug 2021 13:51:58 +0530
Subject: [PATCH 0012/1750] powerpc/perf/hv-gpci: Fix counter value parsing

commit f9addd85fbfacf0d155e83dbee8696d6df5ed0c7 upstream.

H_GetPerformanceCounterInfo (0xF080) hcall returns the counter data in
the result buffer. Result buffer has specific format defined in the PAPR
specification. One of the fields is counter offset and width of the
counter data returned.

Counter data are returned in a unsigned char array in big endian byte
order. To get the final counter data, the values must be left shifted
byte at a time. But commit 220a0c609ad17 ("powerpc/perf: Add support for
the hv gpci (get performance counter info) interface") made the shifting
bitwise and also assumed little endian order. Because of that, hcall
counters values are reported incorrectly.

In particular this can lead to counters go backwards which messes up the
counter prev vs now calculation and leads to huge counter value
reporting:

  #: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
           -C 0 -I 1000
        time             counts unit events
     1.000078854 18,446,744,073,709,535,232      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     2.000213293                  0      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     3.000320107                  0      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     4.000428392                  0      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     5.000537864                  0      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     6.000649087                  0      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     7.000760312                  0      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     8.000865218             16,448      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
     9.000978985 18,446,744,073,709,535,232      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
    10.001088891             16,384      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
    11.001201435                  0      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
    12.001307937 18,446,744,073,709,535,232      hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/

Fix the shifting logic to correct match the format, ie. read bytes in
big endian order.

Fixes: e4f226b1580b ("powerpc/perf/hv-gpci: Increase request buffer size")
Cc: stable@vger.kernel.org # v4.6+
Reported-by: Nageswara R Sastry<rnsastry@linux.ibm.com>
Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
Tested-by: Nageswara R Sastry<rnsastry@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210813082158.429023-1-kjain@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/perf/hv-gpci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
index d48413e28c39..c756228a081f 100644
--- a/arch/powerpc/perf/hv-gpci.c
+++ b/arch/powerpc/perf/hv-gpci.c
@@ -175,7 +175,7 @@ static unsigned long single_gpci_request(u32 req, u32 starting_index,
 	 */
 	count = 0;
 	for (i = offset; i < offset + length; i++)
-		count |= arg->bytes[i] << (i - offset);
+		count |= (u64)(arg->bytes[i]) << ((length - 1 - (i - offset)) * 8);
 
 	*value = count;
 out:

From 907944851aa0615f1a1ccaf0b9ba499d11e26eee Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Fri, 30 Jul 2021 11:26:21 +0200
Subject: [PATCH 0013/1750] xen: fix setting of max_pfn in shared_info

commit 4b511d5bfa74b1926daefd1694205c7f1bcf677f upstream.

Xen PV guests are specifying the highest used PFN via the max_pfn
field in shared_info. This value is used by the Xen tools when saving
or migrating the guest.

Unfortunately this field is misnamed, as in reality it is specifying
the number of pages (including any memory holes) of the guest, so it
is the highest used PFN + 1. Renaming isn't possible, as this is a
public Xen hypervisor interface which needs to be kept stable.

The kernel will set the value correctly initially at boot time, but
when adding more pages (e.g. due to memory hotplug or ballooning) a
real PFN number is stored in max_pfn. This is done when expanding the
p2m array, and the PFN stored there is even possibly wrong, as it
should be the last possible PFN of the just added P2M frame, and not
one which led to the P2M expansion.

Fix that by setting shared_info->max_pfn to the last possible PFN + 1.

Fixes: 98dd166ea3a3c3 ("x86/xen/p2m: hint at the last populated P2M entry")
Cc: stable@vger.kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Link: https://lore.kernel.org/r/20210730092622.9973-2-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/xen/p2m.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 56e0f290fef6..e809f1446846 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -618,8 +618,8 @@ int xen_alloc_p2m_entry(unsigned long pfn)
 	}
 
 	/* Expanded the p2m? */
-	if (pfn > xen_p2m_last_pfn) {
-		xen_p2m_last_pfn = pfn;
+	if (pfn >= xen_p2m_last_pfn) {
+		xen_p2m_last_pfn = ALIGN(pfn + 1, P2M_PER_PAGE);
 		HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn;
 	}
 

From c37085d606349bd312903d1957d174ca52503cf8 Mon Sep 17 00:00:00 2001
From: Harshvardhan Jha <harshvardhan.jha@oracle.com>
Date: Tue, 27 Jul 2021 05:37:10 +0530
Subject: [PATCH 0014/1750] 9p/xen: Fix end of loop tests for
 list_for_each_entry

commit 732b33d0dbf17e9483f0b50385bf606f724f50a2 upstream.

This patch addresses the following problems:
 - priv can never be NULL, so this part of the check is useless
 - if the loop ran through the whole list, priv->client is invalid and
it is more appropriate and sufficient to check for the end of
list_for_each_entry loop condition.

Link: http://lkml.kernel.org/r/20210727000709.225032-1-harshvardhan.jha@oracle.com
Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Tested-by: Stefano Stabellini <sstabellini@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/9p/trans_xen.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index f4fea28e05da..3ec1a51a6944 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -138,7 +138,7 @@ static bool p9_xen_write_todo(struct xen_9pfs_dataring *ring, RING_IDX size)
 
 static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 {
-	struct xen_9pfs_front_priv *priv = NULL;
+	struct xen_9pfs_front_priv *priv;
 	RING_IDX cons, prod, masked_cons, masked_prod;
 	unsigned long flags;
 	u32 size = p9_req->tc.size;
@@ -151,7 +151,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req)
 			break;
 	}
 	read_unlock(&xen_9pfs_lock);
-	if (!priv || priv->client != client)
+	if (list_entry_is_head(priv, &xen_9pfs_devs, list))
 		return -EINVAL;
 
 	num = p9_req->tc.tag % priv->num_rings;

From 8248b61b86fb5ff2980de57ead707bbd28c78ea3 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Sun, 29 Aug 2021 19:18:24 +0100
Subject: [PATCH 0015/1750] ceph: fix dereference of null pointer cf

commit 05a444d3f90a3c3e6362e88a1bf13e1a60f8cace upstream.

Currently in the case where kmem_cache_alloc fails the null pointer
cf is dereferenced when assigning cf->is_capsnap = false. Fix this
by adding a null pointer check and return path.

Cc: stable@vger.kernel.org
Addresses-Coverity: ("Dereference null return")
Fixes: b2f9fa1f3bd8 ("ceph: correctly handle releasing an embedded cap flush")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/caps.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index b864c9b9e8df..678dac8365ed 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1755,6 +1755,9 @@ struct ceph_cap_flush *ceph_alloc_cap_flush(void)
 	struct ceph_cap_flush *cf;
 
 	cf = kmem_cache_alloc(ceph_cap_flush_cachep, GFP_KERNEL);
+	if (!cf)
+		return NULL;
+
 	cf->is_capsnap = false;
 	return cf;
 }

From 2daa118a3f7b6f6f13feb8fede80b4b2eb6ea508 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Fri, 20 Aug 2021 16:46:47 -0400
Subject: [PATCH 0016/1750] selftests/ftrace: Fix requirement check of README
 file

commit 210f9df02611cbe641ced3239122b270fd907d86 upstream.

The selftest for ftrace checks some features by checking if the README has
text that states the feature is supported by that kernel. Unfortunately,
this check gives false positives because it many not be checked if there's
spaces in the string to check. This is due to the compare between the
required variable with the ":README" string stripped, because neither has
quotes around them.

Link: https://lkml.kernel.org/r/20210820204742.087177341@goodmis.org

Cc: "Tzvetomir Stoyanov" <tz.stoyanov@gmail.com>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: linux-kselftest@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: 1b8eec510ba64 ("selftests/ftrace: Support ":README" suffix for requires")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/ftrace/test.d/functions | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions
index a6fac927ee82..0cee6b067a37 100644
--- a/tools/testing/selftests/ftrace/test.d/functions
+++ b/tools/testing/selftests/ftrace/test.d/functions
@@ -115,7 +115,7 @@ check_requires() { # Check required files and tracers
                 echo "Required tracer $t is not configured."
                 exit_unsupported
             fi
-        elif [ $r != $i ]; then
+        elif [ "$r" != "$i" ]; then
             if ! grep -Fq "$r" README ; then
                 echo "Required feature pattern \"$r\" is not in README."
                 exit_unsupported

From ac99b3aa83759a182e758a994c586f69a1202f5e Mon Sep 17 00:00:00 2001
From: Rolf Eike Beer <eb@emlix.com>
Date: Fri, 30 Jul 2021 13:51:54 +0200
Subject: [PATCH 0017/1750] tools/thermal/tmon: Add cross compiling support

commit b5f7912bb604b47a0fe024560488a7556dce8ee7 upstream.

Default to prefixed pkg-config when crosscompiling, this matches what
other parts of the tools/ directory already do.

[dlezcano] : Reworked description

Signed-off-by: Rolf Eike Beer <eb@emlix.com>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/31302992.qZodDJZGDc@devpool47
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/thermal/tmon/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/thermal/tmon/Makefile b/tools/thermal/tmon/Makefile
index 59e417ec3e13..25d7f8f37cfd 100644
--- a/tools/thermal/tmon/Makefile
+++ b/tools/thermal/tmon/Makefile
@@ -10,7 +10,7 @@ override CFLAGS+= $(call cc-option,-O3,-O1) ${WARNFLAGS}
 # Add "-fstack-protector" only if toolchain supports it.
 override CFLAGS+= $(call cc-option,-fstack-protector-strong)
 CC?= $(CROSS_COMPILE)gcc
-PKG_CONFIG?= pkg-config
+PKG_CONFIG?= $(CROSS_COMPILE)pkg-config
 
 override CFLAGS+=-D VERSION=\"$(VERSION)\"
 LDFLAGS+=

From 7eb16be25f0f971867ae286850b65816875d3293 Mon Sep 17 00:00:00 2001
From: Dinh Nguyen <dinguyen@kernel.org>
Date: Tue, 13 Jul 2021 09:46:19 -0500
Subject: [PATCH 0018/1750] clk: socfpga: agilex: fix the parents of the
 psi_ref_clk

commit 9d563236cca43fc4fe190b3be173444bd48e2a3b upstream.

The psi_ref_clk comes from the C2 node of the main_pll and periph_pll,
not the C3.

Fixes: 80c6b7a0894f ("clk: socfpga: agilex: add clock driver for the Agilex platform")
Cc: stable@vger.kernel.org
Signed-off-by: Kris Chaplin <kris.chaplin@intel.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20210713144621.605140-1-dinguyen@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/socfpga/clk-agilex.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/clk/socfpga/clk-agilex.c b/drivers/clk/socfpga/clk-agilex.c
index 438075a50b9f..0f10079bd8d5 100644
--- a/drivers/clk/socfpga/clk-agilex.c
+++ b/drivers/clk/socfpga/clk-agilex.c
@@ -107,10 +107,10 @@ static const struct clk_parent_data gpio_db_free_mux[] = {
 };
 
 static const struct clk_parent_data psi_ref_free_mux[] = {
-	{ .fw_name = "main_pll_c3",
-	  .name = "main_pll_c3", },
-	{ .fw_name = "peri_pll_c3",
-	  .name = "peri_pll_c3", },
+	{ .fw_name = "main_pll_c2",
+	  .name = "main_pll_c2", },
+	{ .fw_name = "peri_pll_c2",
+	  .name = "peri_pll_c2", },
 	{ .fw_name = "osc1",
 	  .name = "osc1", },
 	{ .fw_name = "cb-intosc-hs-div2-clk",

From 96bf326fb93cdaf659404444793b7357e050384a Mon Sep 17 00:00:00 2001
From: Dinh Nguyen <dinguyen@kernel.org>
Date: Tue, 13 Jul 2021 09:46:20 -0500
Subject: [PATCH 0019/1750] clk: socfpga: agilex: fix up s2f_user0_clk
 representation

commit f817c132db679d492d96c60993fa2f2c67ab18d0 upstream.

Correct the s2f_user0_mux clock representation.

Fixes: 80c6b7a0894f ("clk: socfpga: agilex: add clock driver for the Agilex platform")
Cc: stable@vger.kernel.org
Signed-off-by: Kris Chaplin <kris.chaplin@intel.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20210713144621.605140-2-dinguyen@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/socfpga/clk-agilex.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/clk/socfpga/clk-agilex.c b/drivers/clk/socfpga/clk-agilex.c
index 0f10079bd8d5..f559f5e95147 100644
--- a/drivers/clk/socfpga/clk-agilex.c
+++ b/drivers/clk/socfpga/clk-agilex.c
@@ -193,6 +193,13 @@ static const struct clk_parent_data sdmmc_mux[] = {
 	  .name = "boot_clk", },
 };
 
+static const struct clk_parent_data s2f_user0_mux[] = {
+	{ .fw_name = "s2f_user0_free_clk",
+	  .name = "s2f_user0_free_clk", },
+	{ .fw_name = "boot_clk",
+	  .name = "boot_clk", },
+};
+
 static const struct clk_parent_data s2f_user1_mux[] = {
 	{ .fw_name = "s2f_user1_free_clk",
 	  .name = "s2f_user1_free_clk", },
@@ -306,6 +313,8 @@ static const struct stratix10_gate_clock agilex_gate_clks[] = {
 	  4, 0x98, 0, 16, 0x88, 3, 0},
 	{ AGILEX_SDMMC_CLK, "sdmmc_clk", NULL, sdmmc_mux, ARRAY_SIZE(sdmmc_mux), 0, 0x7C,
 	  5, 0, 0, 0, 0x88, 4, 4},
+	{ AGILEX_S2F_USER0_CLK, "s2f_user0_clk", NULL, s2f_user0_mux, ARRAY_SIZE(s2f_user0_mux), 0, 0x24,
+	  6, 0, 0, 0, 0x30, 2, 0},
 	{ AGILEX_S2F_USER1_CLK, "s2f_user1_clk", NULL, s2f_user1_mux, ARRAY_SIZE(s2f_user1_mux), 0, 0x7C,
 	  6, 0, 0, 0, 0x88, 5, 0},
 	{ AGILEX_PSI_REF_CLK, "psi_ref_clk", NULL, psi_mux, ARRAY_SIZE(psi_mux), 0, 0x7C,

From 7524fcd09c3e3c36691bd1df29a92f0b2f5bc126 Mon Sep 17 00:00:00 2001
From: Dinh Nguyen <dinguyen@kernel.org>
Date: Tue, 13 Jul 2021 09:46:21 -0500
Subject: [PATCH 0020/1750] clk: socfpga: agilex: add the bypass register for
 s2f_usr0 clock

commit d17929eb1066d1c1653aae9bb4396a9f1d6602ac upstream.

Add the bypass register for the s2f_user0_clk.

Fixes: 80c6b7a0894f ("clk: socfpga: agilex: add clock driver for the Agilex platform")
Cc: stable@vger.kernel.org
Signed-off-by: Kris Chaplin <kris.chaplin@intel.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20210713144621.605140-3-dinguyen@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/socfpga/clk-agilex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/socfpga/clk-agilex.c b/drivers/clk/socfpga/clk-agilex.c
index f559f5e95147..7182afb4258a 100644
--- a/drivers/clk/socfpga/clk-agilex.c
+++ b/drivers/clk/socfpga/clk-agilex.c
@@ -267,7 +267,7 @@ static const struct stratix10_perip_cnt_clock agilex_main_perip_cnt_clks[] = {
 	{ AGILEX_SDMMC_FREE_CLK, "sdmmc_free_clk", NULL, sdmmc_free_mux,
 	  ARRAY_SIZE(sdmmc_free_mux), 0, 0xE4, 0, 0, 0},
 	{ AGILEX_S2F_USER0_FREE_CLK, "s2f_user0_free_clk", NULL, s2f_usr0_free_mux,
-	  ARRAY_SIZE(s2f_usr0_free_mux), 0, 0xE8, 0, 0, 0},
+	  ARRAY_SIZE(s2f_usr0_free_mux), 0, 0xE8, 0, 0x30, 2},
 	{ AGILEX_S2F_USER1_FREE_CLK, "s2f_user1_free_clk", NULL, s2f_usr1_free_mux,
 	  ARRAY_SIZE(s2f_usr1_free_mux), 0, 0xEC, 0, 0x88, 5},
 	{ AGILEX_PSI_REF_FREE_CLK, "psi_ref_free_clk", NULL, psi_ref_free_mux,

From 1e1136fbe89fadfe4cbeb373caf4e3956196854f Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Sun, 25 Jul 2021 19:08:30 +0100
Subject: [PATCH 0021/1750] pinctrl: stmfx: Fix hazardous u8[] to unsigned long
 cast

commit 1b73e588f47397dee6e4bdfd953e0306c60b5fe5 upstream.

Casting a small array of u8 to an unsigned long is *never* OK:

- it does funny thing when the array size is less than that of a long,
  as it accesses random places in the stack
- it makes everything even more fun with a BE kernel

Fix this by building the unsigned long used as a bitmap byte by byte,
in a way that works across endianess and has no undefined behaviours.

An extra BUILD_BUG_ON() catches the unlikely case where the array
would be larger than a single unsigned long.

Fixes: 1490d9f841b1 ("pinctrl: Add STMFX GPIO expander Pinctrl/GPIO driver")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Cc: Amelie Delaunay <amelie.delaunay@foss.st.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Link: https://lore.kernel.org/r/20210725180830.250218-1-maz@kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-stmfx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-stmfx.c b/drivers/pinctrl/pinctrl-stmfx.c
index 008c83107a3c..5fa2488fae87 100644
--- a/drivers/pinctrl/pinctrl-stmfx.c
+++ b/drivers/pinctrl/pinctrl-stmfx.c
@@ -566,7 +566,7 @@ static irqreturn_t stmfx_pinctrl_irq_thread_fn(int irq, void *dev_id)
 	u8 pending[NR_GPIO_REGS];
 	u8 src[NR_GPIO_REGS] = {0, 0, 0};
 	unsigned long n, status;
-	int ret;
+	int i, ret;
 
 	ret = regmap_bulk_read(pctl->stmfx->map, STMFX_REG_IRQ_GPI_PENDING,
 			       &pending, NR_GPIO_REGS);
@@ -576,7 +576,9 @@ static irqreturn_t stmfx_pinctrl_irq_thread_fn(int irq, void *dev_id)
 	regmap_bulk_write(pctl->stmfx->map, STMFX_REG_IRQ_GPI_SRC,
 			  src, NR_GPIO_REGS);
 
-	status = *(unsigned long *)pending;
+	BUILD_BUG_ON(NR_GPIO_REGS > sizeof(status));
+	for (i = 0, status = 0; i < NR_GPIO_REGS; i++)
+		status |= (unsigned long)pending[i] << (i * 8);
 	for_each_set_bit(n, &status, gc->ngpio) {
 		handle_nested_irq(irq_find_mapping(gc->irq.domain, n));
 		stmfx_pinctrl_irq_toggle_trigger(pctl, n);

From 610e8b2621d6bc0db17f6d5e5e17edc573de759c Mon Sep 17 00:00:00 2001
From: Paul Cercueil <paul@crapouillou.net>
Date: Sat, 17 Jul 2021 18:48:34 +0100
Subject: [PATCH 0022/1750] pinctrl: ingenic: Fix incorrect pull up/down info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit d5e931403942b3af39212960c2592b5ba741b2bf upstream.

Fix the pull up/down info for both the JZ4760 and JZ4770 SoCs, as the
previous values sometimes contradicted what's written in the programming
manual.

Fixes: b5c23aa46537 ("pinctrl: add a pinctrl driver for the Ingenic jz47xx SoCs")
Cc: <stable@vger.kernel.org> # v4.12
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Tested-by: 周琰杰 (Zhou Yanjie)<zhouyanjie@wanyeetech.com>
Link: https://lore.kernel.org/r/20210717174836.14776-1-paul@crapouillou.net
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-ingenic.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c
index 033d142f0c27..e0df5ad6741d 100644
--- a/drivers/pinctrl/pinctrl-ingenic.c
+++ b/drivers/pinctrl/pinctrl-ingenic.c
@@ -363,7 +363,7 @@ static const struct ingenic_chip_info jz4725b_chip_info = {
 };
 
 static const u32 jz4760_pull_ups[6] = {
-	0xffffffff, 0xfffcf3ff, 0xffffffff, 0xffffcfff, 0xfffffb7c, 0xfffff00f,
+	0xffffffff, 0xfffcf3ff, 0xffffffff, 0xffffcfff, 0xfffffb7c, 0x0000000f,
 };
 
 static const u32 jz4760_pull_downs[6] = {
@@ -618,11 +618,11 @@ static const struct ingenic_chip_info jz4760_chip_info = {
 };
 
 static const u32 jz4770_pull_ups[6] = {
-	0x3fffffff, 0xfff0030c, 0xffffffff, 0xffff4fff, 0xfffffb7c, 0xffa7f00f,
+	0x3fffffff, 0xfff0f3fc, 0xffffffff, 0xffff4fff, 0xfffffb7c, 0x0024f00f,
 };
 
 static const u32 jz4770_pull_downs[6] = {
-	0x00000000, 0x000f0c03, 0x00000000, 0x0000b000, 0x00000483, 0x00580ff0,
+	0x00000000, 0x000f0c03, 0x00000000, 0x0000b000, 0x00000483, 0x005b0ff0,
 };
 
 static int jz4770_uart0_data_pins[] = { 0xa0, 0xa3, };

From e80c45dbe263b2b5d372a76b802ef3ef89f2b35f Mon Sep 17 00:00:00 2001
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Date: Tue, 29 Jun 2021 21:02:49 +0530
Subject: [PATCH 0023/1750] soc: qcom: aoss: Fix the out of bound usage of
 cooling_devs

commit a89f355e469dcda129c2522be4fdba00c1c74c83 upstream.

In "qmp_cooling_devices_register", the count value is initially
QMP_NUM_COOLING_RESOURCES, which is 2. Based on the initial count value,
the memory for cooling_devs is allocated. Then while calling the
"qmp_cooling_device_add" function, count value is post-incremented for
each child node.

This makes the out of bound access to the cooling_dev array. Fix it by
passing the QMP_NUM_COOLING_RESOURCES definition to devm_kzalloc() and
initializing the count to 0.

While at it, let's also free the memory allocated to cooling_dev if no
cooling device is found in DT and during unroll phase.

Cc: stable@vger.kernel.org # 5.4
Fixes: 05589b30b21a ("soc: qcom: Extend AOSS QMP driver to support resources that are used to wake up the SoC.")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20210629153249.73428-1-manivannan.sadhasivam@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/qcom/qcom_aoss.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c
index ed2c687c16b3..4fe88d4690e2 100644
--- a/drivers/soc/qcom/qcom_aoss.c
+++ b/drivers/soc/qcom/qcom_aoss.c
@@ -476,12 +476,12 @@ static int qmp_cooling_device_add(struct qmp *qmp,
 static int qmp_cooling_devices_register(struct qmp *qmp)
 {
 	struct device_node *np, *child;
-	int count = QMP_NUM_COOLING_RESOURCES;
+	int count = 0;
 	int ret;
 
 	np = qmp->dev->of_node;
 
-	qmp->cooling_devs = devm_kcalloc(qmp->dev, count,
+	qmp->cooling_devs = devm_kcalloc(qmp->dev, QMP_NUM_COOLING_RESOURCES,
 					 sizeof(*qmp->cooling_devs),
 					 GFP_KERNEL);
 
@@ -497,12 +497,16 @@ static int qmp_cooling_devices_register(struct qmp *qmp)
 			goto unroll;
 	}
 
+	if (!count)
+		devm_kfree(qmp->dev, qmp->cooling_devs);
+
 	return 0;
 
 unroll:
 	while (--count >= 0)
 		thermal_cooling_device_unregister
 			(qmp->cooling_devs[count].cdev);
+	devm_kfree(qmp->dev, qmp->cooling_devs);
 
 	return ret;
 }

From 3fdf2feb6cbe76c6867224ed8527b356e805352c Mon Sep 17 00:00:00 2001
From: Iwona Winiarska <iwona.winiarska@intel.com>
Date: Wed, 4 Aug 2021 01:48:18 +0200
Subject: [PATCH 0024/1750] soc: aspeed: lpc-ctrl: Fix boundary check for mmap

commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream.

The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
side of the comparison, and uses resource address (rather than just the
resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and
map pages that are located outside memory-region reserved by the driver.

Fixes: 6c4e97678501 ("drivers/misc: Add Aspeed LPC control driver")
Cc: stable@vger.kernel.org
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/aspeed/aspeed-lpc-ctrl.c b/drivers/soc/aspeed/aspeed-lpc-ctrl.c
index 01ed21e8bfee..040c7dc1d479 100644
--- a/drivers/soc/aspeed/aspeed-lpc-ctrl.c
+++ b/drivers/soc/aspeed/aspeed-lpc-ctrl.c
@@ -46,7 +46,7 @@ static int aspeed_lpc_ctrl_mmap(struct file *file, struct vm_area_struct *vma)
 	unsigned long vsize = vma->vm_end - vma->vm_start;
 	pgprot_t prot = vma->vm_page_prot;
 
-	if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size)
+	if (vma->vm_pgoff + vma_pages(vma) > lpc_ctrl->mem_size >> PAGE_SHIFT)
 		return -EINVAL;
 
 	/* ast2400/2500 AHB accesses are not cache coherent */

From 01e6c64bbc5d3553421cf217afef1ae47744edda Mon Sep 17 00:00:00 2001
From: Iwona Winiarska <iwona.winiarska@intel.com>
Date: Wed, 4 Aug 2021 01:48:19 +0200
Subject: [PATCH 0025/1750] soc: aspeed: p2a-ctrl: Fix boundary check for mmap

commit 8b07e990fb254fcbaa919616ac77f981cb48c73d upstream.

The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
side of the comparison, and uses resource address (rather than just the
resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and
map pages that are located outside memory-region reserved by the driver.

Fixes: 01c60dcea9f7 ("drivers/misc: Add Aspeed P2A control driver")
Cc: stable@vger.kernel.org
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/aspeed/aspeed-p2a-ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/aspeed/aspeed-p2a-ctrl.c b/drivers/soc/aspeed/aspeed-p2a-ctrl.c
index b60fbeaffcbd..20b5fb2a207c 100644
--- a/drivers/soc/aspeed/aspeed-p2a-ctrl.c
+++ b/drivers/soc/aspeed/aspeed-p2a-ctrl.c
@@ -110,7 +110,7 @@ static int aspeed_p2a_mmap(struct file *file, struct vm_area_struct *vma)
 	vsize = vma->vm_end - vma->vm_start;
 	prot = vma->vm_page_prot;
 
-	if (vma->vm_pgoff + vsize > ctrl->mem_base + ctrl->mem_size)
+	if (vma->vm_pgoff + vma_pages(vma) > ctrl->mem_size >> PAGE_SHIFT)
 		return -EINVAL;
 
 	/* ast2400/2500 AHB accesses are not cache coherent */

From 2d3a9dff763faa5b0182f3ea4e3f81d25bd1423c Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Fri, 6 Aug 2021 12:31:04 +0100
Subject: [PATCH 0026/1750] arm64: mm: Fix TLBI vs ASID rollover

commit 5e10f9887ed85d4f59266d5c60dd09be96b5dbd4 upstream.

When switching to an 'mm_struct' for the first time following an ASID
rollover, a new ASID may be allocated and assigned to 'mm->context.id'.
This reassignment can happen concurrently with other operations on the
mm, such as unmapping pages and subsequently issuing TLB invalidation.

Consequently, we need to ensure that (a) accesses to 'mm->context.id'
are atomic and (b) all page-table updates made prior to a TLBI using the
old ASID are guaranteed to be visible to CPUs running with the new ASID.

This was found by inspection after reviewing the VMID changes from
Shameer but it looks like a real (yet hard to hit) bug.

Cc: <stable@vger.kernel.org>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Jade Alglave <jade.alglave@arm.com>
Cc: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Will Deacon <will@kernel.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20210806113109.2475-2-will@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/mmu.h      | 29 +++++++++++++++++++++++++----
 arch/arm64/include/asm/tlbflush.h | 11 ++++++-----
 2 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h
index b2e91c187e2a..c7315862e243 100644
--- a/arch/arm64/include/asm/mmu.h
+++ b/arch/arm64/include/asm/mmu.h
@@ -30,11 +30,32 @@ typedef struct {
 } mm_context_t;
 
 /*
- * This macro is only used by the TLBI and low-level switch_mm() code,
- * neither of which can race with an ASID change. We therefore don't
- * need to reload the counter using atomic64_read().
+ * We use atomic64_read() here because the ASID for an 'mm_struct' can
+ * be reallocated when scheduling one of its threads following a
+ * rollover event (see new_context() and flush_context()). In this case,
+ * a concurrent TLBI (e.g. via try_to_unmap_one() and ptep_clear_flush())
+ * may use a stale ASID. This is fine in principle as the new ASID is
+ * guaranteed to be clean in the TLB, but the TLBI routines have to take
+ * care to handle the following race:
+ *
+ *    CPU 0                    CPU 1                          CPU 2
+ *
+ *    // ptep_clear_flush(mm)
+ *    xchg_relaxed(pte, 0)
+ *    DSB ISHST
+ *    old = ASID(mm)
+ *         |                                                  <rollover>
+ *         |                   new = new_context(mm)
+ *         \-----------------> atomic_set(mm->context.id, new)
+ *                             cpu_switch_mm(mm)
+ *                             // Hardware walk of pte using new ASID
+ *    TLBI(old)
+ *
+ * In this scenario, the barrier on CPU 0 and the dependency on CPU 1
+ * ensure that the page-table walker on CPU 1 *must* see the invalid PTE
+ * written by CPU 0.
  */
-#define ASID(mm)	((mm)->context.id.counter & 0xffff)
+#define ASID(mm)	(atomic64_read(&(mm)->context.id) & 0xffff)
 
 static inline bool arm64_kernel_unmapped_at_el0(void)
 {
diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
index cc3f5a33ff9c..36f02892e1df 100644
--- a/arch/arm64/include/asm/tlbflush.h
+++ b/arch/arm64/include/asm/tlbflush.h
@@ -245,9 +245,10 @@ static inline void flush_tlb_all(void)
 
 static inline void flush_tlb_mm(struct mm_struct *mm)
 {
-	unsigned long asid = __TLBI_VADDR(0, ASID(mm));
+	unsigned long asid;
 
 	dsb(ishst);
+	asid = __TLBI_VADDR(0, ASID(mm));
 	__tlbi(aside1is, asid);
 	__tlbi_user(aside1is, asid);
 	dsb(ish);
@@ -256,9 +257,10 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
 static inline void flush_tlb_page_nosync(struct vm_area_struct *vma,
 					 unsigned long uaddr)
 {
-	unsigned long addr = __TLBI_VADDR(uaddr, ASID(vma->vm_mm));
+	unsigned long addr;
 
 	dsb(ishst);
+	addr = __TLBI_VADDR(uaddr, ASID(vma->vm_mm));
 	__tlbi(vale1is, addr);
 	__tlbi_user(vale1is, addr);
 }
@@ -283,9 +285,7 @@ static inline void __flush_tlb_range(struct vm_area_struct *vma,
 {
 	int num = 0;
 	int scale = 0;
-	unsigned long asid = ASID(vma->vm_mm);
-	unsigned long addr;
-	unsigned long pages;
+	unsigned long asid, addr, pages;
 
 	start = round_down(start, stride);
 	end = round_up(end, stride);
@@ -305,6 +305,7 @@ static inline void __flush_tlb_range(struct vm_area_struct *vma,
 	}
 
 	dsb(ishst);
+	asid = ASID(vma->vm_mm);
 
 	/*
 	 * When the CPU does not support TLB range operations, flush the TLB

From de32e151800d898d4fba8cadeebeaf756ecbbcd5 Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Mon, 23 Aug 2021 11:12:53 +0100
Subject: [PATCH 0027/1750] arm64: head: avoid over-mapping in map_memory

commit 90268574a3e8a6b883bd802d702a2738577e1006 upstream.

The `compute_indices` and `populate_entries` macros operate on inclusive
bounds, and thus the `map_memory` macro which uses them also operates
on inclusive bounds.

We pass `_end` and `_idmap_text_end` to `map_memory`, but these are
exclusive bounds, and if one of these is sufficiently aligned (as a
result of kernel configuration, physical placement, and KASLR), then:

* In `compute_indices`, the computed `iend` will be in the page/block *after*
  the final byte of the intended mapping.

* In `populate_entries`, an unnecessary entry will be created at the end
  of each level of table. At the leaf level, this entry will map up to
  SWAPPER_BLOCK_SIZE bytes of physical addresses that we did not intend
  to map.

As we may map up to SWAPPER_BLOCK_SIZE bytes more than intended, we may
violate the boot protocol and map physical address past the 2MiB-aligned
end address we are permitted to map. As we map these with Normal memory
attributes, this may result in further problems depending on what these
physical addresses correspond to.

The final entry at each level may require an additional table at that
level. As EARLY_ENTRIES() calculates an inclusive bound, we allocate
enough memory for this.

Avoid the extraneous mapping by having map_memory convert the exclusive
end address to an inclusive end address by subtracting one, and do
likewise in EARLY_ENTRIES() when calculating the number of required
tables. For clarity, comments are updated to more clearly document which
boundaries the macros operate on.  For consistency with the other
macros, the comments in map_memory are also updated to describe `vstart`
and `vend` as virtual addresses.

Fixes: 0370b31e4845 ("arm64: Extend early page table code to allow for larger kernels")
Cc: <stable@vger.kernel.org> # 4.16.x
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Steve Capper <steve.capper@arm.com>
Cc: Will Deacon <will@kernel.org>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20210823101253.55567-1-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/kernel-pgtable.h |  4 ++--
 arch/arm64/kernel/head.S                | 11 ++++++-----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/arch/arm64/include/asm/kernel-pgtable.h b/arch/arm64/include/asm/kernel-pgtable.h
index 587c504a4c8b..4b06cf9a8c8a 100644
--- a/arch/arm64/include/asm/kernel-pgtable.h
+++ b/arch/arm64/include/asm/kernel-pgtable.h
@@ -65,8 +65,8 @@
 #define EARLY_KASLR	(0)
 #endif
 
-#define EARLY_ENTRIES(vstart, vend, shift) (((vend) >> (shift)) \
-					- ((vstart) >> (shift)) + 1 + EARLY_KASLR)
+#define EARLY_ENTRIES(vstart, vend, shift) \
+	((((vend) - 1) >> (shift)) - ((vstart) >> (shift)) + 1 + EARLY_KASLR)
 
 #define EARLY_PGDS(vstart, vend) (EARLY_ENTRIES(vstart, vend, PGDIR_SHIFT))
 
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 78cdd6b24172..f9119eea735e 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -191,7 +191,7 @@ SYM_CODE_END(preserve_boot_args)
  * to be composed of multiple pages. (This effectively scales the end index).
  *
  *	vstart:	virtual address of start of range
- *	vend:	virtual address of end of range
+ *	vend:	virtual address of end of range - we map [vstart, vend]
  *	shift:	shift used to transform virtual address into index
  *	ptrs:	number of entries in page table
  *	istart:	index in table corresponding to vstart
@@ -228,17 +228,18 @@ SYM_CODE_END(preserve_boot_args)
  *
  *	tbl:	location of page table
  *	rtbl:	address to be used for first level page table entry (typically tbl + PAGE_SIZE)
- *	vstart:	start address to map
- *	vend:	end address to map - we map [vstart, vend]
+ *	vstart:	virtual address of start of range
+ *	vend:	virtual address of end of range - we map [vstart, vend - 1]
  *	flags:	flags to use to map last level entries
  *	phys:	physical address corresponding to vstart - physical memory is contiguous
  *	pgds:	the number of pgd entries
  *
  * Temporaries:	istart, iend, tmp, count, sv - these need to be different registers
- * Preserves:	vstart, vend, flags
- * Corrupts:	tbl, rtbl, istart, iend, tmp, count, sv
+ * Preserves:	vstart, flags
+ * Corrupts:	tbl, rtbl, vend, istart, iend, tmp, count, sv
  */
 	.macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv
+	sub \vend, \vend, #1
 	add \rtbl, \tbl, #PAGE_SIZE
 	mov \sv, \rtbl
 	mov \count, #0

From 4753723f8b48a24acef0afbfb359e0ca17fc328c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
Date: Wed, 11 Aug 2021 15:32:20 +0200
Subject: [PATCH 0028/1750] iio: ltc2983: fix device probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit b76d26d69ecc97ebb24aaf40427a13c808a4f488 upstream.

There is no reason to assume that the IRQ rising edge (indicating that
the device start up phase is done) will happen after we request the IRQ.
If the device is already up by the time we request it, the call to
'wait_for_completion_timeout()' will timeout and we will fail the device
probe even though there's nothing wrong.

Fix it by just polling the status register until we get the indication that
the device is up and running. As a side effect of this fix, requesting the
IRQ is also moved to after the setup function.

Fixes: f110f3188e563 ("iio: temperature: Add support for LTC2983")
Reported-and-tested-by: Drew Fustini <drew@pdp7.com>
Reviewed-by: Drew Fustini <drew@pdp7.com>
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210811133220.190264-2-nuno.sa@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/temperature/ltc2983.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/drivers/iio/temperature/ltc2983.c b/drivers/iio/temperature/ltc2983.c
index 3b5ba26d7d86..3b4a0e60e605 100644
--- a/drivers/iio/temperature/ltc2983.c
+++ b/drivers/iio/temperature/ltc2983.c
@@ -89,6 +89,8 @@
 
 #define	LTC2983_STATUS_START_MASK	BIT(7)
 #define	LTC2983_STATUS_START(x)		FIELD_PREP(LTC2983_STATUS_START_MASK, x)
+#define	LTC2983_STATUS_UP_MASK		GENMASK(7, 6)
+#define	LTC2983_STATUS_UP(reg)		FIELD_GET(LTC2983_STATUS_UP_MASK, reg)
 
 #define	LTC2983_STATUS_CHAN_SEL_MASK	GENMASK(4, 0)
 #define	LTC2983_STATUS_CHAN_SEL(x) \
@@ -1362,17 +1364,16 @@ static int ltc2983_parse_dt(struct ltc2983_data *st)
 
 static int ltc2983_setup(struct ltc2983_data *st, bool assign_iio)
 {
-	u32 iio_chan_t = 0, iio_chan_v = 0, chan, iio_idx = 0;
+	u32 iio_chan_t = 0, iio_chan_v = 0, chan, iio_idx = 0, status;
 	int ret;
-	unsigned long time;
 
-	/* make sure the device is up */
-	time = wait_for_completion_timeout(&st->completion,
-					    msecs_to_jiffies(250));
-
-	if (!time) {
+	/* make sure the device is up: start bit (7) is 0 and done bit (6) is 1 */
+	ret = regmap_read_poll_timeout(st->regmap, LTC2983_STATUS_REG, status,
+				       LTC2983_STATUS_UP(status) == 1, 25000,
+				       25000 * 10);
+	if (ret) {
 		dev_err(&st->spi->dev, "Device startup timed out\n");
-		return -ETIMEDOUT;
+		return ret;
 	}
 
 	st->iio_chan = devm_kzalloc(&st->spi->dev,
@@ -1492,10 +1493,11 @@ static int ltc2983_probe(struct spi_device *spi)
 	ret = ltc2983_parse_dt(st);
 	if (ret)
 		return ret;
-	/*
-	 * let's request the irq now so it is used to sync the device
-	 * startup in ltc2983_setup()
-	 */
+
+	ret = ltc2983_setup(st, true);
+	if (ret)
+		return ret;
+
 	ret = devm_request_irq(&spi->dev, spi->irq, ltc2983_irq_handler,
 			       IRQF_TRIGGER_RISING, name, st);
 	if (ret) {
@@ -1503,10 +1505,6 @@ static int ltc2983_probe(struct spi_device *spi)
 		return ret;
 	}
 
-	ret = ltc2983_setup(st, true);
-	if (ret)
-		return ret;
-
 	indio_dev->name = name;
 	indio_dev->num_channels = st->iio_channels;
 	indio_dev->channels = st->iio_chan;

From 646870ad8e56ff25ca38682b18171e07ddf673d5 Mon Sep 17 00:00:00 2001
From: Joseph Gates <jgates@squareup.com>
Date: Wed, 18 Aug 2021 13:31:43 +0200
Subject: [PATCH 0029/1750] wcn36xx: Ensure finish scan is not requested before
 start scan

commit d195d7aac09bddabc2c8326fb02fcec2b0a2de02 upstream.

If the operating channel is the first in the scan list, it was seen that
a finish scan request would be sent before a start scan request was
sent, causing the firmware to fail all future scans. Track the current
channel being scanned to avoid requesting the scan finish before it
starts.

Cc: <stable@vger.kernel.org>
Fixes: 5973a2947430 ("wcn36xx: Fix software-driven scan")
Signed-off-by: Joseph Gates <jgates@squareup.com>
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1629286303-13179-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/wcn36xx/main.c    | 5 ++++-
 drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 9f8e44210e89..6bed61953542 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -405,13 +405,14 @@ static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
 		wcn36xx_dbg(WCN36XX_DBG_MAC, "wcn36xx_config channel switch=%d\n",
 			    ch);
 
-		if (wcn->sw_scan_opchannel == ch) {
+		if (wcn->sw_scan_opchannel == ch && wcn->sw_scan_channel) {
 			/* If channel is the initial operating channel, we may
 			 * want to receive/transmit regular data packets, then
 			 * simply stop the scan session and exit PS mode.
 			 */
 			wcn36xx_smd_finish_scan(wcn, HAL_SYS_MODE_SCAN,
 						wcn->sw_scan_vif);
+			wcn->sw_scan_channel = 0;
 		} else if (wcn->sw_scan) {
 			/* A scan is ongoing, do not change the operating
 			 * channel, but start a scan session on the channel.
@@ -419,6 +420,7 @@ static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed)
 			wcn36xx_smd_init_scan(wcn, HAL_SYS_MODE_SCAN,
 					      wcn->sw_scan_vif);
 			wcn36xx_smd_start_scan(wcn, ch);
+			wcn->sw_scan_channel = ch;
 		} else {
 			wcn36xx_change_opchannel(wcn, ch);
 		}
@@ -699,6 +701,7 @@ static void wcn36xx_sw_scan_start(struct ieee80211_hw *hw,
 
 	wcn->sw_scan = true;
 	wcn->sw_scan_vif = vif;
+	wcn->sw_scan_channel = 0;
 	if (vif_priv->sta_assoc)
 		wcn->sw_scan_opchannel = WCN36XX_HW_CHANNEL(wcn);
 	else
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index 71fa9992b118..d0fcce86903a 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -232,6 +232,7 @@ struct wcn36xx {
 	struct cfg80211_scan_request *scan_req;
 	bool			sw_scan;
 	u8			sw_scan_opchannel;
+	u8			sw_scan_channel;
 	struct ieee80211_vif	*sw_scan_vif;
 	struct mutex		scan_lock;
 	bool			scan_aborted;

From 5df14bba0056fb7d075dd6dc8c26ff3da33e4fc1 Mon Sep 17 00:00:00 2001
From: zhenwei pi <pizhenwei@bytedance.com>
Date: Thu, 19 Aug 2021 20:37:10 +0800
Subject: [PATCH 0030/1750] crypto: public_key: fix overflow during implicit
 conversion

commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream.

Hit kernel warning like this, it can be reproduced by verifying 256
bytes datafile by keyctl command, run script:
RAWDATA=rawdata
SIGDATA=sigdata

modprobe pkcs8_key_parser

rm -rf *.der *.pem *.pfx
rm -rf $RAWDATA
dd if=/dev/random of=$RAWDATA bs=256 count=1

openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
  -subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=xx.com/emailAddress=yy@xx.com"

KEY_ID=`openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER | keyctl \
  padd asymmetric 123 @s`

keyctl pkey_sign $KEY_ID 0 $RAWDATA enc=pkcs1 hash=sha1 > $SIGDATA
keyctl pkey_verify $KEY_ID 0 $RAWDATA $SIGDATA enc=pkcs1 hash=sha1

Then the kernel reports:
 WARNING: CPU: 5 PID: 344556 at crypto/rsa-pkcs1pad.c:540
   pkcs1pad_verify+0x160/0x190
 ...
 Call Trace:
  public_key_verify_signature+0x282/0x380
  ? software_key_query+0x12d/0x180
  ? keyctl_pkey_params_get+0xd6/0x130
  asymmetric_key_verify_signature+0x66/0x80
  keyctl_pkey_verify+0xa5/0x100
  do_syscall_64+0x35/0xb0
  entry_SYSCALL_64_after_hwframe+0x44/0xae

The reason of this issue, in function 'asymmetric_key_verify_signature':
'.digest_size(u8) = params->in_len(u32)' leads overflow of an u8 value,
so use u32 instead of u8 for digest_size field. And reorder struct
public_key_signature, it saves 8 bytes on a 64-bit machine.

Cc: stable@vger.kernel.org
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/crypto/public_key.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 948c5203ca9c..f5bd80858fc5 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -39,9 +39,9 @@ extern void public_key_free(struct public_key *key);
 struct public_key_signature {
 	struct asymmetric_key_id *auth_ids[2];
 	u8 *s;			/* Signature */
-	u32 s_size;		/* Number of bytes in signature */
 	u8 *digest;
-	u8 digest_size;		/* Number of bytes in digest */
+	u32 s_size;		/* Number of bytes in signature */
+	u32 digest_size;	/* Number of bytes in digest */
 	const char *pkey_algo;
 	const char *hash_algo;
 	const char *encoding;

From 0d54bbad80f7294e6e2cb335a9861899512b2a77 Mon Sep 17 00:00:00 2001
From: Damien Le Moal <damien.lemoal@wdc.com>
Date: Wed, 11 Aug 2021 12:36:57 +0900
Subject: [PATCH 0031/1750] block: bfq: fix bfq_set_next_ioprio_data()

commit a680dd72ec336b81511e3bff48efac6dbfa563e7 upstream.

For a request that has a priority level equal to or larger than
IOPRIO_BE_NR, bfq_set_next_ioprio_data() prints a critical warning but
defaults to setting the request new_ioprio field to IOPRIO_BE_NR. This
is not consistent with the warning and the allowed values for priority
levels. Fix this by setting the request new_ioprio field to
IOPRIO_BE_NR - 1, the lowest priority level allowed.

Cc: <stable@vger.kernel.org>
Fixes: aee69d78dec0 ("block, bfq: introduce the BFQ-v0 I/O scheduler as an extra scheduler")
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://lore.kernel.org/r/20210811033702.368488-2-damien.lemoal@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/bfq-iosched.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 8ea37328ca84..b8c2ddc01aec 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -5011,7 +5011,7 @@ bfq_set_next_ioprio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic)
 	if (bfqq->new_ioprio >= IOPRIO_BE_NR) {
 		pr_crit("bfq_set_next_ioprio_data: new_ioprio %d\n",
 			bfqq->new_ioprio);
-		bfqq->new_ioprio = IOPRIO_BE_NR;
+		bfqq->new_ioprio = IOPRIO_BE_NR - 1;
 	}
 
 	bfqq->entity.new_weight = bfq_ioprio_to_weight(bfqq->new_ioprio);

From 4f920fefd857b47dfcfda880822667d80079c9b0 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Mon, 16 Aug 2021 10:27:14 +0200
Subject: [PATCH 0032/1750] power: supply: max17042: handle fails of reading
 status register

commit 54784ffa5b267f57161eb8fbb811499f22a0a0bf upstream.

Reading status register can fail in the interrupt handler.  In such
case, the regmap_read() will not store anything useful under passed
'val' variable and random stack value will be used to determine type of
interrupt.

Handle the regmap_read() failure to avoid handling interrupt type and
triggering changed power supply event based on random stack value.

Fixes: 39e7213edc4f ("max17042_battery: Support regmap to access device's registers")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/power/supply/max17042_battery.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
index 48d3985eaa8a..69bb0f56e492 100644
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -859,8 +859,12 @@ static irqreturn_t max17042_thread_handler(int id, void *dev)
 {
 	struct max17042_chip *chip = dev;
 	u32 val;
+	int ret;
+
+	ret = regmap_read(chip->regmap, MAX17042_STATUS, &val);
+	if (ret)
+		return IRQ_HANDLED;
 
-	regmap_read(chip->regmap, MAX17042_STATUS, &val);
 	if ((val & STATUS_INTR_SOCMIN_BIT) ||
 		(val & STATUS_INTR_SOCMAX_BIT)) {
 		dev_info(&chip->client->dev, "SOC threshold INTR\n");

From 7509c4cb7c8050177da9ee5e053c0c3d55bb66b7 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Sat, 14 Aug 2021 00:40:38 +0200
Subject: [PATCH 0033/1750] dm crypt: Avoid percpu_counter spinlock contention
 in crypt_page_alloc()

commit 528b16bfc3ae5f11638e71b3b63a81f9999df727 upstream.

On systems with many cores using dm-crypt, heavy spinlock contention in
percpu_counter_compare() can be observed when the page allocation limit
for a given device is reached or close to be reached. This is due
to percpu_counter_compare() taking a spinlock to compute an exact
result on potentially many CPUs at the same time.

Switch to non-exact comparison of allocated and allowed pages by using
the value returned by percpu_counter_read_positive() to avoid taking
the percpu_counter spinlock.

This may over/under estimate the actual number of allocated pages by at
most (batch-1) * num_online_cpus().

Currently, batch is bounded by 32. The system on which this issue was
first observed has 256 CPUs and 512GB of RAM. With a 4k page size, this
change may over/under estimate by 31MB. With ~10G (2%) allowed dm-crypt
allocations, this seems an acceptable error. Certainly preferred over
running into the spinlock contention.

This behavior was reproduced on an EC2 c5.24xlarge instance with 96 CPUs
and 192GB RAM as follows, but can be provoked on systems with less CPUs
as well.

 * Disable swap
 * Tune vm settings to promote regular writeback
     $ echo 50 > /proc/sys/vm/dirty_expire_centisecs
     $ echo 25 > /proc/sys/vm/dirty_writeback_centisecs
     $ echo $((128 * 1024 * 1024)) > /proc/sys/vm/dirty_background_bytes

 * Create 8 dmcrypt devices based on files on a tmpfs
 * Create and mount an ext4 filesystem on each crypt devices
 * Run stress-ng --hdd 8 within one of above filesystems

Total %system usage collected from sysstat goes to ~35%. Write throughput
on the underlying loop device is ~2GB/s. perf profiling an individual
kworker kcryptd thread shows the following profile, indicating spinlock
contention in percpu_counter_compare():

    99.98%     0.00%  kworker/u193:46  [kernel.kallsyms]  [k] ret_from_fork
      |
      --ret_from_fork
        kthread
        worker_thread
        |
         --99.92%--process_one_work
            |
            |--80.52%--kcryptd_crypt
            |    |
            |    |--62.58%--mempool_alloc
            |    |  |
            |    |   --62.24%--crypt_page_alloc
            |    |     |
            |    |      --61.51%--__percpu_counter_compare
            |    |        |
            |    |         --61.34%--__percpu_counter_sum
            |    |           |
            |    |           |--58.68%--_raw_spin_lock_irqsave
            |    |           |  |
            |    |           |   --58.30%--native_queued_spin_lock_slowpath
            |    |           |
            |    |            --0.69%--cpumask_next
            |    |                |
            |    |                 --0.51%--_find_next_bit
            |    |
            |    |--10.61%--crypt_convert
            |    |          |
            |    |          |--6.05%--xts_crypt
            ...

After applying this patch and running the same test, %system usage is
lowered to ~7% and write throughput on the loop device increases
to ~2.7GB/s. perf report shows mempool_alloc() as ~8% rather than ~62%
in the profile and not hitting the percpu_counter() spinlock anymore.

    |--8.15%--mempool_alloc
    |    |
    |    |--3.93%--crypt_page_alloc
    |    |    |
    |    |     --3.75%--__alloc_pages
    |    |         |
    |    |          --3.62%--get_page_from_freelist
    |    |              |
    |    |               --3.22%--rmqueue_bulk
    |    |                   |
    |    |                    --2.59%--_raw_spin_lock
    |    |                      |
    |    |                       --2.57%--native_queued_spin_lock_slowpath
    |    |
    |     --3.05%--_raw_spin_lock_irqsave
    |               |
    |                --2.49%--native_queued_spin_lock_slowpath

Suggested-by: DJ Gregor <dj@corelight.com>
Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Arne Welzel <arne.welzel@corelight.com>
Fixes: 5059353df86e ("dm crypt: limit the number of allocated pages")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/dm-crypt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 70ae6f3aede9..2aa4acd33af3 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -2643,7 +2643,12 @@ static void *crypt_page_alloc(gfp_t gfp_mask, void *pool_data)
 	struct crypt_config *cc = pool_data;
 	struct page *page;
 
-	if (unlikely(percpu_counter_compare(&cc->n_allocated_pages, dm_crypt_pages_per_client) >= 0) &&
+	/*
+	 * Note, percpu_counter_read_positive() may over (and under) estimate
+	 * the current usage by at most (batch - 1) * num_online_cpus() pages,
+	 * but avoids potential spinlock contention of an exact result.
+	 */
+	if (unlikely(percpu_counter_read_positive(&cc->n_allocated_pages) >= dm_crypt_pages_per_client) &&
 	    likely(gfp_mask & __GFP_NORETRY))
 		return NULL;
 

From 6cae39f457547623fe1a48370d87cc1f4125fc42 Mon Sep 17 00:00:00 2001
From: Brijesh Singh <brijesh.singh@amd.com>
Date: Wed, 28 Jul 2021 10:15:21 -0500
Subject: [PATCH 0034/1750] crypto: ccp - shutdown SEV firmware on kexec

commit 5441a07a127f106c9936e4f9fa1a8a93e3f31828 upstream.

The commit 97f9ac3db6612 ("crypto: ccp - Add support for SEV-ES to the
PSP driver") added support to allocate Trusted Memory Region (TMR)
used during the SEV-ES firmware initialization. The TMR gets locked
during the firmware initialization and unlocked during the shutdown.
While the TMR is locked, access to it is disallowed.

Currently, the CCP driver does not shutdown the firmware during the
kexec reboot, leaving the TMR memory locked.

Register a callback to shutdown the SEV firmware on the kexec boot.

Fixes: 97f9ac3db6612 ("crypto: ccp - Add support for SEV-ES to the PSP driver")
Reported-by: Lucas Nussbaum <lucas.nussbaum@inria.fr>
Tested-by: Lucas Nussbaum <lucas.nussbaum@inria.fr>
Cc: <stable@kernel.org>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/sev-dev.c | 49 +++++++++++++++++-------------------
 drivers/crypto/ccp/sp-pci.c  | 12 +++++++++
 2 files changed, 35 insertions(+), 26 deletions(-)

diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index d0018794e92e..57b57d4db500 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -278,6 +278,9 @@ static int __sev_platform_shutdown_locked(int *error)
 	struct sev_device *sev = psp_master->sev_data;
 	int ret;
 
+	if (sev->state == SEV_STATE_UNINIT)
+		return 0;
+
 	ret = __sev_do_cmd_locked(SEV_CMD_SHUTDOWN, NULL, error);
 	if (ret)
 		return ret;
@@ -1018,6 +1021,20 @@ int sev_dev_init(struct psp_device *psp)
 	return ret;
 }
 
+static void sev_firmware_shutdown(struct sev_device *sev)
+{
+	sev_platform_shutdown(NULL);
+
+	if (sev_es_tmr) {
+		/* The TMR area was encrypted, flush it from the cache */
+		wbinvd_on_all_cpus();
+
+		free_pages((unsigned long)sev_es_tmr,
+			   get_order(SEV_ES_TMR_SIZE));
+		sev_es_tmr = NULL;
+	}
+}
+
 void sev_dev_destroy(struct psp_device *psp)
 {
 	struct sev_device *sev = psp->sev_data;
@@ -1025,6 +1042,8 @@ void sev_dev_destroy(struct psp_device *psp)
 	if (!sev)
 		return;
 
+	sev_firmware_shutdown(sev);
+
 	if (sev->misc)
 		kref_put(&misc_dev->refcount, sev_exit);
 
@@ -1055,21 +1074,6 @@ void sev_pci_init(void)
 	if (sev_get_api_version())
 		goto err;
 
-	/*
-	 * If platform is not in UNINIT state then firmware upgrade and/or
-	 * platform INIT command will fail. These command require UNINIT state.
-	 *
-	 * In a normal boot we should never run into case where the firmware
-	 * is not in UNINIT state on boot. But in case of kexec boot, a reboot
-	 * may not go through a typical shutdown sequence and may leave the
-	 * firmware in INIT or WORKING state.
-	 */
-
-	if (sev->state != SEV_STATE_UNINIT) {
-		sev_platform_shutdown(NULL);
-		sev->state = SEV_STATE_UNINIT;
-	}
-
 	if (sev_version_greater_or_equal(0, 15) &&
 	    sev_update_firmware(sev->dev) == 0)
 		sev_get_api_version();
@@ -1114,17 +1118,10 @@ void sev_pci_init(void)
 
 void sev_pci_exit(void)
 {
-	if (!psp_master->sev_data)
+	struct sev_device *sev = psp_master->sev_data;
+
+	if (!sev)
 		return;
 
-	sev_platform_shutdown(NULL);
-
-	if (sev_es_tmr) {
-		/* The TMR area was encrypted, flush it from the cache */
-		wbinvd_on_all_cpus();
-
-		free_pages((unsigned long)sev_es_tmr,
-			   get_order(SEV_ES_TMR_SIZE));
-		sev_es_tmr = NULL;
-	}
+	sev_firmware_shutdown(sev);
 }
diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c
index 7d346d842a39..c319e7e3917d 100644
--- a/drivers/crypto/ccp/sp-pci.c
+++ b/drivers/crypto/ccp/sp-pci.c
@@ -241,6 +241,17 @@ static int sp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	return ret;
 }
 
+static void sp_pci_shutdown(struct pci_dev *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct sp_device *sp = dev_get_drvdata(dev);
+
+	if (!sp)
+		return;
+
+	sp_destroy(sp);
+}
+
 static void sp_pci_remove(struct pci_dev *pdev)
 {
 	struct device *dev = &pdev->dev;
@@ -370,6 +381,7 @@ static struct pci_driver sp_pci_driver = {
 	.id_table = sp_pci_table,
 	.probe = sp_pci_probe,
 	.remove = sp_pci_remove,
+	.shutdown = sp_pci_shutdown,
 	.driver.pm = &sp_pci_pm_ops,
 };
 

From 516dbe27f44748bdf2c413e74997734f3a7af445 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Wed, 18 Aug 2021 20:48:45 +0800
Subject: [PATCH 0035/1750] VMCI: fix NULL pointer dereference when unmapping
 queue pair

commit a30dc6cf0dc51419021550152e435736aaef8799 upstream.

I got a NULL pointer dereference report when doing fuzz test:

Call Trace:
  qp_release_pages+0xae/0x130
  qp_host_unregister_user_memory.isra.25+0x2d/0x80
  vmci_qp_broker_unmap+0x191/0x320
  ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0
  vmci_host_unlocked_ioctl+0x59f/0xd50
  ? do_vfs_ioctl+0x14b/0xa10
  ? tomoyo_file_ioctl+0x28/0x30
  ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0
  __x64_sys_ioctl+0xea/0x120
  do_syscall_64+0x34/0xb0
  entry_SYSCALL_64_after_hwframe+0x44/0xae

When a queue pair is created by the following call, it will not
register the user memory if the page_store is NULL, and the
entry->state will be set to VMCIQPB_CREATED_NO_MEM.

vmci_host_unlocked_ioctl
  vmci_host_do_alloc_queuepair
    vmci_qp_broker_alloc
      qp_broker_alloc
        qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM;

When unmapping this queue pair, qp_host_unregister_user_memory() will
be called to unregister the non-existent user memory, which will
result in a null pointer reference. It will also change
VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be
present in this operation.

Only when the qp broker has mem, it can unregister the user
memory when unmapping the qp broker.

Only when the qp broker has no mem, it can register the user
memory when mapping the qp broker.

Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Cc: stable <stable@vger.kernel.org>
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20210818124845.488312-1-wanghai38@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index c2338750313c..a49782dd903c 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -2238,7 +2238,8 @@ int vmci_qp_broker_map(struct vmci_handle handle,
 
 	result = VMCI_SUCCESS;
 
-	if (context_id != VMCI_HOST_CONTEXT_ID) {
+	if (context_id != VMCI_HOST_CONTEXT_ID &&
+	    !QPBROKERSTATE_HAS_MEM(entry)) {
 		struct vmci_qp_page_store page_store;
 
 		page_store.pages = guest_mem;
@@ -2345,7 +2346,8 @@ int vmci_qp_broker_unmap(struct vmci_handle handle,
 		goto out;
 	}
 
-	if (context_id != VMCI_HOST_CONTEXT_ID) {
+	if (context_id != VMCI_HOST_CONTEXT_ID &&
+	    QPBROKERSTATE_HAS_MEM(entry)) {
 		qp_acquire_queue_mutex(entry->produce_q);
 		result = qp_save_headers(entry);
 		if (result < VMCI_SUCCESS)

From c0eaaa686864b07a85743d6004cd0a7e58c376cb Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Thu, 17 Jun 2021 14:33:29 +0200
Subject: [PATCH 0036/1750] media: uvc: don't do DMA on stack

commit 1a10d7fdb6d0e235e9d230916244cc2769d3f170 upstream.

As warned by smatch:
	drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i)
	drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)

those two functions call uvc_query_ctrl passing a pointer to
a data at the DMA stack. those are used to send URBs via
usb_control_msg(). Using DMA stack is not supported and should
not work anymore on modern Linux versions.

So, use a kmalloc'ed buffer.

Cc: stable@vger.kernel.org	# Kernel 4.9 and upper
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/usb/uvc/uvc_v4l2.c | 34 +++++++++++++++++++++-----------
 1 file changed, 23 insertions(+), 11 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index c7172b8952a9..5f0e2fa69da5 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -898,8 +898,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
 {
 	struct uvc_fh *handle = fh;
 	struct uvc_video_chain *chain = handle->chain;
+	u8 *buf;
 	int ret;
-	u8 i;
 
 	if (chain->selector == NULL ||
 	    (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) {
@@ -907,22 +907,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input)
 		return 0;
 	}
 
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
 	ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id,
 			     chain->dev->intfnum,  UVC_SU_INPUT_SELECT_CONTROL,
-			     &i, 1);
-	if (ret < 0)
-		return ret;
+			     buf, 1);
+	if (!ret)
+		*input = *buf - 1;
 
-	*input = i - 1;
-	return 0;
+	kfree(buf);
+
+	return ret;
 }
 
 static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
 {
 	struct uvc_fh *handle = fh;
 	struct uvc_video_chain *chain = handle->chain;
+	u8 *buf;
 	int ret;
-	u32 i;
 
 	ret = uvc_acquire_privileges(handle);
 	if (ret < 0)
@@ -938,10 +943,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input)
 	if (input >= chain->selector->bNrInPins)
 		return -EINVAL;
 
-	i = input + 1;
-	return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
-			      chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
-			      &i, 1);
+	buf = kmalloc(1, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	*buf = input + 1;
+	ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id,
+			     chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL,
+			     buf, 1);
+	kfree(buf);
+
+	return ret;
 }
 
 static int uvc_ioctl_queryctrl(struct file *file, void *fh,

From 2d2aaa200cede60d145ce1eda8cd2811d124a06a Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Sat, 3 Jul 2021 15:37:17 +0200
Subject: [PATCH 0037/1750] media: rc-loopback: return number of emitters
 rather than error

commit 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 upstream.

The LIRC_SET_TRANSMITTER_MASK ioctl should return the number of emitters
if an invalid list was set.

Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/rc-loopback.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/rc-loopback.c b/drivers/media/rc/rc-loopback.c
index 1ba3f96ffa7d..40ab66c850f2 100644
--- a/drivers/media/rc/rc-loopback.c
+++ b/drivers/media/rc/rc-loopback.c
@@ -42,7 +42,7 @@ static int loop_set_tx_mask(struct rc_dev *dev, u32 mask)
 
 	if ((mask & (RXMASK_REGULAR | RXMASK_LEARNING)) != mask) {
 		dprintk("invalid tx mask: %u\n", mask);
-		return -EINVAL;
+		return 2;
 	}
 
 	dprintk("setting tx mask: %u\n", mask);

From bcc0c767f9b345f727c4696244494d78d31f5956 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Mon, 31 May 2021 18:40:06 +0300
Subject: [PATCH 0038/1750] s390/qdio: fix roll-back after timeout on ESTABLISH
 ccw

commit 2c197870e4701610ec3b1143808d4e31152caf30 upstream.

When qdio_establish() times out while waiting for the ESTABLISH ccw to
complete, it calls qdio_shutdown() to roll back all of its previous
actions. But at this point the qdio_irq's state is still
QDIO_IRQ_STATE_INACTIVE, so qdio_shutdown() will exit immediately
without doing any actual work.

Which means that eg. the qdio_irq's thinint-indicator stays registered,
and cdev->handler isn't restored to its old value. And since
commit 954d6235be41 ("s390/qdio: make thinint registration symmetric")
the qdio_irq also stays on the tiq_list, so on the next qdio_establish()
we might get a helpful BUG from the list-debugging code:

...
[ 4633.512591] list_add double add: new=00000000005a4110, prev=00000001b357db78, next=00000000005a4110.
[ 4633.512621] ------------[ cut here ]------------
[ 4633.512623] kernel BUG at lib/list_debug.c:29!
...
[ 4633.512796]  [<00000001b2c6ee9a>] __list_add_valid+0x82/0xa0
[ 4633.512798] ([<00000001b2c6ee96>] __list_add_valid+0x7e/0xa0)
[ 4633.512800]  [<00000001b2fcecce>] qdio_establish_thinint+0x116/0x190
[ 4633.512805]  [<00000001b2fcbe58>] qdio_establish+0x128/0x498
...

Fix this by extracting a goto-chain from the existing error exits in
qdio_establish(), and check the return value of the wait_event_...()
to detect the timeout condition.

Fixes: 779e6e1c724d ("[S390] qdio: new qdio driver.")
Root-caused-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Cc: <stable@vger.kernel.org> # 2.6.27
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/cio/qdio_main.c | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index f9a31c7819ae..acd7398b4528 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1243,6 +1243,7 @@ int qdio_establish(struct ccw_device *cdev,
 {
 	struct qdio_irq *irq_ptr = cdev->private->qdio_data;
 	struct subchannel_id schid;
+	long timeout;
 	int rc;
 
 	ccw_device_get_schid(cdev, &schid);
@@ -1268,11 +1269,8 @@ int qdio_establish(struct ccw_device *cdev,
 	qdio_setup_irq(irq_ptr, init_data);
 
 	rc = qdio_establish_thinint(irq_ptr);
-	if (rc) {
-		qdio_shutdown_irq(irq_ptr);
-		mutex_unlock(&irq_ptr->setup_mutex);
-		return rc;
-	}
+	if (rc)
+		goto err_thinint;
 
 	/* establish q */
 	irq_ptr->ccw.cmd_code = irq_ptr->equeue.cmd;
@@ -1288,15 +1286,16 @@ int qdio_establish(struct ccw_device *cdev,
 	if (rc) {
 		DBF_ERROR("%4x est IO ERR", irq_ptr->schid.sch_no);
 		DBF_ERROR("rc:%4x", rc);
-		qdio_shutdown_thinint(irq_ptr);
-		qdio_shutdown_irq(irq_ptr);
-		mutex_unlock(&irq_ptr->setup_mutex);
-		return rc;
+		goto err_ccw_start;
 	}
 
-	wait_event_interruptible_timeout(cdev->private->wait_q,
-		irq_ptr->state == QDIO_IRQ_STATE_ESTABLISHED ||
-		irq_ptr->state == QDIO_IRQ_STATE_ERR, HZ);
+	timeout = wait_event_interruptible_timeout(cdev->private->wait_q,
+						   irq_ptr->state == QDIO_IRQ_STATE_ESTABLISHED ||
+						   irq_ptr->state == QDIO_IRQ_STATE_ERR, HZ);
+	if (timeout <= 0) {
+		rc = (timeout == -ERESTARTSYS) ? -EINTR : -ETIME;
+		goto err_ccw_timeout;
+	}
 
 	if (irq_ptr->state != QDIO_IRQ_STATE_ESTABLISHED) {
 		mutex_unlock(&irq_ptr->setup_mutex);
@@ -1315,6 +1314,14 @@ int qdio_establish(struct ccw_device *cdev,
 	qdio_print_subchannel_info(irq_ptr);
 	qdio_setup_debug_entries(irq_ptr);
 	return 0;
+
+err_ccw_timeout:
+err_ccw_start:
+	qdio_shutdown_thinint(irq_ptr);
+err_thinint:
+	qdio_shutdown_irq(irq_ptr);
+	mutex_unlock(&irq_ptr->setup_mutex);
+	return rc;
 }
 EXPORT_SYMBOL_GPL(qdio_establish);
 

From 76668bdee0b08f5ed6f55323a1db91e2d7f6c790 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Mon, 31 May 2021 18:33:02 +0300
Subject: [PATCH 0039/1750] s390/qdio: cancel the ESTABLISH ccw after timeout

commit 1c1dc8bda3a05c60877a6649775894db5343bdea upstream.

When the ESTABLISH ccw does not complete within the specified timeout,
try our best to cancel the ccw program that is still active on the
device. Otherwise the IO subsystem might be accessing it even after
the driver eg. called qdio_free().

Fixes: 779e6e1c724d ("[S390] qdio: new qdio driver.")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Cc: <stable@vger.kernel.org> # 2.6.27
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/cio/qdio_main.c | 51 +++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 21 deletions(-)

diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index acd7398b4528..3e29c26f0185 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1025,6 +1025,33 @@ static void qdio_shutdown_queues(struct qdio_irq *irq_ptr)
 	}
 }
 
+static int qdio_cancel_ccw(struct qdio_irq *irq, int how)
+{
+	struct ccw_device *cdev = irq->cdev;
+	int rc;
+
+	spin_lock_irq(get_ccwdev_lock(cdev));
+	qdio_set_state(irq, QDIO_IRQ_STATE_CLEANUP);
+	if (how & QDIO_FLAG_CLEANUP_USING_CLEAR)
+		rc = ccw_device_clear(cdev, QDIO_DOING_CLEANUP);
+	else
+		/* default behaviour is halt */
+		rc = ccw_device_halt(cdev, QDIO_DOING_CLEANUP);
+	spin_unlock_irq(get_ccwdev_lock(cdev));
+	if (rc) {
+		DBF_ERROR("%4x SHUTD ERR", irq->schid.sch_no);
+		DBF_ERROR("rc:%4d", rc);
+		return rc;
+	}
+
+	wait_event_interruptible_timeout(cdev->private->wait_q,
+					 irq->state == QDIO_IRQ_STATE_INACTIVE ||
+					 irq->state == QDIO_IRQ_STATE_ERR,
+					 10 * HZ);
+
+	return 0;
+}
+
 /**
  * qdio_shutdown - shut down a qdio subchannel
  * @cdev: associated ccw device
@@ -1063,27 +1090,7 @@ int qdio_shutdown(struct ccw_device *cdev, int how)
 	qdio_shutdown_queues(irq_ptr);
 	qdio_shutdown_debug_entries(irq_ptr);
 
-	/* cleanup subchannel */
-	spin_lock_irq(get_ccwdev_lock(cdev));
-	qdio_set_state(irq_ptr, QDIO_IRQ_STATE_CLEANUP);
-	if (how & QDIO_FLAG_CLEANUP_USING_CLEAR)
-		rc = ccw_device_clear(cdev, QDIO_DOING_CLEANUP);
-	else
-		/* default behaviour is halt */
-		rc = ccw_device_halt(cdev, QDIO_DOING_CLEANUP);
-	spin_unlock_irq(get_ccwdev_lock(cdev));
-	if (rc) {
-		DBF_ERROR("%4x SHUTD ERR", irq_ptr->schid.sch_no);
-		DBF_ERROR("rc:%4d", rc);
-		goto no_cleanup;
-	}
-
-	wait_event_interruptible_timeout(cdev->private->wait_q,
-		irq_ptr->state == QDIO_IRQ_STATE_INACTIVE ||
-		irq_ptr->state == QDIO_IRQ_STATE_ERR,
-		10 * HZ);
-
-no_cleanup:
+	rc = qdio_cancel_ccw(irq_ptr, how);
 	qdio_shutdown_thinint(irq_ptr);
 	qdio_shutdown_irq(irq_ptr);
 
@@ -1316,10 +1323,12 @@ int qdio_establish(struct ccw_device *cdev,
 	return 0;
 
 err_ccw_timeout:
+	qdio_cancel_ccw(irq_ptr, QDIO_FLAG_CLEANUP_USING_CLEAR);
 err_ccw_start:
 	qdio_shutdown_thinint(irq_ptr);
 err_thinint:
 	qdio_shutdown_irq(irq_ptr);
+	qdio_set_state(irq_ptr, QDIO_IRQ_STATE_INACTIVE);
 	mutex_unlock(&irq_ptr->setup_mutex);
 	return rc;
 }

From 300ccb12925289a810861daae67b88517d7895b3 Mon Sep 17 00:00:00 2001
From: Robin Gong <yibin.gong@nxp.com>
Date: Wed, 14 Jul 2021 18:20:43 +0800
Subject: [PATCH 0040/1750] Revert "dmaengine: imx-sdma: refine to load context
 only once"

commit 8592f02464d52776c5cfae4627c6413b0ae7602d upstream.

This reverts commit ad0d92d7ba6aecbe2705907c38ff8d8be4da1e9c, because
in spi-imx case, burst length may be changed dynamically.

Fixes: ad0d92d7ba6a ("dmaengine: imx-sdma: refine to load context only once")
Cc: <stable@vger.kernel.org>
Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Acked-by: Sascha Hauer <s.hauer@pengutronix.de>
Tested-by: Richard Leitner <richard.leitner@skidata.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/imx-sdma.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index 16b908c77db3..dd9901a85050 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -379,7 +379,6 @@ struct sdma_channel {
 	unsigned long			watermark_level;
 	u32				shp_addr, per_addr;
 	enum dma_status			status;
-	bool				context_loaded;
 	struct imx_dma_data		data;
 	struct work_struct		terminate_worker;
 };
@@ -985,9 +984,6 @@ static int sdma_load_context(struct sdma_channel *sdmac)
 	int ret;
 	unsigned long flags;
 
-	if (sdmac->context_loaded)
-		return 0;
-
 	if (sdmac->direction == DMA_DEV_TO_MEM)
 		load_address = sdmac->pc_from_device;
 	else if (sdmac->direction == DMA_DEV_TO_DEV)
@@ -1030,8 +1026,6 @@ static int sdma_load_context(struct sdma_channel *sdmac)
 
 	spin_unlock_irqrestore(&sdma->channel_0_lock, flags);
 
-	sdmac->context_loaded = true;
-
 	return ret;
 }
 
@@ -1070,7 +1064,6 @@ static void sdma_channel_terminate_work(struct work_struct *work)
 	vchan_get_all_descriptors(&sdmac->vc, &head);
 	spin_unlock_irqrestore(&sdmac->vc.lock, flags);
 	vchan_dma_desc_free_list(&sdmac->vc, &head);
-	sdmac->context_loaded = false;
 }
 
 static int sdma_terminate_all(struct dma_chan *chan)
@@ -1338,7 +1331,6 @@ static void sdma_free_chan_resources(struct dma_chan *chan)
 
 	sdmac->event_id0 = 0;
 	sdmac->event_id1 = 0;
-	sdmac->context_loaded = false;
 
 	sdma_set_channel_priority(sdmac, 0);
 

From bcbc44e42dc676fa63c111617533d15c4cf444de Mon Sep 17 00:00:00 2001
From: Robin Gong <yibin.gong@nxp.com>
Date: Wed, 14 Jul 2021 18:20:44 +0800
Subject: [PATCH 0041/1750] dmaengine: imx-sdma: remove duplicated
 sdma_load_context

commit e555a03b112838883fdd8185d613c35d043732f2 upstream.

Since sdma_transfer_init() will do sdma_load_context before any
sdma transfer, no need once more in sdma_config_channel().

Fixes: ad0d92d7ba6a ("dmaengine: imx-sdma: refine to load context only once")
Cc: <stable@vger.kernel.org>
Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Acked-by: Vinod Koul <vkoul@kernel.org>
Tested-by: Richard Leitner <richard.leitner@skidata.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/imx-sdma.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
index dd9901a85050..306f93e4b26a 100644
--- a/drivers/dma/imx-sdma.c
+++ b/drivers/dma/imx-sdma.c
@@ -1138,7 +1138,6 @@ static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac)
 static int sdma_config_channel(struct dma_chan *chan)
 {
 	struct sdma_channel *sdmac = to_sdma_chan(chan);
-	int ret;
 
 	sdma_disable_channel(chan);
 
@@ -1178,9 +1177,7 @@ static int sdma_config_channel(struct dma_chan *chan)
 		sdmac->watermark_level = 0; /* FIXME: M3_BASE_ADDRESS */
 	}
 
-	ret = sdma_load_context(sdmac);
-
-	return ret;
+	return 0;
 }
 
 static int sdma_set_channel_priority(struct sdma_channel *sdmac,

From ba73bc1666153257550a47f6bcc67a5fc4871427 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Mon, 23 Aug 2021 11:52:20 +0200
Subject: [PATCH 0042/1750] libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860
 and 870 SSDs

commit 8a6430ab9c9c87cb64c512e505e8690bbaee190b upstream.

Commit ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860")
limited the existing ATA_HORKAGE_NO_NCQ_TRIM quirk from "Samsung SSD 8*",
covering all Samsung 800 series SSDs, to only apply to "Samsung SSD 840*"
and "Samsung SSD 850*" series based on information from Samsung.

But there is a large number of users which is still reporting issues
with the Samsung 860 and 870 SSDs combined with Intel, ASmedia or
Marvell SATA controllers and all reporters also report these problems
going away when disabling queued trims.

Note that with AMD SATA controllers users are reporting even worse
issues and only completely disabling NCQ helps there, this will be
addressed in a separate patch.

Fixes: ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203475
Cc: stable@vger.kernel.org
Cc: Kate Hsuan <hpa@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Link: https://lore.kernel.org/r/20210823095220.30157-1-hdegoede@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/libata-core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 44f434acfce0..0e6e73b8023f 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3950,6 +3950,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "Samsung SSD 850*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+	{ "Samsung SSD 860*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+	{ "Samsung SSD 870*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
+						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "FCCT*M500*",			NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 

From ce7e64e63acf42f9d1fe36ec300e56af63958814 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Mon, 9 Aug 2021 19:07:30 +0100
Subject: [PATCH 0043/1750] ARM: 9105/1: atags_to_fdt: don't warn about stack
 size

commit b30d0289de72c62516df03fdad8d53f552c69839 upstream.

The merge_fdt_bootargs() function by definition consumes more than 1024
bytes of stack because it has a 1024 byte command line on the stack,
meaning that we always get a warning when building this file:

arch/arm/boot/compressed/atags_to_fdt.c: In function 'merge_fdt_bootargs':
arch/arm/boot/compressed/atags_to_fdt.c:98:1: warning: the frame size of 1032 bytes is larger than 1024 bytes [-Wframe-larger-than=]

However, as this is the decompressor and we know that it has a very shallow
call chain, and we do not actually risk overflowing the kernel stack
at runtime here.

This just shuts up the warning by disabling the warning flag for this
file.

Tested on Nexus 7 2012 builds.

Acked-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: David Heidelberg <david@ixit.cz>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/compressed/Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index 0d6ee56f5831..175213d7a1aa 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -84,6 +84,8 @@ compress-$(CONFIG_KERNEL_LZ4)  = lz4
 libfdt_objs := fdt_rw.o fdt_ro.o fdt_wip.o fdt.o
 
 ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y)
+CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN}
+CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280
 OBJS	+= $(libfdt_objs) atags_to_fdt.o
 endif
 

From 74d6dfcb0f9daa0fd32368147c34cff05026eb4a Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Fri, 6 Aug 2021 08:04:37 +0800
Subject: [PATCH 0044/1750] f2fs: fix to do sanity check for sb/cp fields
 correctly

commit 65ddf6564843890a58ee3b18bb46ce67d96333fb upstream.

This patch fixes below problems of sb/cp sanity check:
- in sanity_check_raw_superi(), it missed to consider log header
blocks while cp_payload check.
- in f2fs_sanity_check_ckpt(), it missed to check nat_bits_blocks.

Cc: <stable@kernel.org>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/super.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 476b2c497d28..dad91b1f3849 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2898,11 +2898,13 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
 		return -EFSCORRUPTED;
 	}
 
-	if (le32_to_cpu(raw_super->cp_payload) >
-				(blocks_per_seg - F2FS_CP_PACKS)) {
-		f2fs_info(sbi, "Insane cp_payload (%u > %u)",
+	if (le32_to_cpu(raw_super->cp_payload) >=
+				(blocks_per_seg - F2FS_CP_PACKS -
+				NR_CURSEG_PERSIST_TYPE)) {
+		f2fs_info(sbi, "Insane cp_payload (%u >= %u)",
 			  le32_to_cpu(raw_super->cp_payload),
-			  blocks_per_seg - F2FS_CP_PACKS);
+			  blocks_per_seg - F2FS_CP_PACKS -
+			  NR_CURSEG_PERSIST_TYPE);
 		return -EFSCORRUPTED;
 	}
 
@@ -2938,6 +2940,7 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
 	unsigned int cp_pack_start_sum, cp_payload;
 	block_t user_block_count, valid_user_blocks;
 	block_t avail_node_count, valid_node_count;
+	unsigned int nat_blocks, nat_bits_bytes, nat_bits_blocks;
 	int i, j;
 
 	total = le32_to_cpu(raw_super->segment_count);
@@ -3058,6 +3061,17 @@ int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi)
 		return 1;
 	}
 
+	nat_blocks = nat_segs << log_blocks_per_seg;
+	nat_bits_bytes = nat_blocks / BITS_PER_BYTE;
+	nat_bits_blocks = F2FS_BLK_ALIGN((nat_bits_bytes << 1) + 8);
+	if (__is_set_ckpt_flags(ckpt, CP_NAT_BITS_FLAG) &&
+		(cp_payload + F2FS_CP_PACKS +
+		NR_CURSEG_PERSIST_TYPE + nat_bits_blocks >= blocks_per_seg)) {
+		f2fs_warn(sbi, "Insane cp_payload: %u, nat_bits_blocks: %u)",
+			  cp_payload, nat_bits_blocks);
+		return -EFSCORRUPTED;
+	}
+
 	if (unlikely(f2fs_cp_error(sbi))) {
 		f2fs_err(sbi, "A bug case: need to run fsck");
 		return 1;

From 9302a3c00cc65c873a16a768c7ed77cf10bba43e Mon Sep 17 00:00:00 2001
From: Stuart Hayes <stuart.w.hayes@gmail.com>
Date: Thu, 13 May 2021 03:03:14 +0530
Subject: [PATCH 0045/1750] PCI/portdrv: Enable Bandwidth Notification only if
 port supports it

commit 00823dcbdd415c868390feaca16f0265101efab4 upstream.

Previously we assumed that all Root Ports and Switch Downstream Ports
supported Link Bandwidth Notification.  Per spec, this is only required
for Ports supporting Links wider than x1 and/or multiple Link speeds
(PCIe r5.0, sec 7.5.3.6).

Because we assumed all Ports supported it, we tried to set up a Bandwidth
Notification IRQ, which failed for devices that don't support IRQs at all,
which meant pcieport didn't attach to the Port at all.

Check the Link Bandwidth Notification Capability bit and enable the service
only when the Port supports it.

[bhelgaas: commit log]
Fixes: e8303bb7a75c ("PCI/LINK: Report degraded links via link bandwidth notification")
Link: https://lore.kernel.org/r/20210512213314.7778-1-stuart.w.hayes@gmail.com
Signed-off-by: Stuart Hayes <stuart.w.hayes@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pcie/portdrv_core.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
index 50a9522ab07d..3779b264dbec 100644
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
@@ -260,8 +260,13 @@ static int get_port_device_capability(struct pci_dev *dev)
 		services |= PCIE_PORT_SERVICE_DPC;
 
 	if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM ||
-	    pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT)
-		services |= PCIE_PORT_SERVICE_BWNOTIF;
+	    pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) {
+		u32 linkcap;
+
+		pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &linkcap);
+		if (linkcap & PCI_EXP_LNKCAP_LBNC)
+			services |= PCIE_PORT_SERVICE_BWNOTIF;
+	}
 
 	return services;
 }

From 088a1052f7b010b2f5a9a5999a3c52721f356294 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Thu, 24 Jun 2021 19:14:18 +0200
Subject: [PATCH 0046/1750] PCI: Restrict ASMedia ASM1062 SATA Max Payload Size
 Supported
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit b12d93e9958e028856cbcb061b6e64728ca07755 upstream.

The ASMedia ASM1062 SATA controller advertises Max_Payload_Size_Supported
of 512, but in fact it cannot handle incoming TLPs with payload size of
512.

We discovered this issue on PCIe controllers capable of MPS = 512 (Aardvark
and DesignWare), where the issue presents itself as an External Abort.
Bjorn Helgaas says:

  Probably ASM1062 reports a Malformed TLP error when it receives a data
  payload of 512 bytes, and Aardvark, DesignWare, etc convert this to an
  arm64 External Abort. [1]

To avoid this problem, limit the ASM1062 Max Payload Size Supported to 256
bytes, so we set the Max Payload Size of devices that may send TLPs to the
ASM1062 to 256 or less.

[1] https://lore.kernel.org/linux-pci/20210601170907.GA1949035@bjorn-Precision-5520/
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212695
Link: https://lore.kernel.org/r/20210624171418.27194-2-kabel@kernel.org
Reported-by: Rötti <espressobinboardarmbiantempmailaddress@posteo.de>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Krzysztof Wilczyński <kw@linux.com>
Reviewed-by: Pali Rohár <pali@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index a91c944961ca..bad294c35251 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3252,6 +3252,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
 			PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE,
 			PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_ASMEDIA, 0x0612, fixup_mpss_256);
 
 /*
  * Intel 5000 and 5100 Memory controllers have an erratum with read completion

From 72f2be34327221ca790c27f9204ffec1329a1c12 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= <kw@linux.com>
Date: Thu, 29 Jul 2021 23:37:54 +0000
Subject: [PATCH 0047/1750] PCI: Return ~0 data on pciconfig_read()
 CAP_SYS_ADMIN failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit a8bd29bd49c4156ea0ec5a97812333e2aeef44e7 upstream.

The pciconfig_read() syscall reads PCI configuration space using
hardware-dependent config accessors.

If the read fails on PCI, most accessors don't return an error; they
pretend the read was successful and got ~0 data from the device, so the
syscall returns success with ~0 data in the buffer.

When the accessor does return an error, pciconfig_read() normally fills the
user's buffer with ~0 and returns an error in errno.  But after
e4585da22ad0 ("pci syscall.c: Switch to refcounting API"), we don't fill
the buffer with ~0 for the EPERM "user lacks CAP_SYS_ADMIN" error.

Userspace may rely on the ~0 data to detect errors, but after e4585da22ad0,
that would not detect CAP_SYS_ADMIN errors.

Restore the original behaviour of filling the buffer with ~0 when the
CAP_SYS_ADMIN check fails.

[bhelgaas: commit log, fold in Nathan's fix
https://lore.kernel.org/r/20210803200836.500658-1-nathan@kernel.org]
Fixes: e4585da22ad0 ("pci syscall.c: Switch to refcounting API")
Link: https://lore.kernel.org/r/20210729233755.1509616-1-kw@linux.com
Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/syscall.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
index 8b003c890b87..c9f03418e71e 100644
--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -22,8 +22,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn,
 	long err;
 	int cfg_ret;
 
+	err = -EPERM;
+	dev = NULL;
 	if (!capable(CAP_SYS_ADMIN))
-		return -EPERM;
+		goto error;
 
 	err = -ENODEV;
 	dev = pci_get_domain_bus_and_slot(0, bus, dfn);

From df23bd40ed8832a2730b92122c389ecdf4813aee Mon Sep 17 00:00:00 2001
From: Hyun Kwon <hyun.kwon@xilinx.com>
Date: Fri, 25 Jun 2021 12:48:23 +0200
Subject: [PATCH 0048/1750] PCI: xilinx-nwl: Enable the clock through CCF

commit de0a01f5296651d3a539f2d23d0db8f359483696 upstream.

Enable PCIe reference clock. There is no remove function that's why
this should be enough for simple operation.
Normally this clock is enabled by default by firmware but there are
usecases where this clock should be enabled by driver itself.
It is also good that PCIe clock is recorded in a clock framework.

Link: https://lore.kernel.org/r/ee6997a08fab582b1c6de05f8be184f3fe8d5357.1624618100.git.michal.simek@xilinx.com
Fixes: ab597d35ef11 ("PCI: xilinx-nwl: Add support for Xilinx NWL PCIe Host Controller")
Signed-off-by: Hyun Kwon <hyun.kwon@xilinx.com>
Signed-off-by: Bharat Kumar Gogada <bharat.kumar.gogada@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c
index f3cf7d61924f..2a9fe7c3aef9 100644
--- a/drivers/pci/controller/pcie-xilinx-nwl.c
+++ b/drivers/pci/controller/pcie-xilinx-nwl.c
@@ -6,6 +6,7 @@
  * (C) Copyright 2014 - 2015, Xilinx, Inc.
  */
 
+#include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
@@ -168,6 +169,7 @@ struct nwl_pcie {
 	u8 last_busno;
 	struct nwl_msi msi;
 	struct irq_domain *legacy_irq_domain;
+	struct clk *clk;
 	raw_spinlock_t leg_mask_lock;
 };
 
@@ -825,6 +827,16 @@ static int nwl_pcie_probe(struct platform_device *pdev)
 		return err;
 	}
 
+	pcie->clk = devm_clk_get(dev, NULL);
+	if (IS_ERR(pcie->clk))
+		return PTR_ERR(pcie->clk);
+
+	err = clk_prepare_enable(pcie->clk);
+	if (err) {
+		dev_err(dev, "can't enable PCIe ref clock\n");
+		return err;
+	}
+
 	err = nwl_pcie_bridge_init(pcie);
 	if (err) {
 		dev_err(dev, "HW Initialization failed\n");

From fa3c15ccf2ea0dc108052403cb07ae386e8f5989 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 24 Jun 2021 23:55:45 +0200
Subject: [PATCH 0049/1750] PCI: aardvark: Configure PCIe resources from
 'ranges' DT property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 64f160e19e9264a7f6d89c516baae1473b6f8359 upstream.

In commit 6df6ba974a55 ("PCI: aardvark: Remove PCIe outbound window
configuration") was removed aardvark PCIe outbound window configuration and
commit description said that was recommended solution by HW designers.

But that commit completely removed support for configuring PCIe IO
resources without removing PCIe IO 'ranges' from DTS files. After that
commit PCIe IO space started to be treated as PCIe MEM space and accessing
it just caused kernel crash.

Moreover implementation of PCIe outbound windows prior that commit was
incorrect. It completely ignored offset between CPU address and PCIe bus
address and expected that in DTS is CPU address always same as PCIe bus
address without doing any checks. Also it completely ignored size of every
PCIe resource specified in 'ranges' DTS property and expected that every
PCIe resource has size 128 MB (also for PCIe IO range). Again without any
check. Apparently none of PCIe resource has in DTS specified size of 128
MB. So it was completely broken and thanks to how aardvark mask works,
configuration was completely ignored.

This patch reverts back support for PCIe outbound window configuration but
implementation is a new without issues mentioned above. PCIe outbound
window is required when DTS specify in 'ranges' property non-zero offset
between CPU and PCIe address space. To address recommendation by HW
designers as specified in commit description of 6df6ba974a55, set default
outbound parameters as PCIe MEM access without translation and therefore
for this PCIe 'ranges' it is not needed to configure PCIe outbound window.
For PCIe IO space is needed to configure aardvark PCIe outbound window.

This patch fixes kernel crash when trying to access PCIe IO space.

Link: https://lore.kernel.org/r/20210624215546.4015-2-pali@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org # 6df6ba974a55 ("PCI: aardvark: Remove PCIe outbound window configuration")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 195 +++++++++++++++++++++++++-
 1 file changed, 194 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index b1b41b61e0bd..bd9f31ff5868 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -117,6 +117,46 @@
 #define PCIE_MSI_MASK_REG			(CONTROL_BASE_ADDR + 0x5C)
 #define PCIE_MSI_PAYLOAD_REG			(CONTROL_BASE_ADDR + 0x9C)
 
+/* PCIe window configuration */
+#define OB_WIN_BASE_ADDR			0x4c00
+#define OB_WIN_BLOCK_SIZE			0x20
+#define OB_WIN_COUNT				8
+#define OB_WIN_REG_ADDR(win, offset)		(OB_WIN_BASE_ADDR + \
+						 OB_WIN_BLOCK_SIZE * (win) + \
+						 (offset))
+#define OB_WIN_MATCH_LS(win)			OB_WIN_REG_ADDR(win, 0x00)
+#define     OB_WIN_ENABLE			BIT(0)
+#define OB_WIN_MATCH_MS(win)			OB_WIN_REG_ADDR(win, 0x04)
+#define OB_WIN_REMAP_LS(win)			OB_WIN_REG_ADDR(win, 0x08)
+#define OB_WIN_REMAP_MS(win)			OB_WIN_REG_ADDR(win, 0x0c)
+#define OB_WIN_MASK_LS(win)			OB_WIN_REG_ADDR(win, 0x10)
+#define OB_WIN_MASK_MS(win)			OB_WIN_REG_ADDR(win, 0x14)
+#define OB_WIN_ACTIONS(win)			OB_WIN_REG_ADDR(win, 0x18)
+#define OB_WIN_DEFAULT_ACTIONS			(OB_WIN_ACTIONS(OB_WIN_COUNT-1) + 0x4)
+#define     OB_WIN_FUNC_NUM_MASK		GENMASK(31, 24)
+#define     OB_WIN_FUNC_NUM_SHIFT		24
+#define     OB_WIN_FUNC_NUM_ENABLE		BIT(23)
+#define     OB_WIN_BUS_NUM_BITS_MASK		GENMASK(22, 20)
+#define     OB_WIN_BUS_NUM_BITS_SHIFT		20
+#define     OB_WIN_MSG_CODE_ENABLE		BIT(22)
+#define     OB_WIN_MSG_CODE_MASK		GENMASK(21, 14)
+#define     OB_WIN_MSG_CODE_SHIFT		14
+#define     OB_WIN_MSG_PAYLOAD_LEN		BIT(12)
+#define     OB_WIN_ATTR_ENABLE			BIT(11)
+#define     OB_WIN_ATTR_TC_MASK			GENMASK(10, 8)
+#define     OB_WIN_ATTR_TC_SHIFT		8
+#define     OB_WIN_ATTR_RELAXED			BIT(7)
+#define     OB_WIN_ATTR_NOSNOOP			BIT(6)
+#define     OB_WIN_ATTR_POISON			BIT(5)
+#define     OB_WIN_ATTR_IDO			BIT(4)
+#define     OB_WIN_TYPE_MASK			GENMASK(3, 0)
+#define     OB_WIN_TYPE_SHIFT			0
+#define     OB_WIN_TYPE_MEM			0x0
+#define     OB_WIN_TYPE_IO			0x4
+#define     OB_WIN_TYPE_CONFIG_TYPE0		0x8
+#define     OB_WIN_TYPE_CONFIG_TYPE1		0x9
+#define     OB_WIN_TYPE_MSG			0xc
+
 /* LMI registers base address and register offsets */
 #define LMI_BASE_ADDR				0x6000
 #define CFG_REG					(LMI_BASE_ADDR + 0x0)
@@ -187,6 +227,13 @@
 struct advk_pcie {
 	struct platform_device *pdev;
 	void __iomem *base;
+	struct {
+		phys_addr_t match;
+		phys_addr_t remap;
+		phys_addr_t mask;
+		u32 actions;
+	} wins[OB_WIN_COUNT];
+	u8 wins_count;
 	struct irq_domain *irq_domain;
 	struct irq_chip irq_chip;
 	struct irq_domain *msi_domain;
@@ -366,9 +413,39 @@ static void advk_pcie_train_link(struct advk_pcie *pcie)
 	dev_err(dev, "link never came up\n");
 }
 
+/*
+ * Set PCIe address window register which could be used for memory
+ * mapping.
+ */
+static void advk_pcie_set_ob_win(struct advk_pcie *pcie, u8 win_num,
+				 phys_addr_t match, phys_addr_t remap,
+				 phys_addr_t mask, u32 actions)
+{
+	advk_writel(pcie, OB_WIN_ENABLE |
+			  lower_32_bits(match), OB_WIN_MATCH_LS(win_num));
+	advk_writel(pcie, upper_32_bits(match), OB_WIN_MATCH_MS(win_num));
+	advk_writel(pcie, lower_32_bits(remap), OB_WIN_REMAP_LS(win_num));
+	advk_writel(pcie, upper_32_bits(remap), OB_WIN_REMAP_MS(win_num));
+	advk_writel(pcie, lower_32_bits(mask), OB_WIN_MASK_LS(win_num));
+	advk_writel(pcie, upper_32_bits(mask), OB_WIN_MASK_MS(win_num));
+	advk_writel(pcie, actions, OB_WIN_ACTIONS(win_num));
+}
+
+static void advk_pcie_disable_ob_win(struct advk_pcie *pcie, u8 win_num)
+{
+	advk_writel(pcie, 0, OB_WIN_MATCH_LS(win_num));
+	advk_writel(pcie, 0, OB_WIN_MATCH_MS(win_num));
+	advk_writel(pcie, 0, OB_WIN_REMAP_LS(win_num));
+	advk_writel(pcie, 0, OB_WIN_REMAP_MS(win_num));
+	advk_writel(pcie, 0, OB_WIN_MASK_LS(win_num));
+	advk_writel(pcie, 0, OB_WIN_MASK_MS(win_num));
+	advk_writel(pcie, 0, OB_WIN_ACTIONS(win_num));
+}
+
 static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 {
 	u32 reg;
+	int i;
 
 	/* Enable TX */
 	reg = advk_readl(pcie, PCIE_CORE_REF_CLK_REG);
@@ -447,15 +524,51 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 	reg = PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK);
 	advk_writel(pcie, reg, HOST_CTRL_INT_MASK_REG);
 
+	/*
+	 * Enable AXI address window location generation:
+	 * When it is enabled, the default outbound window
+	 * configurations (Default User Field: 0xD0074CFC)
+	 * are used to transparent address translation for
+	 * the outbound transactions. Thus, PCIe address
+	 * windows are not required for transparent memory
+	 * access when default outbound window configuration
+	 * is set for memory access.
+	 */
 	reg = advk_readl(pcie, PCIE_CORE_CTRL2_REG);
 	reg |= PCIE_CORE_CTRL2_OB_WIN_ENABLE;
 	advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG);
 
-	/* Bypass the address window mapping for PIO */
+	/*
+	 * Set memory access in Default User Field so it
+	 * is not required to configure PCIe address for
+	 * transparent memory access.
+	 */
+	advk_writel(pcie, OB_WIN_TYPE_MEM, OB_WIN_DEFAULT_ACTIONS);
+
+	/*
+	 * Bypass the address window mapping for PIO:
+	 * Since PIO access already contains all required
+	 * info over AXI interface by PIO registers, the
+	 * address window is not required.
+	 */
 	reg = advk_readl(pcie, PIO_CTRL);
 	reg |= PIO_CTRL_ADDR_WIN_DISABLE;
 	advk_writel(pcie, reg, PIO_CTRL);
 
+	/*
+	 * Configure PCIe address windows for non-memory or
+	 * non-transparent access as by default PCIe uses
+	 * transparent memory access.
+	 */
+	for (i = 0; i < pcie->wins_count; i++)
+		advk_pcie_set_ob_win(pcie, i,
+				     pcie->wins[i].match, pcie->wins[i].remap,
+				     pcie->wins[i].mask, pcie->wins[i].actions);
+
+	/* Disable remaining PCIe outbound windows */
+	for (i = pcie->wins_count; i < OB_WIN_COUNT; i++)
+		advk_pcie_disable_ob_win(pcie, i);
+
 	advk_pcie_train_link(pcie);
 
 	/*
@@ -1162,6 +1275,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
 	struct device *dev = &pdev->dev;
 	struct advk_pcie *pcie;
 	struct pci_host_bridge *bridge;
+	struct resource_entry *entry;
 	int ret, irq;
 
 	bridge = devm_pci_alloc_host_bridge(dev, sizeof(struct advk_pcie));
@@ -1172,6 +1286,80 @@ static int advk_pcie_probe(struct platform_device *pdev)
 	pcie->pdev = pdev;
 	platform_set_drvdata(pdev, pcie);
 
+	resource_list_for_each_entry(entry, &bridge->windows) {
+		resource_size_t start = entry->res->start;
+		resource_size_t size = resource_size(entry->res);
+		unsigned long type = resource_type(entry->res);
+		u64 win_size;
+
+		/*
+		 * Aardvark hardware allows to configure also PCIe window
+		 * for config type 0 and type 1 mapping, but driver uses
+		 * only PIO for issuing configuration transfers which does
+		 * not use PCIe window configuration.
+		 */
+		if (type != IORESOURCE_MEM && type != IORESOURCE_MEM_64 &&
+		    type != IORESOURCE_IO)
+			continue;
+
+		/*
+		 * Skip transparent memory resources. Default outbound access
+		 * configuration is set to transparent memory access so it
+		 * does not need window configuration.
+		 */
+		if ((type == IORESOURCE_MEM || type == IORESOURCE_MEM_64) &&
+		    entry->offset == 0)
+			continue;
+
+		/*
+		 * The n-th PCIe window is configured by tuple (match, remap, mask)
+		 * and an access to address A uses this window if A matches the
+		 * match with given mask.
+		 * So every PCIe window size must be a power of two and every start
+		 * address must be aligned to window size. Minimal size is 64 KiB
+		 * because lower 16 bits of mask must be zero. Remapped address
+		 * may have set only bits from the mask.
+		 */
+		while (pcie->wins_count < OB_WIN_COUNT && size > 0) {
+			/* Calculate the largest aligned window size */
+			win_size = (1ULL << (fls64(size)-1)) |
+				   (start ? (1ULL << __ffs64(start)) : 0);
+			win_size = 1ULL << __ffs64(win_size);
+			if (win_size < 0x10000)
+				break;
+
+			dev_dbg(dev,
+				"Configuring PCIe window %d: [0x%llx-0x%llx] as %lu\n",
+				pcie->wins_count, (unsigned long long)start,
+				(unsigned long long)start + win_size, type);
+
+			if (type == IORESOURCE_IO) {
+				pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_IO;
+				pcie->wins[pcie->wins_count].match = pci_pio_to_address(start);
+			} else {
+				pcie->wins[pcie->wins_count].actions = OB_WIN_TYPE_MEM;
+				pcie->wins[pcie->wins_count].match = start;
+			}
+			pcie->wins[pcie->wins_count].remap = start - entry->offset;
+			pcie->wins[pcie->wins_count].mask = ~(win_size - 1);
+
+			if (pcie->wins[pcie->wins_count].remap & (win_size - 1))
+				break;
+
+			start += win_size;
+			size -= win_size;
+			pcie->wins_count++;
+		}
+
+		if (size > 0) {
+			dev_err(&pcie->pdev->dev,
+				"Invalid PCIe region [0x%llx-0x%llx]\n",
+				(unsigned long long)entry->res->start,
+				(unsigned long long)entry->res->end + 1);
+			return -EINVAL;
+		}
+	}
+
 	pcie->base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(pcie->base))
 		return PTR_ERR(pcie->base);
@@ -1252,6 +1440,7 @@ static int advk_pcie_remove(struct platform_device *pdev)
 {
 	struct advk_pcie *pcie = platform_get_drvdata(pdev);
 	struct pci_host_bridge *bridge = pci_host_bridge_from_priv(pcie);
+	int i;
 
 	pci_lock_rescan_remove();
 	pci_stop_root_bus(bridge->bus);
@@ -1261,6 +1450,10 @@ static int advk_pcie_remove(struct platform_device *pdev)
 	advk_pcie_remove_msi_irq_domain(pcie);
 	advk_pcie_remove_irq_domain(pcie);
 
+	/* Disable outbound address windows mapping */
+	for (i = 0; i < OB_WIN_COUNT; i++)
+		advk_pcie_disable_ob_win(pcie, i);
+
 	return 0;
 }
 

From 9d6090575406e504d4143b171482b8e5591e85ef Mon Sep 17 00:00:00 2001
From: Jianjun Wang <jianjun.wang@mediatek.com>
Date: Tue, 20 Apr 2021 14:17:18 +0800
Subject: [PATCH 0050/1750] PCI: Export pci_pio_to_address() for module use

commit 9cc742078c9a90cdd4cf131e9f760e6965df9048 upstream.

This interface will be used by PCI host drivers for PIO translation,
export it to support compiling those drivers as kernel modules.

Link: https://lore.kernel.org/r/20210420061723.989-3-jianjun.wang@mediatek.com
Signed-off-by: Jianjun Wang <jianjun.wang@mediatek.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 29f5d699fa06..05a84f095fe7 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -4043,6 +4043,7 @@ phys_addr_t pci_pio_to_address(unsigned long pio)
 
 	return address;
 }
+EXPORT_SYMBOL_GPL(pci_pio_to_address);
 
 unsigned long __weak pci_address_to_pio(phys_addr_t address)
 {

From b50db4c02f45a50a98de8ac207591360400fb458 Mon Sep 17 00:00:00 2001
From: Evan Wang <xswang@marvell.com>
Date: Thu, 22 Jul 2021 16:40:38 +0200
Subject: [PATCH 0051/1750] PCI: aardvark: Fix checking for PIO status
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit fcb461e2bc8b83b7eaca20cb2221e8b940f2189c upstream.

There is an issue that when PCIe switch is connected to an Armada 3700
board, there will be lots of warnings about PIO errors when reading the
config space. According to Aardvark PIO read and write sequence in HW
specification, the current way to check PIO status has the following
issues:

1) For PIO read operation, it reports the error message, which should be
   avoided according to HW specification.

2) For PIO read and write operations, it only checks PIO operation complete
   status, which is not enough, and error status should also be checked.

This patch aligns the code with Aardvark PIO read and write sequence in HW
specification on PIO status check and fix the warnings when reading config
space.

[pali: Fix CRS handling when CRSSVE is not enabled]

Link: https://lore.kernel.org/r/20210722144041.12661-2-pali@kernel.org
Tested-by: Victor Gu <xigu@marvell.com>
Signed-off-by: Evan Wang <xswang@marvell.com>
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Victor Gu <xigu@marvell.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org # b1bd5714472c ("PCI: aardvark: Indicate error in 'val' when config read fails")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 62 +++++++++++++++++++++++----
 1 file changed, 54 insertions(+), 8 deletions(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index bd9f31ff5868..85c7d06a6d83 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -57,6 +57,7 @@
 #define   PIO_COMPLETION_STATUS_CRS		2
 #define   PIO_COMPLETION_STATUS_CA		4
 #define   PIO_NON_POSTED_REQ			BIT(10)
+#define   PIO_ERR_STATUS			BIT(11)
 #define PIO_ADDR_LS				(PIO_BASE_ADDR + 0x8)
 #define PIO_ADDR_MS				(PIO_BASE_ADDR + 0xc)
 #define PIO_WR_DATA				(PIO_BASE_ADDR + 0x10)
@@ -585,7 +586,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 	advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG);
 }
 
-static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
+static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)
 {
 	struct device *dev = &pcie->pdev->dev;
 	u32 reg;
@@ -596,14 +597,49 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
 	status = (reg & PIO_COMPLETION_STATUS_MASK) >>
 		PIO_COMPLETION_STATUS_SHIFT;
 
-	if (!status)
-		return;
-
+	/*
+	 * According to HW spec, the PIO status check sequence as below:
+	 * 1) even if COMPLETION_STATUS(bit9:7) indicates successful,
+	 *    it still needs to check Error Status(bit11), only when this bit
+	 *    indicates no error happen, the operation is successful.
+	 * 2) value Unsupported Request(1) of COMPLETION_STATUS(bit9:7) only
+	 *    means a PIO write error, and for PIO read it is successful with
+	 *    a read value of 0xFFFFFFFF.
+	 * 3) value Completion Retry Status(CRS) of COMPLETION_STATUS(bit9:7)
+	 *    only means a PIO write error, and for PIO read it is successful
+	 *    with a read value of 0xFFFF0001.
+	 * 4) value Completer Abort (CA) of COMPLETION_STATUS(bit9:7) means
+	 *    error for both PIO read and PIO write operation.
+	 * 5) other errors are indicated as 'unknown'.
+	 */
 	switch (status) {
+	case PIO_COMPLETION_STATUS_OK:
+		if (reg & PIO_ERR_STATUS) {
+			strcomp_status = "COMP_ERR";
+			break;
+		}
+		/* Get the read result */
+		if (val)
+			*val = advk_readl(pcie, PIO_RD_DATA);
+		/* No error */
+		strcomp_status = NULL;
+		break;
 	case PIO_COMPLETION_STATUS_UR:
 		strcomp_status = "UR";
 		break;
 	case PIO_COMPLETION_STATUS_CRS:
+		/* PCIe r4.0, sec 2.3.2, says:
+		 * If CRS Software Visibility is not enabled, the Root Complex
+		 * must re-issue the Configuration Request as a new Request.
+		 * A Root Complex implementation may choose to limit the number
+		 * of Configuration Request/CRS Completion Status loops before
+		 * determining that something is wrong with the target of the
+		 * Request and taking appropriate action, e.g., complete the
+		 * Request to the host as a failed transaction.
+		 *
+		 * To simplify implementation do not re-issue the Configuration
+		 * Request and complete the Request as a failed transaction.
+		 */
 		strcomp_status = "CRS";
 		break;
 	case PIO_COMPLETION_STATUS_CA:
@@ -614,6 +650,9 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
 		break;
 	}
 
+	if (!strcomp_status)
+		return 0;
+
 	if (reg & PIO_NON_POSTED_REQ)
 		str_posted = "Non-posted";
 	else
@@ -621,6 +660,8 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie)
 
 	dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
 		str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS));
+
+	return -EFAULT;
 }
 
 static int advk_pcie_wait_pio(struct advk_pcie *pcie)
@@ -858,10 +899,13 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
 		return PCIBIOS_SET_FAILED;
 	}
 
-	advk_pcie_check_pio_status(pcie);
+	/* Check PIO status and get the read result */
+	ret = advk_pcie_check_pio_status(pcie, val);
+	if (ret < 0) {
+		*val = 0xffffffff;
+		return PCIBIOS_SET_FAILED;
+	}
 
-	/* Get the read result */
-	*val = advk_readl(pcie, PIO_RD_DATA);
 	if (size == 1)
 		*val = (*val >> (8 * (where & 3))) & 0xff;
 	else if (size == 2)
@@ -925,7 +969,9 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
 	if (ret < 0)
 		return PCIBIOS_SET_FAILED;
 
-	advk_pcie_check_pio_status(pcie);
+	ret = advk_pcie_check_pio_status(pcie, NULL);
+	if (ret < 0)
+		return PCIBIOS_SET_FAILED;
 
 	return PCIBIOS_SUCCESSFUL;
 }

From 4e89aea738b5db125471c838f4544b64fd4b3776 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Fri, 20 Aug 2021 17:50:20 +0200
Subject: [PATCH 0052/1750] PCI: aardvark: Fix masking and unmasking legacy
 INTx interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit d212dcee27c1f89517181047e5485fcbba4a25c2 upstream.

irq_mask and irq_unmask callbacks need to be properly guarded by raw spin
locks as masking/unmasking procedure needs atomic read-modify-write
operation on hardware register.

Link: https://lore.kernel.org/r/20210820155020.3000-1-pali@kernel.org
Reported-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 85c7d06a6d83..88e19ad54f64 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -237,6 +237,7 @@ struct advk_pcie {
 	u8 wins_count;
 	struct irq_domain *irq_domain;
 	struct irq_chip irq_chip;
+	raw_spinlock_t irq_lock;
 	struct irq_domain *msi_domain;
 	struct irq_domain *msi_inner_domain;
 	struct irq_chip msi_bottom_irq_chip;
@@ -1045,22 +1046,28 @@ static void advk_pcie_irq_mask(struct irq_data *d)
 {
 	struct advk_pcie *pcie = d->domain->host_data;
 	irq_hw_number_t hwirq = irqd_to_hwirq(d);
+	unsigned long flags;
 	u32 mask;
 
+	raw_spin_lock_irqsave(&pcie->irq_lock, flags);
 	mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
 	mask |= PCIE_ISR1_INTX_ASSERT(hwirq);
 	advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
+	raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
 }
 
 static void advk_pcie_irq_unmask(struct irq_data *d)
 {
 	struct advk_pcie *pcie = d->domain->host_data;
 	irq_hw_number_t hwirq = irqd_to_hwirq(d);
+	unsigned long flags;
 	u32 mask;
 
+	raw_spin_lock_irqsave(&pcie->irq_lock, flags);
 	mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
 	mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq);
 	advk_writel(pcie, mask, PCIE_ISR1_MASK_REG);
+	raw_spin_unlock_irqrestore(&pcie->irq_lock, flags);
 }
 
 static int advk_pcie_irq_map(struct irq_domain *h,
@@ -1144,6 +1151,8 @@ static int advk_pcie_init_irq_domain(struct advk_pcie *pcie)
 	struct irq_chip *irq_chip;
 	int ret = 0;
 
+	raw_spin_lock_init(&pcie->irq_lock);
+
 	pcie_intc_node =  of_get_next_child(node, NULL);
 	if (!pcie_intc_node) {
 		dev_err(dev, "No PCIe Intc node found\n");

From 70fd9363673bcf3fafcb1e5075426602496a67a0 Mon Sep 17 00:00:00 2001
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date: Tue, 29 Jun 2021 11:25:50 -0700
Subject: [PATCH 0053/1750] HID: input: do not report stylus battery state as
 "full"

[ Upstream commit f4abaa9eebde334045ed6ac4e564d050f1df3013 ]

The power supply states of discharging, charging, full, etc, represent
state of charging, not the capacity level of the battery (for which
we have a separate property). Current HID usage tables to not allow
for expressing charging state of the batteries found in generic
styli, so we should simply assume that the battery is discharging
even if current capacity is at 100% when battery strength reporting
is done via HID interface. In fact, we were doing just that before
commit 581c4484769e.

This change helps UIs to not mis-represent fully charged batteries in
styli as being charging/topping-off.

Fixes: 581c4484769e ("HID: input: map digitizer battery usage")
Reported-by: Kenneth Albanowski <kenalba@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-input.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index d1ab2dccf6fd..580d378342c4 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -415,8 +415,6 @@ static int hidinput_get_battery_property(struct power_supply *psy,
 
 		if (dev->battery_status == HID_BATTERY_UNKNOWN)
 			val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
-		else if (dev->battery_capacity == 100)
-			val->intval = POWER_SUPPLY_STATUS_FULL;
 		else
 			val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
 		break;

From 2d586a3f5b7ec2f5a939db4abc9aa053c237545c Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Mon, 19 Jul 2021 16:46:47 +0800
Subject: [PATCH 0054/1750] f2fs: quota: fix potential deadlock

[ Upstream commit 9de71ede81e6d1a111fdd868b2d78d459fa77f80 ]

xfstest generic/587 reports a deadlock issue as below:

======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc1 #69 Not tainted
------------------------------------------------------
repquota/8606 is trying to acquire lock:
ffff888022ac9320 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}, at: f2fs_quota_sync+0x207/0x300 [f2fs]

but task is already holding lock:
ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (&sbi->quota_sem){.+.+}-{3:3}:
       __lock_acquire+0x648/0x10b0
       lock_acquire+0x128/0x470
       down_read+0x3b/0x2a0
       f2fs_quota_sync+0x59/0x300 [f2fs]
       f2fs_quota_on+0x48/0x100 [f2fs]
       do_quotactl+0x5e3/0xb30
       __x64_sys_quotactl+0x23a/0x4e0
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #1 (&sbi->cp_rwsem){++++}-{3:3}:
       __lock_acquire+0x648/0x10b0
       lock_acquire+0x128/0x470
       down_read+0x3b/0x2a0
       f2fs_unlink+0x353/0x670 [f2fs]
       vfs_unlink+0x1c7/0x380
       do_unlinkat+0x413/0x4b0
       __x64_sys_unlinkat+0x50/0xb0
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #0 (&sb->s_type->i_mutex_key#18){+.+.}-{3:3}:
       check_prev_add+0xdc/0xb30
       validate_chain+0xa67/0xb20
       __lock_acquire+0x648/0x10b0
       lock_acquire+0x128/0x470
       down_write+0x39/0xc0
       f2fs_quota_sync+0x207/0x300 [f2fs]
       do_quotactl+0xaff/0xb30
       __x64_sys_quotactl+0x23a/0x4e0
       do_syscall_64+0x3b/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

other info that might help us debug this:

Chain exists of:
  &sb->s_type->i_mutex_key#18 --> &sbi->cp_rwsem --> &sbi->quota_sem

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&sbi->quota_sem);
                               lock(&sbi->cp_rwsem);
                               lock(&sbi->quota_sem);
  lock(&sb->s_type->i_mutex_key#18);

 *** DEADLOCK ***

3 locks held by repquota/8606:
 #0: ffff88801efac0e0 (&type->s_umount_key#53){++++}-{3:3}, at: user_get_super+0xd9/0x190
 #1: ffff8880084bc380 (&sbi->cp_rwsem){++++}-{3:3}, at: f2fs_quota_sync+0x3e/0x300 [f2fs]
 #2: ffff8880084bcde8 (&sbi->quota_sem){.+.+}-{3:3}, at: f2fs_quota_sync+0x59/0x300 [f2fs]

stack backtrace:
CPU: 6 PID: 8606 Comm: repquota Not tainted 5.14.0-rc1 #69
Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
Call Trace:
 dump_stack_lvl+0xce/0x134
 dump_stack+0x17/0x20
 print_circular_bug.isra.0.cold+0x239/0x253
 check_noncircular+0x1be/0x1f0
 check_prev_add+0xdc/0xb30
 validate_chain+0xa67/0xb20
 __lock_acquire+0x648/0x10b0
 lock_acquire+0x128/0x470
 down_write+0x39/0xc0
 f2fs_quota_sync+0x207/0x300 [f2fs]
 do_quotactl+0xaff/0xb30
 __x64_sys_quotactl+0x23a/0x4e0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f883b0b4efe

The root cause is ABBA deadlock of inode lock and cp_rwsem,
reorder locks in f2fs_quota_sync() as below to fix this issue:
- lock inode
- lock cp_rwsem
- lock quota_sem

Fixes: db6ec53b7e03 ("f2fs: add a rw_sem to cover quota flag changes")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/super.c | 88 ++++++++++++++++++++++++++++---------------------
 1 file changed, 50 insertions(+), 38 deletions(-)

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index dad91b1f3849..de543168b370 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2206,6 +2206,33 @@ static int f2fs_enable_quotas(struct super_block *sb)
 	return 0;
 }
 
+static int f2fs_quota_sync_file(struct f2fs_sb_info *sbi, int type)
+{
+	struct quota_info *dqopt = sb_dqopt(sbi->sb);
+	struct address_space *mapping = dqopt->files[type]->i_mapping;
+	int ret = 0;
+
+	ret = dquot_writeback_dquots(sbi->sb, type);
+	if (ret)
+		goto out;
+
+	ret = filemap_fdatawrite(mapping);
+	if (ret)
+		goto out;
+
+	/* if we are using journalled quota */
+	if (is_journalled_quota(sbi))
+		goto out;
+
+	ret = filemap_fdatawait(mapping);
+
+	truncate_inode_pages(&dqopt->files[type]->i_data, 0);
+out:
+	if (ret)
+		set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
+	return ret;
+}
+
 int f2fs_quota_sync(struct super_block *sb, int type)
 {
 	struct f2fs_sb_info *sbi = F2FS_SB(sb);
@@ -2213,57 +2240,42 @@ int f2fs_quota_sync(struct super_block *sb, int type)
 	int cnt;
 	int ret;
 
-	/*
-	 * do_quotactl
-	 *  f2fs_quota_sync
-	 *  down_read(quota_sem)
-	 *  dquot_writeback_dquots()
-	 *  f2fs_dquot_commit
-	 *                            block_operation
-	 *                            down_read(quota_sem)
-	 */
-	f2fs_lock_op(sbi);
-
-	down_read(&sbi->quota_sem);
-	ret = dquot_writeback_dquots(sb, type);
-	if (ret)
-		goto out;
-
 	/*
 	 * Now when everything is written we can discard the pagecache so
 	 * that userspace sees the changes.
 	 */
 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
-		struct address_space *mapping;
 
 		if (type != -1 && cnt != type)
 			continue;
-		if (!sb_has_quota_active(sb, cnt))
-			continue;
 
-		mapping = dqopt->files[cnt]->i_mapping;
-
-		ret = filemap_fdatawrite(mapping);
-		if (ret)
-			goto out;
-
-		/* if we are using journalled quota */
-		if (is_journalled_quota(sbi))
-			continue;
-
-		ret = filemap_fdatawait(mapping);
-		if (ret)
-			set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
+		if (!sb_has_quota_active(sb, type))
+			return 0;
 
 		inode_lock(dqopt->files[cnt]);
-		truncate_inode_pages(&dqopt->files[cnt]->i_data, 0);
+
+		/*
+		 * do_quotactl
+		 *  f2fs_quota_sync
+		 *  down_read(quota_sem)
+		 *  dquot_writeback_dquots()
+		 *  f2fs_dquot_commit
+		 *			      block_operation
+		 *			      down_read(quota_sem)
+		 */
+		f2fs_lock_op(sbi);
+		down_read(&sbi->quota_sem);
+
+		ret = f2fs_quota_sync_file(sbi, cnt);
+
+		up_read(&sbi->quota_sem);
+		f2fs_unlock_op(sbi);
+
 		inode_unlock(dqopt->files[cnt]);
+
+		if (ret)
+			break;
 	}
-out:
-	if (ret)
-		set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
-	up_read(&sbi->quota_sem);
-	f2fs_unlock_op(sbi);
 	return ret;
 }
 

From 782ceaba977c4ef5b8e124f939c6e44524c18560 Mon Sep 17 00:00:00 2001
From: Zhaoyu Liu <zackary.liu.pro@gmail.com>
Date: Sun, 20 Dec 2020 16:37:19 +0800
Subject: [PATCH 0055/1750] pinctrl: remove empty lines in pinctrl subsystem

[ Upstream commit 43878eb7c83d3335af7737dcce1fa79071065dfe ]

Remove all empty lines at the end of functions in pinctrl subsystem,
and make the code neat.

Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Zhaoyu Liu <zackaryliu@yeah.net>
Link: https://lore.kernel.org/r/X98NP6NFK1Afzrgd@manjaro
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/actions/pinctrl-owl.c         | 1 -
 drivers/pinctrl/core.c                        | 1 -
 drivers/pinctrl/freescale/pinctrl-imx1-core.c | 1 -
 drivers/pinctrl/mvebu/pinctrl-armada-37xx.c   | 1 -
 drivers/pinctrl/pinctrl-at91.c                | 1 -
 drivers/pinctrl/pinctrl-st.c                  | 1 -
 drivers/pinctrl/pinctrl-sx150x.c              | 1 -
 drivers/pinctrl/qcom/pinctrl-sdm845.c         | 1 -
 drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c       | 1 -
 drivers/pinctrl/renesas/pfc-r8a77950.c        | 1 -
 drivers/pinctrl/renesas/pfc-r8a77951.c        | 1 -
 drivers/pinctrl/renesas/pfc-r8a7796.c         | 1 -
 drivers/pinctrl/renesas/pfc-r8a77965.c        | 1 -
 13 files changed, 13 deletions(-)

diff --git a/drivers/pinctrl/actions/pinctrl-owl.c b/drivers/pinctrl/actions/pinctrl-owl.c
index 903a4baf3846..c8b3e396ea27 100644
--- a/drivers/pinctrl/actions/pinctrl-owl.c
+++ b/drivers/pinctrl/actions/pinctrl-owl.c
@@ -444,7 +444,6 @@ static int owl_group_config_get(struct pinctrl_dev *pctrldev,
 	*config = pinconf_to_config_packed(param, arg);
 
 	return ret;
-
 }
 
 static int owl_group_config_set(struct pinctrl_dev *pctrldev,
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 20b477cd5a30..6e6825d17a1d 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -2119,7 +2119,6 @@ struct pinctrl_dev *pinctrl_register(struct pinctrl_desc *pctldesc,
 		return ERR_PTR(error);
 
 	return pctldev;
-
 }
 EXPORT_SYMBOL_GPL(pinctrl_register);
 
diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
index 08d110078c43..70186448d2f4 100644
--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
@@ -290,7 +290,6 @@ static const struct pinctrl_ops imx1_pctrl_ops = {
 	.pin_dbg_show = imx1_pin_dbg_show,
 	.dt_node_to_map = imx1_dt_node_to_map,
 	.dt_free_map = imx1_dt_free_map,
-
 };
 
 static int imx1_pmx_set(struct pinctrl_dev *pctldev, unsigned selector,
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
index 68894e9e05d2..5a68e242f6b3 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
@@ -188,7 +188,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
 	PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"),
 	PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"),
 	PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"),
-
 };
 
 static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {
diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c
index 72edc675431c..9015486e38c1 100644
--- a/drivers/pinctrl/pinctrl-at91.c
+++ b/drivers/pinctrl/pinctrl-at91.c
@@ -733,7 +733,6 @@ static const struct at91_pinctrl_mux_ops sam9x60_ops = {
 	.get_slewrate   = at91_mux_sam9x60_get_slewrate,
 	.set_slewrate   = at91_mux_sam9x60_set_slewrate,
 	.irq_type	= alt_gpio_irq_type,
-
 };
 
 static struct at91_pinctrl_mux_ops sama5d3_ops = {
diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c
index 7b8c7a0b13de..43d9e6c7fd81 100644
--- a/drivers/pinctrl/pinctrl-st.c
+++ b/drivers/pinctrl/pinctrl-st.c
@@ -541,7 +541,6 @@ static void st_pinconf_set_retime_packed(struct st_pinctrl *info,
 	st_regmap_field_bit_set_clear_pin(rt_p->delay_0, delay & 0x1, pin);
 	/* 2 bit delay, msb */
 	st_regmap_field_bit_set_clear_pin(rt_p->delay_1, delay & 0x2, pin);
-
 }
 
 static void st_pinconf_set_retime_dedicated(struct st_pinctrl *info,
diff --git a/drivers/pinctrl/pinctrl-sx150x.c b/drivers/pinctrl/pinctrl-sx150x.c
index c110f780407b..484a3b9e875c 100644
--- a/drivers/pinctrl/pinctrl-sx150x.c
+++ b/drivers/pinctrl/pinctrl-sx150x.c
@@ -443,7 +443,6 @@ static void sx150x_gpio_set(struct gpio_chip *chip, unsigned int offset,
 		sx150x_gpio_oscio_set(pctl, value);
 	else
 		__sx150x_gpio_set(pctl, offset, value);
-
 }
 
 static void sx150x_gpio_set_multiple(struct gpio_chip *chip,
diff --git a/drivers/pinctrl/qcom/pinctrl-sdm845.c b/drivers/pinctrl/qcom/pinctrl-sdm845.c
index 2834d2c1338c..c51793f6546f 100644
--- a/drivers/pinctrl/qcom/pinctrl-sdm845.c
+++ b/drivers/pinctrl/qcom/pinctrl-sdm845.c
@@ -1310,7 +1310,6 @@ static const struct msm_pinctrl_soc_data sdm845_pinctrl = {
 	.ngpios = 151,
 	.wakeirq_map = sdm845_pdc_map,
 	.nwakeirq_map = ARRAY_SIZE(sdm845_pdc_map),
-
 };
 
 static const struct msm_pinctrl_soc_data sdm845_acpi_pinctrl = {
diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
index 681d8dcf37e3..92e7f2602847 100644
--- a/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
+++ b/drivers/pinctrl/qcom/pinctrl-ssbi-mpp.c
@@ -617,7 +617,6 @@ static void pm8xxx_mpp_dbg_show_one(struct seq_file *s,
 		}
 		break;
 	}
-
 }
 
 static void pm8xxx_mpp_dbg_show(struct seq_file *s, struct gpio_chip *chip)
diff --git a/drivers/pinctrl/renesas/pfc-r8a77950.c b/drivers/pinctrl/renesas/pfc-r8a77950.c
index 04812e62f3a4..9d89da2319e5 100644
--- a/drivers/pinctrl/renesas/pfc-r8a77950.c
+++ b/drivers/pinctrl/renesas/pfc-r8a77950.c
@@ -1668,7 +1668,6 @@ static const unsigned int avb_mii_pins[] = {
 	PIN_AVB_RX_CTL, PIN_AVB_RXC, PIN_AVB_RD0,
 	PIN_AVB_RD1, PIN_AVB_RD2, PIN_AVB_RD3,
 	PIN_AVB_TXCREFCLK,
-
 };
 static const unsigned int avb_mii_mux[] = {
 	AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,
diff --git a/drivers/pinctrl/renesas/pfc-r8a77951.c b/drivers/pinctrl/renesas/pfc-r8a77951.c
index a94ebe0bf5d0..4aea6e4b7157 100644
--- a/drivers/pinctrl/renesas/pfc-r8a77951.c
+++ b/drivers/pinctrl/renesas/pfc-r8a77951.c
@@ -1727,7 +1727,6 @@ static const unsigned int avb_mii_pins[] = {
 	PIN_AVB_RX_CTL, PIN_AVB_RXC, PIN_AVB_RD0,
 	PIN_AVB_RD1, PIN_AVB_RD2, PIN_AVB_RD3,
 	PIN_AVB_TXCREFCLK,
-
 };
 static const unsigned int avb_mii_mux[] = {
 	AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,
diff --git a/drivers/pinctrl/renesas/pfc-r8a7796.c b/drivers/pinctrl/renesas/pfc-r8a7796.c
index 3878d6b0db14..a67fa0e4df7c 100644
--- a/drivers/pinctrl/renesas/pfc-r8a7796.c
+++ b/drivers/pinctrl/renesas/pfc-r8a7796.c
@@ -1732,7 +1732,6 @@ static const unsigned int avb_mii_pins[] = {
 	PIN_AVB_RX_CTL, PIN_AVB_RXC, PIN_AVB_RD0,
 	PIN_AVB_RD1, PIN_AVB_RD2, PIN_AVB_RD3,
 	PIN_AVB_TXCREFCLK,
-
 };
 static const unsigned int avb_mii_mux[] = {
 	AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,
diff --git a/drivers/pinctrl/renesas/pfc-r8a77965.c b/drivers/pinctrl/renesas/pfc-r8a77965.c
index 7a50b9b69a7d..7db2b7f2ff67 100644
--- a/drivers/pinctrl/renesas/pfc-r8a77965.c
+++ b/drivers/pinctrl/renesas/pfc-r8a77965.c
@@ -1736,7 +1736,6 @@ static const unsigned int avb_mii_pins[] = {
 	PIN_AVB_RX_CTL, PIN_AVB_RXC, PIN_AVB_RD0,
 	PIN_AVB_RD1, PIN_AVB_RD2, PIN_AVB_RD3,
 	PIN_AVB_TXCREFCLK,
-
 };
 static const unsigned int avb_mii_mux[] = {
 	AVB_TX_CTL_MARK, AVB_TXC_MARK, AVB_TD0_MARK,

From ef5395fbadac89af2c4e20b3b6c449ad51c4e085 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Mon, 19 Jul 2021 13:29:38 +0200
Subject: [PATCH 0056/1750] pinctrl: armada-37xx: Correct PWM pins definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit baf8d6899b1e8906dc076ef26cc633e96a8bb0c3 ]

The PWM pins on North Bridge on Armada 37xx can be configured into PWM
or GPIO functions. When in PWM function, each pin can also be configured
to drive low on 0 and tri-state on 1 (LED mode).

The current definitions handle this by declaring two pin groups for each
pin:
- group "pwmN" with functions "pwm" and "gpio"
- group "ledN_od" ("od" for open drain) with functions "led" and "gpio"

This is semantically incorrect. The correct definition for each pin
should be one group with three functions: "pwm", "led" and "gpio".

Change the "pwmN" groups to support "led" function.

Remove "ledN_od" groups. This cannot break backwards compatibility with
older device trees: no device tree uses it since there is no PWM driver
for this SOC yet. Also "ledN_od" groups are not even documented.

Fixes: b835d6953009 ("pinctrl: armada-37xx: swap polarity on LED group")
Signed-off-by: Marek Behún <kabel@kernel.org>
Acked-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20210719112938.27594-1-kabel@kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../pinctrl/marvell,armada-37xx-pinctrl.txt      |  8 ++++----
 drivers/pinctrl/mvebu/pinctrl-armada-37xx.c      | 16 ++++++++--------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
index 38dc56a57760..ecec514b3155 100644
--- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-37xx-pinctrl.txt
@@ -43,19 +43,19 @@ group emmc_nb
 
 group pwm0
  - pin 11 (GPIO1-11)
- - functions pwm, gpio
+ - functions pwm, led, gpio
 
 group pwm1
  - pin 12
- - functions pwm, gpio
+ - functions pwm, led, gpio
 
 group pwm2
  - pin 13
- - functions pwm, gpio
+ - functions pwm, led, gpio
 
 group pwm3
  - pin 14
- - functions pwm, gpio
+ - functions pwm, led, gpio
 
 group pmic1
  - pin 7
diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
index 5a68e242f6b3..5cb018f98800 100644
--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
@@ -167,10 +167,14 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
 	PIN_GRP_GPIO("jtag", 20, 5, BIT(0), "jtag"),
 	PIN_GRP_GPIO("sdio0", 8, 3, BIT(1), "sdio"),
 	PIN_GRP_GPIO("emmc_nb", 27, 9, BIT(2), "emmc"),
-	PIN_GRP_GPIO("pwm0", 11, 1, BIT(3), "pwm"),
-	PIN_GRP_GPIO("pwm1", 12, 1, BIT(4), "pwm"),
-	PIN_GRP_GPIO("pwm2", 13, 1, BIT(5), "pwm"),
-	PIN_GRP_GPIO("pwm3", 14, 1, BIT(6), "pwm"),
+	PIN_GRP_GPIO_3("pwm0", 11, 1, BIT(3) | BIT(20), 0, BIT(20), BIT(3),
+		       "pwm", "led"),
+	PIN_GRP_GPIO_3("pwm1", 12, 1, BIT(4) | BIT(21), 0, BIT(21), BIT(4),
+		       "pwm", "led"),
+	PIN_GRP_GPIO_3("pwm2", 13, 1, BIT(5) | BIT(22), 0, BIT(22), BIT(5),
+		       "pwm", "led"),
+	PIN_GRP_GPIO_3("pwm3", 14, 1, BIT(6) | BIT(23), 0, BIT(23), BIT(6),
+		       "pwm", "led"),
 	PIN_GRP_GPIO("pmic1", 7, 1, BIT(7), "pmic"),
 	PIN_GRP_GPIO("pmic0", 6, 1, BIT(8), "pmic"),
 	PIN_GRP_GPIO("i2c2", 2, 2, BIT(9), "i2c"),
@@ -184,10 +188,6 @@ static struct armada_37xx_pin_group armada_37xx_nb_groups[] = {
 	PIN_GRP_EXTRA("uart2", 9, 2, BIT(1) | BIT(13) | BIT(14) | BIT(19),
 		      BIT(1) | BIT(13) | BIT(14), BIT(1) | BIT(19),
 		      18, 2, "gpio", "uart"),
-	PIN_GRP_GPIO_2("led0_od", 11, 1, BIT(20), BIT(20), 0, "led"),
-	PIN_GRP_GPIO_2("led1_od", 12, 1, BIT(21), BIT(21), 0, "led"),
-	PIN_GRP_GPIO_2("led2_od", 13, 1, BIT(22), BIT(22), 0, "led"),
-	PIN_GRP_GPIO_2("led3_od", 14, 1, BIT(23), BIT(23), 0, "led"),
 };
 
 static struct armada_37xx_pin_group armada_37xx_sb_groups[] = {

From f1eccc40816852e8a74a70cace71bdff336e14cb Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Sat, 24 Jul 2021 09:20:10 +0200
Subject: [PATCH 0057/1750] scsi: bsg: Remove support for
 SCSI_IOCTL_SEND_COMMAND

[ Upstream commit beec64d0c9749afedf51c3c10cf52de1d9a89cc0 ]

SCSI_IOCTL_SEND_COMMAND has been deprecated longer than bsg exists and has
been warning for just as long.  More importantly it harcodes SCSI CDBs and
thus will do the wrong thing on non-SCSI bsg nodes.

Link: https://lore.kernel.org/r/20210724072033.1284840-2-hch@lst.de
Fixes: aa387cc89567 ("block: add bsg helper library")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Acked-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/bsg.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/block/bsg.c b/block/bsg.c
index 3d78e843a83f..2cbc1fcc8247 100644
--- a/block/bsg.c
+++ b/block/bsg.c
@@ -371,10 +371,13 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case SG_GET_RESERVED_SIZE:
 	case SG_SET_RESERVED_SIZE:
 	case SG_EMULATED_HOST:
-	case SCSI_IOCTL_SEND_COMMAND:
 		return scsi_cmd_ioctl(bd->queue, NULL, file->f_mode, cmd, uarg);
 	case SG_IO:
 		return bsg_sg_io(bd->queue, file->f_mode, uarg);
+	case SCSI_IOCTL_SEND_COMMAND:
+		pr_warn_ratelimited("%s: calling unsupported SCSI_IOCTL_SEND_COMMAND\n",
+				current->comm);
+		return -EINVAL;
 	default:
 		return -ENOTTY;
 	}

From 273ed4f47e6f02303bd7998ceee1431349674f43 Mon Sep 17 00:00:00 2001
From: Peter Geis <pgwipeout@gmail.com>
Date: Wed, 28 Jul 2021 14:00:28 -0400
Subject: [PATCH 0058/1750] clk: rockchip: drop GRF dependency for
 rk3328/rk3036 pll types

[ Upstream commit 6fffe52fb336ec2063270a7305652a93ea677ca1 ]

The rk3036/rk3328 pll types were converted to checking the lock status
via the internal register in january 2020, so don't need the grf
reference since then.

But it was forgotten to remove grf check when deciding between the
pll rate ops (read-only vs. read-write), so a clock driver without
the needed grf reference might've been put into the read-only mode
just because the grf reference was missing.

This affected the rk356x that needs to reclock certain plls at boot.

Fix this by removing the check for the grf for selecting the utilized
operations.

Suggested-by: Heiko Stuebner <heiko@sntech.de>
Fixes: 7f6ffbb885d1 ("clk: rockchip: convert rk3036 pll type to use internal lock status")
Signed-off-by: Peter Geis <pgwipeout@gmail.com>
[adjusted the commit message, adjusted the fixes tag]
Link: https://lore.kernel.org/r/20210728180034.717953-3-pgwipeout@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/rockchip/clk-pll.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/rockchip/clk-pll.c b/drivers/clk/rockchip/clk-pll.c
index 4c6c9167ef50..bbbf9ce42867 100644
--- a/drivers/clk/rockchip/clk-pll.c
+++ b/drivers/clk/rockchip/clk-pll.c
@@ -940,7 +940,7 @@ struct clk *rockchip_clk_register_pll(struct rockchip_clk_provider *ctx,
 	switch (pll_type) {
 	case pll_rk3036:
 	case pll_rk3328:
-		if (!pll->rate_table || IS_ERR(ctx->grf))
+		if (!pll->rate_table)
 			init.ops = &rockchip_rk3036_pll_clk_norate_ops;
 		else
 			init.ops = &rockchip_rk3036_pll_clk_ops;

From b824bae96f7391ac8419e622c28141b8739c7fe9 Mon Sep 17 00:00:00 2001
From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Date: Thu, 15 Jul 2021 12:04:45 -0400
Subject: [PATCH 0059/1750] IB/hfi1: Adjust pkey entry in index 0

[ Upstream commit 62004871e1fa7f9a60797595c03477af5b5ec36f ]

It is possible for the primary IPoIB network device associated with any
RDMA device to fail to join certain multicast groups preventing IPv6
neighbor discovery and possibly other network ULPs from working
correctly. The IPv4 broadcast group is not affected as the IPoIB network
device handles joining that multicast group directly.

This is because the primary IPoIB network device uses the pkey at ndex 0
in the associated RDMA device's pkey table. Anytime the pkey value of
index 0 changes, the primary IPoIB network device automatically modifies
it's broadcast address (i.e. /sys/class/net/[ib0]/broadcast), since the
broadcast address includes the pkey value, and then bounces carrier. This
includes initial pkey assignment, such as when the pkey at index 0
transitions from the opa default of invalid (0x0000) to some value such as
the OPA default pkey for Virtual Fabric 0: 0x8001 or when the fabric
manager is restarted with a configuration change causing the pkey at index
0 to change. Many network ULPs are not sensitive to the carrier bounce and
are not expecting the broadcast address to change including the linux IPv6
stack.  This problem does not affect IPoIB child network devices as their
pkey value is constant for all time.

To mitigate this issue, change the default pkey in at index 0 to 0x8001 to
cover the predominant case and avoid issues as ipoib comes up and the FM
sweeps.

At some point, ipoib multicast support should automatically fix
non-broadcast addresses as it does with the primary broadcast address.

Fixes: 7724105686e7 ("IB/hfi1: add driver files")
Link: https://lore.kernel.org/r/20210715160445.142451.47651.stgit@awfm-01.cornelisnetworks.com
Suggested-by: Josh Collier <josh.d.collier@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hfi1/init.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index 786c6316273f..b6e453e9ba23 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -650,12 +650,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
 
 	ppd->pkeys[default_pkey_idx] = DEFAULT_P_KEY;
 	ppd->part_enforce |= HFI1_PART_ENFORCE_IN;
-
-	if (loopback) {
-		dd_dev_err(dd, "Faking data partition 0x8001 in idx %u\n",
-			   !default_pkey_idx);
-		ppd->pkeys[!default_pkey_idx] = 0x8001;
-	}
+	ppd->pkeys[0] = 0x8001;
 
 	INIT_WORK(&ppd->link_vc_work, handle_verify_cap);
 	INIT_WORK(&ppd->link_up_work, handle_link_up);

From fe2a1cd62267c3afe233221b10df1f58e17da0f5 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Fri, 23 Jul 2021 17:08:55 +0300
Subject: [PATCH 0060/1750] RDMA/iwcm: Release resources if iw_cm module
 initialization fails

[ Upstream commit e677b72a0647249370f2635862bf0241c86f66ad ]

The failure during iw_cm module initialization partially left the system
with unreleased memory and other resources. Rewrite the module init/exit
routines in such way that netlink commands will be opened only after
successful initialization.

Fixes: b493d91d333e ("iwcm: common code for port mapper")
Link: https://lore.kernel.org/r/b01239f99cb1a3e6d2b0694c242d89e6410bcd93.1627048781.git.leonro@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/iwcm.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index da8adadf4755..75b6da00065a 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -1187,29 +1187,34 @@ static int __init iw_cm_init(void)
 
 	ret = iwpm_init(RDMA_NL_IWCM);
 	if (ret)
-		pr_err("iw_cm: couldn't init iwpm\n");
-	else
-		rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table);
+		return ret;
+
 	iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0);
 	if (!iwcm_wq)
-		return -ENOMEM;
+		goto err_alloc;
 
 	iwcm_ctl_table_hdr = register_net_sysctl(&init_net, "net/iw_cm",
 						 iwcm_ctl_table);
 	if (!iwcm_ctl_table_hdr) {
 		pr_err("iw_cm: couldn't register sysctl paths\n");
-		destroy_workqueue(iwcm_wq);
-		return -ENOMEM;
+		goto err_sysctl;
 	}
 
+	rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table);
 	return 0;
+
+err_sysctl:
+	destroy_workqueue(iwcm_wq);
+err_alloc:
+	iwpm_exit(RDMA_NL_IWCM);
+	return -ENOMEM;
 }
 
 static void __exit iw_cm_cleanup(void)
 {
+	rdma_nl_unregister(RDMA_NL_IWCM);
 	unregister_net_sysctl_table(iwcm_ctl_table_hdr);
 	destroy_workqueue(iwcm_wq);
-	rdma_nl_unregister(RDMA_NL_IWCM);
 	iwpm_exit(RDMA_NL_IWCM);
 }
 

From 8ea3e622af56b6f5aa92e78d2b3d31603c6b5c6f Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Wed, 28 Jul 2021 16:04:12 +0300
Subject: [PATCH 0061/1750] docs: Fix infiniband uverbs minor number

[ Upstream commit 8d7e415d55610d503fdb8815344846b72d194a40 ]

Starting from the beginning of infiniband subsystem, the uverbs char
devices start from 192 as a minor number, see
commit bc38a6abdd5a ("[PATCH] IB uverbs: core implementation").

This patch updates the admin guide documentation to reflect it.

Fixes: 9d85025b0418 ("docs-rst: create an user's manual book")
Link: https://lore.kernel.org/r/bad03e6bcde45550c01e12908a6fe7dfa4770703.1627477347.git.leonro@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/admin-guide/devices.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Documentation/admin-guide/devices.txt b/Documentation/admin-guide/devices.txt
index 63fd4e6a014b..8b738855e1c5 100644
--- a/Documentation/admin-guide/devices.txt
+++ b/Documentation/admin-guide/devices.txt
@@ -3003,10 +3003,10 @@
 		65 = /dev/infiniband/issm1     Second InfiniBand IsSM device
 		  ...
 		127 = /dev/infiniband/issm63    63rd InfiniBand IsSM device
-		128 = /dev/infiniband/uverbs0   First InfiniBand verbs device
-		129 = /dev/infiniband/uverbs1   Second InfiniBand verbs device
+		192 = /dev/infiniband/uverbs0   First InfiniBand verbs device
+		193 = /dev/infiniband/uverbs1   Second InfiniBand verbs device
 		  ...
-		159 = /dev/infiniband/uverbs31  31st InfiniBand verbs device
+		223 = /dev/infiniband/uverbs31  31st InfiniBand verbs device
 
  232 char	Biometric Devices
 		0 = /dev/biometric/sensor0/fingerprint	first fingerprint sensor on first device

From 59137b7dfff1ac1fe84537d5dbe18a4e72b41917 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Fri, 30 Jul 2021 10:50:31 +0100
Subject: [PATCH 0062/1750] scsi: BusLogic: Use %X for u32 sized integer rather
 than %lX

[ Upstream commit 2127cd21fb78c6e22d92944253afd967b0ff774d ]

An earlier fix changed the print format specifier for adapter->bios_addr to
use %lX. However, the integer is a u32 so the fix was wrong. Fix this by
using the correct %X format specifier.

Link: https://lore.kernel.org/r/20210730095031.26981-1-colin.king@canonical.com
Fixes: 43622697117c ("scsi: BusLogic: use %lX for unsigned long rather than %X")
Acked-by: Khalid Aziz <khalid@gonehiking.org>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Addresses-Coverity: ("Invalid type in argument")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/BusLogic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index 7231de2767a9..86d9d804dea7 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -1845,7 +1845,7 @@ static bool __init blogic_reportconfig(struct blogic_adapter *adapter)
 		else
 			blogic_info("None, ", adapter);
 		if (adapter->bios_addr > 0)
-			blogic_info("BIOS Address: 0x%lX, ", adapter,
+			blogic_info("BIOS Address: 0x%X, ", adapter,
 					adapter->bios_addr);
 		else
 			blogic_info("BIOS Address: None, ", adapter);

From 0f711378f0b1e80b9d2edd28a959ab4f71194e92 Mon Sep 17 00:00:00 2001
From: Jaehyoung Choi <jkkkkk.choi@samsung.com>
Date: Fri, 30 Jul 2021 22:29:05 +0300
Subject: [PATCH 0063/1750] pinctrl: samsung: Fix pinctrl bank pin count

[ Upstream commit 70115558ab02fe8d28a6634350b3491a542aaa02 ]

Commit 1abd18d1a51a ("pinctrl: samsung: Register pinctrl before GPIO")
changes the order of GPIO and pinctrl registration: now pinctrl is
registered before GPIO. That means gpio_chip->ngpio is not set when
samsung_pinctrl_register() called, and one cannot rely on that value
anymore. Use `pin_bank->nr_pins' instead of `pin_bank->gpio_chip.ngpio'
to fix mentioned inconsistency.

Fixes: 1abd18d1a51a ("pinctrl: samsung: Register pinctrl before GPIO")
Signed-off-by: Jaehyoung Choi <jkkkkk.choi@samsung.com>
Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
Link: https://lore.kernel.org/r/20210730192905.7173-1-semen.protsenko@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c
index 608eb5a07248..7f809a57bee5 100644
--- a/drivers/pinctrl/samsung/pinctrl-samsung.c
+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c
@@ -918,7 +918,7 @@ static int samsung_pinctrl_register(struct platform_device *pdev,
 		pin_bank->grange.pin_base = drvdata->pin_base
 						+ pin_bank->pin_base;
 		pin_bank->grange.base = pin_bank->grange.pin_base;
-		pin_bank->grange.npins = pin_bank->gpio_chip.ngpio;
+		pin_bank->grange.npins = pin_bank->nr_pins;
 		pin_bank->grange.gc = &pin_bank->gpio_chip;
 		pinctrl_add_gpio_range(drvdata->pctl_dev, &pin_bank->grange);
 	}

From d353e093c0d5cb5c7d5e6c4c4327d2da7d8104f1 Mon Sep 17 00:00:00 2001
From: Jason Gunthorpe <jgg@nvidia.com>
Date: Fri, 16 Jul 2021 15:39:12 -0300
Subject: [PATCH 0064/1750] vfio: Use config not menuconfig for VFIO_NOIOMMU

[ Upstream commit 26c22cfde5dd6e63f25c48458b0185dcb0fbb2fd ]

VFIO_NOIOMMU is supposed to be an element in the VFIO menu, not start
a new menu. Correct this copy-paste mistake.

Fixes: 03a76b60f8ba ("vfio: Include No-IOMMU mode")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Link: https://lore.kernel.org/r/0-v1-3f0b685c3679+478-vfio_menuconfig_jgg@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/vfio/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig
index 67d0bf4efa16..e44bf736e2b2 100644
--- a/drivers/vfio/Kconfig
+++ b/drivers/vfio/Kconfig
@@ -29,7 +29,7 @@ menuconfig VFIO
 
 	  If you don't know what to do here, say N.
 
-menuconfig VFIO_NOIOMMU
+config VFIO_NOIOMMU
 	bool "VFIO No-IOMMU support"
 	depends on VFIO
 	help

From 3b2bbcccd6e9a19c552e720da3af83cd48b75f98 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bvanassche@acm.org>
Date: Wed, 21 Jul 2021 20:34:22 -0700
Subject: [PATCH 0065/1750] scsi: ufs: Fix memory corruption by
 ufshcd_read_desc_param()

[ Upstream commit d3d9c4570285090b533b00946b72647361f0345b ]

If param_offset > buff_len then the memcpy() statement in
ufshcd_read_desc_param() corrupts memory since it copies 256 + buff_len -
param_offset bytes into a buffer with size buff_len.  Since param_offset <
256 this results in writing past the bound of the output buffer.

Link: https://lore.kernel.org/r/20210722033439.26550-2-bvanassche@acm.org
Fixes: cbe193f6f093 ("scsi: ufs: Fix potential NULL pointer access during memcpy")
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Reviewed-by: Daejun Park <daejun7.park@samsung.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 854c96e63007..4dabd09400c6 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -3249,9 +3249,11 @@ int ufshcd_read_desc_param(struct ufs_hba *hba,
 
 	if (is_kmalloc) {
 		/* Make sure we don't copy more data than available */
-		if (param_offset + param_size > buff_len)
-			param_size = buff_len - param_offset;
-		memcpy(param_read_buf, &desc_buf[param_offset], param_size);
+		if (param_offset >= buff_len)
+			ret = -EINVAL;
+		else
+			memcpy(param_read_buf, &desc_buf[param_offset],
+			       min_t(u32, param_size, buff_len - param_offset));
 	}
 out:
 	if (is_kmalloc)

From c5a5528da7228618979bc374f1bc03ad9b69b458 Mon Sep 17 00:00:00 2001
From: "Gautham R. Shenoy" <ego@linux.vnet.ibm.com>
Date: Mon, 19 Jul 2021 12:03:18 +0530
Subject: [PATCH 0066/1750] cpuidle: pseries: Fixup CEDE0 latency only for
 POWER10 onwards

[ Upstream commit 50741b70b0cbbafbd9199f5180e66c0c53783a4a ]

Commit d947fb4c965c ("cpuidle: pseries: Fixup exit latency for
CEDE(0)") sets the exit latency of CEDE(0) based on the latency values
of the Extended CEDE states advertised by the platform

On POWER9 LPARs, the firmwares advertise a very low value of 2us for
CEDE1 exit latency on a Dedicated LPAR. The latency advertized by the
PHYP hypervisor corresponds to the latency required to wakeup from the
underlying hardware idle state. However the wakeup latency from the
LPAR perspective should include

1. The time taken to transition the CPU from the Hypervisor into the
   LPAR post wakeup from platform idle state

2. Time taken to send the IPI from the source CPU (waker) to the idle
   target CPU (wakee).

1. can be measured via timer idle test, where we queue a timer, say
for 1ms, and enter the CEDE state. When the timer fires, in the timer
handler we compute how much extra timer over the expected 1ms have we
consumed. On a a POWER9 LPAR the numbers are

CEDE latency measured using a timer (numbers in ns)
N       Min      Median   Avg       90%ile  99%ile    Max    Stddev
400     2601     5677     5668.74    5917    6413     9299   455.01

1. and 2. combined can be determined by an IPI latency test where we
send an IPI to an idle CPU and in the handler compute the time
difference between when the IPI was sent and when the handler ran. We
see the following numbers on POWER9 LPAR.

CEDE latency measured using an IPI (numbers in ns)
N       Min      Median   Avg       90%ile  99%ile    Max    Stddev
400     711      7564     7369.43   8559    9514      9698   1200.01

Suppose, we consider the 99th percentile latency value measured using
the IPI to be the wakeup latency, the value would be 9.5us This is in
the ballpark of the default value of 10us.

Hence, use the exit latency of CEDE(0) based on the latency values
advertized by platform only from POWER10 onwards. The values
advertized on POWER10 platforms is more realistic and informed by the
latency measurements. For earlier platforms stick to the default value
of 10us. The fix was suggested by Michael Ellerman.

Fixes: d947fb4c965c ("cpuidle: pseries: Fixup exit latency for CEDE(0)")
Reported-by: Enrico Joedecke <joedecke@de.ibm.com>
Signed-off-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1626676399-15975-2-git-send-email-ego@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpuidle/cpuidle-pseries.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c
index a2b5c6f60cf0..e592280d8acf 100644
--- a/drivers/cpuidle/cpuidle-pseries.c
+++ b/drivers/cpuidle/cpuidle-pseries.c
@@ -419,7 +419,21 @@ static int pseries_idle_probe(void)
 			cpuidle_state_table = shared_states;
 			max_idle_state = ARRAY_SIZE(shared_states);
 		} else {
-			fixup_cede0_latency();
+			/*
+			 * Use firmware provided latency values
+			 * starting with POWER10 platforms. In the
+			 * case that we are running on a POWER10
+			 * platform but in an earlier compat mode, we
+			 * can still use the firmware provided values.
+			 *
+			 * However, on platforms prior to POWER10, we
+			 * cannot rely on the accuracy of the firmware
+			 * provided latency values. On such platforms,
+			 * go with the conservative default estimate
+			 * of 10us.
+			 */
+			if (cpu_has_feature(CPU_FTR_ARCH_31) || pvr_version_is(PVR_POWER10))
+				fixup_cede0_latency();
 			cpuidle_state_table = dedicated_states;
 			max_idle_state = NR_DEDICATED_STATES;
 		}

From 1988836e30c503a820c2cc5211955e2efaf59bfb Mon Sep 17 00:00:00 2001
From: Michal Suchanek <msuchanek@suse.de>
Date: Thu, 29 Jul 2021 20:01:03 +0200
Subject: [PATCH 0067/1750] powerpc/stacktrace: Include linux/delay.h

[ Upstream commit a6cae77f1bc89368a4e2822afcddc45c3062d499 ]

commit 7c6986ade69e ("powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()")
introduces udelay() call without including the linux/delay.h header.
This may happen to work on master but the header that declares the
functionshould be included nonetheless.

Fixes: 7c6986ade69e ("powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()")
Signed-off-by: Michal Suchanek <msuchanek@suse.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210729180103.15578-1-msuchanek@suse.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/stacktrace.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/kernel/stacktrace.c b/arch/powerpc/kernel/stacktrace.c
index 2f926ea9b7b9..d4a66ce93f52 100644
--- a/arch/powerpc/kernel/stacktrace.c
+++ b/arch/powerpc/kernel/stacktrace.c
@@ -8,6 +8,7 @@
  * Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp.
  */
 
+#include <linux/delay.h>
 #include <linux/export.h>
 #include <linux/kallsyms.h>
 #include <linux/module.h>

From a77da9de0d7d2f5a2db590451b9d102868a552c6 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Fri, 23 Jul 2021 14:39:45 +0300
Subject: [PATCH 0068/1750] RDMA/efa: Remove double QP type assignment

[ Upstream commit f9193d266347fe9bed5c173e7a1bf96268142a79 ]

The QP type is set by the IB/core and shouldn't be set in the driver.

Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
Link: https://lore.kernel.org/r/838c40134c1590167b888ca06ad51071139ff2ae.1627040189.git.leonro@nvidia.com
Acked-by: Gal Pressman <galpress@amazon.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/efa/efa_verbs.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index 4e940fc50bba..2ece682c7835 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -717,7 +717,6 @@ struct ib_qp *efa_create_qp(struct ib_pd *ibpd,
 
 	qp->qp_handle = create_qp_resp.qp_handle;
 	qp->ibqp.qp_num = create_qp_resp.qp_num;
-	qp->ibqp.qp_type = init_attr->qp_type;
 	qp->max_send_wr = init_attr->cap.max_send_wr;
 	qp->max_recv_wr = init_attr->cap.max_recv_wr;
 	qp->max_send_sge = init_attr->cap.max_send_sge;

From 876e45c95eb61b4af69bed05e78d2927979993f5 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Tue, 3 Aug 2021 21:20:32 +0300
Subject: [PATCH 0069/1750] RDMA/mlx5: Delete not-available udata check

[ Upstream commit 5f6bb7e32283b8e3339b7adc00638234ac199cc4 ]

XRC_TGT QPs are created through kernel verbs and don't have udata at all.

Fixes: 6eefa839c4dd ("RDMA/mlx5: Protect from kernel crash if XRC_TGT doesn't have udata")
Fixes: e383085c2425 ("RDMA/mlx5: Set ECE options during QP create")
Link: https://lore.kernel.org/r/b68228597e730675020aa5162745390a2d39d3a2.1628014762.git.leonro@nvidia.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx5/qp.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 8beba002e5dd..011477356a1d 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1842,7 +1842,6 @@ static int get_atomic_mode(struct mlx5_ib_dev *dev,
 static int create_xrc_tgt_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
 			     struct mlx5_create_qp_params *params)
 {
-	struct mlx5_ib_create_qp *ucmd = params->ucmd;
 	struct ib_qp_init_attr *attr = params->attr;
 	u32 uidx = params->uidx;
 	struct mlx5_ib_resources *devr = &dev->devr;
@@ -1862,8 +1861,6 @@ static int create_xrc_tgt_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
 	if (!in)
 		return -ENOMEM;
 
-	if (MLX5_CAP_GEN(mdev, ece_support) && ucmd)
-		MLX5_SET(create_qp_in, in, ece, ucmd->ece_options);
 	qpc = MLX5_ADDR_OF(create_qp_in, in, qpc);
 
 	MLX5_SET(qpc, qpc, st, MLX5_QP_ST_XRC);

From 49e4c83db88537b23a1f662b234776c73b97e3aa Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Tue, 3 Aug 2021 14:15:47 -0700
Subject: [PATCH 0070/1750] cpuidle: pseries: Mark pseries_idle_proble() as
 __init

[ Upstream commit d04691d373e75c83424b85c0e68e4a3f9370c10d ]

After commit 7cbd631d4dec ("cpuidle: pseries: Fixup CEDE0 latency only
for POWER10 onwards"), pseries_idle_probe() is no longer inlined when
compiling with clang, which causes a modpost warning:

WARNING: modpost: vmlinux.o(.text+0xc86a54): Section mismatch in
reference from the function pseries_idle_probe() to the function
.init.text:fixup_cede0_latency()
The function pseries_idle_probe() references
the function __init fixup_cede0_latency().
This is often because pseries_idle_probe lacks a __init
annotation or the annotation of fixup_cede0_latency is wrong.

pseries_idle_probe() is a non-init function, which calls
fixup_cede0_latency(), which is an init function, explaining the
mismatch. pseries_idle_probe() is only called from
pseries_processor_idle_init(), which is an init function, so mark
pseries_idle_probe() as __init so there is no more warning.

Fixes: 054e44ba99ae ("cpuidle: pseries: Add function to parse extended CEDE records")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210803211547.1093820-1-nathan@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpuidle/cpuidle-pseries.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c
index e592280d8acf..ff164dec8422 100644
--- a/drivers/cpuidle/cpuidle-pseries.c
+++ b/drivers/cpuidle/cpuidle-pseries.c
@@ -402,7 +402,7 @@ static void __init fixup_cede0_latency(void)
  * pseries_idle_probe()
  * Choose state table for shared versus dedicated partition
  */
-static int pseries_idle_probe(void)
+static int __init pseries_idle_probe(void)
 {
 
 	if (cpuidle_disable != IDLE_NO_OVERRIDE)

From 31fd3211ef8b20855bab22a315f09c37512a22a1 Mon Sep 17 00:00:00 2001
From: Yangtao Li <frank.li@vivo.com>
Date: Wed, 4 Aug 2021 11:29:46 +0800
Subject: [PATCH 0071/1750] f2fs: reduce the scope of setting fsck tag when
 de->name_len is zero

[ Upstream commit d4bf15a7ce172d186d400d606adf4f34a59130d6 ]

I recently found a case where de->name_len is 0 in f2fs_fill_dentries()
easily reproduced, and finally set the fsck flag.

Thread A			Thread B
- f2fs_readdir
 - f2fs_read_inline_dir
  - ctx->pos = d.max
				- f2fs_add_dentry
				 - f2fs_add_inline_entry
				  - do_convert_inline_dir
				 - f2fs_add_regular_entry
- f2fs_readdir
 - f2fs_fill_dentries
  - set_sbi_flag(sbi, SBI_NEED_FSCK)

Process A opens the folder, and has been reading without closing it.
During this period, Process B created a file under the folder (occupying
multiple f2fs_dir_entry, exceeding the d.max of the inline dir). After
creation, process A uses the d.max of inline dir to read it again, and
it will read that de->name_len is 0.

And Chao pointed out that w/o inline conversion, the race condition still
can happen as below:

dir_entry1: A
dir_entry2: B
dir_entry3: C
free slot: _
ctx->pos: ^

Thread A is traversing directory,
ctx-pos moves to below position after readdir() by thread A:
AAAABBBB___
        ^

Then thread B delete dir_entry2, and create dir_entry3.

Thread A calls readdir() to lookup dirents starting from middle
of new dirent slots as below:
AAAACCCCCC_
        ^
In these scenarios, the file system is not damaged, and it's hard to
avoid it. But we can bypass tagging FSCK flag if:
a) bit_pos (:= ctx->pos % d->max) is non-zero and
b) before bit_pos moves to first valid dir_entry.

Fixes: ddf06b753a85 ("f2fs: fix to trigger fsck if dirent.name_len is zero")
Signed-off-by: Yangtao Li <frank.li@vivo.com>
[Chao: clean up description]
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/dir.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
index 4b9ef8bbfa4a..6694298b1660 100644
--- a/fs/f2fs/dir.c
+++ b/fs/f2fs/dir.c
@@ -938,6 +938,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 	struct f2fs_sb_info *sbi = F2FS_I_SB(d->inode);
 	struct blk_plug plug;
 	bool readdir_ra = sbi->readdir_ra == 1;
+	bool found_valid_dirent = false;
 	int err = 0;
 
 	bit_pos = ((unsigned long)ctx->pos % d->max);
@@ -952,13 +953,15 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 
 		de = &d->dentry[bit_pos];
 		if (de->name_len == 0) {
+			if (found_valid_dirent || !bit_pos) {
+				printk_ratelimited(
+					"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix.",
+					KERN_WARNING, sbi->sb->s_id,
+					le32_to_cpu(de->ino));
+				set_sbi_flag(sbi, SBI_NEED_FSCK);
+			}
 			bit_pos++;
 			ctx->pos = start_pos + bit_pos;
-			printk_ratelimited(
-				"%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix.",
-				KERN_WARNING, sbi->sb->s_id,
-				le32_to_cpu(de->ino));
-			set_sbi_flag(sbi, SBI_NEED_FSCK);
 			continue;
 		}
 
@@ -1001,6 +1004,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d,
 			f2fs_ra_node_page(sbi, le32_to_cpu(de->ino));
 
 		ctx->pos = start_pos + bit_pos;
+		found_valid_dirent = true;
 	}
 out:
 	if (readdir_ra)

From ca7f7e37bae4e3aa1d01536c5907131796b49136 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 18 Jul 2021 19:33:09 -0700
Subject: [PATCH 0072/1750] openrisc: don't printk() unconditionally

[ Upstream commit 946e1052cdcc7e585ee5d1e72528ca49fb295243 ]

Don't call printk() when CONFIG_PRINTK is not set.
Fixes the following build errors:

or1k-linux-ld: arch/openrisc/kernel/entry.o: in function `_external_irq_handler':
(.text+0x804): undefined reference to `printk'
(.text+0x804): relocation truncated to fit: R_OR1K_INSN_REL_26 against undefined symbol `printk'

Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Jonas Bonn <jonas@southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Cc: Stafford Horne <shorne@gmail.com>
Cc: openrisc@lists.librecores.org
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/openrisc/kernel/entry.S | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
index bc657e55c15f..98e4f97db515 100644
--- a/arch/openrisc/kernel/entry.S
+++ b/arch/openrisc/kernel/entry.S
@@ -547,6 +547,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
 	l.bnf	1f			// ext irq enabled, all ok.
 	l.nop
 
+#ifdef CONFIG_PRINTK
 	l.addi  r1,r1,-0x8
 	l.movhi r3,hi(42f)
 	l.ori	r3,r3,lo(42f)
@@ -560,6 +561,7 @@ EXCEPTION_ENTRY(_external_irq_handler)
 		.string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r"
 		.align 4
 	.previous
+#endif
 
 	l.ori	r4,r4,SPR_SR_IEE	// fix the bug
 //	l.sw	PT_SR(r1),r4

From fa55e76641d80b36994904c7dff7ec9b3d91b8a3 Mon Sep 17 00:00:00 2001
From: Anthony Iliopoulos <ailiop@suse.com>
Date: Thu, 22 Jul 2021 16:10:55 +0200
Subject: [PATCH 0073/1750] dma-debug: fix debugfs initialization order

[ Upstream commit 173735c346c412d9f084825ecb04f24ada0e2986 ]

Due to link order, dma_debug_init is called before debugfs has a chance
to initialize (via debugfs_init which also happens in the core initcall
stage), so the directories for dma-debug are never created.

Decouple dma_debug_fs_init from dma_debug_init and defer its init until
core_initcall_sync (after debugfs has been initialized) while letting
dma-debug initialization occur as soon as possible to catch any early
mappings, as suggested in [1].

[1] https://lore.kernel.org/linux-iommu/YIgGa6yF%2Fadg8OSN@kroah.com/

Fixes: 15b28bbcd567 ("dma-debug: move initialization to common code")
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/dma/debug.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index 14de1271463f..445754529917 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -794,7 +794,7 @@ static int dump_show(struct seq_file *seq, void *v)
 }
 DEFINE_SHOW_ATTRIBUTE(dump);
 
-static void dma_debug_fs_init(void)
+static int __init dma_debug_fs_init(void)
 {
 	struct dentry *dentry = debugfs_create_dir("dma-api", NULL);
 
@@ -807,7 +807,10 @@ static void dma_debug_fs_init(void)
 	debugfs_create_u32("nr_total_entries", 0444, dentry, &nr_total_entries);
 	debugfs_create_file("driver_filter", 0644, dentry, NULL, &filter_fops);
 	debugfs_create_file("dump", 0444, dentry, NULL, &dump_fops);
+
+	return 0;
 }
+core_initcall_sync(dma_debug_fs_init);
 
 static int device_dma_allocations(struct device *dev, struct dma_debug_entry **out_entry)
 {
@@ -892,8 +895,6 @@ static int dma_debug_init(void)
 		spin_lock_init(&dma_entry_hash[i].lock);
 	}
 
-	dma_debug_fs_init();
-
 	nr_pages = DIV_ROUND_UP(nr_prealloc_entries, DMA_DEBUG_DYNAMIC_ENTRIES);
 	for (i = 0; i < nr_pages; ++i)
 		dma_debug_create_entries(GFP_KERNEL);

From 4b96edea5cd1b77bef855a51ecabfb3579f8b7bc Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 26 Jul 2021 07:58:49 -0400
Subject: [PATCH 0074/1750] NFSv4/pNFS: Fix a layoutget livelock loop

[ Upstream commit e20772cbdf463c12088837e5a08bde1b876bfd25 ]

If NFS_LAYOUT_RETURN_REQUESTED is set, but there is no value set for
the layout plh_return_seq, we can end up in a livelock loop in which
every layout segment retrieved by a new call to layoutget is immediately
invalidated by pnfs_layout_need_return().
To get around this, we should just set plh_return_seq to the current
value of the layout stateid's seqid.

Fixes: d474f96104bd ("NFS: Don't return layout segments that are in use")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/pnfs.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 371665e0c154..fef0537d15b0 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -347,11 +347,15 @@ pnfs_set_plh_return_info(struct pnfs_layout_hdr *lo, enum pnfs_iomode iomode,
 		iomode = IOMODE_ANY;
 	lo->plh_return_iomode = iomode;
 	set_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
-	if (seq != 0) {
-		WARN_ON_ONCE(lo->plh_return_seq != 0 && lo->plh_return_seq != seq);
+	/*
+	 * We must set lo->plh_return_seq to avoid livelocks with
+	 * pnfs_layout_need_return()
+	 */
+	if (seq == 0)
+		seq = be32_to_cpu(lo->plh_stateid.seqid);
+	if (!lo->plh_return_seq || pnfs_seqid_is_newer(seq, lo->plh_return_seq))
 		lo->plh_return_seq = seq;
-		pnfs_barrier_update(lo, seq);
-	}
+	pnfs_barrier_update(lo, seq);
 }
 
 static void

From 2a542421eb7f489af1ff7672fa2d474870780182 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Fri, 23 Jul 2021 08:57:20 -0400
Subject: [PATCH 0075/1750] NFSv4/pNFS: Always allow update of a zero valued
 layout barrier

[ Upstream commit 45baadaad7bf9183651fb74f4ed1200da48505a5 ]

A zero value for the layout barrier indicates that it has been cleared
(since seqid '0' is an illegal value), so we should always allow it to
be updated.

Fixes: d29b468da4f9 ("pNFS/NFSv4: Improve rejection of out-of-order layouts")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/pnfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index fef0537d15b0..741b6283ac9c 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -335,7 +335,7 @@ static bool pnfs_seqid_is_newer(u32 s1, u32 s2)
 
 static void pnfs_barrier_update(struct pnfs_layout_hdr *lo, u32 newseq)
 {
-	if (pnfs_seqid_is_newer(newseq, lo->plh_barrier))
+	if (pnfs_seqid_is_newer(newseq, lo->plh_barrier) || !lo->plh_barrier)
 		lo->plh_barrier = newseq;
 }
 

From 9aa7a3ffb11c8b2e4004a9471cac59c19475b006 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Fri, 23 Jul 2021 08:57:21 -0400
Subject: [PATCH 0076/1750] NFSv4/pnfs: The layout barrier indicate a minimal
 value for the seqid

[ Upstream commit d6236a98b3bab07c0a1455fd1ab46f79c3978cdc ]

The intention of the layout barrier is to ensure that we do not update
the layout to match an older value than the current expectation. Fix the
test in pnfs_layout_stateid_blocked() to reflect that it is legal for
the seqid of the stateid to match that of the barrier.

Fixes: aa95edf309ef ("NFSv4/pnfs: Fix the layout barrier update")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/pnfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 741b6283ac9c..5370e082aded 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1004,7 +1004,7 @@ pnfs_layout_stateid_blocked(const struct pnfs_layout_hdr *lo,
 {
 	u32 seqid = be32_to_cpu(stateid->seqid);
 
-	return !pnfs_seqid_is_newer(seqid, lo->plh_barrier) && lo->plh_barrier;
+	return lo->plh_barrier && pnfs_seqid_is_newer(lo->plh_barrier, seqid);
 }
 
 /* lget is set to 1 if called from inside send_layoutget call chain */

From f3d30161278776fb0a4a163c05f44a55acc47f1b Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 26 Jul 2021 07:59:23 -0400
Subject: [PATCH 0077/1750] SUNRPC: Fix potential memory corruption

[ Upstream commit c2dc3e5fad13aca5d7bdf4bcb52b1a1d707c8555 ]

We really should not call rpc_wake_up_queued_task_set_status() with
xprt->snd_task as an argument unless we are certain that is actually an
rpc_task.

Fixes: 0445f92c5d53 ("SUNRPC: Fix disconnection races")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/xprt.h | 1 +
 net/sunrpc/xprt.c           | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index cad1fa2b6baa..e7b997d6f031 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -421,6 +421,7 @@ void			xprt_unlock_connect(struct rpc_xprt *, void *);
 #define XPRT_CONGESTED		(9)
 #define XPRT_CWND_WAIT		(10)
 #define XPRT_WRITE_SPACE	(11)
+#define XPRT_SND_IS_COOKIE	(12)
 
 static inline void xprt_set_connected(struct rpc_xprt *xprt)
 {
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 9a50764be916..ccfa85e995fd 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -746,9 +746,9 @@ void xprt_force_disconnect(struct rpc_xprt *xprt)
 	/* Try to schedule an autoclose RPC call */
 	if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
 		queue_work(xprtiod_workqueue, &xprt->task_cleanup);
-	else if (xprt->snd_task)
+	else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
 		rpc_wake_up_queued_task_set_status(&xprt->pending,
-				xprt->snd_task, -ENOTCONN);
+						   xprt->snd_task, -ENOTCONN);
 	spin_unlock(&xprt->transport_lock);
 }
 EXPORT_SYMBOL_GPL(xprt_force_disconnect);
@@ -837,6 +837,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt,
 		goto out;
 	if (xprt->snd_task != task)
 		goto out;
+	set_bit(XPRT_SND_IS_COOKIE, &xprt->state);
 	xprt->snd_task = cookie;
 	ret = true;
 out:
@@ -852,6 +853,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
 	if (!test_bit(XPRT_LOCKED, &xprt->state))
 		goto out;
 	xprt->snd_task =NULL;
+	clear_bit(XPRT_SND_IS_COOKIE, &xprt->state);
 	xprt->ops->release_xprt(xprt, NULL);
 	xprt_schedule_autodisconnect(xprt);
 out:

From f19abe046354fb3c1578008c626b2e036a763f39 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 26 Jul 2021 08:03:12 -0400
Subject: [PATCH 0078/1750] SUNRPC/xprtrdma: Fix reconnection locking

[ Upstream commit f99fa50880f5300fbbb3c0754ddc7f8738d24fe7 ]

The xprtrdma client code currently relies on the task that initiated the
connect to hold the XPRT_LOCK for the duration of the connection
attempt. If the task is woken early, due to some other event, then that
lock could get released early.
Avoid races by using the same mechanism that the socket code uses of
transferring lock ownership to the RDMA connect worker itself. That
frees us to call rpcrdma_xprt_disconnect() directly since we're now
guaranteed exclusion w.r.t. other callers.

Fixes: 4cf44be6f1e8 ("xprtrdma: Fix recursion into rpcrdma_xprt_disconnect()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprt.c               |  2 ++
 net/sunrpc/xprtrdma/transport.c | 11 +++++------
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index ccfa85e995fd..8201531ce5d9 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -844,6 +844,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt,
 	spin_unlock(&xprt->transport_lock);
 	return ret;
 }
+EXPORT_SYMBOL_GPL(xprt_lock_connect);
 
 void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
 {
@@ -860,6 +861,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
 	spin_unlock(&xprt->transport_lock);
 	wake_up_bit(&xprt->state, XPRT_LOCKED);
 }
+EXPORT_SYMBOL_GPL(xprt_unlock_connect);
 
 /**
  * xprt_connect - schedule a transport connect operation
diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
index c26db0a37996..8e2368a0c2a2 100644
--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -249,12 +249,9 @@ xprt_rdma_connect_worker(struct work_struct *work)
 					   xprt->stat.connect_start;
 		xprt_set_connected(xprt);
 		rc = -EAGAIN;
-	} else {
-		/* Force a call to xprt_rdma_close to clean up */
-		spin_lock(&xprt->transport_lock);
-		set_bit(XPRT_CLOSE_WAIT, &xprt->state);
-		spin_unlock(&xprt->transport_lock);
-	}
+	} else
+		rpcrdma_xprt_disconnect(r_xprt);
+	xprt_unlock_connect(xprt, r_xprt);
 	xprt_wake_pending_tasks(xprt, rc);
 }
 
@@ -487,6 +484,8 @@ xprt_rdma_connect(struct rpc_xprt *xprt, struct rpc_task *task)
 	struct rpcrdma_ep *ep = r_xprt->rx_ep;
 	unsigned long delay;
 
+	WARN_ON_ONCE(!xprt_lock_connect(xprt, task, r_xprt));
+
 	delay = 0;
 	if (ep && ep->re_connect_status != 0) {
 		delay = xprt_reconnect_delay(xprt);

From 21a2be1a5145d072deedc7cdc5b2d17380abea75 Mon Sep 17 00:00:00 2001
From: Olga Kornievskaia <kolga@netapp.com>
Date: Wed, 23 Jun 2021 23:28:48 -0400
Subject: [PATCH 0079/1750] SUNRPC query transport's source port

[ Upstream commit a8482488a7d6d320f63a9ee1912dbb5ae5b80a61 ]

Provide ability to query transport's source port.

Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/xprtsock.h | 1 +
 net/sunrpc/xprtsock.c           | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/include/linux/sunrpc/xprtsock.h b/include/linux/sunrpc/xprtsock.h
index 3c1423ee74b4..8c2a712cb242 100644
--- a/include/linux/sunrpc/xprtsock.h
+++ b/include/linux/sunrpc/xprtsock.h
@@ -10,6 +10,7 @@
 
 int		init_socket_xprt(void);
 void		cleanup_socket_xprt(void);
+unsigned short	get_srcport(struct rpc_xprt *);
 
 #define RPC_MIN_RESVPORT	(1U)
 #define RPC_MAX_RESVPORT	(65535U)
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 9c0f71e82d97..7d7c08af54de 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1639,6 +1639,13 @@ static int xs_get_srcport(struct sock_xprt *transport)
 	return port;
 }
 
+unsigned short get_srcport(struct rpc_xprt *xprt)
+{
+	struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt);
+	return sock->srcport;
+}
+EXPORT_SYMBOL(get_srcport);
+
 static unsigned short xs_next_srcport(struct sock_xprt *transport, unsigned short port)
 {
 	if (transport->srcport != 0)

From f02ab9d1d3a64f8d6bb4294295770fc897fa736f Mon Sep 17 00:00:00 2001
From: Anna Schumaker <Anna.Schumaker@Netapp.com>
Date: Tue, 20 Jul 2021 16:04:42 -0400
Subject: [PATCH 0080/1750] sunrpc: Fix return value of get_srcport()

[ Upstream commit 5d46dd04cb68771f77ba66dbf6fd323a4a2ce00d ]

Since bc1c56e9bbe9 transport->srcport may by unset, causing
get_srcport() to return 0 when called. Fix this by querying the port
from the underlying socket instead of the transport.

Fixes: bc1c56e9bbe9 (SUNRPC: prevent port reuse on transports which don't request it)
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/xprtsock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 7d7c08af54de..16c7758e7bf3 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1642,7 +1642,7 @@ static int xs_get_srcport(struct sock_xprt *transport)
 unsigned short get_srcport(struct rpc_xprt *xprt)
 {
 	struct sock_xprt *sock = container_of(xprt, struct sock_xprt, xprt);
-	return sock->srcport;
+	return xs_sock_getport(sock->sock);
 }
 EXPORT_SYMBOL(get_srcport);
 

From 6291fd0eeafc094d670232e3deade9bce8fe080a Mon Sep 17 00:00:00 2001
From: Wei Li <liwei391@huawei.com>
Date: Thu, 15 Jul 2021 11:26:25 +0800
Subject: [PATCH 0081/1750] scsi: fdomain: Fix error return code in
 fdomain_probe()

[ Upstream commit 632c4ae6da1d629eddf9da1e692d7617c568c256 ]

If request_region() fails the return value is not set. Return -EBUSY on
error.

Link: https://lore.kernel.org/r/20210715032625.1395495-1-liwei391@huawei.com
Fixes: 8674a8aa2c39 ("scsi: fdomain: Add PCMCIA support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Li <liwei391@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/pcmcia/fdomain_cs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/pcmcia/fdomain_cs.c b/drivers/scsi/pcmcia/fdomain_cs.c
index e42acf314d06..33df6a9ba9b5 100644
--- a/drivers/scsi/pcmcia/fdomain_cs.c
+++ b/drivers/scsi/pcmcia/fdomain_cs.c
@@ -45,8 +45,10 @@ static int fdomain_probe(struct pcmcia_device *link)
 		goto fail_disable;
 
 	if (!request_region(link->resource[0]->start, FDOMAIN_REGION_SIZE,
-			    "fdomain_cs"))
+			    "fdomain_cs")) {
+		ret = -EBUSY;
 		goto fail_disable;
+	}
 
 	sh = fdomain_create(link->resource[0]->start, link->irq, 7, &link->dev);
 	if (!sh) {

From d3612083ecc1355fa85236e084b34b0d608279dd Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Thu, 22 Jul 2021 11:39:29 +0800
Subject: [PATCH 0082/1750] pinctrl: single: Fix error return code in
 pcs_parse_bits_in_pinctrl_entry()

[ Upstream commit d789a490d32fdf0465275e3607f8a3bc87d3f3ba ]

Fix to return -ENOTSUPP instead of 0 when PCS_HAS_PINCONF is true, which
is the same as that returned in pcs_parse_pinconf().

Fixes: 4e7e8017a80e ("pinctrl: pinctrl-single: enhance to configure multiple pins of different modules")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210722033930.4034-2-thunder.leizhen@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-single.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 12cc4eb18637..17aa0d542d92 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1222,6 +1222,7 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs,
 
 	if (PCS_HAS_PINCONF) {
 		dev_err(pcs->dev, "pinconf not supported\n");
+		res = -ENOTSUPP;
 		goto free_pingroups;
 	}
 

From 41066433be42e9c055a8fd3ff1c1315c20c13f93 Mon Sep 17 00:00:00 2001
From: Laurent Dufour <ldufour@linux.ibm.com>
Date: Tue, 11 May 2021 09:31:36 +0200
Subject: [PATCH 0083/1750] powerpc/numa: Consider the max NUMA node for
 migratable LPAR

[ Upstream commit 9c7248bb8de31f51c693bfa6a6ea53b1c07e0fa8 ]

When a LPAR is migratable, we should consider the maximum possible NUMA
node instead of the number of NUMA nodes from the actual system.

The DT property 'ibm,current-associativity-domains' defines the maximum
number of nodes the LPAR can see when running on that box. But if the
LPAR is being migrated on another box, it may see up to the nodes
defined by 'ibm,max-associativity-domains'. So if a LPAR is migratable,
that value should be used.

Unfortunately, there is no easy way to know if an LPAR is migratable or
not. The hypervisor exports the property 'ibm,migratable-partition' in
the case it set to migrate partition, but that would not mean that the
current partition is migratable.

Without this patch, when a LPAR is started on a 2 node box and then
migrated to a 3 node box, the hypervisor may spread the LPAR's CPUs on
the 3rd node. In that case if a CPU from that 3rd node is added to the
LPAR, it will be wrongly assigned to the node because the kernel has
been set to use up to 2 nodes (the configuration of the departure node).
With this patch applies, the CPU is correctly added to the 3rd node.

Fixes: f9f130ff2ec9 ("powerpc/numa: Detect support for coregroup")
Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210511073136.17795-1-ldufour@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/mm/numa.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index f2bf98bdcea2..094a1076fd1f 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -893,7 +893,7 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn)
 static void __init find_possible_nodes(void)
 {
 	struct device_node *rtas;
-	const __be32 *domains;
+	const __be32 *domains = NULL;
 	int prop_length, max_nodes;
 	u32 i;
 
@@ -909,9 +909,14 @@ static void __init find_possible_nodes(void)
 	 * it doesn't exist, then fallback on ibm,max-associativity-domains.
 	 * Current denotes what the platform can support compared to max
 	 * which denotes what the Hypervisor can support.
+	 *
+	 * If the LPAR is migratable, new nodes might be activated after a LPM,
+	 * so we should consider the max number in that case.
 	 */
-	domains = of_get_property(rtas, "ibm,current-associativity-domains",
-					&prop_length);
+	if (!of_get_property(of_root, "ibm,migratable-partition", NULL))
+		domains = of_get_property(rtas,
+					  "ibm,current-associativity-domains",
+					  &prop_length);
 	if (!domains) {
 		domains = of_get_property(rtas, "ibm,max-associativity-domains",
 					&prop_length);
@@ -920,6 +925,8 @@ static void __init find_possible_nodes(void)
 	}
 
 	max_nodes = of_read_number(&domains[min_common_depth], 1);
+	pr_info("Partition configured for %d NUMA nodes.\n", max_nodes);
+
 	for (i = 0; i < max_nodes; i++) {
 		if (!node_possible(i))
 			node_set(i, node_possible_map);

From 782c4017845d433862de03309582f4a7274c6a21 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 10 Aug 2021 11:46:13 +0300
Subject: [PATCH 0084/1750] scsi: smartpqi: Fix an error code in
 pqi_get_raid_map()

[ Upstream commit d1f6581a6796c4e9fd8a4a24e8b77463d18f0df1 ]

Return -EINVAL on failure instead of success.

Link: https://lore.kernel.org/r/20210810084613.GB23810@kili
Fixes: a91aaae0243b ("scsi: smartpqi: allow for larger raid maps")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/smartpqi/smartpqi_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c
index 5083e5d2b467..de73ade70c24 100644
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -1207,6 +1207,7 @@ static int pqi_get_raid_map(struct pqi_ctrl_info *ctrl_info,
 				"Requested %d bytes, received %d bytes",
 				raid_map_size,
 				get_unaligned_le32(&raid_map->structure_size));
+			rc = -EINVAL;
 			goto error;
 		}
 	}

From dc4577749987ef913b1b14b6a904c04ee5e1da26 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 10 Aug 2021 11:47:53 +0300
Subject: [PATCH 0085/1750] scsi: qedi: Fix error codes in
 qedi_alloc_global_queues()

[ Upstream commit 4dbe57d46d54a847875fa33e7d05877bb341585e ]

This function had some left over code that returned 1 on error instead
negative error codes.  Convert everything to use negative error codes.  The
caller treats all non-zero returns the same so this does not affect run
time.

A couple places set "rc" instead of "status" so those error paths ended up
returning success by mistake.  Get rid of the "rc" variable and use
"status" everywhere.

Remove the bogus "status = 0" initialization, as a future proofing measure
so the compiler will warn about uninitialized error codes.

Link: https://lore.kernel.org/r/20210810084753.GD23810@kili
Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.")
Acked-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qedi/qedi_main.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index b33eff9ea80b..299d0369e4f0 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1623,7 +1623,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
 {
 	u32 *list;
 	int i;
-	int status = 0, rc;
+	int status;
 	u32 *pbl;
 	dma_addr_t page;
 	int num_pages;
@@ -1634,14 +1634,14 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
 	 */
 	if (!qedi->num_queues) {
 		QEDI_ERR(&qedi->dbg_ctx, "No MSI-X vectors available!\n");
-		return 1;
+		return -ENOMEM;
 	}
 
 	/* Make sure we allocated the PBL that will contain the physical
 	 * addresses of our queues
 	 */
 	if (!qedi->p_cpuq) {
-		status = 1;
+		status = -EINVAL;
 		goto mem_alloc_failure;
 	}
 
@@ -1656,13 +1656,13 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi)
 		  "qedi->global_queues=%p.\n", qedi->global_queues);
 
 	/* Allocate DMA coherent buffers for BDQ */
-	rc = qedi_alloc_bdq(qedi);
-	if (rc)
+	status = qedi_alloc_bdq(qedi);
+	if (status)
 		goto mem_alloc_failure;
 
 	/* Allocate DMA coherent buffers for NVM_ISCSI_CFG */
-	rc = qedi_alloc_nvm_iscsi_cfg(qedi);
-	if (rc)
+	status = qedi_alloc_nvm_iscsi_cfg(qedi);
+	if (status)
 		goto mem_alloc_failure;
 
 	/* Allocate a CQ and an associated PBL for each MSI-X

From 1bc19e4062e9a1bb23c019879bb18341721cd2b6 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 10 Aug 2021 11:51:49 +0300
Subject: [PATCH 0086/1750] scsi: qedf: Fix error codes in
 qedf_alloc_global_queues()

[ Upstream commit ccc89737aa6b9f248cf1623014038beb6c2b7f56 ]

This driver has some left over "return 1" on failure style code mixed with
"return negative error codes" style code.  The caller doesn't care so we
should just convert everything to return negative error codes.

Then there was a problem that there were two variables used to store error
codes which just resulted in confusion.  If qedf_alloc_bdq() returned a
negative error code, we accidentally returned success instead of
propagating the error code.  So get rid of the "rc" variable and use
"status" every where.

Also remove the "status = 0" initialization so that these sorts of bugs
will be detected by the compiler in the future.

Link: https://lore.kernel.org/r/20210810085023.GA23998@kili
Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Acked-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qedf/qedf_main.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index 846a02de4d51..c63dcc39f76c 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -3000,7 +3000,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
 {
 	u32 *list;
 	int i;
-	int status = 0, rc;
+	int status;
 	u32 *pbl;
 	dma_addr_t page;
 	int num_pages;
@@ -3012,7 +3012,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
 	 */
 	if (!qedf->num_queues) {
 		QEDF_ERR(&(qedf->dbg_ctx), "No MSI-X vectors available!\n");
-		return 1;
+		return -ENOMEM;
 	}
 
 	/*
@@ -3020,7 +3020,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
 	 * addresses of our queues
 	 */
 	if (!qedf->p_cpuq) {
-		status = 1;
+		status = -EINVAL;
 		QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n");
 		goto mem_alloc_failure;
 	}
@@ -3036,8 +3036,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf)
 		   "qedf->global_queues=%p.\n", qedf->global_queues);
 
 	/* Allocate DMA coherent buffers for BDQ */
-	rc = qedf_alloc_bdq(qedf);
-	if (rc) {
+	status = qedf_alloc_bdq(qedf);
+	if (status) {
 		QEDF_ERR(&qedf->dbg_ctx, "Unable to allocate bdq.\n");
 		goto mem_alloc_failure;
 	}

From 947579a6967a651c3c33d983ecea9c2e6bfccbfb Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 17 Aug 2021 14:24:06 +0930
Subject: [PATCH 0087/1750] powerpc/config: Renable MTD_PHYSMAP_OF

[ Upstream commit d0e28a6145c3455b69991245e7f6147eb914b34a ]

CONFIG_MTD_PHYSMAP_OF is not longer enabled as it depends on
MTD_PHYSMAP which is not enabled.

This is a regression from commit 642b1e8dbed7 ("mtd: maps: Merge
physmap_of.c into physmap-core.c"), which added the extra dependency.
Add CONFIG_MTD_PHYSMAP=y so this stays in the config, as Christophe said
it is useful for build coverage.

Fixes: 642b1e8dbed7 ("mtd: maps: Merge physmap_of.c into physmap-core.c")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Acked-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210817045407.2445664-3-joel@jms.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/configs/mpc885_ads_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/configs/mpc885_ads_defconfig b/arch/powerpc/configs/mpc885_ads_defconfig
index 949ff9ccda5e..dbf3ff8adc65 100644
--- a/arch/powerpc/configs/mpc885_ads_defconfig
+++ b/arch/powerpc/configs/mpc885_ads_defconfig
@@ -34,6 +34,7 @@ CONFIG_MTD_CFI_GEOMETRY=y
 # CONFIG_MTD_CFI_I2 is not set
 CONFIG_MTD_CFI_I4=y
 CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_PHYSMAP_OF=y
 # CONFIG_BLK_DEV is not set
 CONFIG_NETDEVICES=y

From 253bac6c60ad317c805d3061aa813b74b8692b2a Mon Sep 17 00:00:00 2001
From: Lu Baolu <baolu.lu@linux.intel.com>
Date: Wed, 18 Aug 2021 21:48:44 +0800
Subject: [PATCH 0088/1750] iommu/vt-d: Update the virtual command related
 registers

[ Upstream commit 4d99efb229e63928c6b03a756a2e38cd4777fbe8 ]

The VT-d spec Revision 3.3 updated the virtual command registers, virtual
command opcode B register, virtual command response register and virtual
command capability register (Section 10.4.43, 10.4.44, 10.4.45, 10.4.46).
This updates the virtual command interface implementation in the Intel
IOMMU driver accordingly.

Fixes: 24f27d32ab6b7 ("iommu/vt-d: Enlightened PASID allocation")
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Cc: Ashok Raj <ashok.raj@intel.com>
Cc: Sanjay Kumar <sanjay.k.kumar@intel.com>
Cc: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20210713042649.3547403-1-baolu.lu@linux.intel.com
Link: https://lore.kernel.org/r/20210818134852.1847070-2-baolu.lu@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/intel/pasid.h | 10 +++++-----
 include/linux/intel-iommu.h |  6 +++---
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h
index 30cb30046b15..35963e6bf9fa 100644
--- a/drivers/iommu/intel/pasid.h
+++ b/drivers/iommu/intel/pasid.h
@@ -28,12 +28,12 @@
 #define VCMD_CMD_ALLOC			0x1
 #define VCMD_CMD_FREE			0x2
 #define VCMD_VRSP_IP			0x1
-#define VCMD_VRSP_SC(e)			(((e) >> 1) & 0x3)
+#define VCMD_VRSP_SC(e)			(((e) & 0xff) >> 1)
 #define VCMD_VRSP_SC_SUCCESS		0
-#define VCMD_VRSP_SC_NO_PASID_AVAIL	2
-#define VCMD_VRSP_SC_INVALID_PASID	2
-#define VCMD_VRSP_RESULT_PASID(e)	(((e) >> 8) & 0xfffff)
-#define VCMD_CMD_OPERAND(e)		((e) << 8)
+#define VCMD_VRSP_SC_NO_PASID_AVAIL	16
+#define VCMD_VRSP_SC_INVALID_PASID	16
+#define VCMD_VRSP_RESULT_PASID(e)	(((e) >> 16) & 0xfffff)
+#define VCMD_CMD_OPERAND(e)		((e) << 16)
 /*
  * Domain ID reserved for pasid entries programmed for first-level
  * only and pass-through transfer modes.
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index c00ee3458a91..142ec79cda84 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -122,9 +122,9 @@
 #define DMAR_MTRR_PHYSMASK8_REG 0x208
 #define DMAR_MTRR_PHYSBASE9_REG 0x210
 #define DMAR_MTRR_PHYSMASK9_REG 0x218
-#define DMAR_VCCAP_REG		0xe00 /* Virtual command capability register */
-#define DMAR_VCMD_REG		0xe10 /* Virtual command register */
-#define DMAR_VCRSP_REG		0xe20 /* Virtual command response register */
+#define DMAR_VCCAP_REG		0xe30 /* Virtual command capability register */
+#define DMAR_VCMD_REG		0xe00 /* Virtual command register */
+#define DMAR_VCRSP_REG		0xe10 /* Virtual command response register */
 
 #define OFFSET_STRIDE		(9)
 

From e84a72f6962180ff76343b49f9389b1f314e0123 Mon Sep 17 00:00:00 2001
From: Jim Broadus <jbroadus@gmail.com>
Date: Sun, 8 Aug 2021 23:55:05 -0700
Subject: [PATCH 0089/1750] HID: i2c-hid: Fix Elan touchpad regression

[ Upstream commit 786537063bbfb3a7ebc6fc21b2baf37fb91df401 ]

A quirk was recently added for Elan devices that has same device match
as an entry earlier in the list. The i2c_hid_lookup_quirk function will
always return the last match in the list, so the new entry shadows the
old entry. The quirk in the previous entry, I2C_HID_QUIRK_BOGUS_IRQ,
silenced a flood of messages which have reappeared in the 5.13 kernel.

This change moves the two quirk flags into the same entry.

Fixes: ca66a6770bd9 (HID: i2c-hid: Skip ELAN power-on command after reset)
Signed-off-by: Jim Broadus <jbroadus@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/i2c-hid/i2c-hid-core.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 1f08c848c33d..998aad8a9e60 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -176,8 +176,6 @@ static const struct i2c_hid_quirks {
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
 	{ I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118,
 		I2C_HID_QUIRK_NO_IRQ_AFTER_RESET },
-	{ USB_VENDOR_ID_ELAN, HID_ANY_ID,
-		 I2C_HID_QUIRK_BOGUS_IRQ },
 	{ USB_VENDOR_ID_ALPS_JP, HID_ANY_ID,
 		 I2C_HID_QUIRK_RESET_ON_RESUME },
 	{ I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393,
@@ -188,7 +186,8 @@ static const struct i2c_hid_quirks {
 	 * Sending the wakeup after reset actually break ELAN touchscreen controller
 	 */
 	{ USB_VENDOR_ID_ELAN, HID_ANY_ID,
-		 I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET },
+		 I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET |
+		 I2C_HID_QUIRK_BOGUS_IRQ },
 	{ 0, 0 }
 };
 

From 926bf91248dd12b5f93620a05f082c662b84db9d Mon Sep 17 00:00:00 2001
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
Date: Tue, 10 Aug 2021 17:14:33 +0200
Subject: [PATCH 0090/1750] clk: imx8m: fix clock tree update of TF-A managed
 clocks

[ Upstream commit d36207b848a6490e14664e2197a1c8ab51d8148e ]

On the i.MX8M*, the TF-A exposes a SiP (Silicon Provider) service
for DDR frequency scaling. The imx8m-ddrc-devfreq driver calls the
SiP and then does clk_set_parent on the DDR muxes to synchronize
the clock tree.

Since 936c383673b9 ("clk: imx: fix composite peripheral flags"),
these TF-A managed muxes have SET_PARENT_GATE set, which results
in imx8m-ddrc-devfreq's clk_set_parent after SiP failing with -EBUSY:

	echo 25000000 > userspace/set_freq
	imx8m-ddrc-devfreq 3d400000.memory-controller: failed to set
		dram_apb parent: -16

Fix this by adding a new i.MX composite flag for firmware managed
clocks, which clears SET_PARENT_GATE.

This is safe to do, because updating the Linux clock tree to reflect
reality will always be glitch-free.

Fixes: 936c383673b9 ("clk: imx: fix composite peripheral flags")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
Link: https://lore.kernel.org/r/20210810151432.9228-1-a.fatoum@pengutronix.de
Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/imx/clk-composite-8m.c |  3 ++-
 drivers/clk/imx/clk-imx8mm.c       |  7 ++++---
 drivers/clk/imx/clk-imx8mn.c       |  7 ++++---
 drivers/clk/imx/clk-imx8mq.c       |  7 ++++---
 drivers/clk/imx/clk.h              | 16 ++++++++++++++--
 5 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c
index 2c309e3dc8e3..04e728538cef 100644
--- a/drivers/clk/imx/clk-composite-8m.c
+++ b/drivers/clk/imx/clk-composite-8m.c
@@ -216,7 +216,8 @@ struct clk_hw *imx8m_clk_hw_composite_flags(const char *name,
 		div->width = PCG_PREDIV_WIDTH;
 		divider_ops = &imx8m_clk_composite_divider_ops;
 		mux_ops = &clk_mux_ops;
-		flags |= CLK_SET_PARENT_GATE;
+		if (!(composite_flags & IMX_COMPOSITE_FW_MANAGED))
+			flags |= CLK_SET_PARENT_GATE;
 	}
 
 	div->lock = &imx_ccm_lock;
diff --git a/drivers/clk/imx/clk-imx8mm.c b/drivers/clk/imx/clk-imx8mm.c
index 4cbf86ab2eac..711bd2294c70 100644
--- a/drivers/clk/imx/clk-imx8mm.c
+++ b/drivers/clk/imx/clk-imx8mm.c
@@ -458,10 +458,11 @@ static int imx8mm_clocks_probe(struct platform_device *pdev)
 
 	/*
 	 * DRAM clocks are manipulated from TF-A outside clock framework.
-	 * Mark with GET_RATE_NOCACHE to always read div value from hardware
+	 * The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE
+	 * as div value should always be read from hardware
 	 */
-	hws[IMX8MM_CLK_DRAM_ALT] = __imx8m_clk_hw_composite("dram_alt", imx8mm_dram_alt_sels, base + 0xa000, CLK_GET_RATE_NOCACHE);
-	hws[IMX8MM_CLK_DRAM_APB] = __imx8m_clk_hw_composite("dram_apb", imx8mm_dram_apb_sels, base + 0xa080, CLK_IS_CRITICAL | CLK_GET_RATE_NOCACHE);
+	hws[IMX8MM_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mm_dram_alt_sels, base + 0xa000);
+	hws[IMX8MM_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mm_dram_apb_sels, base + 0xa080);
 
 	/* IP */
 	hws[IMX8MM_CLK_VPU_G1] = imx8m_clk_hw_composite("vpu_g1", imx8mm_vpu_g1_sels, base + 0xa100);
diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c
index f98f25279539..33a7ddc23cd2 100644
--- a/drivers/clk/imx/clk-imx8mn.c
+++ b/drivers/clk/imx/clk-imx8mn.c
@@ -441,10 +441,11 @@ static int imx8mn_clocks_probe(struct platform_device *pdev)
 
 	/*
 	 * DRAM clocks are manipulated from TF-A outside clock framework.
-	 * Mark with GET_RATE_NOCACHE to always read div value from hardware
+	 * The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE
+	 * as div value should always be read from hardware
 	 */
-	hws[IMX8MN_CLK_DRAM_ALT] = __imx8m_clk_hw_composite("dram_alt", imx8mn_dram_alt_sels, base + 0xa000, CLK_GET_RATE_NOCACHE);
-	hws[IMX8MN_CLK_DRAM_APB] = __imx8m_clk_hw_composite("dram_apb", imx8mn_dram_apb_sels, base + 0xa080, CLK_IS_CRITICAL | CLK_GET_RATE_NOCACHE);
+	hws[IMX8MN_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mn_dram_alt_sels, base + 0xa000);
+	hws[IMX8MN_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mn_dram_apb_sels, base + 0xa080);
 
 	hws[IMX8MN_CLK_DISP_PIXEL] = imx8m_clk_hw_composite("disp_pixel", imx8mn_disp_pixel_sels, base + 0xa500);
 	hws[IMX8MN_CLK_SAI2] = imx8m_clk_hw_composite("sai2", imx8mn_sai2_sels, base + 0xa600);
diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c
index aac6bcc65c20..f679e5cc320b 100644
--- a/drivers/clk/imx/clk-imx8mq.c
+++ b/drivers/clk/imx/clk-imx8mq.c
@@ -427,11 +427,12 @@ static int imx8mq_clocks_probe(struct platform_device *pdev)
 
 	/*
 	 * DRAM clocks are manipulated from TF-A outside clock framework.
-	 * Mark with GET_RATE_NOCACHE to always read div value from hardware
+	 * The fw_managed helper sets GET_RATE_NOCACHE and clears SET_PARENT_GATE
+	 * as div value should always be read from hardware
 	 */
 	hws[IMX8MQ_CLK_DRAM_CORE] = imx_clk_hw_mux2_flags("dram_core_clk", base + 0x9800, 24, 1, imx8mq_dram_core_sels, ARRAY_SIZE(imx8mq_dram_core_sels), CLK_IS_CRITICAL);
-	hws[IMX8MQ_CLK_DRAM_ALT] = __imx8m_clk_hw_composite("dram_alt", imx8mq_dram_alt_sels, base + 0xa000, CLK_GET_RATE_NOCACHE);
-	hws[IMX8MQ_CLK_DRAM_APB] = __imx8m_clk_hw_composite("dram_apb", imx8mq_dram_apb_sels, base + 0xa080, CLK_IS_CRITICAL | CLK_GET_RATE_NOCACHE);
+	hws[IMX8MQ_CLK_DRAM_ALT] = imx8m_clk_hw_fw_managed_composite("dram_alt", imx8mq_dram_alt_sels, base + 0xa000);
+	hws[IMX8MQ_CLK_DRAM_APB] = imx8m_clk_hw_fw_managed_composite_critical("dram_apb", imx8mq_dram_apb_sels, base + 0xa080);
 
 	/* IP */
 	hws[IMX8MQ_CLK_VPU_G1] = imx8m_clk_hw_composite("vpu_g1", imx8mq_vpu_g1_sels, base + 0xa100);
diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h
index f04cbbab9fcc..c66e00e87711 100644
--- a/drivers/clk/imx/clk.h
+++ b/drivers/clk/imx/clk.h
@@ -533,8 +533,9 @@ struct clk_hw *imx_clk_hw_cpu(const char *name, const char *parent_name,
 		struct clk *div, struct clk *mux, struct clk *pll,
 		struct clk *step);
 
-#define IMX_COMPOSITE_CORE	BIT(0)
-#define IMX_COMPOSITE_BUS	BIT(1)
+#define IMX_COMPOSITE_CORE		BIT(0)
+#define IMX_COMPOSITE_BUS		BIT(1)
+#define IMX_COMPOSITE_FW_MANAGED	BIT(2)
 
 struct clk_hw *imx8m_clk_hw_composite_flags(const char *name,
 					    const char * const *parent_names,
@@ -570,6 +571,17 @@ struct clk_hw *imx8m_clk_hw_composite_flags(const char *name,
 		ARRAY_SIZE(parent_names), reg, 0, \
 		flags | CLK_SET_RATE_NO_REPARENT | CLK_OPS_PARENT_ENABLE)
 
+#define __imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, flags) \
+	imx8m_clk_hw_composite_flags(name, parent_names, \
+		ARRAY_SIZE(parent_names), reg, IMX_COMPOSITE_FW_MANAGED, \
+		flags | CLK_GET_RATE_NOCACHE | CLK_SET_RATE_NO_REPARENT | CLK_OPS_PARENT_ENABLE)
+
+#define imx8m_clk_hw_fw_managed_composite(name, parent_names, reg) \
+	__imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, 0)
+
+#define imx8m_clk_hw_fw_managed_composite_critical(name, parent_names, reg) \
+	__imx8m_clk_hw_fw_managed_composite(name, parent_names, reg, CLK_IS_CRITICAL)
+
 #define __imx8m_clk_composite(name, parent_names, reg, flags) \
 	to_clk(__imx8m_clk_hw_composite(name, parent_names, reg, flags))
 

From bda5602c1c35fb22847951607776d49352322e47 Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@linux.ibm.com>
Date: Thu, 5 Aug 2021 18:26:14 -0300
Subject: [PATCH 0091/1750] KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines

[ Upstream commit 5d7d6dac8fe99ed59eee2300e4a03370f94d5222 ]

The __kvmhv_copy_tofrom_guest_radix function was introduced along with
nested HV guest support. It uses the platform's Radix MMU quadrants to
provide a nested hypervisor with fast access to its nested guests
memory (H_COPY_TOFROM_GUEST hypercall). It has also since been added
as a fast path for the kvmppc_ld/st routines which are used during
instruction emulation.

The commit def0bfdbd603 ("powerpc: use probe_user_read() and
probe_user_write()") changed the low level copy function from
raw_copy_from_user to probe_user_read, which adds a check to
access_ok. In powerpc that is:

 static inline bool __access_ok(unsigned long addr, unsigned long size)
 {
         return addr < TASK_SIZE_MAX && size <= TASK_SIZE_MAX - addr;
 }

and TASK_SIZE_MAX is 0x0010000000000000UL for 64-bit, which means that
setting the two MSBs of the effective address (which correspond to the
quadrant) now cause access_ok to reject the access.

This was not caught earlier because the most common code path via
kvmppc_ld/st contains a fallback (kvm_read_guest) that is likely to
succeed for L1 guests. For nested guests there is no fallback.

Another issue is that probe_user_read (now __copy_from_user_nofault)
does not return the number of bytes not copied in case of failure, so
the destination memory is not being cleared anymore in
kvmhv_copy_from_guest_radix:

 ret = kvmhv_copy_tofrom_guest_radix(vcpu, eaddr, to, NULL, n);
 if (ret > 0)                            <-- always false!
         memset(to + (n - ret), 0, ret);

This patch fixes both issues by skipping access_ok and open-coding the
low level __copy_to/from_user_inatomic.

Fixes: def0bfdbd603 ("powerpc: use probe_user_read() and probe_user_write()")
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210805212616.2641017-2-farosas@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kvm/book3s_64_mmu_radix.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c
index bb35490400e9..04028f905e50 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c
@@ -64,10 +64,12 @@ unsigned long __kvmhv_copy_tofrom_guest_radix(int lpid, int pid,
 	}
 	isync();
 
+	pagefault_disable();
 	if (is_load)
-		ret = copy_from_user_nofault(to, (const void __user *)from, n);
+		ret = __copy_from_user_inatomic(to, (const void __user *)from, n);
 	else
-		ret = copy_to_user_nofault((void __user *)to, from, n);
+		ret = __copy_to_user_inatomic((void __user *)to, from, n);
+	pagefault_enable();
 
 	/* switch the pid first to avoid running host with unallocated pid */
 	if (quadrant == 1 && pid != old_pid)

From 4c0c4f702196a735a3f7cabb4180d37c5a745979 Mon Sep 17 00:00:00 2001
From: Alim Akhtar <alim.akhtar@samsung.com>
Date: Thu, 19 Aug 2021 22:41:31 +0530
Subject: [PATCH 0092/1750] scsi: ufs: ufs-exynos: Fix static checker warning

[ Upstream commit 313bf281f2091552f509fd05a74172c70ce7572f ]

clk_get_rate() returns unsigned long and currently this driver stores the
return value in u32 type, resulting the below warning:

Fixed smatch warnings:

        drivers/scsi/ufs/ufs-exynos.c:286 exynos_ufs_get_clk_info()
        warn: wrong type for 'ufs->mclk_rate' (should be 'ulong')

        drivers/scsi/ufs/ufs-exynos.c:287 exynos_ufs_get_clk_info()
        warn: wrong type for 'pclk_rate' (should be 'ulong')

Link: https://lore.kernel.org/r/20210819171131.55912-1-alim.akhtar@samsung.com
Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufs-exynos.c | 4 ++--
 drivers/scsi/ufs/ufs-exynos.h | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/ufs/ufs-exynos.c b/drivers/scsi/ufs/ufs-exynos.c
index f54b494ca448..3f4f3d6f48f9 100644
--- a/drivers/scsi/ufs/ufs-exynos.c
+++ b/drivers/scsi/ufs/ufs-exynos.c
@@ -259,7 +259,7 @@ static int exynos_ufs_get_clk_info(struct exynos_ufs *ufs)
 	struct ufs_hba *hba = ufs->hba;
 	struct list_head *head = &hba->clk_list_head;
 	struct ufs_clk_info *clki;
-	u32 pclk_rate;
+	unsigned long pclk_rate;
 	u32 f_min, f_max;
 	u8 div = 0;
 	int ret = 0;
@@ -298,7 +298,7 @@ static int exynos_ufs_get_clk_info(struct exynos_ufs *ufs)
 	}
 
 	if (unlikely(pclk_rate < f_min || pclk_rate > f_max)) {
-		dev_err(hba->dev, "not available pclk range %d\n", pclk_rate);
+		dev_err(hba->dev, "not available pclk range %lu\n", pclk_rate);
 		ret = -EINVAL;
 		goto out;
 	}
diff --git a/drivers/scsi/ufs/ufs-exynos.h b/drivers/scsi/ufs/ufs-exynos.h
index 76d6e39efb2f..541b577c371c 100644
--- a/drivers/scsi/ufs/ufs-exynos.h
+++ b/drivers/scsi/ufs/ufs-exynos.h
@@ -197,7 +197,7 @@ struct exynos_ufs {
 	u32 pclk_div;
 	u32 pclk_avail_min;
 	u32 pclk_avail_max;
-	u32 mclk_rate;
+	unsigned long mclk_rate;
 	int avail_ln_rx;
 	int avail_ln_tx;
 	int rx_sel_idx;

From add8e8c3402f3bb54c66716b23544d2ef289a79d Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Thu, 12 Aug 2021 02:00:43 +1000
Subject: [PATCH 0093/1750] KVM: PPC: Book3S HV Nested: Reflect guest PMU
 in-use to L0 when guest SPRs are live

[ Upstream commit 1782663897945a5cf28e564ba5eed730098e9aa4 ]

After the L1 saves its PMU SPRs but before loading the L2's PMU SPRs,
switch the pmcregs_in_use field in the L1 lppaca to the value advertised
by the L2 in its VPA. On the way out of the L2, set it back after saving
the L2 PMU registers (if they were in-use).

This transfers the PMU liveness indication between the L1 and L2 at the
points where the registers are not live.

This fixes the nested HV bug for which a workaround was added to the L0
HV by commit 63279eeb7f93a ("KVM: PPC: Book3S HV: Always save guest pmu
for guest capable of nesting"), which explains the problem in detail.
That workaround is no longer required for guests that include this bug
fix.

Fixes: 360cae313702 ("KVM: PPC: Book3S HV: Nested guest entry via hypercall")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Reviewed-by: Fabiano Rosas <farosas@linux.ibm.com>
Link: https://lore.kernel.org/r/20210811160134.904987-10-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/pmc.h |  7 +++++++
 arch/powerpc/kvm/book3s_hv.c   | 20 ++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/arch/powerpc/include/asm/pmc.h b/arch/powerpc/include/asm/pmc.h
index c6bbe9778d3c..3c09109e708e 100644
--- a/arch/powerpc/include/asm/pmc.h
+++ b/arch/powerpc/include/asm/pmc.h
@@ -34,6 +34,13 @@ static inline void ppc_set_pmu_inuse(int inuse)
 #endif
 }
 
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+static inline int ppc_get_pmu_inuse(void)
+{
+	return get_paca()->pmcregs_in_use;
+}
+#endif
+
 extern void power4_enable_pmcs(void);
 
 #else /* CONFIG_PPC64 */
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index bd7350a608d4..175967a195c4 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -58,6 +58,7 @@
 #include <asm/kvm_book3s.h>
 #include <asm/mmu_context.h>
 #include <asm/lppaca.h>
+#include <asm/pmc.h>
 #include <asm/processor.h>
 #include <asm/cputhreads.h>
 #include <asm/page.h>
@@ -3619,6 +3620,18 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit,
 	    cpu_has_feature(CPU_FTR_P9_TM_HV_ASSIST))
 		kvmppc_restore_tm_hv(vcpu, vcpu->arch.shregs.msr, true);
 
+#ifdef CONFIG_PPC_PSERIES
+	if (kvmhv_on_pseries()) {
+		barrier();
+		if (vcpu->arch.vpa.pinned_addr) {
+			struct lppaca *lp = vcpu->arch.vpa.pinned_addr;
+			get_lppaca()->pmcregs_in_use = lp->pmcregs_in_use;
+		} else {
+			get_lppaca()->pmcregs_in_use = 1;
+		}
+		barrier();
+	}
+#endif
 	kvmhv_load_guest_pmu(vcpu);
 
 	msr_check_and_set(MSR_FP | MSR_VEC | MSR_VSX);
@@ -3756,6 +3769,13 @@ static int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit,
 	save_pmu |= nesting_enabled(vcpu->kvm);
 
 	kvmhv_save_guest_pmu(vcpu, save_pmu);
+#ifdef CONFIG_PPC_PSERIES
+	if (kvmhv_on_pseries()) {
+		barrier();
+		get_lppaca()->pmcregs_in_use = ppc_get_pmu_inuse();
+		barrier();
+	}
+#endif
 
 	vc->entry_exit_map = 0x101;
 	vc->in_guest = 0;

From 903ca538f5882404f7764c3c93b5c82c4794a288 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Thu, 26 Aug 2021 16:08:22 +0200
Subject: [PATCH 0094/1750] platform/x86: dell-smbios-wmi: Add missing kfree in
 error-exit from run_smbios_call

[ Upstream commit 0487d4fc42d7f31a56cfd9e2237f9ebd889e6112 ]

As pointed out be Kees Cook if we return -EIO because the
obj->type != ACPI_TYPE_BUFFER, then we must kfree the
output buffer before the return.

Fixes: 1a258e670434 ("platform/x86: dell-smbios-wmi: Add new WMI dispatcher driver")
Reported-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210826140822.71198-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/dell-smbios-wmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c
index c97bd4a45242..5821e9d9a4ce 100644
--- a/drivers/platform/x86/dell-smbios-wmi.c
+++ b/drivers/platform/x86/dell-smbios-wmi.c
@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev)
 		if (obj->type == ACPI_TYPE_INTEGER)
 			dev_dbg(&wdev->dev, "SMBIOS call failed: %llu\n",
 				obj->integer.value);
+		kfree(output.pointer);
 		return -EIO;
 	}
 	memcpy(&priv->buf->std, obj->buffer.pointer, obj->buffer.length);

From e91077cf1780108dc586cedf1d19f65b44fa3870 Mon Sep 17 00:00:00 2001
From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Date: Thu, 26 Aug 2021 15:34:00 +0530
Subject: [PATCH 0095/1750] powerpc/smp: Update cpu_core_map on all PowerPc
 systems

[ Upstream commit b8b928030332a0ca16d42433eb2c3085600d8704 ]

lscpu() uses core_siblings to list the number of sockets in the
system. core_siblings is set using topology_core_cpumask.

While optimizing the powerpc bootup path, Commit 4ca234a9cbd7
("powerpc/smp: Stop updating cpu_core_mask").  it was found that
updating cpu_core_mask() ended up taking a lot of time. It was thought
that on Powerpc, cpu_core_mask() would always be same as
cpu_cpu_mask() i.e number of sockets will always be equal to number of
nodes. As an optimization, cpu_core_mask() was made a snapshot of
cpu_cpu_mask().

However that was found to be false with PowerPc KVM guests, where each
node could have more than one socket. So with Commit c47f892d7aa6
("powerpc/smp: Reintroduce cpu_core_mask"), cpu_core_mask was updated
based on chip_id but in an optimized way using some mask manipulations
and chip_id caching.

However on non-PowerNV and non-pseries KVM guests (i.e not
implementing cpu_to_chip_id(), continued to use a copy of
cpu_cpu_mask().

There are two issues that were noticed on such systems
1. lscpu would report one extra socket.
On a IBM,9009-42A (aka zz system) which has only 2 chips/ sockets/
nodes, lscpu would report
Architecture:        ppc64le
Byte Order:          Little Endian
CPU(s):              160
On-line CPU(s) list: 0-159
Thread(s) per core:  8
Core(s) per socket:  6
Socket(s):           3                <--------------
NUMA node(s):        2
Model:               2.2 (pvr 004e 0202)
Model name:          POWER9 (architected), altivec supported
Hypervisor vendor:   pHyp
Virtualization type: para
L1d cache:           32K
L1i cache:           32K
L2 cache:            512K
L3 cache:            10240K
NUMA node0 CPU(s):   0-79
NUMA node1 CPU(s):   80-159

2. Currently cpu_cpu_mask is updated when a core is
added/removed. However its not updated when smt mode switching or on
CPUs are explicitly offlined. However all other percpu masks are
updated to ensure only active/online CPUs are in the masks.
This results in build_sched_domain traces since there will be CPUs in
cpu_cpu_mask() but those CPUs are not present in SMT / CACHE / MC /
NUMA domains. A loop of threads running smt mode switching and core
add/remove will soon show this trace.
Hence cpu_cpu_mask has to be update at smt mode switch.

This will have impact on cpu_core_mask(). cpu_core_mask() is a
snapshot of cpu_cpu_mask. Different CPUs within the same socket will
end up having different cpu_core_masks since they are snapshots at
different points of time. This means when lscpu will start reporting
many more sockets than the actual number of sockets/ nodes / chips.

Different ways to handle this problem:
A. Update the snapshot aka cpu_core_mask for all CPUs whenever
   cpu_cpu_mask is updated. This would a non-optimal solution.
B. Instead of a cpumask_var_t, make cpu_core_map a cpumask pointer
   pointing to cpu_cpu_mask. However percpu cpumask pointer is frowned
   upon and we need a clean way to handle PowerPc KVM guest which is
   not a snapshot.
C. Update cpu_core_masks all PowerPc systems like in PowerPc KVM
guests using mask manipulations. This approach is relatively simple
and unifies with the existing code.
D. On top of 3, we could also resurrect get_physical_package_id which
   could return a nid for the said CPU. However this is not needed at this
   time.

Option C is the preferred approach for now.

While this is somewhat a revert of Commit 4ca234a9cbd7 ("powerpc/smp:
Stop updating cpu_core_mask").

1. Plain revert has some conflicts
2. For chip_id == -1, the cpu_core_mask is made identical to
cpu_cpu_mask, unlike previously where cpu_core_mask was set to a core
if chip_id doesn't exist.

This goes by the principle that if chip_id is not exposed, then
sockets / chip / node share the same set of CPUs.

With the fix, lscpu o/p would be
Architecture:        ppc64le
Byte Order:          Little Endian
CPU(s):              160
On-line CPU(s) list: 0-159
Thread(s) per core:  8
Core(s) per socket:  6
Socket(s):           2                     <--------------
NUMA node(s):        2
Model:               2.2 (pvr 004e 0202)
Model name:          POWER9 (architected), altivec supported
Hypervisor vendor:   pHyp
Virtualization type: para
L1d cache:           32K
L1i cache:           32K
L2 cache:            512K
L3 cache:            10240K
NUMA node0 CPU(s):   0-79
NUMA node1 CPU(s):   80-159

Fixes: 4ca234a9cbd7 ("powerpc/smp: Stop updating cpu_core_mask")
Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210826100401.412519-3-srikar@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/smp.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 26a028a9233a..91f274134884 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -1385,6 +1385,7 @@ static void add_cpu_to_masks(int cpu)
 	 * add it to it's own thread sibling mask.
 	 */
 	cpumask_set_cpu(cpu, cpu_sibling_mask(cpu));
+	cpumask_set_cpu(cpu, cpu_core_mask(cpu));
 
 	for (i = first_thread; i < first_thread + threads_per_core; i++)
 		if (cpu_online(i))
@@ -1399,11 +1400,6 @@ static void add_cpu_to_masks(int cpu)
 	if (has_coregroup_support())
 		update_coregroup_mask(cpu, &mask);
 
-	if (chip_id == -1 || !ret) {
-		cpumask_copy(per_cpu(cpu_core_map, cpu), cpu_cpu_mask(cpu));
-		goto out;
-	}
-
 	if (shared_caches)
 		submask_fn = cpu_l2_cache_mask;
 
@@ -1413,6 +1409,10 @@ static void add_cpu_to_masks(int cpu)
 	/* Skip all CPUs already part of current CPU core mask */
 	cpumask_andnot(mask, cpu_online_mask, cpu_core_mask(cpu));
 
+	/* If chip_id is -1; limit the cpu_core_mask to within DIE*/
+	if (chip_id == -1)
+		cpumask_and(mask, mask, cpu_cpu_mask(cpu));
+
 	for_each_cpu(i, mask) {
 		if (chip_id == cpu_to_chip_id(i)) {
 			or_cpumasks_related(cpu, i, submask_fn, cpu_core_mask);
@@ -1422,7 +1422,6 @@ static void add_cpu_to_masks(int cpu)
 		}
 	}
 
-out:
 	free_cpumask_var(mask);
 }
 

From b4849e2ac706387fed6af98e88f619c49cecc4a8 Mon Sep 17 00:00:00 2001
From: Wenpeng Liang <liangwenpeng@huawei.com>
Date: Thu, 26 Aug 2021 21:37:31 +0800
Subject: [PATCH 0096/1750] RDMA/hns: Fix QP's resp incomplete assignment

[ Upstream commit d2e0ccffcdd7209fc9881c8970d2a7e28dcb43b9 ]

The resp passed to the user space represents the enable flag of qp,
incomplete assignment will cause some features of the user space to be
disabled.

Fixes: 90ae0b57e4a5 ("RDMA/hns: Combine enable flags of qp")
Fixes: aba457ca890c ("RDMA/hns: Support owner mode doorbell")
Link: https://lore.kernel.org/r/1629985056-57004-3-git-send-email-liangwenpeng@huawei.com
Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_qp.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index ef1452215b17..7ce9ad8aee1e 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -740,7 +740,6 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 				goto err_out;
 			}
 			hr_qp->en_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB;
-			resp->cap_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB;
 		}
 
 		if (user_qp_has_rdb(hr_dev, init_attr, udata, resp)) {
@@ -752,7 +751,6 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 				goto err_sdb;
 			}
 			hr_qp->en_flags |= HNS_ROCE_QP_CAP_RQ_RECORD_DB;
-			resp->cap_flags |= HNS_ROCE_QP_CAP_RQ_RECORD_DB;
 		}
 	} else {
 		/* QP doorbell register address */
@@ -959,6 +957,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
 	}
 
 	if (udata) {
+		resp.cap_flags = hr_qp->en_flags;
 		ret = ib_copy_to_udata(udata, &resp,
 				       min(udata->outlen, sizeof(resp)));
 		if (ret) {

From 9bab2bc4c238ca5a2faeb26db03808d95784a204 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Thu, 17 Jun 2021 14:21:00 +0100
Subject: [PATCH 0097/1750] fscache: Fix cookie key hashing

[ Upstream commit 35b72573e977ed6b18b094136a4fa3e0ffb13603 ]

The current hash algorithm used for hashing cookie keys is really bad,
producing almost no dispersion (after a test kernel build, ~30000 files
were split over just 18 out of the 32768 hash buckets).

Borrow the full_name_hash() hash function into fscache to do the hashing
for cookie keys and, in the future, volume keys.

I don't want to use full_name_hash() as-is because I want the hash value to
be consistent across arches and over time as the hash value produced may
get used on disk.

I can also optimise parts of it away as the key will always be a padded
array of aligned 32-bit words.

Fixes: ec0328e46d6e ("fscache: Maintain a catalogue of allocated cookies")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
cc: linux-cachefs@redhat.com
Link: https://lore.kernel.org/r/162431201844.2908479.8293647220901514696.stgit@warthog.procyon.org.uk/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fscache/cookie.c   | 14 +-------------
 fs/fscache/internal.h |  2 ++
 fs/fscache/main.c     | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+), 13 deletions(-)

diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
index 751bc5b1cddf..6104f627cc71 100644
--- a/fs/fscache/cookie.c
+++ b/fs/fscache/cookie.c
@@ -74,10 +74,8 @@ void fscache_free_cookie(struct fscache_cookie *cookie)
 static int fscache_set_key(struct fscache_cookie *cookie,
 			   const void *index_key, size_t index_key_len)
 {
-	unsigned long long h;
 	u32 *buf;
 	int bufs;
-	int i;
 
 	bufs = DIV_ROUND_UP(index_key_len, sizeof(*buf));
 
@@ -91,17 +89,7 @@ static int fscache_set_key(struct fscache_cookie *cookie,
 	}
 
 	memcpy(buf, index_key, index_key_len);
-
-	/* Calculate a hash and combine this with the length in the first word
-	 * or first half word
-	 */
-	h = (unsigned long)cookie->parent;
-	h += index_key_len + cookie->type;
-
-	for (i = 0; i < bufs; i++)
-		h += buf[i];
-
-	cookie->key_hash = h ^ (h >> 32);
+	cookie->key_hash = fscache_hash(0, buf, bufs);
 	return 0;
 }
 
diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
index 08e91efbce53..64aa552b296d 100644
--- a/fs/fscache/internal.h
+++ b/fs/fscache/internal.h
@@ -97,6 +97,8 @@ extern struct workqueue_struct *fscache_object_wq;
 extern struct workqueue_struct *fscache_op_wq;
 DECLARE_PER_CPU(wait_queue_head_t, fscache_object_cong_wait);
 
+extern unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n);
+
 static inline bool fscache_object_congested(void)
 {
 	return workqueue_congested(WORK_CPU_UNBOUND, fscache_object_wq);
diff --git a/fs/fscache/main.c b/fs/fscache/main.c
index c1e6cc9091aa..4207f98e405f 100644
--- a/fs/fscache/main.c
+++ b/fs/fscache/main.c
@@ -93,6 +93,45 @@ static struct ctl_table fscache_sysctls_root[] = {
 };
 #endif
 
+/*
+ * Mixing scores (in bits) for (7,20):
+ * Input delta: 1-bit      2-bit
+ * 1 round:     330.3     9201.6
+ * 2 rounds:   1246.4    25475.4
+ * 3 rounds:   1907.1    31295.1
+ * 4 rounds:   2042.3    31718.6
+ * Perfect:    2048      31744
+ *            (32*64)   (32*31/2 * 64)
+ */
+#define HASH_MIX(x, y, a)	\
+	(	x ^= (a),	\
+	y ^= x,	x = rol32(x, 7),\
+	x += y,	y = rol32(y,20),\
+	y *= 9			)
+
+static inline unsigned int fold_hash(unsigned long x, unsigned long y)
+{
+	/* Use arch-optimized multiply if one exists */
+	return __hash_32(y ^ __hash_32(x));
+}
+
+/*
+ * Generate a hash.  This is derived from full_name_hash(), but we want to be
+ * sure it is arch independent and that it doesn't change as bits of the
+ * computed hash value might appear on disk.  The caller also guarantees that
+ * the hashed data will be a series of aligned 32-bit words.
+ */
+unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n)
+{
+	unsigned int a, x = 0, y = salt;
+
+	for (; n; n--) {
+		a = *data++;
+		HASH_MIX(x, y, a);
+	}
+	return fold_hash(x, y);
+}
+
 /*
  * initialise the fs caching module
  */

From 6bf98b94ffeb4dea48b288d874e6be8ecba36191 Mon Sep 17 00:00:00 2001
From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Date: Wed, 7 Jul 2021 16:12:13 +0300
Subject: [PATCH 0098/1750] clk: at91: clk-generated: Limit the requested rate
 to our range

[ Upstream commit af7651e67b9d5f7e63ea23b118e3672ac662244a ]

On clk_generated_determine_rate(), the requested rate could be outside
of clk's range. Limit the rate to the clock's range to not return an
error.

Fixes: df70aeef6083 ("clk: at91: add generated clock driver")
Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Link: https://lore.kernel.org/r/20210707131213.3283509-1-codrin.ciubotariu@microchip.com
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/clk-generated.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
index b4fc8d71daf2..b656d25a9767 100644
--- a/drivers/clk/at91/clk-generated.c
+++ b/drivers/clk/at91/clk-generated.c
@@ -128,6 +128,12 @@ static int clk_generated_determine_rate(struct clk_hw *hw,
 	int i;
 	u32 div;
 
+	/* do not look for a rate that is outside of our range */
+	if (gck->range.max && req->rate > gck->range.max)
+		req->rate = gck->range.max;
+	if (gck->range.min && req->rate < gck->range.min)
+		req->rate = gck->range.min;
+
 	for (i = 0; i < clk_hw_get_num_parents(hw); i++) {
 		if (gck->chg_pid == i)
 			continue;

From d320c1b2e7282de155d21b6f22cfc39e99ee3410 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik@ozlabs.ru>
Date: Fri, 27 Aug 2021 14:07:06 +1000
Subject: [PATCH 0099/1750] KVM: PPC: Fix clearing never mapped TCEs in
 realmode

[ Upstream commit 1d78dfde33a02da1d816279c2e3452978b7abd39 ]

Since commit e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on
demand too"), pages for TCE tables for KVM guests are allocated only
when needed. This allows skipping any update when clearing TCEs. This
works mostly fine as TCE updates are handled when the MMU is enabled.
The realmode handlers fail with H_TOO_HARD when pages are not yet
allocated, except when clearing a TCE in which case KVM prints a warning
and proceeds to dereference a NULL pointer, which crashes the host OS.

This has not been caught so far as the change in commit e1a1ef84cd07 is
reasonably new, and POWER9 runs mostly radix which does not use realmode
handlers. With hash, the default TCE table is memset() by QEMU when the
machine is reset which triggers page faults and the KVM TCE device's
kvm_spapr_tce_fault() handles those with MMU on. And the huge DMA
windows are not cleared by VMs which instead successfully create a DMA
window big enough to map the VM memory 1:1 and then VMs just map
everything without clearing.

This started crashing now as commit 381ceda88c4c ("powerpc/pseries/iommu:
Make use of DDW for indirect mapping") added a mode when a dymanic DMA
window not big enough to map the VM memory 1:1 but it is used anyway,
and the VM now is the first (i.e. not QEMU) to clear a just created
table. Note that upstream QEMU needs to be modified to trigger the VM to
trigger the host OS crash.

This replaces WARN_ON_ONCE_RM() with a check and return, and adds
another warning if TCE is not being cleared.

Fixes: e1a1ef84cd07 ("KVM: PPC: Book3S: Allocate guest TCEs on demand too")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210827040706.517652-1-aik@ozlabs.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kvm/book3s_64_vio_hv.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index 083a4e037718..e5ba96c41f3f 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -173,10 +173,13 @@ static void kvmppc_rm_tce_put(struct kvmppc_spapr_tce_table *stt,
 	idx -= stt->offset;
 	page = stt->pages[idx / TCES_PER_PAGE];
 	/*
-	 * page must not be NULL in real mode,
-	 * kvmppc_rm_ioba_validate() must have taken care of this.
+	 * kvmppc_rm_ioba_validate() allows pages not be allocated if TCE is
+	 * being cleared, otherwise it returns H_TOO_HARD and we skip this.
 	 */
-	WARN_ON_ONCE_RM(!page);
+	if (!page) {
+		WARN_ON_ONCE_RM(tce != 0);
+		return;
+	}
 	tbl = kvmppc_page_address(page);
 
 	tbl[idx % TCES_PER_PAGE] = tce;

From fd69f613af534eebd6fd79eb27b5b0a0d6b94686 Mon Sep 17 00:00:00 2001
From: Yongqiang Niu <yongqiang.niu@mediatek.com>
Date: Mon, 2 Aug 2021 15:52:26 +0800
Subject: [PATCH 0100/1750] soc: mediatek: cmdq: add address shift in jump

[ Upstream commit 8b60ed2b1674b78ebc433a11efa7d48821229037 ]

Add address shift when compose jump instruction
to compatible with 35bit format.

Fixes: 0858fde496f8 ("mailbox: cmdq: variablize address shift in platform")
Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
Reviewed-by: Nicolas Boichat <drinkcat@chromium.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mailbox/mtk-cmdq-mailbox.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
index 5665b6ea8119..75378e35c3d6 100644
--- a/drivers/mailbox/mtk-cmdq-mailbox.c
+++ b/drivers/mailbox/mtk-cmdq-mailbox.c
@@ -168,7 +168,8 @@ static void cmdq_task_insert_into_thread(struct cmdq_task *task)
 	dma_sync_single_for_cpu(dev, prev_task->pa_base,
 				prev_task->pkt->cmd_buf_size, DMA_TO_DEVICE);
 	prev_task_base[CMDQ_NUM_CMD(prev_task->pkt) - 1] =
-		(u64)CMDQ_JUMP_BY_PA << 32 | task->pa_base;
+		(u64)CMDQ_JUMP_BY_PA << 32 |
+		(task->pa_base >> task->cmdq->shift_pa);
 	dma_sync_single_for_device(dev, prev_task->pa_base,
 				   prev_task->pkt->cmd_buf_size, DMA_TO_DEVICE);
 

From 45cb5f86c1c65da62806d0c9618e9351a4025efa Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Tue, 24 Aug 2021 08:12:08 +0800
Subject: [PATCH 0101/1750] f2fs: fix to account missing .skipped_gc_rwsem

[ Upstream commit ad126ebddecbf696e0cf214ff56c7b170fa9f0f7 ]

There is a missing place we forgot to account .skipped_gc_rwsem, fix it.

Fixes: 6f8d4455060d ("f2fs: avoid fi->i_gc_rwsem[WRITE] lock in f2fs_gc")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/gc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
index e02affb5c0e7..72f227f6ebad 100644
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1477,8 +1477,10 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,
 			int err;
 
 			if (S_ISREG(inode->i_mode)) {
-				if (!down_write_trylock(&fi->i_gc_rwsem[READ]))
+				if (!down_write_trylock(&fi->i_gc_rwsem[READ])) {
+					sbi->skipped_gc_rwsem++;
 					continue;
+				}
 				if (!down_write_trylock(
 						&fi->i_gc_rwsem[WRITE])) {
 					sbi->skipped_gc_rwsem++;

From 1c934aba9fd531580f5fedefcd3364d68c560471 Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Thu, 26 Aug 2021 10:03:15 +0800
Subject: [PATCH 0102/1750] f2fs: fix unexpected ENOENT comes from
 f2fs_map_blocks()

[ Upstream commit adf9ea89c719c1d23794e363f631e376b3ff8cbc ]

In below path, it will return ENOENT if filesystem is shutdown:

- f2fs_map_blocks
 - f2fs_get_dnode_of_data
  - f2fs_get_node_page
   - __get_node_page
    - read_node_page
     - is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN)
       return -ENOENT
 - force return value from ENOENT to 0

It should be fine for read case, since it indicates a hole condition,
and caller could use .m_next_pgofs to skip the hole and continue the
lookup.

However it may cause confusing for write case, since leaving a hole
there, and said nothing was wrong doesn't help.

There is at least one case from dax_iomap_actor() will complain that,
so fix this in prior to supporting dax in f2fs.

xfstest generic/388 reports below warning:

ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 485833 at fs/dax.c:1127 dax_iomap_actor+0x339/0x370
Call Trace:
 iomap_apply+0x1c4/0x7b0
 ? dax_iomap_rw+0x1c0/0x1c0
 dax_iomap_rw+0xad/0x1c0
 ? dax_iomap_rw+0x1c0/0x1c0
 f2fs_file_write_iter+0x5ab/0x970 [f2fs]
 do_iter_readv_writev+0x273/0x2e0
 do_iter_write+0xab/0x1f0
 vfs_iter_write+0x21/0x40
 iter_file_splice_write+0x287/0x540
 do_splice+0x37c/0xa60
 __x64_sys_splice+0x15f/0x3a0
 do_syscall_64+0x3b/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae

ubuntu godown: xfstests-induced forced shutdown of /mnt/scratch_f2fs:
------------[ cut here ]------------
RIP: 0010:dax_iomap_pte_fault.isra.0+0x72e/0x14a0
Call Trace:
 dax_iomap_fault+0x44/0x70
 f2fs_dax_huge_fault+0x155/0x400 [f2fs]
 f2fs_dax_fault+0x18/0x30 [f2fs]
 __do_fault+0x4e/0x120
 do_fault+0x3cf/0x7a0
 __handle_mm_fault+0xa8c/0xf20
 ? find_held_lock+0x39/0xd0
 handle_mm_fault+0x1b6/0x480
 do_user_addr_fault+0x320/0xcd0
 ? rcu_read_lock_sched_held+0x67/0xc0
 exc_page_fault+0x77/0x3f0
 ? asm_exc_page_fault+0x8/0x30
 asm_exc_page_fault+0x1e/0x30

Fixes: 83a3bfdb5a8a ("f2fs: indicate shutdown f2fs to allow unmount successfully")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/data.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index cfae2dddb0ba..70a91c47f72f 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1550,7 +1550,21 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
 	if (err) {
 		if (flag == F2FS_GET_BLOCK_BMAP)
 			map->m_pblk = 0;
+
 		if (err == -ENOENT) {
+			/*
+			 * There is one exceptional case that read_node_page()
+			 * may return -ENOENT due to filesystem has been
+			 * shutdown or cp_error, so force to convert error
+			 * number to EIO for such case.
+			 */
+			if (map->m_may_create &&
+				(is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN) ||
+				f2fs_cp_error(sbi))) {
+				err = -EIO;
+				goto unlock_out;
+			}
+
 			err = 0;
 			if (map->m_next_pgofs)
 				*map->m_next_pgofs =

From 4b71928e5c547e774cb4767da0959f9970a4f0f0 Mon Sep 17 00:00:00 2001
From: Chao Yu <chao@kernel.org>
Date: Wed, 25 Aug 2021 19:34:19 +0800
Subject: [PATCH 0103/1750] f2fs: fix to unmap pages from userspace process in
 punch_hole()

[ Upstream commit c8dc3047c48540183744f959412d44b08c5435e1 ]

We need to unmap pages from userspace process before removing pagecache
in punch_hole() like we did in f2fs_setattr().

Similar change:
commit 5e44f8c374dc ("ext4: hole-punch use truncate_pagecache_range")

Fixes: fbfa2cc58d53 ("f2fs: add file operations")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/file.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 6ee8b1e0e174..1fbaab1f7aba 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1080,7 +1080,6 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
 		}
 
 		if (pg_start < pg_end) {
-			struct address_space *mapping = inode->i_mapping;
 			loff_t blk_start, blk_end;
 			struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
 
@@ -1092,8 +1091,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len)
 			down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
 			down_write(&F2FS_I(inode)->i_mmap_sem);
 
-			truncate_inode_pages_range(mapping, blk_start,
-					blk_end - 1);
+			truncate_pagecache_range(inode, blk_start, blk_end - 1);
 
 			f2fs_lock_op(sbi);
 			ret = f2fs_truncate_hole(inode, pg_start, pg_end);

From d04925fb8d7081108fba1ea21ce7a6d14e64eabd Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk@kernel.org>
Date: Mon, 30 Aug 2021 11:37:32 -0700
Subject: [PATCH 0104/1750] f2fs: deallocate compressed pages when error
 happens

[ Upstream commit 827f02842e40ea2e00f401e8f4cb1bccf3b8cd86 ]

In f2fs_write_multi_pages(), f2fs_compress_pages() allocates pages for
compression work in cc->cpages[]. Then, f2fs_write_compressed_pages() initiates
bio submission. But, if there's any error before submitting the IOs like early
f2fs_cp_error(), previously it didn't free cpages by f2fs_compress_free_page().
Let's fix memory leak by putting that just before deallocating cc->cpages.

Fixes: 4c8ff7095bef ("f2fs: support data compression")
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/compress.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index f94b13075ea4..30987ea011f1 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -1308,12 +1308,6 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
 
 	for (--i; i >= 0; i--)
 		fscrypt_finalize_bounce_page(&cc->cpages[i]);
-	for (i = 0; i < cc->nr_cpages; i++) {
-		if (!cc->cpages[i])
-			continue;
-		f2fs_compress_free_page(cc->cpages[i]);
-		cc->cpages[i] = NULL;
-	}
 out_put_cic:
 	kmem_cache_free(cic_entry_slab, cic);
 out_put_dnode:
@@ -1324,6 +1318,12 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
 	else
 		f2fs_unlock_op(sbi);
 out_free:
+	for (i = 0; i < cc->nr_cpages; i++) {
+		if (!cc->cpages[i])
+			continue;
+		f2fs_compress_free_page(cc->cpages[i]);
+		cc->cpages[i] = NULL;
+	}
 	page_array_free(cc->inode, cc->cpages, cc->nr_cpages);
 	cc->cpages = NULL;
 	return -EAGAIN;

From bb8108546da97d7c66a8abe93af5ce04b68b509e Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk@kernel.org>
Date: Mon, 30 Aug 2021 13:30:45 -0700
Subject: [PATCH 0105/1750] f2fs: should put a page beyond EOF when preparing a
 write

[ Upstream commit 9605f75cf36e0bcc0f4ada07b5be712d30107607 ]

The prepare_compress_overwrite() gets/locks a page to prepare a read, and calls
f2fs_read_multi_pages() which checks EOF first. If there's any page beyond EOF,
we unlock the page and set cc->rpages[i] = NULL, which we can't put the page
anymore. This makes page leak, so let's fix by putting that page.

Fixes: a949dc5f2c5c ("f2fs: compress: fix race condition of overwrite vs truncate")
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/f2fs/data.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 70a91c47f72f..1b11a42847c4 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2219,6 +2219,8 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
 			continue;
 		}
 		unlock_page(page);
+		if (for_write)
+			put_page(page);
 		cc->rpages[i] = NULL;
 		cc->nr_rpages--;
 	}

From 981bf9b0aa1bffe3d98607e4024aa42fb8024bf0 Mon Sep 17 00:00:00 2001
From: Oleksij Rempel <o.rempel@pengutronix.de>
Date: Thu, 2 Sep 2021 09:19:51 +0200
Subject: [PATCH 0106/1750] MIPS: Malta: fix alignment of the devicetree buffer

[ Upstream commit bea6a94a279bcbe6b2cde348782b28baf12255a5 ]

Starting with following patch MIPS Malta is not able to boot:
| commit 79edff12060fe7772af08607eff50c0e2486c5ba
| Author: Rob Herring <robh@kernel.org>
| scripts/dtc: Update to upstream version v1.6.0-51-g183df9e9c2b9

The reason is the alignment test added to the fdt_ro_probe_(). To fix
this issue, we need to make sure that fdt_buf is aligned.

Since the dtc patch was designed to uncover potential issue, I handle
initial MIPS Malta patch as initial bug.

Fixes: e81a8c7dabac ("MIPS: Malta: Setup RAM regions via DT")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/mti-malta/malta-dtshim.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/mti-malta/malta-dtshim.c b/arch/mips/mti-malta/malta-dtshim.c
index 0ddf03df6268..f451268f6c38 100644
--- a/arch/mips/mti-malta/malta-dtshim.c
+++ b/arch/mips/mti-malta/malta-dtshim.c
@@ -22,7 +22,7 @@
 #define  ROCIT_CONFIG_GEN1_MEMMAP_SHIFT	8
 #define  ROCIT_CONFIG_GEN1_MEMMAP_MASK	(0xf << 8)
 
-static unsigned char fdt_buf[16 << 10] __initdata;
+static unsigned char fdt_buf[16 << 10] __initdata __aligned(8);
 
 /* determined physical memory size, not overridden by command line args	 */
 extern unsigned long physical_memsize;

From 1e4cfe954bd9c42242bb21292c3dd9fb7f384104 Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <masahiroy@kernel.org>
Date: Thu, 19 Aug 2021 09:01:14 +0900
Subject: [PATCH 0107/1750] kbuild: Fix 'no symbols' warning when
 CONFIG_TRIM_UNUSD_KSYMS=y

[ Upstream commit 52d83df682c82055961531853c066f4f16e234ea ]

When CONFIG_TRIM_UNUSED_KSYMS is enabled, I see some warnings like this:

  nm: arch/x86/entry/vdso/vdso32/note.o: no symbols

$NM (both GNU nm and llvm-nm) warns when no symbol is found in the
object. Suppress the stderr.

Fangrui Song mentioned binutils>=2.37 `nm -q` can be used to suppress
"no symbols" [1], and llvm-nm>=13.0.0 supports -q as well.

We cannot use it for now, but note it as a TODO.

[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=27408

Fixes: bbda5ec671d3 ("kbuild: simplify dependency generation for CONFIG_TRIM_UNUSED_KSYMS")
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/gen_ksymdeps.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/gen_ksymdeps.sh b/scripts/gen_ksymdeps.sh
index 1324986e1362..725e8c9c1b53 100755
--- a/scripts/gen_ksymdeps.sh
+++ b/scripts/gen_ksymdeps.sh
@@ -4,7 +4,13 @@
 set -e
 
 # List of exported symbols
-ksyms=$($NM $1 | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z)
+#
+# If the object has no symbol, $NM warns 'no symbols'.
+# Suppress the stderr.
+# TODO:
+#   Use -q instead of 2>/dev/null when we upgrade the minimum version of
+#   binutils to 2.37, llvm to 13.0.0.
+ksyms=$($NM $1 2>/dev/null | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z)
 
 if [ -z "$ksyms" ]; then
 	exit 0

From 6afd1e053d9bd1f39cf03f2b0702ad0b06b647bd Mon Sep 17 00:00:00 2001
From: Nadav Amit <namit@vmware.com>
Date: Thu, 2 Sep 2021 14:58:59 -0700
Subject: [PATCH 0108/1750] userfaultfd: prevent concurrent API initialization

[ Upstream commit 22e5fe2a2a279d9a6fcbdfb4dffe73821bef1c90 ]

userfaultfd assumes that the enabled features are set once and never
changed after UFFDIO_API ioctl succeeded.

However, currently, UFFDIO_API can be called concurrently from two
different threads, succeed on both threads and leave userfaultfd's
features in non-deterministic state.  Theoretically, other uffd operations
(ioctl's and page-faults) can be dispatched while adversely affected by
such changes of features.

Moreover, the writes to ctx->state and ctx->features are not ordered,
which can - theoretically, again - let userfaultfd_ioctl() think that
userfaultfd API completed, while the features are still not initialized.

To avoid races, it is arguably best to get rid of ctx->state.  Since there
are only 2 states, record the API initialization in ctx->features as the
uppermost bit and remove ctx->state.

Link: https://lkml.kernel.org/r/20210808020724.1022515-3-namit@vmware.com
Fixes: 9cd75c3cd4c3d ("userfaultfd: non-cooperative: add ability to report non-PF events from uffd descriptor")
Signed-off-by: Nadav Amit <namit@vmware.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Peter Xu <peterx@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/userfaultfd.c | 91 +++++++++++++++++++++++-------------------------
 1 file changed, 44 insertions(+), 47 deletions(-)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 3d181b1a6d56..17397c7532f1 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -32,11 +32,6 @@ int sysctl_unprivileged_userfaultfd __read_mostly = 1;
 
 static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
 
-enum userfaultfd_state {
-	UFFD_STATE_WAIT_API,
-	UFFD_STATE_RUNNING,
-};
-
 /*
  * Start with fault_pending_wqh and fault_wqh so they're more likely
  * to be in the same cacheline.
@@ -68,8 +63,6 @@ struct userfaultfd_ctx {
 	unsigned int flags;
 	/* features requested from the userspace */
 	unsigned int features;
-	/* state machine */
-	enum userfaultfd_state state;
 	/* released */
 	bool released;
 	/* memory mappings are changing because of non-cooperative event */
@@ -103,6 +96,14 @@ struct userfaultfd_wake_range {
 	unsigned long len;
 };
 
+/* internal indication that UFFD_API ioctl was successfully executed */
+#define UFFD_FEATURE_INITIALIZED		(1u << 31)
+
+static bool userfaultfd_is_initialized(struct userfaultfd_ctx *ctx)
+{
+	return ctx->features & UFFD_FEATURE_INITIALIZED;
+}
+
 static int userfaultfd_wake_function(wait_queue_entry_t *wq, unsigned mode,
 				     int wake_flags, void *key)
 {
@@ -659,7 +660,6 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs)
 
 		refcount_set(&ctx->refcount, 1);
 		ctx->flags = octx->flags;
-		ctx->state = UFFD_STATE_RUNNING;
 		ctx->features = octx->features;
 		ctx->released = false;
 		ctx->mmap_changing = false;
@@ -936,38 +936,33 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait)
 
 	poll_wait(file, &ctx->fd_wqh, wait);
 
-	switch (ctx->state) {
-	case UFFD_STATE_WAIT_API:
+	if (!userfaultfd_is_initialized(ctx))
 		return EPOLLERR;
-	case UFFD_STATE_RUNNING:
-		/*
-		 * poll() never guarantees that read won't block.
-		 * userfaults can be waken before they're read().
-		 */
-		if (unlikely(!(file->f_flags & O_NONBLOCK)))
-			return EPOLLERR;
-		/*
-		 * lockless access to see if there are pending faults
-		 * __pollwait last action is the add_wait_queue but
-		 * the spin_unlock would allow the waitqueue_active to
-		 * pass above the actual list_add inside
-		 * add_wait_queue critical section. So use a full
-		 * memory barrier to serialize the list_add write of
-		 * add_wait_queue() with the waitqueue_active read
-		 * below.
-		 */
-		ret = 0;
-		smp_mb();
-		if (waitqueue_active(&ctx->fault_pending_wqh))
-			ret = EPOLLIN;
-		else if (waitqueue_active(&ctx->event_wqh))
-			ret = EPOLLIN;
 
-		return ret;
-	default:
-		WARN_ON_ONCE(1);
+	/*
+	 * poll() never guarantees that read won't block.
+	 * userfaults can be waken before they're read().
+	 */
+	if (unlikely(!(file->f_flags & O_NONBLOCK)))
 		return EPOLLERR;
-	}
+	/*
+	 * lockless access to see if there are pending faults
+	 * __pollwait last action is the add_wait_queue but
+	 * the spin_unlock would allow the waitqueue_active to
+	 * pass above the actual list_add inside
+	 * add_wait_queue critical section. So use a full
+	 * memory barrier to serialize the list_add write of
+	 * add_wait_queue() with the waitqueue_active read
+	 * below.
+	 */
+	ret = 0;
+	smp_mb();
+	if (waitqueue_active(&ctx->fault_pending_wqh))
+		ret = EPOLLIN;
+	else if (waitqueue_active(&ctx->event_wqh))
+		ret = EPOLLIN;
+
+	return ret;
 }
 
 static const struct file_operations userfaultfd_fops;
@@ -1161,7 +1156,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,
 	struct uffd_msg msg;
 	int no_wait = file->f_flags & O_NONBLOCK;
 
-	if (ctx->state == UFFD_STATE_WAIT_API)
+	if (!userfaultfd_is_initialized(ctx))
 		return -EINVAL;
 
 	for (;;) {
@@ -1816,9 +1811,10 @@ static int userfaultfd_writeprotect(struct userfaultfd_ctx *ctx,
 static inline unsigned int uffd_ctx_features(__u64 user_features)
 {
 	/*
-	 * For the current set of features the bits just coincide
+	 * For the current set of features the bits just coincide. Set
+	 * UFFD_FEATURE_INITIALIZED to mark the features as enabled.
 	 */
-	return (unsigned int)user_features;
+	return (unsigned int)user_features | UFFD_FEATURE_INITIALIZED;
 }
 
 /*
@@ -1831,12 +1827,10 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
 {
 	struct uffdio_api uffdio_api;
 	void __user *buf = (void __user *)arg;
+	unsigned int ctx_features;
 	int ret;
 	__u64 features;
 
-	ret = -EINVAL;
-	if (ctx->state != UFFD_STATE_WAIT_API)
-		goto out;
 	ret = -EFAULT;
 	if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api)))
 		goto out;
@@ -1853,9 +1847,13 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
 	ret = -EFAULT;
 	if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
 		goto out;
-	ctx->state = UFFD_STATE_RUNNING;
+
 	/* only enable the requested features for this uffd context */
-	ctx->features = uffd_ctx_features(features);
+	ctx_features = uffd_ctx_features(features);
+	ret = -EINVAL;
+	if (cmpxchg(&ctx->features, 0, ctx_features) != 0)
+		goto err_out;
+
 	ret = 0;
 out:
 	return ret;
@@ -1872,7 +1870,7 @@ static long userfaultfd_ioctl(struct file *file, unsigned cmd,
 	int ret = -EINVAL;
 	struct userfaultfd_ctx *ctx = file->private_data;
 
-	if (cmd != UFFDIO_API && ctx->state == UFFD_STATE_WAIT_API)
+	if (cmd != UFFDIO_API && !userfaultfd_is_initialized(ctx))
 		return -EINVAL;
 
 	switch(cmd) {
@@ -1976,7 +1974,6 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
 	refcount_set(&ctx->refcount, 1);
 	ctx->flags = flags;
 	ctx->features = 0;
-	ctx->state = UFFD_STATE_WAIT_API;
 	ctx->released = false;
 	ctx->mmap_changing = false;
 	ctx->mm = current->mm;

From b32d3ded9dc2987edbc3427e66238bfdfcecf0ad Mon Sep 17 00:00:00 2001
From: Dom Cobley <popcornmix@gmail.com>
Date: Tue, 25 May 2021 15:23:48 +0200
Subject: [PATCH 0109/1750] drm/vc4: hdmi: Set HD_CTL_WHOLSMP and
 HD_CTL_CHALIGN_SET

[ Upstream commit 1698ecb218eb82587dbfc71a2e26ded66e5ecf59 ]

Symptom is random switching of speakers when using multichannel.

Repeatedly running speakertest -c8 occasionally starts with
channels jumbled. This is fixed with HD_CTL_WHOLSMP.

The other bit looks beneficial and apears harmless in testing so
I'd suggest adding it too.

Documentation says: HD_CTL_WHILSMP_SET
Wait for whole sample. When this bit is set MAI transmit will start
only when there is at least one whole sample available in the fifo.

Documentation says: HD_CTL_CHALIGN_SET
Channel Align When Overflow. This bit is used to realign the audio
channels in case of an overflow.
If this bit is set, after the detection of an overflow, equal
amount of dummy words to the missing words will be written to fifo,
filling up the broken sample and maintaining alignment.

Signed-off-by: Dom Cobley <popcornmix@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Reviewed-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210525132354.297468-7-maxime@cerno.tech
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vc4/vc4_hdmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c
index c58b8840090a..ee293f061f0a 100644
--- a/drivers/gpu/drm/vc4/vc4_hdmi.c
+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
@@ -1074,7 +1074,9 @@ static int vc4_hdmi_audio_trigger(struct snd_pcm_substream *substream, int cmd,
 		HDMI_WRITE(HDMI_MAI_CTL,
 			   VC4_SET_FIELD(vc4_hdmi->audio.channels,
 					 VC4_HD_MAI_CTL_CHNUM) |
-			   VC4_HD_MAI_CTL_ENABLE);
+					 VC4_HD_MAI_CTL_WHOLSMP |
+					 VC4_HD_MAI_CTL_CHALIGN |
+					 VC4_HD_MAI_CTL_ENABLE);
 		break;
 	case SNDRV_PCM_TRIGGER_STOP:
 		HDMI_WRITE(HDMI_MAI_CTL,

From 10a135969fd7419695c003ddb67ef8a7820a808b Mon Sep 17 00:00:00 2001
From: Luben Tuikov <luben.tuikov@amd.com>
Date: Fri, 26 Mar 2021 16:40:22 -0400
Subject: [PATCH 0110/1750] drm/amdgpu: Fix amdgpu_ras_eeprom_init()

[ Upstream commit dce4400e6516d18313d23de45b5be8a18980b00e ]

No need to account for the 2 bytes of EEPROM
address--this is now well abstracted away by
the fixes the the lower layers.

Cc: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Cc: Alexander Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
Acked-by: Alexander Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
index 0e64c39a2372..7c3efc5f1be0 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c
@@ -305,7 +305,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control *control,
 		return ret;
 	}
 
-	__decode_table_header_from_buff(hdr, &buff[2]);
+	__decode_table_header_from_buff(hdr, buff);
 
 	if (hdr->header == EEPROM_TABLE_HDR_VAL) {
 		control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) /

From 2048907d8cb7b295a9efd86b18f6f11e3d602b92 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Wed, 7 Jul 2021 14:47:52 -0700
Subject: [PATCH 0111/1750] ASoC: atmel: ATMEL drivers don't need HAS_DMA

[ Upstream commit 6c5c659dfe3f02e08054a6c20019e3886618b512 ]

On a config (such as arch/sh/) which does not set HAS_DMA when MMU
is not set, several ATMEL ASoC drivers select symbols that cause
kconfig warnings. There is one "depends on HAS_DMA" which is no longer
needed. Dropping it eliminates the kconfig warnings and still builds
with no problems reported.

Fix the following kconfig warnings:

WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_PDC
  Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n]
  Selected by [m]:
  - SND_ATMEL_SOC_SSC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m]
  - SND_ATMEL_SOC_SSC_PDC [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]

WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_PDC
  Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
  Selected by [m]:
  - SND_AT91_SOC_SAM9G20_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]

WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC
  Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && HAS_DMA [=n]
  Selected by [m]:
  - SND_ATMEL_SOC_SSC_DMA [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m]

WARNING: unmet direct dependencies detected for SND_ATMEL_SOC_SSC_DMA
  Depends on [n]: SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && ATMEL_SSC [=m] && HAS_DMA [=n]
  Selected by [m]:
  - SND_ATMEL_SOC_WM8904 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && I2C [=m]
  - SND_AT91_SOC_SAM9X5_WM8731 [=m] && SOUND [=m] && !UML && SND [=m] && SND_SOC [=m] && SND_ATMEL_SOC [=m] && (ARCH_AT91 || COMPILE_TEST [=y]) && ATMEL_SSC [=m] && SND_SOC_I2C_AND_SPI [=m]

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20210707214752.3831-1-rdunlap@infradead.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/atmel/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
index 142373ec411a..89210048e6c2 100644
--- a/sound/soc/atmel/Kconfig
+++ b/sound/soc/atmel/Kconfig
@@ -11,7 +11,6 @@ if SND_ATMEL_SOC
 
 config SND_ATMEL_SOC_PDC
 	bool
-	depends on HAS_DMA
 
 config SND_ATMEL_SOC_DMA
 	bool

From 6a985c579499f9998d00992f3840383bd9c303e2 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Thu, 17 Jun 2021 13:28:57 +0200
Subject: [PATCH 0112/1750] media: dib8000: rewrite the init prbs logic

[ Upstream commit 8db11aebdb8f93f46a8513c22c9bd52fa23263aa ]

The logic at dib8000_get_init_prbs() has a few issues:

1. the tables used there has an extra unused value at the beginning;
2. the dprintk() message doesn't write the right value when
   transmission mode is not 8K;
3. the array overflow validation is done by the callers.

Rewrite the code to fix such issues.

This should also shut up those smatch warnings:

	drivers/media/dvb-frontends/dib8000.c:2125 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14
	drivers/media/dvb-frontends/dib8000.c:2129 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_2k' 14 <= 14
	drivers/media/dvb-frontends/dib8000.c:2131 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_4k' 14 <= 14
	drivers/media/dvb-frontends/dib8000.c:2134 dib8000_get_init_prbs() error: buffer overflow 'lut_prbs_8k' 14 <= 14

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/dib8000.c | 58 +++++++++++++++++++--------
 1 file changed, 41 insertions(+), 17 deletions(-)

diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c
index 082796534b0a..bb02354a48b8 100644
--- a/drivers/media/dvb-frontends/dib8000.c
+++ b/drivers/media/dvb-frontends/dib8000.c
@@ -2107,32 +2107,55 @@ static void dib8000_load_ana_fe_coefs(struct dib8000_state *state, const s16 *an
 			dib8000_write_word(state, 117 + mode, ana_fe[mode]);
 }
 
-static const u16 lut_prbs_2k[14] = {
-	0, 0x423, 0x009, 0x5C7, 0x7A6, 0x3D8, 0x527, 0x7FF, 0x79B, 0x3D6, 0x3A2, 0x53B, 0x2F4, 0x213
+static const u16 lut_prbs_2k[13] = {
+	0x423, 0x009, 0x5C7,
+	0x7A6, 0x3D8, 0x527,
+	0x7FF, 0x79B, 0x3D6,
+	0x3A2, 0x53B, 0x2F4,
+	0x213
 };
-static const u16 lut_prbs_4k[14] = {
-	0, 0x208, 0x0C3, 0x7B9, 0x423, 0x5C7, 0x3D8, 0x7FF, 0x3D6, 0x53B, 0x213, 0x029, 0x0D0, 0x48E
+
+static const u16 lut_prbs_4k[13] = {
+	0x208, 0x0C3, 0x7B9,
+	0x423, 0x5C7, 0x3D8,
+	0x7FF, 0x3D6, 0x53B,
+	0x213, 0x029, 0x0D0,
+	0x48E
 };
-static const u16 lut_prbs_8k[14] = {
-	0, 0x740, 0x069, 0x7DD, 0x208, 0x7B9, 0x5C7, 0x7FF, 0x53B, 0x029, 0x48E, 0x4C4, 0x367, 0x684
+
+static const u16 lut_prbs_8k[13] = {
+	0x740, 0x069, 0x7DD,
+	0x208, 0x7B9, 0x5C7,
+	0x7FF, 0x53B, 0x029,
+	0x48E, 0x4C4, 0x367,
+	0x684
 };
 
 static u16 dib8000_get_init_prbs(struct dib8000_state *state, u16 subchannel)
 {
 	int sub_channel_prbs_group = 0;
+	int prbs_group;
 
-	sub_channel_prbs_group = (subchannel / 3) + 1;
-	dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]);
+	sub_channel_prbs_group = subchannel / 3;
+	if (sub_channel_prbs_group >= ARRAY_SIZE(lut_prbs_2k))
+		return 0;
 
 	switch (state->fe[0]->dtv_property_cache.transmission_mode) {
 	case TRANSMISSION_MODE_2K:
-			return lut_prbs_2k[sub_channel_prbs_group];
+		prbs_group = lut_prbs_2k[sub_channel_prbs_group];
+		break;
 	case TRANSMISSION_MODE_4K:
-			return lut_prbs_4k[sub_channel_prbs_group];
+		prbs_group =  lut_prbs_4k[sub_channel_prbs_group];
+		break;
 	default:
 	case TRANSMISSION_MODE_8K:
-			return lut_prbs_8k[sub_channel_prbs_group];
+		prbs_group = lut_prbs_8k[sub_channel_prbs_group];
 	}
+
+	dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n",
+		sub_channel_prbs_group, subchannel, prbs_group);
+
+	return prbs_group;
 }
 
 static void dib8000_set_13seg_channel(struct dib8000_state *state)
@@ -2409,10 +2432,8 @@ static void dib8000_set_isdbt_common_channel(struct dib8000_state *state, u8 seq
 	/* TSB or ISDBT ? apply it now */
 	if (c->isdbt_sb_mode) {
 		dib8000_set_sb_channel(state);
-		if (c->isdbt_sb_subchannel < 14)
-			init_prbs = dib8000_get_init_prbs(state, c->isdbt_sb_subchannel);
-		else
-			init_prbs = 0;
+		init_prbs = dib8000_get_init_prbs(state,
+						  c->isdbt_sb_subchannel);
 	} else {
 		dib8000_set_13seg_channel(state);
 		init_prbs = 0xfff;
@@ -3004,6 +3025,7 @@ static int dib8000_tune(struct dvb_frontend *fe)
 
 	unsigned long *timeout = &state->timeout;
 	unsigned long now = jiffies;
+	u16 init_prbs;
 #ifdef DIB8000_AGC_FREEZE
 	u16 agc1, agc2;
 #endif
@@ -3302,8 +3324,10 @@ static int dib8000_tune(struct dvb_frontend *fe)
 		break;
 
 	case CT_DEMOD_STEP_11:  /* 41 : init prbs autosearch */
-		if (state->subchannel <= 41) {
-			dib8000_set_subchannel_prbs(state, dib8000_get_init_prbs(state, state->subchannel));
+		init_prbs = dib8000_get_init_prbs(state, state->subchannel);
+
+		if (init_prbs) {
+			dib8000_set_subchannel_prbs(state, init_prbs);
 			*tune_state = CT_DEMOD_STEP_9;
 		} else {
 			*tune_state = CT_DEMOD_STOP;

From c327b69e96b0d17b56ebf15ebdf3262148f7e7af Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <m@lambda.lt>
Date: Mon, 12 Jul 2021 14:55:51 +0200
Subject: [PATCH 0113/1750] libbpf: Fix reuse of pinned map on older kernel

[ Upstream commit 97eb31384af943d6b97eb5947262cee4ef25cb87 ]

When loading a BPF program with a pinned map, the loader checks whether
the pinned map can be reused, i.e. their properties match. To derive
such of the pinned map, the loader invokes BPF_OBJ_GET_INFO_BY_FD and
then does the comparison.

Unfortunately, on < 4.12 kernels the BPF_OBJ_GET_INFO_BY_FD is not
available, so loading the program fails with the following error:

	libbpf: failed to get map info for map FD 5: Invalid argument
	libbpf: couldn't reuse pinned map at
		'/sys/fs/bpf/tc/globals/cilium_call_policy': parameter
		mismatch"
	libbpf: map 'cilium_call_policy': error reusing pinned map
	libbpf: map 'cilium_call_policy': failed to create:
		Invalid argument(-22)
	libbpf: failed to load object 'bpf_overlay.o'

To fix this, fallback to derivation of the map properties via
/proc/$PID/fdinfo/$MAP_FD if BPF_OBJ_GET_INFO_BY_FD fails with EINVAL,
which can be used as an indicator that the kernel doesn't support
the latter.

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20210712125552.58705-1-m@lambda.lt
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 48 +++++++++++++++++++++++++++++++++++++++---
 1 file changed, 45 insertions(+), 3 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 28923b776cdc..0dad862b3b9d 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -3613,6 +3613,42 @@ static int bpf_map_find_btf_info(struct bpf_object *obj, struct bpf_map *map)
 	return 0;
 }
 
+static int bpf_get_map_info_from_fdinfo(int fd, struct bpf_map_info *info)
+{
+	char file[PATH_MAX], buff[4096];
+	FILE *fp;
+	__u32 val;
+	int err;
+
+	snprintf(file, sizeof(file), "/proc/%d/fdinfo/%d", getpid(), fd);
+	memset(info, 0, sizeof(*info));
+
+	fp = fopen(file, "r");
+	if (!fp) {
+		err = -errno;
+		pr_warn("failed to open %s: %d. No procfs support?\n", file,
+			err);
+		return err;
+	}
+
+	while (fgets(buff, sizeof(buff), fp)) {
+		if (sscanf(buff, "map_type:\t%u", &val) == 1)
+			info->type = val;
+		else if (sscanf(buff, "key_size:\t%u", &val) == 1)
+			info->key_size = val;
+		else if (sscanf(buff, "value_size:\t%u", &val) == 1)
+			info->value_size = val;
+		else if (sscanf(buff, "max_entries:\t%u", &val) == 1)
+			info->max_entries = val;
+		else if (sscanf(buff, "map_flags:\t%i", &val) == 1)
+			info->map_flags = val;
+	}
+
+	fclose(fp);
+
+	return 0;
+}
+
 int bpf_map__reuse_fd(struct bpf_map *map, int fd)
 {
 	struct bpf_map_info info = {};
@@ -3621,6 +3657,8 @@ int bpf_map__reuse_fd(struct bpf_map *map, int fd)
 	char *new_name;
 
 	err = bpf_obj_get_info_by_fd(fd, &info, &len);
+	if (err && errno == EINVAL)
+		err = bpf_get_map_info_from_fdinfo(fd, &info);
 	if (err)
 		return err;
 
@@ -4032,12 +4070,16 @@ static bool map_is_reuse_compat(const struct bpf_map *map, int map_fd)
 	struct bpf_map_info map_info = {};
 	char msg[STRERR_BUFSIZE];
 	__u32 map_info_len;
+	int err;
 
 	map_info_len = sizeof(map_info);
 
-	if (bpf_obj_get_info_by_fd(map_fd, &map_info, &map_info_len)) {
-		pr_warn("failed to get map info for map FD %d: %s\n",
-			map_fd, libbpf_strerror_r(errno, msg, sizeof(msg)));
+	err = bpf_obj_get_info_by_fd(map_fd, &map_info, &map_info_len);
+	if (err && errno == EINVAL)
+		err = bpf_get_map_info_from_fdinfo(map_fd, &map_info);
+	if (err) {
+		pr_warn("failed to get map info for map FD %d: %s\n", map_fd,
+			libbpf_strerror_r(errno, msg, sizeof(msg)));
 		return false;
 	}
 

From 871abd1e6185fa0e066ced9ef8b7a517388f18e8 Mon Sep 17 00:00:00 2001
From: Ani Sinha <ani@anisinha.ca>
Date: Tue, 13 Jul 2021 08:35:21 +0530
Subject: [PATCH 0114/1750] x86/hyperv: fix for unwanted manipulation of
 sched_clock when TSC marked unstable

[ Upstream commit c445535c3efbfb8cb42d098e624d46ab149664b7 ]

Marking TSC as unstable has a side effect of marking sched_clock as
unstable when TSC is still being used as the sched_clock. This is not
desirable. Hyper-V ultimately uses a paravirtualized clock source that
provides a stable scheduler clock even on systems without TscInvariant
CPU capability. Hence, mark_tsc_unstable() call should be called _after_
scheduler clock has been changed to the paravirtualized clocksource. This
will prevent any unwanted manipulation of the sched_clock. Only TSC will
be correctly marked as unstable.

Signed-off-by: Ani Sinha <ani@anisinha.ca>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Tested-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20210713030522.1714803-1-ani@anisinha.ca
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/cpu/mshyperv.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
index 6cc50ab07bde..65d11711cd7b 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -322,8 +322,6 @@ static void __init ms_hyperv_init_platform(void)
 	if (ms_hyperv.features & HV_ACCESS_TSC_INVARIANT) {
 		wrmsrl(HV_X64_MSR_TSC_INVARIANT_CONTROL, 0x1);
 		setup_force_cpu_cap(X86_FEATURE_TSC_RELIABLE);
-	} else {
-		mark_tsc_unstable("running on Hyper-V");
 	}
 
 	/*
@@ -382,6 +380,13 @@ static void __init ms_hyperv_init_platform(void)
 	/* Register Hyper-V specific clocksource */
 	hv_init_clocksource();
 #endif
+	/*
+	 * TSC should be marked as unstable only after Hyper-V
+	 * clocksource has been initialized. This ensures that the
+	 * stability of the sched_clock is not altered.
+	 */
+	if (!(ms_hyperv.features & HV_ACCESS_TSC_INVARIANT))
+		mark_tsc_unstable("running on Hyper-V");
 }
 
 const __initconst struct hypervisor_x86 x86_hyper_ms_hyperv = {

From aad29a00a5983d3ed2d6ca06d2ab63a4f8a61adc Mon Sep 17 00:00:00 2001
From: Sean Anderson <sean.anderson@seco.com>
Date: Thu, 1 Jul 2021 14:56:38 -0400
Subject: [PATCH 0115/1750] crypto: mxs-dcp - Use sg_mapping_iter to copy data

[ Upstream commit 2e6d793e1bf07fe5e20cfbbdcec9e1af7e5097eb ]

This uses the sg_pcopy_from_buffer to copy data, instead of doing it
ourselves.

In addition to reducing code size, this fixes the following oops
resulting from failing to kmap the page:

[   68.896381] Unable to handle kernel NULL pointer dereference at virtual address 00000ab8
[   68.904539] pgd = 3561adb3
[   68.907475] [00000ab8] *pgd=00000000
[   68.911153] Internal error: Oops: 805 [#1] ARM
[   68.915618] Modules linked in: cfg80211 rfkill des_generic libdes arc4 libarc4 cbc ecb algif_skcipher sha256_generic libsha256 sha1_generic hmac aes_generic libaes cmac sha512_generic md5 md4 algif_hash af_alg i2c_imx i2c_core ci_hdrc_imx ci_hdrc mxs_dcp ulpi roles udc_core imx_sdma usbmisc_imx usb_common firmware_class virt_dma phy_mxs_usb nf_tables nfnetlink ip_tables x_tables ipv6 autofs4
[   68.950741] CPU: 0 PID: 139 Comm: mxs_dcp_chan/ae Not tainted 5.10.34 #296
[   68.958501] Hardware name: Freescale i.MX6 Ultralite (Device Tree)
[   68.964710] PC is at memcpy+0xa8/0x330
[   68.968479] LR is at 0xd7b2bc9d
[   68.971638] pc : [<c053e7c8>]    lr : [<d7b2bc9d>]    psr: 000f0013
[   68.977920] sp : c2cbbee4  ip : 00000010  fp : 00000010
[   68.983159] r10: 00000000  r9 : c3283a40  r8 : 1a5a6f08
[   68.988402] r7 : 4bfe0ecc  r6 : 76d8a220  r5 : c32f9050  r4 : 00000001
[   68.994945] r3 : 00000ab8  r2 : fffffff0  r1 : c32f9050  r0 : 00000ab8
[   69.001492] Flags: nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   69.008646] Control: 10c53c7d  Table: 83664059  DAC: 00000051
[   69.014414] Process mxs_dcp_chan/ae (pid: 139, stack limit = 0x667b57ab)
[   69.021133] Stack: (0xc2cbbee4 to 0xc2cbc000)
[   69.025519] bee0:          c32f9050 c3235408 00000010 00000010 00000ab8 00000001 bf10406c
[   69.033720] bf00: 00000000 00000000 00000010 00000000 c32355d0 832fb080 00000000 c13de2fc
[   69.041921] bf20: c3628010 00000010 c33d5780 00000ab8 bf1067e8 00000002 c21e5010 c2cba000
[   69.050125] bf40: c32f8040 00000000 bf106a40 c32f9040 c3283a80 00000001 bf105240 c3234040
[   69.058327] bf60: ffffe000 c3204100 c2c69800 c2cba000 00000000 bf103b84 00000000 c2eddc54
[   69.066530] bf80: c3204144 c0140d1c c2cba000 c2c69800 c0140be8 00000000 00000000 00000000
[   69.074730] bfa0: 00000000 00000000 00000000 c0100114 00000000 00000000 00000000 00000000
[   69.082932] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   69.091131] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
[   69.099364] [<c053e7c8>] (memcpy) from [<bf10406c>] (dcp_chan_thread_aes+0x4e8/0x840 [mxs_dcp])
[   69.108117] [<bf10406c>] (dcp_chan_thread_aes [mxs_dcp]) from [<c0140d1c>] (kthread+0x134/0x160)
[   69.116941] [<c0140d1c>] (kthread) from [<c0100114>] (ret_from_fork+0x14/0x20)
[   69.124178] Exception stack(0xc2cbbfb0 to 0xc2cbbff8)
[   69.129250] bfa0:                                     00000000 00000000 00000000 00000000
[   69.137450] bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   69.145648] bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   69.152289] Code: e320f000 e4803004 e4804004 e4805004 (e4806004)

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/mxs-dcp.c | 36 +++++++++---------------------------
 1 file changed, 9 insertions(+), 27 deletions(-)

diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
index 7daed8b78ac8..5edc91cdb4e6 100644
--- a/drivers/crypto/mxs-dcp.c
+++ b/drivers/crypto/mxs-dcp.c
@@ -299,21 +299,20 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
 
 	struct scatterlist *dst = req->dst;
 	struct scatterlist *src = req->src;
-	const int nents = sg_nents(req->src);
+	int dst_nents = sg_nents(dst);
 
 	const int out_off = DCP_BUF_SZ;
 	uint8_t *in_buf = sdcp->coh->aes_in_buf;
 	uint8_t *out_buf = sdcp->coh->aes_out_buf;
 
-	uint8_t *out_tmp, *src_buf, *dst_buf = NULL;
 	uint32_t dst_off = 0;
+	uint8_t *src_buf = NULL;
 	uint32_t last_out_len = 0;
 
 	uint8_t *key = sdcp->coh->aes_key;
 
 	int ret = 0;
-	int split = 0;
-	unsigned int i, len, clen, rem = 0, tlen = 0;
+	unsigned int i, len, clen, tlen = 0;
 	int init = 0;
 	bool limit_hit = false;
 
@@ -331,7 +330,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
 		memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128);
 	}
 
-	for_each_sg(req->src, src, nents, i) {
+	for_each_sg(req->src, src, sg_nents(src), i) {
 		src_buf = sg_virt(src);
 		len = sg_dma_len(src);
 		tlen += len;
@@ -356,34 +355,17 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq)
 			 * submit the buffer.
 			 */
 			if (actx->fill == out_off || sg_is_last(src) ||
-				limit_hit) {
+			    limit_hit) {
 				ret = mxs_dcp_run_aes(actx, req, init);
 				if (ret)
 					return ret;
 				init = 0;
 
-				out_tmp = out_buf;
+				sg_pcopy_from_buffer(dst, dst_nents, out_buf,
+						     actx->fill, dst_off);
+				dst_off += actx->fill;
 				last_out_len = actx->fill;
-				while (dst && actx->fill) {
-					if (!split) {
-						dst_buf = sg_virt(dst);
-						dst_off = 0;
-					}
-					rem = min(sg_dma_len(dst) - dst_off,
-						  actx->fill);
-
-					memcpy(dst_buf + dst_off, out_tmp, rem);
-					out_tmp += rem;
-					dst_off += rem;
-					actx->fill -= rem;
-
-					if (dst_off == sg_dma_len(dst)) {
-						dst = sg_next(dst);
-						split = 0;
-					} else {
-						split = 1;
-					}
-				}
+				actx->fill = 0;
 			}
 		} while (len);
 

From cc12ab5951aa3a9d0893614120560179db8659a2 Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Thu, 8 Jul 2021 15:25:06 +0200
Subject: [PATCH 0116/1750] PCI: Use pci_update_current_state() in
 pci_enable_device_flags()

[ Upstream commit 14858dcc3b3587f4bb5c48e130ee7d68fc2b0a29 ]

Updating the current_state field of struct pci_dev the way it is done
in pci_enable_device_flags() before calling do_pci_enable_device() may
not work.  For example, if the given PCI device depends on an ACPI
power resource whose _STA method initially returns 0 ("off"), but the
config space of the PCI device is accessible and the power state
retrieved from the PCI_PM_CTRL register is D0, the current_state
field in the struct pci_dev representing that device will get out of
sync with the power.state of its ACPI companion object and that will
lead to power management issues going forward.

To avoid such issues, make pci_enable_device_flags() call
pci_update_current_state() which takes ACPI device power management
into account, if present, to retrieve the current power state of the
device.

Link: https://lore.kernel.org/lkml/20210314000439.3138941-1-luzmaximilian@gmail.com/
Reported-by: Maximilian Luz <luzmaximilian@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Tested-by: Maximilian Luz <luzmaximilian@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 05a84f095fe7..eae6a9fdd33d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1880,11 +1880,7 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags)
 	 * so that things like MSI message writing will behave as expected
 	 * (e.g. if the device really is in D0 at enable time).
 	 */
-	if (dev->pm_cap) {
-		u16 pmcsr;
-		pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr);
-		dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK);
-	}
+	pci_update_current_state(dev, dev->current_state);
 
 	if (atomic_inc_return(&dev->enable_cnt) > 1)
 		return 0;		/* already enabled */

From cca61275874a8807ba357905206961a5decdc326 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Fri, 16 Jul 2021 17:44:07 -0400
Subject: [PATCH 0117/1750] tipc: keep the skb in rcv queue until the whole
 data is read

[ Upstream commit f4919ff59c2828064b4156e3c3600a169909bcf4 ]

Currently, when userspace reads a datagram with a buffer that is
smaller than this datagram, the data will be truncated and only
part of it can be received by users. It doesn't seem right that
users don't know the datagram size and have to use a huge buffer
to read it to avoid the truncation.

This patch to fix it by keeping the skb in rcv queue until the
whole data is read by users. Only the last msg of the datagram
will be marked with MSG_EOR, just as TCP/SCTP does.

Note that this will work as above only when MSG_EOR is set in the
flags parameter of recvmsg(), so that it won't break any old user
applications.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/socket.c | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 9bd72468bc68..963047c57c27 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1887,6 +1887,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 	bool connected = !tipc_sk_type_connectionless(sk);
 	struct tipc_sock *tsk = tipc_sk(sk);
 	int rc, err, hlen, dlen, copy;
+	struct tipc_skb_cb *skb_cb;
 	struct sk_buff_head xmitq;
 	struct tipc_msg *hdr;
 	struct sk_buff *skb;
@@ -1910,6 +1911,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 		if (unlikely(rc))
 			goto exit;
 		skb = skb_peek(&sk->sk_receive_queue);
+		skb_cb = TIPC_SKB_CB(skb);
 		hdr = buf_msg(skb);
 		dlen = msg_data_sz(hdr);
 		hlen = msg_hdr_sz(hdr);
@@ -1929,18 +1931,33 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 
 	/* Capture data if non-error msg, otherwise just set return value */
 	if (likely(!err)) {
-		copy = min_t(int, dlen, buflen);
-		if (unlikely(copy != dlen))
-			m->msg_flags |= MSG_TRUNC;
-		rc = skb_copy_datagram_msg(skb, hlen, m, copy);
+		int offset = skb_cb->bytes_read;
+
+		copy = min_t(int, dlen - offset, buflen);
+		rc = skb_copy_datagram_msg(skb, hlen + offset, m, copy);
+		if (unlikely(rc))
+			goto exit;
+		if (unlikely(offset + copy < dlen)) {
+			if (flags & MSG_EOR) {
+				if (!(flags & MSG_PEEK))
+					skb_cb->bytes_read = offset + copy;
+			} else {
+				m->msg_flags |= MSG_TRUNC;
+				skb_cb->bytes_read = 0;
+			}
+		} else {
+			if (flags & MSG_EOR)
+				m->msg_flags |= MSG_EOR;
+			skb_cb->bytes_read = 0;
+		}
 	} else {
 		copy = 0;
 		rc = 0;
-		if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control)
+		if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control) {
 			rc = -ECONNRESET;
+			goto exit;
+		}
 	}
-	if (unlikely(rc))
-		goto exit;
 
 	/* Mark message as group event if applicable */
 	if (unlikely(grp_evt)) {
@@ -1963,9 +1980,10 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 		tipc_node_distr_xmit(sock_net(sk), &xmitq);
 	}
 
-	tsk_advance_rx_queue(sk);
+	if (!skb_cb->bytes_read)
+		tsk_advance_rx_queue(sk);
 
-	if (likely(!connected))
+	if (likely(!connected) || skb_cb->bytes_read)
 		goto exit;
 
 	/* Send connection flow control advertisement when applicable */

From e78a0b4a339e8cc5343947680829f35a942b64fa Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Sat, 17 Jul 2021 14:32:49 +0200
Subject: [PATCH 0118/1750] net: phy: Fix data type in DP83822
 dp8382x_disable_wol()

[ Upstream commit 0d6835ffe50c9c1f098b5704394331710b67af48 ]

The last argument of phy_clear_bits_mmd(..., u16 val); is u16 and not
int, just inline the value into the function call arguments.

No functional change.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/dp83822.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
index a9b058bb1be8..7bf43031cea8 100644
--- a/drivers/net/phy/dp83822.c
+++ b/drivers/net/phy/dp83822.c
@@ -305,11 +305,9 @@ static int dp83822_config_intr(struct phy_device *phydev)
 
 static int dp8382x_disable_wol(struct phy_device *phydev)
 {
-	int value = DP83822_WOL_EN | DP83822_WOL_MAGIC_EN |
-		    DP83822_WOL_SECURE_ON;
-
-	return phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
-				  MII_DP83822_WOL_CFG, value);
+	return phy_clear_bits_mmd(phydev, DP83822_DEVADDR, MII_DP83822_WOL_CFG,
+				  DP83822_WOL_EN | DP83822_WOL_MAGIC_EN |
+				  DP83822_WOL_SECURE_ON);
 }
 
 static int dp83822_read_status(struct phy_device *phydev)

From 9f11de56012c413140390de736d8c44800602750 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Sun, 27 Jun 2021 17:32:37 +0100
Subject: [PATCH 0119/1750] iio: dac: ad5624r: Fix incorrect handling of an
 optional regulator.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 97683c851f9cdbd3ea55697cbe2dcb6af4287bbd ]

The naming of the regulator is problematic.  VCC is usually a supply
voltage whereas these devices have a separate VREF pin.

Secondly, the regulator core might have provided a stub regulator if
a real regulator wasn't provided. That would in turn have failed to
provide a voltage when queried. So reality was that there was no way
to use the internal reference.

In order to avoid breaking any dts out in the wild, make sure to fallback
to the original vcc naming if vref is not available.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reported-by: kernel test robot <lkp@intel.com>
Acked-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20210627163244.1090296-9-jic23@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/dac/ad5624r_spi.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
index 2b2b8edfd258..ab4997bfd6d4 100644
--- a/drivers/iio/dac/ad5624r_spi.c
+++ b/drivers/iio/dac/ad5624r_spi.c
@@ -229,7 +229,7 @@ static int ad5624r_probe(struct spi_device *spi)
 	if (!indio_dev)
 		return -ENOMEM;
 	st = iio_priv(indio_dev);
-	st->reg = devm_regulator_get(&spi->dev, "vcc");
+	st->reg = devm_regulator_get_optional(&spi->dev, "vref");
 	if (!IS_ERR(st->reg)) {
 		ret = regulator_enable(st->reg);
 		if (ret)
@@ -240,6 +240,22 @@ static int ad5624r_probe(struct spi_device *spi)
 			goto error_disable_reg;
 
 		voltage_uv = ret;
+	} else {
+		if (PTR_ERR(st->reg) != -ENODEV)
+			return PTR_ERR(st->reg);
+		/* Backwards compatibility. This naming is not correct */
+		st->reg = devm_regulator_get_optional(&spi->dev, "vcc");
+		if (!IS_ERR(st->reg)) {
+			ret = regulator_enable(st->reg);
+			if (ret)
+				return ret;
+
+			ret = regulator_get_voltage(st->reg);
+			if (ret < 0)
+				goto error_disable_reg;
+
+			voltage_uv = ret;
+		}
 	}
 
 	spi_set_drvdata(spi, indio_dev);

From 67c9262e3f317c1004329344a17e2ae8ca81965f Mon Sep 17 00:00:00 2001
From: Stefan Assmann <sassmann@kpanic.de>
Date: Fri, 5 Mar 2021 13:38:56 +0100
Subject: [PATCH 0120/1750] iavf: do not override the adapter state in the
 watchdog task

[ Upstream commit 22c8fd71d3a5e6fe584ccc2c1e8760e5baefd5aa ]

The iavf watchdog task overrides adapter->state to __IAVF_RESETTING
when it detects a pending reset. Then schedules iavf_reset_task() which
takes care of the reset.

The reset task is capable of handling the reset without changing
adapter->state. In fact we lose the state information when the watchdog
task prematurely changes the adapter state. This may lead to a crash if
instead of the reset task the iavf_remove() function gets called before
the reset task.
In that case (if we were in state __IAVF_RUNNING previously) the
iavf_remove() function triggers iavf_close() which fails to close the
device because of the incorrect state information.

This may result in a crash due to pending interrupts.
kernel BUG at drivers/pci/msi.c:357!
[...]
Call Trace:
 [<ffffffffbddf24dd>] pci_disable_msix+0x3d/0x50
 [<ffffffffc08d2a63>] iavf_reset_interrupt_capability+0x23/0x40 [iavf]
 [<ffffffffc08d312a>] iavf_remove+0x10a/0x350 [iavf]
 [<ffffffffbddd3359>] pci_device_remove+0x39/0xc0
 [<ffffffffbdeb492f>] __device_release_driver+0x7f/0xf0
 [<ffffffffbdeb49c3>] device_release_driver+0x23/0x30
 [<ffffffffbddcabb4>] pci_stop_bus_device+0x84/0xa0
 [<ffffffffbddcacc2>] pci_stop_and_remove_bus_device+0x12/0x20
 [<ffffffffbddf361f>] pci_iov_remove_virtfn+0xaf/0x160
 [<ffffffffbddf3bcc>] sriov_disable+0x3c/0xf0
 [<ffffffffbddf3ca3>] pci_disable_sriov+0x23/0x30
 [<ffffffffc0667365>] i40e_free_vfs+0x265/0x2d0 [i40e]
 [<ffffffffc0667624>] i40e_pci_sriov_configure+0x144/0x1f0 [i40e]
 [<ffffffffbddd5307>] sriov_numvfs_store+0x177/0x1d0
Code: 00 00 e8 3c 25 e3 ff 49 c7 86 88 08 00 00 00 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 7b 28 e8 0d 44
RIP  [<ffffffffbbbf1068>] free_msi_irqs+0x188/0x190

The solution is to not touch the adapter->state in iavf_watchdog_task()
and let the reset task handle the state transition.

Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/iavf/iavf_main.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
index 7023aa147043..da401d5694bf 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -1951,7 +1951,6 @@ static void iavf_watchdog_task(struct work_struct *work)
 		/* check for hw reset */
 	reg_val = rd32(hw, IAVF_VF_ARQLEN1) & IAVF_VF_ARQLEN1_ARQENABLE_MASK;
 	if (!reg_val) {
-		adapter->state = __IAVF_RESETTING;
 		adapter->flags |= IAVF_FLAG_RESET_PENDING;
 		adapter->aq_required = 0;
 		adapter->current_op = VIRTCHNL_OP_UNKNOWN;

From e0c17c11b15df1fa57e000925f3b40021f8baf90 Mon Sep 17 00:00:00 2001
From: Stefan Assmann <sassmann@kpanic.de>
Date: Tue, 16 Mar 2021 11:01:41 +0100
Subject: [PATCH 0121/1750] iavf: fix locking of critical sections

[ Upstream commit 226d528512cfac890a1619aea4301f3dd314fe60 ]

To avoid races between iavf_init_task(), iavf_reset_task(),
iavf_watchdog_task(), iavf_adminq_task() as well as the shutdown and
remove functions more locking is required.
The current protection by __IAVF_IN_CRITICAL_TASK is needed in
additional places.

- The reset task performs state transitions, therefore needs locking.
- The adminq task acts on replies from the PF in
  iavf_virtchnl_completion() which may alter the states.
- The init task is not only run during probe but also if a VF gets stuck
  to reinitialize it.
- The shutdown function performs a state transition.
- The remove function performs a state transition and also free's
  resources.

iavf_lock_timeout() is introduced to avoid waiting infinitely
and cause a deadlock. Rather unlock and print a warning.

Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/iavf/iavf_main.c | 57 ++++++++++++++++++---
 1 file changed, 50 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
index da401d5694bf..f06c079e812e 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
@@ -131,6 +131,30 @@ enum iavf_status iavf_free_virt_mem_d(struct iavf_hw *hw,
 	return 0;
 }
 
+/**
+ * iavf_lock_timeout - try to set bit but give up after timeout
+ * @adapter: board private structure
+ * @bit: bit to set
+ * @msecs: timeout in msecs
+ *
+ * Returns 0 on success, negative on failure
+ **/
+static int iavf_lock_timeout(struct iavf_adapter *adapter,
+			     enum iavf_critical_section_t bit,
+			     unsigned int msecs)
+{
+	unsigned int wait, delay = 10;
+
+	for (wait = 0; wait < msecs; wait += delay) {
+		if (!test_and_set_bit(bit, &adapter->crit_section))
+			return 0;
+
+		msleep(delay);
+	}
+
+	return -1;
+}
+
 /**
  * iavf_schedule_reset - Set the flags and schedule a reset event
  * @adapter: board private structure
@@ -2064,6 +2088,10 @@ static void iavf_reset_task(struct work_struct *work)
 	if (test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section))
 		return;
 
+	if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200)) {
+		schedule_work(&adapter->reset_task);
+		return;
+	}
 	while (test_and_set_bit(__IAVF_IN_CLIENT_TASK,
 				&adapter->crit_section))
 		usleep_range(500, 1000);
@@ -2278,6 +2306,8 @@ static void iavf_adminq_task(struct work_struct *work)
 	if (!event.msg_buf)
 		goto out;
 
+	if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200))
+		goto freedom;
 	do {
 		ret = iavf_clean_arq_element(hw, &event, &pending);
 		v_op = (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high);
@@ -2291,6 +2321,7 @@ static void iavf_adminq_task(struct work_struct *work)
 		if (pending != 0)
 			memset(event.msg_buf, 0, IAVF_MAX_AQ_BUF_SIZE);
 	} while (pending);
+	clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
 
 	if ((adapter->flags &
 	     (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED)) ||
@@ -3593,6 +3624,10 @@ static void iavf_init_task(struct work_struct *work)
 						    init_task.work);
 	struct iavf_hw *hw = &adapter->hw;
 
+	if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000)) {
+		dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
+		return;
+	}
 	switch (adapter->state) {
 	case __IAVF_STARTUP:
 		if (iavf_startup(adapter) < 0)
@@ -3605,14 +3640,14 @@ static void iavf_init_task(struct work_struct *work)
 	case __IAVF_INIT_GET_RESOURCES:
 		if (iavf_init_get_resources(adapter) < 0)
 			goto init_failed;
-		return;
+		goto out;
 	default:
 		goto init_failed;
 	}
 
 	queue_delayed_work(iavf_wq, &adapter->init_task,
 			   msecs_to_jiffies(30));
-	return;
+	goto out;
 init_failed:
 	if (++adapter->aq_wait_count > IAVF_AQ_MAX_ERR) {
 		dev_err(&adapter->pdev->dev,
@@ -3621,9 +3656,11 @@ static void iavf_init_task(struct work_struct *work)
 		iavf_shutdown_adminq(hw);
 		adapter->state = __IAVF_STARTUP;
 		queue_delayed_work(iavf_wq, &adapter->init_task, HZ * 5);
-		return;
+		goto out;
 	}
 	queue_delayed_work(iavf_wq, &adapter->init_task, HZ);
+out:
+	clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
 }
 
 /**
@@ -3640,9 +3677,12 @@ static void iavf_shutdown(struct pci_dev *pdev)
 	if (netif_running(netdev))
 		iavf_close(netdev);
 
+	if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000))
+		dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
 	/* Prevent the watchdog from running. */
 	adapter->state = __IAVF_REMOVE;
 	adapter->aq_required = 0;
+	clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section);
 
 #ifdef CONFIG_PM
 	pci_save_state(pdev);
@@ -3870,10 +3910,6 @@ static void iavf_remove(struct pci_dev *pdev)
 				 err);
 	}
 
-	/* Shut down all the garbage mashers on the detention level */
-	adapter->state = __IAVF_REMOVE;
-	adapter->aq_required = 0;
-	adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED;
 	iavf_request_reset(adapter);
 	msleep(50);
 	/* If the FW isn't responding, kick it once, but only once. */
@@ -3881,6 +3917,13 @@ static void iavf_remove(struct pci_dev *pdev)
 		iavf_request_reset(adapter);
 		msleep(50);
 	}
+	if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000))
+		dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__);
+
+	/* Shut down all the garbage mashers on the detention level */
+	adapter->state = __IAVF_REMOVE;
+	adapter->aq_required = 0;
+	adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED;
 	iavf_free_all_tx_resources(adapter);
 	iavf_free_all_rx_resources(adapter);
 	iavf_misc_irq_disable(adapter);

From 29ab7f6d505f5e1219c76f2962c9de484418905d Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Wed, 7 Jul 2021 15:14:53 +0200
Subject: [PATCH 0122/1750] ARM: dts: qcom: apq8064: correct clock names

[ Upstream commit 0dc6c59892ead17a9febd11202c9f6794aac1895 ]

Since new code doesn't take old clk names in account, it does fixes
error:

msm_dsi 4700000.mdss_dsi: dev_pm_opp_set_clkname: Couldn't find clock: -2

and following kernel oops introduced by
b0530eb1191 ("drm/msm/dpu: Use OPP API to set clk/perf state").

Also removes warning about deprecated clock names.

Tested against linux-5.10.y LTS on Nexus 7 2013.

Reviewed-by: Brian Masney <masneyb@onstation.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20210707131453.24041-1-david@ixit.cz
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
index 2687c4e890ba..e36d590e8373 100644
--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
@@ -1262,9 +1262,9 @@ dsi0: mdss_dsi@4700000 {
 				<&mmcc DSI1_BYTE_CLK>,
 				<&mmcc DSI_PIXEL_CLK>,
 				<&mmcc DSI1_ESC_CLK>;
-			clock-names = "iface_clk", "bus_clk", "core_mmss_clk",
-					"src_clk", "byte_clk", "pixel_clk",
-					"core_clk";
+			clock-names = "iface", "bus", "core_mmss",
+					"src", "byte", "pixel",
+					"core";
 
 			assigned-clocks = <&mmcc DSI1_BYTE_SRC>,
 					<&mmcc DSI1_ESC_SRC>,

From 9de06dcd4710a4fc4afc8eeba7f7f1276b9c6b29 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Wed, 14 Jul 2021 04:09:22 +0000
Subject: [PATCH 0123/1750] video: fbdev: kyro: fix a DoS bug by restricting
 user input

[ Upstream commit 98a65439172dc69cb16834e62e852afc2adb83ed ]

The user can pass in any value to the driver through the 'ioctl'
interface. The driver dost not check, which may cause DoS bugs.

The following log reveals it:

divide error: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:SetOverlayViewPort+0x133/0x5f0 drivers/video/fbdev/kyro/STG4000OverlayDevice.c:476
Call Trace:
 kyro_dev_overlay_viewport_set drivers/video/fbdev/kyro/fbdev.c:378 [inline]
 kyrofb_ioctl+0x2eb/0x330 drivers/video/fbdev/kyro/fbdev.c:603
 do_fb_ioctl+0x1f3/0x700 drivers/video/fbdev/core/fbmem.c:1171
 fb_ioctl+0xeb/0x130 drivers/video/fbdev/core/fbmem.c:1185
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x19b/0x220 fs/ioctl.c:739
 do_syscall_64+0x32/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1626235762-2590-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/kyro/fbdev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 8fbde92ae8b9..4b8c7c16b1df 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight
 		/* probably haven't called CreateOverlay yet */
 		return -EINVAL;
 
+	if (ulWidth == 0 || ulWidth == 0xffffffff ||
+	    ulHeight == 0 || ulHeight == 0xffffffff ||
+	    (x < 2 && ulWidth + 2 == 0))
+		return -EINVAL;
+
 	/* Stop Ramdac Output */
 	DisableRamdacOutput(deviceInfo.pSTGReg);
 

From 3533aa65e6a93aedb8f5baf5bb52a3165f6a67c7 Mon Sep 17 00:00:00 2001
From: Yajun Deng <yajun.deng@linux.dev>
Date: Mon, 19 Jul 2021 13:18:16 +0800
Subject: [PATCH 0124/1750] netlink: Deal with ESRCH error in nlmsg_notify()

[ Upstream commit fef773fc8110d8124c73a5e6610f89e52814637d ]

Yonghong Song report:
The bpf selftest tc_bpf failed with latest bpf-next.
The following is the command to run and the result:
$ ./test_progs -n 132
[   40.947571] bpf_testmod: loading out-of-tree module taints kernel.
test_tc_bpf:PASS:test_tc_bpf__open_and_load 0 nsec
test_tc_bpf:PASS:bpf_tc_hook_create(BPF_TC_INGRESS) 0 nsec
test_tc_bpf:PASS:bpf_tc_hook_create invalid hook.attach_point 0 nsec
test_tc_bpf_basic:PASS:bpf_obj_get_info_by_fd 0 nsec
test_tc_bpf_basic:PASS:bpf_tc_attach 0 nsec
test_tc_bpf_basic:PASS:handle set 0 nsec
test_tc_bpf_basic:PASS:priority set 0 nsec
test_tc_bpf_basic:PASS:prog_id set 0 nsec
test_tc_bpf_basic:PASS:bpf_tc_attach replace mode 0 nsec
test_tc_bpf_basic:PASS:bpf_tc_query 0 nsec
test_tc_bpf_basic:PASS:handle set 0 nsec
test_tc_bpf_basic:PASS:priority set 0 nsec
test_tc_bpf_basic:PASS:prog_id set 0 nsec
libbpf: Kernel error message: Failed to send filter delete notification
test_tc_bpf_basic:FAIL:bpf_tc_detach unexpected error: -3 (errno 3)
test_tc_bpf:FAIL:test_tc_internal ingress unexpected error: -3 (errno 3)

The failure seems due to the commit
    cfdf0d9ae75b ("rtnetlink: use nlmsg_notify() in rtnetlink_send()")

Deal with ESRCH error in nlmsg_notify() even the report variable is zero.

Reported-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
Link: https://lore.kernel.org/r/20210719051816.11762-1-yajun.deng@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netlink/af_netlink.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index e527f5686e2b..8434da3c0487 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2537,13 +2537,15 @@ int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid,
 		/* errors reported via destination sk->sk_err, but propagate
 		 * delivery errors if NETLINK_BROADCAST_ERROR flag is set */
 		err = nlmsg_multicast(sk, skb, exclude_portid, group, flags);
+		if (err == -ESRCH)
+			err = 0;
 	}
 
 	if (report) {
 		int err2;
 
 		err2 = nlmsg_unicast(sk, skb, portid);
-		if (!err || err == -ESRCH)
+		if (!err)
 			err = err2;
 	}
 

From df19d95141d18231952153e03f578f078f0be384 Mon Sep 17 00:00:00 2001
From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Date: Thu, 15 Jul 2021 17:17:24 +0800
Subject: [PATCH 0125/1750] Smack: Fix wrong semantics in smk_access_entry()

[ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ]

In the smk_access_entry() function, if no matching rule is found
in the rust_list, a negative error code will be used to perform bit
operations with the MAY_ enumeration value. This is semantically
wrong. This patch fixes this issue.

Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smack_access.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 7eabb448acab..169929c6c4eb 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -81,23 +81,22 @@ int log_policy = SMACK_AUDIT_DENIED;
 int smk_access_entry(char *subject_label, char *object_label,
 			struct list_head *rule_list)
 {
-	int may = -ENOENT;
 	struct smack_rule *srp;
 
 	list_for_each_entry_rcu(srp, rule_list, list) {
 		if (srp->smk_object->smk_known == object_label &&
 		    srp->smk_subject->smk_known == subject_label) {
-			may = srp->smk_access;
-			break;
+			int may = srp->smk_access;
+			/*
+			 * MAY_WRITE implies MAY_LOCK.
+			 */
+			if ((may & MAY_WRITE) == MAY_WRITE)
+				may |= MAY_LOCK;
+			return may;
 		}
 	}
 
-	/*
-	 * MAY_WRITE implies MAY_LOCK.
-	 */
-	if ((may & MAY_WRITE) == MAY_WRITE)
-		may |= MAY_LOCK;
-	return may;
+	return -ENOENT;
 }
 
 /**

From 54e51d288b38377e8cd645a83e1ad08cc9d20ccc Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Mon, 12 Jul 2021 12:35:05 +0800
Subject: [PATCH 0126/1750] drm: avoid blocking in drm_clients_info's rcu
 section

[ Upstream commit 5eff9585de220cdd131237f5665db5e6c6bdf590 ]

Inside drm_clients_info, the rcu_read_lock is held to lock
pid_task()->comm. However, within this protected section, a call to
drm_is_current_master is made, which involves a mutex lock in a future
patch. However, this is illegal because the mutex lock might block
while in the RCU read-side critical section.

Since drm_is_current_master isn't protected by rcu_read_lock, we avoid
this by moving it out of the RCU critical section.

The following report came from intel-gfx ci's
igt@debugfs_test@read_all_entries testcase:

=============================
[ BUG: Invalid wait context ]
5.13.0-CI-Patchwork_20515+ #1 Tainted: G        W
-----------------------------
debugfs_test/1101 is trying to lock:
ffff888132d901a8 (&dev->master_mutex){+.+.}-{3:3}, at:
drm_is_current_master+0x1e/0x50
other info that might help us debug this:
context-{4:4}
3 locks held by debugfs_test/1101:
 #0: ffff88810fdffc90 (&p->lock){+.+.}-{3:3}, at:
 seq_read_iter+0x53/0x3b0
 #1: ffff888132d90240 (&dev->filelist_mutex){+.+.}-{3:3}, at:
 drm_clients_info+0x63/0x2a0
 #2: ffffffff82734220 (rcu_read_lock){....}-{1:2}, at:
 drm_clients_info+0x1b1/0x2a0
stack backtrace:
CPU: 8 PID: 1101 Comm: debugfs_test Tainted: G        W
5.13.0-CI-Patchwork_20515+ #1
Hardware name: Intel Corporation CometLake Client Platform/CometLake S
UDIMM (ERB/CRB), BIOS CMLSFWR1.R00.1263.D00.1906260926 06/26/2019
Call Trace:
 dump_stack+0x7f/0xad
 __lock_acquire.cold.78+0x2af/0x2ca
 lock_acquire+0xd3/0x300
 ? drm_is_current_master+0x1e/0x50
 ? __mutex_lock+0x76/0x970
 ? lockdep_hardirqs_on+0xbf/0x130
 __mutex_lock+0xab/0x970
 ? drm_is_current_master+0x1e/0x50
 ? drm_is_current_master+0x1e/0x50
 ? drm_is_current_master+0x1e/0x50
 drm_is_current_master+0x1e/0x50
 drm_clients_info+0x107/0x2a0
 seq_read_iter+0x178/0x3b0
 seq_read+0x104/0x150
 full_proxy_read+0x4e/0x80
 vfs_read+0xa5/0x1b0
 ksys_read+0x5a/0xd0
 do_syscall_64+0x39/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-3-desmondcheongzx@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_debugfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 3d7182001004..b0a826489488 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -91,6 +91,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
 	mutex_lock(&dev->filelist_mutex);
 	list_for_each_entry_reverse(priv, &dev->filelist, lhead) {
 		struct task_struct *task;
+		bool is_current_master = drm_is_current_master(priv);
 
 		rcu_read_lock(); /* locks pid_task()->comm */
 		task = pid_task(priv->pid, PIDTYPE_PID);
@@ -99,7 +100,7 @@ static int drm_clients_info(struct seq_file *m, void *data)
 			   task ? task->comm : "<unknown>",
 			   pid_vnr(priv->pid),
 			   priv->minor->index,
-			   drm_is_current_master(priv) ? 'y' : 'n',
+			   is_current_master ? 'y' : 'n',
 			   priv->authenticated ? 'y' : 'n',
 			   from_kuid_munged(seq_user_ns(m), uid),
 			   priv->magic);

From 06a553a99bacb00d3bc25f79e75c8e0fbf7a5025 Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Mon, 12 Jul 2021 12:35:07 +0800
Subject: [PATCH 0127/1750] drm: serialize drm_file.master with a new spinlock

[ Upstream commit 0b0860a3cf5eccf183760b1177a1dcdb821b0b66 ]

Currently, drm_file.master pointers should be protected by
drm_device.master_mutex when being dereferenced. This is because
drm_file.master is not invariant for the lifetime of drm_file. If
drm_file is not the creator of master, then drm_file.is_master is
false, and a call to drm_setmaster_ioctl will invoke
drm_new_set_master, which then allocates a new master for drm_file and
puts the old master.

Thus, without holding drm_device.master_mutex, the old value of
drm_file.master could be freed while it is being used by another
concurrent process.

However, it is not always possible to lock drm_device.master_mutex to
dereference drm_file.master. Through the fbdev emulation code, this
might occur in a deep nest of other locks. But drm_device.master_mutex
is also the outermost lock in the nesting hierarchy, so this leads to
potential deadlocks.

To address this, we introduce a new spin lock at the bottom of the
lock hierarchy that only serializes drm_file.master. With this change,
the value of drm_file.master changes only when both
drm_device.master_mutex and drm_file.master_lookup_lock are
held. Hence, any process holding either of those locks can ensure that
the value of drm_file.master will not change concurrently.

Since no lock depends on the new drm_file.master_lookup_lock, when
drm_file.master is dereferenced, but drm_device.master_mutex cannot be
held, we can safely protect the master pointer with
drm_file.master_lookup_lock.

Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-5-desmondcheongzx@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_auth.c | 17 +++++++++++------
 drivers/gpu/drm/drm_file.c |  1 +
 include/drm/drm_file.h     | 12 +++++++++---
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 232abbba3686..0024ad93d24b 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -135,16 +135,18 @@ static void drm_set_master(struct drm_device *dev, struct drm_file *fpriv,
 static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
 {
 	struct drm_master *old_master;
+	struct drm_master *new_master;
 
 	lockdep_assert_held_once(&dev->master_mutex);
 
 	WARN_ON(fpriv->is_master);
 	old_master = fpriv->master;
-	fpriv->master = drm_master_create(dev);
-	if (!fpriv->master) {
-		fpriv->master = old_master;
+	new_master = drm_master_create(dev);
+	if (!new_master)
 		return -ENOMEM;
-	}
+	spin_lock(&fpriv->master_lookup_lock);
+	fpriv->master = new_master;
+	spin_unlock(&fpriv->master_lookup_lock);
 
 	fpriv->is_master = 1;
 	fpriv->authenticated = 1;
@@ -302,10 +304,13 @@ int drm_master_open(struct drm_file *file_priv)
 	/* if there is no current master make this fd it, but do not create
 	 * any master object for render clients */
 	mutex_lock(&dev->master_mutex);
-	if (!dev->master)
+	if (!dev->master) {
 		ret = drm_new_set_master(dev, file_priv);
-	else
+	} else {
+		spin_lock(&file_priv->master_lookup_lock);
 		file_priv->master = drm_master_get(dev->master);
+		spin_unlock(&file_priv->master_lookup_lock);
+	}
 	mutex_unlock(&dev->master_mutex);
 
 	return ret;
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index 0ac4566ae3f4..537e7de8e9c3 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -177,6 +177,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)
 	init_waitqueue_head(&file->event_wait);
 	file->event_space = 4096; /* set aside 4k for event buffer */
 
+	spin_lock_init(&file->master_lookup_lock);
 	mutex_init(&file->event_read_lock);
 
 	if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index 716990bace10..ca659ece3ee8 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,15 +226,21 @@ struct drm_file {
 	/**
 	 * @master:
 	 *
-	 * Master this node is currently associated with. Only relevant if
-	 * drm_is_primary_client() returns true. Note that this only
-	 * matches &drm_device.master if the master is the currently active one.
+	 * Master this node is currently associated with. Protected by struct
+	 * &drm_device.master_mutex, and serialized by @master_lookup_lock.
+	 *
+	 * Only relevant if drm_is_primary_client() returns true. Note that
+	 * this only matches &drm_device.master if the master is the currently
+	 * active one.
 	 *
 	 * See also @authentication and @is_master and the :ref:`section on
 	 * primary nodes and authentication <drm_primary_node>`.
 	 */
 	struct drm_master *master;
 
+	/** @master_lock: Serializes @master. */
+	spinlock_t master_lookup_lock;
+
 	/** @pid: Process that opened this file. */
 	struct pid *pid;
 

From 34609faad0c9f9f08d4b59d25c94b78bf5710d93 Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Mon, 12 Jul 2021 12:35:08 +0800
Subject: [PATCH 0128/1750] drm: protect drm_master pointers in drm_lease.c

[ Upstream commit 56f0729a510f92151682ff6c89f69724d5595d6e ]

drm_file->master pointers should be protected by
drm_device.master_mutex or drm_file.master_lookup_lock when being
dereferenced.

However, in drm_lease.c, there are multiple instances where
drm_file->master is accessed and dereferenced while neither lock is
held. This makes drm_lease.c vulnerable to use-after-free bugs.

We address this issue in 2 ways:

1. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to
drm_file.master_lookup_lock. Since drm_master_get increments the
reference count of master, this prevents master from being freed until
we unreference it with drm_master_put.

2. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.

Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-6-desmondcheongzx@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_auth.c  | 25 ++++++++++++
 drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++---------
 include/drm/drm_auth.h      |  1 +
 include/drm/drm_file.h      |  6 +++
 4 files changed, 93 insertions(+), 20 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 0024ad93d24b..c7adbeaf10b1 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -376,6 +376,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
 }
 EXPORT_SYMBOL(drm_master_get);
 
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+	struct drm_master *master = NULL;
+
+	spin_lock(&file_priv->master_lookup_lock);
+	if (!file_priv->master)
+		goto unlock;
+	master = drm_master_get(file_priv->master);
+
+unlock:
+	spin_unlock(&file_priv->master_lookup_lock);
+	return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
 static void drm_master_destroy(struct kref *kref)
 {
 	struct drm_master *master = container_of(kref, struct drm_master, refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index da4f085fc09e..aef22634005e 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -107,10 +107,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
  */
 bool _drm_lease_held(struct drm_file *file_priv, int id)
 {
-	if (!file_priv || !file_priv->master)
+	bool ret;
+	struct drm_master *master;
+
+	if (!file_priv)
 		return true;
 
-	return _drm_lease_held_master(file_priv->master, id);
+	master = drm_file_get_master(file_priv);
+	if (!master)
+		return true;
+	ret = _drm_lease_held_master(master, id);
+	drm_master_put(&master);
+
+	return ret;
 }
 
 /**
@@ -129,13 +138,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
 	struct drm_master *master;
 	bool ret;
 
-	if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+	if (!file_priv)
 		return true;
 
-	master = file_priv->master;
+	master = drm_file_get_master(file_priv);
+	if (!master)
+		return true;
+	if (!master->lessor) {
+		ret = true;
+		goto out;
+	}
 	mutex_lock(&master->dev->mode_config.idr_mutex);
 	ret = _drm_lease_held_master(master, id);
 	mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+	drm_master_put(&master);
 	return ret;
 }
 
@@ -155,10 +173,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
 	int count_in, count_out;
 	uint32_t crtcs_out = 0;
 
-	if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+	if (!file_priv)
 		return crtcs_in;
 
-	master = file_priv->master;
+	master = drm_file_get_master(file_priv);
+	if (!master)
+		return crtcs_in;
+	if (!master->lessor) {
+		crtcs_out = crtcs_in;
+		goto out;
+	}
 	dev = master->dev;
 
 	count_in = count_out = 0;
@@ -177,6 +201,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
 		count_in++;
 	}
 	mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+	drm_master_put(&master);
 	return crtcs_out;
 }
 
@@ -490,7 +517,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	size_t object_count;
 	int ret = 0;
 	struct idr leases;
-	struct drm_master *lessor = lessor_priv->master;
+	struct drm_master *lessor;
 	struct drm_master *lessee = NULL;
 	struct file *lessee_file = NULL;
 	struct file *lessor_file = lessor_priv->filp;
@@ -502,12 +529,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
-	/* Do not allow sub-leases */
-	if (lessor->lessor) {
-		DRM_DEBUG_LEASE("recursive leasing not allowed\n");
-		return -EINVAL;
-	}
-
 	/* need some objects */
 	if (cl->object_count == 0) {
 		DRM_DEBUG_LEASE("no objects in lease\n");
@@ -519,12 +540,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 		return -EINVAL;
 	}
 
+	lessor = drm_file_get_master(lessor_priv);
+	/* Do not allow sub-leases */
+	if (lessor->lessor) {
+		DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+		ret = -EINVAL;
+		goto out_lessor;
+	}
+
 	object_count = cl->object_count;
 
 	object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
 			array_size(object_count, sizeof(__u32)));
-	if (IS_ERR(object_ids))
-		return PTR_ERR(object_ids);
+	if (IS_ERR(object_ids)) {
+		ret = PTR_ERR(object_ids);
+		goto out_lessor;
+	}
 
 	idr_init(&leases);
 
@@ -535,14 +566,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	if (ret) {
 		DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
 		idr_destroy(&leases);
-		return ret;
+		goto out_lessor;
 	}
 
 	/* Allocate a file descriptor for the lease */
 	fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
 	if (fd < 0) {
 		idr_destroy(&leases);
-		return fd;
+		ret = fd;
+		goto out_lessor;
 	}
 
 	DRM_DEBUG_LEASE("Creating lease\n");
@@ -578,6 +610,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	/* Hook up the fd */
 	fd_install(fd, lessee_file);
 
+	drm_master_put(&lessor);
 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
 	return 0;
 
@@ -587,6 +620,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 out_leases:
 	put_unused_fd(fd);
 
+out_lessor:
+	drm_master_put(&lessor);
 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
 	return ret;
 }
@@ -609,7 +644,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
 	struct drm_mode_list_lessees *arg = data;
 	__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
 	__u32 count_lessees = arg->count_lessees;
-	struct drm_master *lessor = lessor_priv->master, *lessee;
+	struct drm_master *lessor, *lessee;
 	int count;
 	int ret = 0;
 
@@ -620,6 +655,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
+	lessor = drm_file_get_master(lessor_priv);
 	DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
 
 	mutex_lock(&dev->mode_config.idr_mutex);
@@ -643,6 +679,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
 		arg->count_lessees = count;
 
 	mutex_unlock(&dev->mode_config.idr_mutex);
+	drm_master_put(&lessor);
 
 	return ret;
 }
@@ -662,7 +699,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
 	struct drm_mode_get_lease *arg = data;
 	__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
 	__u32 count_objects = arg->count_objects;
-	struct drm_master *lessee = lessee_priv->master;
+	struct drm_master *lessee;
 	struct idr *object_idr;
 	int count;
 	void *entry;
@@ -676,6 +713,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
+	lessee = drm_file_get_master(lessee_priv);
 	DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
 
 	mutex_lock(&dev->mode_config.idr_mutex);
@@ -703,6 +741,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
 		arg->count_objects = count;
 
 	mutex_unlock(&dev->mode_config.idr_mutex);
+	drm_master_put(&lessee);
 
 	return ret;
 }
@@ -721,7 +760,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
 				void *data, struct drm_file *lessor_priv)
 {
 	struct drm_mode_revoke_lease *arg = data;
-	struct drm_master *lessor = lessor_priv->master;
+	struct drm_master *lessor;
 	struct drm_master *lessee;
 	int ret = 0;
 
@@ -731,6 +770,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
+	lessor = drm_file_get_master(lessor_priv);
 	mutex_lock(&dev->mode_config.idr_mutex);
 
 	lessee = _drm_find_lessee(lessor, arg->lessee_id);
@@ -751,6 +791,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
 
 fail:
 	mutex_unlock(&dev->mode_config.idr_mutex);
+	drm_master_put(&lessor);
 
 	return ret;
 }
diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
index 6bf8b2b78991..f99d3417f304 100644
--- a/include/drm/drm_auth.h
+++ b/include/drm/drm_auth.h
@@ -107,6 +107,7 @@ struct drm_master {
 };
 
 struct drm_master *drm_master_get(struct drm_master *master);
+struct drm_master *drm_file_get_master(struct drm_file *file_priv);
 void drm_master_put(struct drm_master **master);
 bool drm_is_current_master(struct drm_file *fpriv);
 
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index ca659ece3ee8..42d04607d091 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -233,6 +233,12 @@ struct drm_file {
 	 * this only matches &drm_device.master if the master is the currently
 	 * active one.
 	 *
+	 * When dereferencing this pointer, either hold struct
+	 * &drm_device.master_mutex for the duration of the pointer's use, or
+	 * use drm_file_get_master() if struct &drm_device.master_mutex is not
+	 * currently held and there is no other need to hold it. This prevents
+	 * @master from being freed during use.
+	 *
 	 * See also @authentication and @is_master and the :ref:`section on
 	 * primary nodes and authentication <drm_primary_node>`.
 	 */

From d3ca78775db42eedde8ce9fee5fbd5be4b36a0f1 Mon Sep 17 00:00:00 2001
From: Zhouyi Zhou <zhouzhouyi@gmail.com>
Date: Tue, 13 Jul 2021 08:56:45 +0800
Subject: [PATCH 0129/1750] rcu: Fix macro name CONFIG_TASKS_RCU_TRACE

[ Upstream commit fed31a4dd3adb5455df7c704de2abb639a1dc1c0 ]

This commit fixes several typos where CONFIG_TASKS_RCU_TRACE should
instead be CONFIG_TASKS_TRACE_RCU.  Among other things, these typos
could cause CONFIG_TASKS_TRACE_RCU_READ_MB=y kernels to suffer from
memory-ordering bugs that could result in false-positive quiescent
states and too-short grace periods.

Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/rcupdate.h | 2 +-
 kernel/rcu/tree_plugin.h | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 0d7013da818c..095b3b39bd03 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -163,7 +163,7 @@ void synchronize_rcu_tasks(void);
 # define synchronize_rcu_tasks synchronize_rcu
 # endif
 
-# ifdef CONFIG_TASKS_RCU_TRACE
+# ifdef CONFIG_TASKS_TRACE_RCU
 # define rcu_tasks_trace_qs(t)						\
 	do {								\
 		if (!likely(READ_ONCE((t)->trc_reader_checked)) &&	\
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 574aeaac9272..c5091aeaa37b 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2591,17 +2591,17 @@ static void noinstr rcu_dynticks_task_exit(void)
 /* Turn on heavyweight RCU tasks trace readers on idle/user entry. */
 static void rcu_dynticks_task_trace_enter(void)
 {
-#ifdef CONFIG_TASKS_RCU_TRACE
+#ifdef CONFIG_TASKS_TRACE_RCU
 	if (IS_ENABLED(CONFIG_TASKS_TRACE_RCU_READ_MB))
 		current->trc_reader_special.b.need_mb = true;
-#endif /* #ifdef CONFIG_TASKS_RCU_TRACE */
+#endif /* #ifdef CONFIG_TASKS_TRACE_RCU */
 }
 
 /* Turn off heavyweight RCU tasks trace readers on idle/user exit. */
 static void rcu_dynticks_task_trace_exit(void)
 {
-#ifdef CONFIG_TASKS_RCU_TRACE
+#ifdef CONFIG_TASKS_TRACE_RCU
 	if (IS_ENABLED(CONFIG_TASKS_TRACE_RCU_READ_MB))
 		current->trc_reader_special.b.need_mb = false;
-#endif /* #ifdef CONFIG_TASKS_RCU_TRACE */
+#endif /* #ifdef CONFIG_TASKS_TRACE_RCU */
 }

From 463b3edfba90f6771195626b4f252c8545002cb2 Mon Sep 17 00:00:00 2001
From: Sasha Neftin <sasha.neftin@intel.com>
Date: Mon, 14 Jun 2021 15:19:39 +0300
Subject: [PATCH 0130/1750] igc: Check if num of q_vectors is smaller than max
 before array access

[ Upstream commit 373e2829e7c2e1e606503cdb5c97749f512a4be9 ]

Ensure that the adapter->q_vector[MAX_Q_VECTORS] array isn't accessed
beyond its size. It was fixed by using a local variable num_q_vectors
as a limit for loop index, and ensure that num_q_vectors is not bigger
than MAX_Q_VECTORS.

Suggested-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Dvora Fuxbrumer <dvorax.fuxbrumer@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/igc/igc_main.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 013dd2955381..cae090a07252 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -4083,6 +4083,7 @@ static irqreturn_t igc_msix_ring(int irq, void *data)
  */
 static int igc_request_msix(struct igc_adapter *adapter)
 {
+	unsigned int num_q_vectors = adapter->num_q_vectors;
 	int i = 0, err = 0, vector = 0, free_vector = 0;
 	struct net_device *netdev = adapter->netdev;
 
@@ -4091,7 +4092,13 @@ static int igc_request_msix(struct igc_adapter *adapter)
 	if (err)
 		goto err_out;
 
-	for (i = 0; i < adapter->num_q_vectors; i++) {
+	if (num_q_vectors > MAX_Q_VECTORS) {
+		num_q_vectors = MAX_Q_VECTORS;
+		dev_warn(&adapter->pdev->dev,
+			 "The number of queue vectors (%d) is higher than max allowed (%d)\n",
+			 adapter->num_q_vectors, MAX_Q_VECTORS);
+	}
+	for (i = 0; i < num_q_vectors; i++) {
 		struct igc_q_vector *q_vector = adapter->q_vector[i];
 
 		vector++;

From 224cf5e8c853691f92e984f3e6e399479793e2bf Mon Sep 17 00:00:00 2001
From: Kelly Devilliv <kelly.devilliv@gmail.com>
Date: Sun, 27 Jun 2021 20:57:46 +0800
Subject: [PATCH 0131/1750] usb: host: fotg210: fix the endpoint's
 transactional opportunities calculation

[ Upstream commit c2e898764245c852bc8ee4857613ba4f3a6d761d ]

Now that usb_endpoint_maxp() only returns the lowest
11 bits from wMaxPacketSize, we should make use of the
usb_endpoint_* helpers instead and remove the unnecessary
max_packet()/hb_mult() macro.

Signed-off-by: Kelly Devilliv <kelly.devilliv@gmail.com>
Link: https://lore.kernel.org/r/20210627125747.127646-3-kelly.devilliv@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/fotg210-hcd.c | 36 ++++++++++++++++------------------
 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index bd958f059fe6..1eb8bb55c59c 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -2509,11 +2509,6 @@ static unsigned qh_completions(struct fotg210_hcd *fotg210,
 	return count;
 }
 
-/* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */
-#define hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03))
-/* ... and packet size, for any kind of endpoint descriptor */
-#define max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff)
-
 /* reverse of qh_urb_transaction:  free a list of TDs.
  * used for cleanup after errors, before HC sees an URB's TDs.
  */
@@ -2599,7 +2594,7 @@ static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210,
 		token |= (1 /* "in" */ << 8);
 	/* else it's already initted to "out" pid (0 << 8) */
 
-	maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input));
+	maxpacket = usb_maxpacket(urb->dev, urb->pipe, !is_input);
 
 	/*
 	 * buffer gets wrapped in one or more qtds;
@@ -2713,9 +2708,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
 		gfp_t flags)
 {
 	struct fotg210_qh *qh = fotg210_qh_alloc(fotg210, flags);
+	struct usb_host_endpoint *ep;
 	u32 info1 = 0, info2 = 0;
 	int is_input, type;
 	int maxp = 0;
+	int mult;
 	struct usb_tt *tt = urb->dev->tt;
 	struct fotg210_qh_hw *hw;
 
@@ -2730,14 +2727,15 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
 
 	is_input = usb_pipein(urb->pipe);
 	type = usb_pipetype(urb->pipe);
-	maxp = usb_maxpacket(urb->dev, urb->pipe, !is_input);
+	ep = usb_pipe_endpoint(urb->dev, urb->pipe);
+	maxp = usb_endpoint_maxp(&ep->desc);
+	mult = usb_endpoint_maxp_mult(&ep->desc);
 
 	/* 1024 byte maxpacket is a hardware ceiling.  High bandwidth
 	 * acts like up to 3KB, but is built from smaller packets.
 	 */
-	if (max_packet(maxp) > 1024) {
-		fotg210_dbg(fotg210, "bogus qh maxpacket %d\n",
-				max_packet(maxp));
+	if (maxp > 1024) {
+		fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", maxp);
 		goto done;
 	}
 
@@ -2751,8 +2749,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
 	 */
 	if (type == PIPE_INTERRUPT) {
 		qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH,
-				is_input, 0,
-				hb_mult(maxp) * max_packet(maxp)));
+				is_input, 0, mult * maxp));
 		qh->start = NO_FRAME;
 
 		if (urb->dev->speed == USB_SPEED_HIGH) {
@@ -2789,7 +2786,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
 			think_time = tt ? tt->think_time : 0;
 			qh->tt_usecs = NS_TO_US(think_time +
 					usb_calc_bus_time(urb->dev->speed,
-					is_input, 0, max_packet(maxp)));
+					is_input, 0, maxp));
 			qh->period = urb->interval;
 			if (qh->period > fotg210->periodic_size) {
 				qh->period = fotg210->periodic_size;
@@ -2852,11 +2849,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb,
 			 * to help them do so.  So now people expect to use
 			 * such nonconformant devices with Linux too; sigh.
 			 */
-			info1 |= max_packet(maxp) << 16;
+			info1 |= maxp << 16;
 			info2 |= (FOTG210_TUNE_MULT_HS << 30);
 		} else {		/* PIPE_INTERRUPT */
-			info1 |= max_packet(maxp) << 16;
-			info2 |= hb_mult(maxp) << 30;
+			info1 |= maxp << 16;
+			info2 |= mult << 30;
 		}
 		break;
 	default:
@@ -3926,6 +3923,7 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,
 	int is_input;
 	long bandwidth;
 	unsigned multi;
+	struct usb_host_endpoint *ep;
 
 	/*
 	 * this might be a "high bandwidth" highspeed endpoint,
@@ -3933,14 +3931,14 @@ static void iso_stream_init(struct fotg210_hcd *fotg210,
 	 */
 	epnum = usb_pipeendpoint(pipe);
 	is_input = usb_pipein(pipe) ? USB_DIR_IN : 0;
-	maxp = usb_maxpacket(dev, pipe, !is_input);
+	ep = usb_pipe_endpoint(dev, pipe);
+	maxp = usb_endpoint_maxp(&ep->desc);
 	if (is_input)
 		buf1 = (1 << 11);
 	else
 		buf1 = 0;
 
-	maxp = max_packet(maxp);
-	multi = hb_mult(maxp);
+	multi = usb_endpoint_maxp_mult(&ep->desc);
 	buf1 |= maxp;
 	maxp *= multi;
 

From 566ddd2d94b099792a02ca44fffb657ea3fd59c6 Mon Sep 17 00:00:00 2001
From: Kelly Devilliv <kelly.devilliv@gmail.com>
Date: Sun, 27 Jun 2021 20:57:47 +0800
Subject: [PATCH 0132/1750] usb: host: fotg210: fix the actual_length of an iso
 packet

[ Upstream commit 091cb2f782f32ab68c6f5f326d7868683d3d4875 ]

We should acquire the actual_length of an iso packet
from the iTD directly using FOTG210_ITD_LENGTH() macro.

Signed-off-by: Kelly Devilliv <kelly.devilliv@gmail.com>
Link: https://lore.kernel.org/r/20210627125747.127646-4-kelly.devilliv@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/fotg210-hcd.c | 5 ++---
 drivers/usb/host/fotg210.h     | 5 -----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
index 1eb8bb55c59c..ff0b3457fd34 100644
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -4459,13 +4459,12 @@ static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd)
 
 			/* HC need not update length with this error */
 			if (!(t & FOTG210_ISOC_BABBLE)) {
-				desc->actual_length =
-					fotg210_itdlen(urb, desc, t);
+				desc->actual_length = FOTG210_ITD_LENGTH(t);
 				urb->actual_length += desc->actual_length;
 			}
 		} else if (likely((t & FOTG210_ISOC_ACTIVE) == 0)) {
 			desc->status = 0;
-			desc->actual_length = fotg210_itdlen(urb, desc, t);
+			desc->actual_length = FOTG210_ITD_LENGTH(t);
 			urb->actual_length += desc->actual_length;
 		} else {
 			/* URB was too late */
diff --git a/drivers/usb/host/fotg210.h b/drivers/usb/host/fotg210.h
index 6cee40ec65b4..67f59517ebad 100644
--- a/drivers/usb/host/fotg210.h
+++ b/drivers/usb/host/fotg210.h
@@ -686,11 +686,6 @@ static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210)
 	return fotg210_readl(fotg210, &fotg210->regs->frame_index);
 }
 
-#define fotg210_itdlen(urb, desc, t) ({			\
-	usb_pipein((urb)->pipe) ?				\
-	(desc)->length - FOTG210_ITD_LENGTH(t) :			\
-	FOTG210_ITD_LENGTH(t);					\
-})
 /*-------------------------------------------------------------------------*/
 
 #endif /* __LINUX_FOTG210_H */

From b2b8137ec9205900c4608f7c9e6667d8626ed472 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Thu, 1 Jul 2021 04:48:34 -0700
Subject: [PATCH 0133/1750] usb: gadget: u_ether: fix a potential null pointer
 dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8ae01239609b29ec2eff55967c8e0fe3650cfa09 ]

f_ncm tx timeout can call us with null skb to flush
a pending frame.  In this case skb is NULL to begin
with but ceases to be null after dev->wrap() completes.

In such a case in->maxpacket will be read, even though
we've failed to check that 'in' is not NULL.

Though I've never observed this fail in practice,
however the 'flush operation' simply does not make sense with
a null usb IN endpoint - there's nowhere to flush to...
(note that we're the gadget/device, and IN is from the point
 of view of the host, so here IN actually means outbound...)

Cc: Brooke Basile <brookebasile@gmail.com>
Cc: "Bryan O'Donoghue" <bryan.odonoghue@linaro.org>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20210701114834.884597-6-zenczykowski@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/function/u_ether.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index c019f2b0c0af..a9cb647bac6f 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -491,8 +491,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
 	}
 	spin_unlock_irqrestore(&dev->lock, flags);
 
-	if (skb && !in) {
-		dev_kfree_skb_any(skb);
+	if (!in) {
+		if (skb)
+			dev_kfree_skb_any(skb);
 		return NETDEV_TX_OK;
 	}
 

From 5534de13b6dc23f890fad9194bacf5da05248a61 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Thu, 8 Jul 2021 11:30:56 +0300
Subject: [PATCH 0134/1750] USB: EHCI: ehci-mv: improve error handling in
 mv_ehci_enable()

[ Upstream commit 61136a12cbed234374ec6f588af57c580b20b772 ]

mv_ehci_enable() did not disable and unprepare clocks in case of
failures of phy_init(). Besides, it did not take into account failures
of ehci_clock_enable() (in effect, failures of clk_prepare_enable()).
The patch fixes both issues and gets rid of redundant wrappers around
clk_prepare_enable() and clk_disable_unprepare() to simplify this a bit.

Found by Linux Driver Verification project (linuxtesting.org).

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Link: https://lore.kernel.org/r/20210708083056.21543-1-novikov@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-mv.c | 25 ++++++++++++-------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index cffdc8d01b2a..8fd27249ad25 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -42,26 +42,25 @@ struct ehci_hcd_mv {
 	int (*set_vbus)(unsigned int vbus);
 };
 
-static void ehci_clock_enable(struct ehci_hcd_mv *ehci_mv)
-{
-	clk_prepare_enable(ehci_mv->clk);
-}
-
-static void ehci_clock_disable(struct ehci_hcd_mv *ehci_mv)
-{
-	clk_disable_unprepare(ehci_mv->clk);
-}
-
 static int mv_ehci_enable(struct ehci_hcd_mv *ehci_mv)
 {
-	ehci_clock_enable(ehci_mv);
-	return phy_init(ehci_mv->phy);
+	int retval;
+
+	retval = clk_prepare_enable(ehci_mv->clk);
+	if (retval)
+		return retval;
+
+	retval = phy_init(ehci_mv->phy);
+	if (retval)
+		clk_disable_unprepare(ehci_mv->clk);
+
+	return retval;
 }
 
 static void mv_ehci_disable(struct ehci_hcd_mv *ehci_mv)
 {
 	phy_exit(ehci_mv->phy);
-	ehci_clock_disable(ehci_mv);
+	clk_disable_unprepare(ehci_mv->clk);
 }
 
 static int mv_ehci_reset(struct usb_hcd *hcd)

From 03f4492dbff3d7d8b01d9245ddbb721d8181fca8 Mon Sep 17 00:00:00 2001
From: Jack Pham <jackp@codeaurora.org>
Date: Tue, 20 Jul 2021 01:09:07 -0700
Subject: [PATCH 0135/1750] usb: gadget: composite: Allow bMaxPower=0 if
 self-powered

[ Upstream commit bcacbf06c891374e7fdd7b72d11cda03b0269b43 ]

Currently the composite driver encodes the MaxPower field of
the configuration descriptor by reading the c->MaxPower of the
usb_configuration only if it is non-zero, otherwise it falls back
to using the value hard-coded in CONFIG_USB_GADGET_VBUS_DRAW.
However, there are cases when a configuration must explicitly set
bMaxPower to 0, particularly if its bmAttributes also has the
Self-Powered bit set, which is a valid combination.

This is specifically called out in the USB PD specification section
9.1, in which a PDUSB device "shall report zero in the bMaxPower
field after negotiating a mutually agreeable Contract", and also
verified by the USB Type-C Functional Test TD.4.10.2 Sink Power
Precedence Test.

The fix allows the c->MaxPower to be used for encoding the bMaxPower
even if it is 0, if the self-powered bit is also set.  An example
usage of this would be for a ConfigFS gadget to be dynamically
updated by userspace when the Type-C connection is determined to be
operating in Power Delivery mode.

Co-developed-by: Ronak Vijay Raheja <rraheja@codeaurora.org>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Ronak Vijay Raheja <rraheja@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Link: https://lore.kernel.org/r/20210720080907.30292-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/composite.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index 1a556a628971..3ffa939678d7 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -481,7 +481,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,
 {
 	unsigned val;
 
-	if (c->MaxPower)
+	if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
 		val = c->MaxPower;
 	else
 		val = CONFIG_USB_GADGET_VBUS_DRAW;
@@ -905,7 +905,11 @@ static int set_config(struct usb_composite_dev *cdev,
 	}
 
 	/* when we return, be sure our power usage is valid */
-	power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
+	if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER))
+		power = c->MaxPower;
+	else
+		power = CONFIG_USB_GADGET_VBUS_DRAW;
+
 	if (gadget->speed < USB_SPEED_SUPER)
 		power = min(power, 500U);
 	else

From 642639bb8d42df1df445d65ccd5be0e08cf1866f Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Wed, 14 Jul 2021 12:13:46 +0200
Subject: [PATCH 0136/1750] staging: board: Fix uninitialized spinlock when
 attaching genpd

[ Upstream commit df00609821bf17f50a75a446266d19adb8339d84 ]

On Armadillo-800-EVA with CONFIG_DEBUG_SPINLOCK=y:

    BUG: spinlock bad magic on CPU#0, swapper/1
     lock: lcdc0_device+0x10c/0x308, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
    CPU: 0 PID: 1 Comm: swapper Not tainted 5.11.0-rc5-armadillo-00036-gbbca04be7a80-dirty #287
    Hardware name: Generic R8A7740 (Flattened Device Tree)
    [<c010c3c8>] (unwind_backtrace) from [<c010a49c>] (show_stack+0x10/0x14)
    [<c010a49c>] (show_stack) from [<c0159534>] (do_raw_spin_lock+0x20/0x94)
    [<c0159534>] (do_raw_spin_lock) from [<c040858c>] (dev_pm_get_subsys_data+0x8c/0x11c)
    [<c040858c>] (dev_pm_get_subsys_data) from [<c05fbcac>] (genpd_add_device+0x78/0x2b8)
    [<c05fbcac>] (genpd_add_device) from [<c0412db4>] (of_genpd_add_device+0x34/0x4c)
    [<c0412db4>] (of_genpd_add_device) from [<c0a1ea74>] (board_staging_register_device+0x11c/0x148)
    [<c0a1ea74>] (board_staging_register_device) from [<c0a1eac4>] (board_staging_register_devices+0x24/0x28)

of_genpd_add_device() is called before platform_device_register(), as it
needs to attach the genpd before the device is probed.  But the spinlock
is only initialized when the device is registered.

Fix this by open-coding the spinlock initialization, cfr.
device_pm_init_common() in the internal drivers/base code, and in the
SuperH early platform code.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/57783ece7ddae55f2bda2f59f452180bff744ea0.1626257398.git.geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/board/board.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/board/board.c b/drivers/staging/board/board.c
index cb6feb34dd40..f980af037345 100644
--- a/drivers/staging/board/board.c
+++ b/drivers/staging/board/board.c
@@ -136,6 +136,7 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc)
 static int board_staging_add_dev_domain(struct platform_device *pdev,
 					const char *domain)
 {
+	struct device *dev = &pdev->dev;
 	struct of_phandle_args pd_args;
 	struct device_node *np;
 
@@ -148,7 +149,11 @@ static int board_staging_add_dev_domain(struct platform_device *pdev,
 	pd_args.np = np;
 	pd_args.args_count = 0;
 
-	return of_genpd_add_device(&pd_args, &pdev->dev);
+	/* Initialization similar to device_pm_init_common() */
+	spin_lock_init(&dev->power.lock);
+	dev->power.early_init = true;
+
+	return of_genpd_add_device(&pd_args, dev);
 }
 #else
 static inline int board_staging_add_dev_domain(struct platform_device *pdev,

From 165c55af5f5f748ffa05b20b6896cef349e16a37 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Wed, 14 Jul 2021 05:53:23 +0000
Subject: [PATCH 0137/1750] tty: serial: jsm: hold port lock when reporting
 modem line changes

[ Upstream commit 240e126c28df084222f0b661321e8e3ecb0d232e ]

uart_handle_dcd_change() requires a port lock to be held and will emit a
warning when lockdep is enabled.

Held corresponding lock to fix the following warnings.

[  132.528648] WARNING: CPU: 5 PID: 11600 at drivers/tty/serial/serial_core.c:3046 uart_handle_dcd_change+0xf4/0x120
[  132.530482] Modules linked in:
[  132.531050] CPU: 5 PID: 11600 Comm: jsm Not tainted 5.14.0-rc1-00003-g7fef2edf7cc7-dirty #31
[  132.535268] RIP: 0010:uart_handle_dcd_change+0xf4/0x120
[  132.557100] Call Trace:
[  132.557562]  ? __free_pages+0x83/0xb0
[  132.558213]  neo_parse_modem+0x156/0x220
[  132.558897]  neo_param+0x399/0x840
[  132.559495]  jsm_tty_open+0x12f/0x2d0
[  132.560131]  uart_startup.part.18+0x153/0x340
[  132.560888]  ? lock_is_held_type+0xe9/0x140
[  132.561660]  uart_port_activate+0x7f/0xe0
[  132.562351]  ? uart_startup.part.18+0x340/0x340
[  132.563003]  tty_port_open+0x8d/0xf0
[  132.563523]  ? uart_set_options+0x1e0/0x1e0
[  132.564125]  uart_open+0x24/0x40
[  132.564604]  tty_open+0x15c/0x630

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/1626242003-3809-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/jsm/jsm_neo.c | 2 ++
 drivers/tty/serial/jsm/jsm_tty.c | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/drivers/tty/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c
index bf0e2a4cb0ce..c6f927a76c3b 100644
--- a/drivers/tty/serial/jsm/jsm_neo.c
+++ b/drivers/tty/serial/jsm/jsm_neo.c
@@ -815,7 +815,9 @@ static void neo_parse_isr(struct jsm_board *brd, u32 port)
 		/* Parse any modem signal changes */
 		jsm_dbg(INTR, &ch->ch_bd->pci_dev,
 			"MOD_STAT: sending to parse_modem_sigs\n");
+		spin_lock_irqsave(&ch->uart_port.lock, lock_flags);
 		neo_parse_modem(ch, readb(&ch->ch_neo_uart->msr));
+		spin_unlock_irqrestore(&ch->uart_port.lock, lock_flags);
 	}
 }
 
diff --git a/drivers/tty/serial/jsm/jsm_tty.c b/drivers/tty/serial/jsm/jsm_tty.c
index 689774c073ca..8438454ca653 100644
--- a/drivers/tty/serial/jsm/jsm_tty.c
+++ b/drivers/tty/serial/jsm/jsm_tty.c
@@ -187,6 +187,7 @@ static void jsm_tty_break(struct uart_port *port, int break_state)
 
 static int jsm_tty_open(struct uart_port *port)
 {
+	unsigned long lock_flags;
 	struct jsm_board *brd;
 	struct jsm_channel *channel =
 		container_of(port, struct jsm_channel, uart_port);
@@ -240,6 +241,7 @@ static int jsm_tty_open(struct uart_port *port)
 	channel->ch_cached_lsr = 0;
 	channel->ch_stops_sent = 0;
 
+	spin_lock_irqsave(&port->lock, lock_flags);
 	termios = &port->state->port.tty->termios;
 	channel->ch_c_cflag	= termios->c_cflag;
 	channel->ch_c_iflag	= termios->c_iflag;
@@ -259,6 +261,7 @@ static int jsm_tty_open(struct uart_port *port)
 	jsm_carrier(channel);
 
 	channel->ch_open_count++;
+	spin_unlock_irqrestore(&port->lock, lock_flags);
 
 	jsm_dbg(OPEN, &channel->ch_bd->pci_dev, "finish\n");
 	return 0;

From e944a221262e9e9f445ce88f79886476d8baec16 Mon Sep 17 00:00:00 2001
From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Date: Thu, 15 Jul 2021 17:07:18 +0300
Subject: [PATCH 0138/1750] bus: fsl-mc: fix mmio base address for child DPRCs

[ Upstream commit 8990f96a012f42543005b07d9e482694192e9309 ]

Some versions of the MC firmware wrongly report 0 for register base
address of the DPMCP associated with child DPRC objects thus rendering
them unusable. This is particularly troublesome in ACPI boot scenarios
where the legacy way of extracting this base address from the device
tree does not apply.
Given that DPMCPs share the same base address, workaround this by using
the base address extracted from the root DPRC container.

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
Link: https://lore.kernel.org/r/20210715140718.8513-8-laurentiu.tudor@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 806766b1b45f..e329cdd7156c 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -64,6 +64,8 @@ struct fsl_mc_addr_translation_range {
 #define MC_FAPR_PL	BIT(18)
 #define MC_FAPR_BMT	BIT(17)
 
+static phys_addr_t mc_portal_base_phys_addr;
+
 /**
  * fsl_mc_bus_match - device to driver matching callback
  * @dev: the fsl-mc device to match against
@@ -597,14 +599,30 @@ static int fsl_mc_device_get_mmio_regions(struct fsl_mc_device *mc_dev,
 		 * If base address is in the region_desc use it otherwise
 		 * revert to old mechanism
 		 */
-		if (region_desc.base_address)
+		if (region_desc.base_address) {
 			regions[i].start = region_desc.base_address +
 						region_desc.base_offset;
-		else
+		} else {
 			error = translate_mc_addr(mc_dev, mc_region_type,
 					  region_desc.base_offset,
 					  &regions[i].start);
 
+			/*
+			 * Some versions of the MC firmware wrongly report
+			 * 0 for register base address of the DPMCP associated
+			 * with child DPRC objects thus rendering them unusable.
+			 * This is particularly troublesome in ACPI boot
+			 * scenarios where the legacy way of extracting this
+			 * base address from the device tree does not apply.
+			 * Given that DPMCPs share the same base address,
+			 * workaround this by using the base address extracted
+			 * from the root DPRC container.
+			 */
+			if (is_fsl_mc_bus_dprc(mc_dev) &&
+			    regions[i].start == region_desc.base_offset)
+				regions[i].start += mc_portal_base_phys_addr;
+		}
+
 		if (error < 0) {
 			dev_err(parent_dev,
 				"Invalid MC offset: %#x (for %s.%d\'s region %d)\n",
@@ -996,6 +1014,8 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
 	plat_res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	mc_portal_phys_addr = plat_res->start;
 	mc_portal_size = resource_size(plat_res);
+	mc_portal_base_phys_addr = mc_portal_phys_addr & ~0x3ffffff;
+
 	error = fsl_create_mc_io(&pdev->dev, mc_portal_phys_addr,
 				 mc_portal_size, NULL,
 				 FSL_MC_IO_ATOMIC_CONTEXT_PORTAL, &mc_io);

From b4f5c9454dfcfee9393f547932eff81a2d9d50bc Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Wed, 7 Jul 2021 21:18:27 -0600
Subject: [PATCH 0139/1750] selftests: firmware: Fix ignored return val of
 asprintf() warn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fe968ca2cac91888310b143a483123c84906e3fc ]

Fix the following ingonred return val of asprintf() warn during
build:

cc -Wall -O2    fw_namespace.c  -o ../tools/testing/selftests/firmware/fw_namespace
fw_namespace.c: In function ‘main’:
fw_namespace.c:132:2: warning: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
  132 |  asprintf(&fw_path, "/lib/firmware/%s", fw_name);
      |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20210708031827.51293-1-skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/firmware/fw_namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/firmware/fw_namespace.c b/tools/testing/selftests/firmware/fw_namespace.c
index 5ebc1aec7923..817b2f1e8ee6 100644
--- a/tools/testing/selftests/firmware/fw_namespace.c
+++ b/tools/testing/selftests/firmware/fw_namespace.c
@@ -129,7 +129,8 @@ int main(int argc, char **argv)
 		die("mounting tmpfs to /lib/firmware failed\n");
 
 	sys_path = argv[1];
-	asprintf(&fw_path, "/lib/firmware/%s", fw_name);
+	if (asprintf(&fw_path, "/lib/firmware/%s", fw_name) < 0)
+		die("error: failed to build full fw_path\n");
 
 	setup_fw(fw_path);
 

From f462a39eb8334b52e332cc0cbffb705660b7d87b Mon Sep 17 00:00:00 2001
From: Oliver Logush <oliver.logush@amd.com>
Date: Wed, 23 Jun 2021 15:04:04 -0400
Subject: [PATCH 0140/1750] drm/amd/display: Fix timer_per_pixel unit error

[ Upstream commit 23e55639b87fb16a9f0f66032ecb57060df6c46c ]

[why]
The units of the time_per_pixel variable were incorrect, this had to be
changed for the code to properly function.

[how]
The change was very straightforward, only required one line of code to
be changed where the calculation was done.

Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Signed-off-by: Oliver Logush <oliver.logush@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index cfe85ba1018e..5dbc290bcbe8 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -2455,7 +2455,7 @@ void dcn20_set_mcif_arb_params(
 				wb_arb_params->cli_watermark[k] = get_wm_writeback_urgent(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000;
 				wb_arb_params->pstate_watermark[k] = get_wm_writeback_dram_clock_change(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000;
 			}
-			wb_arb_params->time_per_pixel = 16.0 / context->res_ctx.pipe_ctx[i].stream->phy_pix_clk; /* 4 bit fraction, ms */
+			wb_arb_params->time_per_pixel = 16.0 * 1000 / (context->res_ctx.pipe_ctx[i].stream->phy_pix_clk / 1000); /* 4 bit fraction, ms */
 			wb_arb_params->slice_lines = 32;
 			wb_arb_params->arbitration_slice = 2;
 			wb_arb_params->max_scaled_time = dcn20_calc_max_scaled_time(wb_arb_params->time_per_pixel,

From c6e5eebd95406f08298b80543323b7e32e45f58f Mon Sep 17 00:00:00 2001
From: Ezequiel Garcia <ezequiel@collabora.com>
Date: Mon, 19 Jul 2021 22:52:33 +0200
Subject: [PATCH 0141/1750] media: hantro: vp8: Move noisy WARN_ON to vpu_debug

[ Upstream commit 6ad61a7847da09b6261824accb539d05bcdfef65 ]

When the VP8 decoders can't find a reference frame,
the driver falls back to the current output frame.

This will probably produce some undesirable results,
leading to frame corruption, but shouldn't cause
noisy warnings.

Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
Acked-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Tested-by: Alex Bee <knaerzche@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/hantro/hantro_g1_vp8_dec.c    | 13 ++++++++++---
 .../staging/media/hantro/rk3399_vpu_hw_vp8_dec.c    | 13 ++++++++++---
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/media/hantro/hantro_g1_vp8_dec.c b/drivers/staging/media/hantro/hantro_g1_vp8_dec.c
index a5cdf150cd16..d30bdc678cc2 100644
--- a/drivers/staging/media/hantro/hantro_g1_vp8_dec.c
+++ b/drivers/staging/media/hantro/hantro_g1_vp8_dec.c
@@ -377,12 +377,17 @@ static void cfg_ref(struct hantro_ctx *ctx,
 	vb2_dst = hantro_get_dst_buf(ctx);
 
 	ref = hantro_get_ref(ctx, hdr->last_frame_ts);
-	if (!ref)
+	if (!ref) {
+		vpu_debug(0, "failed to find last frame ts=%llu\n",
+			  hdr->last_frame_ts);
 		ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
+	}
 	vdpu_write_relaxed(vpu, ref, G1_REG_ADDR_REF(0));
 
 	ref = hantro_get_ref(ctx, hdr->golden_frame_ts);
-	WARN_ON(!ref && hdr->golden_frame_ts);
+	if (!ref && hdr->golden_frame_ts)
+		vpu_debug(0, "failed to find golden frame ts=%llu\n",
+			  hdr->golden_frame_ts);
 	if (!ref)
 		ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
 	if (hdr->flags & V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_GOLDEN)
@@ -390,7 +395,9 @@ static void cfg_ref(struct hantro_ctx *ctx,
 	vdpu_write_relaxed(vpu, ref, G1_REG_ADDR_REF(4));
 
 	ref = hantro_get_ref(ctx, hdr->alt_frame_ts);
-	WARN_ON(!ref && hdr->alt_frame_ts);
+	if (!ref && hdr->alt_frame_ts)
+		vpu_debug(0, "failed to find alt frame ts=%llu\n",
+			  hdr->alt_frame_ts);
 	if (!ref)
 		ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
 	if (hdr->flags & V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_ALT)
diff --git a/drivers/staging/media/hantro/rk3399_vpu_hw_vp8_dec.c b/drivers/staging/media/hantro/rk3399_vpu_hw_vp8_dec.c
index a4a792f00b11..5b8c8fc49cce 100644
--- a/drivers/staging/media/hantro/rk3399_vpu_hw_vp8_dec.c
+++ b/drivers/staging/media/hantro/rk3399_vpu_hw_vp8_dec.c
@@ -454,12 +454,17 @@ static void cfg_ref(struct hantro_ctx *ctx,
 	vb2_dst = hantro_get_dst_buf(ctx);
 
 	ref = hantro_get_ref(ctx, hdr->last_frame_ts);
-	if (!ref)
+	if (!ref) {
+		vpu_debug(0, "failed to find last frame ts=%llu\n",
+			  hdr->last_frame_ts);
 		ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
+	}
 	vdpu_write_relaxed(vpu, ref, VDPU_REG_VP8_ADDR_REF0);
 
 	ref = hantro_get_ref(ctx, hdr->golden_frame_ts);
-	WARN_ON(!ref && hdr->golden_frame_ts);
+	if (!ref && hdr->golden_frame_ts)
+		vpu_debug(0, "failed to find golden frame ts=%llu\n",
+			  hdr->golden_frame_ts);
 	if (!ref)
 		ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
 	if (hdr->flags & V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_GOLDEN)
@@ -467,7 +472,9 @@ static void cfg_ref(struct hantro_ctx *ctx,
 	vdpu_write_relaxed(vpu, ref, VDPU_REG_VP8_ADDR_REF2_5(2));
 
 	ref = hantro_get_ref(ctx, hdr->alt_frame_ts);
-	WARN_ON(!ref && hdr->alt_frame_ts);
+	if (!ref && hdr->alt_frame_ts)
+		vpu_debug(0, "failed to find alt frame ts=%llu\n",
+			  hdr->alt_frame_ts);
 	if (!ref)
 		ref = vb2_dma_contig_plane_dma_addr(&vb2_dst->vb2_buf, 0);
 	if (hdr->flags & V4L2_VP8_FRAME_HEADER_FLAG_SIGN_BIAS_ALT)

From 9a85b9e37601df890b4f668c413f731c4ba4a215 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Sat, 10 Jul 2021 14:04:32 +0200
Subject: [PATCH 0142/1750] media: platform: stm32: unprepare clocks at
 handling errors in probe

[ Upstream commit 055d2db28ec2fa3ab5c527c5604f1b32b89fa13a ]

stm32_cec_probe() did not unprepare clocks on error handling paths. The
patch fixes that.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/cec/platform/stm32/stm32-cec.c | 26 ++++++++++++++------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/drivers/media/cec/platform/stm32/stm32-cec.c b/drivers/media/cec/platform/stm32/stm32-cec.c
index ea4b1ebfca99..0ffd89712536 100644
--- a/drivers/media/cec/platform/stm32/stm32-cec.c
+++ b/drivers/media/cec/platform/stm32/stm32-cec.c
@@ -305,14 +305,16 @@ static int stm32_cec_probe(struct platform_device *pdev)
 
 	cec->clk_hdmi_cec = devm_clk_get(&pdev->dev, "hdmi-cec");
 	if (IS_ERR(cec->clk_hdmi_cec) &&
-	    PTR_ERR(cec->clk_hdmi_cec) == -EPROBE_DEFER)
-		return -EPROBE_DEFER;
+	    PTR_ERR(cec->clk_hdmi_cec) == -EPROBE_DEFER) {
+		ret = -EPROBE_DEFER;
+		goto err_unprepare_cec_clk;
+	}
 
 	if (!IS_ERR(cec->clk_hdmi_cec)) {
 		ret = clk_prepare(cec->clk_hdmi_cec);
 		if (ret) {
 			dev_err(&pdev->dev, "Can't prepare hdmi-cec clock\n");
-			return ret;
+			goto err_unprepare_cec_clk;
 		}
 	}
 
@@ -324,19 +326,27 @@ static int stm32_cec_probe(struct platform_device *pdev)
 			CEC_NAME, caps,	CEC_MAX_LOG_ADDRS);
 	ret = PTR_ERR_OR_ZERO(cec->adap);
 	if (ret)
-		return ret;
+		goto err_unprepare_hdmi_cec_clk;
 
 	ret = cec_register_adapter(cec->adap, &pdev->dev);
-	if (ret) {
-		cec_delete_adapter(cec->adap);
-		return ret;
-	}
+	if (ret)
+		goto err_delete_adapter;
 
 	cec_hw_init(cec);
 
 	platform_set_drvdata(pdev, cec);
 
 	return 0;
+
+err_delete_adapter:
+	cec_delete_adapter(cec->adap);
+
+err_unprepare_hdmi_cec_clk:
+	clk_unprepare(cec->clk_hdmi_cec);
+
+err_unprepare_cec_clk:
+	clk_unprepare(cec->clk_cec);
+	return ret;
 }
 
 static int stm32_cec_remove(struct platform_device *pdev)

From e5cecb9105d45ad7955e202e048441920595d78b Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Thu, 8 Apr 2021 10:18:43 +0200
Subject: [PATCH 0143/1750] media: atomisp: Fix runtime PM imbalance in
 atomisp_pci_probe

[ Upstream commit 672fe1cf145ab9978c62eb827d6a16aa6b63994b ]

When hmm_pool_register() fails, a pairing PM usage counter
increment is needed to keep the counter balanced. It's the
same for the following error paths.

Link: https://lore.kernel.org/linux-media/20210408081850.24278-1-dinghao.liu@zju.edu.cn
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 0295e2e32d79..02f774ed80c8 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -1815,6 +1815,7 @@ static int atomisp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
 	hmm_cleanup();
 	hmm_pool_unregister(HMM_POOL_TYPE_RESERVED);
 hmm_pool_fail:
+	pm_runtime_get_noresume(&pdev->dev);
 	destroy_workqueue(isp->wdt_work_queue);
 wdt_work_queue_fail:
 	atomisp_acc_cleanup(isp);

From 23e5fb6475897f3ad380781883ae6d5440daa8b6 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Thu, 17 Jun 2021 09:23:29 +0200
Subject: [PATCH 0144/1750] media: atomisp: pci: fix error return code in
 atomisp_pci_probe()

[ Upstream commit d14e272958bdfdc40dcafb827d24ba6fdafa9d52 ]

If init_atomisp_wdts() fails, atomisp_pci_probe() need return
error code.

Link: https://lore.kernel.org/linux-media/20210617072329.1233662-1-yangyingliang@huawei.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/atomisp/pci/atomisp_v4l2.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
index 02f774ed80c8..fa1bd99cd6f1 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_v4l2.c
@@ -1763,7 +1763,8 @@ static int atomisp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
 	if (err < 0)
 		goto register_entities_fail;
 	/* init atomisp wdts */
-	if (init_atomisp_wdts(isp) != 0)
+	err = init_atomisp_wdts(isp);
+	if (err != 0)
 		goto wdt_work_queue_fail;
 
 	/* save the iunit context only once after all the values are init'ed. */

From 52bb703f71d37d52c4c6dbb216c213c9ab79300e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20S=C3=B6derlund?= <niklas.soderlund@corigine.com>
Date: Thu, 22 Jul 2021 13:25:02 +0200
Subject: [PATCH 0145/1750] nfp: fix return statement in nfp_net_parse_meta()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4431531c482a2c05126caaa9fcc5053a4a5c495b ]

The return type of the function is bool and while NULL do evaluate to
false it's not very nice, fix this by explicitly returning false. There
is no functional change.

Signed-off-by: Niklas Söderlund <niklas.soderlund@corigine.com>
Signed-off-by: Louis Peens <louis.peens@corigine.com>
Signed-off-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 437226866ce8..dfc1f32cda2b 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -1697,7 +1697,7 @@ nfp_net_parse_meta(struct net_device *netdev, struct nfp_meta_parsed *meta,
 		case NFP_NET_META_RESYNC_INFO:
 			if (nfp_net_tls_rx_resync_req(netdev, data, pkt,
 						      pkt_len))
-				return NULL;
+				return false;
 			data += sizeof(struct nfp_net_tls_resync_req);
 			break;
 		default:

From 5b3a45eedd27a5e3fac887fa6ad486f44723a4d9 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Thu, 22 Jul 2021 16:28:59 +0200
Subject: [PATCH 0146/1750] ethtool: improve compat ioctl handling

[ Upstream commit dd98d2895de6485c884a9cb42de69fed02826fa4 ]

The ethtool compat ioctl handling is hidden away in net/socket.c,
which introduces a couple of minor oddities:

- The implementation may end up diverging, as seen in the RXNFC
  extension in commit 84a1d9c48200 ("net: ethtool: extend RXNFC
  API to support RSS spreading of filter matches") that does not work
  in compat mode.

- Most architectures do not need the compat handling at all
  because u64 and compat_u64 have the same alignment.

- On x86, the conversion is done for both x32 and i386 user space,
  but it's actually wrong to do it for x32 and cannot work there.

- On 32-bit Arm, it never worked for compat oabi user space, since
  that needs to do the same conversion but does not.

- It would be nice to get rid of both compat_alloc_user_space()
  and copy_in_user() throughout the kernel.

None of these actually seems to be a serious problem that real
users are likely to encounter, but fixing all of them actually
leads to code that is both shorter and more readable.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/ethtool.h |   4 --
 net/ethtool/ioctl.c     | 136 +++++++++++++++++++++++++++++++++++-----
 net/socket.c            | 125 +-----------------------------------
 3 files changed, 121 insertions(+), 144 deletions(-)

diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h
index 6408b446051f..b98291d391f3 100644
--- a/include/linux/ethtool.h
+++ b/include/linux/ethtool.h
@@ -17,8 +17,6 @@
 #include <linux/compat.h>
 #include <uapi/linux/ethtool.h>
 
-#ifdef CONFIG_COMPAT
-
 struct compat_ethtool_rx_flow_spec {
 	u32		flow_type;
 	union ethtool_flow_union h_u;
@@ -38,8 +36,6 @@ struct compat_ethtool_rxnfc {
 	u32				rule_locs[];
 };
 
-#endif /* CONFIG_COMPAT */
-
 #include <linux/rculist.h>
 
 /**
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 68ff19af195c..97b402b2d6fb 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -7,6 +7,7 @@
  * the information ethtool needs.
  */
 
+#include <linux/compat.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/capability.h>
@@ -807,6 +808,120 @@ static noinline_for_stack int ethtool_get_sset_info(struct net_device *dev,
 	return ret;
 }
 
+static noinline_for_stack int
+ethtool_rxnfc_copy_from_compat(struct ethtool_rxnfc *rxnfc,
+			       const struct compat_ethtool_rxnfc __user *useraddr,
+			       size_t size)
+{
+	struct compat_ethtool_rxnfc crxnfc = {};
+
+	/* We expect there to be holes between fs.m_ext and
+	 * fs.ring_cookie and at the end of fs, but nowhere else.
+	 * On non-x86, no conversion should be needed.
+	 */
+	BUILD_BUG_ON(!IS_ENABLED(CONFIG_X86_64) &&
+		     sizeof(struct compat_ethtool_rxnfc) !=
+		     sizeof(struct ethtool_rxnfc));
+	BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
+		     sizeof(useraddr->fs.m_ext) !=
+		     offsetof(struct ethtool_rxnfc, fs.m_ext) +
+		     sizeof(rxnfc->fs.m_ext));
+	BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.location) -
+		     offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
+		     offsetof(struct ethtool_rxnfc, fs.location) -
+		     offsetof(struct ethtool_rxnfc, fs.ring_cookie));
+
+	if (copy_from_user(&crxnfc, useraddr, min(size, sizeof(crxnfc))))
+		return -EFAULT;
+
+	*rxnfc = (struct ethtool_rxnfc) {
+		.cmd		= crxnfc.cmd,
+		.flow_type	= crxnfc.flow_type,
+		.data		= crxnfc.data,
+		.fs		= {
+			.flow_type	= crxnfc.fs.flow_type,
+			.h_u		= crxnfc.fs.h_u,
+			.h_ext		= crxnfc.fs.h_ext,
+			.m_u		= crxnfc.fs.m_u,
+			.m_ext		= crxnfc.fs.m_ext,
+			.ring_cookie	= crxnfc.fs.ring_cookie,
+			.location	= crxnfc.fs.location,
+		},
+		.rule_cnt	= crxnfc.rule_cnt,
+	};
+
+	return 0;
+}
+
+static int ethtool_rxnfc_copy_from_user(struct ethtool_rxnfc *rxnfc,
+					const void __user *useraddr,
+					size_t size)
+{
+	if (compat_need_64bit_alignment_fixup())
+		return ethtool_rxnfc_copy_from_compat(rxnfc, useraddr, size);
+
+	if (copy_from_user(rxnfc, useraddr, size))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int ethtool_rxnfc_copy_to_compat(void __user *useraddr,
+					const struct ethtool_rxnfc *rxnfc,
+					size_t size, const u32 *rule_buf)
+{
+	struct compat_ethtool_rxnfc crxnfc;
+
+	memset(&crxnfc, 0, sizeof(crxnfc));
+	crxnfc = (struct compat_ethtool_rxnfc) {
+		.cmd		= rxnfc->cmd,
+		.flow_type	= rxnfc->flow_type,
+		.data		= rxnfc->data,
+		.fs		= {
+			.flow_type	= rxnfc->fs.flow_type,
+			.h_u		= rxnfc->fs.h_u,
+			.h_ext		= rxnfc->fs.h_ext,
+			.m_u		= rxnfc->fs.m_u,
+			.m_ext		= rxnfc->fs.m_ext,
+			.ring_cookie	= rxnfc->fs.ring_cookie,
+			.location	= rxnfc->fs.location,
+		},
+		.rule_cnt	= rxnfc->rule_cnt,
+	};
+
+	if (copy_to_user(useraddr, &crxnfc, min(size, sizeof(crxnfc))))
+		return -EFAULT;
+
+	return 0;
+}
+
+static int ethtool_rxnfc_copy_to_user(void __user *useraddr,
+				      const struct ethtool_rxnfc *rxnfc,
+				      size_t size, const u32 *rule_buf)
+{
+	int ret;
+
+	if (compat_need_64bit_alignment_fixup()) {
+		ret = ethtool_rxnfc_copy_to_compat(useraddr, rxnfc, size,
+						   rule_buf);
+		useraddr += offsetof(struct compat_ethtool_rxnfc, rule_locs);
+	} else {
+		ret = copy_to_user(useraddr, &rxnfc, size);
+		useraddr += offsetof(struct ethtool_rxnfc, rule_locs);
+	}
+
+	if (ret)
+		return -EFAULT;
+
+	if (rule_buf) {
+		if (copy_to_user(useraddr, rule_buf,
+				 rxnfc->rule_cnt * sizeof(u32)))
+			return -EFAULT;
+	}
+
+	return 0;
+}
+
 static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
 						u32 cmd, void __user *useraddr)
 {
@@ -825,7 +940,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
 		info_size = (offsetof(struct ethtool_rxnfc, data) +
 			     sizeof(info.data));
 
-	if (copy_from_user(&info, useraddr, info_size))
+	if (ethtool_rxnfc_copy_from_user(&info, useraddr, info_size))
 		return -EFAULT;
 
 	rc = dev->ethtool_ops->set_rxnfc(dev, &info);
@@ -833,7 +948,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
 		return rc;
 
 	if (cmd == ETHTOOL_SRXCLSRLINS &&
-	    copy_to_user(useraddr, &info, info_size))
+	    ethtool_rxnfc_copy_to_user(useraddr, &info, info_size, NULL))
 		return -EFAULT;
 
 	return 0;
@@ -859,7 +974,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
 		info_size = (offsetof(struct ethtool_rxnfc, data) +
 			     sizeof(info.data));
 
-	if (copy_from_user(&info, useraddr, info_size))
+	if (ethtool_rxnfc_copy_from_user(&info, useraddr, info_size))
 		return -EFAULT;
 
 	/* If FLOW_RSS was requested then user-space must be using the
@@ -867,7 +982,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
 	 */
 	if (cmd == ETHTOOL_GRXFH && info.flow_type & FLOW_RSS) {
 		info_size = sizeof(info);
-		if (copy_from_user(&info, useraddr, info_size))
+		if (ethtool_rxnfc_copy_from_user(&info, useraddr, info_size))
 			return -EFAULT;
 		/* Since malicious users may modify the original data,
 		 * we need to check whether FLOW_RSS is still requested.
@@ -893,18 +1008,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
 	if (ret < 0)
 		goto err_out;
 
-	ret = -EFAULT;
-	if (copy_to_user(useraddr, &info, info_size))
-		goto err_out;
-
-	if (rule_buf) {
-		useraddr += offsetof(struct ethtool_rxnfc, rule_locs);
-		if (copy_to_user(useraddr, rule_buf,
-				 info.rule_cnt * sizeof(u32)))
-			goto err_out;
-	}
-	ret = 0;
-
+	ret = ethtool_rxnfc_copy_to_user(useraddr, &info, info_size, rule_buf);
 err_out:
 	kfree(rule_buf);
 
diff --git a/net/socket.c b/net/socket.c
index dd5da07bc1ff..d52c265ad449 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -3112,128 +3112,6 @@ static int compat_dev_ifconf(struct net *net, struct compat_ifconf __user *uifc3
 	return 0;
 }
 
-static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
-{
-	struct compat_ethtool_rxnfc __user *compat_rxnfc;
-	bool convert_in = false, convert_out = false;
-	size_t buf_size = 0;
-	struct ethtool_rxnfc __user *rxnfc = NULL;
-	struct ifreq ifr;
-	u32 rule_cnt = 0, actual_rule_cnt;
-	u32 ethcmd;
-	u32 data;
-	int ret;
-
-	if (get_user(data, &ifr32->ifr_ifru.ifru_data))
-		return -EFAULT;
-
-	compat_rxnfc = compat_ptr(data);
-
-	if (get_user(ethcmd, &compat_rxnfc->cmd))
-		return -EFAULT;
-
-	/* Most ethtool structures are defined without padding.
-	 * Unfortunately struct ethtool_rxnfc is an exception.
-	 */
-	switch (ethcmd) {
-	default:
-		break;
-	case ETHTOOL_GRXCLSRLALL:
-		/* Buffer size is variable */
-		if (get_user(rule_cnt, &compat_rxnfc->rule_cnt))
-			return -EFAULT;
-		if (rule_cnt > KMALLOC_MAX_SIZE / sizeof(u32))
-			return -ENOMEM;
-		buf_size += rule_cnt * sizeof(u32);
-		fallthrough;
-	case ETHTOOL_GRXRINGS:
-	case ETHTOOL_GRXCLSRLCNT:
-	case ETHTOOL_GRXCLSRULE:
-	case ETHTOOL_SRXCLSRLINS:
-		convert_out = true;
-		fallthrough;
-	case ETHTOOL_SRXCLSRLDEL:
-		buf_size += sizeof(struct ethtool_rxnfc);
-		convert_in = true;
-		rxnfc = compat_alloc_user_space(buf_size);
-		break;
-	}
-
-	if (copy_from_user(&ifr.ifr_name, &ifr32->ifr_name, IFNAMSIZ))
-		return -EFAULT;
-
-	ifr.ifr_data = convert_in ? rxnfc : (void __user *)compat_rxnfc;
-
-	if (convert_in) {
-		/* We expect there to be holes between fs.m_ext and
-		 * fs.ring_cookie and at the end of fs, but nowhere else.
-		 */
-		BUILD_BUG_ON(offsetof(struct compat_ethtool_rxnfc, fs.m_ext) +
-			     sizeof(compat_rxnfc->fs.m_ext) !=
-			     offsetof(struct ethtool_rxnfc, fs.m_ext) +
-			     sizeof(rxnfc->fs.m_ext));
-		BUILD_BUG_ON(
-			offsetof(struct compat_ethtool_rxnfc, fs.location) -
-			offsetof(struct compat_ethtool_rxnfc, fs.ring_cookie) !=
-			offsetof(struct ethtool_rxnfc, fs.location) -
-			offsetof(struct ethtool_rxnfc, fs.ring_cookie));
-
-		if (copy_in_user(rxnfc, compat_rxnfc,
-				 (void __user *)(&rxnfc->fs.m_ext + 1) -
-				 (void __user *)rxnfc) ||
-		    copy_in_user(&rxnfc->fs.ring_cookie,
-				 &compat_rxnfc->fs.ring_cookie,
-				 (void __user *)(&rxnfc->fs.location + 1) -
-				 (void __user *)&rxnfc->fs.ring_cookie))
-			return -EFAULT;
-		if (ethcmd == ETHTOOL_GRXCLSRLALL) {
-			if (put_user(rule_cnt, &rxnfc->rule_cnt))
-				return -EFAULT;
-		} else if (copy_in_user(&rxnfc->rule_cnt,
-					&compat_rxnfc->rule_cnt,
-					sizeof(rxnfc->rule_cnt)))
-			return -EFAULT;
-	}
-
-	ret = dev_ioctl(net, SIOCETHTOOL, &ifr, NULL);
-	if (ret)
-		return ret;
-
-	if (convert_out) {
-		if (copy_in_user(compat_rxnfc, rxnfc,
-				 (const void __user *)(&rxnfc->fs.m_ext + 1) -
-				 (const void __user *)rxnfc) ||
-		    copy_in_user(&compat_rxnfc->fs.ring_cookie,
-				 &rxnfc->fs.ring_cookie,
-				 (const void __user *)(&rxnfc->fs.location + 1) -
-				 (const void __user *)&rxnfc->fs.ring_cookie) ||
-		    copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
-				 sizeof(rxnfc->rule_cnt)))
-			return -EFAULT;
-
-		if (ethcmd == ETHTOOL_GRXCLSRLALL) {
-			/* As an optimisation, we only copy the actual
-			 * number of rules that the underlying
-			 * function returned.  Since Mallory might
-			 * change the rule count in user memory, we
-			 * check that it is less than the rule count
-			 * originally given (as the user buffer size),
-			 * which has been range-checked.
-			 */
-			if (get_user(actual_rule_cnt, &rxnfc->rule_cnt))
-				return -EFAULT;
-			if (actual_rule_cnt < rule_cnt)
-				rule_cnt = actual_rule_cnt;
-			if (copy_in_user(&compat_rxnfc->rule_locs[0],
-					 &rxnfc->rule_locs[0],
-					 rule_cnt * sizeof(u32)))
-				return -EFAULT;
-		}
-	}
-
-	return 0;
-}
-
 static int compat_siocwandev(struct net *net, struct compat_ifreq __user *uifr32)
 {
 	compat_uptr_t uptr32;
@@ -3390,8 +3268,6 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
 		return old_bridge_ioctl(argp);
 	case SIOCGIFCONF:
 		return compat_dev_ifconf(net, argp);
-	case SIOCETHTOOL:
-		return ethtool_ioctl(net, argp);
 	case SIOCWANDEV:
 		return compat_siocwandev(net, argp);
 	case SIOCGIFMAP:
@@ -3404,6 +3280,7 @@ static int compat_sock_ioctl_trans(struct file *file, struct socket *sock,
 		return sock->ops->gettstamp(sock, argp, cmd == SIOCGSTAMP_OLD,
 					    !COMPAT_USE_64BIT_TIME);
 
+	case SIOCETHTOOL:
 	case SIOCBONDSLAVEINFOQUERY:
 	case SIOCBONDINFOQUERY:
 	case SIOCSHWTSTAMP:

From a5999d18a8d8c4c767c60d67fe6a6fe51b9a203d Mon Sep 17 00:00:00 2001
From: Oak Zeng <Oak.Zeng@amd.com>
Date: Wed, 14 Jul 2021 09:50:37 -0500
Subject: [PATCH 0147/1750] drm/amdgpu: Fix a printing message

[ Upstream commit 95f71f12aa45d65b7f2ccab95569795edffd379a ]

The printing message "PSP loading VCN firmware" is mis-leading because
people might think driver is loading VCN firmware. Actually when this
message is printed, driver is just preparing some VCN ucode, not loading
VCN firmware yet. The actual VCN firmware loading will be in the PSP block
hw_init. Fix the printing message

Signed-off-by: Oak Zeng <Oak.Zeng@amd.com>
Reviewed-by: Christian Konig <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
index aa8ae0ca62f9..e8737fa438f0 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c
@@ -120,7 +120,7 @@ static int vcn_v1_0_sw_init(void *handle)
 		adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
 		adev->firmware.fw_size +=
 			ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
-		DRM_INFO("PSP loading VCN firmware\n");
+		dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
 	}
 
 	r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
index fc939d4f4841..f493b5c3d382 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
@@ -122,7 +122,7 @@ static int vcn_v2_0_sw_init(void *handle)
 		adev->firmware.ucode[AMDGPU_UCODE_ID_VCN].fw = adev->vcn.fw;
 		adev->firmware.fw_size +=
 			ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
-		DRM_INFO("PSP loading VCN firmware\n");
+		dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
 	}
 
 	r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
index 2c328362eee3..ce64d4016f90 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
@@ -152,7 +152,7 @@ static int vcn_v2_5_sw_init(void *handle)
 			adev->firmware.fw_size +=
 				ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
 		}
-		DRM_INFO("PSP loading VCN firmware\n");
+		dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
 	}
 
 	r = amdgpu_vcn_resume(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
index c9c888be1228..2099f6ebd833 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -148,7 +148,7 @@ static int vcn_v3_0_sw_init(void *handle)
 			adev->firmware.fw_size +=
 				ALIGN(le32_to_cpu(hdr->ucode_size_bytes), PAGE_SIZE);
 		}
-		DRM_INFO("PSP loading VCN firmware\n");
+		dev_info(adev->dev, "Will use PSP to load VCN firmware\n");
 	}
 
 	r = amdgpu_vcn_resume(adev);

From 6f51f4241253974a6a147daecd5c20beb7450330 Mon Sep 17 00:00:00 2001
From: Anson Jacob <Anson.Jacob@amd.com>
Date: Tue, 20 Jul 2021 11:00:44 -0400
Subject: [PATCH 0148/1750] drm/amd/amdgpu: Update debugfs link_settings output
 link_rate field in hex

[ Upstream commit 1a394b3c3de2577f200cb623c52a5c2b82805cec ]

link_rate is updated via debugfs using hex values, set it to output
in hex as well.

eg: Resolution: 1920x1080@144Hz
cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x14  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred:  0  0x0  0

echo "4 0x1e" > /sys/kernel/debug/dri/0/DP-1/link_settings

cat /sys/kernel/debug/dri/0/DP-1/link_settings
Current:  4  0x1e  0  Verified:  4  0x1e  0  Reported:  4  0x1e  16  Preferred:  4  0x1e  0

Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c    | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index e02a55fc1382..fbb65c95464b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -197,29 +197,29 @@ static ssize_t dp_link_settings_read(struct file *f, char __user *buf,
 
 	rd_buf_ptr = rd_buf;
 
-	str_len = strlen("Current:  %d  %d  %d  ");
-	snprintf(rd_buf_ptr, str_len, "Current:  %d  %d  %d  ",
+	str_len = strlen("Current:  %d  0x%x  %d  ");
+	snprintf(rd_buf_ptr, str_len, "Current:  %d  0x%x  %d  ",
 			link->cur_link_settings.lane_count,
 			link->cur_link_settings.link_rate,
 			link->cur_link_settings.link_spread);
 	rd_buf_ptr += str_len;
 
-	str_len = strlen("Verified:  %d  %d  %d  ");
-	snprintf(rd_buf_ptr, str_len, "Verified:  %d  %d  %d  ",
+	str_len = strlen("Verified:  %d  0x%x  %d  ");
+	snprintf(rd_buf_ptr, str_len, "Verified:  %d  0x%x  %d  ",
 			link->verified_link_cap.lane_count,
 			link->verified_link_cap.link_rate,
 			link->verified_link_cap.link_spread);
 	rd_buf_ptr += str_len;
 
-	str_len = strlen("Reported:  %d  %d  %d  ");
-	snprintf(rd_buf_ptr, str_len, "Reported:  %d  %d  %d  ",
+	str_len = strlen("Reported:  %d  0x%x  %d  ");
+	snprintf(rd_buf_ptr, str_len, "Reported:  %d  0x%x  %d  ",
 			link->reported_link_cap.lane_count,
 			link->reported_link_cap.link_rate,
 			link->reported_link_cap.link_spread);
 	rd_buf_ptr += str_len;
 
-	str_len = strlen("Preferred:  %d  %d  %d  ");
-	snprintf(rd_buf_ptr, str_len, "Preferred:  %d  %d  %d\n",
+	str_len = strlen("Preferred:  %d  0x%x  %d  ");
+	snprintf(rd_buf_ptr, str_len, "Preferred:  %d  0x%x  %d\n",
 			link->preferred_link_setting.lane_count,
 			link->preferred_link_setting.link_rate,
 			link->preferred_link_setting.link_spread);

From 99121dec14b0bbdc37709da95d8971f188ee9c0f Mon Sep 17 00:00:00 2001
From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Date: Wed, 21 Jul 2021 12:40:58 +0200
Subject: [PATCH 0149/1750] bpf/tests: Fix copy-and-paste error in double word
 test

[ Upstream commit ae7f47041d928b1a2f28717d095b4153c63cbf6a ]

This test now operates on DW as stated instead of W, which was
already covered by another test.

Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210721104058.3755254-1-johan.almbladh@anyfinetworks.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/test_bpf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index ca7d635bccd9..ca8eef2f6442 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -4286,8 +4286,8 @@ static struct bpf_test tests[] = {
 		.u.insns_int = {
 			BPF_LD_IMM64(R0, 0),
 			BPF_LD_IMM64(R1, 0xffffffffffffffffLL),
-			BPF_STX_MEM(BPF_W, R10, R1, -40),
-			BPF_LDX_MEM(BPF_W, R0, R10, -40),
+			BPF_STX_MEM(BPF_DW, R10, R1, -40),
+			BPF_LDX_MEM(BPF_DW, R0, R10, -40),
 			BPF_EXIT_INSN(),
 		},
 		INTERNAL,

From 6a3564739b9f9f0c8df4c0eab3ce888a04e967a4 Mon Sep 17 00:00:00 2001
From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Date: Wed, 21 Jul 2021 12:38:22 +0200
Subject: [PATCH 0150/1750] bpf/tests: Do not PASS tests without actually
 testing the result

[ Upstream commit 2b7e9f25e590726cca76700ebdb10e92a7a72ca1 ]

Each test case can have a set of sub-tests, where each sub-test can
run the cBPF/eBPF test snippet with its own data_size and expected
result. Before, the end of the sub-test array was indicated by both
data_size and result being zero. However, most or all of the internal
eBPF tests has a data_size of zero already. When such a test also had
an expected value of zero, the test was never run but reported as
PASS anyway.

Now the test runner always runs the first sub-test, regardless of the
data_size and result values. The sub-test array zero-termination only
applies for any additional sub-tests.

There are other ways fix it of course, but this solution at least
removes the surprise of eBPF tests with a zero result always succeeding.

Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210721103822.3755111-1-johan.almbladh@anyfinetworks.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/test_bpf.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index ca8eef2f6442..4a9137c8551a 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -6664,7 +6664,14 @@ static int run_one(const struct bpf_prog *fp, struct bpf_test *test)
 		u64 duration;
 		u32 ret;
 
-		if (test->test[i].data_size == 0 &&
+		/*
+		 * NOTE: Several sub-tests may be present, in which case
+		 * a zero {data_size, result} tuple indicates the end of
+		 * the sub-test array. The first test is always run,
+		 * even if both data_size and result happen to be zero.
+		 */
+		if (i > 0 &&
+		    test->test[i].data_size == 0 &&
 		    test->test[i].result == 0)
 			break;
 

From be2e11b9f8fab49da85a3d79a34f4436c60510df Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Wed, 14 Jul 2021 11:48:06 +0200
Subject: [PATCH 0151/1750] drm/bridge: nwl-dsi: Avoid potential multiplication
 overflow on 32-bit

[ Upstream commit 47956bc86ee4e8530cac386a04f62a6095f7afbe ]

As nwl_dsi.lanes is u32, and NSEC_PER_SEC is 1000000000L, the second
multiplication in

    dsi->lanes * 8 * NSEC_PER_SEC

will overflow on a 32-bit platform.  Fix this by making the constant
unsigned long long, forcing 64-bit arithmetic.

As iMX8 is arm64, this driver is currently used on 64-bit platforms
only, where long is 64-bit, so this cannot happen.  But the issue will
start to happen when the driver is reused for a 32-bit SoC (e.g.
i.MX7ULP), or when code is copied for a new driver.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/ebb82941a86b4e35c4fcfb1ef5a5cfad7c1fceab.1626255956.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/nwl-dsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c
index c65ca860712d..6cac2e58cd15 100644
--- a/drivers/gpu/drm/bridge/nwl-dsi.c
+++ b/drivers/gpu/drm/bridge/nwl-dsi.c
@@ -196,7 +196,7 @@ static u32 ps2bc(struct nwl_dsi *dsi, unsigned long long ps)
 	u32 bpp = mipi_dsi_pixel_format_to_bpp(dsi->format);
 
 	return DIV64_U64_ROUND_UP(ps * dsi->mode.clock * bpp,
-				  dsi->lanes * 8 * NSEC_PER_SEC);
+				  dsi->lanes * 8ULL * NSEC_PER_SEC);
 }
 
 /*

From 3740418ccde89fe26057fad3f31ecb1730100461 Mon Sep 17 00:00:00 2001
From: Jernej Skrabec <jernej.skrabec@gmail.com>
Date: Thu, 22 Jul 2021 18:12:18 +0200
Subject: [PATCH 0152/1750] arm64: dts: allwinner: h6: tanix-tx6: Fix regulator
 node names

[ Upstream commit 7ab1f6539762946de06ca14d7401ae123821bc40 ]

Regulator node names don't reflect class of the device. Fix that by
prefixing names with "regulator-".

Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210722161220.51181-2-jernej.skrabec@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts
index be81330db14f..02641191682e 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix-tx6.dts
@@ -32,14 +32,14 @@ hdmi_con_in: endpoint {
 		};
 	};
 
-	reg_vcc3v3: vcc3v3 {
+	reg_vcc3v3: regulator-vcc3v3 {
 		compatible = "regulator-fixed";
 		regulator-name = "vcc3v3";
 		regulator-min-microvolt = <3300000>;
 		regulator-max-microvolt = <3300000>;
 	};
 
-	reg_vdd_cpu_gpu: vdd-cpu-gpu {
+	reg_vdd_cpu_gpu: regulator-vdd-cpu-gpu {
 		compatible = "regulator-fixed";
 		regulator-name = "vdd-cpu-gpu";
 		regulator-min-microvolt = <1135000>;

From 6a8dcd2ffb4126214107d77fdc0361fab4b2acfa Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Mon, 26 Jul 2021 10:03:53 +0000
Subject: [PATCH 0153/1750] video: fbdev: asiliantfb: Error out if 'pixclock'
 equals zero

[ Upstream commit b36b242d4b8ea178f7fd038965e3cac7f30c3f09 ]

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of 'pixclock',
it may cause divide error.

Fix this by checking whether 'pixclock' is zero first.

The following log reveals it:

[   43.861711] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
[   43.861737] CPU: 2 PID: 11764 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #224
[   43.861756] RIP: 0010:asiliantfb_check_var+0x4e/0x730
[   43.861843] Call Trace:
[   43.861848]  ? asiliantfb_remove+0x190/0x190
[   43.861858]  fb_set_var+0x2e4/0xeb0
[   43.861866]  ? fb_blank+0x1a0/0x1a0
[   43.861873]  ? lock_acquire+0x1ef/0x530
[   43.861884]  ? lock_release+0x810/0x810
[   43.861892]  ? lock_is_held_type+0x100/0x140
[   43.861903]  ? ___might_sleep+0x1ee/0x2d0
[   43.861914]  ? __mutex_lock+0x620/0x1190
[   43.861921]  ? do_fb_ioctl+0x313/0x700
[   43.861929]  ? mutex_lock_io_nested+0xfa0/0xfa0
[   43.861936]  ? __this_cpu_preempt_check+0x1d/0x30
[   43.861944]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861952]  ? lockdep_hardirqs_on+0x59/0x100
[   43.861959]  ? _raw_spin_unlock_irqrestore+0x46/0x60
[   43.861967]  ? trace_hardirqs_on+0x6a/0x1c0
[   43.861978]  do_fb_ioctl+0x31e/0x700

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-2-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/asiliantfb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c
index 3e006da47752..84c56f525889 100644
--- a/drivers/video/fbdev/asiliantfb.c
+++ b/drivers/video/fbdev/asiliantfb.c
@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var,
 {
 	unsigned long Ftarget, ratio, remainder;
 
+	if (!var->pixclock)
+		return -EINVAL;
+
 	ratio = 1000000 / var->pixclock;
 	remainder = 1000000 % var->pixclock;
 	Ftarget = 1000000 * ratio + (1000000 * remainder) / var->pixclock;

From 63abc0eb8af54cf24df2bad768bab4dd561c2999 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Mon, 26 Jul 2021 10:03:54 +0000
Subject: [PATCH 0154/1750] video: fbdev: kyro: Error out if 'pixclock' equals
 zero

[ Upstream commit 1520b4b7ba964f8eec2e7dd14c571d50de3e5191 ]

The userspace program could pass any values to the driver through
ioctl() interface. if the driver doesn't check the value of 'pixclock',
it may cause divide error because the value of 'lineclock' and
'frameclock' will be zero.

Fix this by checking whether 'pixclock' is zero in kyrofb_check_var().

The following log reveals it:

[  103.073930] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
[  103.073942] CPU: 4 PID: 12483 Comm: syz-executor Not tainted 5.14.0-rc2-00478-g2734d6c1b1a0-dirty #118
[  103.073959] RIP: 0010:kyrofb_set_par+0x316/0xc80
[  103.074045] Call Trace:
[  103.074048]  ? ___might_sleep+0x1ee/0x2d0
[  103.074060]  ? kyrofb_ioctl+0x330/0x330
[  103.074069]  fb_set_var+0x5bf/0xeb0
[  103.074078]  ? fb_blank+0x1a0/0x1a0
[  103.074085]  ? lock_acquire+0x3bd/0x530
[  103.074094]  ? lock_release+0x810/0x810
[  103.074103]  ? ___might_sleep+0x1ee/0x2d0
[  103.074114]  ? __mutex_lock+0x620/0x1190
[  103.074126]  ? trace_hardirqs_on+0x6a/0x1c0
[  103.074137]  do_fb_ioctl+0x31e/0x700
[  103.074144]  ? fb_getput_cmap+0x280/0x280
[  103.074152]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074162]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074171]  ? __sanitizer_cov_trace_switch+0x67/0xf0
[  103.074181]  ? __sanitizer_cov_trace_const_cmp2+0x20/0x80
[  103.074191]  ? do_vfs_ioctl+0x14b/0x16c0
[  103.074199]  ? vfs_fileattr_set+0xb60/0xb60
[  103.074207]  ? rcu_read_lock_sched_held+0x11/0x80
[  103.074216]  ? lock_release+0x483/0x810
[  103.074224]  ? __fget_files+0x217/0x3d0
[  103.074234]  ? __fget_files+0x239/0x3d0
[  103.074243]  ? do_fb_ioctl+0x700/0x700
[  103.074250]  fb_ioctl+0xe6/0x130

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-3-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/kyro/fbdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c
index 4b8c7c16b1df..25801e8e3f74 100644
--- a/drivers/video/fbdev/kyro/fbdev.c
+++ b/drivers/video/fbdev/kyro/fbdev.c
@@ -399,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 {
 	struct kyrofb_info *par = info->par;
 
+	if (!var->pixclock)
+		return -EINVAL;
+
 	if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) {
 		printk(KERN_WARNING "kyrofb: depth not supported: %u\n", var->bits_per_pixel);
 		return -EINVAL;

From bcc61adefd7845fa89d6dd0514a0ee8b545f85ef Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Mon, 26 Jul 2021 10:03:55 +0000
Subject: [PATCH 0155/1750] video: fbdev: riva: Error out if 'pixclock' equals
 zero

[ Upstream commit f92763cb0feba247e0939ed137b495601fd072a5 ]

The userspace program could pass any values to the driver through
ioctl() interface. If the driver doesn't check the value of 'pixclock',
it may cause divide error.

Fix this by checking whether 'pixclock' is zero first.

The following log reveals it:

[   33.396850] divide error: 0000 [#1] PREEMPT SMP KASAN PTI
[   33.396864] CPU: 5 PID: 11754 Comm: i740 Not tainted 5.14.0-rc2-00513-gac532c9bbcfb-dirty #222
[   33.396883] RIP: 0010:riva_load_video_mode+0x417/0xf70
[   33.396969] Call Trace:
[   33.396973]  ? debug_smp_processor_id+0x1c/0x20
[   33.396984]  ? tick_nohz_tick_stopped+0x1a/0x90
[   33.396996]  ? rivafb_copyarea+0x3c0/0x3c0
[   33.397003]  ? wake_up_klogd.part.0+0x99/0xd0
[   33.397014]  ? vprintk_emit+0x110/0x4b0
[   33.397024]  ? vprintk_default+0x26/0x30
[   33.397033]  ? vprintk+0x9c/0x1f0
[   33.397041]  ? printk+0xba/0xed
[   33.397054]  ? record_print_text.cold+0x16/0x16
[   33.397063]  ? __kasan_check_read+0x11/0x20
[   33.397074]  ? profile_tick+0xc0/0x100
[   33.397084]  ? __sanitizer_cov_trace_const_cmp4+0x24/0x80
[   33.397094]  ? riva_set_rop_solid+0x2a0/0x2a0
[   33.397102]  rivafb_set_par+0xbe/0x610
[   33.397111]  ? riva_set_rop_solid+0x2a0/0x2a0
[   33.397119]  fb_set_var+0x5bf/0xeb0
[   33.397127]  ? fb_blank+0x1a0/0x1a0
[   33.397134]  ? lock_acquire+0x1ef/0x530
[   33.397143]  ? lock_release+0x810/0x810
[   33.397151]  ? lock_is_held_type+0x100/0x140
[   33.397159]  ? ___might_sleep+0x1ee/0x2d0
[   33.397170]  ? __mutex_lock+0x620/0x1190
[   33.397180]  ? trace_hardirqs_on+0x6a/0x1c0
[   33.397190]  do_fb_ioctl+0x31e/0x700

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/1627293835-17441-4-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/riva/fbdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c
index ce55b9d2e862..7dd621c7afe4 100644
--- a/drivers/video/fbdev/riva/fbdev.c
+++ b/drivers/video/fbdev/riva/fbdev.c
@@ -1084,6 +1084,9 @@ static int rivafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 	int mode_valid = 0;
 	
 	NVTRACE_ENTER();
+	if (!var->pixclock)
+		return -EINVAL;
+
 	switch (var->bits_per_pixel) {
 	case 1 ... 8:
 		var->red.offset = var->green.offset = var->blue.offset = 0;

From 64583448c231df5dd809de712322c42de3680cfb Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Mon, 26 Jul 2021 14:52:51 -0500
Subject: [PATCH 0156/1750] ipv4: ip_output.c: Fix out-of-bounds warning in
 ip_copy_addrs()

[ Upstream commit 6321c7acb82872ef6576c520b0e178eaad3a25c0 ]

Fix the following out-of-bounds warning:

    In function 'ip_copy_addrs',
        inlined from '__ip_queue_xmit' at net/ipv4/ip_output.c:517:2:
net/ipv4/ip_output.c:449:2: warning: 'memcpy' offset [40, 43] from the object at 'fl' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 36 [-Warray-bounds]
      449 |  memcpy(&iph->saddr, &fl4->saddr,
          |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      450 |         sizeof(fl4->saddr) + sizeof(fl4->daddr));
          |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The problem is that the original code is trying to copy data into a
couple of struct members adjacent to each other in a single call to
memcpy(). This causes a legitimate compiler warning because memcpy()
overruns the length of &iph->saddr and &fl4->saddr. As these are just
a couple of struct members, fix this by using direct assignments,
instead of memcpy().

This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ip_output.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 560d5dc43562..10d4cde31c6b 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -445,8 +445,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4)
 {
 	BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) !=
 		     offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr));
-	memcpy(&iph->saddr, &fl4->saddr,
-	       sizeof(fl4->saddr) + sizeof(fl4->daddr));
+
+	iph->saddr = fl4->saddr;
+	iph->daddr = fl4->daddr;
 }
 
 /* Note: skb->sk can be different from sk, in case of tunnels */

From 863d2eb2f726add454283dfd935c9743be71aa51 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Mon, 26 Jul 2021 14:25:11 -0500
Subject: [PATCH 0157/1750] flow_dissector: Fix out-of-bounds warnings

[ Upstream commit 323e0cb473e2a8706ff162b6b4f4fa16023c9ba7 ]

Fix the following out-of-bounds warnings:

    net/core/flow_dissector.c: In function '__skb_flow_dissect':
>> net/core/flow_dissector.c:1104:4: warning: 'memcpy' offset [24, 39] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'struct in6_addr' at offset 8 [-Warray-bounds]
     1104 |    memcpy(&key_addrs->v6addrs, &iph->saddr,
          |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1105 |           sizeof(key_addrs->v6addrs));
          |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from include/linux/ipv6.h:5,
                     from net/core/flow_dissector.c:6:
    include/uapi/linux/ipv6.h:133:18: note: subobject 'saddr' declared here
      133 |  struct in6_addr saddr;
          |                  ^~~~~
>> net/core/flow_dissector.c:1059:4: warning: 'memcpy' offset [16, 19] from the object at '<unknown>' is out of the bounds of referenced subobject 'saddr' with type 'unsigned int' at offset 12 [-Warray-bounds]
     1059 |    memcpy(&key_addrs->v4addrs, &iph->saddr,
          |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     1060 |           sizeof(key_addrs->v4addrs));
          |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~
    In file included from include/linux/ip.h:17,
                     from net/core/flow_dissector.c:5:
    include/uapi/linux/ip.h:103:9: note: subobject 'saddr' declared here
      103 |  __be32 saddr;
          |         ^~~~~

The problem is that the original code is trying to copy data into a
couple of struct members adjacent to each other in a single call to
memcpy().  So, the compiler legitimately complains about it. As these
are just a couple of members, fix this by copying each one of them in
separate calls to memcpy().

This helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

Link: https://github.com/KSPP/linux/issues/109
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/d5ae2e65-1f18-2577-246f-bada7eee6ccd@intel.com/
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/flow_dissector.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index c52e5ea654e9..813c709c61cf 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1047,8 +1047,10 @@ bool __skb_flow_dissect(const struct net *net,
 							      FLOW_DISSECTOR_KEY_IPV4_ADDRS,
 							      target_container);
 
-			memcpy(&key_addrs->v4addrs, &iph->saddr,
-			       sizeof(key_addrs->v4addrs));
+			memcpy(&key_addrs->v4addrs.src, &iph->saddr,
+			       sizeof(key_addrs->v4addrs.src));
+			memcpy(&key_addrs->v4addrs.dst, &iph->daddr,
+			       sizeof(key_addrs->v4addrs.dst));
 			key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
 		}
 
@@ -1092,8 +1094,10 @@ bool __skb_flow_dissect(const struct net *net,
 							      FLOW_DISSECTOR_KEY_IPV6_ADDRS,
 							      target_container);
 
-			memcpy(&key_addrs->v6addrs, &iph->saddr,
-			       sizeof(key_addrs->v6addrs));
+			memcpy(&key_addrs->v6addrs.src, &iph->saddr,
+			       sizeof(key_addrs->v6addrs.src));
+			memcpy(&key_addrs->v6addrs.dst, &iph->daddr,
+			       sizeof(key_addrs->v6addrs.dst));
 			key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
 		}
 

From 77d62f2bcc7fadf2764c792d31a94cb80943d031 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <hca@linux.ibm.com>
Date: Mon, 12 Jul 2021 19:26:01 +0200
Subject: [PATCH 0158/1750] s390/jump_label: print real address in a case of a
 jump label bug

[ Upstream commit 5492886c14744d239e87f1b0b774b5a341e755cc ]

In case of a jump label print the real address of the piece of code
where a mismatch was detected. This is right before the system panics,
so there is nothing revealed.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/jump_label.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
index ab584e8e3527..9156653b56f6 100644
--- a/arch/s390/kernel/jump_label.c
+++ b/arch/s390/kernel/jump_label.c
@@ -36,7 +36,7 @@ static void jump_label_bug(struct jump_entry *entry, struct insn *expected,
 	unsigned char *ipe = (unsigned char *)expected;
 	unsigned char *ipn = (unsigned char *)new;
 
-	pr_emerg("Jump label code mismatch at %pS [%p]\n", ipc, ipc);
+	pr_emerg("Jump label code mismatch at %pS [%px]\n", ipc, ipc);
 	pr_emerg("Found:    %6ph\n", ipc);
 	pr_emerg("Expected: %6ph\n", ipe);
 	pr_emerg("New:      %6ph\n", ipn);

From 973c57c5e649481a7444ec79f29b213115cb8c2c Mon Sep 17 00:00:00 2001
From: Niklas Schnelle <schnelle@linux.ibm.com>
Date: Thu, 8 Jul 2021 14:55:42 +0200
Subject: [PATCH 0159/1750] s390: make PCI mio support a machine flag

[ Upstream commit 3322ba0d7bea1e24ae464418626f6a15b69533ab ]

Kernel support for the newer PCI mio instructions can be toggled off
with the pci=nomio command line option which needs to integrate with
common code PCI option parsing. However this option then toggles static
branches which can't be toggled yet in an early_param() call.

Thus commit 9964f396f1d0 ("s390: fix setting of mio addressing control")
moved toggling the static branches to the PCI init routine.

With this setup however we can't check for mio support outside the PCI
code during early boot, i.e. before switching the static branches, which
we need to be able to export this as an ELF HWCAP.

Improve on this by turning mio availability into a machine flag that
gets initially set based on CONFIG_PCI and the facility bit and gets
toggled off if pci=nomio is found during PCI option parsing allowing
simple access to this machine flag after early init.

Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/include/asm/setup.h | 2 ++
 arch/s390/kernel/early.c      | 4 ++++
 arch/s390/pci/pci.c           | 5 ++---
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h
index bdb242a1544e..75a2ecec2ab8 100644
--- a/arch/s390/include/asm/setup.h
+++ b/arch/s390/include/asm/setup.h
@@ -38,6 +38,7 @@
 #define MACHINE_FLAG_NX		BIT(15)
 #define MACHINE_FLAG_GS		BIT(16)
 #define MACHINE_FLAG_SCC	BIT(17)
+#define MACHINE_FLAG_PCI_MIO	BIT(18)
 
 #define LPP_MAGIC		BIT(31)
 #define LPP_PID_MASK		_AC(0xffffffff, UL)
@@ -113,6 +114,7 @@ extern unsigned long mio_wb_bit_mask;
 #define MACHINE_HAS_NX		(S390_lowcore.machine_flags & MACHINE_FLAG_NX)
 #define MACHINE_HAS_GS		(S390_lowcore.machine_flags & MACHINE_FLAG_GS)
 #define MACHINE_HAS_SCC		(S390_lowcore.machine_flags & MACHINE_FLAG_SCC)
+#define MACHINE_HAS_PCI_MIO	(S390_lowcore.machine_flags & MACHINE_FLAG_PCI_MIO)
 
 /*
  * Console mode. Override with conmode=
diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
index 705844f73934..985e1e755333 100644
--- a/arch/s390/kernel/early.c
+++ b/arch/s390/kernel/early.c
@@ -238,6 +238,10 @@ static __init void detect_machine_facilities(void)
 		clock_comparator_max = -1ULL >> 1;
 		__ctl_set_bit(0, 53);
 	}
+	if (IS_ENABLED(CONFIG_PCI) && test_facility(153)) {
+		S390_lowcore.machine_flags |= MACHINE_FLAG_PCI_MIO;
+		/* the control bit is set during PCI initialization */
+	}
 }
 
 static inline void save_vector_registers(void)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 0ddb1fe353dc..f5ddbc625c1a 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -866,7 +866,6 @@ static void zpci_mem_exit(void)
 }
 
 static unsigned int s390_pci_probe __initdata = 1;
-static unsigned int s390_pci_no_mio __initdata;
 unsigned int s390_pci_force_floating __initdata;
 static unsigned int s390_pci_initialized;
 
@@ -877,7 +876,7 @@ char * __init pcibios_setup(char *str)
 		return NULL;
 	}
 	if (!strcmp(str, "nomio")) {
-		s390_pci_no_mio = 1;
+		S390_lowcore.machine_flags &= ~MACHINE_FLAG_PCI_MIO;
 		return NULL;
 	}
 	if (!strcmp(str, "force_floating")) {
@@ -906,7 +905,7 @@ static int __init pci_base_init(void)
 	if (!test_facility(69) || !test_facility(71))
 		return 0;
 
-	if (test_facility(153) && !s390_pci_no_mio) {
+	if (MACHINE_HAS_PCI_MIO) {
 		static_branch_enable(&have_mio);
 		ctl_set_bit(2, 5);
 	}

From b763d2e7d45c1d067e560fca8353997fc2e3da88 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Sat, 26 Jun 2021 06:11:51 +0200
Subject: [PATCH 0160/1750] serial: 8250: Define RX trigger levels for OxSemi
 950 devices

[ Upstream commit d7aff291d069c4418285f3c8ee27b0ff67ce5998 ]

Oxford Semiconductor 950 serial port devices have a 128-byte FIFO and in
the enhanced (650) mode, which we select in `autoconfig_has_efr' with
the ECB bit set in the EFR register, they support the receive interrupt
trigger level selectable with FCR bits 7:6 from the set of 16, 32, 112,
120.  This applies to the original OX16C950 discrete UART[1] as well as
950 cores embedded into more complex devices.

For these devices we set the default to 112, which sets an excessively
high level of 112 or 7/8 of the FIFO capacity, unlike with other port
types where we choose at most 1/2 of their respective FIFO capacities.
Additionally we don't make the trigger level configurable.  Consequently
frequent input overruns happen with high bit rates where hardware flow
control cannot be used (e.g. terminal applications) even with otherwise
highly-performant systems.

Lower the default receive interrupt trigger level to 32 then, and make
it configurable.  Document the trigger levels along with other port
types, including the set of 16, 32, 64, 112 for the transmit interrupt
as well[2].

References:

[1] "OX16C950 rev B High Performance UART with 128 byte FIFOs", Oxford
    Semiconductor, Inc., DS-0031, Sep 05, Table 10: "Receiver Trigger
    Levels", p. 22

[2] same, Table 9: "Transmit Interrupt Trigger Levels", p. 22

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Link: https://lore.kernel.org/r/alpine.DEB.2.21.2106260608480.37803@angie.orcam.me.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_port.c | 3 ++-
 include/uapi/linux/serial_reg.h     | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 3de0a16e055a..5d40f1010fbf 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -122,7 +122,8 @@ static const struct serial8250_config uart_config[] = {
 		.name		= "16C950/954",
 		.fifo_size	= 128,
 		.tx_loadsz	= 128,
-		.fcr		= UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10,
+		.fcr		= UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_01,
+		.rxtrig_bytes	= {16, 32, 112, 120},
 		/* UART_CAP_EFR breaks billionon CF bluetooth card. */
 		.flags		= UART_CAP_FIFO | UART_CAP_SLEEP,
 	},
diff --git a/include/uapi/linux/serial_reg.h b/include/uapi/linux/serial_reg.h
index be07b5470f4b..f51bc8f36813 100644
--- a/include/uapi/linux/serial_reg.h
+++ b/include/uapi/linux/serial_reg.h
@@ -62,6 +62,7 @@
  * ST16C654:	 8  16  56  60		 8  16  32  56	PORT_16654
  * TI16C750:	 1  16  32  56		xx  xx  xx  xx	PORT_16750
  * TI16C752:	 8  16  56  60		 8  16  32  56
+ * OX16C950:	16  32 112 120		16  32  64 112	PORT_16C950
  * Tegra:	 1   4   8  14		16   8   4   1	PORT_TEGRA
  */
 #define UART_FCR_R_TRIG_00	0x00

From dd3307a8b3838f76632d5d5c083f164da4dbbd3d Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Fri, 23 Jul 2021 09:43:10 +0200
Subject: [PATCH 0161/1750] xtensa: ISS: don't panic in rs_init

[ Upstream commit 23411c720052ad860b3e579ee4873511e367130a ]

While alloc_tty_driver failure in rs_init would mean we have much bigger
problem, there is no reason to panic when tty_register_driver fails
there. It can fail for various reasons.

So handle the failure gracefully. Actually handle them both while at it.
This will make at least the console functional as it was enabled earlier
by console_initcall in iss_console_init. Instead of shooting down the
whole system.

We move tty_port_init() after alloc_tty_driver(), so that we don't need
to destroy the port in case the latter function fails.

Cc: Chris Zankel <chris@zankel.net>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: linux-xtensa@linux-xtensa.org
Acked-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20210723074317.32690-2-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/platforms/iss/console.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
index af81a62faba6..e7faea3d73d3 100644
--- a/arch/xtensa/platforms/iss/console.c
+++ b/arch/xtensa/platforms/iss/console.c
@@ -168,9 +168,13 @@ static const struct tty_operations serial_ops = {
 
 int __init rs_init(void)
 {
-	tty_port_init(&serial_port);
+	int ret;
 
 	serial_driver = alloc_tty_driver(SERIAL_MAX_NUM_LINES);
+	if (!serial_driver)
+		return -ENOMEM;
+
+	tty_port_init(&serial_port);
 
 	pr_info("%s %s\n", serial_name, serial_version);
 
@@ -190,8 +194,15 @@ int __init rs_init(void)
 	tty_set_operations(serial_driver, &serial_ops);
 	tty_port_link_device(&serial_port, serial_driver, 0);
 
-	if (tty_register_driver(serial_driver))
-		panic("Couldn't register serial driver\n");
+	ret = tty_register_driver(serial_driver);
+	if (ret) {
+		pr_err("Couldn't register serial driver\n");
+		tty_driver_kref_put(serial_driver);
+		tty_port_destroy(&serial_port);
+
+		return ret;
+	}
+
 	return 0;
 }
 

From 2603740df8b2f8d443a4257a37db12cb1264e24f Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Fri, 23 Jul 2021 09:43:11 +0200
Subject: [PATCH 0162/1750] hvsi: don't panic on tty_register_driver failure

[ Upstream commit 7ccbdcc4d08a6d7041e4849219bbb12ffa45db4c ]

The alloc_tty_driver failure is handled gracefully in hvsi_init. But
tty_register_driver is not. panic is called if that one fails.

So handle the failure of tty_register_driver gracefully too. This will
keep at least the console functional as it was enabled earlier by
console_initcall in hvsi_console_init. Instead of shooting down the
whole system.

This means, we disable interrupts and restore hvsi_wait back to
poll_for_state().

Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20210723074317.32690-3-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/hvc/hvsi.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/tty/hvc/hvsi.c b/drivers/tty/hvc/hvsi.c
index e8c58f9bd263..d6afaae1729a 100644
--- a/drivers/tty/hvc/hvsi.c
+++ b/drivers/tty/hvc/hvsi.c
@@ -1038,7 +1038,7 @@ static const struct tty_operations hvsi_ops = {
 
 static int __init hvsi_init(void)
 {
-	int i;
+	int i, ret;
 
 	hvsi_driver = alloc_tty_driver(hvsi_count);
 	if (!hvsi_driver)
@@ -1069,12 +1069,25 @@ static int __init hvsi_init(void)
 	}
 	hvsi_wait = wait_for_state; /* irqs active now */
 
-	if (tty_register_driver(hvsi_driver))
-		panic("Couldn't register hvsi console driver\n");
+	ret = tty_register_driver(hvsi_driver);
+	if (ret) {
+		pr_err("Couldn't register hvsi console driver\n");
+		goto err_free_irq;
+	}
 
 	printk(KERN_DEBUG "HVSI: registered %i devices\n", hvsi_count);
 
 	return 0;
+err_free_irq:
+	hvsi_wait = poll_for_state;
+	for (i = 0; i < hvsi_count; i++) {
+		struct hvsi_struct *hp = &hvsi_ports[i];
+
+		free_irq(hp->virq, hp);
+	}
+	tty_driver_kref_put(hvsi_driver);
+
+	return ret;
 }
 device_initcall(hvsi_init);
 

From d0a8ef04c22043c88b2ac0628d0f3e2dcca4b8cf Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 26 Jul 2021 15:07:17 +0200
Subject: [PATCH 0163/1750] serial: 8250_pci: make setup_port() parameters
 explicitly unsigned

[ Upstream commit 3a96e97ab4e835078e6f27b7e1c0947814df3841 ]

The bar and offset parameters to setup_port() are used in pointer math,
and while it would be very difficult to get them to wrap as a negative
number, just be "safe" and make them unsigned so that static checkers do
not trip over them unintentionally.

Cc: Jiri Slaby <jirislaby@kernel.org>
Reported-by: Jordy Zomer <jordy@pwning.systems>
Link: https://lore.kernel.org/r/20210726130717.2052096-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 39f9ea24e316..58f718ed1bb9 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -87,7 +87,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
 
 static int
 setup_port(struct serial_private *priv, struct uart_8250_port *port,
-	   int bar, int offset, int regshift)
+	   u8 bar, unsigned int offset, int regshift)
 {
 	struct pci_dev *dev = priv->dev;
 

From 035f83b5abd35169e853190ff5be7bf49cfa3720 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Wed, 21 Jul 2021 10:45:11 +0200
Subject: [PATCH 0164/1750] staging: ks7010: Fix the initialization of the
 'sleep_status' structure

[ Upstream commit 56315e55119c0ea57e142b6efb7c31208628ad86 ]

'sleep_status' has 3 atomic_t members. Initialize the 3 of them instead of
initializing only 2 of them and setting 0 twice to the same variable.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/d2e52a33a9beab41879551d0ae2fdfc99970adab.1626856991.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/ks7010/ks7010_sdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/ks7010/ks7010_sdio.c b/drivers/staging/ks7010/ks7010_sdio.c
index 78dc8beeae98..8c740c771f50 100644
--- a/drivers/staging/ks7010/ks7010_sdio.c
+++ b/drivers/staging/ks7010/ks7010_sdio.c
@@ -939,9 +939,9 @@ static void ks7010_private_init(struct ks_wlan_private *priv,
 	memset(&priv->wstats, 0, sizeof(priv->wstats));
 
 	/* sleep mode */
+	atomic_set(&priv->sleepstatus.status, 0);
 	atomic_set(&priv->sleepstatus.doze_request, 0);
 	atomic_set(&priv->sleepstatus.wakeup_request, 0);
-	atomic_set(&priv->sleepstatus.wakeup_request, 0);
 
 	trx_device_init(priv);
 	hostif_init(priv);

From 874d5aa06ce2aac1085d3bf2868b0bc57afd5856 Mon Sep 17 00:00:00 2001
From: Juhee Kang <claudiajkang@gmail.com>
Date: Tue, 27 Jul 2021 04:10:55 +0000
Subject: [PATCH 0165/1750] samples: bpf: Fix tracex7 error raised on the
 missing argument

[ Upstream commit 7d07006f05922b95518be403f08ef8437b67aa32 ]

The current behavior of 'tracex7' doesn't consist with other bpf samples
tracex{1..6}. Other samples do not require any argument to run with, but
tracex7 should be run with btrfs device argument. (it should be executed
with test_override_return.sh)

Currently, tracex7 doesn't have any description about how to run this
program and raises an unexpected error. And this result might be
confusing since users might not have a hunch about how to run this
program.

    // Current behavior
    # ./tracex7
    sh: 1: Syntax error: word unexpected (expecting ")")
    // Fixed behavior
    # ./tracex7
    ERROR: Run with the btrfs device argument!

In order to fix this error, this commit adds logic to report a message
and exit when running this program with a missing argument.

Additionally in test_override_return.sh, there is a problem with
multiple directory(tmpmnt) creation. So in this commit adds a line with
removing the directory with every execution.

Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210727041056.23455-1-claudiajkang@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/test_override_return.sh | 1 +
 samples/bpf/tracex7_user.c          | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/samples/bpf/test_override_return.sh b/samples/bpf/test_override_return.sh
index e68b9ee6814b..35db26f736b9 100755
--- a/samples/bpf/test_override_return.sh
+++ b/samples/bpf/test_override_return.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 
+rm -r tmpmnt
 rm -f testfile.img
 dd if=/dev/zero of=testfile.img bs=1M seek=1000 count=1
 DEVICE=$(losetup --show -f testfile.img)
diff --git a/samples/bpf/tracex7_user.c b/samples/bpf/tracex7_user.c
index fdcd6580dd73..8be7ce18d3ba 100644
--- a/samples/bpf/tracex7_user.c
+++ b/samples/bpf/tracex7_user.c
@@ -14,6 +14,11 @@ int main(int argc, char **argv)
 	int ret = 0;
 	FILE *f;
 
+	if (!argv[1]) {
+		fprintf(stderr, "ERROR: Run with the btrfs device argument!\n");
+		return 0;
+	}
+
 	snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]);
 	obj = bpf_object__open_file(filename, NULL);
 	if (libbpf_get_error(obj)) {

From 4af60a543ba60239d8931215c7e239c91e42c129 Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <m@lambda.lt>
Date: Mon, 26 Jul 2021 17:20:01 +0200
Subject: [PATCH 0166/1750] libbpf: Fix race when pinning maps in parallel

[ Upstream commit 043c5bb3c4f43670ab4fea0b847373ab42d25f3e ]

When loading in parallel multiple programs which use the same to-be
pinned map, it is possible that two instances of the loader will call
bpf_object__create_maps() at the same time. If the map doesn't exist
when both instances call bpf_object__reuse_map(), then one of the
instances will fail with EEXIST when calling bpf_map__pin().

Fix the race by retrying reusing a map if bpf_map__pin() returns
EEXIST. The fix is similar to the one in iproute2: e4c4685fd6e4 ("bpf:
Fix race condition with map pinning").

Before retrying the pinning, we don't do any special cleaning of an
internal map state. The closer code inspection revealed that it's not
required:

    - bpf_object__create_map(): map->inner_map is destroyed after a
      successful call, map->fd is closed if pinning fails.
    - bpf_object__populate_internal_map(): created map elements is
      destroyed upon close(map->fd).
    - init_map_slots(): slots are freed after their initialization.

Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210726152001.34845-1-m@lambda.lt
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 0dad862b3b9d..b337d6f29098 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -4284,10 +4284,13 @@ bpf_object__create_maps(struct bpf_object *obj)
 	char *cp, errmsg[STRERR_BUFSIZE];
 	unsigned int i, j;
 	int err;
+	bool retried;
 
 	for (i = 0; i < obj->nr_maps; i++) {
 		map = &obj->maps[i];
 
+		retried = false;
+retry:
 		if (map->pin_path) {
 			err = bpf_object__reuse_map(map);
 			if (err) {
@@ -4295,6 +4298,12 @@ bpf_object__create_maps(struct bpf_object *obj)
 					map->name);
 				goto err_out;
 			}
+			if (retried && map->fd < 0) {
+				pr_warn("map '%s': cannot find pinned map\n",
+					map->name);
+				err = -ENOENT;
+				goto err_out;
+			}
 		}
 
 		if (map->fd >= 0) {
@@ -4328,9 +4337,13 @@ bpf_object__create_maps(struct bpf_object *obj)
 		if (map->pin_path && !map->pinned) {
 			err = bpf_map__pin(map, NULL);
 			if (err) {
+				zclose(map->fd);
+				if (!retried && err == -EEXIST) {
+					retried = true;
+					goto retry;
+				}
 				pr_warn("map '%s': failed to auto-pin at '%s': %d\n",
 					map->name, map->pin_path, err);
-				zclose(map->fd);
 				goto err_out;
 			}
 		}

From 3b82e4799f539103579e01c46e082fcfe6400567 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Tue, 27 Jul 2021 15:51:30 +0300
Subject: [PATCH 0167/1750] ata: sata_dwc_460ex: No need to call phy_exit()
 befre phy_init()

[ Upstream commit 3ad4a31620355358316fa08fcfab37b9d6c33347 ]

Last change to device managed APIs cleaned up error path to simple phy_exit()
call, which in some cases has been executed with NULL parameter. This per se
is not a problem, but rather logical misconception: no need to free resource
when it's for sure has not been allocated yet. Fix the driver accordingly.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210727125130.19977-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/sata_dwc_460ex.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
index 9dcef6ac643b..982fe9112532 100644
--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
@@ -1249,24 +1249,20 @@ static int sata_dwc_probe(struct platform_device *ofdev)
 	irq = irq_of_parse_and_map(np, 0);
 	if (irq == NO_IRQ) {
 		dev_err(&ofdev->dev, "no SATA DMA irq\n");
-		err = -ENODEV;
-		goto error_out;
+		return -ENODEV;
 	}
 
 #ifdef CONFIG_SATA_DWC_OLD_DMA
 	if (!of_find_property(np, "dmas", NULL)) {
 		err = sata_dwc_dma_init_old(ofdev, hsdev);
 		if (err)
-			goto error_out;
+			return err;
 	}
 #endif
 
 	hsdev->phy = devm_phy_optional_get(hsdev->dev, "sata-phy");
-	if (IS_ERR(hsdev->phy)) {
-		err = PTR_ERR(hsdev->phy);
-		hsdev->phy = NULL;
-		goto error_out;
-	}
+	if (IS_ERR(hsdev->phy))
+		return PTR_ERR(hsdev->phy);
 
 	err = phy_init(hsdev->phy);
 	if (err)

From 6528cc687c888d312bc5599bc9cdb603b3e7eb5a Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Wed, 28 Jul 2021 15:51:04 +0800
Subject: [PATCH 0168/1750] Bluetooth: skip invalid hci_sync_conn_complete_evt

[ Upstream commit 92fe24a7db751b80925214ede43f8d2be792ea7b ]

Syzbot reported a corrupted list in kobject_add_internal [1]. This
happens when multiple HCI_EV_SYNC_CONN_COMPLETE event packets with
status 0 are sent for the same HCI connection. This causes us to
register the device more than once which corrupts the kset list.

As this is forbidden behavior, we add a check for whether we're
trying to process the same HCI_EV_SYNC_CONN_COMPLETE event multiple
times for one connection. If that's the case, the event is invalid, so
we report an error that the device is misbehaving, and ignore the
packet.

Link: https://syzkaller.appspot.com/bug?extid=66264bf2fd0476be7e6c [1]
Reported-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
Tested-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index e59ae24a8f17..45de2d8b9a9d 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4329,6 +4329,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
 
 	switch (ev->status) {
 	case 0x00:
+		/* The synchronous connection complete event should only be
+		 * sent once per new connection. Receiving a successful
+		 * complete event when the connection status is already
+		 * BT_CONNECTED means that the device is misbehaving and sent
+		 * multiple complete event packets for the same new connection.
+		 *
+		 * Registering the device more than once can corrupt kernel
+		 * memory, hence upon detecting this invalid event, we report
+		 * an error and ignore the packet.
+		 */
+		if (conn->state == BT_CONNECTED) {
+			bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
+			goto unlock;
+		}
+
 		conn->handle = __le16_to_cpu(ev->handle);
 		conn->state  = BT_CONNECTED;
 		conn->type   = ev->link_type;

From f4c7c95e3ee5741439cd11bf67b84a7d07e7c1c1 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Thu, 22 Jul 2021 11:03:52 +0800
Subject: [PATCH 0169/1750] workqueue: Fix possible memory leaks in
 wq_numa_init()

[ Upstream commit f728c4a9e8405caae69d4bc1232c54ff57b5d20f ]

In error handling branch "if (WARN_ON(node == NUMA_NO_NODE))", the
previously allocated memories are not released. Doing this before
allocating memory eliminates memory leaks.

tj: Note that the condition only occurs when the arch code is pretty broken
and the WARN_ON might as well be BUG_ON().

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/workqueue.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 51d19fc71e61..4cb622b2661b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5893,6 +5893,13 @@ static void __init wq_numa_init(void)
 		return;
 	}
 
+	for_each_possible_cpu(cpu) {
+		if (WARN_ON(cpu_to_node(cpu) == NUMA_NO_NODE)) {
+			pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);
+			return;
+		}
+	}
+
 	wq_update_unbound_numa_attrs_buf = alloc_workqueue_attrs();
 	BUG_ON(!wq_update_unbound_numa_attrs_buf);
 
@@ -5910,11 +5917,6 @@ static void __init wq_numa_init(void)
 
 	for_each_possible_cpu(cpu) {
 		node = cpu_to_node(cpu);
-		if (WARN_ON(node == NUMA_NO_NODE)) {
-			pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);
-			/* happens iff arch is bonkers, let's just proceed */
-			return;
-		}
 		cpumask_set_cpu(cpu, tbl[node]);
 	}
 

From 37437a60a93b8b5f2ce760d97d57704ded3bc047 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Thu, 10 Jun 2021 17:02:41 +0200
Subject: [PATCH 0170/1750] ARM: dts: stm32: Set {bitclock,frame}-master
 phandles on DHCOM SoM

[ Upstream commit a79e78c391dc074742c855dc0108a88f781d56a3 ]

Fix the following dtbs_check warning:
arch/arm/boot/dts/stm32mp157c-dhcom-pdk2.dt.yaml: codec@a: port:endpoint@0:frame-master: True is not of type 'array'
arch/arm/boot/dts/stm32mp157c-dhcom-pdk2.dt.yaml: codec@a: port:endpoint@0:bitclock-master: True is not of type 'array'

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: Patrice Chotard <patrice.chotard@foss.st.com>
Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
Cc: kernel@dh-electronics.com
Cc: linux-stm32@st-md-mailman.stormreply.com
To: linux-arm-kernel@lists.infradead.org
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
index 633079245601..fd0cd10cb093 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi
@@ -172,15 +172,15 @@ sgtl5000_port: port {
 			sgtl5000_tx_endpoint: endpoint@0 {
 				reg = <0>;
 				remote-endpoint = <&sai2a_endpoint>;
-				frame-master;
-				bitclock-master;
+				frame-master = <&sgtl5000_tx_endpoint>;
+				bitclock-master = <&sgtl5000_tx_endpoint>;
 			};
 
 			sgtl5000_rx_endpoint: endpoint@1 {
 				reg = <1>;
 				remote-endpoint = <&sai2b_endpoint>;
-				frame-master;
-				bitclock-master;
+				frame-master = <&sgtl5000_rx_endpoint>;
+				bitclock-master = <&sgtl5000_rx_endpoint>;
 			};
 		};
 

From 3142476fa002e366c8a9dbd124618ab263fb7a89 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Thu, 10 Jun 2021 17:03:06 +0200
Subject: [PATCH 0171/1750] ARM: dts: stm32: Set {bitclock,frame}-master
 phandles on ST DKx

[ Upstream commit 8aec45d7884f16cc21d668693c5b88bff8df0f02 ]

Fix the following dtbs_check warning:
cs42l51@4a: port:endpoint@0:frame-master: True is not of type 'array'
cs42l51@4a: port:endpoint@0:bitclock-master: True is not of type 'array'

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: Patrice Chotard <patrice.chotard@foss.st.com>
Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
Cc: linux-stm32@st-md-mailman.stormreply.com
To: linux-arm-kernel@lists.infradead.org
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp15xx-dkx.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
index 93398cfae97e..47df8ac67cf1 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dkx.dtsi
@@ -212,15 +212,15 @@ cs42l51_port: port {
 			cs42l51_tx_endpoint: endpoint@0 {
 				reg = <0>;
 				remote-endpoint = <&sai2a_endpoint>;
-				frame-master;
-				bitclock-master;
+				frame-master = <&cs42l51_tx_endpoint>;
+				bitclock-master = <&cs42l51_tx_endpoint>;
 			};
 
 			cs42l51_rx_endpoint: endpoint@1 {
 				reg = <1>;
 				remote-endpoint = <&sai2b_endpoint>;
-				frame-master;
-				bitclock-master;
+				frame-master = <&cs42l51_rx_endpoint>;
+				bitclock-master = <&cs42l51_rx_endpoint>;
 			};
 		};
 	};

From 5d008cb7636de3a5962856e6a7eb39d1f7cb9619 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Sun, 20 Jun 2021 23:24:31 +0200
Subject: [PATCH 0172/1750] ARM: dts: stm32: Update AV96 adv7513 node per
 dtbs_check

[ Upstream commit 1e6bc5987a5252948e3411e5a2dbb434fd1ea107 ]

Swap reg and reg-names order and drop adi,input-justification
and adi,input-style to fix the following dtbs_check warnings:
arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: adi,input-justification: False schema does not allow ['evenly']
arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: adi,input-style: False schema does not allow [[1]]
arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: reg-names:1: 'edid' was expected
arch/arm/boot/dts/stm32mp157a-dhcor-avenger96.dt.yaml: hdmi-transmitter@3d: reg-names:2: 'cec' was expected

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: Patrice Chotard <patrice.chotard@foss.st.com>
Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
Cc: linux-stm32@st-md-mailman.stormreply.com
To: linux-arm-kernel@lists.infradead.org
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
index ec02cee1dd9b..944d38b85eef 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi
@@ -185,8 +185,8 @@ &i2c2 {	/* X6 I2C2 */
 &i2c4 {
 	hdmi-transmitter@3d {
 		compatible = "adi,adv7513";
-		reg = <0x3d>, <0x2d>, <0x4d>, <0x5d>;
-		reg-names = "main", "cec", "edid", "packet";
+		reg = <0x3d>, <0x4d>, <0x2d>, <0x5d>;
+		reg-names = "main", "edid", "cec", "packet";
 		clocks = <&cec_clock>;
 		clock-names = "cec";
 
@@ -204,8 +204,6 @@ hdmi-transmitter@3d {
 		adi,input-depth = <8>;
 		adi,input-colorspace = "rgb";
 		adi,input-clock = "1x";
-		adi,input-style = <1>;
-		adi,input-justification = "evenly";
 
 		ports {
 			#address-cells = <1>;

From f710323dcd24ce6209ee767e910ac4a21ffc618c Mon Sep 17 00:00:00 2001
From: Yufeng Mo <moyufeng@huawei.com>
Date: Fri, 30 Jul 2021 10:19:11 +0800
Subject: [PATCH 0173/1750] bonding: 3ad: fix the concurrency between
 __bond_release_one() and bond_3ad_state_machine_handler()

[ Upstream commit 220ade77452c15ecb1ab94c3f8aaeb6d033c3582 ]

Some time ago, I reported a calltrace issue
"did not find a suitable aggregator", please see[1].
After a period of analysis and reproduction, I find
that this problem is caused by concurrency.

Before the problem occurs, the bond structure is like follows:

bond0 - slaver0(eth0) - agg0.lag_ports -> port0 - port1
                      \
                        port0
      \
        slaver1(eth1) - agg1.lag_ports -> NULL
                      \
                        port1

If we run 'ifenslave bond0 -d eth1', the process is like below:

excuting __bond_release_one()
|
bond_upper_dev_unlink()[step1]
|                       |                       |
|                       |                       bond_3ad_lacpdu_recv()
|                       |                       ->bond_3ad_rx_indication()
|                       |                       spin_lock_bh()
|                       |                       ->ad_rx_machine()
|                       |                       ->__record_pdu()[step2]
|                       |                       spin_unlock_bh()
|                       |                       |
|                       bond_3ad_state_machine_handler()
|                       spin_lock_bh()
|                       ->ad_port_selection_logic()
|                       ->try to find free aggregator[step3]
|                       ->try to find suitable aggregator[step4]
|                       ->did not find a suitable aggregator[step5]
|                       spin_unlock_bh()
|                       |
|                       |
bond_3ad_unbind_slave() |
spin_lock_bh()
spin_unlock_bh()

step1: already removed slaver1(eth1) from list, but port1 remains
step2: receive a lacpdu and update port0
step3: port0 will be removed from agg0.lag_ports. The struct is
       "agg0.lag_ports -> port1" now, and agg0 is not free. At the
	   same time, slaver1/agg1 has been removed from the list by step1.
	   So we can't find a free aggregator now.
step4: can't find suitable aggregator because of step2
step5: cause a calltrace since port->aggregator is NULL

To solve this concurrency problem, put bond_upper_dev_unlink()
after bond_3ad_unbind_slave(). In this way, we can invalid the port
first and skip this port in bond_3ad_state_machine_handler(). This
eliminates the situation that the slaver has been removed from the
list but the port is still valid.

[1]https://lore.kernel.org/netdev/10374.1611947473@famine/

Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 018af1e38eb9..645c7cabcbe4 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2219,7 +2219,6 @@ static int __bond_release_one(struct net_device *bond_dev,
 	/* recompute stats just before removing the slave */
 	bond_get_stats(bond->dev, &bond->bond_stats);
 
-	bond_upper_dev_unlink(bond, slave);
 	/* unregister rx_handler early so bond_handle_frame wouldn't be called
 	 * for this slave anymore.
 	 */
@@ -2228,6 +2227,8 @@ static int __bond_release_one(struct net_device *bond_dev,
 	if (BOND_MODE(bond) == BOND_MODE_8023AD)
 		bond_3ad_unbind_slave(slave);
 
+	bond_upper_dev_unlink(bond, slave);
+
 	if (bond_mode_can_use_xmit_hash(bond))
 		bond_update_slave_arr(bond, slave);
 

From 8fb3d8c151a78c47aff1ab994c57ba785fe6a4f0 Mon Sep 17 00:00:00 2001
From: Nicolas Ferre <nicolas.ferre@microchip.com>
Date: Thu, 29 Jul 2021 16:28:27 +0200
Subject: [PATCH 0174/1750] ARM: dts: at91: use the right property for shutdown
 controller
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 818c4593434e81c9971b8fc278215121622c755e ]

The wrong property "atmel,shdwc-debouncer" was used to specify the
debounce delay for the shutdown controler. Replace it with the
documented and implemented property "debounce-delay-us", as mentioned
in v4 driver submission. See:
https://lore.kernel.org/r/1458134390-23847-3-git-send-email-nicolas.ferre@atmel.com/

Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Reported-by: Clément Léger <clement.leger@bootlin.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20210730172729.28093-1-nicolas.ferre@microchip.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-kizbox3_common.dtsi    | 2 +-
 arch/arm/boot/dts/at91-sam9x60ek.dts          | 2 +-
 arch/arm/boot/dts/at91-sama5d27_som1_ek.dts   | 2 +-
 arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts | 2 +-
 arch/arm/boot/dts/at91-sama5d2_icp.dts        | 2 +-
 arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts     | 2 +-
 arch/arm/boot/dts/at91-sama5d2_xplained.dts   | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/arch/arm/boot/dts/at91-kizbox3_common.dtsi b/arch/arm/boot/dts/at91-kizbox3_common.dtsi
index 7c3076e245ef..dc77d8e80e56 100644
--- a/arch/arm/boot/dts/at91-kizbox3_common.dtsi
+++ b/arch/arm/boot/dts/at91-kizbox3_common.dtsi
@@ -336,7 +336,7 @@ &pwm0 {
 };
 
 &shutdown_controller {
-	atmel,shdwc-debouncer = <976>;
+	debounce-delay-us = <976>;
 	atmel,wakeup-rtc-timer;
 
 	input@0 {
diff --git a/arch/arm/boot/dts/at91-sam9x60ek.dts b/arch/arm/boot/dts/at91-sam9x60ek.dts
index ebbc9b23aef1..b1068cca4228 100644
--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
+++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
@@ -662,7 +662,7 @@ &rtt {
 };
 
 &shutdown_controller {
-	atmel,shdwc-debouncer = <976>;
+	debounce-delay-us = <976>;
 	status = "okay";
 
 	input@0 {
diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
index d3cd2443ba25..9a18453d7842 100644
--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
@@ -138,7 +138,7 @@ i2c3: i2c@600 {
 			};
 
 			shdwc@f8048010 {
-				atmel,shdwc-debouncer = <976>;
+				debounce-delay-us = <976>;
 				atmel,wakeup-rtc-timer;
 
 				input@0 {
diff --git a/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts
index 4883b84b4ede..20bcb7480d2e 100644
--- a/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d27_wlsom1_ek.dts
@@ -205,7 +205,7 @@ &sdmmc0 {
 };
 
 &shutdown_controller {
-	atmel,shdwc-debouncer = <976>;
+	debounce-delay-us = <976>;
 	atmel,wakeup-rtc-timer;
 
 	input@0 {
diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at91-sama5d2_icp.dts
index 19bb50f50c1f..308d472bd104 100644
--- a/arch/arm/boot/dts/at91-sama5d2_icp.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts
@@ -693,7 +693,7 @@ &sdmmc0 {
 };
 
 &shutdown_controller {
-	atmel,shdwc-debouncer = <976>;
+	debounce-delay-us = <976>;
 	atmel,wakeup-rtc-timer;
 
 	input@0 {
diff --git a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
index 1c6361ba1aca..317c6ddb5677 100644
--- a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
@@ -203,7 +203,7 @@ i2c2: i2c@600 {
 			};
 
 			shdwc@f8048010 {
-				atmel,shdwc-debouncer = <976>;
+				debounce-delay-us = <976>;
 
 				input@0 {
 					reg = <0>;
diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
index d767968ae217..08c5182ba86b 100644
--- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts
@@ -347,7 +347,7 @@ i2c2: i2c@600 {
 			};
 
 			shdwc@f8048010 {
-				atmel,shdwc-debouncer = <976>;
+				debounce-delay-us = <976>;
 				atmel,wakeup-rtc-timer;
 
 				input@0 {

From f1fb1f6fa17253bf898ae73c39a36ff781f1a6ad Mon Sep 17 00:00:00 2001
From: Vidya Sagar <vidyas@nvidia.com>
Date: Wed, 28 Jul 2021 00:20:55 +0530
Subject: [PATCH 0175/1750] arm64: tegra: Fix Tegra194 PCIe EP compatible
 string

[ Upstream commit bf2942a8b7c38e8cc2d5157b4f0323d7f4e5ec71 ]

The initialization sequence performed by the generic platform driver
pcie-designware-plat.c for a DWC based implementation doesn't work for
Tegra194. Tegra194 has a different initialization sequence requirement
which can only be satisfied by the Tegra194 specific platform driver
pcie-tegra194.c. So, remove the generic compatible string "snps,dw-pcie-ep"
from Tegra194's endpoint controller nodes.

Signed-off-by: Vidya Sagar <vidyas@nvidia.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/nvidia/tegra194.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
index 6946fb210e48..9b5007e5f790 100644
--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi
@@ -1976,7 +1976,7 @@ pcie@141a0000 {
 	};
 
 	pcie_ep@14160000 {
-		compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
+		compatible = "nvidia,tegra194-pcie-ep";
 		power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>;
 		reg = <0x00 0x14160000 0x0 0x00020000>, /* appl registers (128K)      */
 		      <0x00 0x36040000 0x0 0x00040000>, /* iATU_DMA reg space (256K)  */
@@ -2008,7 +2008,7 @@ pcie_ep@14160000 {
 	};
 
 	pcie_ep@14180000 {
-		compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
+		compatible = "nvidia,tegra194-pcie-ep";
 		power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>;
 		reg = <0x00 0x14180000 0x0 0x00020000>, /* appl registers (128K)      */
 		      <0x00 0x38040000 0x0 0x00040000>, /* iATU_DMA reg space (256K)  */
@@ -2040,7 +2040,7 @@ pcie_ep@14180000 {
 	};
 
 	pcie_ep@141a0000 {
-		compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep";
+		compatible = "nvidia,tegra194-pcie-ep";
 		power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>;
 		reg = <0x00 0x141a0000 0x0 0x00020000>, /* appl registers (128K)      */
 		      <0x00 0x3a040000 0x0 0x00040000>, /* iATU_DMA reg space (256K)  */

From 9cf827242033f664d3b6536d8e264a6378ab3a8e Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Mon, 2 Aug 2021 16:24:56 +0200
Subject: [PATCH 0176/1750] ASoC: Intel: bytcr_rt5640: Move "Platform Clock"
 routes to the maps for the matching in-/output

[ Upstream commit dccd1dfd0770bfd494b68d1135b4547b2c602c42 ]

Move the "Platform Clock" routes for the "Internal Mic" and "Speaker"
routes to the intmic_*_map[] / *_spk_map[] arrays.

This ensures that these "Platform Clock" routes do not get added when the
BYT_RT5640_NO_INTERNAL_MIC_MAP / BYT_RT5640_NO_SPEAKERS quirks are used.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210802142501.991985-2-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/boards/bytcr_rt5640.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index ca14730232ba..43ee3d095a1b 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -286,9 +286,6 @@ static const struct snd_soc_dapm_widget byt_rt5640_widgets[] = {
 static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = {
 	{"Headphone", NULL, "Platform Clock"},
 	{"Headset Mic", NULL, "Platform Clock"},
-	{"Internal Mic", NULL, "Platform Clock"},
-	{"Speaker", NULL, "Platform Clock"},
-
 	{"Headset Mic", NULL, "MICBIAS1"},
 	{"IN2P", NULL, "Headset Mic"},
 	{"Headphone", NULL, "HPOL"},
@@ -296,19 +293,23 @@ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = {
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic1_map[] = {
+	{"Internal Mic", NULL, "Platform Clock"},
 	{"DMIC1", NULL, "Internal Mic"},
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic2_map[] = {
+	{"Internal Mic", NULL, "Platform Clock"},
 	{"DMIC2", NULL, "Internal Mic"},
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_intmic_in1_map[] = {
+	{"Internal Mic", NULL, "Platform Clock"},
 	{"Internal Mic", NULL, "MICBIAS1"},
 	{"IN1P", NULL, "Internal Mic"},
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_intmic_in3_map[] = {
+	{"Internal Mic", NULL, "Platform Clock"},
 	{"Internal Mic", NULL, "MICBIAS1"},
 	{"IN3P", NULL, "Internal Mic"},
 };
@@ -350,6 +351,7 @@ static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif2_map[] = {
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = {
+	{"Speaker", NULL, "Platform Clock"},
 	{"Speaker", NULL, "SPOLP"},
 	{"Speaker", NULL, "SPOLN"},
 	{"Speaker", NULL, "SPORP"},
@@ -357,6 +359,7 @@ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = {
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_mono_spk_map[] = {
+	{"Speaker", NULL, "Platform Clock"},
 	{"Speaker", NULL, "SPOLP"},
 	{"Speaker", NULL, "SPOLN"},
 };

From a64e3f1d8a27f6868e01f99f7f21519e46da61fb Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Mon, 2 Aug 2021 10:21:50 -0500
Subject: [PATCH 0177/1750] ASoC: Intel: update sof_pcm512x quirks

[ Upstream commit 22414cade8dfec25ab94df52b3a4f7aa8edb6120 ]

The default SOF topology enables SSP capture and DMICs, even though
both of these hardware capabilities are not always available in
hardware (specific versions of HiFiberry and DMIC kit needed).

For the SSP capture, this leads to annoying "SP5-Codec: ASoC: no
backend capture" and "streamSSP5-Codec: ASoC: no users capture at
close - state 0" errors.

Update the quirks to match what the topology needs, which also allows
for the ability to remove SSP capture and DMIC support.

BugLink: https://github.com/thesofproject/linux/issues/3061
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Link: https://lore.kernel.org/r/20210802152151.15832-4-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/boards/sof_pcm512x.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/boards/sof_pcm512x.c b/sound/soc/intel/boards/sof_pcm512x.c
index d2b0456236c7..bdd671f07659 100644
--- a/sound/soc/intel/boards/sof_pcm512x.c
+++ b/sound/soc/intel/boards/sof_pcm512x.c
@@ -26,11 +26,16 @@
 
 #define SOF_PCM512X_SSP_CODEC(quirk)		((quirk) & GENMASK(3, 0))
 #define SOF_PCM512X_SSP_CODEC_MASK			(GENMASK(3, 0))
+#define SOF_PCM512X_ENABLE_SSP_CAPTURE		BIT(4)
+#define SOF_PCM512X_ENABLE_DMIC			BIT(5)
 
 #define IDISP_CODEC_MASK	0x4
 
 /* Default: SSP5 */
-static unsigned long sof_pcm512x_quirk = SOF_PCM512X_SSP_CODEC(5);
+static unsigned long sof_pcm512x_quirk =
+	SOF_PCM512X_SSP_CODEC(5) |
+	SOF_PCM512X_ENABLE_SSP_CAPTURE |
+	SOF_PCM512X_ENABLE_DMIC;
 
 static bool is_legacy_cpu;
 
@@ -245,8 +250,9 @@ static struct snd_soc_dai_link *sof_card_dai_links_create(struct device *dev,
 	links[id].dpcm_playback = 1;
 	/*
 	 * capture only supported with specific versions of the Hifiberry DAC+
-	 * links[id].dpcm_capture = 1;
 	 */
+	if (sof_pcm512x_quirk & SOF_PCM512X_ENABLE_SSP_CAPTURE)
+		links[id].dpcm_capture = 1;
 	links[id].no_pcm = 1;
 	links[id].cpus = &cpus[id];
 	links[id].num_cpus = 1;
@@ -381,6 +387,9 @@ static int sof_audio_probe(struct platform_device *pdev)
 
 	ssp_codec = sof_pcm512x_quirk & SOF_PCM512X_SSP_CODEC_MASK;
 
+	if (!(sof_pcm512x_quirk & SOF_PCM512X_ENABLE_DMIC))
+		dmic_be_num = 0;
+
 	/* compute number of dai links */
 	sof_audio_card_pcm512x.num_links = 1 + dmic_be_num + hdmi_num;
 

From 4cb4967472c878a57a1de6e1f3d582bb9d00acd5 Mon Sep 17 00:00:00 2001
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Date: Fri, 23 Jul 2021 13:22:32 +0200
Subject: [PATCH 0178/1750] media: imx258: Rectify mismatch of VTS value

[ Upstream commit 51f93add3669f1b1f540de1cf397815afbd4c756 ]

The frame_length_lines (0x0340) registers are hard-coded as follows:

- 4208x3118
  frame_length_lines = 0x0c50

- 2104x1560
  frame_length_lines = 0x0638

- 1048x780
  frame_length_lines = 0x034c

The driver exposes the V4L2_CID_VBLANK control in read-only mode and
sets its value to vts_def - height, where vts_def is a mode-dependent
value coming from the supported_modes array. It is set using one of
the following macros defined in the driver:

  #define IMX258_VTS_30FPS                0x0c98
  #define IMX258_VTS_30FPS_2K             0x0638
  #define IMX258_VTS_30FPS_VGA            0x034c

There's a clear mismatch in the value for the full resolution mode i.e.
IMX258_VTS_30FPS. Fix it by rectifying the macro with the value set for
the frame_length_lines register as stated above.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/imx258.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c
index ccb55fd1d506..c0a691a73ec9 100644
--- a/drivers/media/i2c/imx258.c
+++ b/drivers/media/i2c/imx258.c
@@ -22,7 +22,7 @@
 #define IMX258_CHIP_ID			0x0258
 
 /* V_TIMING internal */
-#define IMX258_VTS_30FPS		0x0c98
+#define IMX258_VTS_30FPS		0x0c50
 #define IMX258_VTS_30FPS_2K		0x0638
 #define IMX258_VTS_30FPS_VGA		0x034c
 #define IMX258_VTS_MAX			0xffff

From ac1bcf53e32fe503e0d311af4ae14789c6566210 Mon Sep 17 00:00:00 2001
From: Umang Jain <umang.jain@ideasonboard.com>
Date: Fri, 23 Jul 2021 13:22:33 +0200
Subject: [PATCH 0179/1750] media: imx258: Limit the max analogue gain to 480
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f809665ee75fff3f4ea8907f406a66d380aeb184 ]

The range for analog gain mentioned in the datasheet is [0, 480].
The real gain formula mentioned in the datasheet is:

	Gain = 512 / (512 – X)

Hence, values larger than 511 clearly makes no sense. The gain
register field is also documented to be of 9-bits in the datasheet.

Certainly, it is enough to infer that, the kernel driver currently
advertises an arbitrary analog gain max. Fix it by rectifying the
value as per the data sheet i.e. 480.

Signed-off-by: Umang Jain <umang.jain@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/imx258.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c
index c0a691a73ec9..e6104ee97ed2 100644
--- a/drivers/media/i2c/imx258.c
+++ b/drivers/media/i2c/imx258.c
@@ -46,7 +46,7 @@
 /* Analog gain control */
 #define IMX258_REG_ANALOG_GAIN		0x0204
 #define IMX258_ANA_GAIN_MIN		0
-#define IMX258_ANA_GAIN_MAX		0x1fff
+#define IMX258_ANA_GAIN_MAX		480
 #define IMX258_ANA_GAIN_STEP		1
 #define IMX258_ANA_GAIN_DEFAULT		0x0
 

From e3a2e20ed5037e668df4522575fd09a2b87263c3 Mon Sep 17 00:00:00 2001
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Date: Fri, 23 Jul 2021 10:22:59 +0200
Subject: [PATCH 0180/1750] media: v4l2-dv-timings.c: fix wrong condition in
 two for-loops
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4108b3e6db31acc4c68133290bbcc87d4db905c9 ]

These for-loops should test against v4l2_dv_timings_presets[i].bt.width,
not if i < v4l2_dv_timings_presets[i].bt.width. Luckily nothing ever broke,
since the smallest width is still a lot higher than the total number of
presets, but it is wrong.

The last item in the presets array is all 0, so the for-loop must stop
when it reaches that sentinel.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: Krzysztof Hałasa <khalasa@piap.pl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-dv-timings.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
index 230d65a64217..af48705c704f 100644
--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
@@ -196,7 +196,7 @@ bool v4l2_find_dv_timings_cap(struct v4l2_dv_timings *t,
 	if (!v4l2_valid_dv_timings(t, cap, fnc, fnc_handle))
 		return false;
 
-	for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) {
+	for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) {
 		if (v4l2_valid_dv_timings(v4l2_dv_timings_presets + i, cap,
 					  fnc, fnc_handle) &&
 		    v4l2_match_dv_timings(t, v4l2_dv_timings_presets + i,
@@ -218,7 +218,7 @@ bool v4l2_find_dv_timings_cea861_vic(struct v4l2_dv_timings *t, u8 vic)
 {
 	unsigned int i;
 
-	for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) {
+	for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) {
 		const struct v4l2_bt_timings *bt =
 			&v4l2_dv_timings_presets[i].bt;
 

From c159db240cf27af29f4e4e747c8bd60faa5e34fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Krzysztof=20Ha=C5=82asa?= <khalasa@piap.pl>
Date: Mon, 26 Jul 2021 12:46:28 +0200
Subject: [PATCH 0181/1750] media: TDA1997x: fix tda1997x_query_dv_timings()
 return value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7dee1030871a48d4f3c5a74227a4b4188463479a ]

Correctly propagate the tda1997x_detect_std error value.

Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tda1997x.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 9554c8348c02..17cc69c3227f 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -1695,14 +1695,15 @@ static int tda1997x_query_dv_timings(struct v4l2_subdev *sd,
 				     struct v4l2_dv_timings *timings)
 {
 	struct tda1997x_state *state = to_state(sd);
+	int ret;
 
 	v4l_dbg(1, debug, state->client, "%s\n", __func__);
 	memset(timings, 0, sizeof(struct v4l2_dv_timings));
 	mutex_lock(&state->lock);
-	tda1997x_detect_std(state, timings);
+	ret = tda1997x_detect_std(state, timings);
 	mutex_unlock(&state->lock);
 
-	return 0;
+	return ret;
 }
 
 static const struct v4l2_subdev_video_ops tda1997x_video_ops = {

From 4e014ff22e4bca97193bc36fd67c2233422690b6 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Wed, 28 Jul 2021 16:44:32 +0200
Subject: [PATCH 0182/1750] media: tegra-cec: Handle errors of
 clk_prepare_enable()

[ Upstream commit 38367073c796a37a61549b1f66a71b3adb03802d ]

tegra_cec_probe() and tegra_cec_resume() ignored possible errors of
clk_prepare_enable(). The patch fixes this.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/cec/platform/tegra/tegra_cec.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/media/cec/platform/tegra/tegra_cec.c b/drivers/media/cec/platform/tegra/tegra_cec.c
index 1ac0c70a5981..5e907395ca2e 100644
--- a/drivers/media/cec/platform/tegra/tegra_cec.c
+++ b/drivers/media/cec/platform/tegra/tegra_cec.c
@@ -366,7 +366,11 @@ static int tegra_cec_probe(struct platform_device *pdev)
 		return -ENOENT;
 	}
 
-	clk_prepare_enable(cec->clk);
+	ret = clk_prepare_enable(cec->clk);
+	if (ret) {
+		dev_err(&pdev->dev, "Unable to prepare clock for CEC\n");
+		return ret;
+	}
 
 	/* set context info. */
 	cec->dev = &pdev->dev;
@@ -446,9 +450,7 @@ static int tegra_cec_resume(struct platform_device *pdev)
 
 	dev_notice(&pdev->dev, "Resuming\n");
 
-	clk_prepare_enable(cec->clk);
-
-	return 0;
+	return clk_prepare_enable(cec->clk);
 }
 #endif
 

From 783be2a942999d3521c505b58157a87063de2c03 Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Tue, 1 Jun 2021 09:41:40 -0500
Subject: [PATCH 0183/1750] gfs2: Fix glock recursion in freeze_go_xmote_bh

[ Upstream commit 9d9b16054b7d357afde69a027514c695092b0d22 ]

We must not call gfs2_consist (which does a file system withdraw) from
the freeze glock's freeze_go_xmote_bh function because the withdraw
will try to use the freeze glock, thus causing a glock recursion error.

This patch changes freeze_go_xmote_bh to call function
gfs2_assert_withdraw_delayed instead of gfs2_consist to avoid recursion.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/glops.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 3faa421568b0..bf539eab92c6 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -623,16 +623,13 @@ static int freeze_go_xmote_bh(struct gfs2_glock *gl, struct gfs2_holder *gh)
 		j_gl->gl_ops->go_inval(j_gl, DIO_METADATA);
 
 		error = gfs2_find_jhead(sdp->sd_jdesc, &head, false);
-		if (error)
-			gfs2_consist(sdp);
-		if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT))
-			gfs2_consist(sdp);
-
-		/*  Initialize some head of the log stuff  */
-		if (!gfs2_withdrawn(sdp)) {
-			sdp->sd_log_sequence = head.lh_sequence + 1;
-			gfs2_log_pointers_init(sdp, head.lh_blkno);
-		}
+		if (gfs2_assert_withdraw_delayed(sdp, !error))
+			return error;
+		if (gfs2_assert_withdraw_delayed(sdp, head.lh_flags &
+						 GFS2_LOG_HEAD_UNMOUNT))
+			return -EIO;
+		sdp->sd_log_sequence = head.lh_sequence + 1;
+		gfs2_log_pointers_init(sdp, head.lh_blkno);
 	}
 	return 0;
 }

From 310a127178b09af7a66edce236c85706d861d323 Mon Sep 17 00:00:00 2001
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Date: Thu, 29 Jul 2021 00:25:04 +0200
Subject: [PATCH 0184/1750] arm64: dts: qcom: sdm630: Rewrite memory map

[ Upstream commit 26e02c98a9ad63eb21b9be4ac92002f555130d3b ]

The memory map was wrong. Fix it.

Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
Link: https://lore.kernel.org/r/20210728222542.54269-2-konrad.dybcio@somainline.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm630.dtsi | 41 ++++++++++++----------------
 1 file changed, 18 insertions(+), 23 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
index deb928d303c2..7da420cd21ba 100644
--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -343,10 +343,19 @@ wlan_msa_mem: wlan-msa-mem@85700000 {
 		};
 
 		qhee_code: qhee-code@85800000 {
-			reg = <0x0 0x85800000 0x0 0x3700000>;
+			reg = <0x0 0x85800000 0x0 0x600000>;
 			no-map;
 		};
 
+		rmtfs_mem: memory@85e00000 {
+			compatible = "qcom,rmtfs-mem";
+			reg = <0x0 0x85e00000 0x0 0x200000>;
+			no-map;
+
+			qcom,client-id = <1>;
+			qcom,vmid = <15>;
+		};
+
 		smem_region: smem-mem@86000000 {
 			reg = <0 0x86000000 0 0x200000>;
 			no-map;
@@ -357,58 +366,44 @@ tz_mem: memory@86200000 {
 			no-map;
 		};
 
-		modem_fw_mem: modem-fw-region@8ac00000 {
+		mpss_region: mpss@8ac00000 {
 			reg = <0x0 0x8ac00000 0x0 0x7e00000>;
 			no-map;
 		};
 
-		adsp_fw_mem: adsp-fw-region@92a00000 {
+		adsp_region: adsp@92a00000 {
 			reg = <0x0 0x92a00000 0x0 0x1e00000>;
 			no-map;
 		};
 
-		pil_mba_mem: pil-mba-region@94800000 {
+		mba_region: mba@94800000 {
 			reg = <0x0 0x94800000 0x0 0x200000>;
 			no-map;
 		};
 
-		buffer_mem: buffer-region@94a00000 {
+		buffer_mem: tzbuffer@94a00000 {
 			reg = <0x0 0x94a00000 0x0 0x100000>;
 			no-map;
 		};
 
-		venus_fw_mem: venus-fw-region@9f800000 {
+		venus_region: venus@9f800000 {
 			reg = <0x0 0x9f800000 0x0 0x800000>;
 			no-map;
 		};
 
-		secure_region2: secure-region2@f7c00000 {
-			reg = <0x0 0xf7c00000 0x0 0x5c00000>;
-			no-map;
-		};
-
 		adsp_mem: adsp-region@f6000000 {
 			reg = <0x0 0xf6000000 0x0 0x800000>;
 			no-map;
 		};
 
-		qseecom_ta_mem: qseecom-ta-region@fec00000 {
-			reg = <0x0 0xfec00000 0x0 0x1000000>;
-			no-map;
-		};
-
 		qseecom_mem: qseecom-region@f6800000 {
 			reg = <0x0 0xf6800000 0x0 0x1400000>;
 			no-map;
 		};
 
-		secure_display_memory: secure-region@f5c00000 {
-			reg = <0x0 0xf5c00000 0x0 0x5c00000>;
-			no-map;
-		};
-
-		cont_splash_mem: cont-splash-region@9d400000 {
-			reg = <0x0 0x9d400000 0x0 0x23ff000>;
+		zap_shader_region: gpu@fed00000 {
+			compatible = "shared-dma-pool";
+			reg = <0x0 0xfed00000 0x0 0xa00000>;
 			no-map;
 		};
 	};

From 699c91475847e634ab88d96a199c518d0f38138b Mon Sep 17 00:00:00 2001
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Date: Thu, 29 Jul 2021 00:25:11 +0200
Subject: [PATCH 0185/1750] arm64: dts: qcom: sdm630: Fix TLMM node and pinctrl
 configuration

[ Upstream commit 36a0d47aee6a8cfd3c6cf4274732d8ef994a25b4 ]

Previous pinctrl configuration was wrong. Fix it and clean up how
multi-pin states are described.

Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@somainline.org>
Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
Link: https://lore.kernel.org/r/20210728222542.54269-9-konrad.dybcio@somainline.org
[bjorn: Polished the commit message]
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm630.dtsi | 218 +++++++++++++++++----------
 1 file changed, 142 insertions(+), 76 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
index 7da420cd21ba..ee7fcf4c158f 100644
--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -522,14 +522,18 @@ tcsr_mutex_regs: syscon@1f40000 {
 			reg = <0x01f40000 0x20000>;
 		};
 
-		tlmm: pinctrl@3000000 {
+		tlmm: pinctrl@3100000 {
 			compatible = "qcom,sdm630-pinctrl";
-			reg = <0x03000000 0xc00000>;
+			reg = <0x03100000 0x400000>,
+				  <0x03500000 0x400000>,
+				  <0x03900000 0x400000>;
+			reg-names = "south", "center", "north";
 			interrupts = <GIC_SPI 208 IRQ_TYPE_LEVEL_HIGH>;
 			gpio-controller;
-			#gpio-cells = <0x2>;
+			gpio-ranges = <&tlmm 0 0 114>;
+			#gpio-cells = <2>;
 			interrupt-controller;
-			#interrupt-cells = <0x2>;
+			#interrupt-cells = <2>;
 
 			blsp1_uart1_default: blsp1-uart1-default {
 				pins = "gpio0", "gpio1", "gpio2", "gpio3";
@@ -549,40 +553,48 @@ blsp1_uart2_default: blsp1-uart2-default {
 				bias-disable;
 			};
 
-			blsp2_uart1_tx_active: blsp2-uart1-tx-active {
-				pins = "gpio16";
-				drive-strength = <2>;
-				bias-disable;
+			blsp2_uart1_default: blsp2-uart1-active {
+				tx-rts {
+					pins = "gpio16", "gpio19";
+					function = "blsp_uart5";
+					drive-strength = <2>;
+					bias-disable;
+				};
+
+				rx {
+					/*
+					 * Avoid garbage data while BT module
+					 * is powered off or not driving signal
+					 */
+					pins = "gpio17";
+					function = "blsp_uart5";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
+
+				cts {
+					/* Match the pull of the BT module */
+					pins = "gpio18";
+					function = "blsp_uart5";
+					drive-strength = <2>;
+					bias-pull-down;
+				};
 			};
 
-			blsp2_uart1_tx_sleep: blsp2-uart1-tx-sleep {
-				pins = "gpio16";
-				drive-strength = <2>;
-				bias-pull-up;
-			};
+			blsp2_uart1_sleep: blsp2-uart1-sleep {
+				tx {
+					pins = "gpio16";
+					function = "gpio";
+					drive-strength = <2>;
+					bias-pull-up;
+				};
 
-			blsp2_uart1_rxcts_active: blsp2-uart1-rxcts-active {
-				pins = "gpio17", "gpio18";
-				drive-strength = <2>;
-				bias-disable;
-			};
-
-			blsp2_uart1_rxcts_sleep: blsp2-uart1-rxcts-sleep {
-				pins = "gpio17", "gpio18";
-				drive-strength = <2>;
-				bias-no-pull;
-			};
-
-			blsp2_uart1_rfr_active: blsp2-uart1-rfr-active {
-				pins = "gpio19";
-				drive-strength = <2>;
-				bias-disable;
-			};
-
-			blsp2_uart1_rfr_sleep: blsp2-uart1-rfr-sleep {
-				pins = "gpio19";
-				drive-strength = <2>;
-				bias-no-pull;
+				rx-cts-rts {
+					pins = "gpio17", "gpio18", "gpio19";
+					function = "gpio";
+					drive-strength = <2>;
+					bias-no-pull;
+				};
 			};
 
 			i2c1_default: i2c1-default {
@@ -681,50 +693,106 @@ i2c8_sleep: i2c8-sleep {
 				bias-pull-up;
 			};
 
-			sdc1_clk_on: sdc1-clk-on {
-				pins = "sdc1_clk";
-				bias-disable;
-				drive-strength = <16>;
+			sdc1_state_on: sdc1-on {
+				clk {
+					pins = "sdc1_clk";
+					bias-disable;
+					drive-strength = <16>;
+				};
+
+				cmd {
+					pins = "sdc1_cmd";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+
+				data {
+					pins = "sdc1_data";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+
+				rclk {
+					pins = "sdc1_rclk";
+					bias-pull-down;
+				};
 			};
 
-			sdc1_clk_off: sdc1-clk-off {
-				pins = "sdc1_clk";
-				bias-disable;
-				drive-strength = <2>;
+			sdc1_state_off: sdc1-off {
+				clk {
+					pins = "sdc1_clk";
+					bias-disable;
+					drive-strength = <2>;
+				};
+
+				cmd {
+					pins = "sdc1_cmd";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
+
+				data {
+					pins = "sdc1_data";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
+
+				rclk {
+					pins = "sdc1_rclk";
+					bias-pull-down;
+				};
 			};
 
-			sdc1_cmd_on: sdc1-cmd-on {
-				pins = "sdc1_cmd";
-				bias-pull-up;
-				drive-strength = <10>;
+			sdc2_state_on: sdc2-on {
+				clk {
+					pins = "sdc2_clk";
+					bias-disable;
+					drive-strength = <16>;
+				};
+
+				cmd {
+					pins = "sdc2_cmd";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+
+				data {
+					pins = "sdc2_data";
+					bias-pull-up;
+					drive-strength = <10>;
+				};
+
+				sd-cd {
+					pins = "gpio54";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
 			};
 
-			sdc1_cmd_off: sdc1-cmd-off {
-				pins = "sdc1_cmd";
-				bias-pull-up;
-				drive-strength = <2>;
-			};
+			sdc2_state_off: sdc2-off {
+				clk {
+					pins = "sdc2_clk";
+					bias-disable;
+					drive-strength = <2>;
+				};
 
-			sdc1_data_on: sdc1-data-on {
-				pins = "sdc1_data";
-				bias-pull-up;
-				drive-strength = <8>;
-			};
+				cmd {
+					pins = "sdc2_cmd";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
 
-			sdc1_data_off: sdc1-data-off {
-				pins = "sdc1_data";
-				bias-pull-up;
-				drive-strength = <2>;
-			};
+				data {
+					pins = "sdc2_data";
+					bias-pull-up;
+					drive-strength = <2>;
+				};
 
-			sdc1_rclk_on: sdc1-rclk-on {
-				pins = "sdc1_rclk";
-				bias-pull-down;
-			};
-
-			sdc1_rclk_off: sdc1-rclk-off {
-				pins = "sdc1_rclk";
-				bias-pull-down;
+				sd-cd {
+					pins = "gpio54";
+					bias-disable;
+					drive-strength = <2>;
+				};
 			};
 		};
 
@@ -816,8 +884,8 @@ sdhc_1: sdhci@c0c4000 {
 			clock-names = "core", "iface", "xo";
 
 			pinctrl-names = "default", "sleep";
-			pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on &sdc1_rclk_on>;
-			pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off &sdc1_rclk_off>;
+			pinctrl-0 = <&sdc1_state_on>;
+			pinctrl-1 = <&sdc1_state_off>;
 
 			bus-width = <8>;
 			non-removable;
@@ -962,10 +1030,8 @@ blsp2_uart1: serial@c1af000 {
 			dmas = <&blsp2_dma 0>, <&blsp2_dma 1>;
 			dma-names = "tx", "rx";
 			pinctrl-names = "default", "sleep";
-			pinctrl-0 = <&blsp2_uart1_tx_active &blsp2_uart1_rxcts_active
-				&blsp2_uart1_rfr_active>;
-			pinctrl-1 = <&blsp2_uart1_tx_sleep &blsp2_uart1_rxcts_sleep
-				&blsp2_uart1_rfr_sleep>;
+			pinctrl-0 = <&blsp2_uart1_default>;
+			pinctrl-1 = <&blsp2_uart1_sleep>;
 			status = "disabled";
 		};
 

From 6a00decce3a6edc59f659468a6d8f80c313b742c Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Tue, 27 Jul 2021 13:35:33 +0300
Subject: [PATCH 0186/1750] serial: 8250_omap: Handle optional
 overrun-throttle-ms property

[ Upstream commit 1fe0e1fa3209ad8e9124147775bd27b1d9f04bd4 ]

Handle optional overrun-throttle-ms property as done for 8250_fsl in commit
6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during
input overruns"). This can be used to rate limit the UART interrupts on
noisy lines that end up producing messages like the following:

ttyS ttyS2: 4 input overrun(s)

At least on droid4, the multiplexed USB and UART port is left to UART mode
by the bootloader for a debug console, and if a USB charger is connected
on boot, we get noise on the UART until the PMIC related drivers for PHY
and charger are loaded.

With this patch and overrun-throttle-ms = <500> we avoid the extra rx
interrupts.

Cc: Carl Philipp Klemm <philipp@uvos.xyz>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Cc: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210727103533.51547-2-tony@atomide.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_omap.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index c37468887fd2..efe4cf32add2 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -617,7 +617,7 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
 	struct uart_port *port = dev_id;
 	struct omap8250_priv *priv = port->private_data;
 	struct uart_8250_port *up = up_to_u8250p(port);
-	unsigned int iir;
+	unsigned int iir, lsr;
 	int ret;
 
 #ifdef CONFIG_SERIAL_8250_DMA
@@ -628,6 +628,7 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
 #endif
 
 	serial8250_rpm_get(up);
+	lsr = serial_port_in(port, UART_LSR);
 	iir = serial_port_in(port, UART_IIR);
 	ret = serial8250_handle_irq(port, iir);
 
@@ -642,6 +643,24 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id)
 		serial_port_in(port, UART_RX);
 	}
 
+	/* Stop processing interrupts on input overrun */
+	if ((lsr & UART_LSR_OE) && up->overrun_backoff_time_ms > 0) {
+		unsigned long delay;
+
+		up->ier = port->serial_in(port, UART_IER);
+		if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
+			port->ops->stop_rx(port);
+		} else {
+			/* Keep restarting the timer until
+			 * the input overrun subsides.
+			 */
+			cancel_delayed_work(&up->overrun_backoff);
+		}
+
+		delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
+		schedule_delayed_work(&up->overrun_backoff, delay);
+	}
+
 	serial8250_rpm_put(up);
 
 	return IRQ_RETVAL(ret);
@@ -1353,6 +1372,10 @@ static int omap8250_probe(struct platform_device *pdev)
 		}
 	}
 
+	if (of_property_read_u32(np, "overrun-throttle-ms",
+				 &up.overrun_backoff_time_ms) != 0)
+		up.overrun_backoff_time_ms = 0;
+
 	priv->wakeirq = irq_of_parse_and_map(np, 1);
 
 	pdata = of_device_get_match_data(&pdev->dev);

From 74287874c91d878e133daecab676bcdb4c9e388f Mon Sep 17 00:00:00 2001
From: Sebastian Reichel <sebastian.reichel@collabora.com>
Date: Mon, 2 Aug 2021 19:23:08 +0200
Subject: [PATCH 0187/1750] ARM: dts: imx53-ppd: Fix ACHC entry

[ Upstream commit cd7cd5b716d594e27a933c12f026d4f2426d7bf4 ]

PPD has only one ACHC device, which effectively is a Kinetis
microcontroller. It has one SPI interface used for normal
communication. Additionally it's possible to flash the device
firmware using NXP's EzPort protocol by correctly driving a
second chip select pin and the device reset pin.

Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20210802172309.164365-3-sebastian.reichel@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx53-ppd.dts | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts
index f7dcdf96e5c0..6d9a5ede94aa 100644
--- a/arch/arm/boot/dts/imx53-ppd.dts
+++ b/arch/arm/boot/dts/imx53-ppd.dts
@@ -70,6 +70,12 @@ cko2_11M: sgtl-clock-cko2 {
 		clock-frequency = <11289600>;
 	};
 
+	achc_24M: achc-clock {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency = <24000000>;
+	};
+
 	sgtlsound: sound {
 		compatible = "fsl,imx53-cpuvo-sgtl5000",
 			     "fsl,imx-audio-sgtl5000";
@@ -313,16 +319,13 @@ &gpio4 11 GPIO_ACTIVE_LOW
 		    &gpio4 12 GPIO_ACTIVE_LOW>;
 	status = "okay";
 
-	spidev0: spi@0 {
-		compatible = "ge,achc";
-		reg = <0>;
-		spi-max-frequency = <1000000>;
-	};
-
-	spidev1: spi@1 {
-		compatible = "ge,achc";
-		reg = <1>;
-		spi-max-frequency = <1000000>;
+	spidev0: spi@1 {
+		compatible = "ge,achc", "nxp,kinetis-k20";
+		reg = <1>, <0>;
+		vdd-supply = <&reg_3v3>;
+		vdda-supply = <&reg_3v3>;
+		clocks = <&achc_24M>;
+		reset-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>;
 	};
 
 	gpioxra0: gpio@2 {

From 34e9c56675a81f32d7fcec53087a232f77a39371 Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Mon, 8 Mar 2021 11:38:24 +0530
Subject: [PATCH 0188/1750] arm64: dts: qcom: ipq8074: fix pci node reg
 property

[ Upstream commit 52c9887fba71fc8f12d343833fc595c762aac8c7 ]

reg property should be array of values, here it is a single array,
leading to below warning:

arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@10000000:reg:0: [268435456, 3869, 268439328, 168, 557056, 8192, 269484032, 4096] is too long
arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@10000000:ranges: 'oneOf' conditional failed, one must be fixed:
arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@10000000:ranges: 'oneOf' conditional failed, one must be fixed:
[[2164260864, 0, 270532608, 270532608, 0, 1048576, 2181038080, 0, 271581184, 271581184, 0, 13631488]] is not of type 'null'
[2164260864, 0, 270532608, 270532608, 0, 1048576, 2181038080, 0, 271581184, 271581184, 0, 13631488] is too long
arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@20000000:reg:0: [536870912, 3869, 536874784, 168, 524288, 8192, 537919488, 4096] is too long
arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@20000000:ranges: 'oneOf' conditional failed, one must be fixed:
arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: soc: pci@20000000:ranges: 'oneOf' conditional failed, one must be fixed:
[[2164260864, 0, 538968064, 538968064, 0, 1048576, 2181038080, 0, 540016640, 540016640, 0, 13631488]] is not of type 'null'
[2164260864, 0, 538968064, 538968064, 0, 1048576, 2181038080, 0, 540016640, 540016640, 0, 13631488] is too long

Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20210308060826.3074234-17-vkoul@kernel.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/ipq8074.dtsi | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
index 829e37ac82f6..776a6b0f61a6 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
@@ -567,10 +567,10 @@ frame@b128000 {
 
 		pcie1: pci@10000000 {
 			compatible = "qcom,pcie-ipq8074";
-			reg =  <0x10000000 0xf1d
-				0x10000f20 0xa8
-				0x00088000 0x2000
-				0x10100000 0x1000>;
+			reg =  <0x10000000 0xf1d>,
+			       <0x10000f20 0xa8>,
+			       <0x00088000 0x2000>,
+			       <0x10100000 0x1000>;
 			reg-names = "dbi", "elbi", "parf", "config";
 			device_type = "pci";
 			linux,pci-domain = <1>;
@@ -629,10 +629,10 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */
 
 		pcie0: pci@20000000 {
 			compatible = "qcom,pcie-ipq8074";
-			reg =  <0x20000000 0xf1d
-				0x20000f20 0xa8
-				0x00080000 0x2000
-				0x20100000 0x1000>;
+			reg = <0x20000000 0xf1d>,
+			      <0x20000f20 0xa8>,
+			      <0x00080000 0x2000>,
+			      <0x20100000 0x1000>;
 			reg-names = "dbi", "elbi", "parf", "config";
 			device_type = "pci";
 			linux,pci-domain = <0>;

From da714a198342c752839045d54d4240cf335cd67a Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Mon, 8 Mar 2021 11:38:25 +0530
Subject: [PATCH 0189/1750] arm64: dts: qcom: sdm660: use reg value for memory
 node

[ Upstream commit c81210e38966cfa1c784364e4035081c3227cf5b ]

memory node like other node should be node@reg, which is missing in this
case, so fix it up

arch/arm64/boot/dts/qcom/ipq8074-hk01.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 1073741824, 0, 536870912]]}

Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20210308060826.3074234-18-vkoul@kernel.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
index e8c37a1693d3..cc08dc4eb56a 100644
--- a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
+++ b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts
@@ -20,7 +20,7 @@ chosen {
 		stdout-path = "serial0";
 	};
 
-	memory {
+	memory@40000000 {
 		device_type = "memory";
 		reg = <0x0 0x40000000 0x0 0x20000000>;
 	};

From aa16e76c80afecb97dc509e3c48db0f89c0d6ba5 Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Mon, 8 Mar 2021 11:38:26 +0530
Subject: [PATCH 0190/1750] arm64: dts: qcom: ipq6018: drop '0x' from unit
 address

[ Upstream commit 1b91b8ef60e9a67141e66af3cca532c00f4605fe ]

Nodes need not contain '0x' for the unit address. Drop it to fix the
below warning:

arch/arm64/boot/dts/qcom/ipq6018-cp01-c1.dt.yaml: reserved-memory:
'memory@0x60000' does not match any of the regexes

Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20210308060826.3074234-19-vkoul@kernel.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
index cdc1e3d60c58..3ceb36cac512 100644
--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
@@ -151,7 +151,7 @@ reserved-memory {
 		#size-cells = <2>;
 		ranges;
 
-		rpm_msg_ram: memory@0x60000 {
+		rpm_msg_ram: memory@60000 {
 			reg = <0x0 0x60000 0x0 0x6000>;
 			no-map;
 		};

From bda9c84edbb3eba9bebb8888bb7b2393235b003c Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Mon, 8 Mar 2021 11:38:18 +0530
Subject: [PATCH 0191/1750] arm64: dts: qcom: sdm630: don't use underscore in
 node name

[ Upstream commit 639dfdbecd88ec05bda87b1d5d419afad50af21c ]

We have underscore (_) in node name so fix that up as well.

Fix this by changing node name to use dash (-)

Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20210308060826.3074234-11-vkoul@kernel.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sdm630.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sdm630.dtsi b/arch/arm64/boot/dts/qcom/sdm630.dtsi
index ee7fcf4c158f..f87054575ce7 100644
--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -17,14 +17,14 @@ / {
 	chosen { };
 
 	clocks {
-		xo_board: xo_board {
+		xo_board: xo-board {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
 			clock-frequency = <19200000>;
 			clock-output-names = "xo_board";
 		};
 
-		sleep_clk: sleep_clk {
+		sleep_clk: sleep-clk {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
 			clock-frequency = <32764>;

From f868c2d62a27de5fd7971f635b9cea34261c0c1b Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Mon, 8 Mar 2021 11:38:16 +0530
Subject: [PATCH 0192/1750] arm64: dts: qcom: msm8994: don't use underscore in
 node name

[ Upstream commit 8c678beca7ed3fa8a2c6d86f6603bc23400f9ad8 ]

We have underscore (_) in node name leading to warning:
arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon-cityman.dt.yaml: clocks: xo_board: {'type': 'object'} is not allowed for {'compatible': ['fixed-clock'], '#clock-cells': [[0]], 'clock-frequency': [[19200000]], 'phandle': [[26]]}
arch/arm64/boot/dts/qcom/msm8994-msft-lumia-octagon-cityman.dt.yaml: clocks: sleep_clk: {'type': 'object'} is not allowed for {'compatible': ['fixed-clock'], '#clock-cells': [[0]], 'clock-frequency': [[32768]]}

Fix this by changing node name to use dash (-)

Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20210308060826.3074234-9-vkoul@kernel.org
[bjorn: Added clock-output-names to satisfy parent_names]
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8994.dtsi | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/msm8994.dtsi b/arch/arm64/boot/dts/qcom/msm8994.dtsi
index 6707f898607f..45f9a44326a6 100644
--- a/arch/arm64/boot/dts/qcom/msm8994.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8994.dtsi
@@ -14,16 +14,18 @@ / {
 	chosen { };
 
 	clocks {
-		xo_board: xo_board {
+		xo_board: xo-board {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
 			clock-frequency = <19200000>;
+			clock-output-names = "xo_board";
 		};
 
-		sleep_clk: sleep_clk {
+		sleep_clk: sleep-clk {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
 			clock-frequency = <32768>;
+			clock-output-names = "sleep_clk";
 		};
 	};
 

From 43ccafc91f638e9cf1c50fb49856164f5787cef3 Mon Sep 17 00:00:00 2001
From: Vinod Koul <vkoul@kernel.org>
Date: Mon, 8 Mar 2021 11:38:17 +0530
Subject: [PATCH 0193/1750] arm64: dts: qcom: msm8996: don't use underscore in
 node name

[ Upstream commit 84f3efbe5b4654077608bc2fc027177fe4592321 ]

We have underscore (_) in node name leading to warning:

arch/arm64/boot/dts/qcom/apq8096-db820c.dt.yaml: clocks: $nodename:0: 'clocks' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
arch/arm64/boot/dts/qcom/apq8096-db820c.dt.yaml: clocks: xo_board: {'type': 'object'} is not allowed for {'compatible': ['fixed-clock'], '#clock-cells': [[0]], 'clock-frequency': [[19200000]], 'clock-output-names': ['xo_board'], 'phandle': [[115]]}

Fix this by changing node name to use dash (-)

Signed-off-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20210308060826.3074234-10-vkoul@kernel.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index fd6ae5464dea..eef17434d12a 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -17,14 +17,14 @@ / {
 	chosen { };
 
 	clocks {
-		xo_board: xo_board {
+		xo_board: xo-board {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
 			clock-frequency = <19200000>;
 			clock-output-names = "xo_board";
 		};
 
-		sleep_clk: sleep_clk {
+		sleep_clk: sleep-clk {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
 			clock-frequency = <32764>;

From 35e5c99b152de914b3f84fa41aa16bac3c699b48 Mon Sep 17 00:00:00 2001
From: Georgi Djakov <georgi.djakov@linaro.org>
Date: Thu, 11 Feb 2021 21:36:37 +0200
Subject: [PATCH 0194/1750] arm64: dts: qcom: sm8250: Fix epss_l3 unit address

[ Upstream commit 77b53d65dc1e54321ec841912f06bcb558a079c0 ]

The unit address of the epss_l3 node is incorrect and does not match
the address of its "reg" property. Let's fix it.

Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
Link: https://lore.kernel.org/r/20210211193637.9737-1-georgi.djakov@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index d4547a192748..ec356fe07ac8 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -2346,7 +2346,7 @@ apps_bcm_voter: bcm_voter {
 			};
 		};
 
-		epss_l3: interconnect@18591000 {
+		epss_l3: interconnect@18590000 {
 			compatible = "qcom,sm8250-epss-l3";
 			reg = <0 0x18590000 0 0x1000>;
 

From 2b0fa8d5304102db03c7ba89742902219b3eec94 Mon Sep 17 00:00:00 2001
From: Rajendra Nayak <rnayak@codeaurora.org>
Date: Fri, 6 Aug 2021 09:59:45 +0100
Subject: [PATCH 0195/1750] nvmem: qfprom: Fix up qfprom_disable_fuse_blowing()
 ordering

[ Upstream commit 11c4b3e264d68ba6dcd52d12dbcfd3f564f2f137 ]

qfprom_disable_fuse_blowing() disables a bunch of resources,
and then does a few register writes in the 'conf' address
space.
It works perhaps because the resources are needed only for the
'raw' register space writes, and that the 'conf' space allows
read/writes regardless.
However that makes the code look confusing, so just move the
register writes before turning off the resources in the
function.

Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20210806085947.22682-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvmem/qfprom.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
index 955b8b8c8238..8ef772ccfb36 100644
--- a/drivers/nvmem/qfprom.c
+++ b/drivers/nvmem/qfprom.c
@@ -104,6 +104,9 @@ static void qfprom_disable_fuse_blowing(const struct qfprom_priv *priv,
 {
 	int ret;
 
+	writel(old->timer_val, priv->qfpconf + QFPROM_BLOW_TIMER_OFFSET);
+	writel(old->accel_val, priv->qfpconf + QFPROM_ACCEL_OFFSET);
+
 	/*
 	 * This may be a shared rail and may be able to run at a lower rate
 	 * when we're not blowing fuses.  At the moment, the regulator framework
@@ -124,9 +127,6 @@ static void qfprom_disable_fuse_blowing(const struct qfprom_priv *priv,
 			 "Failed to set clock rate for disable (ignoring)\n");
 
 	clk_disable_unprepare(priv->secclk);
-
-	writel(old->timer_val, priv->qfpconf + QFPROM_BLOW_TIMER_OFFSET);
-	writel(old->accel_val, priv->qfpconf + QFPROM_ACCEL_OFFSET);
 }
 
 /**

From ac21cd44c95457ee2904783fc13c78b3c2deca10 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Fri, 6 Aug 2021 12:13:40 -0700
Subject: [PATCH 0196/1750] net: ethernet: stmmac: Do not use unreachable() in
 ipq806x_gmac_probe()

[ Upstream commit 4367355dd90942a71641c98c40c74589c9bddf90 ]

When compiling with clang in certain configurations, an objtool warning
appears:

drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.o: warning: objtool:
ipq806x_gmac_probe() falls through to next function phy_modes()

This happens because the unreachable annotation in the third switch
statement is not eliminated. The compiler should know that the first
default case would prevent the second and third from being reached as
the comment notes but sanitizer options can make it harder for the
compiler to reason this out.

Help the compiler out by eliminating the unreachable() annotation and
unifying the default case error handling so that there is no objtool
warning, the meaning of the code stays the same, and there is less
duplication.

Reported-by: Sami Tolvanen <samitolvanen@google.com>
Tested-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/stmicro/stmmac/dwmac-ipq806x.c    | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 749585fe6fc9..90f69f43770a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -289,10 +289,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
 		val &= ~NSS_COMMON_GMAC_CTL_PHY_IFACE_SEL;
 		break;
 	default:
-		dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
-			phy_modes(gmac->phy_mode));
-		err = -EINVAL;
-		goto err_remove_config_dt;
+		goto err_unsupported_phy;
 	}
 	regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val);
 
@@ -309,10 +306,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
 			NSS_COMMON_CLK_SRC_CTRL_OFFSET(gmac->id);
 		break;
 	default:
-		dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
-			phy_modes(gmac->phy_mode));
-		err = -EINVAL;
-		goto err_remove_config_dt;
+		goto err_unsupported_phy;
 	}
 	regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val);
 
@@ -329,8 +323,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
 				NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id);
 		break;
 	default:
-		/* We don't get here; the switch above will have errored out */
-		unreachable();
+		goto err_unsupported_phy;
 	}
 	regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val);
 
@@ -361,6 +354,11 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
 
 	return 0;
 
+err_unsupported_phy:
+	dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n",
+		phy_modes(gmac->phy_mode));
+	err = -EINVAL;
+
 err_remove_config_dt:
 	stmmac_remove_config_dt(pdev, plat_dat);
 

From 0bbbe3ec67f0360dac572fed91edb9f585d015de Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Thu, 15 Jul 2021 08:09:25 +0200
Subject: [PATCH 0197/1750] drm/msm: mdp4: drop vblank get/put from
 prepare/complete_commit

[ Upstream commit 56bd931ae506730c9ab1e4cc4bfefa43fc2d18fa ]

msm_atomic is doing vblank get/put's already,
currently there no need to duplicate the effort in MDP4

Fix warning:
...
WARNING: CPU: 3 PID: 79 at drivers/gpu/drm/drm_vblank.c:1194 drm_vblank_put+0x1cc/0x1d4
...
and multiple vblank time-outs:
...
msm 5100000.mdp: vblank time out, crtc=1
...

Tested on Nexus 7 2013 (deb), LTS 5.10.50.

Introduced by: 119ecb7fd3b5 ("drm/msm/mdp4: request vblank during modeset")

Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20210715060925.7880-1-david@ixit.cz
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
index c1c152e39918..39577bf9215a 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -89,13 +89,6 @@ static void mdp4_disable_commit(struct msm_kms *kms)
 
 static void mdp4_prepare_commit(struct msm_kms *kms, struct drm_atomic_state *state)
 {
-	int i;
-	struct drm_crtc *crtc;
-	struct drm_crtc_state *crtc_state;
-
-	/* see 119ecb7fd */
-	for_each_new_crtc_in_state(state, crtc, crtc_state, i)
-		drm_crtc_vblank_get(crtc);
 }
 
 static void mdp4_flush_commit(struct msm_kms *kms, unsigned crtc_mask)
@@ -114,12 +107,6 @@ static void mdp4_wait_flush(struct msm_kms *kms, unsigned crtc_mask)
 
 static void mdp4_complete_commit(struct msm_kms *kms, unsigned crtc_mask)
 {
-	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
-	struct drm_crtc *crtc;
-
-	/* see 119ecb7fd */
-	for_each_crtc_mask(mdp4_kms->dev, crtc, crtc_mask)
-		drm_crtc_vblank_put(crtc);
 }
 
 static long mdp4_round_pixclk(struct msm_kms *kms, unsigned long rate,

From 127f3610a0e399df5b1149c6dca826a400240a14 Mon Sep 17 00:00:00 2001
From: Konrad Dybcio <konrad.dybcio@somainline.org>
Date: Thu, 29 Jul 2021 00:20:54 +0200
Subject: [PATCH 0198/1750] drm/msm/dsi: Fix DSI and DSI PHY regulator config
 from SDM660

[ Upstream commit 462f7017a6918d152870bfb8852f3c70fd74b296 ]

VDDA is not present and the specified load value is wrong. Fix it.

Signed-off-by: Konrad Dybcio <konrad.dybcio@somainline.org>
Link: https://lore.kernel.org/r/20210728222057.52641-1-konrad.dybcio@somainline.org
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/dsi_cfg.c          | 1 -
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
index b2ff68a15791..d255bea87ca4 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c
@@ -158,7 +158,6 @@ static const struct msm_dsi_config sdm660_dsi_cfg = {
 	.reg_cfg = {
 		.num = 2,
 		.regs = {
-			{"vdd", 73400, 32 },	/* 0.9 V */
 			{"vdda", 12560, 4 },	/* 1.2 V */
 		},
 	},
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
index 519400501bcd..1ca9e73c6e07 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c
@@ -168,7 +168,7 @@ const struct msm_dsi_phy_cfg dsi_phy_14nm_660_cfgs = {
 	.reg_cfg = {
 		.num = 1,
 		.regs = {
-			{"vcca", 17000, 32},
+			{"vcca", 73400, 32},
 		},
 	},
 	.ops = {

From f76f78f9f479ebfdd94ec8c868b39aba7ca4fb0f Mon Sep 17 00:00:00 2001
From: Quanyang Wang <quanyang.wang@windriver.com>
Date: Wed, 10 Mar 2021 12:59:45 +0800
Subject: [PATCH 0199/1750] drm: xlnx: zynqmp_dpsub: Call pm_runtime_get_sync
 before setting pixel clock

[ Upstream commit a19effb6dbe5bd1be77a6d68eba04dba8993ffeb ]

The Runtime PM subsystem will force the device "fd4a0000.zynqmp-display"
to enter suspend state while booting if the following conditions are met:
- the usage counter is zero (pm_runtime_get_sync hasn't been called yet)
- no 'active' children (no zynqmp-dp-snd-xx node under dpsub node)
- no other device in the same power domain (dpdma node has no
		"power-domains = <&zynqmp_firmware PD_DP>" property)

So there is a scenario as below:
1) DP device enters suspend state   <- call zynqmp_gpd_power_off
2) zynqmp_disp_crtc_setup_clock	    <- configurate register VPLL_FRAC_CFG
3) pm_runtime_get_sync		    <- call zynqmp_gpd_power_on and clear previous
				       VPLL_FRAC_CFG configuration
4) clk_prepare_enable(disp->pclk)   <- enable failed since VPLL_FRAC_CFG
				       configuration is corrupted

From above, we can see that pm_runtime_get_sync may clear register
VPLL_FRAC_CFG configuration and result the failure of clk enabling.
Putting pm_runtime_get_sync at the very beginning of the function
zynqmp_disp_crtc_atomic_enable can resolve this issue.

Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/xlnx/zynqmp_disp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_disp.c b/drivers/gpu/drm/xlnx/zynqmp_disp.c
index 8cd8af35cfaa..205c72a249b7 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_disp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_disp.c
@@ -1447,9 +1447,10 @@ zynqmp_disp_crtc_atomic_enable(struct drm_crtc *crtc,
 	struct drm_display_mode *adjusted_mode = &crtc->state->adjusted_mode;
 	int ret, vrefresh;
 
+	pm_runtime_get_sync(disp->dev);
+
 	zynqmp_disp_crtc_setup_clock(crtc, adjusted_mode);
 
-	pm_runtime_get_sync(disp->dev);
 	ret = clk_prepare_enable(disp->pclk);
 	if (ret) {
 		dev_err(disp->dev, "failed to enable a pixel clock\n");

From 0f0f1de02b9b1c793cff929b55c42b9fda7680b1 Mon Sep 17 00:00:00 2001
From: Quanyang Wang <quanyang.wang@windriver.com>
Date: Tue, 23 Mar 2021 10:55:01 +0800
Subject: [PATCH 0200/1750] drm: xlnx: zynqmp: release reset to DP controller
 before accessing DP registers

[ Upstream commit a338619bd76011035d462f0f9e8b2f24d7fe5a1e ]

When insmod zynqmp-dpsub.ko after rmmod it, system will hang with the
error log as below:

root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko
[   88.391289] [drm] Initialized zynqmp-dpsub 1.0.0 20130509 for fd4a0000.display on minor 0
[   88.529906] Console: switching to colour frame buffer device 128x48
[   88.549402] zynqmp-dpsub fd4a0000.display: [drm] fb0: zynqmp-dpsubdrm frame buffer device
[   88.571624] zynqmp-dpsub fd4a0000.display: ZynqMP DisplayPort Subsystem driver probed
root@xilinx-zynqmp:~# rmmod zynqmp_dpsub
[   94.023404] Console: switching to colour dummy device 80x25
root@xilinx-zynqmp:~# insmod zynqmp-dpsub.ko
	<hang here>

This is because that in zynqmp_dp_probe it tries to access some DP
registers while the DP controller is still in the reset state. When
running "rmmod zynqmp_dpsub", zynqmp_dp_reset(dp, true) in
zynqmp_dp_phy_exit is called to force the DP controller into the reset
state. Then insmod will call zynqmp_dp_probe to program the DP registers,
but at this moment the DP controller hasn't been brought out of the reset
state yet since the function zynqmp_dp_reset(dp, false) is called later and
this will result the system hang.

Releasing the reset to DP controller before any read/write operation to it
will fix this issue. And for symmetry, move zynqmp_dp_reset() call from
zynqmp_dp_phy_exit() to zynqmp_dp_remove().

Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/xlnx/zynqmp_dp.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/xlnx/zynqmp_dp.c b/drivers/gpu/drm/xlnx/zynqmp_dp.c
index 59d1fb017da0..13811332b349 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dp.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dp.c
@@ -402,10 +402,6 @@ static int zynqmp_dp_phy_init(struct zynqmp_dp *dp)
 		}
 	}
 
-	ret = zynqmp_dp_reset(dp, false);
-	if (ret < 0)
-		return ret;
-
 	zynqmp_dp_clr(dp, ZYNQMP_DP_PHY_RESET, ZYNQMP_DP_PHY_RESET_ALL_RESET);
 
 	/*
@@ -441,8 +437,6 @@ static void zynqmp_dp_phy_exit(struct zynqmp_dp *dp)
 				ret);
 	}
 
-	zynqmp_dp_reset(dp, true);
-
 	for (i = 0; i < dp->num_lanes; i++) {
 		ret = phy_exit(dp->phy[i]);
 		if (ret)
@@ -1682,9 +1676,13 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct drm_device *drm)
 		return PTR_ERR(dp->reset);
 	}
 
+	ret = zynqmp_dp_reset(dp, false);
+	if (ret < 0)
+		return ret;
+
 	ret = zynqmp_dp_phy_probe(dp);
 	if (ret)
-		return ret;
+		goto err_reset;
 
 	/* Initialize the hardware. */
 	zynqmp_dp_write(dp, ZYNQMP_DP_TX_PHY_POWER_DOWN,
@@ -1696,7 +1694,7 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct drm_device *drm)
 
 	ret = zynqmp_dp_phy_init(dp);
 	if (ret)
-		return ret;
+		goto err_reset;
 
 	zynqmp_dp_write(dp, ZYNQMP_DP_TRANSMITTER_ENABLE, 1);
 
@@ -1708,15 +1706,18 @@ int zynqmp_dp_probe(struct zynqmp_dpsub *dpsub, struct drm_device *drm)
 					zynqmp_dp_irq_handler, IRQF_ONESHOT,
 					dev_name(dp->dev), dp);
 	if (ret < 0)
-		goto error;
+		goto err_phy_exit;
 
 	dev_dbg(dp->dev, "ZynqMP DisplayPort Tx probed with %u lanes\n",
 		dp->num_lanes);
 
 	return 0;
 
-error:
+err_phy_exit:
 	zynqmp_dp_phy_exit(dp);
+err_reset:
+	zynqmp_dp_reset(dp, true);
+
 	return ret;
 }
 
@@ -1734,4 +1735,5 @@ void zynqmp_dp_remove(struct zynqmp_dpsub *dpsub)
 	zynqmp_dp_write(dp, ZYNQMP_DP_INT_DS, 0xffffffff);
 
 	zynqmp_dp_phy_exit(dp);
+	zynqmp_dp_reset(dp, true);
 }

From 491c8be21993bdb63f36dba3b7004d8bce6a83ff Mon Sep 17 00:00:00 2001
From: Sanjay R Mehta <sanju.mehta@amd.com>
Date: Tue, 3 Aug 2021 07:34:56 -0500
Subject: [PATCH 0201/1750] thunderbolt: Fix port linking by checking all
 adapters

[ Upstream commit 42716425ad7e1b6529ec61c260c11176841f4b5f ]

In tb_switch_default_link_ports(), while linking of ports,
only odd-numbered ports (1,3,5..) are considered and even-numbered
ports are not considered.

AMD host router has lane adapters at 2 and 3 and link ports at adapter 2
is not considered due to which lane bonding gets disabled.

Hence added a fix such that all ports are considered during
linking of ports.

Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Sanjay R Mehta <sanju.mehta@amd.com>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thunderbolt/switch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 9a272a516b2d..c4b157c29af7 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -2204,7 +2204,7 @@ static void tb_switch_default_link_ports(struct tb_switch *sw)
 {
 	int i;
 
-	for (i = 1; i <= sw->config.max_port_number; i += 2) {
+	for (i = 1; i <= sw->config.max_port_number; i++) {
 		struct tb_port *port = &sw->ports[i];
 		struct tb_port *subordinate;
 

From d763afc4ea2b251217ec87cf4c1e006c9f0aef99 Mon Sep 17 00:00:00 2001
From: Roy Chan <roy.chan@amd.com>
Date: Wed, 21 Jul 2021 19:33:26 -0400
Subject: [PATCH 0202/1750] drm/amd/display: fix missing writeback disablement
 if plane is removed

[ Upstream commit 82367e7f22d085092728f45fd5fbb15e3fb997c0 ]

[Why]
If the plane has been removed, the writeback disablement logic
doesn't run

[How]
fix the logic order

Acked-by: Anson Jacob <Anson.Jacob@amd.com>
Signed-off-by: Roy Chan <roy.chan@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 ++++++++------
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 12 +++++++++++-
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
index 9d3ccdd35582..79a2b9c785f0 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
@@ -1704,13 +1704,15 @@ void dcn20_program_front_end_for_ctx(
 				dcn20_program_pipe(dc, pipe, context);
 				pipe = pipe->bottom_pipe;
 			}
-			/* Program secondary blending tree and writeback pipes */
-			pipe = &context->res_ctx.pipe_ctx[i];
-			if (!pipe->prev_odm_pipe && pipe->stream->num_wb_info > 0
-					&& (pipe->update_flags.raw || pipe->plane_state->update_flags.raw || pipe->stream->update_flags.raw)
-					&& hws->funcs.program_all_writeback_pipes_in_tree)
-				hws->funcs.program_all_writeback_pipes_in_tree(dc, pipe->stream, context);
 		}
+		/* Program secondary blending tree and writeback pipes */
+		pipe = &context->res_ctx.pipe_ctx[i];
+		if (!pipe->top_pipe && !pipe->prev_odm_pipe
+				&& pipe->stream && pipe->stream->num_wb_info > 0
+				&& (pipe->update_flags.raw || (pipe->plane_state && pipe->plane_state->update_flags.raw)
+					|| pipe->stream->update_flags.raw)
+				&& hws->funcs.program_all_writeback_pipes_in_tree)
+			hws->funcs.program_all_writeback_pipes_in_tree(dc, pipe->stream, context);
 	}
 }
 
diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
index 97909d5aab34..22c77e96f6a5 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
@@ -396,12 +396,22 @@ void dcn30_program_all_writeback_pipes_in_tree(
 			for (i_pipe = 0; i_pipe < dc->res_pool->pipe_count; i_pipe++) {
 				struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i_pipe];
 
+				if (!pipe_ctx->plane_state)
+					continue;
+
 				if (pipe_ctx->plane_state == wb_info.writeback_source_plane) {
 					wb_info.mpcc_inst = pipe_ctx->plane_res.mpcc_inst;
 					break;
 				}
 			}
-			ASSERT(wb_info.mpcc_inst != -1);
+
+			if (wb_info.mpcc_inst == -1) {
+				/* Disable writeback pipe and disconnect from MPCC
+				 * if source plane has been removed
+				 */
+				dc->hwss.disable_writeback(dc, wb_info.dwb_pipe_inst);
+				continue;
+			}
 
 			ASSERT(wb_info.dwb_pipe_inst < dc->res_pool->res_cap->num_dwb);
 			dwb = dc->res_pool->dwbc[wb_info.dwb_pipe_inst];

From 63ebc1f1df813ebb40d19449c356480555008166 Mon Sep 17 00:00:00 2001
From: Roy Chan <roy.chan@amd.com>
Date: Mon, 19 Jul 2021 19:00:22 -0400
Subject: [PATCH 0203/1750] drm/amd/display: fix incorrect CM/TF programming
 sequence in dwb

[ Upstream commit 781e1e23131cce56fb557e6ec2260480a6bd08cc ]

[How]
the programming sequeune was for old asic.
the correct programming sequeunce should be similar to the one
used in mpc. the fix is copied from the mpc programming sequeunce.

Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
Acked-by: Anson Jacob <Anson.Jacob@amd.com>
Signed-off-by: Roy Chan <roy.chan@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/display/dc/dcn30/dcn30_dwb_cm.c   | 90 +++++++++++++------
 1 file changed, 64 insertions(+), 26 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
index 8593145379d9..6d621f07be48 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dwb_cm.c
@@ -49,6 +49,11 @@
 static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
 	struct dcn3_xfer_func_reg *reg)
 {
+	reg->shifts.field_region_start_base = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
+	reg->masks.field_region_start_base = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_BASE_B;
+	reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
+	reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
+
 	reg->shifts.exp_region0_lut_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
 	reg->masks.exp_region0_lut_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION0_LUT_OFFSET;
 	reg->shifts.exp_region0_num_segments = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION0_NUM_SEGMENTS;
@@ -66,8 +71,6 @@ static void dwb3_get_reg_field_ogam(struct dcn30_dwbc *dwbc30,
 	reg->masks.field_region_end_base = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_END_BASE_B;
 	reg->shifts.field_region_linear_slope = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
 	reg->masks.field_region_linear_slope = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_SLOPE_B;
-	reg->masks.field_offset = dwbc30->dwbc_mask->DWB_OGAM_RAMA_OFFSET_B;
-	reg->shifts.field_offset = dwbc30->dwbc_shift->DWB_OGAM_RAMA_OFFSET_B;
 	reg->shifts.exp_region_start = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_B;
 	reg->masks.exp_region_start = dwbc30->dwbc_mask->DWB_OGAM_RAMA_EXP_REGION_START_B;
 	reg->shifts.exp_resion_start_segment = dwbc30->dwbc_shift->DWB_OGAM_RAMA_EXP_REGION_START_SEGMENT_B;
@@ -147,18 +150,19 @@ static enum dc_lut_mode dwb3_get_ogam_current(
 	uint32_t state_mode;
 	uint32_t ram_select;
 
-	REG_GET(DWB_OGAM_CONTROL,
-		DWB_OGAM_MODE, &state_mode);
-	REG_GET(DWB_OGAM_CONTROL,
-		DWB_OGAM_SELECT, &ram_select);
+	REG_GET_2(DWB_OGAM_CONTROL,
+		DWB_OGAM_MODE_CURRENT, &state_mode,
+		DWB_OGAM_SELECT_CURRENT, &ram_select);
 
 	if (state_mode == 0) {
 		mode = LUT_BYPASS;
 	} else if (state_mode == 2) {
 		if (ram_select == 0)
 			mode = LUT_RAM_A;
-		else
+		else if (ram_select == 1)
 			mode = LUT_RAM_B;
+		else
+			mode = LUT_BYPASS;
 	} else {
 		// Reserved value
 		mode = LUT_BYPASS;
@@ -172,10 +176,10 @@ static void dwb3_configure_ogam_lut(
 	struct dcn30_dwbc *dwbc30,
 	bool is_ram_a)
 {
-	REG_UPDATE(DWB_OGAM_LUT_CONTROL,
-		DWB_OGAM_LUT_READ_COLOR_SEL, 7);
-	REG_UPDATE(DWB_OGAM_CONTROL,
-		DWB_OGAM_SELECT, is_ram_a == true ? 0 : 1);
+	REG_UPDATE_2(DWB_OGAM_LUT_CONTROL,
+		DWB_OGAM_LUT_WRITE_COLOR_MASK, 7,
+		DWB_OGAM_LUT_HOST_SEL, (is_ram_a == true) ? 0 : 1);
+
 	REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
 }
 
@@ -185,17 +189,45 @@ static void dwb3_program_ogam_pwl(struct dcn30_dwbc *dwbc30,
 {
 	uint32_t i;
 
-    // triple base implementation
-	for (i = 0; i < num/2; i++) {
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+0].red_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+0].green_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+0].blue_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+1].red_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+1].green_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+1].blue_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+2].red_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+2].green_reg);
-		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[2*i+2].blue_reg);
+	uint32_t last_base_value_red = rgb[num-1].red_reg + rgb[num-1].delta_red_reg;
+	uint32_t last_base_value_green = rgb[num-1].green_reg + rgb[num-1].delta_green_reg;
+	uint32_t last_base_value_blue = rgb[num-1].blue_reg + rgb[num-1].delta_blue_reg;
+
+	if (is_rgb_equal(rgb,  num)) {
+		for (i = 0 ; i < num; i++)
+			REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].red_reg);
+
+		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_red);
+
+	} else {
+
+		REG_UPDATE(DWB_OGAM_LUT_CONTROL,
+				DWB_OGAM_LUT_WRITE_COLOR_MASK, 4);
+
+		for (i = 0 ; i < num; i++)
+			REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].red_reg);
+
+		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_red);
+
+		REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
+
+		REG_UPDATE(DWB_OGAM_LUT_CONTROL,
+				DWB_OGAM_LUT_WRITE_COLOR_MASK, 2);
+
+		for (i = 0 ; i < num; i++)
+			REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].green_reg);
+
+		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_green);
+
+		REG_SET(DWB_OGAM_LUT_INDEX, 0, DWB_OGAM_LUT_INDEX, 0);
+
+		REG_UPDATE(DWB_OGAM_LUT_CONTROL,
+				DWB_OGAM_LUT_WRITE_COLOR_MASK, 1);
+
+		for (i = 0 ; i < num; i++)
+			REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, rgb[i].blue_reg);
+
+		REG_SET(DWB_OGAM_LUT_DATA, 0, DWB_OGAM_LUT_DATA, last_base_value_blue);
 	}
 }
 
@@ -211,6 +243,8 @@ static bool dwb3_program_ogam_lut(
 		return false;
 	}
 
+	REG_SET(DWB_OGAM_CONTROL, 0, DWB_OGAM_MODE, 2);
+
 	current_mode = dwb3_get_ogam_current(dwbc30);
 	if (current_mode == LUT_BYPASS || current_mode == LUT_RAM_A)
 		next_mode = LUT_RAM_B;
@@ -227,8 +261,7 @@ static bool dwb3_program_ogam_lut(
 	dwb3_program_ogam_pwl(
 		dwbc30, params->rgb_resulted, params->hw_points_num);
 
-	REG_SET(DWB_OGAM_CONTROL, 0, DWB_OGAM_MODE, 2);
-	REG_SET(DWB_OGAM_CONTROL, 0, DWB_OGAM_SELECT, next_mode == LUT_RAM_A ? 0 : 1);
+	REG_UPDATE(DWB_OGAM_CONTROL, DWB_OGAM_SELECT, next_mode == LUT_RAM_A ? 0 : 1);
 
 	return true;
 }
@@ -271,14 +304,19 @@ static void dwb3_program_gamut_remap(
 
 	struct color_matrices_reg gam_regs;
 
-	REG_UPDATE(DWB_GAMUT_REMAP_COEF_FORMAT, DWB_GAMUT_REMAP_COEF_FORMAT, coef_format);
-
 	if (regval == NULL || select == CM_GAMUT_REMAP_MODE_BYPASS) {
 		REG_SET(DWB_GAMUT_REMAP_MODE, 0,
 				DWB_GAMUT_REMAP_MODE, 0);
 		return;
 	}
 
+	REG_UPDATE(DWB_GAMUT_REMAP_COEF_FORMAT, DWB_GAMUT_REMAP_COEF_FORMAT, coef_format);
+
+	gam_regs.shifts.csc_c11 = dwbc30->dwbc_shift->DWB_GAMUT_REMAPA_C11;
+	gam_regs.masks.csc_c11  = dwbc30->dwbc_mask->DWB_GAMUT_REMAPA_C11;
+	gam_regs.shifts.csc_c12 = dwbc30->dwbc_shift->DWB_GAMUT_REMAPA_C12;
+	gam_regs.masks.csc_c12 = dwbc30->dwbc_mask->DWB_GAMUT_REMAPA_C12;
+
 	switch (select) {
 	case CM_GAMUT_REMAP_MODE_RAMA_COEFF:
 		gam_regs.csc_c11_c12 = REG(DWB_GAMUT_REMAPA_C11_C12);

From 3841dfa7eb5c93044bb28a3bf5400eb8add3a85e Mon Sep 17 00:00:00 2001
From: Jussi Maki <joamaki@gmail.com>
Date: Sat, 31 Jul 2021 05:57:37 +0000
Subject: [PATCH 0204/1750] selftests/bpf: Fix xdp_tx.c prog section name

[ Upstream commit 95413846cca37f20000dd095cf6d91f8777129d7 ]

The program type cannot be deduced from 'tx' which causes an invalid
argument error when trying to load xdp_tx.o using the skeleton.
Rename the section name to "xdp" so that libbpf can deduce the type.

Signed-off-by: Jussi Maki <joamaki@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210731055738.16820-7-joamaki@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/progs/xdp_tx.c   | 2 +-
 tools/testing/selftests/bpf/test_xdp_veth.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/xdp_tx.c b/tools/testing/selftests/bpf/progs/xdp_tx.c
index 94e6c2b281cb..5f725c720e00 100644
--- a/tools/testing/selftests/bpf/progs/xdp_tx.c
+++ b/tools/testing/selftests/bpf/progs/xdp_tx.c
@@ -3,7 +3,7 @@
 #include <linux/bpf.h>
 #include <bpf/bpf_helpers.h>
 
-SEC("tx")
+SEC("xdp")
 int xdp_tx(struct xdp_md *xdp)
 {
 	return XDP_TX;
diff --git a/tools/testing/selftests/bpf/test_xdp_veth.sh b/tools/testing/selftests/bpf/test_xdp_veth.sh
index ba8ffcdaac30..995278e684b6 100755
--- a/tools/testing/selftests/bpf/test_xdp_veth.sh
+++ b/tools/testing/selftests/bpf/test_xdp_veth.sh
@@ -108,7 +108,7 @@ ip link set dev veth2 xdp pinned $BPF_DIR/progs/redirect_map_1
 ip link set dev veth3 xdp pinned $BPF_DIR/progs/redirect_map_2
 
 ip -n ns1 link set dev veth11 xdp obj xdp_dummy.o sec xdp_dummy
-ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec tx
+ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec xdp
 ip -n ns3 link set dev veth33 xdp obj xdp_dummy.o sec xdp_dummy
 
 trap cleanup EXIT

From d6c91423993e8164ca4162ff046c6437bbd75b53 Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Sat, 24 Jul 2021 19:18:24 +0800
Subject: [PATCH 0205/1750] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

[ Upstream commit 2bc5da528dd570c5ecabc107e6fbdbc55974276f ]

drm_file.master should be protected by either drm_device.master_mutex
or drm_file.master_lookup_lock when being dereferenced. However,
drm_master_get is called on unprotected file_priv->master pointers in
vmw_surface_define_ioctl and vmw_gb_surface_define_internal.

This is fixed by replacing drm_master_get with drm_file_get_master.

Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210724111824.59266-4-desmondcheongzx@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index f493b20c7a38..f1a51371de5b 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -866,7 +866,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 	user_srf->prime.base.shareable = false;
 	user_srf->prime.base.tfile = NULL;
 	if (drm_is_primary_client(file_priv))
-		user_srf->master = drm_master_get(file_priv->master);
+		user_srf->master = drm_file_get_master(file_priv);
 
 	/**
 	 * From this point, the generic resource management functions
@@ -1537,7 +1537,7 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
 
 	user_srf = container_of(srf, struct vmw_user_surface, srf);
 	if (drm_is_primary_client(file_priv))
-		user_srf->master = drm_master_get(file_priv->master);
+		user_srf->master = drm_file_get_master(file_priv);
 
 	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
 	if (unlikely(ret != 0))

From a1073aad497d0d071a71f61b721966a176d50c08 Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Tue, 10 Aug 2021 12:14:05 +0800
Subject: [PATCH 0206/1750] Bluetooth: schedule SCO timeouts with delayed_work

[ Upstream commit ba316be1b6a00db7126ed9a39f9bee434a508043 ]

struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.

This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.

This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
       CPU0
       ----
  lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
  <Interrupt>
    lock(slock-AF_BLUETOOTH-BTPROTO_SCO);

To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.

As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.

Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.

Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/sco.c | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 600b1832e1dd..6a338c6926e0 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -48,6 +48,8 @@ struct sco_conn {
 	spinlock_t	lock;
 	struct sock	*sk;
 
+	struct delayed_work	timeout_work;
+
 	unsigned int    mtu;
 };
 
@@ -74,9 +76,20 @@ struct sco_pinfo {
 #define SCO_CONN_TIMEOUT	(HZ * 40)
 #define SCO_DISCONN_TIMEOUT	(HZ * 2)
 
-static void sco_sock_timeout(struct timer_list *t)
+static void sco_sock_timeout(struct work_struct *work)
 {
-	struct sock *sk = from_timer(sk, t, sk_timer);
+	struct sco_conn *conn = container_of(work, struct sco_conn,
+					     timeout_work.work);
+	struct sock *sk;
+
+	sco_conn_lock(conn);
+	sk = conn->sk;
+	if (sk)
+		sock_hold(sk);
+	sco_conn_unlock(conn);
+
+	if (!sk)
+		return;
 
 	BT_DBG("sock %p state %d", sk, sk->sk_state);
 
@@ -90,14 +103,21 @@ static void sco_sock_timeout(struct timer_list *t)
 
 static void sco_sock_set_timer(struct sock *sk, long timeout)
 {
+	if (!sco_pi(sk)->conn)
+		return;
+
 	BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
-	sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
+	cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
+	schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
 }
 
 static void sco_sock_clear_timer(struct sock *sk)
 {
+	if (!sco_pi(sk)->conn)
+		return;
+
 	BT_DBG("sock %p state %d", sk, sk->sk_state);
-	sk_stop_timer(sk, &sk->sk_timer);
+	cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
 }
 
 /* ---- SCO connections ---- */
@@ -177,6 +197,9 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
 		sco_chan_del(sk, err);
 		bh_unlock_sock(sk);
 		sock_put(sk);
+
+		/* Ensure no more work items will run before freeing conn. */
+		cancel_delayed_work_sync(&conn->timeout_work);
 	}
 
 	hcon->sco_data = NULL;
@@ -191,6 +214,8 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
 	sco_pi(sk)->conn = conn;
 	conn->sk = sk;
 
+	INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
+
 	if (parent)
 		bt_accept_enqueue(parent, sk, true);
 }
@@ -496,8 +521,6 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
 
 	sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
 
-	timer_setup(&sk->sk_timer, sco_sock_timeout, 0);
-
 	bt_sock_link(&sco_sk_list, sk);
 	return sk;
 }

From 98d44b7be6f1bcfd4f824c5f8bc2b742f890879f Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Tue, 10 Aug 2021 12:14:06 +0800
Subject: [PATCH 0207/1750] Bluetooth: avoid circular locks in sco_sock_connect

[ Upstream commit 734bc5ff783115aa3164f4e9dd5967ae78e0a8ab ]

In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.

However, doing so results in a circular locking dependency:

======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191

but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:959 [inline]
       __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
       hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
       hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
       hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
       hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
       process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
       worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
       kthread+0x3e5/0x4d0 kernel/kthread.c:319
       ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

-> #1 (&hdev->lock){+.+.}-{3:3}:
       __mutex_lock_common kernel/locking/mutex.c:959 [inline]
       __mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
       sco_connect net/bluetooth/sco.c:245 [inline]
       sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
       __sys_connect_file+0x155/0x1a0 net/socket.c:1879
       __sys_connect+0x161/0x190 net/socket.c:1896
       __do_sys_connect net/socket.c:1906 [inline]
       __se_sys_connect net/socket.c:1903 [inline]
       __x64_sys_connect+0x6f/0xb0 net/socket.c:1903
       do_syscall_x64 arch/x86/entry/common.c:50 [inline]
       do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
       check_prev_add kernel/locking/lockdep.c:3051 [inline]
       check_prevs_add kernel/locking/lockdep.c:3174 [inline]
       validate_chain kernel/locking/lockdep.c:3789 [inline]
       __lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
       lock_acquire kernel/locking/lockdep.c:5625 [inline]
       lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
       lock_sock_nested+0xca/0x120 net/core/sock.c:3170
       lock_sock include/net/sock.h:1613 [inline]
       sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
       sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
       hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
       hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
       hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
       hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
       vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
       __fput+0x288/0x920 fs/file_table.c:280
       task_work_run+0xdd/0x1a0 kernel/task_work.c:164
       exit_task_work include/linux/task_work.h:32 [inline]
       do_exit+0xbd4/0x2a60 kernel/exit.c:825
       do_group_exit+0x125/0x310 kernel/exit.c:922
       get_signal+0x47f/0x2160 kernel/signal.c:2808
       arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
       handle_signal_work kernel/entry/common.c:148 [inline]
       exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
       exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
       __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
       syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
       ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288

other info that might help us debug this:

Chain exists of:
  sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(hci_cb_list_lock);
                               lock(&hdev->lock);
                               lock(hci_cb_list_lock);
  lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);

 *** DEADLOCK ***

The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:

  hci_dev_do_close():
    hci_dev_lock();
    hci_conn_hash_flush():
      hci_disconn_cfm():
        mutex_lock(&hci_cb_list_lock);
        sco_disconn_cfm():
        sco_conn_del():
          lock_sock(sk);

However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.

We fix this by pulling the call to hci_dev_lock out from sco_connect.

Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/sco.c | 39 ++++++++++++++++-----------------------
 1 file changed, 16 insertions(+), 23 deletions(-)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 6a338c6926e0..7c24a9acbc45 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -235,44 +235,32 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
 	return err;
 }
 
-static int sco_connect(struct sock *sk)
+static int sco_connect(struct hci_dev *hdev, struct sock *sk)
 {
 	struct sco_conn *conn;
 	struct hci_conn *hcon;
-	struct hci_dev  *hdev;
 	int err, type;
 
 	BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
 
-	hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
-	if (!hdev)
-		return -EHOSTUNREACH;
-
-	hci_dev_lock(hdev);
-
 	if (lmp_esco_capable(hdev) && !disable_esco)
 		type = ESCO_LINK;
 	else
 		type = SCO_LINK;
 
 	if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
-	    (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
-		err = -EOPNOTSUPP;
-		goto done;
-	}
+	    (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)))
+		return -EOPNOTSUPP;
 
 	hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
 			       sco_pi(sk)->setting);
-	if (IS_ERR(hcon)) {
-		err = PTR_ERR(hcon);
-		goto done;
-	}
+	if (IS_ERR(hcon))
+		return PTR_ERR(hcon);
 
 	conn = sco_conn_add(hcon);
 	if (!conn) {
 		hci_conn_drop(hcon);
-		err = -ENOMEM;
-		goto done;
+		return -ENOMEM;
 	}
 
 	/* Update source addr of the socket */
@@ -280,7 +268,7 @@ static int sco_connect(struct sock *sk)
 
 	err = sco_chan_add(conn, sk, NULL);
 	if (err)
-		goto done;
+		return err;
 
 	if (hcon->state == BT_CONNECTED) {
 		sco_sock_clear_timer(sk);
@@ -290,9 +278,6 @@ static int sco_connect(struct sock *sk)
 		sco_sock_set_timer(sk, sk->sk_sndtimeo);
 	}
 
-done:
-	hci_dev_unlock(hdev);
-	hci_dev_put(hdev);
 	return err;
 }
 
@@ -585,6 +570,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
 {
 	struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
 	struct sock *sk = sock->sk;
+	struct hci_dev  *hdev;
 	int err;
 
 	BT_DBG("sk %p", sk);
@@ -599,12 +585,19 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
 	if (sk->sk_type != SOCK_SEQPACKET)
 		return -EINVAL;
 
+	hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR);
+	if (!hdev)
+		return -EHOSTUNREACH;
+	hci_dev_lock(hdev);
+
 	lock_sock(sk);
 
 	/* Set destination address and psm */
 	bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
 
-	err = sco_connect(sk);
+	err = sco_connect(hdev, sk);
+	hci_dev_unlock(hdev);
+	hci_dev_put(hdev);
 	if (err)
 		goto done;
 

From f86bc4a1a401d3691bad41e67f9db0c2ea94da32 Mon Sep 17 00:00:00 2001
From: Kuogee Hsieh <khsieh@codeaurora.org>
Date: Thu, 5 Aug 2021 13:44:54 -0700
Subject: [PATCH 0208/1750] drm/msm/dp: return correct edid checksum after
 corrupted edid checksum read

[ Upstream commit 7948fe12d47a946fb8025a0534c900e3dd4b5839 ]

Response with correct edid checksum saved at connector after corrupted edid
checksum read. This fixes Link Layer CTS cases 4.2.2.3, 4.2.2.6.

Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/1628196295-7382-6-git-send-email-khsieh@codeaurora.org
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_panel.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_panel.c b/drivers/gpu/drm/msm/dp/dp_panel.c
index 18cec4fc5e0b..2768d1d306f0 100644
--- a/drivers/gpu/drm/msm/dp/dp_panel.c
+++ b/drivers/gpu/drm/msm/dp/dp_panel.c
@@ -261,7 +261,7 @@ static u8 dp_panel_get_edid_checksum(struct edid *edid)
 {
 	struct edid *last_block;
 	u8 *raw_edid;
-	bool is_edid_corrupt;
+	bool is_edid_corrupt = false;
 
 	if (!edid) {
 		DRM_ERROR("invalid edid input\n");
@@ -293,7 +293,12 @@ void dp_panel_handle_sink_request(struct dp_panel *dp_panel)
 	panel = container_of(dp_panel, struct dp_panel_private, dp_panel);
 
 	if (panel->link->sink_request & DP_TEST_LINK_EDID_READ) {
-		u8 checksum = dp_panel_get_edid_checksum(dp_panel->edid);
+		u8 checksum;
+
+		if (dp_panel->edid)
+			checksum = dp_panel_get_edid_checksum(dp_panel->edid);
+		else
+			checksum = dp_panel->connector->real_edid_checksum;
 
 		dp_link_send_edid_checksum(panel->link, checksum);
 		dp_link_send_test_response(panel->link);

From 155e7047909d871f2910bf24b66432c23a2a11e4 Mon Sep 17 00:00:00 2001
From: Eran Ben Elisha <eranbe@nvidia.com>
Date: Tue, 10 Aug 2021 21:15:05 +0300
Subject: [PATCH 0209/1750] net/mlx5: Fix variable type to match 64bit

[ Upstream commit 979aa51967add26b37f9d77e01729d44a2da8e5f ]

Fix the following smatch warning:
wait_func_handle_exec_timeout() warn: should '1 << ent->idx' be a 64 bit type?

Use 1ULL, to have a 64 bit type variable.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Eran Ben Elisha <eranbe@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index e49387dbef98..2e55e0088871 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -865,7 +865,7 @@ static void cb_timeout_handler(struct work_struct *work)
 	ent->ret = -ETIMEDOUT;
 	mlx5_core_warn(dev, "cmd[%d]: %s(0x%x) Async, timeout. Will cause a leak of a command resource\n",
 		       ent->idx, mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in));
-	mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+	mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true);
 
 out:
 	cmd_ent_put(ent); /* for the cmd_ent_get() took on schedule delayed work */
@@ -982,7 +982,7 @@ static void cmd_work_handler(struct work_struct *work)
 		MLX5_SET(mbox_out, ent->out, status, status);
 		MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
 
-		mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true);
 		return;
 	}
 
@@ -996,7 +996,7 @@ static void cmd_work_handler(struct work_struct *work)
 		poll_timeout(ent);
 		/* make sure we read the descriptor after ownership is SW */
 		rmb();
-		mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT));
+		mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT));
 	}
 }
 
@@ -1056,7 +1056,7 @@ static void wait_func_handle_exec_timeout(struct mlx5_core_dev *dev,
 		       mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in));
 
 	ent->ret = -ETIMEDOUT;
-	mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+	mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true);
 }
 
 static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)

From 2254383788ff93a423e20068333b9f8376d56cb4 Mon Sep 17 00:00:00 2001
From: Tuo Li <islituo@gmail.com>
Date: Wed, 11 Aug 2021 04:34:58 -0700
Subject: [PATCH 0210/1750] gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible
 uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()

[ Upstream commit a211260c34cfadc6068fece8c9e99e0fe1e2a2b6 ]

The variable val is declared without initialization, and its address is
passed to amdgpu_i2c_get_byte(). In this function, the value of val is
accessed in:
  DRM_DEBUG("i2c 0x%02x 0x%02x read failed\n",
       addr, *val);

Also, when amdgpu_i2c_get_byte() returns, val may remain uninitialized,
but it is accessed in:
  val &= ~amdgpu_connector->router.ddc_mux_control_pin;

To fix this possible uninitialized-variable access, initialize val to 0 in
amdgpu_i2c_router_select_ddc_port().

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
index 47cad23a6b9e..b91d3d29b410 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c
@@ -339,7 +339,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan *i2c_bus,
 void
 amdgpu_i2c_router_select_ddc_port(const struct amdgpu_connector *amdgpu_connector)
 {
-	u8 val;
+	u8 val = 0;
 
 	if (!amdgpu_connector->router.ddc_valid)
 		return;

From 83449db3aac0895147eac723bf23d0739720b968 Mon Sep 17 00:00:00 2001
From: Tuo Li <islituo@gmail.com>
Date: Tue, 10 Aug 2021 21:07:03 -0700
Subject: [PATCH 0211/1750] drm/display: fix possible null-pointer dereference
 in dcn10_set_clock()

[ Upstream commit 554594567b1fa3da74f88ec7b2dc83d000c58e98 ]

The variable dc->clk_mgr is checked in:
  if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)

This indicates dc->clk_mgr can be NULL.
However, it is dereferenced in:
    if (!dc->clk_mgr->funcs->get_clock)

To fix this null-pointer dereference, check dc->clk_mgr and the function
pointer dc->clk_mgr->funcs->get_clock earlier, and return if one of them
is NULL.

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 0d1e7b56fb39..532f6a1145b5 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3740,13 +3740,12 @@ enum dc_status dcn10_set_clock(struct dc *dc,
 	struct dc_clock_config clock_cfg = {0};
 	struct dc_clocks *current_clocks = &context->bw_ctx.bw.dcn.clk;
 
-	if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock)
-				dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
-						context, clock_type, &clock_cfg);
-
-	if (!dc->clk_mgr->funcs->get_clock)
+	if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock)
 		return DC_FAIL_UNSUPPORTED_1;
 
+	dc->clk_mgr->funcs->get_clock(dc->clk_mgr,
+		context, clock_type, &clock_cfg);
+
 	if (clk_khz > clock_cfg.max_clock_khz)
 		return DC_FAIL_CLK_EXCEED_MAX;
 
@@ -3764,7 +3763,7 @@ enum dc_status dcn10_set_clock(struct dc *dc,
 	else
 		return DC_ERROR_UNEXPECTED;
 
-	if (dc->clk_mgr && dc->clk_mgr->funcs->update_clocks)
+	if (dc->clk_mgr->funcs->update_clocks)
 				dc->clk_mgr->funcs->update_clocks(dc->clk_mgr,
 				context, true);
 	return DC_OK;

From 9713dfa5185ac06efa5998c61d4287d8306f60f4 Mon Sep 17 00:00:00 2001
From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Date: Mon, 28 Jun 2021 14:32:46 +0200
Subject: [PATCH 0212/1750] mac80211: Fix monitor MTU limit so that A-MSDUs get
 through

[ Upstream commit 79f5962baea74ce1cd4e5949598944bff854b166 ]

The maximum MTU was set to 2304, which is the maximum MSDU size. While
this is valid for normal WLAN interfaces, it is too low for monitor
interfaces. A monitor interface may receive and inject MPDU frames, and
the maximum MPDU frame size is larger than 2304. The MPDU may also
contain an A-MSDU frame, in which case the size may be much larger than
the MTU limit. Since the maximum size of an A-MSDU depends on the PHY
mode of the transmitting STA, it is not possible to set an exact MTU
limit for a monitor interface. Now the maximum MTU for a monitor
interface is unrestricted.

Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Link: https://lore.kernel.org/r/20210628123246.2070558-1-johan.almbladh@anyfinetworks.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/iface.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 30589b4c09da..3a15ef8dd322 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -2000,9 +2000,16 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
 		netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops);
 
-		/* MTU range: 256 - 2304 */
+		/* MTU range is normally 256 - 2304, where the upper limit is
+		 * the maximum MSDU size. Monitor interfaces send and receive
+		 * MPDU and A-MSDU frames which may be much larger so we do
+		 * not impose an upper limit in that case.
+		 */
 		ndev->min_mtu = 256;
-		ndev->max_mtu = local->hw.max_mtu;
+		if (type == NL80211_IFTYPE_MONITOR)
+			ndev->max_mtu = 0;
+		else
+			ndev->max_mtu = local->hw.max_mtu;
 
 		ret = register_netdevice(ndev);
 		if (ret) {

From 035e8d5a6dd8a7b4632925fb24647ae7385c9057 Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Tue, 3 Aug 2021 00:19:43 +0300
Subject: [PATCH 0213/1750] ARM: tegra: acer-a500: Remove bogus USB VBUS
 regulators

[ Upstream commit 70e740ad55e5f93a19493720f4105555fade4a73 ]

The configuration of USB VBUS regulators was borrowed from downstream
kernel, which is incorrect because the corresponding GPIOs are connected
to PROX_EN (A501 3G model) and LED_EN pins in accordance to the board
schematics. USB works fine with both GPIOs being disabled, so remove the
bogus USB VBUS regulators. The USB VBUS of USB3 is supplied from the fixed
5v system regulator and device-mode USB1 doesn't have VBUS switches.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../boot/dts/tegra20-acer-a500-picasso.dts    | 25 +------------------
 1 file changed, 1 insertion(+), 24 deletions(-)

diff --git a/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts b/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts
index 5d0f0fbba1d2..5dbfb83c1b06 100644
--- a/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts
+++ b/arch/arm/boot/dts/tegra20-acer-a500-picasso.dts
@@ -704,7 +704,6 @@ usb-phy@c5000000 {
 		nvidia,xcvr-setup-use-fuses;
 		nvidia,xcvr-lsfslew = <2>;
 		nvidia,xcvr-lsrslew = <2>;
-		vbus-supply = <&vdd_vbus1>;
 	};
 
 	usb@c5008000 {
@@ -716,7 +715,7 @@ usb-phy@c5008000 {
 		nvidia,xcvr-setup-use-fuses;
 		nvidia,xcvr-lsfslew = <2>;
 		nvidia,xcvr-lsrslew = <2>;
-		vbus-supply = <&vdd_vbus3>;
+		vbus-supply = <&vdd_5v0_sys>;
 	};
 
 	brcm_wifi_pwrseq: wifi-pwrseq {
@@ -967,28 +966,6 @@ vdd_pnl: regulator@3 {
 		vin-supply = <&vdd_5v0_sys>;
 	};
 
-	vdd_vbus1: regulator@4 {
-		compatible = "regulator-fixed";
-		regulator-name = "vdd_usb1_vbus";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		regulator-always-on;
-		gpio = <&gpio TEGRA_GPIO(D, 0) GPIO_ACTIVE_HIGH>;
-		enable-active-high;
-		vin-supply = <&vdd_5v0_sys>;
-	};
-
-	vdd_vbus3: regulator@5 {
-		compatible = "regulator-fixed";
-		regulator-name = "vdd_usb3_vbus";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		regulator-always-on;
-		gpio = <&gpio TEGRA_GPIO(D, 3) GPIO_ACTIVE_HIGH>;
-		enable-active-high;
-		vin-supply = <&vdd_5v0_sys>;
-	};
-
 	sound {
 		compatible = "nvidia,tegra-audio-wm8903-picasso",
 			     "nvidia,tegra-audio-wm8903";

From 9c2b89f64f2e803c2ac9473e4889742c53440890 Mon Sep 17 00:00:00 2001
From: Andreas Obergschwandtner <andreas.obergschwandtner@gmail.com>
Date: Thu, 29 Jul 2021 16:42:26 +0200
Subject: [PATCH 0214/1750] ARM: tegra: tamonten: Fix UART pad setting

[ Upstream commit 2270ad2f4e123336af685ecedd1618701cb4ca1e ]

This patch fixes the tristate and pullup configuration for UART 1 to 3
on the Tamonten SOM.

Signed-off-by: Andreas Obergschwandtner <andreas.obergschwandtner@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi
index 95e6bccdb4f6..dd4d506683de 100644
--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi
+++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi
@@ -185,8 +185,9 @@ conf_ata {
 				nvidia,pins = "ata", "atb", "atc", "atd", "ate",
 					"cdev1", "cdev2", "dap1", "dtb", "gma",
 					"gmb", "gmc", "gmd", "gme", "gpu7",
-					"gpv", "i2cp", "pta", "rm", "slxa",
-					"slxk", "spia", "spib", "uac";
+					"gpv", "i2cp", "irrx", "irtx", "pta",
+					"rm", "slxa", "slxk", "spia", "spib",
+					"uac";
 				nvidia,pull = <TEGRA_PIN_PULL_NONE>;
 				nvidia,tristate = <TEGRA_PIN_DISABLE>;
 			};
@@ -211,7 +212,7 @@ conf_crtp {
 			conf_ddc {
 				nvidia,pins = "ddc", "dta", "dtd", "kbca",
 					"kbcb", "kbcc", "kbcd", "kbce", "kbcf",
-					"sdc";
+					"sdc", "uad", "uca";
 				nvidia,pull = <TEGRA_PIN_PULL_UP>;
 				nvidia,tristate = <TEGRA_PIN_DISABLE>;
 			};
@@ -221,10 +222,9 @@ conf_hdint {
 					"lvp0", "owc", "sdb";
 				nvidia,tristate = <TEGRA_PIN_ENABLE>;
 			};
-			conf_irrx {
-				nvidia,pins = "irrx", "irtx", "sdd", "spic",
-					"spie", "spih", "uaa", "uab", "uad",
-					"uca", "ucb";
+			conf_sdd {
+				nvidia,pins = "sdd", "spic", "spie", "spih",
+					"uaa", "uab", "ucb";
 				nvidia,pull = <TEGRA_PIN_PULL_UP>;
 				nvidia,tristate = <TEGRA_PIN_ENABLE>;
 			};

From aa06cfc5291ca824632fbebe35a2ae8161ce7790 Mon Sep 17 00:00:00 2001
From: Thierry Reding <treding@nvidia.com>
Date: Tue, 22 Jun 2021 15:44:22 +0200
Subject: [PATCH 0215/1750] arm64: tegra: Fix compatible string for Tegra132
 CPUs

[ Upstream commit f865d0292ff3c0ca09414436510eb4c815815509 ]

The documented compatible string for the CPUs found on Tegra132 is
"nvidia,tegra132-denver", rather than the previously used compatible
string "nvidia,denver".

Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/nvidia/tegra132.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/nvidia/tegra132.dtsi b/arch/arm64/boot/dts/nvidia/tegra132.dtsi
index e40281510c0c..b14e9f3bfdbd 100644
--- a/arch/arm64/boot/dts/nvidia/tegra132.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra132.dtsi
@@ -1215,13 +1215,13 @@ cpus {
 
 		cpu@0 {
 			device_type = "cpu";
-			compatible = "nvidia,denver";
+			compatible = "nvidia,tegra132-denver";
 			reg = <0>;
 		};
 
 		cpu@1 {
 			device_type = "cpu";
-			compatible = "nvidia,denver";
+			compatible = "nvidia,tegra132-denver";
 			reg = <1>;
 		};
 	};

From 27e8bc1f5b32509ff40e9a9ed64ca071f42e7c5c Mon Sep 17 00:00:00 2001
From: Raag Jadav <raagjadav@gmail.com>
Date: Thu, 5 Aug 2021 00:54:45 +0530
Subject: [PATCH 0216/1750] arm64: dts: ls1046a: fix eeprom entries

[ Upstream commit c1a6018d1839c9cb8f807dc863a50102a1a5c412 ]

ls1046afrwy and ls1046ardb boards have CAT24C04[1] and CAT24C05[2]
eeproms respectively. Both are 4Kb (512 bytes) in size,
and compatible with AT24C04[3].
Remove multi-address entries, as both the boards have a single chip each.

[1] https://www.onsemi.com/pdf/datasheet/cat24c01-d.pdf
[2] https://www.onsemi.com/pdf/datasheet/cat24c03-d.pdf
[3] https://ww1.microchip.com/downloads/en/DeviceDoc/doc0180.pdf

Signed-off-by: Raag Jadav <raagjadav@gmail.com>
Acked-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts | 8 +-------
 arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts  | 7 +------
 2 files changed, 2 insertions(+), 13 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts
index db3d303093f6..6d22efbd645c 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts
@@ -83,15 +83,9 @@ rtc@51 {
 			};
 
 			eeprom@52 {
-				compatible = "atmel,24c512";
+				compatible = "onnn,cat24c04", "atmel,24c04";
 				reg = <0x52>;
 			};
-
-			eeprom@53 {
-				compatible = "atmel,24c512";
-				reg = <0x53>;
-			};
-
 		};
 	};
 };
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
index d53ccc56bb63..07139e35686d 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts
@@ -58,14 +58,9 @@ temp-sensor@4c {
 	};
 
 	eeprom@52 {
-		compatible = "atmel,24c512";
+		compatible = "onnn,cat24c05", "atmel,24c04";
 		reg = <0x52>;
 	};
-
-	eeprom@53 {
-		compatible = "atmel,24c512";
-		reg = <0x53>;
-	};
 };
 
 &i2c3 {

From 24618e92d50f647774cec82a630bf25053d23fee Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@grimberg.me>
Date: Wed, 16 Jun 2021 14:19:35 -0700
Subject: [PATCH 0217/1750] nvme-tcp: don't check blk_mq_tag_to_rq when
 receiving pdu data

[ Upstream commit 3b01a9d0caa8276d9ce314e09610f7fb70f49a00 ]

We already validate it when receiving the c2hdata pdu header
and this is not changing so this is a redundant check.

Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/tcp.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 5b11d8a23813..986e5fbf31ad 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -699,17 +699,9 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
 			      unsigned int *offset, size_t *len)
 {
 	struct nvme_tcp_data_pdu *pdu = (void *)queue->pdu;
-	struct nvme_tcp_request *req;
-	struct request *rq;
-
-	rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
-	if (!rq) {
-		dev_err(queue->ctrl->ctrl.device,
-			"queue %d tag %#x not found\n",
-			nvme_tcp_queue_id(queue), pdu->command_id);
-		return -ENOENT;
-	}
-	req = blk_mq_rq_to_pdu(rq);
+	struct request *rq =
+		blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
+	struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
 
 	while (true) {
 		int recv_len, ret;

From 240a7025a6f89f9596c36134bd07f3855c56c712 Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@grimberg.me>
Date: Wed, 16 Jun 2021 14:19:36 -0700
Subject: [PATCH 0218/1750] nvme: code command_id with a genctr for
 use-after-free validation

[ Upstream commit e7006de6c23803799be000a5dcce4d916a36541a ]

We cannot detect a (perhaps buggy) controller that is sending us
a completion for a request that was already completed (for example
sending a completion twice), this phenomenon was seen in the wild
a few times.

So to protect against this, we use the upper 4 msbits of the nvme sqe
command_id to use as a 4-bit generation counter and verify it matches
the existing request generation that is incrementing on every execution.

The 16-bit command_id structure now is constructed by:
| xxxx | xxxxxxxxxxxx |
  gen    request tag

This means that we are giving up some possible queue depth as 12 bits
allow for a maximum queue depth of 4095 instead of 65536, however we
never create such long queues anyways so no real harm done.

Suggested-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Acked-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Tested-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c   |  3 ++-
 drivers/nvme/host/nvme.h   | 47 +++++++++++++++++++++++++++++++++++++-
 drivers/nvme/host/pci.c    |  2 +-
 drivers/nvme/host/rdma.c   |  4 ++--
 drivers/nvme/host/tcp.c    | 26 ++++++++++-----------
 drivers/nvme/target/loop.c |  4 ++--
 6 files changed, 66 insertions(+), 20 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index ff5a16b17133..5a9b2f1b1418 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -878,7 +878,8 @@ blk_status_t nvme_setup_cmd(struct nvme_ns *ns, struct request *req,
 		return BLK_STS_IOERR;
 	}
 
-	cmd->common.command_id = req->tag;
+	nvme_req(req)->genctr++;
+	cmd->common.command_id = nvme_cid(req);
 	trace_nvme_setup_cmd(req, cmd);
 	return ret;
 }
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 3cb3c82061d7..8c735c55c15b 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -153,6 +153,7 @@ enum nvme_quirks {
 struct nvme_request {
 	struct nvme_command	*cmd;
 	union nvme_result	result;
+	u8			genctr;
 	u8			retries;
 	u8			flags;
 	u16			status;
@@ -469,6 +470,49 @@ struct nvme_ctrl_ops {
 	int (*get_address)(struct nvme_ctrl *ctrl, char *buf, int size);
 };
 
+/*
+ * nvme command_id is constructed as such:
+ * | xxxx | xxxxxxxxxxxx |
+ *   gen    request tag
+ */
+#define nvme_genctr_mask(gen)			(gen & 0xf)
+#define nvme_cid_install_genctr(gen)		(nvme_genctr_mask(gen) << 12)
+#define nvme_genctr_from_cid(cid)		((cid & 0xf000) >> 12)
+#define nvme_tag_from_cid(cid)			(cid & 0xfff)
+
+static inline u16 nvme_cid(struct request *rq)
+{
+	return nvme_cid_install_genctr(nvme_req(rq)->genctr) | rq->tag;
+}
+
+static inline struct request *nvme_find_rq(struct blk_mq_tags *tags,
+		u16 command_id)
+{
+	u8 genctr = nvme_genctr_from_cid(command_id);
+	u16 tag = nvme_tag_from_cid(command_id);
+	struct request *rq;
+
+	rq = blk_mq_tag_to_rq(tags, tag);
+	if (unlikely(!rq)) {
+		pr_err("could not locate request for tag %#x\n",
+			tag);
+		return NULL;
+	}
+	if (unlikely(nvme_genctr_mask(nvme_req(rq)->genctr) != genctr)) {
+		dev_err(nvme_req(rq)->ctrl->device,
+			"request %#x genctr mismatch (got %#x expected %#x)\n",
+			tag, genctr, nvme_genctr_mask(nvme_req(rq)->genctr));
+		return NULL;
+	}
+	return rq;
+}
+
+static inline struct request *nvme_cid_to_rq(struct blk_mq_tags *tags,
+                u16 command_id)
+{
+	return blk_mq_tag_to_rq(tags, nvme_tag_from_cid(command_id));
+}
+
 #ifdef CONFIG_FAULT_INJECTION_DEBUG_FS
 void nvme_fault_inject_init(struct nvme_fault_inject *fault_inj,
 			    const char *dev_name);
@@ -566,7 +610,8 @@ static inline void nvme_put_ctrl(struct nvme_ctrl *ctrl)
 
 static inline bool nvme_is_aen_req(u16 qid, __u16 command_id)
 {
-	return !qid && command_id >= NVME_AQ_BLK_MQ_DEPTH;
+	return !qid &&
+		nvme_tag_from_cid(command_id) >= NVME_AQ_BLK_MQ_DEPTH;
 }
 
 void nvme_complete_rq(struct request *req);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index fb48a88d1acb..09767a805492 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1012,7 +1012,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
 		return;
 	}
 
-	req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), command_id);
+	req = nvme_find_rq(nvme_queue_tagset(nvmeq), command_id);
 	if (unlikely(!req)) {
 		dev_warn(nvmeq->dev->ctrl.device,
 			"invalid id %d completed on queue %d\n",
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index c6c2e2361b2f..9c356be7f016 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1738,10 +1738,10 @@ static void nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
 	struct request *rq;
 	struct nvme_rdma_request *req;
 
-	rq = blk_mq_tag_to_rq(nvme_rdma_tagset(queue), cqe->command_id);
+	rq = nvme_find_rq(nvme_rdma_tagset(queue), cqe->command_id);
 	if (!rq) {
 		dev_err(queue->ctrl->ctrl.device,
-			"tag 0x%x on QP %#x not found\n",
+			"got bad command_id %#x on QP %#x\n",
 			cqe->command_id, queue->qp->qp_num);
 		nvme_rdma_error_recovery(queue->ctrl);
 		return;
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 986e5fbf31ad..c9a925999c6e 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -484,11 +484,11 @@ static int nvme_tcp_process_nvme_cqe(struct nvme_tcp_queue *queue,
 {
 	struct request *rq;
 
-	rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), cqe->command_id);
+	rq = nvme_find_rq(nvme_tcp_tagset(queue), cqe->command_id);
 	if (!rq) {
 		dev_err(queue->ctrl->ctrl.device,
-			"queue %d tag 0x%x not found\n",
-			nvme_tcp_queue_id(queue), cqe->command_id);
+			"got bad cqe.command_id %#x on queue %d\n",
+			cqe->command_id, nvme_tcp_queue_id(queue));
 		nvme_tcp_error_recovery(&queue->ctrl->ctrl);
 		return -EINVAL;
 	}
@@ -505,11 +505,11 @@ static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue,
 {
 	struct request *rq;
 
-	rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
+	rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);
 	if (!rq) {
 		dev_err(queue->ctrl->ctrl.device,
-			"queue %d tag %#x not found\n",
-			nvme_tcp_queue_id(queue), pdu->command_id);
+			"got bad c2hdata.command_id %#x on queue %d\n",
+			pdu->command_id, nvme_tcp_queue_id(queue));
 		return -ENOENT;
 	}
 
@@ -603,7 +603,7 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
 	data->hdr.plen =
 		cpu_to_le32(data->hdr.hlen + hdgst + req->pdu_len + ddgst);
 	data->ttag = pdu->ttag;
-	data->command_id = rq->tag;
+	data->command_id = nvme_cid(rq);
 	data->data_offset = cpu_to_le32(req->data_sent);
 	data->data_length = cpu_to_le32(req->pdu_len);
 	return 0;
@@ -616,11 +616,11 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue,
 	struct request *rq;
 	int ret;
 
-	rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
+	rq = nvme_find_rq(nvme_tcp_tagset(queue), pdu->command_id);
 	if (!rq) {
 		dev_err(queue->ctrl->ctrl.device,
-			"queue %d tag %#x not found\n",
-			nvme_tcp_queue_id(queue), pdu->command_id);
+			"got bad r2t.command_id %#x on queue %d\n",
+			pdu->command_id, nvme_tcp_queue_id(queue));
 		return -ENOENT;
 	}
 	req = blk_mq_rq_to_pdu(rq);
@@ -700,7 +700,7 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb,
 {
 	struct nvme_tcp_data_pdu *pdu = (void *)queue->pdu;
 	struct request *rq =
-		blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
+		nvme_cid_to_rq(nvme_tcp_tagset(queue), pdu->command_id);
 	struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq);
 
 	while (true) {
@@ -793,8 +793,8 @@ static int nvme_tcp_recv_ddgst(struct nvme_tcp_queue *queue,
 	}
 
 	if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS) {
-		struct request *rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue),
-						pdu->command_id);
+		struct request *rq = nvme_cid_to_rq(nvme_tcp_tagset(queue),
+					pdu->command_id);
 
 		nvme_tcp_end_request(rq, NVME_SC_SUCCESS);
 		queue->nr_cqe++;
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 16d71cc5a50e..ff3258c3eb8b 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -107,10 +107,10 @@ static void nvme_loop_queue_response(struct nvmet_req *req)
 	} else {
 		struct request *rq;
 
-		rq = blk_mq_tag_to_rq(nvme_loop_tagset(queue), cqe->command_id);
+		rq = nvme_find_rq(nvme_loop_tagset(queue), cqe->command_id);
 		if (!rq) {
 			dev_err(queue->ctrl->ctrl.device,
-				"tag 0x%x on queue %d not found\n",
+				"got bad command_id %#x on queue %d\n",
 				cqe->command_id, nvme_loop_queue_idx(queue));
 			return;
 		}

From 6698029de35b780f382495315798f3f504d2c4a5 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Wed, 11 Aug 2021 16:20:15 -0700
Subject: [PATCH 0219/1750] Bluetooth: Fix handling of LE Enhanced Connection
 Complete

[ Upstream commit cafae4cd625502f65d1798659c1aa9b62d38cc56 ]

LE Enhanced Connection Complete contains the Local RPA used in the
connection which must be used when set otherwise there could problems
when pairing since the address used by the remote stack could be the
Local RPA:

BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 4, Part E
page 2396

  'Resolvable Private Address being used by the local device for this
  connection. This is only valid when the Own_Address_Type (from the
  HCI_LE_Create_Connection, HCI_LE_Set_Advertising_Parameters,
  HCI_LE_Set_Extended_Advertising_Parameters, or
  HCI_LE_Extended_Create_Connection commands) is set to 0x02 or
  0x03, and the Controller generated a resolvable private address for the
  local device using a non-zero local IRK. For other Own_Address_Type
  values, the Controller shall return all zeros.'

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_event.c | 93 ++++++++++++++++++++++++++-------------
 1 file changed, 62 insertions(+), 31 deletions(-)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 45de2d8b9a9d..9f52145bb7b7 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5070,9 +5070,64 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
 }
 #endif
 
+static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
+				u8 bdaddr_type, bdaddr_t *local_rpa)
+{
+	if (conn->out) {
+		conn->dst_type = bdaddr_type;
+		conn->resp_addr_type = bdaddr_type;
+		bacpy(&conn->resp_addr, bdaddr);
+
+		/* Check if the controller has set a Local RPA then it must be
+		 * used instead or hdev->rpa.
+		 */
+		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
+			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
+			bacpy(&conn->init_addr, local_rpa);
+		} else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
+			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
+			bacpy(&conn->init_addr, &conn->hdev->rpa);
+		} else {
+			hci_copy_identity_address(conn->hdev, &conn->init_addr,
+						  &conn->init_addr_type);
+		}
+	} else {
+		conn->resp_addr_type = conn->hdev->adv_addr_type;
+		/* Check if the controller has set a Local RPA then it must be
+		 * used instead or hdev->rpa.
+		 */
+		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
+			conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
+			bacpy(&conn->resp_addr, local_rpa);
+		} else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
+			/* In case of ext adv, resp_addr will be updated in
+			 * Adv Terminated event.
+			 */
+			if (!ext_adv_capable(conn->hdev))
+				bacpy(&conn->resp_addr,
+				      &conn->hdev->random_addr);
+		} else {
+			bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
+		}
+
+		conn->init_addr_type = bdaddr_type;
+		bacpy(&conn->init_addr, bdaddr);
+
+		/* For incoming connections, set the default minimum
+		 * and maximum connection interval. They will be used
+		 * to check if the parameters are in range and if not
+		 * trigger the connection update procedure.
+		 */
+		conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
+		conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
+	}
+}
+
 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
-			bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
-			u16 interval, u16 latency, u16 supervision_timeout)
+				 bdaddr_t *bdaddr, u8 bdaddr_type,
+				 bdaddr_t *local_rpa, u8 role, u16 handle,
+				 u16 interval, u16 latency,
+				 u16 supervision_timeout)
 {
 	struct hci_conn_params *params;
 	struct hci_conn *conn;
@@ -5120,32 +5175,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
 		cancel_delayed_work(&conn->le_conn_timeout);
 	}
 
-	if (!conn->out) {
-		/* Set the responder (our side) address type based on
-		 * the advertising address type.
-		 */
-		conn->resp_addr_type = hdev->adv_addr_type;
-		if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
-			/* In case of ext adv, resp_addr will be updated in
-			 * Adv Terminated event.
-			 */
-			if (!ext_adv_capable(hdev))
-				bacpy(&conn->resp_addr, &hdev->random_addr);
-		} else {
-			bacpy(&conn->resp_addr, &hdev->bdaddr);
-		}
-
-		conn->init_addr_type = bdaddr_type;
-		bacpy(&conn->init_addr, bdaddr);
-
-		/* For incoming connections, set the default minimum
-		 * and maximum connection interval. They will be used
-		 * to check if the parameters are in range and if not
-		 * trigger the connection update procedure.
-		 */
-		conn->le_conn_min_interval = hdev->le_conn_min_interval;
-		conn->le_conn_max_interval = hdev->le_conn_max_interval;
-	}
+	le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
 
 	/* Lookup the identity address from the stored connection
 	 * address and address type.
@@ -5239,7 +5269,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
 
 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
-			     ev->role, le16_to_cpu(ev->handle),
+			     NULL, ev->role, le16_to_cpu(ev->handle),
 			     le16_to_cpu(ev->interval),
 			     le16_to_cpu(ev->latency),
 			     le16_to_cpu(ev->supervision_timeout));
@@ -5253,7 +5283,7 @@ static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
 	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
 
 	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
-			     ev->role, le16_to_cpu(ev->handle),
+			     &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
 			     le16_to_cpu(ev->interval),
 			     le16_to_cpu(ev->latency),
 			     le16_to_cpu(ev->supervision_timeout));
@@ -5289,7 +5319,8 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	if (conn) {
 		struct adv_info *adv_instance;
 
-		if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
+		if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
+		    bacmp(&conn->resp_addr, BDADDR_ANY))
 			return;
 
 		if (!hdev->cur_adv_instance) {

From a99eec36ed39f7717827d15aeb329fe0e17396e5 Mon Sep 17 00:00:00 2001
From: Rajendra Nayak <rnayak@codeaurora.org>
Date: Thu, 12 Aug 2021 16:57:20 +0530
Subject: [PATCH 0220/1750] opp: Don't print an error if required-opps is
 missing

[ Upstream commit 020d86fc0df8b865f6dc168d88a7c2dccabd0a9e ]

The 'required-opps' property is considered optional, hence remove
the pr_err() in of_parse_required_opp() when we find the property is
missing.
While at it, also fix the return value of
of_get_required_opp_performance_state() when of_parse_required_opp()
fails, return a -ENODEV instead of the -EINVAL.

Signed-off-by: Rajendra Nayak <rnayak@codeaurora.org>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/opp/of.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/drivers/opp/of.c b/drivers/opp/of.c
index d92a1bfe1690..f83f4f6d7034 100644
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -95,15 +95,7 @@ static struct dev_pm_opp *_find_opp_of_np(struct opp_table *opp_table,
 static struct device_node *of_parse_required_opp(struct device_node *np,
 						 int index)
 {
-	struct device_node *required_np;
-
-	required_np = of_parse_phandle(np, "required-opps", index);
-	if (unlikely(!required_np)) {
-		pr_err("%s: Unable to parse required-opps: %pOF, index: %d\n",
-		       __func__, np, index);
-	}
-
-	return required_np;
+	return of_parse_phandle(np, "required-opps", index);
 }
 
 /* The caller must call dev_pm_opp_put_opp_table() after the table is used */
@@ -1193,7 +1185,7 @@ int of_get_required_opp_performance_state(struct device_node *np, int index)
 
 	required_np = of_parse_required_opp(np, index);
 	if (!required_np)
-		return -EINVAL;
+		return -ENODEV;
 
 	opp_table = _find_table_of_opp_np(required_np);
 	if (IS_ERR(opp_table)) {

From 49e2bcb7cf580f83fec96b29bf2b3774bdf1b930 Mon Sep 17 00:00:00 2001
From: Ulrich Hecht <uli+renesas@fpond.eu>
Date: Mon, 16 Aug 2021 18:22:01 +0200
Subject: [PATCH 0221/1750] serial: sh-sci: fix break handling for sysrq

[ Upstream commit 87b8061bad9bd4b549b2daf36ffbaa57be2789a2 ]

This fixes two issues that cause the sysrq sequence to be inadvertently
aborted on SCIF serial consoles:

- a NUL character remains in the RX queue after a break has been detected,
  which is then passed on to uart_handle_sysrq_char()
- the break interrupt is handled twice on controllers with multiplexed ERI
  and BRI interrupts

Signed-off-by: Ulrich Hecht <uli+renesas@fpond.eu>
Link: https://lore.kernel.org/r/20210816162201.28801-1-uli+renesas@fpond.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/sh-sci.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 70898a999a49..f700bfaef129 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1760,6 +1760,10 @@ static irqreturn_t sci_br_interrupt(int irq, void *ptr)
 
 	/* Handle BREAKs */
 	sci_handle_breaks(port);
+
+	/* drop invalid character received before break was detected */
+	serial_port_in(port, SCxRDR);
+
 	sci_clear_SCxSR(port, SCxSR_BREAK_CLEAR(port));
 
 	return IRQ_HANDLED;
@@ -1839,7 +1843,8 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr)
 		ret = sci_er_interrupt(irq, ptr);
 
 	/* Break Interrupt */
-	if ((ssr_status & SCxSR_BRK(port)) && err_enabled)
+	if (s->irqs[SCIx_ERI_IRQ] != s->irqs[SCIx_BRI_IRQ] &&
+	    (ssr_status & SCxSR_BRK(port)) && err_enabled)
 		ret = sci_br_interrupt(irq, ptr);
 
 	/* Overrun Interrupt */

From fca514f25c4d714d80aac858986b33dd092fefaf Mon Sep 17 00:00:00 2001
From: "Darrick J. Wong" <djwong@kernel.org>
Date: Tue, 10 Aug 2021 18:32:55 -0700
Subject: [PATCH 0222/1750] iomap: pass writeback errors to the mapping

[ Upstream commit b69eea82d37d9ee7cfb3bf05103549dd4ed5ffc3 ]

Modern-day mapping_set_error has the ability to squash the usual
negative error code into something appropriate for long-term storage in
a struct address_space -- ENOSPC becomes AS_ENOSPC, and everything else
becomes EIO.  iomap squashes /everything/ to EIO, just as XFS did before
that, but this doesn't make sense.

Fix this by making it so that we can pass ENOSPC to userspace when
writeback fails due to space problems.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/iomap/buffered-io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index 10cc7979ce38..caed9d98c64a 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -1045,7 +1045,7 @@ iomap_finish_page_writeback(struct inode *inode, struct page *page,
 
 	if (error) {
 		SetPageError(page);
-		mapping_set_error(inode->i_mapping, -EIO);
+		mapping_set_error(inode->i_mapping, error);
 	}
 
 	WARN_ON_ONCE(i_blocks_per_page(inode, page) > 1 && !iop);

From 4b1b4d3f45dffaaee29456f696aa38889ce5f001 Mon Sep 17 00:00:00 2001
From: Luke Hsiao <lukehsiao@google.com>
Date: Mon, 16 Aug 2021 20:51:06 +0000
Subject: [PATCH 0223/1750] tcp: enable data-less, empty-cookie SYN with
 TFO_SERVER_COOKIE_NOT_REQD

[ Upstream commit e3faa49bcecdfcc80e94dd75709d6acb1a5d89f6 ]

Since the original TFO server code was implemented in commit
168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef ("tcp: TCP Fast Open Server -
main code path") the TFO server code has supported the sysctl bit flag
TFO_SERVER_COOKIE_NOT_REQD. Currently, when the TFO_SERVER_ENABLE and
TFO_SERVER_COOKIE_NOT_REQD sysctl bit flags are set, a server connection
will accept a SYN with N bytes of data (N > 0) that has no TFO cookie,
create a new fast open connection, process the incoming data in the SYN,
and make the connection ready for accepting. After accepting, the
connection is ready for read()/recvmsg() to read the N bytes of data in
the SYN, ready for write()/sendmsg() calls and data transmissions to
transmit data.

This commit changes an edge case in this feature by changing this
behavior to apply to (N >= 0) bytes of data in the SYN rather than only
(N > 0) bytes of data in the SYN. Now, a server will accept a data-less
SYN without a TFO cookie if TFO_SERVER_COOKIE_NOT_REQD is set.

Caveat! While this enables a new kind of TFO (data-less empty-cookie
SYN), some firewall rules setup may not work if they assume such packets
are not legit TFOs and will filter them.

Signed-off-by: Luke Hsiao <lukehsiao@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20210816205105.2533289-1-luke.w.hsiao@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_fastopen.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index d49709ba8e16..107111984384 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -379,8 +379,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
 		return NULL;
 	}
 
-	if (syn_data &&
-	    tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
+	if (tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
 		goto fastopen;
 
 	if (foc->len == 0) {

From c53c68c9bf2a8543046360a1e75589f00c032d1a Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Thu, 12 Aug 2021 16:41:42 -0400
Subject: [PATCH 0224/1750] rpc: fix gss_svc_init cleanup on failure

[ Upstream commit 5a4753446253a427c0ff1e433b9c4933e5af207c ]

The failure case here should be rare, but it's obviously wrong.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 6dff64374bfe..e22f2d65457d 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1980,7 +1980,7 @@ gss_svc_init_net(struct net *net)
 		goto out2;
 	return 0;
 out2:
-	destroy_use_gss_proxy_proc_entry(net);
+	rsi_cache_destroy_net(net);
 out1:
 	rsc_cache_destroy_net(net);
 	return rv;

From 39738ebfad3969768d62d7432a38b910d960c7f8 Mon Sep 17 00:00:00 2001
From: Yonghong Song <yhs@fb.com>
Date: Tue, 17 Aug 2021 12:09:23 -0700
Subject: [PATCH 0225/1750] selftests/bpf: Fix flaky send_signal test

[ Upstream commit b16ac5bf732a5e23d164cf908ec7742d6a6120d3 ]

libbpf CI has reported send_signal test is flaky although
I am not able to reproduce it in my local environment.
But I am able to reproduce with on-demand libbpf CI ([1]).

Through code analysis, the following is possible reason.
The failed subtest runs bpf program in softirq environment.
Since bpf_send_signal() only sends to a fork of "test_progs"
process. If the underlying current task is
not "test_progs", bpf_send_signal() will not be triggered
and the subtest will fail.

To reduce the chances where the underlying process is not
the intended one, this patch boosted scheduling priority to
-20 (highest allowed by setpriority() call). And I did
10 runs with on-demand libbpf CI with this patch and I
didn't observe any failures.

 [1] https://github.com/libbpf/libbpf/actions/workflows/ondemand.yml

Signed-off-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210817190923.3186725-1-yhs@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/bpf/prog_tests/send_signal.c       | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tools/testing/selftests/bpf/prog_tests/send_signal.c b/tools/testing/selftests/bpf/prog_tests/send_signal.c
index 7043e6ded0e6..75b72c751772 100644
--- a/tools/testing/selftests/bpf/prog_tests/send_signal.c
+++ b/tools/testing/selftests/bpf/prog_tests/send_signal.c
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 #include <test_progs.h>
+#include <sys/time.h>
+#include <sys/resource.h>
 #include "test_send_signal_kern.skel.h"
 
 static volatile int sigusr1_received = 0;
@@ -41,12 +43,23 @@ static void test_send_signal_common(struct perf_event_attr *attr,
 	}
 
 	if (pid == 0) {
+		int old_prio;
+
 		/* install signal handler and notify parent */
 		signal(SIGUSR1, sigusr1_handler);
 
 		close(pipe_c2p[0]); /* close read */
 		close(pipe_p2c[1]); /* close write */
 
+		/* boost with a high priority so we got a higher chance
+		 * that if an interrupt happens, the underlying task
+		 * is this process.
+		 */
+		errno = 0;
+		old_prio = getpriority(PRIO_PROCESS, 0);
+		ASSERT_OK(errno, "getpriority");
+		ASSERT_OK(setpriority(PRIO_PROCESS, 0, -20), "setpriority");
+
 		/* notify parent signal handler is installed */
 		CHECK(write(pipe_c2p[1], buf, 1) != 1, "pipe_write", "err %d\n", -errno);
 
@@ -62,6 +75,9 @@ static void test_send_signal_common(struct perf_event_attr *attr,
 		/* wait for parent notification and exit */
 		CHECK(read(pipe_p2c[0], buf, 1) != 1, "pipe_read", "err %d\n", -errno);
 
+		/* restore the old priority */
+		ASSERT_OK(setpriority(PRIO_PROCESS, 0, old_prio), "setpriority");
+
 		close(pipe_c2p[1]);
 		close(pipe_p2c[0]);
 		exit(0);

From 868831492dd63b9759b63ad12da5df65d99a4940 Mon Sep 17 00:00:00 2001
From: Brandon Wyman <bjwyman@gmail.com>
Date: Fri, 6 Aug 2021 22:51:31 +0000
Subject: [PATCH 0226/1750] hwmon: (pmbus/ibm-cffps) Fix write bits for LED
 control

[ Upstream commit 76b72736f574ec38b3e94603ea5f74b1853f26b0 ]

When doing a PMBus write for the LED control on the IBM Common Form
Factor Power Supplies (ibm-cffps), the DAh command requires that bit 7
be low and bit 6 be high in order to indicate that you are truly
attempting to do a write.

Signed-off-by: Brandon Wyman <bjwyman@gmail.com>
Link: https://lore.kernel.org/r/20210806225131.1808759-1-bjwyman@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/ibm-cffps.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/pmbus/ibm-cffps.c b/drivers/hwmon/pmbus/ibm-cffps.c
index 2fb7540ee952..79bc2032dcb2 100644
--- a/drivers/hwmon/pmbus/ibm-cffps.c
+++ b/drivers/hwmon/pmbus/ibm-cffps.c
@@ -50,9 +50,9 @@
 #define CFFPS_MFR_VAUX_FAULT			BIT(6)
 #define CFFPS_MFR_CURRENT_SHARE_WARNING		BIT(7)
 
-#define CFFPS_LED_BLINK				BIT(0)
-#define CFFPS_LED_ON				BIT(1)
-#define CFFPS_LED_OFF				BIT(2)
+#define CFFPS_LED_BLINK				(BIT(0) | BIT(6))
+#define CFFPS_LED_ON				(BIT(1) | BIT(6))
+#define CFFPS_LED_OFF				(BIT(2) | BIT(6))
 #define CFFPS_BLINK_RATE_MS			250
 
 enum {

From 2a69325ee51003201043df3b3eec8bbec7b66c12 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 17 Aug 2021 21:42:52 -0700
Subject: [PATCH 0227/1750] staging: rts5208: Fix get_ms_information() heap
 buffer size

[ Upstream commit cbe34165cc1b7d1110b268ba8b9f30843c941639 ]

Fix buf allocation size (it needs to be 2 bytes larger). Found when
__alloc_size() annotations were added to kmalloc() interfaces.

In file included from ./include/linux/string.h:253,
                 from ./include/linux/bitmap.h:10,
                 from ./include/linux/cpumask.h:12,
                 from ./arch/x86/include/asm/paravirt.h:17,
                 from ./arch/x86/include/asm/irqflags.h:63,
                 from ./include/linux/irqflags.h:16,
                 from ./include/linux/rcupdate.h:26,
                 from ./include/linux/rculist.h:11,
                 from ./include/linux/pid.h:5,
                 from ./include/linux/sched.h:14,
                 from ./include/linux/blkdev.h:5,
                 from drivers/staging/rts5208/rtsx_scsi.c:12:
In function 'get_ms_information',
    inlined from 'ms_sp_cmnd' at drivers/staging/rts5208/rtsx_scsi.c:2877:12,
    inlined from 'rtsx_scsi_handler' at drivers/staging/rts5208/rtsx_scsi.c:3247:12:
./include/linux/fortify-string.h:54:29: warning: '__builtin_memcpy' forming offset [106, 107] is out
 of the bounds [0, 106] [-Warray-bounds]
   54 | #define __underlying_memcpy __builtin_memcpy
      |                             ^
./include/linux/fortify-string.h:417:2: note: in expansion of macro '__underlying_memcpy'
  417 |  __underlying_##op(p, q, __fortify_size);   \
      |  ^~~~~~~~~~~~~
./include/linux/fortify-string.h:463:26: note: in expansion of macro '__fortify_memcpy_chk'
  463 | #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,   \
      |                          ^~~~~~~~~~~~~~~~~~~~
drivers/staging/rts5208/rtsx_scsi.c:2851:3: note: in expansion of macro 'memcpy'
 2851 |   memcpy(buf + i, ms_card->raw_sys_info, 96);
      |   ^~~~~~

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-staging@lists.linux.dev
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210818044252.1533634-1-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/rts5208/rtsx_scsi.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
index 1deb74112ad4..11d9d9155eef 100644
--- a/drivers/staging/rts5208/rtsx_scsi.c
+++ b/drivers/staging/rts5208/rtsx_scsi.c
@@ -2802,10 +2802,10 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip)
 	}
 
 	if (dev_info_id == 0x15) {
-		buf_len = 0x3A;
+		buf_len = 0x3C;
 		data_len = 0x3A;
 	} else {
-		buf_len = 0x6A;
+		buf_len = 0x6C;
 		data_len = 0x6A;
 	}
 
@@ -2855,11 +2855,7 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip)
 	}
 
 	rtsx_stor_set_xfer_buf(buf, buf_len, srb);
-
-	if (dev_info_id == 0x15)
-		scsi_set_resid(srb, scsi_bufflen(srb) - 0x3C);
-	else
-		scsi_set_resid(srb, scsi_bufflen(srb) - 0x6C);
+	scsi_set_resid(srb, scsi_bufflen(srb) - buf_len);
 
 	kfree(buf);
 	return STATUS_SUCCESS;

From 1f5db5b8a3d6b351673f9592b8577a7e29eb7432 Mon Sep 17 00:00:00 2001
From: Eli Cohen <elic@nvidia.com>
Date: Tue, 17 Aug 2021 20:05:18 +0300
Subject: [PATCH 0228/1750] net: Fix offloading indirect devices dependency on
 qdisc order creation

[ Upstream commit 74fc4f828769cca1c3be89ea92cb88feaa27ef52 ]

Currently, when creating an ingress qdisc on an indirect device before
the driver registered for callbacks, the driver will not have a chance
to register its filter configuration callbacks.

To fix that, modify the code such that it keeps track of all the ingress
qdiscs that call flow_indr_dev_setup_offload(). When a driver calls
flow_indr_dev_register(),  go through the list of tracked ingress qdiscs
and call the driver callback entry point so as to give it a chance to
register its callback.

Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Eli Cohen <elic@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/flow_offload.h            |  1 +
 net/core/flow_offload.c               | 89 ++++++++++++++++++++++++++-
 net/netfilter/nf_flow_table_offload.c |  1 +
 net/netfilter/nf_tables_offload.c     |  1 +
 net/sched/cls_api.c                   |  1 +
 5 files changed, 92 insertions(+), 1 deletion(-)

diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h
index 123b1e9ea304..010d58159887 100644
--- a/include/net/flow_offload.h
+++ b/include/net/flow_offload.h
@@ -444,6 +444,7 @@ struct flow_block_offload {
 	struct list_head *driver_block_list;
 	struct netlink_ext_ack *extack;
 	struct Qdisc *sch;
+	struct list_head *cb_list_head;
 };
 
 enum tc_setup_type;
diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c
index 715b67f6c62f..e3f0d5906811 100644
--- a/net/core/flow_offload.c
+++ b/net/core/flow_offload.c
@@ -321,6 +321,7 @@ EXPORT_SYMBOL(flow_block_cb_setup_simple);
 static DEFINE_MUTEX(flow_indr_block_lock);
 static LIST_HEAD(flow_block_indr_list);
 static LIST_HEAD(flow_block_indr_dev_list);
+static LIST_HEAD(flow_indir_dev_list);
 
 struct flow_indr_dev {
 	struct list_head		list;
@@ -346,6 +347,33 @@ static struct flow_indr_dev *flow_indr_dev_alloc(flow_indr_block_bind_cb_t *cb,
 	return indr_dev;
 }
 
+struct flow_indir_dev_info {
+	void *data;
+	struct net_device *dev;
+	struct Qdisc *sch;
+	enum tc_setup_type type;
+	void (*cleanup)(struct flow_block_cb *block_cb);
+	struct list_head list;
+	enum flow_block_command command;
+	enum flow_block_binder_type binder_type;
+	struct list_head *cb_list;
+};
+
+static void existing_qdiscs_register(flow_indr_block_bind_cb_t *cb, void *cb_priv)
+{
+	struct flow_block_offload bo;
+	struct flow_indir_dev_info *cur;
+
+	list_for_each_entry(cur, &flow_indir_dev_list, list) {
+		memset(&bo, 0, sizeof(bo));
+		bo.command = cur->command;
+		bo.binder_type = cur->binder_type;
+		INIT_LIST_HEAD(&bo.cb_list);
+		cb(cur->dev, cur->sch, cb_priv, cur->type, &bo, cur->data, cur->cleanup);
+		list_splice(&bo.cb_list, cur->cb_list);
+	}
+}
+
 int flow_indr_dev_register(flow_indr_block_bind_cb_t *cb, void *cb_priv)
 {
 	struct flow_indr_dev *indr_dev;
@@ -367,6 +395,7 @@ int flow_indr_dev_register(flow_indr_block_bind_cb_t *cb, void *cb_priv)
 	}
 
 	list_add(&indr_dev->list, &flow_block_indr_dev_list);
+	existing_qdiscs_register(cb, cb_priv);
 	mutex_unlock(&flow_indr_block_lock);
 
 	return 0;
@@ -463,7 +492,59 @@ struct flow_block_cb *flow_indr_block_cb_alloc(flow_setup_cb_t *cb,
 }
 EXPORT_SYMBOL(flow_indr_block_cb_alloc);
 
-int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch,
+static struct flow_indir_dev_info *find_indir_dev(void *data)
+{
+	struct flow_indir_dev_info *cur;
+
+	list_for_each_entry(cur, &flow_indir_dev_list, list) {
+		if (cur->data == data)
+			return cur;
+	}
+	return NULL;
+}
+
+static int indir_dev_add(void *data, struct net_device *dev, struct Qdisc *sch,
+			 enum tc_setup_type type, void (*cleanup)(struct flow_block_cb *block_cb),
+			 struct flow_block_offload *bo)
+{
+	struct flow_indir_dev_info *info;
+
+	info = find_indir_dev(data);
+	if (info)
+		return -EEXIST;
+
+	info = kzalloc(sizeof(*info), GFP_KERNEL);
+	if (!info)
+		return -ENOMEM;
+
+	info->data = data;
+	info->dev = dev;
+	info->sch = sch;
+	info->type = type;
+	info->cleanup = cleanup;
+	info->command = bo->command;
+	info->binder_type = bo->binder_type;
+	info->cb_list = bo->cb_list_head;
+
+	list_add(&info->list, &flow_indir_dev_list);
+	return 0;
+}
+
+static int indir_dev_remove(void *data)
+{
+	struct flow_indir_dev_info *info;
+
+	info = find_indir_dev(data);
+	if (!info)
+		return -ENOENT;
+
+	list_del(&info->list);
+
+	kfree(info);
+	return 0;
+}
+
+int flow_indr_dev_setup_offload(struct net_device *dev,	struct Qdisc *sch,
 				enum tc_setup_type type, void *data,
 				struct flow_block_offload *bo,
 				void (*cleanup)(struct flow_block_cb *block_cb))
@@ -471,6 +552,12 @@ int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch,
 	struct flow_indr_dev *this;
 
 	mutex_lock(&flow_indr_block_lock);
+
+	if (bo->command == FLOW_BLOCK_BIND)
+		indir_dev_add(data, dev, sch, type, cleanup, bo);
+	else if (bo->command == FLOW_BLOCK_UNBIND)
+		indir_dev_remove(data);
+
 	list_for_each_entry(this, &flow_block_indr_dev_list, list)
 		this->cb(dev, sch, this->cb_priv, type, bo, data, cleanup);
 
diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 92047cea3c17..a6b654b028dd 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -940,6 +940,7 @@ static void nf_flow_table_block_offload_init(struct flow_block_offload *bo,
 	bo->command	= cmd;
 	bo->binder_type	= FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
 	bo->extack	= extack;
+	bo->cb_list_head = &flowtable->flow_block.cb_list;
 	INIT_LIST_HEAD(&bo->cb_list);
 }
 
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 9ce776175214..e5fcbb0e4b8e 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -323,6 +323,7 @@ static void nft_flow_block_offload_init(struct flow_block_offload *bo,
 	bo->command	= cmd;
 	bo->binder_type	= FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
 	bo->extack	= extack;
+	bo->cb_list_head = &basechain->flow_block.cb_list;
 	INIT_LIST_HEAD(&bo->cb_list);
 }
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 31ac76a9189e..8073657a0fd2 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -634,6 +634,7 @@ static void tcf_block_offload_init(struct flow_block_offload *bo,
 	bo->block_shared = shared;
 	bo->extack = extack;
 	bo->sch = sch;
+	bo->cb_list_head = &flow_block->cb_list;
 	INIT_LIST_HEAD(&bo->cb_list);
 }
 

From 9486d7ac9f30fb412ece53cbf59e13e1a6636ab0 Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Thu, 19 Aug 2021 18:29:02 +0100
Subject: [PATCH 0229/1750] kselftest/arm64: mte: Fix misleading output when
 skipping tests

[ Upstream commit 83e5dcbece4ea67ec3ad94b897e2844184802fd7 ]

When skipping the tests due to a lack of system support for MTE we
currently print a message saying FAIL which makes it look like the test
failed even though the test did actually report KSFT_SKIP, creating some
confusion. Change the error message to say SKIP instead so things are
clearer.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20210819172902.56211-1-broonie@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/arm64/mte/mte_common_util.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/arm64/mte/mte_common_util.c b/tools/testing/selftests/arm64/mte/mte_common_util.c
index 70665ba88cbb..2703bd628d06 100644
--- a/tools/testing/selftests/arm64/mte/mte_common_util.c
+++ b/tools/testing/selftests/arm64/mte/mte_common_util.c
@@ -285,7 +285,7 @@ int mte_default_setup(void)
 	int ret;
 
 	if (!(hwcaps2 & HWCAP2_MTE)) {
-		ksft_print_msg("FAIL: MTE features unavailable\n");
+		ksft_print_msg("SKIP: MTE features unavailable\n");
 		return KSFT_SKIP;
 	}
 	/* Get current mte mode */

From 0df5eba67bf05663bfc044865c8daddaf3a2cb4a Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Thu, 19 Aug 2021 17:57:23 +0100
Subject: [PATCH 0230/1750] kselftest/arm64: pac: Fix skipping of tests on
 systems without PAC

[ Upstream commit 0c69bd2ca6ee20064dde7853cd749284e053a874 ]

The PAC tests check to see if the system supports the relevant PAC features
but instead of skipping the tests if they can't be executed they fail the
tests which makes things look like they're not working when they are.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20210819165723.43903-1-broonie@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/arm64/pauth/pac.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/arm64/pauth/pac.c b/tools/testing/selftests/arm64/pauth/pac.c
index 592fe538506e..b743daa772f5 100644
--- a/tools/testing/selftests/arm64/pauth/pac.c
+++ b/tools/testing/selftests/arm64/pauth/pac.c
@@ -25,13 +25,15 @@
 do { \
 	unsigned long hwcaps = getauxval(AT_HWCAP); \
 	/* data key instructions are not in NOP space. This prevents a SIGILL */ \
-	ASSERT_NE(0, hwcaps & HWCAP_PACA) TH_LOG("PAUTH not enabled"); \
+	if (!(hwcaps & HWCAP_PACA))					\
+		SKIP(return, "PAUTH not enabled"); \
 } while (0)
 #define ASSERT_GENERIC_PAUTH_ENABLED() \
 do { \
 	unsigned long hwcaps = getauxval(AT_HWCAP); \
 	/* generic key instructions are not in NOP space. This prevents a SIGILL */ \
-	ASSERT_NE(0, hwcaps & HWCAP_PACG) TH_LOG("Generic PAUTH not enabled"); \
+	if (!(hwcaps & HWCAP_PACG)) \
+		SKIP(return, "Generic PAUTH not enabled");	\
 } while (0)
 
 void sign_specific(struct signatures *sign, size_t val)
@@ -256,7 +258,7 @@ TEST(single_thread_different_keys)
 	unsigned long hwcaps = getauxval(AT_HWCAP);
 
 	/* generic and data key instructions are not in NOP space. This prevents a SIGILL */
-	ASSERT_NE(0, hwcaps & HWCAP_PACA) TH_LOG("PAUTH not enabled");
+	ASSERT_PAUTH_ENABLED();
 	if (!(hwcaps & HWCAP_PACG)) {
 		TH_LOG("WARNING: Generic PAUTH not enabled. Skipping generic key checks");
 		nkeys = NKEYS - 1;
@@ -299,7 +301,7 @@ TEST(exec_changed_keys)
 	unsigned long hwcaps = getauxval(AT_HWCAP);
 
 	/* generic and data key instructions are not in NOP space. This prevents a SIGILL */
-	ASSERT_NE(0, hwcaps & HWCAP_PACA) TH_LOG("PAUTH not enabled");
+	ASSERT_PAUTH_ENABLED();
 	if (!(hwcaps & HWCAP_PACG)) {
 		TH_LOG("WARNING: Generic PAUTH not enabled. Skipping generic key checks");
 		nkeys = NKEYS - 1;

From 2225a5cd2fbc2ef0e0f78e585db3844f60416a39 Mon Sep 17 00:00:00 2001
From: Bob Peterson <rpeterso@redhat.com>
Date: Fri, 30 Jul 2021 12:41:49 -0500
Subject: [PATCH 0231/1750] gfs2: Don't call dlm after protocol is unmounted

[ Upstream commit d1340f80f0b8066321b499a376780da00560e857 ]

In the gfs2 withdraw sequence, the dlm protocol is unmounted with a call
to lm_unmount. After a withdraw, users are allowed to unmount the
withdrawn file system. But at that point we may still have glocks left
over that we need to free via unmount's call to gfs2_gl_hash_clear.
These glocks may have never been completed because of whatever problem
caused the withdraw (IO errors or whatever).

Before this patch, function gdlm_put_lock would still try to call into
dlm to unlock these leftover glocks, which resulted in dlm returning
-EINVAL because the lock space was abandoned. These glocks were never
freed because there was no mechanism after that to free them.

This patch adds a check to gdlm_put_lock to see if the locking protocol
was inactive (DFL_UNMOUNT flag) and if so, free the glock and not
make the invalid call into dlm.

I could have combined this "if" with the one that follows, related to
leftover glock LVBs, but I felt the code was more readable with its own
if clause.

Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/lock_dlm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 153272f82984..5564aa8b4592 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -296,6 +296,11 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 	gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT);
 	gfs2_update_request_times(gl);
 
+	/* don't want to call dlm if we've unmounted the lock protocol */
+	if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) {
+		gfs2_glock_free(gl);
+		return;
+	}
 	/* don't want to skip dlm_unlock writing the lvb when lock has one */
 
 	if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&

From 2d3fab9ceafad925d30d0ea78f3a2b1bc8ce550b Mon Sep 17 00:00:00 2001
From: Li Jun <jun.li@nxp.com>
Date: Fri, 18 Jun 2021 16:28:58 +0800
Subject: [PATCH 0232/1750] usb: chipidea: host: fix port index underflow and
 UBSAN complains

[ Upstream commit e5d6a7c6cfae9e714a0e8ff64facd1ac68a784c6 ]

If wIndex is 0 (and it often is), these calculations underflow and
UBSAN complains, here resolve this by not decrementing the index when
it is equal to 0, this copies the solution from commit 85e3990bea49
("USB: EHCI: avoid undefined pointer arithmetic and placate UBSAN")

Reported-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/1624004938-2399-1-git-send-email-jun.li@nxp.com
Signed-off-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/chipidea/host.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 48e4a5ca1835..f5f56ee07729 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -233,18 +233,26 @@ static int ci_ehci_hub_control(
 )
 {
 	struct ehci_hcd	*ehci = hcd_to_ehci(hcd);
+	unsigned int	ports = HCS_N_PORTS(ehci->hcs_params);
 	u32 __iomem	*status_reg;
-	u32		temp;
+	u32		temp, port_index;
 	unsigned long	flags;
 	int		retval = 0;
 	struct device *dev = hcd->self.controller;
 	struct ci_hdrc *ci = dev_get_drvdata(dev);
 
-	status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1];
+	port_index = wIndex & 0xff;
+	port_index -= (port_index > 0);
+	status_reg = &ehci->regs->port_status[port_index];
 
 	spin_lock_irqsave(&ehci->lock, flags);
 
 	if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
+		if (!wIndex || wIndex > ports) {
+			retval = -EPIPE;
+			goto done;
+		}
+
 		temp = ehci_readl(ehci, status_reg);
 		if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
 			retval = -EPIPE;
@@ -273,7 +281,7 @@ static int ci_ehci_hub_control(
 			ehci_writel(ehci, temp, status_reg);
 		}
 
-		set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
+		set_bit(port_index, &ehci->suspended_ports);
 		goto done;
 	}
 

From 9ce6e29375bab3c081bc61162d82e47e8d7a439a Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Fri, 20 Aug 2021 17:01:59 -0400
Subject: [PATCH 0233/1750] lockd: lockd server-side shouldn't set fl_ops

[ Upstream commit 7de875b231edb807387a81cde288aa9e1015ef9e ]

Locks have two sets of op arrays, fl_lmops for the lock manager (lockd
or nfsd), fl_ops for the filesystem.  The server-side lockd code has
been setting its own fl_ops, which leads to confusion (and crashes) in
the reexport case, where the filesystem expects to be the only one
setting fl_ops.

And there's no reason for it that I can see-the lm_get/put_owner ops do
the same job.

Reported-by: Daire Byrne <daire@dneg.com>
Tested-by: Daire Byrne <daire@dneg.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/lockd/svclock.c | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index 498cb70c2c0d..273a81971ed5 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -395,28 +395,10 @@ nlmsvc_release_lockowner(struct nlm_lock *lock)
 		nlmsvc_put_lockowner(lock->fl.fl_owner);
 }
 
-static void nlmsvc_locks_copy_lock(struct file_lock *new, struct file_lock *fl)
-{
-	struct nlm_lockowner *nlm_lo = (struct nlm_lockowner *)fl->fl_owner;
-	new->fl_owner = nlmsvc_get_lockowner(nlm_lo);
-}
-
-static void nlmsvc_locks_release_private(struct file_lock *fl)
-{
-	nlmsvc_put_lockowner((struct nlm_lockowner *)fl->fl_owner);
-}
-
-static const struct file_lock_operations nlmsvc_lock_ops = {
-	.fl_copy_lock = nlmsvc_locks_copy_lock,
-	.fl_release_private = nlmsvc_locks_release_private,
-};
-
 void nlmsvc_locks_init_private(struct file_lock *fl, struct nlm_host *host,
 						pid_t pid)
 {
 	fl->fl_owner = nlmsvc_find_lockowner(host, pid);
-	if (fl->fl_owner != NULL)
-		fl->fl_ops = &nlmsvc_lock_ops;
 }
 
 /*
@@ -788,9 +770,21 @@ nlmsvc_notify_blocked(struct file_lock *fl)
 	printk(KERN_WARNING "lockd: notification for unknown block!\n");
 }
 
+static fl_owner_t nlmsvc_get_owner(fl_owner_t owner)
+{
+	return nlmsvc_get_lockowner(owner);
+}
+
+static void nlmsvc_put_owner(fl_owner_t owner)
+{
+	nlmsvc_put_lockowner(owner);
+}
+
 const struct lock_manager_operations nlmsvc_lock_operations = {
 	.lm_notify = nlmsvc_notify_blocked,
 	.lm_grant = nlmsvc_grant_deferred,
+	.lm_get_owner = nlmsvc_get_owner,
+	.lm_put_owner = nlmsvc_put_owner,
 };
 
 /*

From 756924bc1804f0696fda8aeedd48a42152c0c7bf Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Tue, 27 Jul 2021 16:36:56 -0700
Subject: [PATCH 0234/1750] drm/exynos: Always initialize mapping in
 exynos_drm_register_dma()

[ Upstream commit c626f3864bbbb28bbe06476b0b497c1330aa4463 ]

In certain randconfigs, clang warns:

drivers/gpu/drm/exynos/exynos_drm_dma.c:121:19: warning: variable
'mapping' is uninitialized when used here [-Wuninitialized]
                priv->mapping = mapping;
                                ^~~~~~~
drivers/gpu/drm/exynos/exynos_drm_dma.c:111:16: note: initialize the
variable 'mapping' to silence this warning
                void *mapping;
                             ^
                              = NULL
1 warning generated.

This occurs when CONFIG_EXYNOS_IOMMU is enabled and both
CONFIG_ARM_DMA_USE_IOMMU and CONFIG_IOMMU_DMA are disabled, which makes
the code look like

  void *mapping;

  if (0)
    mapping = arm_iommu_create_mapping()
  else if (0)
    mapping = iommu_get_domain_for_dev()

  ...
  priv->mapping = mapping;

Add an else branch that initializes mapping to the -ENODEV error pointer
so that there is no more warning and the driver does not change during
runtime.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/exynos/exynos_drm_dma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c
index 0644936afee2..bf33c3084cb4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c
@@ -115,6 +115,8 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev,
 				EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE);
 		else if (IS_ENABLED(CONFIG_IOMMU_DMA))
 			mapping = iommu_get_domain_for_dev(priv->dma_dev);
+		else
+			mapping = ERR_PTR(-ENODEV);
 
 		if (IS_ERR(mapping))
 			return PTR_ERR(mapping);

From 9baf6f8ca285f0d491dd58bc4f558d4fe98ee812 Mon Sep 17 00:00:00 2001
From: Chris Chiu <chris.chiu@canonical.com>
Date: Wed, 4 Aug 2021 23:13:25 +0800
Subject: [PATCH 0235/1750] rtl8xxxu: Fix the handling of TX A-MPDU aggregation

[ Upstream commit 95a581ab3592082c60a08090aabe09ac7d0bd650 ]

The TX A-MPDU aggregation is not handled in the driver since the
ieee80211_start_tx_ba_session has never been started properly.
Start and stop the TX BA session by tracking the TX aggregation
status of each TID. Fix the ampdu_action and the tx descriptor
accordingly with the given TID.

Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210804151325.86600-1-chris.chiu@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/realtek/rtl8xxxu/rtl8xxxu.h  |  2 ++
 .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 33 ++++++++++++++-----
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
index acb6b0cd3667..b28fa0c4d180 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -1378,6 +1378,8 @@ struct rtl8xxxu_priv {
 	u8 no_pape:1;
 	u8 int_buf[USB_INTR_CONTENT_LENGTH];
 	u8 rssi_level;
+	DECLARE_BITMAP(tx_aggr_started, IEEE80211_NUM_TIDS);
+	DECLARE_BITMAP(tid_tx_operational, IEEE80211_NUM_TIDS);
 	/*
 	 * Only one virtual interface permitted because only STA mode
 	 * is supported and no iface_combinations are provided.
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index 5cd7ef3625c5..0d374a294840 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -4805,6 +4805,8 @@ rtl8xxxu_fill_txdesc_v1(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
 	struct ieee80211_rate *tx_rate = ieee80211_get_tx_rate(hw, tx_info);
 	struct rtl8xxxu_priv *priv = hw->priv;
 	struct device *dev = &priv->udev->dev;
+	u8 *qc = ieee80211_get_qos_ctl(hdr);
+	u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
 	u32 rate;
 	u16 rate_flags = tx_info->control.rates[0].flags;
 	u16 seq_number;
@@ -4828,7 +4830,7 @@ rtl8xxxu_fill_txdesc_v1(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
 
 	tx_desc->txdw3 = cpu_to_le32((u32)seq_number << TXDESC32_SEQ_SHIFT);
 
-	if (ampdu_enable)
+	if (ampdu_enable && test_bit(tid, priv->tid_tx_operational))
 		tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_ENABLE);
 	else
 		tx_desc->txdw1 |= cpu_to_le32(TXDESC32_AGG_BREAK);
@@ -4876,6 +4878,8 @@ rtl8xxxu_fill_txdesc_v2(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
 	struct rtl8xxxu_priv *priv = hw->priv;
 	struct device *dev = &priv->udev->dev;
 	struct rtl8xxxu_txdesc40 *tx_desc40;
+	u8 *qc = ieee80211_get_qos_ctl(hdr);
+	u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
 	u32 rate;
 	u16 rate_flags = tx_info->control.rates[0].flags;
 	u16 seq_number;
@@ -4902,7 +4906,7 @@ rtl8xxxu_fill_txdesc_v2(struct ieee80211_hw *hw, struct ieee80211_hdr *hdr,
 
 	tx_desc40->txdw9 = cpu_to_le32((u32)seq_number << TXDESC40_SEQ_SHIFT);
 
-	if (ampdu_enable)
+	if (ampdu_enable && test_bit(tid, priv->tid_tx_operational))
 		tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_ENABLE);
 	else
 		tx_desc40->txdw2 |= cpu_to_le32(TXDESC40_AGG_BREAK);
@@ -5015,12 +5019,19 @@ static void rtl8xxxu_tx(struct ieee80211_hw *hw,
 	if (ieee80211_is_data_qos(hdr->frame_control) && sta) {
 		if (sta->ht_cap.ht_supported) {
 			u32 ampdu, val32;
+			u8 *qc = ieee80211_get_qos_ctl(hdr);
+			u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
 
 			ampdu = (u32)sta->ht_cap.ampdu_density;
 			val32 = ampdu << TXDESC_AMPDU_DENSITY_SHIFT;
 			tx_desc->txdw2 |= cpu_to_le32(val32);
 
 			ampdu_enable = true;
+
+			if (!test_bit(tid, priv->tx_aggr_started) &&
+			    !(skb->protocol == cpu_to_be16(ETH_P_PAE)))
+				if (!ieee80211_start_tx_ba_session(sta, tid, 0))
+					set_bit(tid, priv->tx_aggr_started);
 		}
 	}
 
@@ -6095,6 +6106,7 @@ rtl8xxxu_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	struct device *dev = &priv->udev->dev;
 	u8 ampdu_factor, ampdu_density;
 	struct ieee80211_sta *sta = params->sta;
+	u16 tid = params->tid;
 	enum ieee80211_ampdu_mlme_action action = params->action;
 
 	switch (action) {
@@ -6107,17 +6119,20 @@ rtl8xxxu_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 		dev_dbg(dev,
 			"Changed HT: ampdu_factor %02x, ampdu_density %02x\n",
 			ampdu_factor, ampdu_density);
-		break;
+		return IEEE80211_AMPDU_TX_START_IMMEDIATE;
+	case IEEE80211_AMPDU_TX_STOP_CONT:
 	case IEEE80211_AMPDU_TX_STOP_FLUSH:
-		dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH\n", __func__);
-		rtl8xxxu_set_ampdu_factor(priv, 0);
-		rtl8xxxu_set_ampdu_min_space(priv, 0);
-		break;
 	case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
-		dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP_FLUSH_CONT\n",
-			 __func__);
+		dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_STOP\n", __func__);
 		rtl8xxxu_set_ampdu_factor(priv, 0);
 		rtl8xxxu_set_ampdu_min_space(priv, 0);
+		clear_bit(tid, priv->tx_aggr_started);
+		clear_bit(tid, priv->tid_tx_operational);
+		ieee80211_stop_tx_ba_cb_irqsafe(vif, sta->addr, tid);
+		break;
+	case IEEE80211_AMPDU_TX_OPERATIONAL:
+		dev_dbg(dev, "%s: IEEE80211_AMPDU_TX_OPERATIONAL\n", __func__);
+		set_bit(tid, priv->tid_tx_operational);
 		break;
 	case IEEE80211_AMPDU_RX_START:
 		dev_dbg(dev, "%s: IEEE80211_AMPDU_RX_START\n", __func__);

From 2fd1964f7501b76963690ab54eb59352a8bc2de3 Mon Sep 17 00:00:00 2001
From: Chin-Yen Lee <timlee@realtek.com>
Date: Wed, 28 Jul 2021 09:43:31 +0800
Subject: [PATCH 0236/1750] rtw88: use read_poll_timeout instead of fixed sleep

[ Upstream commit 02a55c0009a55b204e1e5c17295431f0a9e7d3b6 ]

In current wow flow, driver calls rtw_wow_fw_start and sleep for 100ms,
to wait firmware finish preliminary work and then update the value of
WOWLAN_WAKE_REASON register to zero. But later firmware will start wow
function with power-saving mode, in which mode the value of
WOWLAN_WAKE_REASON register is 0xea. So driver may get 0xea value and
return fail. We use read_poll_timeout instead to check the value to avoid
this issue.

Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210728014335.8785-2-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw88/wow.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/wow.c b/drivers/net/wireless/realtek/rtw88/wow.c
index 2fcdf70a3a77..bb2fd4e544f0 100644
--- a/drivers/net/wireless/realtek/rtw88/wow.c
+++ b/drivers/net/wireless/realtek/rtw88/wow.c
@@ -283,15 +283,26 @@ static void rtw_wow_rx_dma_start(struct rtw_dev *rtwdev)
 
 static int rtw_wow_check_fw_status(struct rtw_dev *rtwdev, bool wow_enable)
 {
-	/* wait 100ms for wow firmware to finish work */
-	msleep(100);
+	int ret;
+	u8 check;
+	u32 check_dis;
 
 	if (wow_enable) {
-		if (rtw_read8(rtwdev, REG_WOWLAN_WAKE_REASON))
+		ret = read_poll_timeout(rtw_read8, check, !check, 1000,
+					100000, true, rtwdev,
+					REG_WOWLAN_WAKE_REASON);
+		if (ret)
 			goto wow_fail;
 	} else {
-		if (rtw_read32_mask(rtwdev, REG_FE1IMR, BIT_FS_RXDONE) ||
-		    rtw_read32_mask(rtwdev, REG_RXPKT_NUM, BIT_RW_RELEASE))
+		ret = read_poll_timeout(rtw_read32_mask, check_dis,
+					!check_dis, 1000, 100000, true, rtwdev,
+					REG_FE1IMR, BIT_FS_RXDONE);
+		if (ret)
+			goto wow_fail;
+		ret = read_poll_timeout(rtw_read32_mask, check_dis,
+					!check_dis, 1000, 100000, false, rtwdev,
+					REG_RXPKT_NUM, BIT_RW_RELEASE);
+		if (ret)
 			goto wow_fail;
 	}
 

From aa82a11176bd6af7cec315edd237fa23d3686762 Mon Sep 17 00:00:00 2001
From: Ping-Ke Shih <pkshih@realtek.com>
Date: Wed, 28 Jul 2021 09:43:33 +0800
Subject: [PATCH 0237/1750] rtw88: wow: build wow function only if CONFIG_PM is
 on

[ Upstream commit 05e45887382c4c0f9522515759b34991aa17e69d ]

The kernel test robot reports undefined reference after we report wakeup
reason to mac80211. This is because CONFIG_PM is not defined in the testing
configuration file. In fact, functions within wow.c are used if CONFIG_PM
is defined, so use CONFIG_PM to decide whether we build this file or not.

The reported messages are:
   hppa-linux-ld: drivers/net/wireless/realtek/rtw88/wow.o: in function `rtw_wow_show_wakeup_reason':
>> (.text+0x6c4): undefined reference to `ieee80211_report_wowlan_wakeup'
>> hppa-linux-ld: (.text+0x6e0): undefined reference to `ieee80211_report_wowlan_wakeup'

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210728014335.8785-4-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw88/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw88/Makefile b/drivers/net/wireless/realtek/rtw88/Makefile
index c0e4b111c8b4..73d6807a8cdf 100644
--- a/drivers/net/wireless/realtek/rtw88/Makefile
+++ b/drivers/net/wireless/realtek/rtw88/Makefile
@@ -15,9 +15,9 @@ rtw88_core-y += main.o \
 	   ps.o \
 	   sec.o \
 	   bf.o \
-	   wow.o \
 	   regd.o
 
+rtw88_core-$(CONFIG_PM) += wow.o
 
 obj-$(CONFIG_RTW88_8822B)	+= rtw88_8822b.o
 rtw88_8822b-objs		:= rtw8822b.o rtw8822b_table.o

From 6d657f1fa121f98ecf807c11eba2d9f7c8795185 Mon Sep 17 00:00:00 2001
From: Chin-Yen Lee <timlee@realtek.com>
Date: Wed, 28 Jul 2021 09:43:35 +0800
Subject: [PATCH 0238/1750] rtw88: wow: fix size access error of probe request

[ Upstream commit 69c7044526d984df672b8d9b6d6998c34617cde4 ]

Current flow will lead to null ptr access because of trying
to get the size of freed probe-request packets. We store the
information of packet size into rsvd page instead and also fix
the size error issue, which will cause unstable behavoir of
sending probe request by wow firmware.

Signed-off-by: Chin-Yen Lee <timlee@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210728014335.8785-6-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw88/fw.c | 8 ++++++--
 drivers/net/wireless/realtek/rtw88/fw.h | 1 +
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
index b2fd87834f23..0452630bcfac 100644
--- a/drivers/net/wireless/realtek/rtw88/fw.c
+++ b/drivers/net/wireless/realtek/rtw88/fw.c
@@ -684,7 +684,7 @@ static u16 rtw_get_rsvd_page_probe_req_size(struct rtw_dev *rtwdev,
 			continue;
 		if ((!ssid && !rsvd_pkt->ssid) ||
 		    rtw_ssid_equal(rsvd_pkt->ssid, ssid))
-			size = rsvd_pkt->skb->len;
+			size = rsvd_pkt->probe_req_size;
 	}
 
 	return size;
@@ -912,6 +912,8 @@ static struct sk_buff *rtw_get_rsvd_page_skb(struct ieee80211_hw *hw,
 							 ssid->ssid_len, 0);
 		else
 			skb_new = ieee80211_probereq_get(hw, vif->addr, NULL, 0, 0);
+		if (skb_new)
+			rsvd_pkt->probe_req_size = (u16)skb_new->len;
 		break;
 	case RSVD_NLO_INFO:
 		skb_new = rtw_nlo_info_get(hw);
@@ -1508,6 +1510,7 @@ int rtw_fw_dump_fifo(struct rtw_dev *rtwdev, u8 fifo_sel, u32 addr, u32 size,
 static void __rtw_fw_update_pkt(struct rtw_dev *rtwdev, u8 pkt_id, u16 size,
 				u8 location)
 {
+	struct rtw_chip_info *chip = rtwdev->chip;
 	u8 h2c_pkt[H2C_PKT_SIZE] = {0};
 	u16 total_size = H2C_PKT_HDR_SIZE + H2C_PKT_UPDATE_PKT_LEN;
 
@@ -1518,6 +1521,7 @@ static void __rtw_fw_update_pkt(struct rtw_dev *rtwdev, u8 pkt_id, u16 size,
 	UPDATE_PKT_SET_LOCATION(h2c_pkt, location);
 
 	/* include txdesc size */
+	size += chip->tx_pkt_desc_sz;
 	UPDATE_PKT_SET_SIZE(h2c_pkt, size);
 
 	rtw_fw_send_h2c_packet(rtwdev, h2c_pkt);
@@ -1527,7 +1531,7 @@ void rtw_fw_update_pkt_probe_req(struct rtw_dev *rtwdev,
 				 struct cfg80211_ssid *ssid)
 {
 	u8 loc;
-	u32 size;
+	u16 size;
 
 	loc = rtw_get_rsvd_page_probe_req_location(rtwdev, ssid);
 	if (!loc) {
diff --git a/drivers/net/wireless/realtek/rtw88/fw.h b/drivers/net/wireless/realtek/rtw88/fw.h
index 08644540d259..f4aed247e3bd 100644
--- a/drivers/net/wireless/realtek/rtw88/fw.h
+++ b/drivers/net/wireless/realtek/rtw88/fw.h
@@ -117,6 +117,7 @@ struct rtw_rsvd_page {
 	u8 page;
 	bool add_txdesc;
 	struct cfg80211_ssid *ssid;
+	u16 probe_req_size;
 };
 
 enum rtw_keep_alive_pkt_type {

From c10b1afc2f43f58a26207128edc0705b25367036 Mon Sep 17 00:00:00 2001
From: Subbaraya Sundeep <sbhatta@marvell.com>
Date: Sun, 22 Aug 2021 17:32:18 +0530
Subject: [PATCH 0239/1750] octeontx2-pf: Fix NIX1_RX interface backpressure

[ Upstream commit e8fb4df1f5d84bc08dd4f4827821a851d2eab241 ]

'bp_ena' in Aura context is NIX block index, setting it
zero will always backpressure NIX0 block, even if NIXLF
belongs to NIX1. Hence fix this by setting it appropriately
based on NIX block address.

Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: Hariprasad Kelam <hkelam@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/marvell/octeontx2/nic/otx2_common.c  | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
index df238e46e2ae..b062ed06235d 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -1129,7 +1129,22 @@ static int otx2_aura_init(struct otx2_nic *pfvf, int aura_id,
 	/* Enable backpressure for RQ aura */
 	if (aura_id < pfvf->hw.rqpool_cnt) {
 		aq->aura.bp_ena = 0;
+		/* If NIX1 LF is attached then specify NIX1_RX.
+		 *
+		 * Below NPA_AURA_S[BP_ENA] is set according to the
+		 * NPA_BPINTF_E enumeration given as:
+		 * 0x0 + a*0x1 where 'a' is 0 for NIX0_RX and 1 for NIX1_RX so
+		 * NIX0_RX is 0x0 + 0*0x1 = 0
+		 * NIX1_RX is 0x0 + 1*0x1 = 1
+		 * But in HRM it is given that
+		 * "NPA_AURA_S[BP_ENA](w1[33:32]) - Enable aura backpressure to
+		 * NIX-RX based on [BP] level. One bit per NIX-RX; index
+		 * enumerated by NPA_BPINTF_E."
+		 */
+		if (pfvf->nix_blkaddr == BLKADDR_NIX1)
+			aq->aura.bp_ena = 1;
 		aq->aura.nix0_bpid = pfvf->bpid[0];
+
 		/* Set backpressure level for RQ's Aura */
 		aq->aura.bp = RQ_BP_LVL_AURA;
 	}

From 87ae522e467e17a13b796e2cb595f9c3943e4d5e Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 9 Aug 2021 18:01:31 +1000
Subject: [PATCH 0240/1750] m68knommu: only set CONFIG_ISA_DMA_API for ColdFire
 sub-arch

[ Upstream commit db87db65c1059f3be04506d122f8ec9b2fa3b05e ]

> Hi Arnd,
>
> First bad commit (maybe != root cause):
>
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> head:   2f73937c9aa561e2082839bc1a8efaac75d6e244
> commit: 47fd22f2b84765a2f7e3f150282497b902624547 [4771/5318] cs89x0: rework driver configuration
> config: m68k-randconfig-c003-20210804 (attached as .config)
> compiler: m68k-linux-gcc (GCC) 10.3.0
> reproduce (this is a W=1 build):
>         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
>         chmod +x ~/bin/make.cross
>         # https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=47fd22f2b84765a2f7e3f150282497b902624547
>         git remote add linux-next https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
>         git fetch --no-tags linux-next master
>         git checkout 47fd22f2b84765a2f7e3f150282497b902624547
>         # save the attached .config to linux build tree
>         COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-10.3.0 make.cross ARCH=m68k
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
>
> All errors (new ones prefixed by >>):
>
>    In file included from include/linux/kernel.h:19,
>                     from include/linux/list.h:9,
>                     from include/linux/module.h:12,
>                     from drivers/net/ethernet/cirrus/cs89x0.c:51:
>    drivers/net/ethernet/cirrus/cs89x0.c: In function 'net_open':
>    drivers/net/ethernet/cirrus/cs89x0.c:897:20: error: implicit declaration of function 'isa_virt_to_bus'; did you mean 'virt_to_bus'? [-Werror=implicit-function-declaration]
>      897 |     (unsigned long)isa_virt_to_bus(lp->dma_buff));
>          |                    ^~~~~~~~~~~~~~~
>    include/linux/printk.h:141:17: note: in definition of macro 'no_printk'
>      141 |   printk(fmt, ##__VA_ARGS__);  \
>          |                 ^~~~~~~~~~~
>    drivers/net/ethernet/cirrus/cs89x0.c:86:3: note: in expansion of macro 'pr_debug'
>       86 |   pr_##level(fmt, ##__VA_ARGS__);   \
>          |   ^~~
>    drivers/net/ethernet/cirrus/cs89x0.c:894:3: note: in expansion of macro 'cs89_dbg'
>      894 |   cs89_dbg(1, debug, "%s: dma %lx %lx\n",
>          |   ^~~~~~~~
> >> drivers/net/ethernet/cirrus/cs89x0.c:914:3: error: implicit declaration of function 'disable_dma'; did you mean 'disable_irq'? [-Werror=implicit-function-declaration]

As far as I can tell, this is a bug with the m68kmmu architecture, not
with my driver:
The CONFIG_ISA_DMA_API option is provided for coldfire, which implements it,
but dragonball also sets the option as a side-effect, without actually
implementing
the interfaces. The patch below should fix it.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/Kconfig.bus | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/m68k/Kconfig.bus b/arch/m68k/Kconfig.bus
index f1be832e2b74..d1e93a39cd3b 100644
--- a/arch/m68k/Kconfig.bus
+++ b/arch/m68k/Kconfig.bus
@@ -63,7 +63,7 @@ source "drivers/zorro/Kconfig"
 
 endif
 
-if !MMU
+if COLDFIRE
 
 config ISA_DMA_API
 	def_bool !M5272

From b225eeaf3a02f2d47a4a5ee8cc976fc822eddac7 Mon Sep 17 00:00:00 2001
From: Marcos Paulo de Souza <mpdesouza@suse.com>
Date: Mon, 2 Aug 2021 09:34:00 -0300
Subject: [PATCH 0241/1750] btrfs: tree-log: check btrfs_lookup_data_extent
 return value

[ Upstream commit 3736127a3aa805602b7a2ad60ec9cfce68065fbb ]

Function btrfs_lookup_data_extent calls btrfs_search_slot to verify if
the EXTENT_ITEM exists in the extent tree. btrfs_search_slot can return
values bellow zero if an error happened.

Function replay_one_extent currently checks if the search found
something (0 returned) and increments the reference, and if not, it
seems to evaluate as 'not found'.

Fix the condition by checking if the value was bellow zero and return
early.

Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Marcos Paulo de Souza <mpdesouza@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/tree-log.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index f36928efcf92..ec25e5eab349 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -708,7 +708,9 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
 			 */
 			ret = btrfs_lookup_data_extent(fs_info, ins.objectid,
 						ins.offset);
-			if (ret == 0) {
+			if (ret < 0) {
+				goto out;
+			} else if (ret == 0) {
 				btrfs_init_generic_ref(&ref,
 						BTRFS_ADD_DELAYED_REF,
 						ins.objectid, ins.offset, 0);

From d72afec087f731492a17198619017f2acbaaa0d6 Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Wed, 18 Aug 2021 10:49:52 +0800
Subject: [PATCH 0242/1750] soundwire: intel: fix potential race condition
 during power down

[ Upstream commit ea6942dad4b2a7e1735aa0f10f3d0b04b847750f ]

The power down sequence sets the link_up flag as false outside of the
mutex_lock. This is potentially unsafe.

In additional the flow in that sequence can be improved by first
testing if the link was powered, setting the link_up flag as false and
proceeding with the power down. In case the CPA bits cannot be
cleared, we only flag an error since we cannot deal with interrupts
any longer.

Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://lore.kernel.org/r/20210818024954.16873-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/intel.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index 6a1e862b16c3..dad4326a2a71 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -537,12 +537,14 @@ static int intel_link_power_down(struct sdw_intel *sdw)
 
 	mutex_lock(sdw->link_res->shim_lock);
 
-	intel_shim_master_ip_to_glue(sdw);
-
 	if (!(*shim_mask & BIT(link_id)))
 		dev_err(sdw->cdns.dev,
 			"%s: Unbalanced power-up/down calls\n", __func__);
 
+	sdw->cdns.link_up = false;
+
+	intel_shim_master_ip_to_glue(sdw);
+
 	*shim_mask &= ~BIT(link_id);
 
 	if (!*shim_mask) {
@@ -559,20 +561,21 @@ static int intel_link_power_down(struct sdw_intel *sdw)
 		link_control &=  spa_mask;
 
 		ret = intel_clear_bit(shim, SDW_SHIM_LCTL, link_control, cpa_mask);
+		if (ret < 0) {
+			dev_err(sdw->cdns.dev, "%s: could not power down link\n", __func__);
+
+			/*
+			 * we leave the sdw->cdns.link_up flag as false since we've disabled
+			 * the link at this point and cannot handle interrupts any longer.
+			 */
+		}
 	}
 
 	link_control = intel_readl(shim, SDW_SHIM_LCTL);
 
 	mutex_unlock(sdw->link_res->shim_lock);
 
-	if (ret < 0) {
-		dev_err(sdw->cdns.dev, "%s: could not power down link\n", __func__);
-
-		return ret;
-	}
-
-	sdw->cdns.link_up = false;
-	return 0;
+	return ret;
 }
 
 static void intel_shim_sync_arm(struct sdw_intel *sdw)

From 4a48ed479467a62a197d7c2353249d54d6119d47 Mon Sep 17 00:00:00 2001
From: Cezary Rojewski <cezary.rojewski@intel.com>
Date: Wed, 18 Aug 2021 09:57:36 +0200
Subject: [PATCH 0243/1750] ASoC: Intel: Skylake: Fix module configuration for
 KPB and MIXER

[ Upstream commit e4e0633bcadc950b4b4af06c7f1bb7f7e3e86321 ]

KeyPhrasebuffer, Mixin and Mixout modules configuration is described by
firmware's basic module configuration structure. There are no extended
parameters required. Update functions taking part in building
INIT_INSTANCE IPC payload to reflect that.

Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Tested-by: Lukasz Majczak <lma@semihalf.com>
Link: https://lore.kernel.org/r/20210818075742.1515155-6-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/skylake/skl-messages.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index 476ef1897961..79c6cf2c14bf 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -802,9 +802,12 @@ static u16 skl_get_module_param_size(struct skl_dev *skl,
 
 	case SKL_MODULE_TYPE_BASE_OUTFMT:
 	case SKL_MODULE_TYPE_MIC_SELECT:
-	case SKL_MODULE_TYPE_KPB:
 		return sizeof(struct skl_base_outfmt_cfg);
 
+	case SKL_MODULE_TYPE_MIXER:
+	case SKL_MODULE_TYPE_KPB:
+		return sizeof(struct skl_base_cfg);
+
 	default:
 		/*
 		 * return only base cfg when no specific module type is
@@ -857,10 +860,14 @@ static int skl_set_module_format(struct skl_dev *skl,
 
 	case SKL_MODULE_TYPE_BASE_OUTFMT:
 	case SKL_MODULE_TYPE_MIC_SELECT:
-	case SKL_MODULE_TYPE_KPB:
 		skl_set_base_outfmt_format(skl, module_config, *param_data);
 		break;
 
+	case SKL_MODULE_TYPE_MIXER:
+	case SKL_MODULE_TYPE_KPB:
+		skl_set_base_module_format(skl, module_config, *param_data);
+		break;
+
 	default:
 		skl_set_base_module_format(skl, module_config, *param_data);
 		break;

From be69ed7bb9d3c05074718af811868e47f3f512b8 Mon Sep 17 00:00:00 2001
From: Gustaw Lewandowski <gustaw.lewandowski@linux.intel.com>
Date: Wed, 18 Aug 2021 09:57:37 +0200
Subject: [PATCH 0244/1750] ASoC: Intel: Skylake: Fix passing loadable flag for
 module

[ Upstream commit c5ed9c547cba1dc1238c6e8a0c290fd62ee6e127 ]

skl_get_module_info() tries to set mconfig->module->loadable before
mconfig->module has been assigned thus flag was always set to false
and driver did not try to load module binaries.

Signed-off-by: Gustaw Lewandowski <gustaw.lewandowski@linux.intel.com>
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Tested-by: Lukasz Majczak <lma@semihalf.com>
Link: https://lore.kernel.org/r/20210818075742.1515155-7-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/skylake/skl-pcm.c | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index bbe8d782e0af..b1897a057397 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -1318,21 +1318,6 @@ static int skl_get_module_info(struct skl_dev *skl,
 		return -EIO;
 	}
 
-	list_for_each_entry(module, &skl->uuid_list, list) {
-		if (guid_equal(uuid_mod, &module->uuid)) {
-			mconfig->id.module_id = module->id;
-			if (mconfig->module)
-				mconfig->module->loadable = module->is_loadable;
-			ret = 0;
-			break;
-		}
-	}
-
-	if (ret)
-		return ret;
-
-	uuid_mod = &module->uuid;
-	ret = -EIO;
 	for (i = 0; i < skl->nr_modules; i++) {
 		skl_module = skl->modules[i];
 		uuid_tplg = &skl_module->uuid;
@@ -1342,10 +1327,18 @@ static int skl_get_module_info(struct skl_dev *skl,
 			break;
 		}
 	}
+
 	if (skl->nr_modules && ret)
 		return ret;
 
+	ret = -EIO;
 	list_for_each_entry(module, &skl->uuid_list, list) {
+		if (guid_equal(uuid_mod, &module->uuid)) {
+			mconfig->id.module_id = module->id;
+			mconfig->module->loadable = module->is_loadable;
+			ret = 0;
+		}
+
 		for (i = 0; i < MAX_IN_QUEUE; i++) {
 			pin_id = &mconfig->m_in_pin[i].id;
 			if (guid_equal(&pin_id->mod_uuid, &module->uuid))
@@ -1359,7 +1352,7 @@ static int skl_get_module_info(struct skl_dev *skl,
 		}
 	}
 
-	return 0;
+	return ret;
 }
 
 static int skl_populate_modules(struct skl_dev *skl)

From 1a40e60e2af49cf2b4ecc51e2925a771c757c16e Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Fri, 20 Aug 2021 15:47:22 +0100
Subject: [PATCH 0245/1750] of: Don't allow __of_attached_node_sysfs() without
 CONFIG_SYSFS

[ Upstream commit 6211e9cb2f8faf7faae0b6caf844bfe9527cc607 ]

Trying to boot without SYSFS, but with OF_DYNAMIC quickly
results in a crash:

[    0.088460] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070
[...]
[    0.103927] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc3 #4179
[    0.105810] Hardware name: linux,dummy-virt (DT)
[    0.107147] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
[    0.108876] pc : kernfs_find_and_get_ns+0x3c/0x7c
[    0.110244] lr : kernfs_find_and_get_ns+0x3c/0x7c
[...]
[    0.134087] Call trace:
[    0.134800]  kernfs_find_and_get_ns+0x3c/0x7c
[    0.136054]  safe_name+0x4c/0xd0
[    0.136994]  __of_attach_node_sysfs+0xf8/0x124
[    0.138287]  of_core_init+0x90/0xfc
[    0.139296]  driver_init+0x30/0x4c
[    0.140283]  kernel_init_freeable+0x160/0x1b8
[    0.141543]  kernel_init+0x30/0x140
[    0.142561]  ret_from_fork+0x10/0x18

While not having sysfs isn't a very common option these days,
it is still expected that such configuration would work.

Paper over it by bailing out from __of_attach_node_sysfs() if
CONFIG_SYSFS isn't enabled.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210820144722.169226-1-maz@kernel.org
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/kobj.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/kobj.c b/drivers/of/kobj.c
index a32e60b024b8..6675b5e56960 100644
--- a/drivers/of/kobj.c
+++ b/drivers/of/kobj.c
@@ -119,7 +119,7 @@ int __of_attach_node_sysfs(struct device_node *np)
 	struct property *pp;
 	int rc;
 
-	if (!of_kset)
+	if (!IS_ENABLED(CONFIG_SYSFS) || !of_kset)
 		return 0;
 
 	np->kobj.kset = of_kset;

From 834ecf61cebd84922443d9688d1cff84e4a0e9c2 Mon Sep 17 00:00:00 2001
From: Manish Narani <manish.narani@xilinx.com>
Date: Tue, 15 Jun 2021 16:13:51 +0530
Subject: [PATCH 0246/1750] mmc: sdhci-of-arasan: Modified SD default speed to
 19MHz for ZynqMP

[ Upstream commit c0b4e411a9b09748466ee06d2ae6772effa64dfb ]

SD standard speed timing was met only at 19MHz and not 25 MHz, that's
why changing driver to 19MHz. The reason for this is when a level shifter
is used on the board, timing was met for standard speed only at 19MHz.
Since this level shifter is commonly required for high speed modes,
the driver is modified to use standard speed of 19Mhz.

Signed-off-by: Manish Narani <manish.narani@xilinx.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/1623753837-21035-2-git-send-email-manish.narani@xilinx.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-of-arasan.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
index 3b8d456e857d..0c5479a06e9e 100644
--- a/drivers/mmc/host/sdhci-of-arasan.c
+++ b/drivers/mmc/host/sdhci-of-arasan.c
@@ -159,6 +159,12 @@ struct sdhci_arasan_data {
 /* Controller immediately reports SDHCI_CLOCK_INT_STABLE after enabling the
  * internal clock even when the clock isn't stable */
 #define SDHCI_ARASAN_QUIRK_CLOCK_UNSTABLE BIT(1)
+/*
+ * Some of the Arasan variations might not have timing requirements
+ * met at 25MHz for Default Speed mode, those controllers work at
+ * 19MHz instead
+ */
+#define SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN BIT(2)
 };
 
 struct sdhci_arasan_of_data {
@@ -290,6 +296,16 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
 		sdhci_arasan->is_phy_on = false;
 	}
 
+	if (sdhci_arasan->quirks & SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN) {
+		/*
+		 * Some of the Arasan variations might not have timing
+		 * requirements met at 25MHz for Default Speed mode,
+		 * those controllers work at 19MHz instead.
+		 */
+		if (clock == DEFAULT_SPEED_MAX_DTR)
+			clock = (DEFAULT_SPEED_MAX_DTR * 19) / 25;
+	}
+
 	/* Set the Input and Output Clock Phase Delays */
 	if (clk_data->set_clk_delays)
 		clk_data->set_clk_delays(host);
@@ -1598,6 +1614,8 @@ static int sdhci_arasan_probe(struct platform_device *pdev)
 	if (of_device_is_compatible(np, "xlnx,zynqmp-8.9a")) {
 		host->mmc_host_ops.execute_tuning =
 			arasan_zynqmp_execute_tuning;
+
+		sdhci_arasan->quirks |= SDHCI_ARASAN_QUIRK_CLOCK_25_BROKEN;
 	}
 
 	arasan_dt_parse_clk_phases(&pdev->dev, &sdhci_arasan->clk_data);

From 7f43da79ebc5e60ba8c0f9677e58a3fce37c12d6 Mon Sep 17 00:00:00 2001
From: Manish Narani <manish.narani@xilinx.com>
Date: Tue, 15 Jun 2021 16:13:54 +0530
Subject: [PATCH 0247/1750] mmc: sdhci-of-arasan: Check return value of
 non-void funtions

[ Upstream commit 66bad6ed2204fdb78a0a8fb89d824397106a5471 ]

At a couple of places, the return values of the non-void functions were
not getting checked. This was reported by the coverity tool. Modify the
code to check the return values of the same.

Addresses-Coverity: ("check_return")
Signed-off-by: Manish Narani <manish.narani@xilinx.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Link: https://lore.kernel.org/r/1623753837-21035-5-git-send-email-manish.narani@xilinx.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-of-arasan.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c
index 0c5479a06e9e..fc38db64a6b4 100644
--- a/drivers/mmc/host/sdhci-of-arasan.c
+++ b/drivers/mmc/host/sdhci-of-arasan.c
@@ -273,7 +273,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
 			 * through low speeds without power cycling.
 			 */
 			sdhci_set_clock(host, host->max_clk);
-			phy_power_on(sdhci_arasan->phy);
+			if (phy_power_on(sdhci_arasan->phy)) {
+				pr_err("%s: Cannot power on phy.\n",
+				       mmc_hostname(host->mmc));
+				return;
+			}
+
 			sdhci_arasan->is_phy_on = true;
 
 			/*
@@ -323,7 +328,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock)
 		msleep(20);
 
 	if (ctrl_phy) {
-		phy_power_on(sdhci_arasan->phy);
+		if (phy_power_on(sdhci_arasan->phy)) {
+			pr_err("%s: Cannot power on phy.\n",
+			       mmc_hostname(host->mmc));
+			return;
+		}
+
 		sdhci_arasan->is_phy_on = true;
 	}
 }
@@ -479,7 +489,9 @@ static int sdhci_arasan_suspend(struct device *dev)
 		ret = phy_power_off(sdhci_arasan->phy);
 		if (ret) {
 			dev_err(dev, "Cannot power off phy.\n");
-			sdhci_resume_host(host);
+			if (sdhci_resume_host(host))
+				dev_err(dev, "Cannot resume host.\n");
+
 			return ret;
 		}
 		sdhci_arasan->is_phy_on = false;

From 3aab5bffdde0d30a8885d0140afc2d58e76da714 Mon Sep 17 00:00:00 2001
From: Thomas Hebb <tommyhebb@gmail.com>
Date: Sun, 1 Aug 2021 04:46:14 -0700
Subject: [PATCH 0248/1750] mmc: rtsx_pci: Fix long reads when clock is
 prescaled

[ Upstream commit 3ac5e45291f3f0d699a721357380d4593bc2dcb3 ]

For unexplained reasons, the prescaler register for this device needs to
be cleared (set to 1) while performing a data read or else the command
will hang. This does not appear to affect the real clock rate sent out
on the bus, so I assume it's purely to work around a hardware bug.

During normal operation, the prescaler is already set to 1, so nothing
needs to be done. However, in "initial mode" (which is used for sub-MHz
clock speeds, like the core sets while enumerating cards), it's set to
128 and so we need to reset it during data reads. We currently fail to
do this for long reads.

This has no functional affect on the driver's operation currently
written, as the MMC core always sets a clock above 1MHz before
attempting any long reads. However, the core could conceivably set any
clock speed at any time and the driver should still work, so I think
this fix is worthwhile.

I personally encountered this issue while performing data recovery on an
external chip. My connections had poor signal integrity, so I modified
the core code to reduce the clock speed. Without this change, I saw the
card enumerate but was unable to actually read any data.

Writes don't seem to work in the situation described above even with
this change (and even if the workaround is extended to encompass data
write commands). I was not able to find a way to get them working.

Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
Link: https://lore.kernel.org/r/2fef280d8409ab0100c26c6ac7050227defd098d.1627818365.git.tommyhebb@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/rtsx_pci_sdmmc.c | 44 +++++++++++++++++++------------
 1 file changed, 27 insertions(+), 17 deletions(-)

diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index eb395e144207..e00167bcfaf6 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -539,23 +539,6 @@ static int sd_write_long_data(struct realtek_pci_sdmmc *host,
 	return 0;
 }
 
-static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
-{
-	struct mmc_data *data = mrq->data;
-
-	if (host->sg_count < 0) {
-		data->error = host->sg_count;
-		dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n",
-			__func__, host->sg_count);
-		return data->error;
-	}
-
-	if (data->flags & MMC_DATA_READ)
-		return sd_read_long_data(host, mrq);
-
-	return sd_write_long_data(host, mrq);
-}
-
 static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host)
 {
 	rtsx_pci_write_register(host->pcr, SD_CFG1,
@@ -568,6 +551,33 @@ static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host)
 			SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0);
 }
 
+static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq)
+{
+	struct mmc_data *data = mrq->data;
+	int err;
+
+	if (host->sg_count < 0) {
+		data->error = host->sg_count;
+		dev_dbg(sdmmc_dev(host), "%s: sg_count = %d is invalid\n",
+			__func__, host->sg_count);
+		return data->error;
+	}
+
+	if (data->flags & MMC_DATA_READ) {
+		if (host->initial_mode)
+			sd_disable_initial_mode(host);
+
+		err = sd_read_long_data(host, mrq);
+
+		if (host->initial_mode)
+			sd_enable_initial_mode(host);
+
+		return err;
+	}
+
+	return sd_write_long_data(host, mrq);
+}
+
 static void sd_normal_rw(struct realtek_pci_sdmmc *host,
 		struct mmc_request *mrq)
 {

From d1e382a04adafdf30cb0c738448327d13703422b Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@cn.fujitsu.com>
Date: Fri, 20 Aug 2021 09:55:53 +0800
Subject: [PATCH 0249/1750] selftests/bpf: Enlarge select() timeout for
 test_maps

[ Upstream commit 2d82d73da35b72b53fe0d96350a2b8d929d07e42 ]

0Day robot observed that it's easily timeout on a heavy load host.
-------------------
 # selftests: bpf: test_maps
 # Fork 1024 tasks to 'test_update_delete'
 # Fork 1024 tasks to 'test_update_delete'
 # Fork 100 tasks to 'test_hashmap'
 # Fork 100 tasks to 'test_hashmap_percpu'
 # Fork 100 tasks to 'test_hashmap_sizes'
 # Fork 100 tasks to 'test_hashmap_walk'
 # Fork 100 tasks to 'test_arraymap'
 # Fork 100 tasks to 'test_arraymap_percpu'
 # Failed sockmap unexpected timeout
 not ok 3 selftests: bpf: test_maps # exit=1
 # selftests: bpf: test_lru_map
 # nr_cpus:8
-------------------
Since this test will be scheduled by 0Day to a random host that could have
only a few cpus(2-8), enlarge the timeout to avoid a false NG report.

In practice, i tried to pin it to only one cpu by 'taskset 0x01 ./test_maps',
and knew 10S is likely enough, but i still perfer to a larger value 30.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20210820015556.23276-2-lizhijian@cn.fujitsu.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_maps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index 0d92ebcb335d..179e680e8d13 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -968,7 +968,7 @@ static void test_sockmap(unsigned int tasks, void *data)
 
 		FD_ZERO(&w);
 		FD_SET(sfd[3], &w);
-		to.tv_sec = 1;
+		to.tv_sec = 30;
 		to.tv_usec = 0;
 		s = select(sfd[3] + 1, &w, NULL, NULL, &to);
 		if (s == -1) {

From 7c7d6c9cd879a4bb19b101735858a175e698219b Mon Sep 17 00:00:00 2001
From: Nishad Kamdar <nishadkamdar@gmail.com>
Date: Wed, 25 Aug 2021 00:47:26 +0530
Subject: [PATCH 0250/1750] mmc: core: Return correct emmc response in case of
 ioctl error

[ Upstream commit e72a55f2e5ddcfb3dce0701caf925ce435b87682 ]

When a read/write command is sent via ioctl to the kernel,
and the command fails, the actual error response of the emmc
is not sent to the user.

IOCTL read/write tests are carried out using commands
17 (Single BLock Read), 24 (Single Block Write),
18 (Multi Block Read), 25 (Multi Block Write)

The tests are carried out on a 64Gb emmc device. All of these
tests try to access an "out of range" sector address (0x09B2FFFF).

It is seen that without the patch the response received by the user
is not OUT_OF_RANGE error (R1 response 31st bit is not set) as per
JEDEC specification. After applying the patch proper response is seen.
This is because the function returns without copying the response to
the user in case of failure. This patch fixes the issue.

Hence, this memcpy is required whether we get an error response or not.
Therefor it is moved up from the current position up to immediately
after we have called mmc_wait_for_req().

The test code and the output of only the CMD17 is included in the
commit to limit the message length.

CMD17 (Test Code Snippet):
==========================
        printf("Forming CMD%d\n", opt_idx);
        /*  single block read */
        cmd.blksz = 512;
        cmd.blocks = 1;
        cmd.write_flag = 0;
        cmd.opcode = 17;
        //cmd.arg = atoi(argv[3]);
        cmd.arg = 0x09B2FFFF;
        /* Expecting response R1B */
        cmd.flags = MMC_RSP_SPI_R1 | MMC_RSP_R1 | MMC_CMD_ADTC;

        memset(data, 0, sizeof(__u8) * 512);
        mmc_ioc_cmd_set_data(cmd, data);

        printf("Sending CMD%d: ARG[0x%08x]\n", opt_idx, cmd.arg);
        if(ioctl(fd, MMC_IOC_CMD, &cmd))
                perror("Error");

        printf("\nResponse: %08x\n", cmd.response[0]);

CMD17 (Output without patch):
=============================
test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17
Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4
Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 0x09B2FFF]
Forming CMD17
Sending CMD17: ARG[0x09b2ffff]
Error: Connection timed out

Response: 00000000
(Incorrect response)

CMD17 (Output with patch):
==========================
test@test-LIVA-Z:~$ sudo ./mmc cmd_test /dev/mmcblk0 17
[sudo] password for test:
Entering the do_mmc_commands:Device: /dev/mmcblk0 nargs:4
Entering the do_mmc_commands:Device: /dev/mmcblk0 options[17, 09B2FFFF]
Forming CMD17
Sending CMD17: ARG[0x09b2ffff]
Error: Connection timed out

Response: 80000900
(Correct OUT_OF_ERROR response as per JEDEC specification)

Signed-off-by: Nishad Kamdar <nishadkamdar@gmail.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Link: https://lore.kernel.org/r/20210824191726.8296-1-nishadkamdar@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/core/block.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 87bac9920702..94caee49da99 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -541,6 +541,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
 		return mmc_sanitize(card);
 
 	mmc_wait_for_req(card->host, &mrq);
+	memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp));
 
 	if (cmd.error) {
 		dev_err(mmc_dev(card->host), "%s: cmd error %d\n",
@@ -590,8 +591,6 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md,
 	if (idata->ic.postsleep_min_us)
 		usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
 
-	memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp));
-
 	if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) {
 		/*
 		 * Ensure RPMB/R1B command has completed by polling CMD13

From ba2faddf1f14c2a7ecb0adecaebcc332c919cf05 Mon Sep 17 00:00:00 2001
From: Ding Hui <dinghui@sangfor.com.cn>
Date: Tue, 17 Aug 2021 22:55:10 +0800
Subject: [PATCH 0251/1750] cifs: fix wrong release in sess_alloc_buffer()
 failed path

[ Upstream commit d72c74197b70bc3c95152f351a568007bffa3e11 ]

smb_buf is allocated by small_smb_init_no_tc(), and buf type is
CIFS_SMALL_BUFFER, so we should use cifs_small_buf_release() to
release it in failed path.

Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/sess.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 1a0298d1e7cd..d58c5ffeca0d 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -888,7 +888,7 @@ sess_alloc_buffer(struct sess_data *sess_data, int wct)
 	return 0;
 
 out_free_smb_buf:
-	kfree(smb_buf);
+	cifs_small_buf_release(smb_buf);
 	sess_data->iov[0].iov_base = NULL;
 	sess_data->iov[0].iov_len = 0;
 	sess_data->buf0_type = CIFS_NO_BUFFER;

From c0751eeb938c079d9c7c8e50e16fe6f5ae52fe1b Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Fri, 20 Aug 2021 15:35:01 +0300
Subject: [PATCH 0252/1750] Revert "USB: xhci: fix U1/U2 handling for hardware
 with XHCI_INTEL_HOST quirk set"

[ Upstream commit 2847c46c61486fd8bca9136a6e27177212e78c69 ]

This reverts commit 5d5323a6f3625f101dbfa94ba3ef7706cce38760.

That commit effectively disabled Intel host initiated U1/U2 lpm for devices
with periodic endpoints.

Before that commit we disabled host initiated U1/U2 lpm if the exit latency
was larger than any periodic endpoint service interval, this is according
to xhci spec xhci 1.1 specification section 4.23.5.2

After that commit we incorrectly checked that service interval was smaller
than U1/U2 inactivity timeout. This is not relevant, and can't happen for
Intel hosts as previously set U1/U2 timeout = 105% * service interval.

Patch claimed it solved cases where devices can't be enumerated because of
bandwidth issues. This might be true but it's a side effect of accidentally
turning off lpm.

exit latency calculations have been revised since then

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20210820123503.2605901-5-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/xhci.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index a8d97e23f601..c51391b45207 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4666,19 +4666,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
 {
 	unsigned long long timeout_ns;
 
-	if (xhci->quirks & XHCI_INTEL_HOST)
-		timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
-	else
-		timeout_ns = udev->u1_params.sel;
-
 	/* Prevent U1 if service interval is shorter than U1 exit latency */
 	if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
-		if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
+		if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
 			dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
 			return USB3_LPM_DISABLED;
 		}
 	}
 
+	if (xhci->quirks & XHCI_INTEL_HOST)
+		timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
+	else
+		timeout_ns = udev->u1_params.sel;
+
 	/* The U1 timeout is encoded in 1us intervals.
 	 * Don't return a timeout of zero, because that's USB3_LPM_DISABLED.
 	 */
@@ -4730,19 +4730,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
 {
 	unsigned long long timeout_ns;
 
-	if (xhci->quirks & XHCI_INTEL_HOST)
-		timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
-	else
-		timeout_ns = udev->u2_params.sel;
-
 	/* Prevent U2 if service interval is shorter than U2 exit latency */
 	if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
-		if (xhci_service_interval_to_ns(desc) <= timeout_ns) {
+		if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
 			dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
 			return USB3_LPM_DISABLED;
 		}
 	}
 
+	if (xhci->quirks & XHCI_INTEL_HOST)
+		timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
+	else
+		timeout_ns = udev->u2_params.sel;
+
 	/* The U2 timeout is encoded in 256us intervals */
 	timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000);
 	/* If the necessary timeout value is bigger than what we can set in the

From 8de01a896c1bc14b6b65b8d26013626597a45eda Mon Sep 17 00:00:00 2001
From: Nadezda Lutovinova <lutovinova@ispras.ru>
Date: Thu, 19 Aug 2021 19:33:23 +0300
Subject: [PATCH 0253/1750] usb: musb: musb_dsps: request_irq() after
 initializing musb

[ Upstream commit 7c75bde329d7e2a93cf86a5c15c61f96f1446cdc ]

If IRQ occurs between calling  dsps_setup_optional_vbus_irq()
and  dsps_create_musb_pdev(), then null pointer dereference occurs
since glue->musb wasn't initialized yet.

The patch puts initializing of neccesery data before registration
of the interrupt handler.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210819163323.17714-1-lutovinova@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/musb/musb_dsps.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 5892f3ce0cdc..ce9fc46c9266 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -890,23 +890,22 @@ static int dsps_probe(struct platform_device *pdev)
 	if (!glue->usbss_base)
 		return -ENXIO;
 
-	if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
-		ret = dsps_setup_optional_vbus_irq(pdev, glue);
-		if (ret)
-			goto err_iounmap;
-	}
-
 	platform_set_drvdata(pdev, glue);
 	pm_runtime_enable(&pdev->dev);
 	ret = dsps_create_musb_pdev(glue, pdev);
 	if (ret)
 		goto err;
 
+	if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
+		ret = dsps_setup_optional_vbus_irq(pdev, glue);
+		if (ret)
+			goto err;
+	}
+
 	return 0;
 
 err:
 	pm_runtime_disable(&pdev->dev);
-err_iounmap:
 	iounmap(glue->usbss_base);
 	return ret;
 }

From 29c8f13a345d9399648fc5cffad244db0c8e3fa6 Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Sat, 21 Aug 2021 00:31:21 +0530
Subject: [PATCH 0254/1750] usbip: give back URBs for unsent unlink requests
 during cleanup

[ Upstream commit 258c81b341c8025d79073ce2d6ce19dcdc7d10d2 ]

In vhci_device_unlink_cleanup(), the URBs for unsent unlink requests are
not given back. This sometimes causes usb_kill_urb to wait indefinitely
for that urb to be given back. syzbot has reported a hung task issue [1]
for this.

To fix this, give back the urbs corresponding to unsent unlink requests
(unlink_tx list) similar to how urbs corresponding to unanswered unlink
requests (unlink_rx list) are given back.

[1]: https://syzkaller.appspot.com/bug?id=08f12df95ae7da69814e64eb5515d5a85ed06b76

Reported-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com
Tested-by: syzbot+74d6ef051d3d2eacf428@syzkaller.appspotmail.com
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Link: https://lore.kernel.org/r/20210820190122.16379-2-mail@anirudhrb.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/usbip/vhci_hcd.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 4ba6bcdaa8e9..190bd3d1c1f0 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -957,8 +957,32 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
 	spin_lock(&vdev->priv_lock);
 
 	list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) {
+		struct urb *urb;
+
+		/* give back urb of unsent unlink request */
 		pr_info("unlink cleanup tx %lu\n", unlink->unlink_seqnum);
+
+		urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum);
+		if (!urb) {
+			list_del(&unlink->list);
+			kfree(unlink);
+			continue;
+		}
+
+		urb->status = -ENODEV;
+
+		usb_hcd_unlink_urb_from_ep(hcd, urb);
+
 		list_del(&unlink->list);
+
+		spin_unlock(&vdev->priv_lock);
+		spin_unlock_irqrestore(&vhci->lock, flags);
+
+		usb_hcd_giveback_urb(hcd, urb, urb->status);
+
+		spin_lock_irqsave(&vhci->lock, flags);
+		spin_lock(&vdev->priv_lock);
+
 		kfree(unlink);
 	}
 

From 7344a8a80190f7215752f6a90d1903b1f31cc9b9 Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Thu, 19 Aug 2021 16:59:37 -0600
Subject: [PATCH 0255/1750] usbip:vhci_hcd USB port can get stuck in the
 disabled state

[ Upstream commit 66cce9e73ec61967ed1f97f30cee79bd9a2bb7ee ]

When a remote usb device is attached to the local Virtual USB
Host Controller Root Hub port, the bound device driver may send
a port reset command.

vhci_hcd accepts port resets only when the device doesn't have
port address assigned to it. When reset happens device is in
assigned/used state and vhci_hcd rejects it leaving the port in
a stuck state.

This problem was found when a blue-tooth or xbox wireless dongle
was passed through using usbip.

A few drivers reset the port during probe including mt76 driver
specific to this bug report. Fix the problem with a change to
honor reset requests when device is in used state (VDEV_ST_USED).

Reported-and-tested-by: Michael <msbroadf@gmail.com>
Suggested-by: Michael <msbroadf@gmail.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://lore.kernel.org/r/20210819225937.41037-1-skhan@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/usbip/vhci_hcd.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 190bd3d1c1f0..b07b2925ff78 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -455,8 +455,14 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
 			vhci_hcd->port_status[rhport] &= ~(1 << USB_PORT_FEAT_RESET);
 			vhci_hcd->re_timeout = 0;
 
+			/*
+			 * A few drivers do usb reset during probe when
+			 * the device could be in VDEV_ST_USED state
+			 */
 			if (vhci_hcd->vdev[rhport].ud.status ==
-			    VDEV_ST_NOTASSIGNED) {
+				VDEV_ST_NOTASSIGNED ||
+			    vhci_hcd->vdev[rhport].ud.status ==
+				VDEV_ST_USED) {
 				usbip_dbg_vhci_rh(
 					" enable rhport %d (status %u)\n",
 					rhport,

From 969eddc3b4dcd0610fb370a5084fd06cec5ad5ab Mon Sep 17 00:00:00 2001
From: Sugar Zhang <sugar.zhang@rock-chips.com>
Date: Thu, 26 Aug 2021 12:01:50 +0800
Subject: [PATCH 0256/1750] ASoC: rockchip: i2s: Fix regmap_ops hang

[ Upstream commit 53ca9b9777b95cdd689181d7c547e38dc79adad0 ]

API 'set_fmt' maybe called when PD is off, in the situation,
any register access will hang the system. so, enable PD
before r/w register.

Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
Link: https://lore.kernel.org/r/1629950520-14190-4-git-send-email-sugar.zhang@rock-chips.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/rockchip/rockchip_i2s.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
index 593299675b8c..43522d7701e9 100644
--- a/sound/soc/rockchip/rockchip_i2s.c
+++ b/sound/soc/rockchip/rockchip_i2s.c
@@ -186,7 +186,9 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 {
 	struct rk_i2s_dev *i2s = to_info(cpu_dai);
 	unsigned int mask = 0, val = 0;
+	int ret = 0;
 
+	pm_runtime_get_sync(cpu_dai->dev);
 	mask = I2S_CKR_MSS_MASK;
 	switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
 	case SND_SOC_DAIFMT_CBS_CFS:
@@ -199,7 +201,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 		i2s->is_master_mode = false;
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_pm_put;
 	}
 
 	regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
@@ -213,7 +216,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 		val = I2S_CKR_CKP_POS;
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_pm_put;
 	}
 
 	regmap_update_bits(i2s->regmap, I2S_CKR, mask, val);
@@ -236,7 +240,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 		val = I2S_TXCR_TFS_PCM | I2S_TXCR_PBM_MODE(1);
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_pm_put;
 	}
 
 	regmap_update_bits(i2s->regmap, I2S_TXCR, mask, val);
@@ -259,12 +264,16 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 		val = I2S_RXCR_TFS_PCM | I2S_RXCR_PBM_MODE(1);
 		break;
 	default:
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err_pm_put;
 	}
 
 	regmap_update_bits(i2s->regmap, I2S_RXCR, mask, val);
 
-	return 0;
+err_pm_put:
+	pm_runtime_put(cpu_dai->dev);
+
+	return ret;
 }
 
 static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream,

From 27d4a96addefb9bffb78b3556ebb2c5ece64912f Mon Sep 17 00:00:00 2001
From: Xiaotan Luo <lxt@rock-chips.com>
Date: Thu, 26 Aug 2021 12:02:36 +0800
Subject: [PATCH 0257/1750] ASoC: rockchip: i2s: Fixup config for
 DAIFMT_DSP_A/B

[ Upstream commit 1bf56843e664eef2525bdbfae6a561e98910f676 ]

- DSP_A: PCM delay 1 bit mode, L data MSB after FRM LRC
- DSP_B: PCM no delay mode, L data MSB during FRM LRC

Signed-off-by: Xiaotan Luo <lxt@rock-chips.com>
Signed-off-by: Sugar Zhang <sugar.zhang@rock-chips.com>
Link: https://lore.kernel.org/r/1629950562-14281-3-git-send-email-sugar.zhang@rock-chips.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/rockchip/rockchip_i2s.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
index 43522d7701e9..fa84ec695b52 100644
--- a/sound/soc/rockchip/rockchip_i2s.c
+++ b/sound/soc/rockchip/rockchip_i2s.c
@@ -233,12 +233,12 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 	case SND_SOC_DAIFMT_I2S:
 		val = I2S_TXCR_IBM_NORMAL;
 		break;
-	case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
-		val = I2S_TXCR_TFS_PCM;
-		break;
-	case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
+	case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */
 		val = I2S_TXCR_TFS_PCM | I2S_TXCR_PBM_MODE(1);
 		break;
+	case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */
+		val = I2S_TXCR_TFS_PCM;
+		break;
 	default:
 		ret = -EINVAL;
 		goto err_pm_put;
@@ -257,12 +257,12 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai,
 	case SND_SOC_DAIFMT_I2S:
 		val = I2S_RXCR_IBM_NORMAL;
 		break;
-	case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */
-		val = I2S_RXCR_TFS_PCM;
-		break;
-	case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */
+	case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */
 		val = I2S_RXCR_TFS_PCM | I2S_RXCR_PBM_MODE(1);
 		break;
+	case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */
+		val = I2S_RXCR_TFS_PCM;
+		break;
 	default:
 		ret = -EINVAL;
 		goto err_pm_put;

From 0e9f4492219f8f991163691aad43897da8478c4e Mon Sep 17 00:00:00 2001
From: Sean Keely <Sean.Keely@amd.com>
Date: Thu, 19 Aug 2021 21:26:14 -0500
Subject: [PATCH 0258/1750] drm/amdkfd: Account for SH/SE count when setting up
 cu masks.

[ Upstream commit 1ec06c2dee679e9f089e78ed20cb74ee90155f61 ]

On systems with multiple SH per SE compute_static_thread_mgmt_se#
is split into independent masks, one for each SH, in the upper and
lower 16 bits.  We need to detect this and apply cu masking to each
SH.  The cu mask bits are assigned first to each SE, then to
alternate SHs, then finally to higher CU id.  This ensures that
the maximum number of SPIs are engaged as early as possible while
balancing CU assignment to each SH.

v2: Use max SH/SE rather than max SH in cu_per_sh.

v3: Fix comment blocks, ensure se_mask is initially zero filled,
    and correctly assign se.sh.cu positions to unset bits in cu_mask.

Signed-off-by: Sean Keely <Sean.Keely@amd.com>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 80 +++++++++++++++-----
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h |  1 +
 2 files changed, 62 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
index 88813dad731f..c021519af810 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c
@@ -98,36 +98,78 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm,
 		uint32_t *se_mask)
 {
 	struct kfd_cu_info cu_info;
-	uint32_t cu_per_se[KFD_MAX_NUM_SE] = {0};
-	int i, se, sh, cu = 0;
-
+	uint32_t cu_per_sh[KFD_MAX_NUM_SE][KFD_MAX_NUM_SH_PER_SE] = {0};
+	int i, se, sh, cu;
 	amdgpu_amdkfd_get_cu_info(mm->dev->kgd, &cu_info);
 
 	if (cu_mask_count > cu_info.cu_active_number)
 		cu_mask_count = cu_info.cu_active_number;
 
+	/* Exceeding these bounds corrupts the stack and indicates a coding error.
+	 * Returning with no CU's enabled will hang the queue, which should be
+	 * attention grabbing.
+	 */
+	if (cu_info.num_shader_engines > KFD_MAX_NUM_SE) {
+		pr_err("Exceeded KFD_MAX_NUM_SE, chip reports %d\n", cu_info.num_shader_engines);
+		return;
+	}
+	if (cu_info.num_shader_arrays_per_engine > KFD_MAX_NUM_SH_PER_SE) {
+		pr_err("Exceeded KFD_MAX_NUM_SH, chip reports %d\n",
+			cu_info.num_shader_arrays_per_engine * cu_info.num_shader_engines);
+		return;
+	}
+	/* Count active CUs per SH.
+	 *
+	 * Some CUs in an SH may be disabled.	HW expects disabled CUs to be
+	 * represented in the high bits of each SH's enable mask (the upper and lower
+	 * 16 bits of se_mask) and will take care of the actual distribution of
+	 * disabled CUs within each SH automatically.
+	 * Each half of se_mask must be filled only on bits 0-cu_per_sh[se][sh]-1.
+	 *
+	 * See note on Arcturus cu_bitmap layout in gfx_v9_0_get_cu_info.
+	 */
 	for (se = 0; se < cu_info.num_shader_engines; se++)
 		for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++)
-			cu_per_se[se] += hweight32(cu_info.cu_bitmap[se % 4][sh + (se / 4)]);
+			cu_per_sh[se][sh] = hweight32(cu_info.cu_bitmap[se % 4][sh + (se / 4)]);
 
-	/* Symmetrically map cu_mask to all SEs:
-	 * cu_mask[0] bit0 -> se_mask[0] bit0;
-	 * cu_mask[0] bit1 -> se_mask[1] bit0;
-	 * ... (if # SE is 4)
-	 * cu_mask[0] bit4 -> se_mask[0] bit1;
+	/* Symmetrically map cu_mask to all SEs & SHs:
+	 * se_mask programs up to 2 SH in the upper and lower 16 bits.
+	 *
+	 * Examples
+	 * Assuming 1 SH/SE, 4 SEs:
+	 * cu_mask[0] bit0 -> se_mask[0] bit0
+	 * cu_mask[0] bit1 -> se_mask[1] bit0
 	 * ...
+	 * cu_mask[0] bit4 -> se_mask[0] bit1
+	 * ...
+	 *
+	 * Assuming 2 SH/SE, 4 SEs
+	 * cu_mask[0] bit0 -> se_mask[0] bit0 (SE0,SH0,CU0)
+	 * cu_mask[0] bit1 -> se_mask[1] bit0 (SE1,SH0,CU0)
+	 * ...
+	 * cu_mask[0] bit4 -> se_mask[0] bit16 (SE0,SH1,CU0)
+	 * cu_mask[0] bit5 -> se_mask[1] bit16 (SE1,SH1,CU0)
+	 * ...
+	 * cu_mask[0] bit8 -> se_mask[0] bit1 (SE0,SH0,CU1)
+	 * ...
+	 *
+	 * First ensure all CUs are disabled, then enable user specified CUs.
 	 */
-	se = 0;
-	for (i = 0; i < cu_mask_count; i++) {
-		if (cu_mask[i / 32] & (1 << (i % 32)))
-			se_mask[se] |= 1 << cu;
+	for (i = 0; i < cu_info.num_shader_engines; i++)
+		se_mask[i] = 0;
 
-		do {
-			se++;
-			if (se == cu_info.num_shader_engines) {
-				se = 0;
-				cu++;
+	i = 0;
+	for (cu = 0; cu < 16; cu++) {
+		for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) {
+			for (se = 0; se < cu_info.num_shader_engines; se++) {
+				if (cu_per_sh[se][sh] > cu) {
+					if (cu_mask[i / 32] & (1 << (i % 32)))
+						se_mask[se] |= 1 << (cu + sh * 16);
+					i++;
+					if (i == cu_mask_count)
+						return;
+				}
 			}
-		} while (cu >= cu_per_se[se] && cu < 32);
+		}
 	}
 }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
index fbdb16418847..4edc012e3138 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h
@@ -27,6 +27,7 @@
 #include "kfd_priv.h"
 
 #define KFD_MAX_NUM_SE 8
+#define KFD_MAX_NUM_SH_PER_SE 2
 
 /**
  * struct mqd_manager

From eb04c51a439e38dbbab363cf5f0599cbe0507b13 Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Tue, 24 Aug 2021 22:36:03 -0400
Subject: [PATCH 0259/1750] nfsd: fix crash on LOCKT on reexported NFSv3

[ Upstream commit 0bcc7ca40bd823193224e9f38bafbd8325aaf566 ]

Unlike other filesystems, NFSv3 tries to use fl_file in the GETLK case.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfs4state.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 142aac9b63a8..0313390fa4b4 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6855,8 +6855,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
 /*
  * The NFSv4 spec allows a client to do a LOCKT without holding an OPEN,
  * so we do a temporary open here just to get an open file to pass to
- * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
- * inode operation.)
+ * vfs_test_lock.
  */
 static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
 {
@@ -6871,7 +6870,9 @@ static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct
 							NFSD_MAY_READ));
 	if (err)
 		goto out;
+	lock->fl_file = nf->nf_file;
 	err = nfserrno(vfs_test_lock(nf->nf_file, lock));
+	lock->fl_file = NULL;
 out:
 	fh_unlock(fhp);
 	nfsd_file_put(nf);

From 608c8359c567b4a04dedbe121d711b51797e390e Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 2 Aug 2021 17:09:38 +0300
Subject: [PATCH 0260/1750] iwlwifi: pcie: free RBs during configure

[ Upstream commit 6ac5720086c8b176794eb74c5cc09f8b79017f38 ]

When switching op-modes, or more generally when reconfiguring,
we might switch the RB size. In _iwl_pcie_rx_init() we have a
comment saying we must free all RBs since we might switch the
size, but this is actually too late: the switch has been done
and we'll free the buffers with the wrong size.

Fix this by always freeing the buffers, if any, at the start
of configure, instead of only after the size may have changed.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210802170640.42d7c93279c4.I07f74e65aab0e3d965a81206fcb289dc92d74878@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/rx.c    | 5 ++++-
 drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 94299f259518..2c13fa8f2820 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -544,6 +544,9 @@ void iwl_pcie_free_rbs_pool(struct iwl_trans *trans)
 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 	int i;
 
+	if (!trans_pcie->rx_pool)
+		return;
+
 	for (i = 0; i < RX_POOL_SIZE(trans_pcie->num_rx_bufs); i++) {
 		if (!trans_pcie->rx_pool[i].page)
 			continue;
@@ -1094,7 +1097,7 @@ static int _iwl_pcie_rx_init(struct iwl_trans *trans)
 	INIT_LIST_HEAD(&rba->rbd_empty);
 	spin_unlock(&rba->lock);
 
-	/* free all first - we might be reconfigured for a different size */
+	/* free all first - we overwrite everything here */
 	iwl_pcie_free_rbs_pool(trans);
 
 	for (i = 0; i < RX_QUEUE_SIZE; i++)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index bb990be7c870..082768ec8aa8 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1909,6 +1909,9 @@ static void iwl_trans_pcie_configure(struct iwl_trans *trans,
 {
 	struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
+	/* free all first - we might be reconfigured for a different size */
+	iwl_pcie_free_rbs_pool(trans);
+
 	trans->txqs.cmd.q_id = trans_cfg->cmd_queue;
 	trans->txqs.cmd.fifo = trans_cfg->cmd_fifo;
 	trans->txqs.cmd.wdg_timeout = trans_cfg->cmd_q_wdg_timeout;

From 3ed8982df50ed30165e1f2148958def2bb6dc2e1 Mon Sep 17 00:00:00 2001
From: Zhang Qilong <zhangqilong3@huawei.com>
Date: Mon, 2 Aug 2021 17:28:24 +0300
Subject: [PATCH 0261/1750] iwlwifi: mvm: fix a memory leak in
 iwl_mvm_mac_ctxt_beacon_changed

[ Upstream commit 0f5d44ac6e55551798dd3da0ff847c8df5990822 ]

If beacon_inject_active is true, we will return without freeing
beacon.  Fid that by freeing it before returning.

Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
[reworded the commit message]
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210802172232.d16206ca60fc.I9984a9b442c84814c307cee3213044e24d26f38a@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index 5243b84e653c..6a8bf9bb9c45 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -1044,8 +1044,10 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
 		return -ENOMEM;
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-	if (mvm->beacon_inject_active)
+	if (mvm->beacon_inject_active) {
+		dev_kfree_skb(beacon);
 		return -EBUSY;
+	}
 #endif
 
 	ret = iwl_mvm_mac_ctxt_send_beacon(mvm, vif, beacon);

From 9e80a3d88f4dfccd3371a91cdd778f79f738a029 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 2 Aug 2021 17:28:27 +0300
Subject: [PATCH 0262/1750] iwlwifi: mvm: avoid static queue number aliasing

[ Upstream commit c6ce1c74ef2923b8ffd85f7f8b486f804f343b39 ]

When TVQM is enabled (iwl_mvm_has_new_tx_api() is true), then
queue numbers are just sequentially assigned 0, 1, 2, ...
Prior to TVQM, in DQA, there were some statically allocated
queue numbers:
 * IWL_MVM_DQA_AUX_QUEUE == 1,
 * both IWL_MVM_DQA_INJECT_MONITOR_QUEUE and
   IWL_MVM_DQA_P2P_DEVICE_QUEUE == 2, and
 * IWL_MVM_DQA_AP_PROBE_RESP_QUEUE == 9.

Now, these values are assigned to the members mvm->aux_queue,
mvm->snif_queue, mvm->probe_queue and mvm->p2p_dev_queue by
default. Normally, this doesn't really matter, and if TVQM is
in fact available we override them to the real values after
allocating a queue for use there.

However, this allocation doesn't always happen. For example,
for mvm->p2p_dev_queue (== 2) it only happens when the P2P
Device interface is started, if any. If it's not started, the
value in mvm->p2p_dev_queue remains 2. This wouldn't really
matter all that much if it weren't for iwl_mvm_is_static_queue()
which checks a queue number against one of those four static
numbers.

Now, if no P2P Device or monitor interface is added then queue
2 may be dynamically allocated, yet alias mvm->p2p_dev_queue or
mvm->snif_queue, and thus iwl_mvm_is_static_queue() erroneously
returns true for it. If it then gets full, all interface queues
are stopped, instead of just backpressuring against the one TXQ
that's really the only affected one.

This clearly can lead to issues, as everything is stopped even
if just a single TXQ filled its corresponding HW queue, if it
happens to have an appropriate number (2 or 9, AUX is always
reassigned.) Due to a mac80211 bug, this also led to a situation
in which the queues remained stopped across a deauthentication
and then attempts to connect to a new AP started failing, but
that's fixed separately.

Fix all of this by simply initializing the queue numbers to
the invalid value until they're used, if TVQM is enabled, and
also setting them back to that value when the queues are later
freed again.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210802172232.2e47e623f9e2.I9b0830dafbb68ef35b7b8f0f46160abec02ac7d0@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 24 +++++++++++++---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 30 ++++++++++++--------
 2 files changed, 38 insertions(+), 16 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index cb83490f1016..0be8ff30b13e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -678,10 +678,26 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
 	mvm->fw_restart = iwlwifi_mod_params.fw_restart ? -1 : 0;
 
-	mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE;
-	mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE;
-	mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
-	mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
+	if (iwl_mvm_has_new_tx_api(mvm)) {
+		/*
+		 * If we have the new TX/queue allocation API initialize them
+		 * all to invalid numbers. We'll rewrite the ones that we need
+		 * later, but that doesn't happen for all of them all of the
+		 * time (e.g. P2P Device is optional), and if a dynamic queue
+		 * ends up getting number 2 (IWL_MVM_DQA_P2P_DEVICE_QUEUE) then
+		 * iwl_mvm_is_static_queue() erroneously returns true, and we
+		 * might have things getting stuck.
+		 */
+		mvm->aux_queue = IWL_MVM_INVALID_QUEUE;
+		mvm->snif_queue = IWL_MVM_INVALID_QUEUE;
+		mvm->probe_queue = IWL_MVM_INVALID_QUEUE;
+		mvm->p2p_dev_queue = IWL_MVM_INVALID_QUEUE;
+	} else {
+		mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE;
+		mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE;
+		mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE;
+		mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE;
+	}
 
 	mvm->sf_state = SF_UNINIT;
 	if (iwl_mvm_has_unified_ucode(mvm))
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index a66a5c19474a..ef62839894c7 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -362,8 +362,9 @@ static int iwl_mvm_invalidate_sta_queue(struct iwl_mvm *mvm, int queue,
 }
 
 static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-			       int queue, u8 tid, u8 flags)
+			       u16 *queueptr, u8 tid, u8 flags)
 {
+	int queue = *queueptr;
 	struct iwl_scd_txq_cfg_cmd cmd = {
 		.scd_queue = queue,
 		.action = SCD_CFG_DISABLE_QUEUE,
@@ -372,6 +373,7 @@ static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
 	if (iwl_mvm_has_new_tx_api(mvm)) {
 		iwl_trans_txq_free(mvm->trans, queue);
+		*queueptr = IWL_MVM_INVALID_QUEUE;
 
 		return 0;
 	}
@@ -533,6 +535,7 @@ static int iwl_mvm_free_inactive_queue(struct iwl_mvm *mvm, int queue,
 	u8 sta_id, tid;
 	unsigned long disable_agg_tids = 0;
 	bool same_sta;
+	u16 queue_tmp = queue;
 	int ret;
 
 	lockdep_assert_held(&mvm->mutex);
@@ -555,7 +558,7 @@ static int iwl_mvm_free_inactive_queue(struct iwl_mvm *mvm, int queue,
 		iwl_mvm_invalidate_sta_queue(mvm, queue,
 					     disable_agg_tids, false);
 
-	ret = iwl_mvm_disable_txq(mvm, old_sta, queue, tid, 0);
+	ret = iwl_mvm_disable_txq(mvm, old_sta, &queue_tmp, tid, 0);
 	if (ret) {
 		IWL_ERR(mvm,
 			"Failed to free inactive queue %d (ret=%d)\n",
@@ -1230,6 +1233,7 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm,
 	unsigned int wdg_timeout =
 		iwl_mvm_get_wd_timeout(mvm, mvmsta->vif, false, false);
 	int queue = -1;
+	u16 queue_tmp;
 	unsigned long disable_agg_tids = 0;
 	enum iwl_mvm_agg_state queue_state;
 	bool shared_queue = false, inc_ssn;
@@ -1378,7 +1382,8 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm,
 	return 0;
 
 out_err:
-	iwl_mvm_disable_txq(mvm, sta, queue, tid, 0);
+	queue_tmp = queue;
+	iwl_mvm_disable_txq(mvm, sta, &queue_tmp, tid, 0);
 
 	return ret;
 }
@@ -1825,7 +1830,7 @@ static void iwl_mvm_disable_sta_queues(struct iwl_mvm *mvm,
 		if (mvm_sta->tid_data[i].txq_id == IWL_MVM_INVALID_QUEUE)
 			continue;
 
-		iwl_mvm_disable_txq(mvm, sta, mvm_sta->tid_data[i].txq_id, i,
+		iwl_mvm_disable_txq(mvm, sta, &mvm_sta->tid_data[i].txq_id, i,
 				    0);
 		mvm_sta->tid_data[i].txq_id = IWL_MVM_INVALID_QUEUE;
 	}
@@ -2033,7 +2038,7 @@ static int iwl_mvm_add_int_sta_with_queue(struct iwl_mvm *mvm, int macidx,
 	ret = iwl_mvm_add_int_sta_common(mvm, sta, addr, macidx, maccolor);
 	if (ret) {
 		if (!iwl_mvm_has_new_tx_api(mvm))
-			iwl_mvm_disable_txq(mvm, NULL, *queue,
+			iwl_mvm_disable_txq(mvm, NULL, queue,
 					    IWL_MAX_TID_COUNT, 0);
 		return ret;
 	}
@@ -2106,7 +2111,7 @@ int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 	if (WARN_ON_ONCE(mvm->snif_sta.sta_id == IWL_MVM_INVALID_STA))
 		return -EINVAL;
 
-	iwl_mvm_disable_txq(mvm, NULL, mvm->snif_queue, IWL_MAX_TID_COUNT, 0);
+	iwl_mvm_disable_txq(mvm, NULL, &mvm->snif_queue, IWL_MAX_TID_COUNT, 0);
 	ret = iwl_mvm_rm_sta_common(mvm, mvm->snif_sta.sta_id);
 	if (ret)
 		IWL_WARN(mvm, "Failed sending remove station\n");
@@ -2123,7 +2128,7 @@ int iwl_mvm_rm_aux_sta(struct iwl_mvm *mvm)
 	if (WARN_ON_ONCE(mvm->aux_sta.sta_id == IWL_MVM_INVALID_STA))
 		return -EINVAL;
 
-	iwl_mvm_disable_txq(mvm, NULL, mvm->aux_queue, IWL_MAX_TID_COUNT, 0);
+	iwl_mvm_disable_txq(mvm, NULL, &mvm->aux_queue, IWL_MAX_TID_COUNT, 0);
 	ret = iwl_mvm_rm_sta_common(mvm, mvm->aux_sta.sta_id);
 	if (ret)
 		IWL_WARN(mvm, "Failed sending remove station\n");
@@ -2219,7 +2224,7 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
 					  struct ieee80211_vif *vif)
 {
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-	int queue;
+	u16 *queueptr, queue;
 
 	lockdep_assert_held(&mvm->mutex);
 
@@ -2228,10 +2233,10 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
 	switch (vif->type) {
 	case NL80211_IFTYPE_AP:
 	case NL80211_IFTYPE_ADHOC:
-		queue = mvm->probe_queue;
+		queueptr = &mvm->probe_queue;
 		break;
 	case NL80211_IFTYPE_P2P_DEVICE:
-		queue = mvm->p2p_dev_queue;
+		queueptr = &mvm->p2p_dev_queue;
 		break;
 	default:
 		WARN(1, "Can't free bcast queue on vif type %d\n",
@@ -2239,7 +2244,8 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm,
 		return;
 	}
 
-	iwl_mvm_disable_txq(mvm, NULL, queue, IWL_MAX_TID_COUNT, 0);
+	queue = *queueptr;
+	iwl_mvm_disable_txq(mvm, NULL, queueptr, IWL_MAX_TID_COUNT, 0);
 	if (iwl_mvm_has_new_tx_api(mvm))
 		return;
 
@@ -2474,7 +2480,7 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 
 	iwl_mvm_flush_sta(mvm, &mvmvif->mcast_sta, true);
 
-	iwl_mvm_disable_txq(mvm, NULL, mvmvif->cab_queue, 0, 0);
+	iwl_mvm_disable_txq(mvm, NULL, &mvmvif->cab_queue, 0, 0);
 
 	ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id);
 	if (ret)

From 4ed6510e0559510ac967b42eb019c0753e435c43 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 5 Aug 2021 13:19:31 +0300
Subject: [PATCH 0263/1750] iwlwifi: mvm: fix access to BSS elements

[ Upstream commit 6c608cd6962ebdf84fd3de6d42f88ed64d2f4e1b ]

BSS elements are protected using RCU, so we need to use
RCU properly to access them, fix that.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210805130823.fd8b5791ab44.Iba26800a6301078d3782fb249c476dd8ac2bf3c6@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 9caff70cbd27..6f301ac8cce2 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -3029,16 +3029,20 @@ static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 						    void *_data)
 {
 	struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data;
+	const struct cfg80211_bss_ies *ies;
 	const struct element *elem;
 
-	elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data,
-				  bss->ies->len);
+	rcu_read_lock();
+	ies = rcu_dereference(bss->ies);
+	elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data,
+				  ies->len);
 
 	if (!elem || elem->datalen < 10 ||
 	    !(elem->data[10] &
 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) {
 		data->tolerated = false;
 	}
+	rcu_read_unlock();
 }
 
 static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw,

From a693aff5e8d7fa70bfaf222cbe0443c742af27c9 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 5 Aug 2021 14:21:54 +0300
Subject: [PATCH 0264/1750] iwlwifi: fw: correctly limit to monitor dump

[ Upstream commit e6344c060209ef4e970cac18adeac1676a2a73cd ]

In commit 79f033f6f229 ("iwlwifi: dbg: don't limit dump decisions
to all or monitor") we changed the code to pass around a bitmap,
but in the monitor_only case, one place accidentally used the bit
number, not the bit mask, resulting in CSR and FW_INFO getting
dumped instead of monitor data. Fix that.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210805141826.774fd8729a33.Ic985a787071d1c0b127ef0ba8367da896ee11f57@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
index ab4a8b942c81..419eaa5cf0b5 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
@@ -2303,7 +2303,7 @@ static void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt,
 		return;
 
 	if (dump_data->monitor_only)
-		dump_mask &= IWL_FW_ERROR_DUMP_FW_MONITOR;
+		dump_mask &= BIT(IWL_FW_ERROR_DUMP_FW_MONITOR);
 
 	fw_error_dump.trans_ptr = iwl_trans_dump_data(fwrt->trans, dump_mask);
 	file_len = le32_to_cpu(dump_file->file_len);

From 4bbf0a9d90e8e56b5dfa46f3e5feb96091f16300 Mon Sep 17 00:00:00 2001
From: Ilan Peer <ilan.peer@intel.com>
Date: Thu, 26 Aug 2021 22:47:42 +0300
Subject: [PATCH 0265/1750] iwlwifi: mvm: Fix scan channel flags settings

[ Upstream commit 090f1be3abf3069ef856b29761f181808bf55917 ]

The iwl_mvm_scan_ch_n_aps_flag() is called with a variable
before the value of the variable is set. Fix it.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210826224715.f6f188980a5e.Ie7331a8b94004d308f6cbde44e519155a5be91dd@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
index aebaad45043f..a5d90e028833 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c
@@ -1682,7 +1682,7 @@ iwl_mvm_umac_scan_cfg_channels_v6(struct iwl_mvm *mvm,
 		struct iwl_scan_channel_cfg_umac *cfg = &cp->channel_config[i];
 		u32 n_aps_flag =
 			iwl_mvm_scan_ch_n_aps_flag(vif_type,
-						   cfg->v2.channel_num);
+						   channels[i]->hw_value);
 
 		cfg->flags = cpu_to_le32(flags | n_aps_flag);
 		cfg->v2.channel_num = channels[i]->hw_value;

From 9c5c65ecbd87c3d7ab5bb44187038c4865cb7dd0 Mon Sep 17 00:00:00 2001
From: Wentao_Liang <Wentao_Liang_g@163.com>
Date: Thu, 19 Aug 2021 22:30:05 +0800
Subject: [PATCH 0266/1750] net/mlx5: DR, fix a potential use-after-free bug

[ Upstream commit 6cc64770fb386b10a64a1fe09328396de7bb5262 ]

In line 849 (#1), "mlx5dr_htbl_put(cur_htbl);" drops the reference to
cur_htbl and may cause cur_htbl to be freed.

However, cur_htbl is subsequently used in the next line, which may result
in an use-after-free bug.

Fix this by calling mlx5dr_err() before the cur_htbl is put.

Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
index b3c9dc032026..478de5ded7c2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
@@ -824,9 +824,9 @@ dr_rule_handle_ste_branch(struct mlx5dr_rule *rule,
 			new_htbl = dr_rule_rehash(rule, nic_rule, cur_htbl,
 						  ste_location, send_ste_list);
 			if (!new_htbl) {
-				mlx5dr_htbl_put(cur_htbl);
 				mlx5dr_err(dmn, "Failed creating rehash table, htbl-log_size: %d\n",
 					   cur_htbl->chunk_size);
+				mlx5dr_htbl_put(cur_htbl);
 			} else {
 				cur_htbl = new_htbl;
 			}

From 1e9302537804a6a3ccf681718b753e39e165a891 Mon Sep 17 00:00:00 2001
From: Yevgeny Kliteynik <kliteyn@nvidia.com>
Date: Thu, 24 Sep 2020 20:58:50 +0300
Subject: [PATCH 0267/1750] net/mlx5: DR, Enable QP retransmission

[ Upstream commit ec449ed8230cd30769de3cb70ee0fce293047372 ]

Under high stress, SW steering might get stuck on polling for completion
that never comes.
For such cases QP needs to have protocol retransmission mechanism enabled.
Currently the retransmission timeout is defined as 0 (unlimited). Fix this
by defining a real timeout.

Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Alex Vesker <valex@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
index ea3c6cf27db4..eb6677f737a0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c
@@ -605,6 +605,7 @@ static int dr_cmd_modify_qp_rtr2rts(struct mlx5_core_dev *mdev,
 
 	MLX5_SET(qpc, qpc, retry_count, attr->retry_cnt);
 	MLX5_SET(qpc, qpc, rnr_retry, attr->rnr_retry);
+	MLX5_SET(qpc, qpc, primary_address_path.ack_timeout, 0x8); /* ~1ms */
 
 	MLX5_SET(rtr2rts_qp_in, in, opcode, MLX5_CMD_OP_RTR2RTS_QP);
 	MLX5_SET(rtr2rts_qp_in, in, qpn, dr_qp->qpn);

From 3ad66d67822d0f72bc2c4ff5a0879db1b2dd90bb Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Fri, 30 Jul 2021 11:07:10 +0100
Subject: [PATCH 0268/1750] parport: remove non-zero check on count

[ Upstream commit 0be883a0d795d9146f5325de582584147dd0dcdc ]

The check for count appears to be incorrect since a non-zero count
check occurs a couple of statements earlier. Currently the check is
always false and the dev->port->irq != PARPORT_IRQ_NONE part of the
check is never tested and the if statement is dead-code. Fix this
by removing the check on count.

Note that this code is pre-git history, so I can't find a sha for
it.

Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Addresses-Coverity: ("Logically dead code")
Link: https://lore.kernel.org/r/20210730100710.27405-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/parport/ieee1284_ops.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/parport/ieee1284_ops.c b/drivers/parport/ieee1284_ops.c
index 2c11bd3fe1fd..17061f1df0f4 100644
--- a/drivers/parport/ieee1284_ops.c
+++ b/drivers/parport/ieee1284_ops.c
@@ -518,7 +518,7 @@ size_t parport_ieee1284_ecp_read_data (struct parport *port,
 				goto out;
 
 			/* Yield the port for a while. */
-			if (count && dev->port->irq != PARPORT_IRQ_NONE) {
+			if (dev->port->irq != PARPORT_IRQ_NONE) {
 				parport_release (dev);
 				schedule_timeout_interruptible(msecs_to_jiffies(40));
 				parport_claim_or_block (dev);

From b1d547f2f51ace1caa2573e357d571cf1321ccb9 Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <cyeaa@connect.ust.hk>
Date: Fri, 27 Aug 2021 00:41:40 -0700
Subject: [PATCH 0269/1750] selftests/bpf: Fix potential unreleased lock

[ Upstream commit 47bb27a20d6ea22cd092c1fc2bb4fcecac374838 ]

This lock is not released if the program
return at the patched branch.

Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210827074140.118671-1-cyeaa@connect.ust.hk
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c b/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c
index ec281b0363b8..86f97681ad89 100644
--- a/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockopt_inherit.c
@@ -195,8 +195,10 @@ static void run_test(int cgroup_fd)
 
 	pthread_mutex_lock(&server_started_mtx);
 	if (CHECK_FAIL(pthread_create(&tid, NULL, server_thread,
-				      (void *)&server_fd)))
+				      (void *)&server_fd))) {
+		pthread_mutex_unlock(&server_started_mtx);
 		goto close_server_fd;
+	}
 	pthread_cond_wait(&server_started, &server_started_mtx);
 	pthread_mutex_unlock(&server_started_mtx);
 

From be457b27dd0a0428bcf9dd10156049c20031fb34 Mon Sep 17 00:00:00 2001
From: Loic Poulain <loic.poulain@linaro.org>
Date: Thu, 26 Aug 2021 17:46:08 +0200
Subject: [PATCH 0270/1750] wcn36xx: Fix missing frame timestamp for
 beacon/probe-resp

[ Upstream commit 8678fd31f2d3eb14f2b8b39c9bc266f16fa24b22 ]

When receiving a beacon or probe response, we should update the
boottime_ns field which is the timestamp the frame was received at.
(cf mac80211.h)

This fixes a scanning issue with Android since it relies on this
timestamp to determine when the AP has been seen for the last time
(via the nl80211 BSS_LAST_SEEN_BOOTTIME parameter).

Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1629992768-23785-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/txrx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index 1b831157ede1..cab196bb38cd 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -287,6 +287,10 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
 		status.rate_idx = 0;
 	}
 
+	if (ieee80211_is_beacon(hdr->frame_control) ||
+	    ieee80211_is_probe_resp(hdr->frame_control))
+		status.boottime_ns = ktime_get_boottime_ns();
+
 	memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
 
 	if (ieee80211_is_beacon(hdr->frame_control)) {

From aa3708236ea011adee77af428f21ba30becd0ba3 Mon Sep 17 00:00:00 2001
From: Zekun Shen <bruceshenzk@gmail.com>
Date: Sat, 19 Jun 2021 09:29:14 -0400
Subject: [PATCH 0271/1750] ath9k: fix OOB read ar9300_eeprom_restore_internal

[ Upstream commit 23151b9ae79e3bc4f6a0c4cd3a7f355f68dad128 ]

Bad header can have large length field which can cause OOB.
cptr is the last bytes for read, and the eeprom is parsed
from high to low address. The OOB, triggered by the condition
length > cptr could cause memory error with a read on
negative index.

There are some sanity check around length, but it is not
compared with cptr (the remaining bytes). Here, the
corrupted/bad EEPROM can cause panic.

I was able to reproduce the crash, but I cannot find the
log and the reproducer now. After I applied the patch, the
bug is no longer reproducible.

Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YM3xKsQJ0Hw2hjrc@Zekuns-MBP-16.fios-router.home
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index b4885a700296..b0a4ca3559fd 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3351,7 +3351,8 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
 			"Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n",
 			cptr, code, reference, length, major, minor);
 		if ((!AR_SREV_9485(ah) && length >= 1024) ||
-		    (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485)) {
+		    (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485) ||
+		    (length > cptr)) {
 			ath_dbg(common, EEPROM, "Skipping bad header\n");
 			cptr -= COMP_HDR_LEN;
 			continue;

From 5ed5d594d9a7adc9b81c29d3714a642d2422c1fc Mon Sep 17 00:00:00 2001
From: Miaoqing Pan <miaoqing@codeaurora.org>
Date: Mon, 9 Aug 2021 12:05:16 +0800
Subject: [PATCH 0272/1750] ath9k: fix sleeping in atomic context

[ Upstream commit 7c48662b9d56666219f526a71ace8c15e6e12f1f ]

The problem is that gpio_free() can sleep and the cfg_soc() can be
called with spinlocks held. One problematic call tree is:

--> ath_reset_internal() takes &sc->sc_pcu_lock spin lock
   --> ath9k_hw_reset()
      --> ath9k_hw_gpio_request_in()
         --> ath9k_hw_gpio_request()
            --> ath9k_hw_gpio_cfg_soc()

Remove gpio_free(), use error message instead, so we should make sure
there is no GPIO conflict.

Also remove ath9k_hw_gpio_free() from ath9k_hw_apply_gpio_override(),
as gpio_mask will never be set for SOC chips.

Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1628481916-15030-1-git-send-email-miaoqing@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/hw.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index c86faebbc459..6b2668f065d5 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1622,7 +1622,6 @@ static void ath9k_hw_apply_gpio_override(struct ath_hw *ah)
 		ath9k_hw_gpio_request_out(ah, i, NULL,
 					  AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
 		ath9k_hw_set_gpio(ah, i, !!(ah->gpio_val & BIT(i)));
-		ath9k_hw_gpio_free(ah, i);
 	}
 }
 
@@ -2730,14 +2729,17 @@ static void ath9k_hw_gpio_cfg_output_mux(struct ath_hw *ah, u32 gpio, u32 type)
 static void ath9k_hw_gpio_cfg_soc(struct ath_hw *ah, u32 gpio, bool out,
 				  const char *label)
 {
+	int err;
+
 	if (ah->caps.gpio_requested & BIT(gpio))
 		return;
 
-	/* may be requested by BSP, free anyway */
-	gpio_free(gpio);
-
-	if (gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label))
+	err = gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label);
+	if (err) {
+		ath_err(ath9k_hw_common(ah), "request GPIO%d failed:%d\n",
+			gpio, err);
 		return;
+	}
 
 	ah->caps.gpio_requested |= BIT(gpio);
 }

From a4301d06a0b88166565a21ce34cdb50d51976e49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E8=B4=87?= <yun.wang@linux.alibaba.com>
Date: Mon, 30 Aug 2021 18:28:01 +0800
Subject: [PATCH 0273/1750] net: fix NULL pointer reference in
 cipso_v4_doi_free

[ Upstream commit 733c99ee8be9a1410287cdbb943887365e83b2d6 ]

In netlbl_cipsov4_add_std() when 'doi_def->map.std' alloc
failed, we sometime observe panic:

  BUG: kernel NULL pointer dereference, address:
  ...
  RIP: 0010:cipso_v4_doi_free+0x3a/0x80
  ...
  Call Trace:
   netlbl_cipsov4_add_std+0xf4/0x8c0
   netlbl_cipsov4_add+0x13f/0x1b0
   genl_family_rcv_msg_doit.isra.15+0x132/0x170
   genl_rcv_msg+0x125/0x240

This is because in cipso_v4_doi_free() there is no check
on 'doi_def->map.std' when 'doi_def->type' equal 1, which
is possibe, since netlbl_cipsov4_add_std() haven't initialize
it before alloc 'doi_def->map.std'.

This patch just add the check to prevent panic happen for similar
cases.

Reported-by: Abaci <abaci@linux.alibaba.com>
Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netlabel/netlabel_cipso_v4.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 50f40943c815..f3f1df1b0f8e 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -144,8 +144,8 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 		return -ENOMEM;
 	doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
 	if (doi_def->map.std == NULL) {
-		ret_val = -ENOMEM;
-		goto add_std_failure;
+		kfree(doi_def);
+		return -ENOMEM;
 	}
 	doi_def->type = CIPSO_V4_MAP_TRANS;
 

From c49a52046da7580c1eaa251396b18aa3da091d13 Mon Sep 17 00:00:00 2001
From: Haimin Zhang <tcs_kernel@tencent.com>
Date: Mon, 30 Aug 2021 11:47:01 +0800
Subject: [PATCH 0274/1750] fix array-index-out-of-bounds in taprio_change

[ Upstream commit efe487fce3061d94222c6501d7be3aa549b3dc78 ]

syzbot report an array-index-out-of-bounds in taprio_change
index 16 is out of range for type '__u16 [16]'
that's because mqprio->num_tc is lager than TC_MAX_QUEUE,so we check
the return value of netdev_set_num_tc.

Reported-by: syzbot+2b3e5fb6c7ef285a94f6@syzkaller.appspotmail.com
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_taprio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 00853065dfa0..cb5e5220da55 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1502,7 +1502,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt,
 	taprio_set_picos_per_byte(dev, q);
 
 	if (mqprio) {
-		netdev_set_num_tc(dev, mqprio->num_tc);
+		err = netdev_set_num_tc(dev, mqprio->num_tc);
+		if (err)
+			goto free_sched;
 		for (i = 0; i < mqprio->num_tc; i++)
 			netdev_set_tc_queue(dev, i,
 					    mqprio->count[i],

From fb1ee027878b30f7545c77b1cdf1f61136d21092 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 31 Aug 2021 16:40:18 +0800
Subject: [PATCH 0275/1750] net: w5100: check return value after calling
 platform_get_resource()

[ Upstream commit a39ff4a47f3e1da3b036817ef436b1a9be10783a ]

It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.

Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/wiznet/w5100.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c
index c0d181a7f83a..0b7135a3c585 100644
--- a/drivers/net/ethernet/wiznet/w5100.c
+++ b/drivers/net/ethernet/wiznet/w5100.c
@@ -1052,6 +1052,8 @@ static int w5100_mmio_probe(struct platform_device *pdev)
 		mac_addr = data->mac_addr;
 
 	mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!mem)
+		return -EINVAL;
 	if (resource_size(mem) < W5100_BUS_DIRECT_SIZE)
 		ops = &w5100_mmio_indirect_ops;
 	else

From 2c304c65defd4aaf2e4e0c8226c6e03cc09a7355 Mon Sep 17 00:00:00 2001
From: Guojia Liao <liaoguojia@huawei.com>
Date: Mon, 30 Aug 2021 21:51:07 +0800
Subject: [PATCH 0276/1750] net: hns3: clean up a type mismatch warning

[ Upstream commit e79c0e324b011b0288cd411a5b53870a7730f163 ]

abs() returns signed long, which could not convert the type
as unsigned, and it may cause a mismatch type warning from
static tools. To fix it, this patch uses an variable to save
the abs()'s result and does a explicit conversion.

Signed-off-by: Guojia Liao <liaoguojia@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index 61f6f0287cbe..ff9d84a7147f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -10,7 +10,14 @@
 
 static u16 hclge_errno_to_resp(int errno)
 {
-	return abs(errno);
+	int resp = abs(errno);
+
+	/* The status for pf to vf msg cmd is u16, constrainted by HW.
+	 * We need to keep the same type with it.
+	 * The intput errno is the stander error code, it's safely to
+	 * use a u16 to store the abs(errno).
+	 */
+	return (u16)resp;
 }
 
 /* hclge_gen_resp_to_vf: used to generate a synchronous response to VF when PF

From 6930a2a5be5cbb0c202fcfa2773c95bd10a19197 Mon Sep 17 00:00:00 2001
From: David Laight <David.Laight@ACULAB.COM>
Date: Sat, 7 Nov 2020 13:16:25 +0000
Subject: [PATCH 0277/1750] fs/io_uring Don't use the return value from
 import_iovec().

[ Upstream commit 10fc72e43352753a08f9cf83aa5c40baec00d212 ]

This is the only code that relies on import_iovec() returning
iter.count on success.
This allows a better interface to import_iovec().

Signed-off-by: David Laight <david.laight@aculab.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 6978a42fa39b..8de0f52fd29d 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3128,7 +3128,7 @@ static ssize_t __io_import_iovec(int rw, struct io_kiocb *req,
 
 		ret = import_single_range(rw, buf, sqe_len, *iovec, iter);
 		*iovec = NULL;
-		return ret < 0 ? ret : sqe_len;
+		return ret;
 	}
 
 	if (req->flags & REQ_F_BUFFER_SELECT) {
@@ -3154,7 +3154,7 @@ static ssize_t io_import_iovec(int rw, struct io_kiocb *req,
 	if (!iorw)
 		return __io_import_iovec(rw, req, iovec, iter, needs_lock);
 	*iovec = NULL;
-	return iov_iter_count(&iorw->iter);
+	return 0;
 }
 
 static inline loff_t *io_kiocb_ppos(struct kiocb *kiocb)
@@ -3423,7 +3423,7 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
 	if (ret < 0)
 		return ret;
 	iov_count = iov_iter_count(iter);
-	io_size = ret;
+	io_size = iov_count;
 	req->result = io_size;
 	ret = 0;
 
@@ -3552,7 +3552,7 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
 	if (ret < 0)
 		return ret;
 	iov_count = iov_iter_count(iter);
-	io_size = ret;
+	io_size = iov_count;
 	req->result = io_size;
 
 	/* Ensure we clear previously set non-block flag */

From 9a4e7f9038660b7fd41280f9d97e6c722804bd1d Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Sat, 7 Nov 2020 13:16:26 +0000
Subject: [PATCH 0278/1750] io_uring: remove duplicated io_size from rw

[ Upstream commit 632546c4b5a4dad8e3ac456406c65c0db9a0b570 ]

io_size and iov_count in io_read() and io_write() hold the same value,
kill the last one.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 8de0f52fd29d..d0089039fee7 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3413,7 +3413,6 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
 	struct iov_iter __iter, *iter = &__iter;
 	struct io_async_rw *rw = req->async_data;
 	ssize_t io_size, ret, ret2;
-	size_t iov_count;
 	bool no_async;
 
 	if (rw)
@@ -3422,8 +3421,7 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
 	ret = io_import_iovec(READ, req, &iovec, iter, !force_nonblock);
 	if (ret < 0)
 		return ret;
-	iov_count = iov_iter_count(iter);
-	io_size = iov_count;
+	io_size = iov_iter_count(iter);
 	req->result = io_size;
 	ret = 0;
 
@@ -3439,7 +3437,7 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
 	if (no_async)
 		goto copy_iov;
 
-	ret = rw_verify_area(READ, req->file, io_kiocb_ppos(kiocb), iov_count);
+	ret = rw_verify_area(READ, req->file, io_kiocb_ppos(kiocb), io_size);
 	if (unlikely(ret))
 		goto out_free;
 
@@ -3458,7 +3456,7 @@ static int io_read(struct io_kiocb *req, bool force_nonblock,
 		if (req->file->f_flags & O_NONBLOCK)
 			goto done;
 		/* some cases will consume bytes even on error returns */
-		iov_iter_revert(iter, iov_count - iov_iter_count(iter));
+		iov_iter_revert(iter, io_size - iov_iter_count(iter));
 		ret = 0;
 		goto copy_iov;
 	} else if (ret < 0) {
@@ -3542,7 +3540,6 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
 	struct kiocb *kiocb = &req->rw.kiocb;
 	struct iov_iter __iter, *iter = &__iter;
 	struct io_async_rw *rw = req->async_data;
-	size_t iov_count;
 	ssize_t ret, ret2, io_size;
 
 	if (rw)
@@ -3551,8 +3548,7 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
 	ret = io_import_iovec(WRITE, req, &iovec, iter, !force_nonblock);
 	if (ret < 0)
 		return ret;
-	iov_count = iov_iter_count(iter);
-	io_size = iov_count;
+	io_size = iov_iter_count(iter);
 	req->result = io_size;
 
 	/* Ensure we clear previously set non-block flag */
@@ -3570,7 +3566,7 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
 	    (req->flags & REQ_F_ISREG))
 		goto copy_iov;
 
-	ret = rw_verify_area(WRITE, req->file, io_kiocb_ppos(kiocb), iov_count);
+	ret = rw_verify_area(WRITE, req->file, io_kiocb_ppos(kiocb), io_size);
 	if (unlikely(ret))
 		goto out_free;
 
@@ -3613,7 +3609,7 @@ static int io_write(struct io_kiocb *req, bool force_nonblock,
 	} else {
 copy_iov:
 		/* some cases will consume bytes even on error returns */
-		iov_iter_revert(iter, iov_count - iov_iter_count(iter));
+		iov_iter_revert(iter, io_size - iov_iter_count(iter));
 		ret = io_setup_async_rw(req, iovec, inline_vecs, iter, false);
 		if (!ret)
 			return -EAGAIN;

From 7a5756e90563e5a31739d313fb6b379449ded9d9 Mon Sep 17 00:00:00 2001
From: Mikulas Patocka <mpatocka@redhat.com>
Date: Mon, 30 Aug 2021 05:42:27 -0400
Subject: [PATCH 0279/1750] parisc: fix crash with signals and alloca

commit 030f653078316a9cc9ca6bd1b0234dcf858be35d upstream.

I was debugging some crashes on parisc and I found out that there is a
crash possibility if a function using alloca is interrupted by a signal.
The reason for the crash is that the gcc alloca implementation leaves
garbage in the upper 32 bits of the sp register. This normally doesn't
matter (the upper bits are ignored because the PSW W-bit is clear),
however the signal delivery routine in the kernel uses full 64 bits of sp
and it fails with -EFAULT if the upper 32 bits are not zero.

I created this program that demonstrates the problem:

#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <alloca.h>

static __attribute__((noinline,noclone)) void aa(int *size)
{
	void * volatile p = alloca(-*size);
	while (1) ;
}

static void handler(int sig)
{
	write(1, "signal delivered\n", 17);
	_exit(0);
}

int main(void)
{
	int size = -0x100;
	signal(SIGALRM, handler);
	alarm(1);
	aa(&size);
}

If you compile it with optimizations, it will crash.
The "aa" function has this disassembly:

000106a0 <aa>:
   106a0:       08 03 02 41     copy r3,r1
   106a4:       08 1e 02 43     copy sp,r3
   106a8:       6f c1 00 80     stw,ma r1,40(sp)
   106ac:       37 dc 3f c1     ldo -20(sp),ret0
   106b0:       0c 7c 12 90     stw ret0,8(r3)
   106b4:       0f 40 10 9c     ldw 0(r26),ret0		; ret0 = 0x00000000FFFFFF00
   106b8:       97 9c 00 7e     subi 3f,ret0,ret0	; ret0 = 0xFFFFFFFF0000013F
   106bc:       d7 80 1c 1a     depwi 0,31,6,ret0	; ret0 = 0xFFFFFFFF00000100
   106c0:       0b 9e 0a 1e     add,l sp,ret0,sp	;   sp = 0xFFFFFFFFxxxxxxxx
   106c4:       e8 1f 1f f7     b,l,n 106c4 <aa+0x24>,r0

This patch fixes the bug by truncating the "usp" variable to 32 bits.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/signal.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
index 9f43eaeb0b0a..8d6c9b88eb3f 100644
--- a/arch/parisc/kernel/signal.c
+++ b/arch/parisc/kernel/signal.c
@@ -237,6 +237,12 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs,
 #endif
 	
 	usp = (regs->gr[30] & ~(0x01UL));
+#ifdef CONFIG_64BIT
+	if (is_compat_task()) {
+		/* The gcc alloca implementation leaves garbage in the upper 32 bits of sp */
+		usp = (compat_uint_t)usp;
+	}
+#endif
 	/*FIXME: frame_size parameter is unused, remove it. */
 	frame = get_sigframe(&ksig->ka, usp, sizeof(*frame));
 

From 69775e4e17f2380f67c972899b02828d7a71d627 Mon Sep 17 00:00:00 2001
From: chenying <chenying.kernel@bytedance.com>
Date: Mon, 16 Aug 2021 18:02:56 +0800
Subject: [PATCH 0280/1750] ovl: fix BUG_ON() in may_delete() when called from
 ovl_cleanup()

commit 52d5a0c6bd8a89f460243ed937856354f8f253a3 upstream.

If function ovl_instantiate() returns an error, ovl_cleanup will be called
and try to remove newdentry from wdir, but the newdentry has been moved to
udir at this time.  This will causes BUG_ON(victim->d_parent->d_inode !=
dir) in fs/namei.c:may_delete.

Signed-off-by: chenying <chenying.kernel@bytedance.com>
Fixes: 01b39dcc9568 ("ovl: use inode_insert5() to hash a newly created inode")
Link: https://lore.kernel.org/linux-unionfs/e6496a94-a161-dc04-c38a-d2544633acb4@bytedance.com/
Cc: <stable@vger.kernel.org> # v4.18
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/dir.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index d1efa3a5a503..08b595c526d7 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -542,8 +542,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
 			goto out_cleanup;
 	}
 	err = ovl_instantiate(dentry, inode, newdentry, hardlink);
-	if (err)
-		goto out_cleanup;
+	if (err) {
+		ovl_cleanup(udir, newdentry);
+		dput(newdentry);
+	}
 out_dput:
 	dput(upper);
 out_unlock:

From 137dafa722303d5eed1340ded248bcbaea514d58 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Tue, 20 Apr 2021 20:01:47 +0200
Subject: [PATCH 0281/1750] scsi: BusLogic: Fix missing pr_cont() use

commit 44d01fc86d952f5a8b8b32bdb4841504d5833d95 upstream.

Update BusLogic driver's messaging system to use pr_cont() for continuation
lines, bringing messy output:

pci 0000:00:13.0: PCI->APIC IRQ transform: INT A -> IRQ 17
scsi: ***** BusLogic SCSI Driver Version 2.1.17 of 12 September 2013 *****
scsi: Copyright 1995-1998 by Leonard N. Zubkoff <lnz@dandelion.com>
scsi0: Configuring BusLogic Model BT-958 PCI Wide Ultra SCSI Host Adapter
scsi0:   Firmware Version: 5.07B, I/O Address: 0x7000, IRQ Channel: 17/Level
scsi0:   PCI Bus: 0, Device: 19, Address:
0xE0012000,
Host Adapter SCSI ID: 7
scsi0:   Parity Checking: Enabled, Extended Translation: Enabled
scsi0:   Synchronous Negotiation: Ultra, Wide Negotiation: Enabled
scsi0:   Disconnect/Reconnect: Enabled, Tagged Queuing: Enabled
scsi0:   Scatter/Gather Limit: 128 of 8192 segments, Mailboxes: 211
scsi0:   Driver Queue Depth: 211, Host Adapter Queue Depth: 192
scsi0:   Tagged Queue Depth:
Automatic
, Untagged Queue Depth: 3
scsi0:   SCSI Bus Termination: Both Enabled
, SCAM: Disabled

scsi0: *** BusLogic BT-958 Initialized Successfully ***
scsi host0: BusLogic BT-958

back to order:

pci 0000:00:13.0: PCI->APIC IRQ transform: INT A -> IRQ 17
scsi: ***** BusLogic SCSI Driver Version 2.1.17 of 12 September 2013 *****
scsi: Copyright 1995-1998 by Leonard N. Zubkoff <lnz@dandelion.com>
scsi0: Configuring BusLogic Model BT-958 PCI Wide Ultra SCSI Host Adapter
scsi0:   Firmware Version: 5.07B, I/O Address: 0x7000, IRQ Channel: 17/Level
scsi0:   PCI Bus: 0, Device: 19, Address: 0xE0012000, Host Adapter SCSI ID: 7
scsi0:   Parity Checking: Enabled, Extended Translation: Enabled
scsi0:   Synchronous Negotiation: Ultra, Wide Negotiation: Enabled
scsi0:   Disconnect/Reconnect: Enabled, Tagged Queuing: Enabled
scsi0:   Scatter/Gather Limit: 128 of 8192 segments, Mailboxes: 211
scsi0:   Driver Queue Depth: 211, Host Adapter Queue Depth: 192
scsi0:   Tagged Queue Depth: Automatic, Untagged Queue Depth: 3
scsi0:   SCSI Bus Termination: Both Enabled, SCAM: Disabled
scsi0: *** BusLogic BT-958 Initialized Successfully ***
scsi host0: BusLogic BT-958

Also diagnostic output such as with the BusLogic=TraceConfiguration
parameter is affected and becomes vertical and therefore hard to read.
This has now been corrected, e.g.:

pci 0000:00:13.0: PCI->APIC IRQ transform: INT A -> IRQ 17
blogic_cmd(86) Status = 30:  4 ==>  4: FF 05 93 00
blogic_cmd(95) Status = 28: (Modify I/O Address)
blogic_cmd(91) Status = 30:  1 ==>  1: 01
blogic_cmd(04) Status = 30:  4 ==>  4: 41 41 35 30
blogic_cmd(8D) Status = 30: 14 ==> 14: 45 DC 00 20 00 00 00 00 00 40 30 37 42 1D
scsi: ***** BusLogic SCSI Driver Version 2.1.17 of 12 September 2013 *****
scsi: Copyright 1995-1998 by Leonard N. Zubkoff <lnz@dandelion.com>
blogic_cmd(04) Status = 30:  4 ==>  4: 41 41 35 30
blogic_cmd(0B) Status = 30:  3 ==>  3: 00 08 07
blogic_cmd(0D) Status = 30: 34 ==> 34: 03 01 07 04 00 00 00 00 00 00 00 00 00 00 00 00 FF 42 44 46 FF 00 00 00 00 00 00 00 00 00 FF 00 FF 00
blogic_cmd(8D) Status = 30: 14 ==> 14: 45 DC 00 20 00 00 00 00 00 40 30 37 42 1D
blogic_cmd(84) Status = 30:  1 ==>  1: 37
blogic_cmd(8B) Status = 30:  5 ==>  5: 39 35 38 20 20
blogic_cmd(85) Status = 30:  1 ==>  1: 42
blogic_cmd(86) Status = 30:  4 ==>  4: FF 05 93 00
blogic_cmd(91) Status = 30: 64 ==> 64: 41 46 3E 20 39 35 38 20 20 00 C4 00 04 01 07 2F 07 04 35 FF FF FF FF FF FF FF FF FF FF 01 00 FE FF 08 FF FF 00 00 00 00 00 00 00 01 00 01 00 00 FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 FC
scsi0: Configuring BusLogic Model BT-958 PCI Wide Ultra SCSI Host Adapter

etc.

Link: https://lore.kernel.org/r/alpine.DEB.2.21.2104201940430.44318@angie.orcam.me.uk
Fixes: 4bcc595ccd80 ("printk: reinstate KERN_CONT for printing continuation lines")
Cc: stable@vger.kernel.org # v4.9+
Acked-by: Khalid Aziz <khalid@gonehiking.org>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/BusLogic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index 86d9d804dea7..39ef07406997 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -3603,7 +3603,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt,
 			if (buf[0] != '\n' || len > 1)
 				printk("%sscsi%d: %s", blogic_msglevelmap[msglevel], adapter->host_no, buf);
 		} else
-			printk("%s", buf);
+			pr_cont("%s", buf);
 	} else {
 		if (begin) {
 			if (adapter != NULL && adapter->adapter_initd)
@@ -3611,7 +3611,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt,
 			else
 				printk("%s%s", blogic_msglevelmap[msglevel], buf);
 		} else
-			printk("%s", buf);
+			pr_cont("%s", buf);
 	}
 	begin = (buf[len - 1] == '\n');
 }

From 9c8414325eee8f821e6e265bf94b93fe2f225922 Mon Sep 17 00:00:00 2001
From: Saurav Kashyap <skashyap@marvell.com>
Date: Mon, 9 Aug 2021 21:37:17 -0700
Subject: [PATCH 0282/1750] scsi: qla2xxx: Changes to support kdump kernel

commit 62e0dec59c1e139dab55aff5aa442adc97804271 upstream.

Avoid allocating firmware dump and only allocate a single queue for a kexec
kernel.

Link: https://lore.kernel.org/r/20210810043720.1137-12-njavali@marvell.com
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 21be50b35bc2..4af794c46d17 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/blk-mq-pci.h>
 #include <linux/refcount.h>
+#include <linux/crash_dump.h>
 
 #include <scsi/scsi_tcq.h>
 #include <scsi/scsicam.h>
@@ -2828,6 +2829,11 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
 			return ret;
 	}
 
+	if (is_kdump_kernel()) {
+		ql2xmqsupport = 0;
+		ql2xallocfwdump = 0;
+	}
+
 	/* This may fail but that's ok */
 	pci_enable_pcie_error_reporting(pdev);
 

From 55be9eb1936af0ec23af2dab68de059e9c0575b2 Mon Sep 17 00:00:00 2001
From: Saurav Kashyap <skashyap@marvell.com>
Date: Mon, 9 Aug 2021 21:37:19 -0700
Subject: [PATCH 0283/1750] scsi: qla2xxx: Sync queue idx with queue_pair_map
 idx

commit c8fadf019964d0eb1da410ba8b629494d3339db9 upstream.

The first invocation of function find_first_zero_bit will return 0 and
queue_id gets set to 0.

An index of queue_pair_map also gets set to 0.

	qpair_id = find_first_zero_bit(ha->qpair_qid_map, ha->max_qpairs);

        set_bit(qpair_id, ha->qpair_qid_map);
        ha->queue_pair_map[qpair_id] = qpair;

In the alloc_queue callback driver checks the map, if queue is already
allocated:

	ha->queue_pair_map[qidx]

This works fine as long as max_qpairs is greater than nvme_max_hw_queues(8)
since the size of the queue_pair_map is equal to max_qpair. In case nr_cpus
is less than 8, max_qpairs is less than 8. This creates wrong value
returned as qpair.

[ 1572.353669] qla2xxx [0000:24:00.3]-2121:6: Returning existing qpair of 4e00000000000000 for idx=2
[ 1572.354458] general protection fault: 0000 [#1] SMP PTI
[ 1572.354461] CPU: 1 PID: 44 Comm: kworker/1:1H Kdump: loaded Tainted: G          IOE    --------- -  - 4.18.0-304.el8.x86_64 #1
[ 1572.354462] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 03/01/2013
[ 1572.354467] Workqueue: kblockd blk_mq_run_work_fn
[ 1572.354485] RIP: 0010:qla_nvme_post_cmd+0x92/0x760 [qla2xxx]
[ 1572.354486] Code: 84 24 5c 01 00 00 00 00 b8 0a 74 1e 66 83 79 48 00 0f 85 a8 03 00 00 48 8b 44 24 08 48 89 ee 4c 89 e7 8b 50 24 e8 5e 8e 00 00 <f0> 41 ff 47 04 0f ae f0 41 f6 47 24 04 74 19 f0 41 ff 4f 04 b8 f0
[ 1572.354487] RSP: 0018:ffff9c81c645fc90 EFLAGS: 00010246
[ 1572.354489] RAX: 0000000000000001 RBX: ffff8ea3e5070138 RCX: 0000000000000001
[ 1572.354490] RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff8ea4c866b800
[ 1572.354491] RBP: ffff8ea4c866b800 R08: 0000000000005010 R09: ffff8ea4c866b800
[ 1572.354492] R10: 0000000000000001 R11: 000000069d1ca3ff R12: ffff8ea4bc460000
[ 1572.354493] R13: ffff8ea3e50702b0 R14: ffff8ea4c4c16a58 R15: 4e00000000000000
[ 1572.354494] FS:  0000000000000000(0000) GS:ffff8ea4dfd00000(0000) knlGS:0000000000000000
[ 1572.354495] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1572.354496] CR2: 000055884504fa58 CR3: 00000005a1410001 CR4: 00000000000606e0
[ 1572.354497] Call Trace:
[ 1572.354503]  ? check_preempt_curr+0x62/0x90
[ 1572.354506]  ? dma_direct_map_sg+0x72/0x1f0
[ 1572.354509]  ? nvme_fc_start_fcp_op.part.32+0x175/0x460 [nvme_fc]
[ 1572.354511]  ? blk_mq_dispatch_rq_list+0x11c/0x730
[ 1572.354515]  ? __switch_to_asm+0x35/0x70
[ 1572.354516]  ? __switch_to_asm+0x41/0x70
[ 1572.354518]  ? __switch_to_asm+0x35/0x70
[ 1572.354519]  ? __switch_to_asm+0x41/0x70
[ 1572.354521]  ? __switch_to_asm+0x35/0x70
[ 1572.354522]  ? __switch_to_asm+0x41/0x70
[ 1572.354523]  ? __switch_to_asm+0x35/0x70
[ 1572.354525]  ? entry_SYSCALL_64_after_hwframe+0xb9/0xca
[ 1572.354527]  ? __switch_to_asm+0x41/0x70
[ 1572.354529]  ? __blk_mq_sched_dispatch_requests+0xc6/0x170
[ 1572.354531]  ? blk_mq_sched_dispatch_requests+0x30/0x60
[ 1572.354532]  ? __blk_mq_run_hw_queue+0x51/0xd0
[ 1572.354535]  ? process_one_work+0x1a7/0x360
[ 1572.354537]  ? create_worker+0x1a0/0x1a0
[ 1572.354538]  ? worker_thread+0x30/0x390
[ 1572.354540]  ? create_worker+0x1a0/0x1a0
[ 1572.354541]  ? kthread+0x116/0x130
[ 1572.354543]  ? kthread_flush_work_fn+0x10/0x10
[ 1572.354545]  ? ret_from_fork+0x35/0x40

Fix is to use index 0 for admin and first IO queue.

Link: https://lore.kernel.org/r/20210810043720.1137-14-njavali@marvell.com
Fixes: e84067d74301 ("scsi: qla2xxx: Add FC-NVMe F/W initialization and transport registration")
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/qla2xxx/qla_nvme.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index b7a1dc24db38..f6c76a063294 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -91,8 +91,9 @@ static int qla_nvme_alloc_queue(struct nvme_fc_local_port *lport,
 	struct qla_hw_data *ha;
 	struct qla_qpair *qpair;
 
-	if (!qidx)
-		qidx++;
+	/* Map admin queue and 1st IO queue to index 0 */
+	if (qidx)
+		qidx--;
 
 	vha = (struct scsi_qla_host *)lport->private;
 	ha = vha->hw;

From 086faa4a2e86e4480f76fcf687b380061a0083f8 Mon Sep 17 00:00:00 2001
From: "Pratik R. Sampat" <psampat@linux.ibm.com>
Date: Wed, 28 Jul 2021 17:35:00 +0530
Subject: [PATCH 0284/1750] cpufreq: powernv: Fix init_chip_info initialization
 in numa=off

commit f34ee9cb2c5ac5af426fee6fa4591a34d187e696 upstream.

In the numa=off kernel command-line configuration init_chip_info() loops
around the number of chips and attempts to copy the cpumask of that node
which is NULL for all iterations after the first chip.

Hence, store the cpu mask for each chip instead of derving cpumask from
node while populating the "chips" struct array and copy that to the
chips[i].mask

Fixes: 053819e0bf84 ("cpufreq: powernv: Handle throttling due to Pmax capping at chip level")
Cc: stable@vger.kernel.org # v4.3+
Reported-by: Shirisha Ganta <shirisha.ganta1@ibm.com>
Signed-off-by: Pratik R. Sampat <psampat@linux.ibm.com>
Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
[mpe: Rename goto label to out_free_chip_cpu_mask]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210728120500.87549-2-psampat@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/cpufreq/powernv-cpufreq.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
index e439b43c19eb..8977e4de5915 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -36,6 +36,7 @@
 #define MAX_PSTATE_SHIFT	32
 #define LPSTATE_SHIFT		48
 #define GPSTATE_SHIFT		56
+#define MAX_NR_CHIPS		32
 
 #define MAX_RAMP_DOWN_TIME				5120
 /*
@@ -1051,12 +1052,20 @@ static int init_chip_info(void)
 	unsigned int *chip;
 	unsigned int cpu, i;
 	unsigned int prev_chip_id = UINT_MAX;
+	cpumask_t *chip_cpu_mask;
 	int ret = 0;
 
 	chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL);
 	if (!chip)
 		return -ENOMEM;
 
+	/* Allocate a chip cpu mask large enough to fit mask for all chips */
+	chip_cpu_mask = kcalloc(MAX_NR_CHIPS, sizeof(cpumask_t), GFP_KERNEL);
+	if (!chip_cpu_mask) {
+		ret = -ENOMEM;
+		goto free_and_return;
+	}
+
 	for_each_possible_cpu(cpu) {
 		unsigned int id = cpu_to_chip_id(cpu);
 
@@ -1064,22 +1073,25 @@ static int init_chip_info(void)
 			prev_chip_id = id;
 			chip[nr_chips++] = id;
 		}
+		cpumask_set_cpu(cpu, &chip_cpu_mask[nr_chips-1]);
 	}
 
 	chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL);
 	if (!chips) {
 		ret = -ENOMEM;
-		goto free_and_return;
+		goto out_free_chip_cpu_mask;
 	}
 
 	for (i = 0; i < nr_chips; i++) {
 		chips[i].id = chip[i];
-		cpumask_copy(&chips[i].mask, cpumask_of_node(chip[i]));
+		cpumask_copy(&chips[i].mask, &chip_cpu_mask[i]);
 		INIT_WORK(&chips[i].throttle, powernv_cpufreq_work_fn);
 		for_each_cpu(cpu, &chips[i].mask)
 			per_cpu(chip_info, cpu) =  &chips[i];
 	}
 
+out_free_chip_cpu_mask:
+	kfree(chip_cpu_mask);
 free_and_return:
 	kfree(chip);
 	return ret;

From 27dd91221b3f714f315c6e6b8f59924fbdd4c331 Mon Sep 17 00:00:00 2001
From: Halil Pasic <pasic@linux.ibm.com>
Date: Sat, 24 Jul 2021 01:17:46 +0200
Subject: [PATCH 0285/1750] s390/pv: fix the forcing of the swiotlb

commit 93ebb6828723b8aef114415c4dc3518342f7dcad upstream.

Since commit 903cd0f315fe ("swiotlb: Use is_swiotlb_force_bounce for
swiotlb data bouncing") if code sets swiotlb_force it needs to do so
before the swiotlb is initialised. Otherwise
io_tlb_default_mem->force_bounce will not get set to true, and devices
that use (the default) swiotlb will not bounce despite switolb_force
having the value of SWIOTLB_FORCE.

Let us restore swiotlb functionality for PV by fulfilling this new
requirement.

This change addresses what turned out to be a fragility in
commit 64e1f0c531d1 ("s390/mm: force swiotlb for protected
virtualization"), which ain't exactly broken in its original context,
but could give us some more headache if people backport the broken
change and forget this fix.

Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Fixes: 903cd0f315fe ("swiotlb: Use is_swiotlb_force_bounce for swiotlb data bouncing")
Fixes: 64e1f0c531d1 ("s390/mm: force swiotlb for protected virtualization")
Cc: stable@vger.kernel.org #5.3+
Signed-off-by: Konrad Rzeszutek Wilk <konrad@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/mm/init.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 77767850d0d0..9d5960bbc45f 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -180,9 +180,9 @@ static void pv_init(void)
 		return;
 
 	/* make sure bounce buffers are shared */
+	swiotlb_force = SWIOTLB_FORCE;
 	swiotlb_init(1);
 	swiotlb_update_mem_attributes();
-	swiotlb_force = SWIOTLB_FORCE;
 }
 
 void __init mem_init(void)

From e1fa3b2b60abb9f43b937741e27c6531ef4cbef9 Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz@oracle.com>
Date: Thu, 2 Sep 2021 14:58:53 -0700
Subject: [PATCH 0286/1750] hugetlb: fix hugetlb cgroup refcounting during vma
 split

commit 09a26e832705fdb7a9484495b71a05e0bbc65207 upstream.

Guillaume Morin reported hitting the following WARNING followed by GPF or
NULL pointer deference either in cgroups_destroy or in the kill_css path.:

    percpu ref (css_release) <= 0 (-1) after switching to atomic
    WARNING: CPU: 23 PID: 130 at lib/percpu-refcount.c:196 percpu_ref_switch_to_atomic_rcu+0x127/0x130
    CPU: 23 PID: 130 Comm: ksoftirqd/23 Kdump: loaded Tainted: G           O      5.10.60 #1
    RIP: 0010:percpu_ref_switch_to_atomic_rcu+0x127/0x130
    Call Trace:
       rcu_core+0x30f/0x530
       rcu_core_si+0xe/0x10
       __do_softirq+0x103/0x2a2
       run_ksoftirqd+0x2b/0x40
       smpboot_thread_fn+0x11a/0x170
       kthread+0x10a/0x140
       ret_from_fork+0x22/0x30

Upon further examination, it was discovered that the css structure was
associated with hugetlb reservations.

For private hugetlb mappings the vma points to a reserve map that
contains a pointer to the css.  At mmap time, reservations are set up
and a reference to the css is taken.  This reference is dropped in the
vma close operation; hugetlb_vm_op_close.  However, if a vma is split no
additional reference to the css is taken yet hugetlb_vm_op_close will be
called twice for the split vma resulting in an underflow.

Fix by taking another reference in hugetlb_vm_op_open.  Note that the
reference is only taken for the owner of the reserve map.  In the more
common fork case, the pointer to the reserve map is cleared for
non-owning vmas.

Link: https://lkml.kernel.org/r/20210830215015.155224-1-mike.kravetz@oracle.com
Fixes: e9fe92ae0cd2 ("hugetlb_cgroup: add reservation accounting for private mappings")
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reported-by: Guillaume Morin <guillaume@morinfr.org>
Suggested-by: Guillaume Morin <guillaume@morinfr.org>
Tested-by: Guillaume Morin <guillaume@morinfr.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/hugetlb_cgroup.h | 12 ++++++++++++
 mm/hugetlb.c                   |  4 +++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/include/linux/hugetlb_cgroup.h b/include/linux/hugetlb_cgroup.h
index 0bff345c4bc6..171bf1be4011 100644
--- a/include/linux/hugetlb_cgroup.h
+++ b/include/linux/hugetlb_cgroup.h
@@ -118,6 +118,13 @@ static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
 	css_put(&h_cg->css);
 }
 
+static inline void resv_map_dup_hugetlb_cgroup_uncharge_info(
+						struct resv_map *resv_map)
+{
+	if (resv_map->css)
+		css_get(resv_map->css);
+}
+
 extern int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
 					struct hugetlb_cgroup **ptr);
 extern int hugetlb_cgroup_charge_cgroup_rsvd(int idx, unsigned long nr_pages,
@@ -196,6 +203,11 @@ static inline void hugetlb_cgroup_put_rsvd_cgroup(struct hugetlb_cgroup *h_cg)
 {
 }
 
+static inline void resv_map_dup_hugetlb_cgroup_uncharge_info(
+						struct resv_map *resv_map)
+{
+}
+
 static inline int hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages,
 					       struct hugetlb_cgroup **ptr)
 {
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index fa6b0ac6c280..6e92ab0ae070 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3659,8 +3659,10 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
 	 * after this open call completes.  It is therefore safe to take a
 	 * new reference here without additional locking.
 	 */
-	if (resv && is_vma_resv_set(vma, HPAGE_RESV_OWNER))
+	if (resv && is_vma_resv_set(vma, HPAGE_RESV_OWNER)) {
+		resv_map_dup_hugetlb_cgroup_uncharge_info(resv);
 		kref_get(&resv->refs);
+	}
 }
 
 static void hugetlb_vm_op_close(struct vm_area_struct *vma)

From ce75a6b399e07ff8a7ccca668047663362befd46 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@cn.fujitsu.com>
Date: Wed, 8 Sep 2021 18:10:02 -0700
Subject: [PATCH 0287/1750] mm/hmm: bypass devmap pte when all pfn requested
 flags are fulfilled

commit 4b42fb213678d2b6a9eeea92a9be200f23e49583 upstream.

Previously, we noticed the one rpma example was failed[1] since commit
36f30e486dce ("IB/core: Improve ODP to use hmm_range_fault()"), where it
will use ODP feature to do RDMA WRITE between fsdax files.

After digging into the code, we found hmm_vma_handle_pte() will still
return EFAULT even though all the its requesting flags has been
fulfilled.  That's because a DAX page will be marked as (_PAGE_SPECIAL |
PAGE_DEVMAP) by pte_mkdevmap().

Link: https://github.com/pmem/rpma/issues/1142 [1]
Link: https://lkml.kernel.org/r/20210830094232.203029-1-lizhijian@cn.fujitsu.com
Fixes: 405506274922 ("mm/hmm: add missing call to hmm_pte_need_fault in HMM_PFN_SPECIAL handling")
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/hmm.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/hmm.c b/mm/hmm.c
index 943cb2ba4442..fb617054f963 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -291,10 +291,13 @@ static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr,
 		goto fault;
 
 	/*
+	 * Bypass devmap pte such as DAX page when all pfn requested
+	 * flags(pfn_req_flags) are fulfilled.
 	 * Since each architecture defines a struct page for the zero page, just
 	 * fall through and treat it like a normal page.
 	 */
-	if (pte_special(pte) && !is_zero_pfn(pte_pfn(pte))) {
+	if (pte_special(pte) && !pte_devmap(pte) &&
+	    !is_zero_pfn(pte_pfn(pte))) {
 		if (hmm_pte_need_fault(hmm_vma_walk, pfn_req_flags, 0)) {
 			pte_unmap(ptep);
 			return -EFAULT;

From 2d2d8b0eca6473eac0a142edea4c2b038da08cbd Mon Sep 17 00:00:00 2001
From: Liu Zixian <liuzixian4@huawei.com>
Date: Wed, 8 Sep 2021 18:10:05 -0700
Subject: [PATCH 0288/1750] mm/hugetlb: initialize hugetlb_usage in mm_init

commit 13db8c50477d83ad3e3b9b0ae247e5cd833a7ae4 upstream.

After fork, the child process will get incorrect (2x) hugetlb_usage.  If
a process uses 5 2MB hugetlb pages in an anonymous mapping,

	HugetlbPages:	   10240 kB

and then forks, the child will show,

	HugetlbPages:	   20480 kB

The reason for double the amount is because hugetlb_usage will be copied
from the parent and then increased when we copy page tables from parent
to child.  Child will have 2x actual usage.

Fix this by adding hugetlb_count_init in mm_init.

Link: https://lkml.kernel.org/r/20210826071742.877-1-liuzixian4@huawei.com
Fixes: 5d317b2b6536 ("mm: hugetlb: proc: add HugetlbPages field to /proc/PID/status")
Signed-off-by: Liu Zixian <liuzixian4@huawei.com>
Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/hugetlb.h | 9 +++++++++
 kernel/fork.c           | 1 +
 2 files changed, 10 insertions(+)

diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index 5b68c9787f7c..b9fbb6d4150e 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -722,6 +722,11 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
 
 void hugetlb_report_usage(struct seq_file *m, struct mm_struct *mm);
 
+static inline void hugetlb_count_init(struct mm_struct *mm)
+{
+	atomic_long_set(&mm->hugetlb_usage, 0);
+}
+
 static inline void hugetlb_count_add(long l, struct mm_struct *mm)
 {
 	atomic_long_add(l, &mm->hugetlb_usage);
@@ -897,6 +902,10 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h,
 	return &mm->page_table_lock;
 }
 
+static inline void hugetlb_count_init(struct mm_struct *mm)
+{
+}
+
 static inline void hugetlb_report_usage(struct seq_file *f, struct mm_struct *m)
 {
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 9705439439fe..3f96400a0ac6 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1037,6 +1037,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
 	mm->pmd_huge_pte = NULL;
 #endif
 	mm_init_uprobes_state(mm);
+	hugetlb_count_init(mm);
 
 	if (current->mm) {
 		mm->flags = current->mm->flags & MMF_INIT_MASK;

From 388f12dabbe0ca7a55d70ae29eea3338cf2e0376 Mon Sep 17 00:00:00 2001
From: Rik van Riel <riel@surriel.com>
Date: Wed, 8 Sep 2021 18:10:08 -0700
Subject: [PATCH 0289/1750] mm,vmscan: fix divide by zero in get_scan_count

commit 32d4f4b782bb8f0ceb78c6b5dc46eb577ae25bf7 upstream.

Commit f56ce412a59d ("mm: memcontrol: fix occasional OOMs due to
proportional memory.low reclaim") introduced a divide by zero corner
case when oomd is being used in combination with cgroup memory.low
protection.

When oomd decides to kill a cgroup, it will force the cgroup memory to
be reclaimed after killing the tasks, by writing to the memory.max file
for that cgroup, forcing the remaining page cache and reclaimable slab
to be reclaimed down to zero.

Previously, on cgroups with some memory.low protection that would result
in the memory being reclaimed down to the memory.low limit, or likely
not at all, having the page cache reclaimed asynchronously later.

With f56ce412a59d the oomd write to memory.max tries to reclaim all the
way down to zero, which may race with another reclaimer, to the point of
ending up with the divide by zero below.

This patch implements the obvious fix.

Link: https://lkml.kernel.org/r/20210826220149.058089c6@imladris.surriel.com
Fixes: f56ce412a59d ("mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim")
Signed-off-by: Rik van Riel <riel@surriel.com>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Chris Down <chris@chrisdown.name>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/vmscan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 7fb9af001ed5..f2817e80a1ab 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2378,7 +2378,7 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc,
 			cgroup_size = max(cgroup_size, protection);
 
 			scan = lruvec_size - lruvec_size * protection /
-				cgroup_size;
+				(cgroup_size + 1);
 
 			/*
 			 * Minimally target SWAP_CLUSTER_MAX pages to keep

From 6d86634d7bd12223f5e743adea2f595995cb9d9b Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Thu, 2 Sep 2021 14:54:57 -0700
Subject: [PATCH 0290/1750] memcg: enable accounting for pids in nested pid
 namespaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit fab827dbee8c2e06ca4ba000fa6c48bcf9054aba upstream.

Commit 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg")
enabled memcg accounting for pids allocated from init_pid_ns.pid_cachep,
but forgot to adjust the setting for nested pid namespaces.  As a result,
pid memory is not accounted exactly where it is really needed, inside
memcg-limited containers with their own pid namespaces.

Pid was one the first kernel objects enabled for memcg accounting.
init_pid_ns.pid_cachep marked by SLAB_ACCOUNT and we can expect that any
new pids in the system are memcg-accounted.

Though recently I've noticed that it is wrong.  nested pid namespaces
creates own slab caches for pid objects, nested pids have increased size
because contain id both for all parent and for own pid namespaces.  The
problem is that these slab caches are _NOT_ marked by SLAB_ACCOUNT, as a
result any pids allocated in nested pid namespaces are not
memcg-accounted.

Pid struct in nested pid namespace consumes up to 500 bytes memory, 100000
such objects gives us up to ~50Mb unaccounted memory, this allow container
to exceed assigned memcg limits.

Link: https://lkml.kernel.org/r/8b6de616-fd1a-02c6-cbdb-976ecdcfa604@virtuozzo.com
Fixes: 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg")
Cc: stable@vger.kernel.org
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Michal Koutný <mkoutny@suse.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/pid_namespace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 9de21803a8ae..ef8733e2a476 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -51,7 +51,8 @@ static struct kmem_cache *create_pid_cachep(unsigned int level)
 	mutex_lock(&pid_caches_mutex);
 	/* Name collision forces to do allocation under mutex. */
 	if (!*pkc)
-		*pkc = kmem_cache_create(name, len, 0, SLAB_HWCACHE_ALIGN, 0);
+		*pkc = kmem_cache_create(name, len, 0,
+					 SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, 0);
 	mutex_unlock(&pid_caches_mutex);
 	/* current can fail, but someone else can succeed. */
 	return READ_ONCE(*pkc);

From b2e72e53cd26c1bccf42b94b0faea47ef9e55461 Mon Sep 17 00:00:00 2001
From: sumiyawang <sumiyawang@tencent.com>
Date: Sun, 22 Aug 2021 19:49:09 +0800
Subject: [PATCH 0291/1750] libnvdimm/pmem: Fix crash triggered when I/O
 in-flight during unbind

commit 32b2397c1e56f33b0b1881def965bb89bd12f448 upstream.

There is a use after free crash when the pmem driver tears down its
mapping while I/O is still inbound.

This is triggered by driver unbind, "ndctl destroy-namespace", while I/O
is in flight.

Fix the sequence of blk_cleanup_queue() vs memunmap().

The crash signature is of the form:

 BUG: unable to handle page fault for address: ffffc90080200000
 CPU: 36 PID: 9606 Comm: systemd-udevd
 Call Trace:
  ? pmem_do_bvec+0xf9/0x3a0
  ? xas_alloc+0x55/0xd0
  pmem_rw_page+0x4b/0x80
  bdev_read_page+0x86/0xb0
  do_mpage_readpage+0x5d4/0x7a0
  ? lru_cache_add+0xe/0x10
  mpage_readpages+0xf9/0x1c0
  ? bd_link_disk_holder+0x1a0/0x1a0
  blkdev_readpages+0x1d/0x20
  read_pages+0x67/0x1a0

  ndctl Call Trace in vmcore:
  PID: 23473  TASK: ffff88c4fbbe8000  CPU: 1   COMMAND: "ndctl"
  __schedule
  schedule
  blk_mq_freeze_queue_wait
  blk_freeze_queue
  blk_cleanup_queue
  pmem_release_queue
  devm_action_release
  release_nodes
  devres_release_all
  device_release_driver_internal
  device_driver_detach
  unbind_store

Cc: <stable@vger.kernel.org>
Signed-off-by: sumiyawang <sumiyawang@tencent.com>
Reviewed-by: yongduan <yongduan@tencent.com>
Link: https://lore.kernel.org/r/1629632949-14749-1-git-send-email-sumiyawang@tencent.com
Fixes: 50f44ee7248a ("mm/devm_memremap_pages: fix final page put race")
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvdimm/pmem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 875076b0ea6c..d5dd79b59b16 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -448,11 +448,11 @@ static int pmem_attach_disk(struct device *dev,
 		pmem->pfn_flags |= PFN_MAP;
 		bb_range = pmem->pgmap.range;
 	} else {
+		addr = devm_memremap(dev, pmem->phys_addr,
+				pmem->size, ARCH_MEMREMAP_PMEM);
 		if (devm_add_action_or_reset(dev, pmem_release_queue,
 					&pmem->pgmap))
 			return -ENOMEM;
-		addr = devm_memremap(dev, pmem->phys_addr,
-				pmem->size, ARCH_MEMREMAP_PMEM);
 		bb_range.start =  res->start;
 		bb_range.end = res->end;
 	}

From 00cdb2fb4df1d3e8e69751c8da22772ef1f7de07 Mon Sep 17 00:00:00 2001
From: Patryk Duda <pdk@semihalf.com>
Date: Tue, 18 May 2021 16:07:58 +0200
Subject: [PATCH 0292/1750] platform/chrome: cros_ec_proto: Send command again
 when timeout occurs

commit 3abc16af57c9939724df92fcbda296b25cc95168 upstream.

Sometimes kernel is trying to probe Fingerprint MCU (FPMCU) when it
hasn't initialized SPI yet. This can happen because FPMCU is restarted
during system boot and kernel can send message in short window
eg. between sysjump to RW and SPI initialization.

Cc: <stable@vger.kernel.org> # 4.4+
Signed-off-by: Patryk Duda <pdk@semihalf.com>
Link: https://lore.kernel.org/r/20210518140758.29318-1-pdk@semihalf.com
Signed-off-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/chrome/cros_ec_proto.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
index ea5149efcbea..9f698a7aad12 100644
--- a/drivers/platform/chrome/cros_ec_proto.c
+++ b/drivers/platform/chrome/cros_ec_proto.c
@@ -279,6 +279,15 @@ static int cros_ec_host_command_proto_query(struct cros_ec_device *ec_dev,
 	msg->insize = sizeof(struct ec_response_get_protocol_info);
 
 	ret = send_command(ec_dev, msg);
+	/*
+	 * Send command once again when timeout occurred.
+	 * Fingerprint MCU (FPMCU) is restarted during system boot which
+	 * introduces small window in which FPMCU won't respond for any
+	 * messages sent by kernel. There is no need to wait before next
+	 * attempt because we waited at least EC_MSG_DEADLINE_MS.
+	 */
+	if (ret == -ETIMEDOUT)
+		ret = send_command(ec_dev, msg);
 
 	if (ret < 0) {
 		dev_dbg(ec_dev->dev,

From 5944d0e2b0ab7f85cc32f216dd534aa91630ba04 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Fri, 23 Jul 2021 15:19:31 -0700
Subject: [PATCH 0293/1750] lib/test_stackinit: Fix static initializer test

commit f9398f15605a50110bf570aaa361163a85113dd1 upstream.

The static initializer test got accidentally converted to a dynamic
initializer. Fix this and retain the giant padding hole without using
an aligned struct member.

Fixes: 50ceaa95ea09 ("lib: Introduce test_stackinit module")
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210723221933.3431999-2-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 lib/test_stackinit.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/lib/test_stackinit.c b/lib/test_stackinit.c
index f93b1e145ada..16b1d3a3a497 100644
--- a/lib/test_stackinit.c
+++ b/lib/test_stackinit.c
@@ -67,10 +67,10 @@ static bool range_contains(char *haystack_start, size_t haystack_size,
 #define INIT_STRUCT_none		/**/
 #define INIT_STRUCT_zero		= { }
 #define INIT_STRUCT_static_partial	= { .two = 0, }
-#define INIT_STRUCT_static_all		= { .one = arg->one,		\
-					    .two = arg->two,		\
-					    .three = arg->three,	\
-					    .four = arg->four,		\
+#define INIT_STRUCT_static_all		= { .one = 0,			\
+					    .two = 0,			\
+					    .three = 0,			\
+					    .four = 0,			\
 					}
 #define INIT_STRUCT_dynamic_partial	= { .two = arg->two, }
 #define INIT_STRUCT_dynamic_all		= { .one = arg->one,		\
@@ -84,8 +84,7 @@ static bool range_contains(char *haystack_start, size_t haystack_size,
 					var.one = 0;			\
 					var.two = 0;			\
 					var.three = 0;			\
-					memset(&var.four, 0,		\
-					       sizeof(var.four))
+					var.four = 0
 
 /*
  * @name: unique string name for the test
@@ -210,18 +209,13 @@ struct test_small_hole {
 	unsigned long four;
 };
 
-/* Try to trigger unhandled padding in a structure. */
-struct test_aligned {
-	u32 internal1;
-	u64 internal2;
-} __aligned(64);
-
+/* Trigger unhandled padding in a structure. */
 struct test_big_hole {
 	u8 one;
 	u8 two;
 	u8 three;
 	/* 61 byte padding hole here. */
-	struct test_aligned four;
+	u8 four __aligned(64);
 } __aligned(64);
 
 struct test_trailing_hole {

From d0aaea1f117d21cbbf77bd201914ff06bc02fb1d Mon Sep 17 00:00:00 2001
From: Jan Hoffmann <jan@3e8.eu>
Date: Wed, 1 Sep 2021 20:49:33 +0200
Subject: [PATCH 0294/1750] net: dsa: lantiq_gswip: fix maximum frame length

commit 552799f8b3b0074d2617f53a63a088f9514a66e3 upstream.

Currently, outgoing packets larger than 1496 bytes are dropped when
tagged VLAN is used on a switch port.

Add the frame check sequence length to the value of the register
GSWIP_MAC_FLEN to fix this. This matches the lantiq_ppa vendor driver,
which uses a value consisting of 1518 bytes for the MAC frame, plus the
lengths of special tag and VLAN tags.

Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
Cc: stable@vger.kernel.org
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/lantiq_gswip.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c
index a455534740cd..95e634cbc4b6 100644
--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
@@ -853,7 +853,8 @@ static int gswip_setup(struct dsa_switch *ds)
 
 	gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN,
 			  GSWIP_MAC_CTRL_2p(cpu_port));
-	gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8, GSWIP_MAC_FLEN);
+	gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8 + ETH_FCS_LEN,
+		       GSWIP_MAC_FLEN);
 	gswip_switch_mask(priv, 0, GSWIP_BM_QUEUE_GCTRL_GL_MOD,
 			  GSWIP_BM_QUEUE_GCTRL);
 

From be1fcecfc1457a6c51d242f817af162b9cee774a Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tzimmermann@suse.de>
Date: Wed, 14 Jul 2021 16:22:28 +0200
Subject: [PATCH 0295/1750] drm/mgag200: Select clock in PLL update functions

commit 147696720eca12ae48d020726208b9a61cdd80bc upstream.

Put the clock-selection code into each of the PLL-update functions to
make them select the correct pixel clock. Instead of copying the code,
introduce a new helper WREG_MISC_MASKED, which does masked writes into
<MISC>. Use it from each individual PLL update function.

The pixel clock for video output was not actually set before programming
the clock's values. It worked because the device had the correct clock
pre-set.

v2:
	* don't duplicate <MISC> update code (Sam)

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: db05f8d3dc87 ("drm/mgag200: Split MISC register update into PLL selection, SYNC and I/O")
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Emil Velikov <emil.velikov@collabora.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v5.9+
Link: https://patchwork.freedesktop.org/patch/msgid/20210714142240.21979-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/mgag200/mgag200_drv.h  | 16 ++++++++++++++++
 drivers/gpu/drm/mgag200/mgag200_mode.c | 20 +++++++++++++-------
 drivers/gpu/drm/mgag200/mgag200_reg.h  |  9 ++++-----
 3 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h
index 749a075fe9e4..d1b51c133e27 100644
--- a/drivers/gpu/drm/mgag200/mgag200_drv.h
+++ b/drivers/gpu/drm/mgag200/mgag200_drv.h
@@ -43,6 +43,22 @@
 #define ATTR_INDEX 0x1fc0
 #define ATTR_DATA 0x1fc1
 
+#define WREG_MISC(v)						\
+	WREG8(MGA_MISC_OUT, v)
+
+#define RREG_MISC(v)						\
+	((v) = RREG8(MGA_MISC_IN))
+
+#define WREG_MISC_MASKED(v, mask)				\
+	do {							\
+		u8 misc_;					\
+		u8 mask_ = (mask);				\
+		RREG_MISC(misc_);				\
+		misc_ &= ~mask_;				\
+		misc_ |= ((v) & mask_);				\
+		WREG_MISC(misc_);				\
+	} while (0)
+
 #define WREG_ATTR(reg, v)					\
 	do {							\
 		RREG8(0x1fda);					\
diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index 38672f9e5c4f..509968c0d16b 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -172,6 +172,8 @@ static int mgag200_g200_set_plls(struct mga_device *mdev, long clock)
 	drm_dbg_kms(dev, "clock: %ld vco: %ld m: %d n: %d p: %d s: %d\n",
 		    clock, f_vco, m, n, p, s);
 
+	WREG_MISC_MASKED(MGAREG_MISC_CLKSEL_MGA, MGAREG_MISC_CLKSEL_MASK);
+
 	WREG_DAC(MGA1064_PIX_PLLC_M, m);
 	WREG_DAC(MGA1064_PIX_PLLC_N, n);
 	WREG_DAC(MGA1064_PIX_PLLC_P, (p | (s << 3)));
@@ -287,6 +289,8 @@ static int mga_g200se_set_plls(struct mga_device *mdev, long clock)
 		return 1;
 	}
 
+	WREG_MISC_MASKED(MGAREG_MISC_CLKSEL_MGA, MGAREG_MISC_CLKSEL_MASK);
+
 	WREG_DAC(MGA1064_PIX_PLLC_M, m);
 	WREG_DAC(MGA1064_PIX_PLLC_N, n);
 	WREG_DAC(MGA1064_PIX_PLLC_P, p);
@@ -383,6 +387,8 @@ static int mga_g200wb_set_plls(struct mga_device *mdev, long clock)
 		}
 	}
 
+	WREG_MISC_MASKED(MGAREG_MISC_CLKSEL_MGA, MGAREG_MISC_CLKSEL_MASK);
+
 	for (i = 0; i <= 32 && pll_locked == false; i++) {
 		if (i > 0) {
 			WREG8(MGAREG_CRTC_INDEX, 0x1e);
@@ -520,6 +526,8 @@ static int mga_g200ev_set_plls(struct mga_device *mdev, long clock)
 		}
 	}
 
+	WREG_MISC_MASKED(MGAREG_MISC_CLKSEL_MGA, MGAREG_MISC_CLKSEL_MASK);
+
 	WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
 	tmp = RREG8(DAC_DATA);
 	tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
@@ -652,6 +660,9 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
 			}
 		}
 	}
+
+	WREG_MISC_MASKED(MGAREG_MISC_CLKSEL_MGA, MGAREG_MISC_CLKSEL_MASK);
+
 	for (i = 0; i <= 32 && pll_locked == false; i++) {
 		WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
 		tmp = RREG8(DAC_DATA);
@@ -752,6 +763,8 @@ static int mga_g200er_set_plls(struct mga_device *mdev, long clock)
 		}
 	}
 
+	WREG_MISC_MASKED(MGAREG_MISC_CLKSEL_MGA, MGAREG_MISC_CLKSEL_MASK);
+
 	WREG8(DAC_INDEX, MGA1064_PIX_CLK_CTL);
 	tmp = RREG8(DAC_DATA);
 	tmp |= MGA1064_PIX_CLK_CTL_CLK_DIS;
@@ -785,8 +798,6 @@ static int mga_g200er_set_plls(struct mga_device *mdev, long clock)
 
 static int mgag200_crtc_set_plls(struct mga_device *mdev, long clock)
 {
-	u8 misc;
-
 	switch(mdev->type) {
 	case G200_PCI:
 	case G200_AGP:
@@ -811,11 +822,6 @@ static int mgag200_crtc_set_plls(struct mga_device *mdev, long clock)
 		break;
 	}
 
-	misc = RREG8(MGA_MISC_IN);
-	misc &= ~MGAREG_MISC_CLK_SEL_MASK;
-	misc |= MGAREG_MISC_CLK_SEL_MGA_MSK;
-	WREG8(MGA_MISC_OUT, misc);
-
 	return 0;
 }
 
diff --git a/drivers/gpu/drm/mgag200/mgag200_reg.h b/drivers/gpu/drm/mgag200/mgag200_reg.h
index 977be0565c06..60e705283fe8 100644
--- a/drivers/gpu/drm/mgag200/mgag200_reg.h
+++ b/drivers/gpu/drm/mgag200/mgag200_reg.h
@@ -222,11 +222,10 @@
 
 #define MGAREG_MISC_IOADSEL	(0x1 << 0)
 #define MGAREG_MISC_RAMMAPEN	(0x1 << 1)
-#define MGAREG_MISC_CLK_SEL_MASK	GENMASK(3, 2)
-#define MGAREG_MISC_CLK_SEL_VGA25	(0x0 << 2)
-#define MGAREG_MISC_CLK_SEL_VGA28	(0x1 << 2)
-#define MGAREG_MISC_CLK_SEL_MGA_PIX	(0x2 << 2)
-#define MGAREG_MISC_CLK_SEL_MGA_MSK	(0x3 << 2)
+#define MGAREG_MISC_CLKSEL_MASK		GENMASK(3, 2)
+#define MGAREG_MISC_CLKSEL_VGA25	(0x0 << 2)
+#define MGAREG_MISC_CLKSEL_VGA28	(0x1 << 2)
+#define MGAREG_MISC_CLKSEL_MGA		(0x3 << 2)
 #define MGAREG_MISC_VIDEO_DIS	(0x1 << 4)
 #define MGAREG_MISC_HIGH_PG_SEL	(0x1 << 5)
 #define MGAREG_MISC_HSYNCPOL		BIT(6)

From 84cac4f80605e023d3b6febb9adc520b236a3d17 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Wed, 11 Aug 2021 19:06:31 +0200
Subject: [PATCH 0296/1750] drm/msi/mdp4: populate priv->kms in mdp4_kms_init

commit cb0927ab80d224c9074f53d1a55b087d12ec5a85 upstream.

Without this fix boot throws NULL ptr exception at msm_dsi_manager_setup_encoder
on devices like Nexus 7 2013 (MDP4 v4.4).

Fixes: 03436e3ec69c ("drm/msm/dsi: Move setup_encoder to modeset_init")

Cc: <stable@vger.kernel.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20210811170631.39296-1-david@ixit.cz
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
index 39577bf9215a..913de5938782 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -397,6 +397,7 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
 {
 	struct platform_device *pdev = to_platform_device(dev->dev);
 	struct mdp4_platform_config *config = mdp4_get_config(pdev);
+	struct msm_drm_private *priv = dev->dev_private;
 	struct mdp4_kms *mdp4_kms;
 	struct msm_kms *kms = NULL;
 	struct msm_gem_address_space *aspace;
@@ -412,7 +413,8 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
 
 	mdp_kms_init(&mdp4_kms->base, &kms_funcs);
 
-	kms = &mdp4_kms->base.base;
+	priv->kms = &mdp4_kms->base.base;
+	kms = priv->kms;
 
 	mdp4_kms->dev = dev;
 

From bb693c114e8b53e3e0b8228be218d907d35959a5 Mon Sep 17 00:00:00 2001
From: Rajkumar Subbiah <rsubbia@codeaurora.org>
Date: Tue, 6 Jul 2021 08:30:34 -0700
Subject: [PATCH 0297/1750] drm/dp_mst: Fix return code on sideband message
 failure

commit 92bd92c44d0d9be5dcbcda315b4be4b909ed9740 upstream.

Commit 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing +
selftests") added some debug code for sideband message tracing. But
it seems to have unintentionally changed the behavior on sideband message
failure. It catches and returns failure only if DRM_UT_DP is enabled.
Otherwise it ignores the error code and returns success. So on an MST
unplug, the caller is unaware that the clear payload message failed and
ends up waiting for 4 seconds for the response. Fixes the issue by
returning the proper error code.

Changes in V2:
-- Revise commit text as review comment
-- add Fixes text

Changes in V3:
-- remove "unlikely" optimization

Fixes: 2f015ec6eab6 ("drm/dp_mst: Add sideband down request tracing + selftests")
Cc: <stable@vger.kernel.org> # v5.5+
Signed-off-by: Rajkumar Subbiah <rsubbia@codeaurora.org>
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Lyude Paul <lyude@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1625585434-9562-1-git-send-email-khsieh@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_dp_mst_topology.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
index 861f16dfd1a3..1f54e9470165 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2869,11 +2869,13 @@ static int process_single_tx_qlock(struct drm_dp_mst_topology_mgr *mgr,
 	idx += tosend + 1;
 
 	ret = drm_dp_send_sideband_msg(mgr, up, chunk, idx);
-	if (unlikely(ret) && drm_debug_enabled(DRM_UT_DP)) {
-		struct drm_printer p = drm_debug_printer(DBG_PREFIX);
+	if (ret) {
+		if (drm_debug_enabled(DRM_UT_DP)) {
+			struct drm_printer p = drm_debug_printer(DBG_PREFIX);
 
-		drm_printf(&p, "sideband msg failed to send\n");
-		drm_dp_mst_dump_sideband_msg_tx(&p, txmsg);
+			drm_printf(&p, "sideband msg failed to send\n");
+			drm_dp_mst_dump_sideband_msg_tx(&p, txmsg);
+		}
 		return ret;
 	}
 

From c29485e34e63198dca6289639aa711f99d88e76e Mon Sep 17 00:00:00 2001
From: Boris Brezillon <boris.brezillon@collabora.com>
Date: Mon, 21 Jun 2021 15:38:56 +0200
Subject: [PATCH 0298/1750] drm/panfrost: Make sure MMU context lifetime is not
 bound to panfrost_priv

commit 7fdc48cc63a30fa3480d18bdd8c5fff2b9b15212 upstream.

Jobs can be in-flight when the file descriptor is closed (either because
the process did not terminate properly, or because it didn't wait for
all GPU jobs to be finished), and apparently panfrost_job_close() does
not cancel already running jobs. Let's refcount the MMU context object
so it's lifetime is no longer bound to the FD lifetime and running jobs
can finish properly without generating spurious page faults.

Reported-by: Icecream95 <ixn@keemail.me>
Fixes: 7282f7645d06 ("drm/panfrost: Implement per FD address spaces")
Cc: <stable@vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210621133907.1683899-2-boris.brezillon@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panfrost/panfrost_device.h |   8 +-
 drivers/gpu/drm/panfrost/panfrost_drv.c    |  50 ++-----
 drivers/gpu/drm/panfrost/panfrost_gem.c    |  20 ++-
 drivers/gpu/drm/panfrost/panfrost_job.c    |   4 +-
 drivers/gpu/drm/panfrost/panfrost_mmu.c    | 160 ++++++++++++++-------
 drivers/gpu/drm/panfrost/panfrost_mmu.h    |   5 +-
 6 files changed, 136 insertions(+), 111 deletions(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_device.h b/drivers/gpu/drm/panfrost/panfrost_device.h
index 597cf1459b0a..4c6bdea5537b 100644
--- a/drivers/gpu/drm/panfrost/panfrost_device.h
+++ b/drivers/gpu/drm/panfrost/panfrost_device.h
@@ -120,8 +120,12 @@ struct panfrost_device {
 };
 
 struct panfrost_mmu {
+	struct panfrost_device *pfdev;
+	struct kref refcount;
 	struct io_pgtable_cfg pgtbl_cfg;
 	struct io_pgtable_ops *pgtbl_ops;
+	struct drm_mm mm;
+	spinlock_t mm_lock;
 	int as;
 	atomic_t as_count;
 	struct list_head list;
@@ -132,9 +136,7 @@ struct panfrost_file_priv {
 
 	struct drm_sched_entity sched_entity[NUM_JOB_SLOTS];
 
-	struct panfrost_mmu mmu;
-	struct drm_mm mm;
-	spinlock_t mm_lock;
+	struct panfrost_mmu *mmu;
 };
 
 static inline struct panfrost_device *to_panfrost_device(struct drm_device *ddev)
diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index 689be734ed20..a70261809cdd 100644
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -417,7 +417,7 @@ static int panfrost_ioctl_madvise(struct drm_device *dev, void *data,
 		 * anyway, so let's not bother.
 		 */
 		if (!list_is_singular(&bo->mappings.list) ||
-		    WARN_ON_ONCE(first->mmu != &priv->mmu)) {
+		    WARN_ON_ONCE(first->mmu != priv->mmu)) {
 			ret = -EINVAL;
 			goto out_unlock_mappings;
 		}
@@ -449,32 +449,6 @@ int panfrost_unstable_ioctl_check(void)
 	return 0;
 }
 
-#define PFN_4G		(SZ_4G >> PAGE_SHIFT)
-#define PFN_4G_MASK	(PFN_4G - 1)
-#define PFN_16M		(SZ_16M >> PAGE_SHIFT)
-
-static void panfrost_drm_mm_color_adjust(const struct drm_mm_node *node,
-					 unsigned long color,
-					 u64 *start, u64 *end)
-{
-	/* Executable buffers can't start or end on a 4GB boundary */
-	if (!(color & PANFROST_BO_NOEXEC)) {
-		u64 next_seg;
-
-		if ((*start & PFN_4G_MASK) == 0)
-			(*start)++;
-
-		if ((*end & PFN_4G_MASK) == 0)
-			(*end)--;
-
-		next_seg = ALIGN(*start, PFN_4G);
-		if (next_seg - *start <= PFN_16M)
-			*start = next_seg + 1;
-
-		*end = min(*end, ALIGN(*start, PFN_4G) - 1);
-	}
-}
-
 static int
 panfrost_open(struct drm_device *dev, struct drm_file *file)
 {
@@ -489,15 +463,11 @@ panfrost_open(struct drm_device *dev, struct drm_file *file)
 	panfrost_priv->pfdev = pfdev;
 	file->driver_priv = panfrost_priv;
 
-	spin_lock_init(&panfrost_priv->mm_lock);
-
-	/* 4G enough for now. can be 48-bit */
-	drm_mm_init(&panfrost_priv->mm, SZ_32M >> PAGE_SHIFT, (SZ_4G - SZ_32M) >> PAGE_SHIFT);
-	panfrost_priv->mm.color_adjust = panfrost_drm_mm_color_adjust;
-
-	ret = panfrost_mmu_pgtable_alloc(panfrost_priv);
-	if (ret)
-		goto err_pgtable;
+	panfrost_priv->mmu = panfrost_mmu_ctx_create(pfdev);
+	if (IS_ERR(panfrost_priv->mmu)) {
+		ret = PTR_ERR(panfrost_priv->mmu);
+		goto err_free;
+	}
 
 	ret = panfrost_job_open(panfrost_priv);
 	if (ret)
@@ -506,9 +476,8 @@ panfrost_open(struct drm_device *dev, struct drm_file *file)
 	return 0;
 
 err_job:
-	panfrost_mmu_pgtable_free(panfrost_priv);
-err_pgtable:
-	drm_mm_takedown(&panfrost_priv->mm);
+	panfrost_mmu_ctx_put(panfrost_priv->mmu);
+err_free:
 	kfree(panfrost_priv);
 	return ret;
 }
@@ -521,8 +490,7 @@ panfrost_postclose(struct drm_device *dev, struct drm_file *file)
 	panfrost_perfcnt_close(file);
 	panfrost_job_close(panfrost_priv);
 
-	panfrost_mmu_pgtable_free(panfrost_priv);
-	drm_mm_takedown(&panfrost_priv->mm);
+	panfrost_mmu_ctx_put(panfrost_priv->mmu);
 	kfree(panfrost_priv);
 }
 
diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c
index 57a31dd0ffed..1d917cea5ceb 100644
--- a/drivers/gpu/drm/panfrost/panfrost_gem.c
+++ b/drivers/gpu/drm/panfrost/panfrost_gem.c
@@ -60,7 +60,7 @@ panfrost_gem_mapping_get(struct panfrost_gem_object *bo,
 
 	mutex_lock(&bo->mappings.lock);
 	list_for_each_entry(iter, &bo->mappings.list, node) {
-		if (iter->mmu == &priv->mmu) {
+		if (iter->mmu == priv->mmu) {
 			kref_get(&iter->refcount);
 			mapping = iter;
 			break;
@@ -74,16 +74,13 @@ panfrost_gem_mapping_get(struct panfrost_gem_object *bo,
 static void
 panfrost_gem_teardown_mapping(struct panfrost_gem_mapping *mapping)
 {
-	struct panfrost_file_priv *priv;
-
 	if (mapping->active)
 		panfrost_mmu_unmap(mapping);
 
-	priv = container_of(mapping->mmu, struct panfrost_file_priv, mmu);
-	spin_lock(&priv->mm_lock);
+	spin_lock(&mapping->mmu->mm_lock);
 	if (drm_mm_node_allocated(&mapping->mmnode))
 		drm_mm_remove_node(&mapping->mmnode);
-	spin_unlock(&priv->mm_lock);
+	spin_unlock(&mapping->mmu->mm_lock);
 }
 
 static void panfrost_gem_mapping_release(struct kref *kref)
@@ -94,6 +91,7 @@ static void panfrost_gem_mapping_release(struct kref *kref)
 
 	panfrost_gem_teardown_mapping(mapping);
 	drm_gem_object_put(&mapping->obj->base.base);
+	panfrost_mmu_ctx_put(mapping->mmu);
 	kfree(mapping);
 }
 
@@ -143,11 +141,11 @@ int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv)
 	else
 		align = size >= SZ_2M ? SZ_2M >> PAGE_SHIFT : 0;
 
-	mapping->mmu = &priv->mmu;
-	spin_lock(&priv->mm_lock);
-	ret = drm_mm_insert_node_generic(&priv->mm, &mapping->mmnode,
+	mapping->mmu = panfrost_mmu_ctx_get(priv->mmu);
+	spin_lock(&mapping->mmu->mm_lock);
+	ret = drm_mm_insert_node_generic(&mapping->mmu->mm, &mapping->mmnode,
 					 size >> PAGE_SHIFT, align, color, 0);
-	spin_unlock(&priv->mm_lock);
+	spin_unlock(&mapping->mmu->mm_lock);
 	if (ret)
 		goto err;
 
@@ -176,7 +174,7 @@ void panfrost_gem_close(struct drm_gem_object *obj, struct drm_file *file_priv)
 
 	mutex_lock(&bo->mappings.lock);
 	list_for_each_entry(iter, &bo->mappings.list, node) {
-		if (iter->mmu == &priv->mmu) {
+		if (iter->mmu == priv->mmu) {
 			mapping = iter;
 			list_del(&iter->node);
 			break;
diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
index 04e6f6f9b742..7e1a5664d452 100644
--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -165,7 +165,7 @@ static void panfrost_job_hw_submit(struct panfrost_job *job, int js)
 		return;
 	}
 
-	cfg = panfrost_mmu_as_get(pfdev, &job->file_priv->mmu);
+	cfg = panfrost_mmu_as_get(pfdev, job->file_priv->mmu);
 
 	job_write(pfdev, JS_HEAD_NEXT_LO(js), jc_head & 0xFFFFFFFF);
 	job_write(pfdev, JS_HEAD_NEXT_HI(js), jc_head >> 32);
@@ -524,7 +524,7 @@ static irqreturn_t panfrost_job_irq_handler(int irq, void *data)
 			if (job) {
 				pfdev->jobs[j] = NULL;
 
-				panfrost_mmu_as_put(pfdev, &job->file_priv->mmu);
+				panfrost_mmu_as_put(pfdev, job->file_priv->mmu);
 				panfrost_devfreq_record_idle(&pfdev->pfdevfreq);
 
 				dma_fence_signal_locked(job->done_fence);
diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c
index 198686216317..eb149148b408 100644
--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -1,5 +1,8 @@
 // SPDX-License-Identifier:	GPL-2.0
 /* Copyright 2019 Linaro, Ltd, Rob Herring <robh@kernel.org> */
+
+#include <drm/panfrost_drm.h>
+
 #include <linux/atomic.h>
 #include <linux/bitfield.h>
 #include <linux/delay.h>
@@ -337,7 +340,7 @@ static void mmu_tlb_inv_context_s1(void *cookie)
 
 static void mmu_tlb_sync_context(void *cookie)
 {
-	//struct panfrost_device *pfdev = cookie;
+	//struct panfrost_mmu *mmu = cookie;
 	// TODO: Wait 1000 GPU cycles for HW_ISSUE_6367/T60X
 }
 
@@ -359,57 +362,10 @@ static const struct iommu_flush_ops mmu_tlb_ops = {
 	.tlb_flush_leaf = mmu_tlb_flush_leaf,
 };
 
-int panfrost_mmu_pgtable_alloc(struct panfrost_file_priv *priv)
-{
-	struct panfrost_mmu *mmu = &priv->mmu;
-	struct panfrost_device *pfdev = priv->pfdev;
-
-	INIT_LIST_HEAD(&mmu->list);
-	mmu->as = -1;
-
-	mmu->pgtbl_cfg = (struct io_pgtable_cfg) {
-		.pgsize_bitmap	= SZ_4K | SZ_2M,
-		.ias		= FIELD_GET(0xff, pfdev->features.mmu_features),
-		.oas		= FIELD_GET(0xff00, pfdev->features.mmu_features),
-		.coherent_walk	= pfdev->coherent,
-		.tlb		= &mmu_tlb_ops,
-		.iommu_dev	= pfdev->dev,
-	};
-
-	mmu->pgtbl_ops = alloc_io_pgtable_ops(ARM_MALI_LPAE, &mmu->pgtbl_cfg,
-					      priv);
-	if (!mmu->pgtbl_ops)
-		return -EINVAL;
-
-	return 0;
-}
-
-void panfrost_mmu_pgtable_free(struct panfrost_file_priv *priv)
-{
-	struct panfrost_device *pfdev = priv->pfdev;
-	struct panfrost_mmu *mmu = &priv->mmu;
-
-	spin_lock(&pfdev->as_lock);
-	if (mmu->as >= 0) {
-		pm_runtime_get_noresume(pfdev->dev);
-		if (pm_runtime_active(pfdev->dev))
-			panfrost_mmu_disable(pfdev, mmu->as);
-		pm_runtime_put_autosuspend(pfdev->dev);
-
-		clear_bit(mmu->as, &pfdev->as_alloc_mask);
-		clear_bit(mmu->as, &pfdev->as_in_use_mask);
-		list_del(&mmu->list);
-	}
-	spin_unlock(&pfdev->as_lock);
-
-	free_io_pgtable_ops(mmu->pgtbl_ops);
-}
-
 static struct panfrost_gem_mapping *
 addr_to_mapping(struct panfrost_device *pfdev, int as, u64 addr)
 {
 	struct panfrost_gem_mapping *mapping = NULL;
-	struct panfrost_file_priv *priv;
 	struct drm_mm_node *node;
 	u64 offset = addr >> PAGE_SHIFT;
 	struct panfrost_mmu *mmu;
@@ -422,11 +378,10 @@ addr_to_mapping(struct panfrost_device *pfdev, int as, u64 addr)
 	goto out;
 
 found_mmu:
-	priv = container_of(mmu, struct panfrost_file_priv, mmu);
 
-	spin_lock(&priv->mm_lock);
+	spin_lock(&mmu->mm_lock);
 
-	drm_mm_for_each_node(node, &priv->mm) {
+	drm_mm_for_each_node(node, &mmu->mm) {
 		if (offset >= node->start &&
 		    offset < (node->start + node->size)) {
 			mapping = drm_mm_node_to_panfrost_mapping(node);
@@ -436,7 +391,7 @@ addr_to_mapping(struct panfrost_device *pfdev, int as, u64 addr)
 		}
 	}
 
-	spin_unlock(&priv->mm_lock);
+	spin_unlock(&mmu->mm_lock);
 out:
 	spin_unlock(&pfdev->as_lock);
 	return mapping;
@@ -549,6 +504,107 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as,
 	return ret;
 }
 
+static void panfrost_mmu_release_ctx(struct kref *kref)
+{
+	struct panfrost_mmu *mmu = container_of(kref, struct panfrost_mmu,
+						refcount);
+	struct panfrost_device *pfdev = mmu->pfdev;
+
+	spin_lock(&pfdev->as_lock);
+	if (mmu->as >= 0) {
+		pm_runtime_get_noresume(pfdev->dev);
+		if (pm_runtime_active(pfdev->dev))
+			panfrost_mmu_disable(pfdev, mmu->as);
+		pm_runtime_put_autosuspend(pfdev->dev);
+
+		clear_bit(mmu->as, &pfdev->as_alloc_mask);
+		clear_bit(mmu->as, &pfdev->as_in_use_mask);
+		list_del(&mmu->list);
+	}
+	spin_unlock(&pfdev->as_lock);
+
+	free_io_pgtable_ops(mmu->pgtbl_ops);
+	drm_mm_takedown(&mmu->mm);
+	kfree(mmu);
+}
+
+void panfrost_mmu_ctx_put(struct panfrost_mmu *mmu)
+{
+	kref_put(&mmu->refcount, panfrost_mmu_release_ctx);
+}
+
+struct panfrost_mmu *panfrost_mmu_ctx_get(struct panfrost_mmu *mmu)
+{
+	kref_get(&mmu->refcount);
+
+	return mmu;
+}
+
+#define PFN_4G		(SZ_4G >> PAGE_SHIFT)
+#define PFN_4G_MASK	(PFN_4G - 1)
+#define PFN_16M		(SZ_16M >> PAGE_SHIFT)
+
+static void panfrost_drm_mm_color_adjust(const struct drm_mm_node *node,
+					 unsigned long color,
+					 u64 *start, u64 *end)
+{
+	/* Executable buffers can't start or end on a 4GB boundary */
+	if (!(color & PANFROST_BO_NOEXEC)) {
+		u64 next_seg;
+
+		if ((*start & PFN_4G_MASK) == 0)
+			(*start)++;
+
+		if ((*end & PFN_4G_MASK) == 0)
+			(*end)--;
+
+		next_seg = ALIGN(*start, PFN_4G);
+		if (next_seg - *start <= PFN_16M)
+			*start = next_seg + 1;
+
+		*end = min(*end, ALIGN(*start, PFN_4G) - 1);
+	}
+}
+
+struct panfrost_mmu *panfrost_mmu_ctx_create(struct panfrost_device *pfdev)
+{
+	struct panfrost_mmu *mmu;
+
+	mmu = kzalloc(sizeof(*mmu), GFP_KERNEL);
+	if (!mmu)
+		return ERR_PTR(-ENOMEM);
+
+	mmu->pfdev = pfdev;
+	spin_lock_init(&mmu->mm_lock);
+
+	/* 4G enough for now. can be 48-bit */
+	drm_mm_init(&mmu->mm, SZ_32M >> PAGE_SHIFT, (SZ_4G - SZ_32M) >> PAGE_SHIFT);
+	mmu->mm.color_adjust = panfrost_drm_mm_color_adjust;
+
+	INIT_LIST_HEAD(&mmu->list);
+	mmu->as = -1;
+
+	mmu->pgtbl_cfg = (struct io_pgtable_cfg) {
+		.pgsize_bitmap	= SZ_4K | SZ_2M,
+		.ias		= FIELD_GET(0xff, pfdev->features.mmu_features),
+		.oas		= FIELD_GET(0xff00, pfdev->features.mmu_features),
+		.coherent_walk	= pfdev->coherent,
+		.tlb		= &mmu_tlb_ops,
+		.iommu_dev	= pfdev->dev,
+	};
+
+	mmu->pgtbl_ops = alloc_io_pgtable_ops(ARM_MALI_LPAE, &mmu->pgtbl_cfg,
+					      mmu);
+	if (!mmu->pgtbl_ops) {
+		kfree(mmu);
+		return ERR_PTR(-EINVAL);
+	}
+
+	kref_init(&mmu->refcount);
+
+	return mmu;
+}
+
 static const char *access_type_name(struct panfrost_device *pfdev,
 		u32 fault_status)
 {
diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.h b/drivers/gpu/drm/panfrost/panfrost_mmu.h
index 44fc2edf63ce..cc2a0d307feb 100644
--- a/drivers/gpu/drm/panfrost/panfrost_mmu.h
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.h
@@ -18,7 +18,8 @@ void panfrost_mmu_reset(struct panfrost_device *pfdev);
 u32 panfrost_mmu_as_get(struct panfrost_device *pfdev, struct panfrost_mmu *mmu);
 void panfrost_mmu_as_put(struct panfrost_device *pfdev, struct panfrost_mmu *mmu);
 
-int panfrost_mmu_pgtable_alloc(struct panfrost_file_priv *priv);
-void panfrost_mmu_pgtable_free(struct panfrost_file_priv *priv);
+struct panfrost_mmu *panfrost_mmu_ctx_get(struct panfrost_mmu *mmu);
+void panfrost_mmu_ctx_put(struct panfrost_mmu *mmu);
+struct panfrost_mmu *panfrost_mmu_ctx_create(struct panfrost_device *pfdev);
 
 #endif

From 7b1abace16a9dff6804d4eb94750beb60d9502b4 Mon Sep 17 00:00:00 2001
From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Date: Tue, 22 Jun 2021 12:23:38 -0400
Subject: [PATCH 0299/1750] drm/amdgpu: Fix BUG_ON assert
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit ea7acd7c5967542353430947f3faf699e70602e5 upstream.

With added CPU domain to placement you can have
now 3 placemnts at once.

CC: stable@kernel.org
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210622162339.761651-5-andrey.grodzovsky@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
index ac043baac05d..ad9863b84f1f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -207,7 +207,7 @@ void amdgpu_bo_placement_from_domain(struct amdgpu_bo *abo, u32 domain)
 		c++;
 	}
 
-	BUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS);
+	BUG_ON(c > AMDGPU_BO_MAX_PLACEMENTS);
 
 	placement->num_placement = c;
 	placement->placement = places;

From 583c4f3d09c3e980a683b59febbb0c775bdff1db Mon Sep 17 00:00:00 2001
From: Aurabindo Pillai <aurabindo.pillai@amd.com>
Date: Tue, 24 Aug 2021 15:10:50 -0400
Subject: [PATCH 0300/1750] drm/amd/display: Update number of DCN3 clock states

commit 0bbf06d888734041e813b916d7821acd4f72005a upstream.

[Why & How]
The DCN3 SoC parameter num_states was calculated but not saved into the
object.

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1403
Cc: stable@vger.kernel.org
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
index e5f4f93317cf..fcb2e1f02a52 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
@@ -2522,6 +2522,7 @@ void dcn30_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
 
+		dcn3_0_soc.num_states = num_states;
 		for (i = 0; i < dcn3_0_soc.num_states; i++) {
 			dcn3_0_soc.clock_limits[i].state = i;
 			dcn3_0_soc.clock_limits[i].dcfclk_mhz = dcfclk_mhz[i];

From b80a99e048275d566d63f2463a2f640065ccbf75 Mon Sep 17 00:00:00 2001
From: "Jerry (Fangzhi) Zuo" <Jerry.Zuo@amd.com>
Date: Wed, 17 Jun 2020 20:34:33 -0400
Subject: [PATCH 0301/1750] drm/amd/display: Update bounding box states (v2)

commit a7a9d11e12fcc32160d55e8612e72e5ab51b15dc upstream.

[Why]
Drop hardcoded dispclk, dppclk, phyclk

[How]
Read the corresponding values from clock table entries already populated.

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1403
Cc: stable@vger.kernel.org
Signed-off-by: Jerry (Fangzhi) Zuo <Jerry.Zuo@amd.com>
Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../drm/amd/display/dc/dcn30/dcn30_resource.c | 41 ++++++++++++++-----
 1 file changed, 31 insertions(+), 10 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
index fcb2e1f02a52..32993ce24a58 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_resource.c
@@ -2455,16 +2455,37 @@ void dcn30_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params
 	dc->dml.soc.dispclk_dppclk_vco_speed_mhz = dc->clk_mgr->dentist_vco_freq_khz / 1000.0;
 
 	if (bw_params->clk_table.entries[0].memclk_mhz) {
+		int max_dcfclk_mhz = 0, max_dispclk_mhz = 0, max_dppclk_mhz = 0, max_phyclk_mhz = 0;
 
-		if (bw_params->clk_table.entries[1].dcfclk_mhz > dcfclk_sta_targets[num_dcfclk_sta_targets-1]) {
+		for (i = 0; i < MAX_NUM_DPM_LVL; i++) {
+			if (bw_params->clk_table.entries[i].dcfclk_mhz > max_dcfclk_mhz)
+				max_dcfclk_mhz = bw_params->clk_table.entries[i].dcfclk_mhz;
+			if (bw_params->clk_table.entries[i].dispclk_mhz > max_dispclk_mhz)
+				max_dispclk_mhz = bw_params->clk_table.entries[i].dispclk_mhz;
+			if (bw_params->clk_table.entries[i].dppclk_mhz > max_dppclk_mhz)
+				max_dppclk_mhz = bw_params->clk_table.entries[i].dppclk_mhz;
+			if (bw_params->clk_table.entries[i].phyclk_mhz > max_phyclk_mhz)
+				max_phyclk_mhz = bw_params->clk_table.entries[i].phyclk_mhz;
+		}
+
+		if (!max_dcfclk_mhz)
+			max_dcfclk_mhz = dcn3_0_soc.clock_limits[0].dcfclk_mhz;
+		if (!max_dispclk_mhz)
+			max_dispclk_mhz = dcn3_0_soc.clock_limits[0].dispclk_mhz;
+		if (!max_dppclk_mhz)
+			max_dppclk_mhz = dcn3_0_soc.clock_limits[0].dppclk_mhz;
+		if (!max_phyclk_mhz)
+			max_phyclk_mhz = dcn3_0_soc.clock_limits[0].phyclk_mhz;
+
+		if (max_dcfclk_mhz > dcfclk_sta_targets[num_dcfclk_sta_targets-1]) {
 			// If max DCFCLK is greater than the max DCFCLK STA target, insert into the DCFCLK STA target array
-			dcfclk_sta_targets[num_dcfclk_sta_targets] = bw_params->clk_table.entries[1].dcfclk_mhz;
+			dcfclk_sta_targets[num_dcfclk_sta_targets] = max_dcfclk_mhz;
 			num_dcfclk_sta_targets++;
-		} else if (bw_params->clk_table.entries[1].dcfclk_mhz < dcfclk_sta_targets[num_dcfclk_sta_targets-1]) {
+		} else if (max_dcfclk_mhz < dcfclk_sta_targets[num_dcfclk_sta_targets-1]) {
 			// If max DCFCLK is less than the max DCFCLK STA target, cap values and remove duplicates
 			for (i = 0; i < num_dcfclk_sta_targets; i++) {
-				if (dcfclk_sta_targets[i] > bw_params->clk_table.entries[1].dcfclk_mhz) {
-					dcfclk_sta_targets[i] = bw_params->clk_table.entries[1].dcfclk_mhz;
+				if (dcfclk_sta_targets[i] > max_dcfclk_mhz) {
+					dcfclk_sta_targets[i] = max_dcfclk_mhz;
 					break;
 				}
 			}
@@ -2502,7 +2523,7 @@ void dcn30_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params
 				dcfclk_mhz[num_states] = dcfclk_sta_targets[i];
 				dram_speed_mts[num_states++] = optimal_uclk_for_dcfclk_sta_targets[i++];
 			} else {
-				if (j < num_uclk_states && optimal_dcfclk_for_uclk[j] <= bw_params->clk_table.entries[1].dcfclk_mhz) {
+				if (j < num_uclk_states && optimal_dcfclk_for_uclk[j] <= max_dcfclk_mhz) {
 					dcfclk_mhz[num_states] = optimal_dcfclk_for_uclk[j];
 					dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 				} else {
@@ -2517,7 +2538,7 @@ void dcn30_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params
 		}
 
 		while (j < num_uclk_states && num_states < DC__VOLTAGE_STATES &&
-				optimal_dcfclk_for_uclk[j] <= bw_params->clk_table.entries[1].dcfclk_mhz) {
+				optimal_dcfclk_for_uclk[j] <= max_dcfclk_mhz) {
 			dcfclk_mhz[num_states] = optimal_dcfclk_for_uclk[j];
 			dram_speed_mts[num_states++] = bw_params->clk_table.entries[j++].memclk_mhz * 16;
 		}
@@ -2530,9 +2551,9 @@ void dcn30_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *bw_params
 			dcn3_0_soc.clock_limits[i].dram_speed_mts = dram_speed_mts[i];
 
 			/* Fill all states with max values of all other clocks */
-			dcn3_0_soc.clock_limits[i].dispclk_mhz = bw_params->clk_table.entries[1].dispclk_mhz;
-			dcn3_0_soc.clock_limits[i].dppclk_mhz  = bw_params->clk_table.entries[1].dppclk_mhz;
-			dcn3_0_soc.clock_limits[i].phyclk_mhz  = bw_params->clk_table.entries[1].phyclk_mhz;
+			dcn3_0_soc.clock_limits[i].dispclk_mhz = max_dispclk_mhz;
+			dcn3_0_soc.clock_limits[i].dppclk_mhz  = max_dppclk_mhz;
+			dcn3_0_soc.clock_limits[i].phyclk_mhz  = max_phyclk_mhz;
 			dcn3_0_soc.clock_limits[i].dtbclk_mhz = dcn3_0_soc.clock_limits[0].dtbclk_mhz;
 			/* These clocks cannot come from bw_params, always fill from dcn3_0_soc[1] */
 			/* FCLK, PHYCLK_D18, SOCCLK, DSCCLK */

From 95251e6833fa38199b3189d5621bc19b0c027e4b Mon Sep 17 00:00:00 2001
From: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Date: Tue, 24 Aug 2021 13:30:25 -0400
Subject: [PATCH 0302/1750] drm/panfrost: Simplify lock_region calculation

commit b5fab345654c603c07525100d744498f28786929 upstream.

In lock_region, simplify the calculation of the region_width parameter.
This field is the size, but encoded as ceil(log2(size)) - 1.
ceil(log2(size)) may be computed directly as fls(size - 1). However, we
want to use the 64-bit versions as the amount to lock can exceed
32-bits.

This avoids undefined (and completely wrong) behaviour when locking all
memory (size ~0). In this case, the old code would "round up" ~0 to the
nearest page, overflowing to 0. Since fls(0) == 0, this would calculate
a region width of 10 + 0 = 10. But then the code would shift by
(region_width - 11) = -1. As shifting by a negative number is undefined,
UBSAN flags the bug. Of course, even if it were defined the behaviour is
wrong, instead of locking all memory almost none would get locked.

The new form of the calculation corrects this special case and avoids
the undefined behaviour.

Signed-off-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Reported-and-tested-by: Chris Morgan <macromorgan@hotmail.com>
Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Cc: <stable@vger.kernel.org>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210824173028.7528-2-alyssa.rosenzweig@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panfrost/panfrost_mmu.c | 19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c
index eb149148b408..4a6a9bccbc34 100644
--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -59,21 +59,12 @@ static void lock_region(struct panfrost_device *pfdev, u32 as_nr,
 {
 	u8 region_width;
 	u64 region = iova & PAGE_MASK;
-	/*
-	 * fls returns:
-	 * 1 .. 32
-	 *
-	 * 10 + fls(num_pages)
-	 * results in the range (11 .. 42)
+
+	/* The size is encoded as ceil(log2) minus(1), which may be calculated
+	 * with fls. The size must be clamped to hardware bounds.
 	 */
-
-	size = round_up(size, PAGE_SIZE);
-
-	region_width = 10 + fls(size >> PAGE_SHIFT);
-	if ((size >> PAGE_SHIFT) != (1ul << (region_width - 11))) {
-		/* not pow2, so must go up to the next pow2 */
-		region_width += 1;
-	}
+	size = max_t(u64, size, PAGE_SIZE);
+	region_width = fls64(size - 1) - 1;
 	region |= region_width;
 
 	/* Lock the region that needs to be updated */

From 8976e09443cbba49f1818c7fb217d016b247ee87 Mon Sep 17 00:00:00 2001
From: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Date: Tue, 24 Aug 2021 13:30:26 -0400
Subject: [PATCH 0303/1750] drm/panfrost: Use u64 for size in lock_region

commit a77b58825d7221d4a45c47881c35a47ba003aa73 upstream.

Mali virtual addresses are 48-bit. Use a u64 instead of size_t to ensure
we can express the "lock everything" condition as ~0ULL without
overflow. This code was silently broken on any platform where a size_t
is less than 48-bits; in particular, it was broken on 32-bit armv7
platforms which remain in use with panfrost. (Mainly RK3288)

Signed-off-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Suggested-by: Rob Herring <robh@kernel.org>
Tested-by: Chris Morgan <macromorgan@hotmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210824173028.7528-3-alyssa.rosenzweig@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panfrost/panfrost_mmu.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c
index 4a6a9bccbc34..adfe7ea45991 100644
--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -55,7 +55,7 @@ static int write_cmd(struct panfrost_device *pfdev, u32 as_nr, u32 cmd)
 }
 
 static void lock_region(struct panfrost_device *pfdev, u32 as_nr,
-			u64 iova, size_t size)
+			u64 iova, u64 size)
 {
 	u8 region_width;
 	u64 region = iova & PAGE_MASK;
@@ -75,7 +75,7 @@ static void lock_region(struct panfrost_device *pfdev, u32 as_nr,
 
 
 static int mmu_hw_do_operation_locked(struct panfrost_device *pfdev, int as_nr,
-				      u64 iova, size_t size, u32 op)
+				      u64 iova, u64 size, u32 op)
 {
 	if (as_nr < 0)
 		return 0;
@@ -92,7 +92,7 @@ static int mmu_hw_do_operation_locked(struct panfrost_device *pfdev, int as_nr,
 
 static int mmu_hw_do_operation(struct panfrost_device *pfdev,
 			       struct panfrost_mmu *mmu,
-			       u64 iova, size_t size, u32 op)
+			       u64 iova, u64 size, u32 op)
 {
 	int ret;
 
@@ -109,7 +109,7 @@ static void panfrost_mmu_enable(struct panfrost_device *pfdev, struct panfrost_m
 	u64 transtab = cfg->arm_mali_lpae_cfg.transtab;
 	u64 memattr = cfg->arm_mali_lpae_cfg.memattr;
 
-	mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0UL, AS_COMMAND_FLUSH_MEM);
+	mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0ULL, AS_COMMAND_FLUSH_MEM);
 
 	mmu_write(pfdev, AS_TRANSTAB_LO(as_nr), transtab & 0xffffffffUL);
 	mmu_write(pfdev, AS_TRANSTAB_HI(as_nr), transtab >> 32);
@@ -125,7 +125,7 @@ static void panfrost_mmu_enable(struct panfrost_device *pfdev, struct panfrost_m
 
 static void panfrost_mmu_disable(struct panfrost_device *pfdev, u32 as_nr)
 {
-	mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0UL, AS_COMMAND_FLUSH_MEM);
+	mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0ULL, AS_COMMAND_FLUSH_MEM);
 
 	mmu_write(pfdev, AS_TRANSTAB_LO(as_nr), 0);
 	mmu_write(pfdev, AS_TRANSTAB_HI(as_nr), 0);
@@ -225,7 +225,7 @@ static size_t get_pgsize(u64 addr, size_t size)
 
 static void panfrost_mmu_flush_range(struct panfrost_device *pfdev,
 				     struct panfrost_mmu *mmu,
-				     u64 iova, size_t size)
+				     u64 iova, u64 size)
 {
 	if (mmu->as < 0)
 		return;

From 412974e75fdd0ce230dbfa2412dbf4a3e54a0b4e Mon Sep 17 00:00:00 2001
From: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Date: Tue, 24 Aug 2021 13:30:27 -0400
Subject: [PATCH 0304/1750] drm/panfrost: Clamp lock region to Bifrost minimum

commit bd7ffbc3ca12629aeb66fb9e28cf42b7f37e3e3b upstream.

When locking a region, we currently clamp to a PAGE_SIZE as the minimum
lock region. While this is valid for Midgard, it is invalid for Bifrost,
where the minimum locking size is 8x larger than the 4k page size. Add a
hardware definition for the minimum lock region size (corresponding to
KBASE_LOCK_REGION_MIN_SIZE_LOG2 in kbase) and respect it.

Signed-off-by: Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>
Tested-by: Chris Morgan <macromorgan@hotmail.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Rob Herring <robh@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210824173028.7528-4-alyssa.rosenzweig@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panfrost/panfrost_mmu.c  | 2 +-
 drivers/gpu/drm/panfrost/panfrost_regs.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c
index adfe7ea45991..7fc45b13a52c 100644
--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c
+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c
@@ -63,7 +63,7 @@ static void lock_region(struct panfrost_device *pfdev, u32 as_nr,
 	/* The size is encoded as ceil(log2) minus(1), which may be calculated
 	 * with fls. The size must be clamped to hardware bounds.
 	 */
-	size = max_t(u64, size, PAGE_SIZE);
+	size = max_t(u64, size, AS_LOCK_REGION_MIN_SIZE);
 	region_width = fls64(size - 1) - 1;
 	region |= region_width;
 
diff --git a/drivers/gpu/drm/panfrost/panfrost_regs.h b/drivers/gpu/drm/panfrost/panfrost_regs.h
index eddaa62ad8b0..2ae3a4d301d3 100644
--- a/drivers/gpu/drm/panfrost/panfrost_regs.h
+++ b/drivers/gpu/drm/panfrost/panfrost_regs.h
@@ -318,6 +318,8 @@
 #define AS_FAULTSTATUS_ACCESS_TYPE_READ		(0x2 << 8)
 #define AS_FAULTSTATUS_ACCESS_TYPE_WRITE	(0x3 << 8)
 
+#define AS_LOCK_REGION_MIN_SIZE                 (1ULL << 15)
+
 #define gpu_write(dev, reg, data) writel(data, dev->iomem + reg)
 #define gpu_read(dev, reg) readl(dev->iomem + reg)
 

From ad3ea16746cc68307165d52e22a3f75015ccd16e Mon Sep 17 00:00:00 2001
From: Amir Goldstein <amir73il@gmail.com>
Date: Thu, 4 Mar 2021 12:48:26 +0200
Subject: [PATCH 0305/1750] fanotify: limit number of event merge attempts

commit b8cd0ee8cda68a888a317991c1e918a8cba1a568 upstream.

Event merges are expensive when event queue size is large, so limit the
linear search to 128 merge tests.

[Stable backport notes] The following statement from upstream commit is
irrelevant for backport:
-
-In combination with 128 size hash table, there is a potential to merge
-with up to 16K events in the hashed queue.
-
[Stable backport notes] The problem is as old as fanotify and described
in the linked cover letter "Performance improvement for fanotify merge".
This backported patch fixes the performance issue at the cost of merging
fewer potential events.  Fixing the performance issue is more important
than preserving the "event merge" behavior, which was not predictable in
any way that applications could rely on.

Link: https://lore.kernel.org/r/20210304104826.3993892-6-amir73il@gmail.com
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/linux-fsdevel/20210202162010.305971-1-amir73il@gmail.com/
Link: https://lore.kernel.org/linux-fsdevel/20210915163334.GD6166@quack2.suse.cz/
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/notify/fanotify/fanotify.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index 1192c9953620..c3af99e94f1d 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -129,11 +129,15 @@ static bool fanotify_should_merge(struct fsnotify_event *old_fsn,
 	return false;
 }
 
+/* Limit event merges to limit CPU overhead per event */
+#define FANOTIFY_MAX_MERGE_EVENTS 128
+
 /* and the list better be locked by something too! */
 static int fanotify_merge(struct list_head *list, struct fsnotify_event *event)
 {
 	struct fsnotify_event *test_event;
 	struct fanotify_event *new;
+	int i = 0;
 
 	pr_debug("%s: list=%p event=%p\n", __func__, list, event);
 	new = FANOTIFY_E(event);
@@ -147,6 +151,8 @@ static int fanotify_merge(struct list_head *list, struct fsnotify_event *event)
 		return 0;
 
 	list_for_each_entry_reverse(test_event, list, list) {
+		if (++i > FANOTIFY_MAX_MERGE_EVENTS)
+			break;
 		if (fanotify_should_merge(test_event, event)) {
 			FANOTIFY_E(test_event)->mask |= new->mask;
 			return 1;

From faf816b0f8d0fa8ea24f579fb6a51e5ed3efd750 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 18 Sep 2021 13:40:38 +0200
Subject: [PATCH 0306/1750] Linux 5.10.67

Link: https://lore.kernel.org/r/20210916155753.903069397@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8b1f1e7517b9..a47273ecfdf2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 66
+SUBLEVEL = 67
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 575279059e26b27aababbb7edae2f0f19205779d Mon Sep 17 00:00:00 2001
From: Robert Foss <robert.foss@linaro.org>
Date: Thu, 17 Dec 2020 15:09:33 +0100
Subject: [PATCH 0307/1750] drm/bridge: lt9611: Fix handling of 4k panels

commit d1a97648ae028a44536927c87837c45ada7141c9 upstream.

4k requires two dsi pipes, so don't report MODE_OK when only a
single pipe is configured. But rather report MODE_PANEL to
signal that requirements of the panel are not being met.

Reported-by: Peter Collingbourne <pcc@google.com>
Suggested-by: Peter Collingbourne <pcc@google.com>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Tested-by: John Stultz <john.stultz@linaro.org>
Tested-by: Anibal Limon <anibal.limon@linaro.org>
Tested-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Acked-by: Vinod Koul <vkoul@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20201217140933.1133969-1-robert.foss@linaro.org
Cc: Peter Collingbourne <pcc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/bridge/lontium-lt9611.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/lontium-lt9611.c b/drivers/gpu/drm/bridge/lontium-lt9611.c
index c1926154eda8..29b1ce2140ab 100644
--- a/drivers/gpu/drm/bridge/lontium-lt9611.c
+++ b/drivers/gpu/drm/bridge/lontium-lt9611.c
@@ -867,8 +867,14 @@ static enum drm_mode_status lt9611_bridge_mode_valid(struct drm_bridge *bridge,
 						     const struct drm_display_mode *mode)
 {
 	struct lt9611_mode *lt9611_mode = lt9611_find_mode(mode);
+	struct lt9611 *lt9611 = bridge_to_lt9611(bridge);
 
-	return lt9611_mode ? MODE_OK : MODE_BAD;
+	if (!lt9611_mode)
+		return MODE_BAD;
+	else if (lt9611_mode->intfs > 1 && !lt9611->dsi1)
+		return MODE_PANEL;
+	else
+		return MODE_OK;
 }
 
 static void lt9611_bridge_pre_enable(struct drm_bridge *bridge)

From 88f3d951e2dbdc7927da799792d885c20b8b94d5 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain@oracle.com>
Date: Tue, 10 Aug 2021 23:23:44 +0800
Subject: [PATCH 0308/1750] btrfs: fix upper limit for max_inline for page size
 64K

commit 6f93e834fa7c5faa0372e46828b4b2a966ac61d7 upstream.

The mount option max_inline ranges from 0 to the sectorsize (which is
now equal to page size). But we parse the mount options too early and
before the actual sectorsize is read from the superblock. So the upper
limit of max_inline is unaware of the actual sectorsize and is limited
by the temporary sectorsize 4096, even on a system where the default
sectorsize is 64K.

Fix this by reading the superblock sectorsize before the mount option
parse.

Reported-by: Alexander Tsvetkov <alexander.tsvetkov@oracle.com>
CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/disk-io.c | 45 +++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index e025cd8f3f07..ef7df2141f34 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3019,6 +3019,29 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
 	 */
 	fs_info->compress_type = BTRFS_COMPRESS_ZLIB;
 
+	/*
+	 * Flag our filesystem as having big metadata blocks if they are bigger
+	 * than the page size
+	 */
+	if (btrfs_super_nodesize(disk_super) > PAGE_SIZE) {
+		if (!(features & BTRFS_FEATURE_INCOMPAT_BIG_METADATA))
+			btrfs_info(fs_info,
+				"flagging fs with big metadata feature");
+		features |= BTRFS_FEATURE_INCOMPAT_BIG_METADATA;
+	}
+
+	/* Set up fs_info before parsing mount options */
+	nodesize = btrfs_super_nodesize(disk_super);
+	sectorsize = btrfs_super_sectorsize(disk_super);
+	stripesize = sectorsize;
+	fs_info->dirty_metadata_batch = nodesize * (1 + ilog2(nr_cpu_ids));
+	fs_info->delalloc_batch = sectorsize * 512 * (1 + ilog2(nr_cpu_ids));
+
+	/* Cache block sizes */
+	fs_info->nodesize = nodesize;
+	fs_info->sectorsize = sectorsize;
+	fs_info->stripesize = stripesize;
+
 	ret = btrfs_parse_options(fs_info, options, sb->s_flags);
 	if (ret) {
 		err = ret;
@@ -3045,28 +3068,6 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
 	if (features & BTRFS_FEATURE_INCOMPAT_SKINNY_METADATA)
 		btrfs_info(fs_info, "has skinny extents");
 
-	/*
-	 * flag our filesystem as having big metadata blocks if
-	 * they are bigger than the page size
-	 */
-	if (btrfs_super_nodesize(disk_super) > PAGE_SIZE) {
-		if (!(features & BTRFS_FEATURE_INCOMPAT_BIG_METADATA))
-			btrfs_info(fs_info,
-				"flagging fs with big metadata feature");
-		features |= BTRFS_FEATURE_INCOMPAT_BIG_METADATA;
-	}
-
-	nodesize = btrfs_super_nodesize(disk_super);
-	sectorsize = btrfs_super_sectorsize(disk_super);
-	stripesize = sectorsize;
-	fs_info->dirty_metadata_batch = nodesize * (1 + ilog2(nr_cpu_ids));
-	fs_info->delalloc_batch = sectorsize * 512 * (1 + ilog2(nr_cpu_ids));
-
-	/* Cache block sizes */
-	fs_info->nodesize = nodesize;
-	fs_info->sectorsize = sectorsize;
-	fs_info->stripesize = stripesize;
-
 	/*
 	 * mixed block groups end up with duplicate but slightly offset
 	 * extent buffers for the same range.  It leads to corruptions

From ce8f81b76d3bef7b9fe6c8f84d029ab898b19469 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Sun, 12 Sep 2021 06:45:07 -0600
Subject: [PATCH 0309/1750] io_uring: ensure symmetry in handling iter types in
 loop_rw_iter()

commit 16c8d2df7ec0eed31b7d3b61cb13206a7fb930cc upstream.

When setting up the next segment, we check what type the iter is and
handle it accordingly. However, when incrementing and processed amount
we do not, and both iter advance and addr/len are adjusted, regardless
of type. Split the increment side just like we do on the setup side.

Fixes: 4017eb91a9e7 ("io_uring: make loop_rw_iter() use original user supplied pointers")
Cc: stable@vger.kernel.org
Reported-by: Valentina Palmiotti <vpalmiotti@gmail.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index d0089039fee7..a8d07273ddc0 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3206,12 +3206,15 @@ static ssize_t loop_rw_iter(int rw, struct io_kiocb *req, struct iov_iter *iter)
 				ret = nr;
 			break;
 		}
+		if (!iov_iter_is_bvec(iter)) {
+			iov_iter_advance(iter, nr);
+		} else {
+			req->rw.len -= nr;
+			req->rw.addr += nr;
+		}
 		ret += nr;
 		if (nr != iovec.iov_len)
 			break;
-		req->rw.len -= nr;
-		req->rw.addr += nr;
-		iov_iter_advance(iter, nr);
 	}
 
 	return ret;

From 1a5a3ba21aeebc6908c06c31125bcdc7584194a2 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Fri, 3 Sep 2021 10:49:37 +0200
Subject: [PATCH 0310/1750] xen: reset legacy rtc flag for PV domU

commit f68aa100d815b5b4467fd1c3abbe3b99d65fd028 upstream.

A Xen PV guest doesn't have a legacy RTC device, so reset the legacy
RTC flag. Otherwise the following WARN splat will occur at boot:

[    1.333404] WARNING: CPU: 1 PID: 1 at /home/gross/linux/head/drivers/rtc/rtc-mc146818-lib.c:25 mc146818_get_time+0x1be/0x210
[    1.333404] Modules linked in:
[    1.333404] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G        W         5.14.0-rc7-default+ #282
[    1.333404] RIP: e030:mc146818_get_time+0x1be/0x210
[    1.333404] Code: c0 64 01 c5 83 fd 45 89 6b 14 7f 06 83 c5 64 89 6b 14 41 83 ec 01 b8 02 00 00 00 44 89 63 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 <0f> 0b 48 c7 c7 30 0e ef 82 4c 89 e6 e8 71 2a 24 00 48 c7 c0 ff ff
[    1.333404] RSP: e02b:ffffc90040093df8 EFLAGS: 00010002
[    1.333404] RAX: 00000000000000ff RBX: ffffc90040093e34 RCX: 0000000000000000
[    1.333404] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000d
[    1.333404] RBP: ffffffff82ef0e30 R08: ffff888005013e60 R09: 0000000000000000
[    1.333404] R10: ffffffff82373e9b R11: 0000000000033080 R12: 0000000000000200
[    1.333404] R13: 0000000000000000 R14: 0000000000000002 R15: ffffffff82cdc6d4
[    1.333404] FS:  0000000000000000(0000) GS:ffff88807d440000(0000) knlGS:0000000000000000
[    1.333404] CS:  10000e030 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.333404] CR2: 0000000000000000 CR3: 000000000260a000 CR4: 0000000000050660
[    1.333404] Call Trace:
[    1.333404]  ? wakeup_sources_sysfs_init+0x30/0x30
[    1.333404]  ? rdinit_setup+0x2b/0x2b
[    1.333404]  early_resume_init+0x23/0xa4
[    1.333404]  ? cn_proc_init+0x36/0x36
[    1.333404]  do_one_initcall+0x3e/0x200
[    1.333404]  kernel_init_freeable+0x232/0x28e
[    1.333404]  ? rest_init+0xd0/0xd0
[    1.333404]  kernel_init+0x16/0x120
[    1.333404]  ret_from_fork+0x1f/0x30

Cc: <stable@vger.kernel.org>
Fixes: 8d152e7a5c7537 ("x86/rtc: Replace paravirt rtc check with platform legacy quirk")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/20210903084937.19392-3-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/xen/enlighten_pv.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index d3cdf467d91f..c758fd913ced 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -1204,6 +1204,11 @@ static void __init xen_dom0_set_legacy_features(void)
 	x86_platform.legacy.rtc = 1;
 }
 
+static void __init xen_domu_set_legacy_features(void)
+{
+	x86_platform.legacy.rtc = 0;
+}
+
 /* First C function to be called on Xen boot */
 asmlinkage __visible void __init xen_start_kernel(void)
 {
@@ -1356,6 +1361,8 @@ asmlinkage __visible void __init xen_start_kernel(void)
 		add_preferred_console("xenboot", 0, NULL);
 		if (pci_xen)
 			x86_init.pci.arch_init = pci_xen_init;
+		x86_platform.set_legacy_features =
+				xen_domu_set_legacy_features;
 	} else {
 		const struct dom0_vga_console_info *info =
 			(void *)((char *)xen_start_info +

From 84da60070c36ddcd8bf4a576e637be8e86535ede Mon Sep 17 00:00:00 2001
From: Adrian Bunk <bunk@kernel.org>
Date: Sun, 12 Sep 2021 22:05:23 +0300
Subject: [PATCH 0311/1750] bnx2x: Fix enabling network interfaces without VFs

commit 52ce14c134a003fee03d8fc57442c05a55b53715 upstream.

This function is called to enable SR-IOV when available,
not enabling interfaces without VFs was a regression.

Fixes: 65161c35554f ("bnx2x: Fix missing error code in bnx2x_iov_init_one()")
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Reported-by: YunQiang Su <wzssyqa@gmail.com>
Tested-by: YunQiang Su <wzssyqa@gmail.com>
Cc: stable@vger.kernel.org
Acked-by: Shai Malin <smalin@marvell.com>
Link: https://lore.kernel.org/r/20210912190523.27991-1-bunk@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 9108b497b3c9..03eb0179ec00 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1225,7 +1225,7 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param,
 
 	/* SR-IOV capability was enabled but there are no VFs*/
 	if (iov->total == 0) {
-		err = -EINVAL;
+		err = 0;
 		goto failed;
 	}
 

From a67e7cdbc633076e5e54ae40d68581c55daea5b5 Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Thu, 9 Sep 2021 17:53:56 +0100
Subject: [PATCH 0312/1750] arm64/sve: Use correct size when reinitialising SVE
 state

commit e35ac9d0b56e9efefaeeb84b635ea26c2839ea86 upstream.

When we need a buffer for SVE register state we call sve_alloc() to make
sure that one is there. In order to avoid repeated allocations and frees
we keep the buffer around unless we change vector length and just memset()
it to ensure a clean register state. The function that deals with this
takes the task to operate on as an argument, however in the case where we
do a memset() we initialise using the SVE state size for the current task
rather than the task passed as an argument.

This is only an issue in the case where we are setting the register state
for a task via ptrace and the task being configured has a different vector
length to the task tracing it. In the case where the buffer is larger in
the traced process we will leak old state from the traced process to
itself, in the case where the buffer is smaller in the traced process we
will overflow the buffer and corrupt memory.

Fixes: bc0ee4760364 ("arm64/sve: Core task context handling")
Cc: <stable@vger.kernel.org> # 4.15.x
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20210909165356.10675-1-broonie@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kernel/fpsimd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 062b21f30f94..a9bbfb800ec2 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -510,7 +510,7 @@ size_t sve_state_size(struct task_struct const *task)
 void sve_alloc(struct task_struct *task)
 {
 	if (task->thread.sve_state) {
-		memset(task->thread.sve_state, 0, sve_state_size(current));
+		memset(task->thread.sve_state, 0, sve_state_size(task));
 		return;
 	}
 

From cd64b416aed2f152d89c25db2ebf4f05e16fc08d Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Fri, 3 Sep 2021 10:49:36 +0200
Subject: [PATCH 0313/1750] PM: base: power: don't try to use non-existing RTC
 for storing data

commit 0560204b360a332c321124dbc5cdfd3364533a74 upstream.

If there is no legacy RTC device, don't try to use it for storing trace
data across suspend/resume.

Cc: <stable@vger.kernel.org>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Rafael J. Wysocki <rafael@kernel.org>
Link: https://lore.kernel.org/r/20210903084937.19392-2-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/power/trace.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/base/power/trace.c b/drivers/base/power/trace.c
index a97f33d0c59f..94665037f4a3 100644
--- a/drivers/base/power/trace.c
+++ b/drivers/base/power/trace.c
@@ -13,6 +13,7 @@
 #include <linux/export.h>
 #include <linux/rtc.h>
 #include <linux/suspend.h>
+#include <linux/init.h>
 
 #include <linux/mc146818rtc.h>
 
@@ -165,6 +166,9 @@ void generate_pm_trace(const void *tracedata, unsigned int user)
 	const char *file = *(const char **)(tracedata + 2);
 	unsigned int user_hash_value, file_hash_value;
 
+	if (!x86_platform.legacy.rtc)
+		return;
+
 	user_hash_value = user % USERHASH;
 	file_hash_value = hash_string(lineno, file, FILEHASH);
 	set_magic_time(user_hash_value, file_hash_value, dev_hash_value);
@@ -267,6 +271,9 @@ static struct notifier_block pm_trace_nb = {
 
 static int __init early_resume_init(void)
 {
+	if (!x86_platform.legacy.rtc)
+		return 0;
+
 	hash_value_early_read = read_magic_time();
 	register_pm_notifier(&pm_trace_nb);
 	return 0;
@@ -277,6 +284,9 @@ static int __init late_resume_init(void)
 	unsigned int val = hash_value_early_read;
 	unsigned int user, file, dev;
 
+	if (!x86_platform.legacy.rtc)
+		return 0;
+
 	user = val % USERHASH;
 	val = val / USERHASH;
 	file = val % FILEHASH;

From 87f7032dc2276cec3317c01d626c86093353f39e Mon Sep 17 00:00:00 2001
From: Evan Quan <evan.quan@amd.com>
Date: Fri, 3 Sep 2021 14:33:11 +0800
Subject: [PATCH 0314/1750] PCI: Add AMD GPU multi-function power dependencies

commit 60b78ed088ebe1a872ee1320b6c5ad6ee2c4bd9a upstream.

Some AMD GPUs have built-in USB xHCI and USB Type-C UCSI controllers with
power dependencies between the GPU and the other functions as in
6d2e369f0d4c ("PCI: Add NVIDIA GPU multi-function power dependencies").

Add device link support for the AMD integrated USB xHCI and USB Type-C UCSI
controllers.

Without this, runtime power management, including GPU resume and temp and
fan sensors don't work correctly.

Reported-at: https://gitlab.freedesktop.org/drm/amd/-/issues/1704
Link: https://lore.kernel.org/r/20210903063311.3606226-1-evan.quan@amd.com
Signed-off-by: Evan Quan <evan.quan@amd.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index bad294c35251..8dac8dcc02c6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5346,7 +5346,7 @@ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
 			      PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, quirk_gpu_hda);
 
 /*
- * Create device link for NVIDIA GPU with integrated USB xHCI Host
+ * Create device link for GPUs with integrated USB xHCI Host
  * controller to VGA.
  */
 static void quirk_gpu_usb(struct pci_dev *usb)
@@ -5355,9 +5355,11 @@ static void quirk_gpu_usb(struct pci_dev *usb)
 }
 DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
 			      PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb);
+DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
+			      PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb);
 
 /*
- * Create device link for NVIDIA GPU with integrated Type-C UCSI controller
+ * Create device link for GPUs with integrated Type-C UCSI controller
  * to VGA. Currently there is no class code defined for UCSI device over PCI
  * so using UNKNOWN class for now and it will be updated when UCSI
  * over PCI gets a class code.
@@ -5370,6 +5372,9 @@ static void quirk_gpu_usb_typec_ucsi(struct pci_dev *ucsi)
 DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
 			      PCI_CLASS_SERIAL_UNKNOWN, 8,
 			      quirk_gpu_usb_typec_ucsi);
+DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID,
+			      PCI_CLASS_SERIAL_UNKNOWN, 8,
+			      quirk_gpu_usb_typec_ucsi);
 
 /*
  * Enable the NVIDIA GPU integrated HDA controller if the BIOS left it

From 8f95553f0016c3994d9c022b5af4a1a433d6714e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ernst=20Sj=C3=B6strand?= <ernstp@gmail.com>
Date: Thu, 2 Sep 2021 09:50:27 +0200
Subject: [PATCH 0315/1750] drm/amd/amdgpu: Increase HWIP_MAX_INSTANCE to 10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 67a44e659888569a133a8f858c8230e9d7aad1d5 upstream.

Seems like newer cards can have even more instances now.
Found by UBSAN: array-index-out-of-bounds in
drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:318:29
index 8 is out of range for type 'uint32_t *[8]'

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1697
Cc: stable@vger.kernel.org
Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 76c31aa7b84d..d949d6c52f24 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -717,7 +717,7 @@ enum amd_hw_ip_block_type {
 	MAX_HWIP
 };
 
-#define HWIP_MAX_INSTANCE	8
+#define HWIP_MAX_INSTANCE	10
 
 struct amd_powerplay {
 	void *pp_handle;

From 0759f648470b5713b0ed89353607a8e0cd3f395e Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:23 +0200
Subject: [PATCH 0316/1750] drm/etnaviv: return context from
 etnaviv_iommu_context_get

commit 78edefc05e41352099ffb8f06f8d9b2d091e29cd upstream.

Being able to have the refcount manipulation in an assignment makes
it much easier to parse the code.

Cc: stable@vger.kernel.org # 5.4
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_buffer.c     | 3 +--
 drivers/gpu/drm/etnaviv/etnaviv_gem.c        | 3 +--
 drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 3 +--
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c        | 6 ++----
 drivers/gpu/drm/etnaviv/etnaviv_mmu.h        | 4 +++-
 5 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
index 76d38561c910..cf741c5c82d2 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
@@ -397,8 +397,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
 		if (switch_mmu_context) {
 			struct etnaviv_iommu_context *old_context = gpu->mmu_context;
 
-			etnaviv_iommu_context_get(mmu_context);
-			gpu->mmu_context = mmu_context;
+			gpu->mmu_context = etnaviv_iommu_context_get(mmu_context);
 			etnaviv_iommu_context_put(old_context);
 		}
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
index 2b7e85318a76..424474041c94 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
@@ -305,8 +305,7 @@ struct etnaviv_vram_mapping *etnaviv_gem_mapping_get(
 		list_del(&mapping->obj_node);
 	}
 
-	etnaviv_iommu_context_get(mmu_context);
-	mapping->context = mmu_context;
+	mapping->context = etnaviv_iommu_context_get(mmu_context);
 	mapping->use = 1;
 
 	ret = etnaviv_iommu_map_gem(mmu_context, etnaviv_obj,
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index d05c35994579..5f24cc52c287 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -532,8 +532,7 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data,
 		goto err_submit_objects;
 
 	submit->ctx = file->driver_priv;
-	etnaviv_iommu_context_get(submit->ctx->mmu);
-	submit->mmu_context = submit->ctx->mmu;
+	submit->mmu_context = etnaviv_iommu_context_get(submit->ctx->mmu);
 	submit->exec_state = args->exec_state;
 	submit->flags = args->flags;
 
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index c6404b8d067f..8fd64fd4a891 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1353,12 +1353,10 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
 	}
 
 	if (!gpu->mmu_context) {
-		etnaviv_iommu_context_get(submit->mmu_context);
-		gpu->mmu_context = submit->mmu_context;
+		gpu->mmu_context = etnaviv_iommu_context_get(submit->mmu_context);
 		etnaviv_gpu_start_fe_idleloop(gpu);
 	} else {
-		etnaviv_iommu_context_get(gpu->mmu_context);
-		submit->prev_mmu_context = gpu->mmu_context;
+		submit->prev_mmu_context = etnaviv_iommu_context_get(gpu->mmu_context);
 	}
 
 	if (submit->nr_pmrs) {
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.h b/drivers/gpu/drm/etnaviv/etnaviv_mmu.h
index d1d6902fd13b..e4a0b7d09c2e 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.h
@@ -105,9 +105,11 @@ void etnaviv_iommu_dump(struct etnaviv_iommu_context *ctx, void *buf);
 struct etnaviv_iommu_context *
 etnaviv_iommu_context_init(struct etnaviv_iommu_global *global,
 			   struct etnaviv_cmdbuf_suballoc *suballoc);
-static inline void etnaviv_iommu_context_get(struct etnaviv_iommu_context *ctx)
+static inline struct etnaviv_iommu_context *
+etnaviv_iommu_context_get(struct etnaviv_iommu_context *ctx)
 {
 	kref_get(&ctx->refcount);
+	return ctx;
 }
 void etnaviv_iommu_context_put(struct etnaviv_iommu_context *ctx);
 void etnaviv_iommu_restore(struct etnaviv_gpu *gpu,

From cf24bd826e4b4c99b2f183a2cc605b0ae641420a Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:24 +0200
Subject: [PATCH 0317/1750] drm/etnaviv: put submit prev MMU context when it
 exists

commit cda7532916f7bc860b36a1806cb8352e6f63dacb upstream.

The prev context is the MMU context at the time of the job
queueing in hardware. As a job might be queued multiple times
due to recovery after a GPU hang, we need to make sure to put
the stale prev MMU context from a prior queuing, to avoid the
reference and thus the MMU context leaking.

Cc: stable@vger.kernel.org # 5.4
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 8fd64fd4a891..81cc05d6ad59 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1356,6 +1356,8 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
 		gpu->mmu_context = etnaviv_iommu_context_get(submit->mmu_context);
 		etnaviv_gpu_start_fe_idleloop(gpu);
 	} else {
+		if (submit->prev_mmu_context)
+			etnaviv_iommu_context_put(submit->prev_mmu_context);
 		submit->prev_mmu_context = etnaviv_iommu_context_get(gpu->mmu_context);
 	}
 

From c63e6e0951ff4ab021947b834db37f591781ee28 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:25 +0200
Subject: [PATCH 0318/1750] drm/etnaviv: stop abusing mmu_context as FE running
 marker

commit 23e0f5a57d0ecec86e1fc82194acd94aede21a46 upstream.

While the DMA frontend can only be active when the MMU context is set, the
reverse isn't necessarily true, as the frontend can be stopped while the
MMU state is kept. Stop treating mmu_context being set as a indication that
the frontend is running and instead add a explicit property.

Cc: stable@vger.kernel.org # 5.4
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 10 ++++++++--
 drivers/gpu/drm/etnaviv/etnaviv_gpu.h |  1 +
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 81cc05d6ad59..f81b01623ce7 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -561,6 +561,8 @@ static int etnaviv_hw_reset(struct etnaviv_gpu *gpu)
 	/* We rely on the GPU running, so program the clock */
 	etnaviv_gpu_update_clock(gpu);
 
+	gpu->fe_running = false;
+
 	return 0;
 }
 
@@ -623,6 +625,8 @@ void etnaviv_gpu_start_fe(struct etnaviv_gpu *gpu, u32 address, u16 prefetch)
 			  VIVS_MMUv2_SEC_COMMAND_CONTROL_ENABLE |
 			  VIVS_MMUv2_SEC_COMMAND_CONTROL_PREFETCH(prefetch));
 	}
+
+	gpu->fe_running = true;
 }
 
 static void etnaviv_gpu_start_fe_idleloop(struct etnaviv_gpu *gpu)
@@ -1352,7 +1356,7 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
 		goto out_unlock;
 	}
 
-	if (!gpu->mmu_context) {
+	if (!gpu->fe_running) {
 		gpu->mmu_context = etnaviv_iommu_context_get(submit->mmu_context);
 		etnaviv_gpu_start_fe_idleloop(gpu);
 	} else {
@@ -1561,7 +1565,7 @@ int etnaviv_gpu_wait_idle(struct etnaviv_gpu *gpu, unsigned int timeout_ms)
 
 static int etnaviv_gpu_hw_suspend(struct etnaviv_gpu *gpu)
 {
-	if (gpu->initialized && gpu->mmu_context) {
+	if (gpu->initialized && gpu->fe_running) {
 		/* Replace the last WAIT with END */
 		mutex_lock(&gpu->lock);
 		etnaviv_buffer_end(gpu);
@@ -1576,6 +1580,8 @@ static int etnaviv_gpu_hw_suspend(struct etnaviv_gpu *gpu)
 
 		etnaviv_iommu_context_put(gpu->mmu_context);
 		gpu->mmu_context = NULL;
+
+		gpu->fe_running = false;
 	}
 
 	gpu->exec_state = -1;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
index 8ea48697d132..1c75c8ed5bce 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h
@@ -101,6 +101,7 @@ struct etnaviv_gpu {
 	struct workqueue_struct *wq;
 	struct drm_gpu_scheduler sched;
 	bool initialized;
+	bool fe_running;
 
 	/* 'ring'-buffer: */
 	struct etnaviv_cmdbuf buffer;

From 6b1c223d8a53a9b08f06c65d932eeb3278022ee8 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:26 +0200
Subject: [PATCH 0319/1750] drm/etnaviv: keep MMU context across runtime
 suspend/resume

commit 8f3eea9d01d7b0f95b0fe04187c0059019ada85b upstream.

The MMU state may be kept across a runtime suspend/resume cycle, as we
avoid a full hardware reset to keep the latency of the runtime PM small.

Don't pretend that the MMU state is lost in driver state. The MMU
context is pushed out when new HW jobs with a different context are
coming in. The only exception to this is when the GPU is unbound, in
which case we need to make sure to also free the last active context.

Cc: stable@vger.kernel.org # 5.4
Reported-by: Michael Walle <michael@walle.cc>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index f81b01623ce7..06d1eb27d6e4 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1578,9 +1578,6 @@ static int etnaviv_gpu_hw_suspend(struct etnaviv_gpu *gpu)
 		 */
 		etnaviv_gpu_wait_idle(gpu, 100);
 
-		etnaviv_iommu_context_put(gpu->mmu_context);
-		gpu->mmu_context = NULL;
-
 		gpu->fe_running = false;
 	}
 
@@ -1729,6 +1726,9 @@ static void etnaviv_gpu_unbind(struct device *dev, struct device *master,
 	etnaviv_gpu_hw_suspend(gpu);
 #endif
 
+	if (gpu->mmu_context)
+		etnaviv_iommu_context_put(gpu->mmu_context);
+
 	if (gpu->initialized) {
 		etnaviv_cmdbuf_free(&gpu->buffer);
 		etnaviv_iommu_global_fini(gpu);

From 22163efedcf303e7d1b73bb3bd3aee26bd41b888 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:27 +0200
Subject: [PATCH 0320/1750] drm/etnaviv: exec and MMU state is lost when
 resetting the GPU

commit 725cbc7884c37f3b4f1777bc1aea6432cded8ca5 upstream.

When the GPU is reset both the current exec state, as well as all MMU
state is lost. Move the driver side state tracking into the reset function
to keep hardware and software state from diverging.

Cc: stable@vger.kernel.org # 5.4
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 06d1eb27d6e4..d31eaec617d9 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -562,6 +562,8 @@ static int etnaviv_hw_reset(struct etnaviv_gpu *gpu)
 	etnaviv_gpu_update_clock(gpu);
 
 	gpu->fe_running = false;
+	gpu->exec_state = -1;
+	gpu->mmu_context = NULL;
 
 	return 0;
 }
@@ -818,7 +820,6 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
 	/* Now program the hardware */
 	mutex_lock(&gpu->lock);
 	etnaviv_gpu_hw_init(gpu);
-	gpu->exec_state = -1;
 	mutex_unlock(&gpu->lock);
 
 	pm_runtime_mark_last_busy(gpu->dev);
@@ -1043,8 +1044,6 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu)
 	spin_unlock(&gpu->event_spinlock);
 
 	etnaviv_gpu_hw_init(gpu);
-	gpu->exec_state = -1;
-	gpu->mmu_context = NULL;
 
 	mutex_unlock(&gpu->lock);
 	pm_runtime_mark_last_busy(gpu->dev);

From 660dfbf208a4bf3eaab8560e8671be831b52e1c1 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:28 +0200
Subject: [PATCH 0321/1750] drm/etnaviv: fix MMU context leak on GPU reset

commit f978a5302f5566480c58ffae64a16d34456801bd upstream.

After a reset the GPU is no longer using the MMU context and may be
restarted with a different context. While the mmu_state proeprly was
cleared, the context wasn't unreferenced, leading to a memory leak.

Cc: stable@vger.kernel.org # 5.4
Reported-by: Michael Walle <michael@walle.cc>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index d31eaec617d9..79c9dd2274da 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -563,6 +563,8 @@ static int etnaviv_hw_reset(struct etnaviv_gpu *gpu)
 
 	gpu->fe_running = false;
 	gpu->exec_state = -1;
+	if (gpu->mmu_context)
+		etnaviv_iommu_context_put(gpu->mmu_context);
 	gpu->mmu_context = NULL;
 
 	return 0;

From ea995e8a629446c4a27e7f8042fc08e05659298b Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:29 +0200
Subject: [PATCH 0322/1750] drm/etnaviv: reference MMU context when setting up
 hardware state

commit d6408538f091fb22d47f792d4efa58143d56c3fb upstream.

Move the refcount manipulation of the MMU context to the point where the
hardware state is programmed. At that point it is also known if a previous
MMU state is still there, or the state needs to be reprogrammed with a
potentially different context.

Cc: stable@vger.kernel.org # 5.4
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c      | 24 +++++++++++-----------
 drivers/gpu/drm/etnaviv/etnaviv_iommu.c    |  4 ++++
 drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c |  8 ++++++++
 3 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 79c9dd2274da..2520b7dad6ce 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -633,17 +633,19 @@ void etnaviv_gpu_start_fe(struct etnaviv_gpu *gpu, u32 address, u16 prefetch)
 	gpu->fe_running = true;
 }
 
-static void etnaviv_gpu_start_fe_idleloop(struct etnaviv_gpu *gpu)
+static void etnaviv_gpu_start_fe_idleloop(struct etnaviv_gpu *gpu,
+					  struct etnaviv_iommu_context *context)
 {
-	u32 address = etnaviv_cmdbuf_get_va(&gpu->buffer,
-				&gpu->mmu_context->cmdbuf_mapping);
 	u16 prefetch;
+	u32 address;
 
 	/* setup the MMU */
-	etnaviv_iommu_restore(gpu, gpu->mmu_context);
+	etnaviv_iommu_restore(gpu, context);
 
 	/* Start command processor */
 	prefetch = etnaviv_buffer_init(gpu);
+	address = etnaviv_cmdbuf_get_va(&gpu->buffer,
+					&gpu->mmu_context->cmdbuf_mapping);
 
 	etnaviv_gpu_start_fe(gpu, address, prefetch);
 }
@@ -1357,14 +1359,12 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit)
 		goto out_unlock;
 	}
 
-	if (!gpu->fe_running) {
-		gpu->mmu_context = etnaviv_iommu_context_get(submit->mmu_context);
-		etnaviv_gpu_start_fe_idleloop(gpu);
-	} else {
-		if (submit->prev_mmu_context)
-			etnaviv_iommu_context_put(submit->prev_mmu_context);
-		submit->prev_mmu_context = etnaviv_iommu_context_get(gpu->mmu_context);
-	}
+	if (!gpu->fe_running)
+		etnaviv_gpu_start_fe_idleloop(gpu, submit->mmu_context);
+
+	if (submit->prev_mmu_context)
+		etnaviv_iommu_context_put(submit->prev_mmu_context);
+	submit->prev_mmu_context = etnaviv_iommu_context_get(gpu->mmu_context);
 
 	if (submit->nr_pmrs) {
 		gpu->event[event[1]].sync_point = &sync_point_perfmon_sample_pre;
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_iommu.c b/drivers/gpu/drm/etnaviv/etnaviv_iommu.c
index 1a7c89a67bea..afe5dd6a9925 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_iommu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_iommu.c
@@ -92,6 +92,10 @@ static void etnaviv_iommuv1_restore(struct etnaviv_gpu *gpu,
 	struct etnaviv_iommuv1_context *v1_context = to_v1_context(context);
 	u32 pgtable;
 
+	if (gpu->mmu_context)
+		etnaviv_iommu_context_put(gpu->mmu_context);
+	gpu->mmu_context = etnaviv_iommu_context_get(context);
+
 	/* set base addresses */
 	gpu_write(gpu, VIVS_MC_MEMORY_BASE_ADDR_RA, context->global->memory_base);
 	gpu_write(gpu, VIVS_MC_MEMORY_BASE_ADDR_FE, context->global->memory_base);
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
index f8bf488e9d71..d664ae29ae20 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c
@@ -172,6 +172,10 @@ static void etnaviv_iommuv2_restore_nonsec(struct etnaviv_gpu *gpu,
 	if (gpu_read(gpu, VIVS_MMUv2_CONTROL) & VIVS_MMUv2_CONTROL_ENABLE)
 		return;
 
+	if (gpu->mmu_context)
+		etnaviv_iommu_context_put(gpu->mmu_context);
+	gpu->mmu_context = etnaviv_iommu_context_get(context);
+
 	prefetch = etnaviv_buffer_config_mmuv2(gpu,
 				(u32)v2_context->mtlb_dma,
 				(u32)context->global->bad_page_dma);
@@ -192,6 +196,10 @@ static void etnaviv_iommuv2_restore_sec(struct etnaviv_gpu *gpu,
 	if (gpu_read(gpu, VIVS_MMUv2_SEC_CONTROL) & VIVS_MMUv2_SEC_CONTROL_ENABLE)
 		return;
 
+	if (gpu->mmu_context)
+		etnaviv_iommu_context_put(gpu->mmu_context);
+	gpu->mmu_context = etnaviv_iommu_context_get(context);
+
 	gpu_write(gpu, VIVS_MMUv2_PTA_ADDRESS_LOW,
 		  lower_32_bits(context->global->v2.pta_dma));
 	gpu_write(gpu, VIVS_MMUv2_PTA_ADDRESS_HIGH,

From cc9d96c9f9e009b8a33385fab9b78ccf92e51d6e Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Fri, 20 Aug 2021 22:18:30 +0200
Subject: [PATCH 0323/1750] drm/etnaviv: add missing MMU context put when
 reaping MMU mapping

commit f2faea8b64125852fa9acc6771c07fc0311a039b upstream.

When we forcefully evict a mapping from the the address space and thus the
MMU context, the MMU context is leaked, as the mapping no longer points to
it, so it doesn't get freed when the GEM object is destroyed. Add the
mssing context put to fix the leak.

Cc: stable@vger.kernel.org # 5.4
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Michael Walle <michael@walle.cc>
Tested-by: Marek Vasut <marex@denx.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
index 15d9fa3879e5..984569a59a90 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
@@ -197,6 +197,7 @@ static int etnaviv_iommu_find_iova(struct etnaviv_iommu_context *context,
 		 */
 		list_for_each_entry_safe(m, n, &list, scan_node) {
 			etnaviv_iommu_remove_mapping(context, m);
+			etnaviv_iommu_context_put(m->context);
 			m->context = NULL;
 			list_del_init(&m->mmu_node);
 			list_del_init(&m->scan_node);

From 0346f8a2c5ecef2fea9932ebeb447c0d957f749a Mon Sep 17 00:00:00 2001
From: Alexander Egorenkov <egorenar@linux.ibm.com>
Date: Thu, 9 Sep 2021 12:20:56 +0200
Subject: [PATCH 0324/1750] s390/sclp: fix Secure-IPL facility detection

commit d76b14f3971a0638b6cd0da289f8b48acee287d0 upstream.

Prevent out-of-range access if the returned SCLP SCCB response is smaller
in size than the address of the Secure-IPL flag.

Fixes: c9896acc7851 ("s390/ipl: Provide has_secure sysfs attribute")
Cc: stable@vger.kernel.org # 5.2+
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/char/sclp_early.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
index cc5e84b80c69..faa3a4b8ed91 100644
--- a/drivers/s390/char/sclp_early.c
+++ b/drivers/s390/char/sclp_early.c
@@ -40,13 +40,14 @@ static void __init sclp_early_facilities_detect(struct read_info_sccb *sccb)
 	sclp.has_gisaf = !!(sccb->fac118 & 0x08);
 	sclp.has_hvs = !!(sccb->fac119 & 0x80);
 	sclp.has_kss = !!(sccb->fac98 & 0x01);
-	sclp.has_sipl = !!(sccb->cbl & 0x4000);
 	if (sccb->fac85 & 0x02)
 		S390_lowcore.machine_flags |= MACHINE_FLAG_ESOP;
 	if (sccb->fac91 & 0x40)
 		S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_GUEST;
 	if (sccb->cpuoff > 134)
 		sclp.has_diag318 = !!(sccb->byte_134 & 0x80);
+	if (sccb->cpuoff > 137)
+		sclp.has_sipl = !!(sccb->cbl & 0x4000);
 	sclp.rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;
 	sclp.rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;
 	sclp.rzm <<= 20;

From 6672dc68e28eca6ba8ffc2809db4cdd8f0cc5d12 Mon Sep 17 00:00:00 2001
From: Jeff Moyer <jmoyer@redhat.com>
Date: Wed, 11 Aug 2021 17:07:37 -0400
Subject: [PATCH 0325/1750] x86/pat: Pass valid address to sanitize_phys()

commit aeef8b5089b76852bd84889f2809e69a7cfb414e upstream.

The end address passed to memtype_reserve() is handed directly to
sanitize_phys().  However, end is exclusive and sanitize_phys() expects
an inclusive address.  If end falls at the end of the physical address
space, sanitize_phys() will return 0.  This can result in drivers
failing to load, and the following warning:

 WARNING: CPU: 26 PID: 749 at arch/x86/mm/pat.c:354 reserve_memtype+0x262/0x450
 reserve_memtype failed: [mem 0x3ffffff00000-0xffffffffffffffff], req uncached-minus
 Call Trace:
  [<ffffffffa427b1f2>] reserve_memtype+0x262/0x450
  [<ffffffffa42764aa>] ioremap_nocache+0x1a/0x20
  [<ffffffffc04620a1>] mpt3sas_base_map_resources+0x151/0xa60 [mpt3sas]
  [<ffffffffc0465555>] mpt3sas_base_attach+0xf5/0xa50 [mpt3sas]
 ---[ end trace 6d6eea4438db89ef ]---
 ioremap reserve_memtype failed -22
 mpt3sas_cm0: unable to map adapter memory! or resource not found
 mpt3sas_cm0: failure at drivers/scsi/mpt3sas/mpt3sas_scsih.c:10597/_scsih_probe()!

Fix this by passing the inclusive end address to sanitize_phys().

Fixes: 510ee090abc3 ("x86/mm/pat: Prepare {reserve, free}_memtype() for "decoy" addresses")
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/x49o8a3pu5i.fsf@segfault.boston.devel.redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/pat/memtype.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/pat/memtype.c b/arch/x86/mm/pat/memtype.c
index ca311aaa67b8..232932bda4e5 100644
--- a/arch/x86/mm/pat/memtype.c
+++ b/arch/x86/mm/pat/memtype.c
@@ -583,7 +583,12 @@ int memtype_reserve(u64 start, u64 end, enum page_cache_mode req_type,
 	int err = 0;
 
 	start = sanitize_phys(start);
-	end = sanitize_phys(end);
+
+	/*
+	 * The end address passed into this function is exclusive, but
+	 * sanitize_phys() expects an inclusive address.
+	 */
+	end = sanitize_phys(end - 1) + 1;
 	if (start >= end) {
 		WARN(1, "%s failed: [mem %#010Lx-%#010Lx], req %s\n", __func__,
 				start, end - 1, cattr_name(req_type));

From 12551b75b00b8d1de3a944ab44c997bee7c9bce0 Mon Sep 17 00:00:00 2001
From: Mike Rapoport <rppt@linux.ibm.com>
Date: Thu, 19 Aug 2021 16:27:17 +0300
Subject: [PATCH 0326/1750] x86/mm: Fix kern_addr_valid() to cope with existing
 but not present entries

commit 34b1999da935a33be6239226bfa6cd4f704c5c88 upstream.

Jiri Olsa reported a fault when running:

  # cat /proc/kallsyms | grep ksys_read
  ffffffff8136d580 T ksys_read
  # objdump -d --start-address=0xffffffff8136d580 --stop-address=0xffffffff8136d590 /proc/kcore

  /proc/kcore:     file format elf64-x86-64

  Segmentation fault

  general protection fault, probably for non-canonical address 0xf887ffcbff000: 0000 [#1] SMP PTI
  CPU: 12 PID: 1079 Comm: objdump Not tainted 5.14.0-rc5qemu+ #508
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014
  RIP: 0010:kern_addr_valid
  Call Trace:
   read_kcore
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? trace_hardirqs_on
   ? rcu_read_lock_sched_held
   ? lock_acquire
   ? lock_acquire
   ? rcu_read_lock_sched_held
   ? lock_acquire
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? rcu_read_lock_sched_held
   ? lock_release
   ? _raw_spin_unlock
   ? __handle_mm_fault
   ? rcu_read_lock_sched_held
   ? lock_acquire
   ? rcu_read_lock_sched_held
   ? lock_release
   proc_reg_read
   ? vfs_read
   vfs_read
   ksys_read
   do_syscall_64
   entry_SYSCALL_64_after_hwframe

The fault happens because kern_addr_valid() dereferences existent but not
present PMD in the high kernel mappings.

Such PMDs are created when free_kernel_image_pages() frees regions larger
than 2Mb. In this case, a part of the freed memory is mapped with PMDs and
the set_memory_np_noalias() -> ... -> __change_page_attr() sequence will
mark the PMD as not present rather than wipe it completely.

Have kern_addr_valid() check whether higher level page table entries are
present before trying to dereference them to fix this issue and to avoid
similar issues in the future.

Stable backporting note:
------------------------

Note that the stable marking is for all active stable branches because
there could be cases where pagetable entries exist but are not valid -
see 9a14aefc1d28 ("x86: cpa, fix lookup_address"), for example. So make
sure to be on the safe side here and use pXY_present() accessors rather
than pXY_none() which could #GP when accessing pages in the direct map.

Also see:

  c40a56a7818c ("x86/mm/init: Remove freed kernel image areas from alias mapping")

for more info.

Reported-by: Jiri Olsa <jolsa@redhat.com>
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Dave Hansen <dave.hansen@intel.com>
Tested-by: Jiri Olsa <jolsa@redhat.com>
Cc: <stable@vger.kernel.org>	# 4.4+
Link: https://lkml.kernel.org/r/20210819132717.19358-1-rppt@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/init_64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index b5a3fa4033d3..067ca92e69ef 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1389,18 +1389,18 @@ int kern_addr_valid(unsigned long addr)
 		return 0;
 
 	p4d = p4d_offset(pgd, addr);
-	if (p4d_none(*p4d))
+	if (!p4d_present(*p4d))
 		return 0;
 
 	pud = pud_offset(p4d, addr);
-	if (pud_none(*pud))
+	if (!pud_present(*pud))
 		return 0;
 
 	if (pud_large(*pud))
 		return pfn_valid(pud_pfn(*pud));
 
 	pmd = pmd_offset(pud, addr);
-	if (pmd_none(*pmd))
+	if (!pmd_present(*pmd))
 		return 0;
 
 	if (pmd_large(*pmd))

From ee3ffd56b40ea6e5128502d03b49ffb53a09c7f6 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Fri, 23 Jul 2021 13:25:36 -0400
Subject: [PATCH 0327/1750] tipc: fix an use-after-free issue in tipc_recvmsg

commit cc19862ffe454a5b632ca202e5a51bfec9f89fd2 upstream.

syzbot reported an use-after-free crash:

  BUG: KASAN: use-after-free in tipc_recvmsg+0xf77/0xf90 net/tipc/socket.c:1979
  Call Trace:
   tipc_recvmsg+0xf77/0xf90 net/tipc/socket.c:1979
   sock_recvmsg_nosec net/socket.c:943 [inline]
   sock_recvmsg net/socket.c:961 [inline]
   sock_recvmsg+0xca/0x110 net/socket.c:957
   tipc_conn_rcv_from_sock+0x162/0x2f0 net/tipc/topsrv.c:398
   tipc_conn_recv_work+0xeb/0x190 net/tipc/topsrv.c:421
   process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
   worker_thread+0x658/0x11f0 kernel/workqueue.c:2422

As Hoang pointed out, it was caused by skb_cb->bytes_read still accessed
after calling tsk_advance_rx_queue() to free the skb in tipc_recvmsg().

This patch is to fix it by accessing skb_cb->bytes_read earlier than
calling tsk_advance_rx_queue().

Fixes: f4919ff59c28 ("tipc: keep the skb in rcv queue until the whole data is read")
Reported-by: syzbot+e6741b97d5552f97c24d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/socket.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 963047c57c27..91230eecb7a8 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1980,10 +1980,12 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m,
 		tipc_node_distr_xmit(sock_net(sk), &xmitq);
 	}
 
-	if (!skb_cb->bytes_read)
-		tsk_advance_rx_queue(sk);
+	if (skb_cb->bytes_read)
+		goto exit;
 
-	if (likely(!connected) || skb_cb->bytes_read)
+	tsk_advance_rx_queue(sk);
+
+	if (likely(!connected))
 		goto exit;
 
 	/* Send connection flow control advertisement when applicable */

From c5c9ee2d367bf4e9939e2888e20999b932c545e9 Mon Sep 17 00:00:00 2001
From: Saeed Mahameed <saeedm@nvidia.com>
Date: Mon, 26 Jul 2021 15:15:39 -0700
Subject: [PATCH 0328/1750] ethtool: Fix rxnfc copy to user buffer overflow

commit 9b29a161ef38040f000dcf9ccf78e34495edfd55 upstream.

In the cited commit, copy_to_user() got called with the wrong pointer,
instead of passing the actual buffer ptr to copy from, a pointer to
the pointer got passed, which causes a buffer overflow calltrace to pop
up when executing "ethtool -x ethX".

Fix ethtool_rxnfc_copy_to_user() to use the rxnfc pointer as passed
to the function, instead of a pointer to it.

This fixes below call trace:
[   15.533533] ------------[ cut here ]------------
[   15.539007] Buffer overflow detected (8 < 192)!
[   15.544110] WARNING: CPU: 3 PID: 1801 at include/linux/thread_info.h:200 copy_overflow+0x15/0x20
[   15.549308] Modules linked in:
[   15.551449] CPU: 3 PID: 1801 Comm: ethtool Not tainted 5.14.0-rc2+ #1058
[   15.553919] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[   15.558378] RIP: 0010:copy_overflow+0x15/0x20
[   15.560648] Code: e9 7c ff ff ff b8 a1 ff ff ff eb c4 66 0f 1f 84 00 00 00 00 00 55 48 89 f2 89 fe 48 c7 c7 88 55 78 8a 48 89 e5 e8 06 5c 1e 00 <0f> 0b 5d c3 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 55
[   15.565114] RSP: 0018:ffffad49c0523bd0 EFLAGS: 00010286
[   15.566231] RAX: 0000000000000000 RBX: 00000000000000c0 RCX: 0000000000000000
[   15.567616] RDX: 0000000000000001 RSI: ffffffff8a7912e7 RDI: 00000000ffffffff
[   15.569050] RBP: ffffad49c0523bd0 R08: ffffffff8ab2ae28 R09: 00000000ffffdfff
[   15.570534] R10: ffffffff8aa4ae40 R11: ffffffff8aa4ae40 R12: 0000000000000000
[   15.571899] R13: 00007ffd4cc2a230 R14: ffffad49c0523c00 R15: 0000000000000000
[   15.573584] FS:  00007f538112f740(0000) GS:ffff96d5bdd80000(0000) knlGS:0000000000000000
[   15.575639] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   15.577092] CR2: 00007f5381226d40 CR3: 0000000013542000 CR4: 00000000001506e0
[   15.578929] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   15.580695] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   15.582441] Call Trace:
[   15.582970]  ethtool_rxnfc_copy_to_user+0x30/0x46
[   15.583815]  ethtool_get_rxnfc.cold+0x23/0x2b
[   15.584584]  dev_ethtool+0x29c/0x25f0
[   15.585286]  ? security_netlbl_sid_to_secattr+0x77/0xd0
[   15.586728]  ? do_set_pte+0xc4/0x110
[   15.587349]  ? _raw_spin_unlock+0x18/0x30
[   15.588118]  ? __might_sleep+0x49/0x80
[   15.588956]  dev_ioctl+0x2c1/0x490
[   15.589616]  sock_ioctl+0x18e/0x330
[   15.591143]  __x64_sys_ioctl+0x41c/0x990
[   15.591823]  ? irqentry_exit_to_user_mode+0x9/0x20
[   15.592657]  ? irqentry_exit+0x33/0x40
[   15.593308]  ? exc_page_fault+0x32f/0x770
[   15.593877]  ? exit_to_user_mode_prepare+0x3c/0x130
[   15.594775]  do_syscall_64+0x35/0x80
[   15.595397]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   15.596037] RIP: 0033:0x7f5381226d4b
[   15.596492] Code: 0f 1e fa 48 8b 05 3d b1 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 0d b1 0c 00 f7 d8 64 89 01 48
[   15.598743] RSP: 002b:00007ffd4cc2a1f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[   15.599804] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5381226d4b
[   15.600795] RDX: 00007ffd4cc2a350 RSI: 0000000000008946 RDI: 0000000000000003
[   15.601712] RBP: 00007ffd4cc2a340 R08: 00007ffd4cc2a350 R09: 0000000000000001
[   15.602751] R10: 00007f538128a990 R11: 0000000000000246 R12: 0000000000000000
[   15.603882] R13: 00007ffd4cc2a350 R14: 00007ffd4cc2a4b0 R15: 0000000000000000
[   15.605042] ---[ end trace 325cf185e2795048 ]---

Fixes: dd98d2895de6 ("ethtool: improve compat ioctl handling")
Reported-by: Shannon Nelson <snelson@pensando.io>
CC: Arnd Bergmann <arnd@arndb.de>
CC: Christoph Hellwig <hch@lst.de>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Tested-by: Shannon Nelson <snelson@pensando.io>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ethtool/ioctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c
index 97b402b2d6fb..80d2a00d3097 100644
--- a/net/ethtool/ioctl.c
+++ b/net/ethtool/ioctl.c
@@ -906,7 +906,7 @@ static int ethtool_rxnfc_copy_to_user(void __user *useraddr,
 						   rule_buf);
 		useraddr += offsetof(struct compat_ethtool_rxnfc, rule_locs);
 	} else {
-		ret = copy_to_user(useraddr, &rxnfc, size);
+		ret = copy_to_user(useraddr, rxnfc, size);
 		useraddr += offsetof(struct ethtool_rxnfc, rule_locs);
 	}
 

From 855c17ffa65fe61b1e3cc9164833496191dc61e1 Mon Sep 17 00:00:00 2001
From: Eli Cohen <elic@nvidia.com>
Date: Wed, 15 Sep 2021 07:47:27 +0300
Subject: [PATCH 0329/1750] net/{mlx5|nfp|bnxt}: Remove unnecessary RTNL lock
 assert

commit 7c3a0a018e672a9723a79b128227272562300055 upstream.

Remove the assert from the callback priv lookup function since it does
not require RTNL lock and is already protected by flow_indr_block_lock.

This will avoid warnings from being emitted to dmesg if the driver
registers its callback after an ingress qdisc was created for a
netdevice.

The warnings started after the following patch was merged:
commit 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation")

Signed-off-by: Eli Cohen <elic@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c        | 3 ---
 drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c | 3 ---
 drivers/net/ethernet/netronome/nfp/flower/offload.c | 3 ---
 3 files changed, 9 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index 5e4429b14b8c..2186706cf913 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -1870,9 +1870,6 @@ bnxt_tc_indr_block_cb_lookup(struct bnxt *bp, struct net_device *netdev)
 {
 	struct bnxt_flower_indr_block_cb_priv *cb_priv;
 
-	/* All callback list access should be protected by RTNL. */
-	ASSERT_RTNL();
-
 	list_for_each_entry(cb_priv, &bp->tc_indr_block_list, list)
 		if (cb_priv->tunnel_netdev == netdev)
 			return cb_priv;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
index e6f782743fbe..2fdea05eec1d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c
@@ -298,9 +298,6 @@ mlx5e_rep_indr_block_priv_lookup(struct mlx5e_rep_priv *rpriv,
 {
 	struct mlx5e_rep_indr_block_priv *cb_priv;
 
-	/* All callback list access should be protected by RTNL. */
-	ASSERT_RTNL();
-
 	list_for_each_entry(cb_priv,
 			    &rpriv->uplink_priv.tc_indr_block_priv_list,
 			    list)
diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c
index e95969c462e4..3f34e6da7295 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c
@@ -1732,9 +1732,6 @@ nfp_flower_indr_block_cb_priv_lookup(struct nfp_app *app,
 	struct nfp_flower_indr_block_cb_priv *cb_priv;
 	struct nfp_flower_priv *priv = app->priv;
 
-	/* All callback list access should be protected by RTNL. */
-	ASSERT_RTNL();
-
 	list_for_each_entry(cb_priv, &priv->indr_block_cb_priv, list)
 		if (cb_priv->netdev == netdev)
 			return cb_priv;

From bd6d9a0dd4111691542ef84db5847fcbdda35686 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 13 Sep 2021 11:08:36 -0700
Subject: [PATCH 0330/1750] net-caif: avoid user-triggerable WARN_ON(1)

commit 550ac9c1aaaaf51fd42e20d461f0b1cdbd55b3d2 upstream.

syszbot triggers this warning, which looks something
we can easily prevent.

If we initialize priv->list_field in chnl_net_init(),
then always use list_del_init(), we can remove robust_list_del()
completely.

WARNING: CPU: 0 PID: 3233 at net/caif/chnl_net.c:67 robust_list_del net/caif/chnl_net.c:67 [inline]
WARNING: CPU: 0 PID: 3233 at net/caif/chnl_net.c:67 chnl_net_uninit+0xc9/0x2e0 net/caif/chnl_net.c:375
Modules linked in:
CPU: 0 PID: 3233 Comm: syz-executor.3 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:robust_list_del net/caif/chnl_net.c:67 [inline]
RIP: 0010:chnl_net_uninit+0xc9/0x2e0 net/caif/chnl_net.c:375
Code: 89 eb e8 3a a3 ba f8 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 bf 01 00 00 48 81 fb 00 14 4e 8d 48 8b 2b 75 d0 e8 17 a3 ba f8 <0f> 0b 5b 5d 41 5c 41 5d e9 0a a3 ba f8 4c 89 e3 e8 02 a3 ba f8 4c
RSP: 0018:ffffc90009067248 EFLAGS: 00010202
RAX: 0000000000008780 RBX: ffffffff8d4e1400 RCX: ffffc9000fd34000
RDX: 0000000000040000 RSI: ffffffff88bb6e49 RDI: 0000000000000003
RBP: ffff88802cd9ee08 R08: 0000000000000000 R09: ffffffff8d0e6647
R10: ffffffff88bb6dc2 R11: 0000000000000000 R12: ffff88803791ae08
R13: dffffc0000000000 R14: 00000000e600ffce R15: ffff888073ed3480
FS:  00007fed10fa0700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2c322000 CR3: 00000000164a6000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 register_netdevice+0xadf/0x1500 net/core/dev.c:10347
 ipcaif_newlink+0x4c/0x260 net/caif/chnl_net.c:468
 __rtnl_newlink+0x106d/0x1750 net/core/rtnetlink.c:3458
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3506
 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 __sys_sendto+0x21c/0x320 net/socket.c:2036
 __do_sys_sendto net/socket.c:2048 [inline]
 __se_sys_sendto net/socket.c:2044 [inline]
 __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2044
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: cc36a070b590 ("net-caif: add CAIF netdevice")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/caif/chnl_net.c | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index 79b6a04d8eb6..42dc080a4dbb 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -53,20 +53,6 @@ struct chnl_net {
 	enum caif_states state;
 };
 
-static void robust_list_del(struct list_head *delete_node)
-{
-	struct list_head *list_node;
-	struct list_head *n;
-	ASSERT_RTNL();
-	list_for_each_safe(list_node, n, &chnl_net_list) {
-		if (list_node == delete_node) {
-			list_del(list_node);
-			return;
-		}
-	}
-	WARN_ON(1);
-}
-
 static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
 {
 	struct sk_buff *skb;
@@ -369,6 +355,7 @@ static int chnl_net_init(struct net_device *dev)
 	ASSERT_RTNL();
 	priv = netdev_priv(dev);
 	strncpy(priv->name, dev->name, sizeof(priv->name));
+	INIT_LIST_HEAD(&priv->list_field);
 	return 0;
 }
 
@@ -377,7 +364,7 @@ static void chnl_net_uninit(struct net_device *dev)
 	struct chnl_net *priv;
 	ASSERT_RTNL();
 	priv = netdev_priv(dev);
-	robust_list_del(&priv->list_field);
+	list_del_init(&priv->list_field);
 }
 
 static const struct net_device_ops netdev_ops = {
@@ -542,7 +529,7 @@ static void __exit chnl_exit_module(void)
 	rtnl_lock();
 	list_for_each_safe(list_node, _tmp, &chnl_net_list) {
 		dev = list_entry(list_node, struct chnl_net, list_field);
-		list_del(list_node);
+		list_del_init(list_node);
 		delete_device(dev);
 	}
 	rtnl_unlock();

From f6f80766558b72d59bd7a25519abc55c71c126c7 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Mon, 13 Sep 2021 15:06:05 -0700
Subject: [PATCH 0331/1750] ptp: dp83640: don't define PAGE0

commit 7366c23ff492ad260776a3ee1aaabba9fc773a8b upstream.

Building dp83640.c on arch/parisc/ produces a build warning for
PAGE0 being redefined. Since the macro is not used in the dp83640
driver, just make it a comment for documentation purposes.

In file included from ../drivers/net/phy/dp83640.c:23:
../drivers/net/phy/dp83640_reg.h:8: warning: "PAGE0" redefined
    8 | #define PAGE0                     0x0000
                 from ../drivers/net/phy/dp83640.c:11:
../arch/parisc/include/asm/page.h:187: note: this is the location of the previous definition
  187 | #define PAGE0   ((struct zeropage *)__PAGE_OFFSET)

Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Richard Cochran <richard.cochran@omicron.at>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Cc: Russell King <linux@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20210913220605.19682-1-rdunlap@infradead.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/dp83640_reg.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/dp83640_reg.h b/drivers/net/phy/dp83640_reg.h
index 21aa24c741b9..daae7fa58fb8 100644
--- a/drivers/net/phy/dp83640_reg.h
+++ b/drivers/net/phy/dp83640_reg.h
@@ -5,7 +5,7 @@
 #ifndef HAVE_DP83640_REGISTERS
 #define HAVE_DP83640_REGISTERS
 
-#define PAGE0                     0x0000
+/* #define PAGE0                  0x0000 */
 #define PHYCR2                    0x001c /* PHY Control Register 2 */
 
 #define PAGE4                     0x0004

From 6c3cb65d561e76fd0398026c023e587fec70e188 Mon Sep 17 00:00:00 2001
From: "Lin, Zhenpeng" <zplin@psu.edu>
Date: Wed, 8 Sep 2021 03:40:59 +0000
Subject: [PATCH 0332/1750] dccp: don't duplicate ccid when cloning dccp sock

commit d9ea761fdd197351890418acd462c51f241014a7 upstream.

Commit 2677d2067731 ("dccp: don't free ccid2_hc_tx_sock ...") fixed
a UAF but reintroduced CVE-2017-6074.

When the sock is cloned, two dccps_hc_tx_ccid will reference to the
same ccid. So one can free the ccid object twice from two socks after
cloning.

This issue was found by "Hadar Manor" as well and assigned with
CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port
the patch from Ubuntu to fix it.

The patch prevents cloned socks from referencing the same ccid.

Fixes: 2677d2067731410 ("dccp: don't free ccid2_hc_tx_sock ...")
Signed-off-by: Zhenpeng Lin <zplin@psu.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dccp/minisocks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index c5c74a34d139..91e7a2202697 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -94,6 +94,8 @@ struct sock *dccp_create_openreq_child(const struct sock *sk,
 		newdp->dccps_role	    = DCCP_ROLE_SERVER;
 		newdp->dccps_hc_rx_ackvec   = NULL;
 		newdp->dccps_service_list   = NULL;
+		newdp->dccps_hc_rx_ccid     = NULL;
+		newdp->dccps_hc_tx_ccid     = NULL;
 		newdp->dccps_service	    = dreq->dreq_service;
 		newdp->dccps_timestamp_echo = dreq->dreq_timestamp_echo;
 		newdp->dccps_timestamp_time = dreq->dreq_timestamp_time;

From edfab735d5182fbfe5b5773869304291aaa12be8 Mon Sep 17 00:00:00 2001
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Date: Thu, 9 Sep 2021 12:32:00 +0800
Subject: [PATCH 0333/1750] net/l2tp: Fix reference count leak in
 l2tp_udp_recv_core

commit 9b6ff7eb666415e1558f1ba8a742f5db6a9954de upstream.

The reference count leak issue may take place in an error handling
path. If both conditions of tunnel->version == L2TP_HDR_VER_3 and the
return value of l2tp_v3_ensure_opt_in_linear is nonzero, the function
would directly jump to label invalid, without decrementing the reference
count of the l2tp_session object session increased earlier by
l2tp_tunnel_get_session(). This may result in refcount leaks.

Fix this issue by decrease the reference count before jumping to the
label invalid.

Fixes: 4522a70db7aa ("l2tp: fix reading optional fields of L2TPv3")
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 203890e378cb..561b6d67ab8b 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -869,8 +869,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb)
 	}
 
 	if (tunnel->version == L2TP_HDR_VER_3 &&
-	    l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr))
+	    l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) {
+		l2tp_session_dec_refcount(session);
 		goto invalid;
+	}
 
 	l2tp_recv_common(session, skb, ptr, optr, hdrflags, length);
 	l2tp_session_dec_refcount(session);

From abe460eb6fbb7720010e82cf1e386ace87cec422 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Thu, 9 Sep 2021 10:33:28 -0700
Subject: [PATCH 0334/1750] r6040: Restore MDIO clock frequency after MAC reset

commit e3f0cc1a945fcefec0c7c9d9dfd028a51daa1846 upstream.

A number of users have reported that they were not able to get the PHY
to successfully link up, especially after commit c36757eb9dee ("net:
phy: consider AN_RESTART status when reading link status") where we
stopped reading just BMSR, but we also read BMCR to determine the link
status.

Andrius at NetBSD did a wonderful job at debugging the problem
and found out that the MDIO bus clock frequency would be incorrectly set
back to its default value which would prevent the MDIO bus controller
from reading PHY registers properly. Back when we only read BMSR, if we
read all 1s, we could falsely indicate a link status, though in general
there is a cable plugged in, so this went unnoticed. After a second read
of BMCR was added, a wrong read will lead to the inability to determine
a link UP condition which is when it started to be visibly broken, even
if it was long before that.

The fix consists in restoring the value of the MD_CSR register that was
set prior to the MAC reset.

Link: http://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=53494
Fixes: 90f750a81a29 ("r6040: consolidate MAC reset to its own function")
Reported-by: Andrius V <vezhlys@gmail.com>
Reported-by: Darek Strugacz <darek.strugacz@op.pl>
Tested-by: Darek Strugacz <darek.strugacz@op.pl>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/rdc/r6040.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/rdc/r6040.c b/drivers/net/ethernet/rdc/r6040.c
index 7c74318620b1..ccdfa930130b 100644
--- a/drivers/net/ethernet/rdc/r6040.c
+++ b/drivers/net/ethernet/rdc/r6040.c
@@ -119,6 +119,8 @@
 #define PHY_ST		0x8A	/* PHY status register */
 #define MAC_SM		0xAC	/* MAC status machine */
 #define  MAC_SM_RST	0x0002	/* MAC status machine reset */
+#define MD_CSC		0xb6	/* MDC speed control register */
+#define  MD_CSC_DEFAULT	0x0030
 #define MAC_ID		0xBE	/* Identifier register */
 
 #define TX_DCNT		0x80	/* TX descriptor count */
@@ -355,8 +357,9 @@ static void r6040_reset_mac(struct r6040_private *lp)
 {
 	void __iomem *ioaddr = lp->base;
 	int limit = MAC_DEF_TIMEOUT;
-	u16 cmd;
+	u16 cmd, md_csc;
 
+	md_csc = ioread16(ioaddr + MD_CSC);
 	iowrite16(MAC_RST, ioaddr + MCR1);
 	while (limit--) {
 		cmd = ioread16(ioaddr + MCR1);
@@ -368,6 +371,10 @@ static void r6040_reset_mac(struct r6040_private *lp)
 	iowrite16(MAC_SM_RST, ioaddr + MAC_SM);
 	iowrite16(0, ioaddr + MAC_SM);
 	mdelay(5);
+
+	/* Restore MDIO clock frequency */
+	if (md_csc != MD_CSC_DEFAULT)
+		iowrite16(md_csc, ioaddr + MD_CSC);
 }
 
 static void r6040_init_mac_regs(struct net_device *dev)

From fd9ed47fe6be437bccab7afb396a270b6c79e499 Mon Sep 17 00:00:00 2001
From: Hoang Le <hoang.h.le@dektech.com.au>
Date: Mon, 13 Sep 2021 16:28:52 +0700
Subject: [PATCH 0335/1750] tipc: increase timeout in tipc_sk_enqueue()

commit f4bb62e64c88c93060c051195d3bbba804e56945 upstream.

In tipc_sk_enqueue() we use hardcoded 2 jiffies to extract
socket buffer from generic queue to particular socket.
The 2 jiffies is too short in case there are other high priority
tasks get CPU cycles for multiple jiffies update. As result, no
buffer could be enqueued to particular socket.

To solve this, we switch to use constant timeout 20msecs.
Then, the function will be expired between 2 jiffies (CONFIG_100HZ)
and 20 jiffies (CONFIG_1000HZ).

Fixes: c637c1035534 ("tipc: resolve race problem at unicast message reception")
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 91230eecb7a8..ce957ee5383c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2422,7 +2422,7 @@ static int tipc_sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk,
 			    u32 dport, struct sk_buff_head *xmitq)
 {
-	unsigned long time_limit = jiffies + 2;
+	unsigned long time_limit = jiffies + usecs_to_jiffies(20000);
 	struct sk_buff *skb;
 	unsigned int lim;
 	atomic_t *dcnt;

From 33c983f7a1821a839fde706ded2fafa18cafeff1 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Tue, 28 Apr 2020 23:31:24 +0200
Subject: [PATCH 0336/1750] drm/rockchip: cdn-dp-core: Make cdn_dp_core_resume
 __maybe_unused

commit 040b8907ccf1c78d020aca29800036565d761d73 upstream.

With the new static annotation, the compiler warns when the functions
are actually unused:

   drivers/gpu/drm/rockchip/cdn-dp-core.c:1123:12: error: 'cdn_dp_resume' defined but not used [-Werror=unused-function]
    1123 | static int cdn_dp_resume(struct device *dev)
         |            ^~~~~~~~~~~~~

Mark them __maybe_unused to suppress that warning as well.

[ Not so 'new' static annotations any more, and I removed the part of
  the patch that added __maybe_unused to cdn_dp_suspend(), because it's
  used by the shutdown/remove code.

  So only the resume function ends up possibly unused if CONFIG_PM isn't
  set     - Linus ]

Fixes: 7c49abb4c2f8 ("drm/rockchip: cdn-dp-core: Make cdn_dp_core_suspend/resume static")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/rockchip/cdn-dp-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c
index 6802d9b65f82..dec54c70e008 100644
--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c
+++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c
@@ -1122,7 +1122,7 @@ static int cdn_dp_suspend(struct device *dev)
 	return ret;
 }
 
-static int cdn_dp_resume(struct device *dev)
+static __maybe_unused int cdn_dp_resume(struct device *dev)
 {
 	struct cdn_dp_device *dp = dev_get_drvdata(dev);
 

From 229e9293b2bada323485dd2168c03b7d69328014 Mon Sep 17 00:00:00 2001
From: Michael Petlan <mpetlan@redhat.com>
Date: Mon, 19 Jul 2021 16:53:32 +0200
Subject: [PATCH 0337/1750] perf machine: Initialize srcline string member in
 add_location struct

commit 57f0ff059e3daa4e70a811cb1d31a49968262d20 upstream.

It's later supposed to be either a correct address or NULL. Without the
initialization, it may contain an undefined value which results in the
following segmentation fault:

  # perf top --sort comm -g --ignore-callees=do_idle

terminates with:

  #0  0x00007ffff56b7685 in __strlen_avx2 () from /lib64/libc.so.6
  #1  0x00007ffff55e3802 in strdup () from /lib64/libc.so.6
  #2  0x00005555558cb139 in hist_entry__init (callchain_size=<optimized out>, sample_self=true, template=0x7fffde7fb110, he=0x7fffd801c250) at util/hist.c:489
  #3  hist_entry__new (template=template@entry=0x7fffde7fb110, sample_self=sample_self@entry=true) at util/hist.c:564
  #4  0x00005555558cb4ba in hists__findnew_entry (hists=hists@entry=0x5555561d9e38, entry=entry@entry=0x7fffde7fb110, al=al@entry=0x7fffde7fb420,
      sample_self=sample_self@entry=true) at util/hist.c:657
  #5  0x00005555558cba1b in __hists__add_entry (hists=hists@entry=0x5555561d9e38, al=0x7fffde7fb420, sym_parent=<optimized out>, bi=bi@entry=0x0, mi=mi@entry=0x0,
      sample=sample@entry=0x7fffde7fb4b0, sample_self=true, ops=0x0, block_info=0x0) at util/hist.c:288
  #6  0x00005555558cbb70 in hists__add_entry (sample_self=true, sample=0x7fffde7fb4b0, mi=0x0, bi=0x0, sym_parent=<optimized out>, al=<optimized out>, hists=0x5555561d9e38)
      at util/hist.c:1056
  #7  iter_add_single_cumulative_entry (iter=0x7fffde7fb460, al=<optimized out>) at util/hist.c:1056
  #8  0x00005555558cc8a4 in hist_entry_iter__add (iter=iter@entry=0x7fffde7fb460, al=al@entry=0x7fffde7fb420, max_stack_depth=<optimized out>, arg=arg@entry=0x7fffffff7db0)
      at util/hist.c:1231
  #9  0x00005555557cdc9a in perf_event__process_sample (machine=<optimized out>, sample=0x7fffde7fb4b0, evsel=<optimized out>, event=<optimized out>, tool=0x7fffffff7db0)
      at builtin-top.c:842
  #10 deliver_event (qe=<optimized out>, qevent=<optimized out>) at builtin-top.c:1202
  #11 0x00005555558a9318 in do_flush (show_progress=false, oe=0x7fffffff80e0) at util/ordered-events.c:244
  #12 __ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP, timestamp=timestamp@entry=0) at util/ordered-events.c:323
  #13 0x00005555558a9789 in __ordered_events__flush (timestamp=<optimized out>, how=<optimized out>, oe=<optimized out>) at util/ordered-events.c:339
  #14 ordered_events__flush (how=OE_FLUSH__TOP, oe=0x7fffffff80e0) at util/ordered-events.c:341
  #15 ordered_events__flush (oe=oe@entry=0x7fffffff80e0, how=how@entry=OE_FLUSH__TOP) at util/ordered-events.c:339
  #16 0x00005555557cd631 in process_thread (arg=0x7fffffff7db0) at builtin-top.c:1114
  #17 0x00007ffff7bb817a in start_thread () from /lib64/libpthread.so.0
  #18 0x00007ffff5656dc3 in clone () from /lib64/libc.so.6

If you look at the frame #2, the code is:

488	 if (he->srcline) {
489          he->srcline = strdup(he->srcline);
490          if (he->srcline == NULL)
491              goto err_rawdata;
492	 }

If he->srcline is not NULL (it is not NULL if it is uninitialized rubbish),
it gets strdupped and strdupping a rubbish random string causes the problem.

Also, if you look at the commit 1fb7d06a509e, it adds the srcline property
into the struct, but not initializing it everywhere needed.

Committer notes:

Now I see, when using --ignore-callees=do_idle we end up here at line
2189 in add_callchain_ip():

2181         if (al.sym != NULL) {
2182                 if (perf_hpp_list.parent && !*parent &&
2183                     symbol__match_regex(al.sym, &parent_regex))
2184                         *parent = al.sym;
2185                 else if (have_ignore_callees && root_al &&
2186                   symbol__match_regex(al.sym, &ignore_callees_regex)) {
2187                         /* Treat this symbol as the root,
2188                            forgetting its callees. */
2189                         *root_al = al;
2190                         callchain_cursor_reset(cursor);
2191                 }
2192         }

And the al that doesn't have the ->srcline field initialized will be
copied to the root_al, so then, back to:

1211 int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
1212                          int max_stack_depth, void *arg)
1213 {
1214         int err, err2;
1215         struct map *alm = NULL;
1216
1217         if (al)
1218                 alm = map__get(al->map);
1219
1220         err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent,
1221                                         iter->evsel, al, max_stack_depth);
1222         if (err) {
1223                 map__put(alm);
1224                 return err;
1225         }
1226
1227         err = iter->ops->prepare_entry(iter, al);
1228         if (err)
1229                 goto out;
1230
1231         err = iter->ops->add_single_entry(iter, al);
1232         if (err)
1233                 goto out;
1234

That al at line 1221 is what hist_entry_iter__add() (called from
sample__resolve_callchain()) saw as 'root_al', and then:

        iter->ops->add_single_entry(iter, al);

will go on with al->srcline with a bogus value, I'll add the above
sequence to the cset and apply, thanks!

Signed-off-by: Michael Petlan <mpetlan@redhat.com>
CC: Milian Wolff <milian.wolff@kdab.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Fixes: 1fb7d06a509e ("perf report Use srcline from callchain for hist entries")
Link: https //lore.kernel.org/r/20210719145332.29747-1-mpetlan@redhat.com
Reported-by: Juri Lelli <jlelli@redhat.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/machine.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 74bf480aa4f0..df515cd8d018 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -2100,6 +2100,7 @@ static int add_callchain_ip(struct thread *thread,
 
 	al.filtered = 0;
 	al.sym = NULL;
+	al.srcline = NULL;
 	if (!cpumode) {
 		thread__find_cpumode_addr_location(thread, ip, &al);
 	} else {

From 29a5af9112a279398c0716bd8d932c94c6a03b16 Mon Sep 17 00:00:00 2001
From: Saeed Mahameed <saeedm@nvidia.com>
Date: Wed, 18 Aug 2021 13:09:26 -0700
Subject: [PATCH 0338/1750] net/mlx5: FWTrace, cancel work on alloc pd error
 flow

commit dfe6fd72b5f1878b16aa2c8603e031bbcd66b96d upstream.

Handle error flow on mlx5_core_alloc_pd() failure,
read_fw_strings_work must be canceled.

Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling")
Reported-by: Pavel Machek (CIP) <pavel@denx.de>
Suggested-by: Pavel Machek (CIP) <pavel@denx.de>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Reviewed-by: Aya Levin <ayal@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
index 3dfcb20e97c6..857be86b4a11 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
@@ -1007,7 +1007,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_tracer *tracer)
 	err = mlx5_core_alloc_pd(dev, &tracer->buff.pdn);
 	if (err) {
 		mlx5_core_warn(dev, "FWTracer: Failed to allocate PD %d\n", err);
-		return err;
+		goto err_cancel_work;
 	}
 
 	err = mlx5_fw_tracer_create_mkey(tracer);
@@ -1031,6 +1031,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_tracer *tracer)
 	mlx5_core_destroy_mkey(dev, &tracer->buff.mkey);
 err_dealloc_pd:
 	mlx5_core_dealloc_pd(dev, tracer->buff.pdn);
+err_cancel_work:
 	cancel_work_sync(&tracer->read_fw_strings_work);
 	return err;
 }

From c586bc31d5b9ae7ed202fc0dcaffbaaed77bde06 Mon Sep 17 00:00:00 2001
From: Maor Gottlieb <maorg@nvidia.com>
Date: Wed, 1 Sep 2021 11:48:13 +0300
Subject: [PATCH 0339/1750] net/mlx5: Fix potential sleeping in atomic context

commit ee27e330a953595903979ffdb84926843595a9fe upstream.

Fixes the below flow of sleeping in atomic context by releasing
the RCU lock before calling to free_match_list.

build_match_list() <- disables preempt
-> free_match_list()
   -> tree_put_node()
      -> down_write_ref_node() <- take write lock

Fixes: 693c6883bbc4 ("net/mlx5: Add hash table for flow groups in flow table")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 1d4b4e6f6fb4..0ff034b0866e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -1675,14 +1675,13 @@ static int build_match_list(struct match_list *match_head,
 
 		curr_match = kmalloc(sizeof(*curr_match), GFP_ATOMIC);
 		if (!curr_match) {
+			rcu_read_unlock();
 			free_match_list(match_head, ft_locked);
-			err = -ENOMEM;
-			goto out;
+			return -ENOMEM;
 		}
 		curr_match->g = g;
 		list_add_tail(&curr_match->list, &match_head->list);
 	}
-out:
 	rcu_read_unlock();
 	return err;
 }

From 8f8ad122ffe01efb7c14b34f9c33b8b16e02fec5 Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Thu, 9 Sep 2021 08:54:52 -0700
Subject: [PATCH 0340/1750] nvme-tcp: fix io_work priority inversion

commit 70f437fb4395ad4d1d16fab9a1ad9fbc9fc0579b upstream.

Dispatching requests inline with the .queue_rq() call may block while
holding the send_mutex. If the tcp io_work also happens to schedule, it
may see the req_list is non-empty, leaving "pending" true and remaining
in TASK_RUNNING. Since io_work is of higher scheduling priority, the
.queue_rq task may not get a chance to run, blocking forward progress
and leading to io timeouts.

Instead of checking for pending requests within io_work, let the queueing
restart io_work outside the send_mutex lock if there is more work to be
done.

Fixes: a0fdd1418007f ("nvme-tcp: rerun io_work if req_list is not empty")
Reported-by: Samuel Jones <sjones@kalrayinc.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/tcp.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index c9a925999c6e..a6b3b0762763 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -273,6 +273,12 @@ static inline void nvme_tcp_send_all(struct nvme_tcp_queue *queue)
 	} while (ret > 0);
 }
 
+static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue)
+{
+	return !list_empty(&queue->send_list) ||
+		!llist_empty(&queue->req_list) || queue->more_requests;
+}
+
 static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req,
 		bool sync, bool last)
 {
@@ -293,9 +299,10 @@ static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req,
 		nvme_tcp_send_all(queue);
 		queue->more_requests = false;
 		mutex_unlock(&queue->send_mutex);
-	} else if (last) {
-		queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work);
 	}
+
+	if (last && nvme_tcp_queue_more(queue))
+		queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work);
 }
 
 static void nvme_tcp_process_req_list(struct nvme_tcp_queue *queue)
@@ -890,12 +897,6 @@ static void nvme_tcp_state_change(struct sock *sk)
 	read_unlock_bh(&sk->sk_callback_lock);
 }
 
-static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue)
-{
-	return !list_empty(&queue->send_list) ||
-		!llist_empty(&queue->req_list) || queue->more_requests;
-}
-
 static inline void nvme_tcp_done_send_req(struct nvme_tcp_queue *queue)
 {
 	queue->request = NULL;
@@ -1132,8 +1133,7 @@ static void nvme_tcp_io_work(struct work_struct *w)
 				pending = true;
 			else if (unlikely(result < 0))
 				break;
-		} else
-			pending = !llist_empty(&queue->req_list);
+		}
 
 		result = nvme_tcp_try_recv(queue);
 		if (result > 0)

From c5102ced8ac0a106182332de15ea2b2920581811 Mon Sep 17 00:00:00 2001
From: Baptiste Lepers <baptiste.lepers@gmail.com>
Date: Mon, 6 Sep 2021 11:53:10 +1000
Subject: [PATCH 0341/1750] events: Reuse value read using READ_ONCE instead of
 re-reading it

commit b89a05b21f46150ac10a962aa50109250b56b03b upstream.

In perf_event_addr_filters_apply, the task associated with
the event (event->ctx->task) is read using READ_ONCE at the beginning
of the function, checked, and then re-read from event->ctx->task,
voiding all guarantees of the checks. Reuse the value that was read by
READ_ONCE to ensure the consistency of the task struct throughout the
function.

Fixes: 375637bc52495 ("perf/core: Introduce address range filtering")
Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20210906015310.12802-1-baptiste.lepers@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7e0fdc19043e..c677f934353a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -9973,7 +9973,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
 		return;
 
 	if (ifh->nr_file_filters) {
-		mm = get_task_mm(event->ctx->task);
+		mm = get_task_mm(task);
 		if (!mm)
 			goto restart;
 

From 983ef866291cc7e51f151cdea5a7c2fe36f632a3 Mon Sep 17 00:00:00 2001
From: Alex Elder <elder@linaro.org>
Date: Tue, 7 Sep 2021 12:05:54 -0500
Subject: [PATCH 0342/1750] net: ipa: initialize all filter table slots

commit b5c102238cea985d8126b173d06b9e1de88037ee upstream.

There is an off-by-one problem in ipa_table_init_add(), when
initializing filter tables.

In that function, the number of filter table entries is determined
based on the number of set bits in the filter map.  However that
count does *not* include the extra "slot" in the filter table that
holds the filter map itself.  Meanwhile, ipa_table_addr() *does*
include the filter map in the memory it returns, but because the
count it's provided doesn't include it, it includes one too few
table entries.

Fix this by including the extra slot for the filter map in the count
computed in ipa_table_init_add().

Note: ipa_filter_reset_table() does not have this problem; it resets
filter table entries one by one, but does not overwrite the filter
bitmap.

Fixes: 2b9feef2b6c2 ("soc: qcom: ipa: filter and routing tables")
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ipa/ipa_table.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ipa/ipa_table.c b/drivers/net/ipa/ipa_table.c
index b3790aa952a1..0747866d60ab 100644
--- a/drivers/net/ipa/ipa_table.c
+++ b/drivers/net/ipa/ipa_table.c
@@ -451,7 +451,8 @@ static void ipa_table_init_add(struct gsi_trans *trans, bool filter,
 	 * table region determines the number of entries it has.
 	 */
 	if (filter) {
-		count = hweight32(ipa->filter_map);
+		/* Include one extra "slot" to hold the filter map itself */
+		count = 1 + hweight32(ipa->filter_map);
 		hash_count = hash_mem->size ? count : 0;
 	} else {
 		count = mem->size / IPA_TABLE_ENTRY_SIZE;

From 7843861e214026bd867d19e832de10d16a52e757 Mon Sep 17 00:00:00 2001
From: Kortan <kortanzh@gmail.com>
Date: Wed, 8 Sep 2021 11:28:48 +0800
Subject: [PATCH 0343/1750] gen_compile_commands: fix missing 'sys' package

commit ec783c7cb2495c5a3b8ca10db8056d43c528f940 upstream.

We need to import the 'sys' package since the script has called
sys.exit() method.

Fixes: 6ad7cbc01527 ("Makefile: Add clang-tidy and static analyzer support to makefile")
Signed-off-by: Kortan <kortanzh@gmail.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/clang-tools/gen_compile_commands.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/clang-tools/gen_compile_commands.py b/scripts/clang-tools/gen_compile_commands.py
index 8ddb5d099029..8bf55bb4f515 100755
--- a/scripts/clang-tools/gen_compile_commands.py
+++ b/scripts/clang-tools/gen_compile_commands.py
@@ -13,6 +13,7 @@ import logging
 import os
 import re
 import subprocess
+import sys
 
 _DEFAULT_OUTPUT = 'compile_commands.json'
 _DEFAULT_LOG_LEVEL = 'WARNING'

From cad96d0e50e4149758d43bcc3bd13f6381312362 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Wed, 8 Sep 2021 13:42:09 +0200
Subject: [PATCH 0344/1750] vhost_net: fix OoB on sendmsg() failure.

commit 3c4cea8fa7f71f00c5279547043a84bc2a4d8b8c upstream.

If the sendmsg() call in vhost_tx_batch() fails, both the 'batched_xdp'
and 'done_idx' indexes are left unchanged. If such failure happens
when batched_xdp == VHOST_NET_BATCH, the next call to
vhost_net_build_xdp() will access and write memory outside the xdp
buffers area.

Since sendmsg() can only error with EBADFD, this change addresses the
issue explicitly freeing the XDP buffers batch on error.

Fixes: 0a0be13b8fe2 ("vhost_net: batch submitting XDP buffers to underlayer sockets")
Suggested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/net.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index c8784dfafdd7..da02c3e96e7b 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -466,7 +466,7 @@ static void vhost_tx_batch(struct vhost_net *net,
 		.num = nvq->batched_xdp,
 		.ptr = nvq->xdp,
 	};
-	int err;
+	int i, err;
 
 	if (nvq->batched_xdp == 0)
 		goto signal_used;
@@ -475,6 +475,15 @@ static void vhost_tx_batch(struct vhost_net *net,
 	err = sock->ops->sendmsg(sock, msghdr, 0);
 	if (unlikely(err < 0)) {
 		vq_err(&nvq->vq, "Fail to batch sending packets\n");
+
+		/* free pages owned by XDP; since this is an unlikely error path,
+		 * keep it simple and avoid more complex bulk update for the
+		 * used pages
+		 */
+		for (i = 0; i < nvq->batched_xdp; ++i)
+			put_page(virt_to_head_page(nvq->xdp[i].data));
+		nvq->batched_xdp = 0;
+		nvq->done_idx = 0;
 		return;
 	}
 

From df38f941a7e4c966919741b86df5e877a1f69e9a Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 8 Sep 2021 17:00:29 -0700
Subject: [PATCH 0345/1750] net/af_unix: fix a data-race in unix_dgram_poll

commit 04f08eb44b5011493d77b602fdec29ff0f5c6cd5 upstream.

syzbot reported another data-race in af_unix [1]

Lets change __skb_insert() to use WRITE_ONCE() when changing
skb head qlen.

Also, change unix_dgram_poll() to use lockless version
of unix_recvq_full()

It is verry possible we can switch all/most unix_recvq_full()
to the lockless version, this will be done in a future kernel version.

[1] HEAD commit: 8596e589b787732c8346f0482919e83cc9362db1

BUG: KCSAN: data-race in skb_queue_tail / unix_dgram_poll

write to 0xffff88814eeb24e0 of 4 bytes by task 25815 on cpu 0:
 __skb_insert include/linux/skbuff.h:1938 [inline]
 __skb_queue_before include/linux/skbuff.h:2043 [inline]
 __skb_queue_tail include/linux/skbuff.h:2076 [inline]
 skb_queue_tail+0x80/0xa0 net/core/skbuff.c:3264
 unix_dgram_sendmsg+0xff2/0x1600 net/unix/af_unix.c:1850
 sock_sendmsg_nosec net/socket.c:703 [inline]
 sock_sendmsg net/socket.c:723 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392
 ___sys_sendmsg net/socket.c:2446 [inline]
 __sys_sendmmsg+0x315/0x4b0 net/socket.c:2532
 __do_sys_sendmmsg net/socket.c:2561 [inline]
 __se_sys_sendmmsg net/socket.c:2558 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2558
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88814eeb24e0 of 4 bytes by task 25834 on cpu 1:
 skb_queue_len include/linux/skbuff.h:1869 [inline]
 unix_recvq_full net/unix/af_unix.c:194 [inline]
 unix_dgram_poll+0x2bc/0x3e0 net/unix/af_unix.c:2777
 sock_poll+0x23e/0x260 net/socket.c:1288
 vfs_poll include/linux/poll.h:90 [inline]
 ep_item_poll fs/eventpoll.c:846 [inline]
 ep_send_events fs/eventpoll.c:1683 [inline]
 ep_poll fs/eventpoll.c:1798 [inline]
 do_epoll_wait+0x6ad/0xf00 fs/eventpoll.c:2226
 __do_sys_epoll_wait fs/eventpoll.c:2238 [inline]
 __se_sys_epoll_wait fs/eventpoll.c:2233 [inline]
 __x64_sys_epoll_wait+0xf6/0x120 fs/eventpoll.c:2233
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000001b -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 25834 Comm: syz-executor.1 Tainted: G        W         5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: 86b18aaa2b5b ("skbuff: fix a data race in skb_queue_len()")
Cc: Qian Cai <cai@lca.pw>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/skbuff.h | 2 +-
 net/unix/af_unix.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 0a1239819fd2..acbf1875ad50 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1908,7 +1908,7 @@ static inline void __skb_insert(struct sk_buff *newsk,
 	WRITE_ONCE(newsk->prev, prev);
 	WRITE_ONCE(next->prev, newsk);
 	WRITE_ONCE(prev->next, newsk);
-	list->qlen++;
+	WRITE_ONCE(list->qlen, list->qlen + 1);
 }
 
 static inline void __skb_queue_splice(const struct sk_buff_head *list,
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 37ffa7725cee..d5c0ae34b1e4 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2769,7 +2769,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock,
 
 		other = unix_peer(sk);
 		if (other && unix_peer(other) != sk &&
-		    unix_recvq_full(other) &&
+		    unix_recvq_full_lockless(other) &&
 		    unix_dgram_peer_wake_me(sk, other))
 			writable = 0;
 

From cf6f29bb2c18be0aaa54d85b5d58f6a9759bcbf1 Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Tue, 14 Sep 2021 16:43:31 +0300
Subject: [PATCH 0346/1750] net: dsa: destroy the phylink instance on any error
 in dsa_slave_phy_setup

commit 6a52e73368038f47f6618623d75061dc263b26ae upstream.

DSA supports connecting to a phy-handle, and has a fallback to a non-OF
based method of connecting to an internal PHY on the switch's own MDIO
bus, if no phy-handle and no fixed-link nodes were present.

The -ENODEV error code from the first attempt (phylink_of_phy_connect)
is what triggers the second attempt (phylink_connect_phy).

However, when the first attempt returns a different error code than
-ENODEV, this results in an unbalance of calls to phylink_create and
phylink_destroy by the time we exit the function. The phylink instance
has leaked.

There are many other error codes that can be returned by
phylink_of_phy_connect. For example, phylink_validate returns -EINVAL.
So this is a practical issue too.

Fixes: aab9c4067d23 ("net: dsa: Plug in PHYLINK support")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/20210914134331.2303380-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/dsa/slave.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 9281c9c6a253..65b125bb3b86 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1728,13 +1728,11 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev)
 		 * use the switch internal MDIO bus instead
 		 */
 		ret = dsa_slave_phy_connect(slave_dev, dp->index);
-		if (ret) {
-			netdev_err(slave_dev,
-				   "failed to connect to port %d: %d\n",
-				   dp->index, ret);
-			phylink_destroy(dp->pl);
-			return ret;
-		}
+	}
+	if (ret) {
+		netdev_err(slave_dev, "failed to connect to PHY: %pe\n",
+			   ERR_PTR(ret));
+		phylink_destroy(dp->pl);
 	}
 
 	return ret;

From 35d3ab2ea2ed594406db5cb063dd1f9daf940a83 Mon Sep 17 00:00:00 2001
From: Will Deacon <will@kernel.org>
Date: Mon, 13 Sep 2021 17:35:47 +0100
Subject: [PATCH 0347/1750] x86/uaccess: Fix 32-bit __get_user_asm_u64() when
 CC_HAS_ASM_GOTO_OUTPUT=y

commit a69ae291e1cc2d08ae77c2029579c59c9bde5061 upstream.

Commit 865c50e1d279 ("x86/uaccess: utilize CONFIG_CC_HAS_ASM_GOTO_OUTPUT")
added an optimised version of __get_user_asm() for x86 using 'asm goto'.

Like the non-optimised code, the 32-bit implementation of 64-bit
get_user() expands to a pair of 32-bit accesses.  Unlike the
non-optimised code, the _original_ pointer is incremented to copy the
high word instead of loading through a new pointer explicitly
constructed to point at a 32-bit type.  Consequently, if the pointer
points at a 64-bit type then we end up loading the wrong data for the
upper 32-bits.

This was observed as a mount() failure in Android targeting i686 after
b0cfcdd9b967 ("d_path: make 'prepend()' fill up the buffer exactly on
overflow") because the call to copy_from_kernel_nofault() from
prepend_copy() ends up in __get_kernel_nofault() and casts the source
pointer to a 'u64 __user *'.  An attempt to mount at "/debug_ramdisk"
therefore ends up failing trying to mount "/debumdismdisk".

Use the existing '__gu_ptr' source pointer to unsigned int for 32-bit
__get_user_asm_u64() instead of the original pointer.

Cc: Bill Wendling <morbo@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 865c50e1d279 ("x86/uaccess: utilize CONFIG_CC_HAS_ASM_GOTO_OUTPUT")
Signed-off-by: Will Deacon <will@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/uaccess.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index c9fa7be3df82..5c95d242f38d 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -301,8 +301,8 @@ do {									\
 	unsigned int __gu_low, __gu_high;				\
 	const unsigned int __user *__gu_ptr;				\
 	__gu_ptr = (const void __user *)(ptr);				\
-	__get_user_asm(__gu_low, ptr, "l", "=r", label);		\
-	__get_user_asm(__gu_high, ptr+1, "l", "=r", label);		\
+	__get_user_asm(__gu_low, __gu_ptr, "l", "=r", label);		\
+	__get_user_asm(__gu_high, __gu_ptr+1, "l", "=r", label);	\
 	(x) = ((unsigned long long)__gu_high << 32) | __gu_low;		\
 } while (0)
 #else

From 53947b68c56bbdd2d8c8399b0d1a6ab154203577 Mon Sep 17 00:00:00 2001
From: zhenggy <zhenggy@chinatelecom.cn>
Date: Tue, 14 Sep 2021 09:51:15 +0800
Subject: [PATCH 0348/1750] tcp: fix tp->undo_retrans accounting in
 tcp_sacktag_one()

commit 4f884f3962767877d7aabbc1ec124d2c307a4257 upstream.

Commit 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit
time") may directly retrans a multiple segments TSO/GSO packet without
split, Since this commit, we can no longer assume that a retransmitted
packet is a single segment.

This patch fixes the tp->undo_retrans accounting in tcp_sacktag_one()
that use the actual segments(pcount) of the retransmitted packet.

Before that commit (10d3be569243), the assumption underlying the
tp->undo_retrans-- seems correct.

Fixes: 10d3be569243 ("tcp-tso: do not split TSO packets at retransmit time")
Signed-off-by: zhenggy <zhenggy@chinatelecom.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ac8d38e04400..991e3434957b 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1314,7 +1314,7 @@ static u8 tcp_sacktag_one(struct sock *sk,
 	if (dup_sack && (sacked & TCPCB_RETRANS)) {
 		if (tp->undo_marker && tp->undo_retrans > 0 &&
 		    after(end_seq, tp->undo_marker))
-			tp->undo_retrans--;
+			tp->undo_retrans = max_t(int, 0, tp->undo_retrans - pcount);
 		if ((sacked & TCPCB_SACKED_ACKED) &&
 		    before(start_seq, state->reord))
 				state->reord = start_seq;

From e00eae1d6b1fb8eecb1250fdcadcc97ea391cbe5 Mon Sep 17 00:00:00 2001
From: Andrea Claudi <aclaudi@redhat.com>
Date: Sat, 11 Sep 2021 16:14:18 +0200
Subject: [PATCH 0349/1750] selftest: net: fix typo in altname test

commit 1b704b27beb11ce147d64b21c914e57afbfb5656 upstream.

If altname deletion of the short alternative name fails, the error
message printed is: "Failed to add short alternative name".
This is obviously a typo, as we are testing altname deletion.

Fix this using a proper error message.

Fixes: f95e6c9c4617 ("selftest: net: add alternative names test")
Signed-off-by: Andrea Claudi <aclaudi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/net/altnames.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/altnames.sh b/tools/testing/selftests/net/altnames.sh
index 4254ddc3f70b..1ef9e4159bba 100755
--- a/tools/testing/selftests/net/altnames.sh
+++ b/tools/testing/selftests/net/altnames.sh
@@ -45,7 +45,7 @@ altnames_test()
 	check_err $? "Got unexpected long alternative name from link show JSON"
 
 	ip link property del $DUMMY_DEV altname $SHORT_NAME
-	check_err $? "Failed to add short alternative name"
+	check_err $? "Failed to delete short alternative name"
 
 	ip -j -p link show $SHORT_NAME &>/dev/null
 	check_fail $? "Unexpected success while trying to do link show with deleted short alternative name"

From 5221e66329910239df788f2cf49f4acc072f86d0 Mon Sep 17 00:00:00 2001
From: Shai Malin <smalin@marvell.com>
Date: Fri, 10 Sep 2021 11:33:56 +0300
Subject: [PATCH 0350/1750] qed: Handle management FW error

commit 20e100f52730cd0db609e559799c1712b5f27582 upstream.

Handle MFW (management FW) error response in order to avoid a crash
during recovery flows.

Changes from v1:
- Add "Fixes tag".

Fixes: tag 5e7ba042fd05 ("qed: Fix reading stale configuration information")
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Shai Malin <smalin@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qed/qed_mcp.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index caeef25c89bb..2cd14ee95c1f 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -3376,6 +3376,7 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn,
 			  struct qed_nvm_image_att *p_image_att)
 {
 	enum nvm_image_type type;
+	int rc;
 	u32 i;
 
 	/* Translate image_id into MFW definitions */
@@ -3404,7 +3405,10 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn,
 		return -EINVAL;
 	}
 
-	qed_mcp_nvm_info_populate(p_hwfn);
+	rc = qed_mcp_nvm_info_populate(p_hwfn);
+	if (rc)
+		return rc;
+
 	for (i = 0; i < p_hwfn->nvm_info.num_images; i++)
 		if (type == p_hwfn->nvm_info.image_att[i].image_type)
 			break;

From 0ab9981fa0c5f1ded9a70b44d9c003e549068e7a Mon Sep 17 00:00:00 2001
From: Aya Levin <ayal@nvidia.com>
Date: Mon, 13 Sep 2021 10:53:49 +0300
Subject: [PATCH 0351/1750] udp_tunnel: Fix udp_tunnel_nic work-queue type

commit e50e711351bdc656a8e6ca1022b4293cae8dcd59 upstream.

Turn udp_tunnel_nic work-queue to an ordered work-queue. This queue
holds the UDP-tunnel configuration commands of the different netdevs.
When the netdevs are functions of the same NIC the order of
execution may be crucial.

Problem example:
NIC with 2 PFs, both PFs declare offload quota of up to 3 UDP-ports.
 $ifconfig eth2 1.1.1.1/16 up

 $ip link add eth2_19503 type vxlan id 5049 remote 1.1.1.2 dev eth2 dstport 19053
 $ip link set dev eth2_19503 up

 $ip link add eth2_19504 type vxlan id 5049 remote 1.1.1.3 dev eth2 dstport 19054
 $ip link set dev eth2_19504 up

 $ip link add eth2_19505 type vxlan id 5049 remote 1.1.1.4 dev eth2 dstport 19055
 $ip link set dev eth2_19505 up

 $ip link add eth2_19506 type vxlan id 5049 remote 1.1.1.5 dev eth2 dstport 19056
 $ip link set dev eth2_19506 up

NIC RX port offload infrastructure offloads the first 3 UDP-ports (on
all devices which sets NETIF_F_RX_UDP_TUNNEL_PORT feature) and not
UDP-port 19056. So both PFs gets this offload configuration.

 $ip link set dev eth2_19504 down

This triggers udp-tunnel-core to remove the UDP-port 19504 from
offload-ports-list and offload UDP-port 19056 instead.

In this scenario it is important that the UDP-port of 19504 will be
removed from both PFs before trying to add UDP-port 19056. The NIC can
stop offloading a UDP-port only when all references are removed.
Otherwise the NIC may report exceeding of the offload quota.

Fixes: cc4e3835eff4 ("udp_tunnel: add central NIC RX port offload infrastructure")
Signed-off-by: Aya Levin <ayal@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/udp_tunnel_nic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
index 0d122edc368d..b91003538d87 100644
--- a/net/ipv4/udp_tunnel_nic.c
+++ b/net/ipv4/udp_tunnel_nic.c
@@ -935,7 +935,7 @@ static int __init udp_tunnel_nic_init_module(void)
 {
 	int err;
 
-	udp_tunnel_nic_workqueue = alloc_workqueue("udp_tunnel_nic", 0, 0);
+	udp_tunnel_nic_workqueue = alloc_ordered_workqueue("udp_tunnel_nic", 0);
 	if (!udp_tunnel_nic_workqueue)
 		return -ENOMEM;
 

From aeb67214ce94f23e76502d69231e334c17e422d7 Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Sun, 12 Sep 2021 18:51:20 +0200
Subject: [PATCH 0352/1750] dt-bindings: arm: Fix Toradex compatible typo

commit 55c21d57eafb7b379bb7b3e93baf9ca2695895b0 upstream.

Fix board compatible typo reported by dtbs_check.

Fixes: f4d1577e9bc6 ("dt-bindings: arm: Convert Tegra board/soc bindings to json-schema")
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20210912165120.188490-1-david@ixit.cz
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/devicetree/bindings/arm/tegra.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/arm/tegra.yaml b/Documentation/devicetree/bindings/arm/tegra.yaml
index 767e86354c8e..2c6911c775c8 100644
--- a/Documentation/devicetree/bindings/arm/tegra.yaml
+++ b/Documentation/devicetree/bindings/arm/tegra.yaml
@@ -54,7 +54,7 @@ properties:
           - const: toradex,apalis_t30
           - const: nvidia,tegra30
       - items:
-          - const: toradex,apalis_t30-eval-v1.1
+          - const: toradex,apalis_t30-v1.1-eval
           - const: toradex,apalis_t30-eval
           - const: toradex,apalis_t30-v1.1
           - const: toradex,apalis_t30

From e68795c1101ed6a1eb2954d40945708a459d14c3 Mon Sep 17 00:00:00 2001
From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Date: Wed, 8 Sep 2021 09:58:20 -0700
Subject: [PATCH 0353/1750] ibmvnic: check failover_pending in login response

commit 273c29e944bda9a20a30c26cfc34c9a3f363280b upstream.

If a failover occurs before a login response is received, the login
response buffer maybe undefined. Check that there was no failover
before accessing the login response buffer.

Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index 3134c1988db3..bb8d0a0f48ee 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -4478,6 +4478,14 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq,
 		return 0;
 	}
 
+	if (adapter->failover_pending) {
+		adapter->init_done_rc = -EAGAIN;
+		netdev_dbg(netdev, "Failover pending, ignoring login response\n");
+		complete(&adapter->init_done);
+		/* login response buffer will be released on reset */
+		return 0;
+	}
+
 	netdev->mtu = adapter->req_mtu - ETH_HLEN;
 
 	netdev_dbg(adapter->netdev, "Login Response Buffer:\n");

From 49eff4ab7d43d625a5906b63c3bfcca9cfac56eb Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Wed, 8 Sep 2021 20:17:18 +1000
Subject: [PATCH 0354/1750] KVM: PPC: Book3S HV: Tolerate treclaim. in
 fake-suspend mode changing registers

commit 267cdfa21385d78c794768233678756e32b39ead upstream.

POWER9 DD2.2 and 2.3 hardware implements a "fake-suspend" mode where
certain TM instructions executed in HV=0 mode cause softpatch interrupts
so the hypervisor can emulate them and prevent problematic processor
conditions. In this fake-suspend mode, the treclaim. instruction does
not modify registers.

Unfortunately the rfscv instruction executed by the guest do not
generate softpatch interrupts, which can cause the hypervisor to lose
track of the fake-suspend mode, and it can execute this treclaim. while
not in fake-suspend mode. This modifies GPRs and crashes the hypervisor.

It's not trivial to disable scv in the guest with HFSCR now, because
they assume a POWER9 has scv available. So this fix saves and restores
checkpointed registers across the treclaim.

Fixes: 7854f7545bff ("KVM: PPC: Book3S: Rework TM save/restore code and make it C-callable")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210908101718.118522-2-npiggin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/book3s_hv_rmhandlers.S | 36 +++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index cd9995ee8441..5777b72bb8b6 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -3146,7 +3146,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_P9_TM_HV_ASSIST)
 	/* The following code handles the fake_suspend = 1 case */
 	mflr	r0
 	std	r0, PPC_LR_STKOFF(r1)
-	stdu	r1, -PPC_MIN_STKFRM(r1)
+	stdu	r1, -TM_FRAME_SIZE(r1)
 
 	/* Turn on TM. */
 	mfmsr	r8
@@ -3161,10 +3161,42 @@ BEGIN_FTR_SECTION
 END_FTR_SECTION_IFSET(CPU_FTR_P9_TM_XER_SO_BUG)
 	nop
 
+	/*
+	 * It's possible that treclaim. may modify registers, if we have lost
+	 * track of fake-suspend state in the guest due to it using rfscv.
+	 * Save and restore registers in case this occurs.
+	 */
+	mfspr	r3, SPRN_DSCR
+	mfspr	r4, SPRN_XER
+	mfspr	r5, SPRN_AMR
+	/* SPRN_TAR would need to be saved here if the kernel ever used it */
+	mfcr	r12
+	SAVE_NVGPRS(r1)
+	SAVE_GPR(2, r1)
+	SAVE_GPR(3, r1)
+	SAVE_GPR(4, r1)
+	SAVE_GPR(5, r1)
+	stw	r12, 8(r1)
+	std	r1, HSTATE_HOST_R1(r13)
+
 	/* We have to treclaim here because that's the only way to do S->N */
 	li	r3, TM_CAUSE_KVM_RESCHED
 	TRECLAIM(R3)
 
+	GET_PACA(r13)
+	ld	r1, HSTATE_HOST_R1(r13)
+	REST_GPR(2, r1)
+	REST_GPR(3, r1)
+	REST_GPR(4, r1)
+	REST_GPR(5, r1)
+	lwz	r12, 8(r1)
+	REST_NVGPRS(r1)
+	mtspr	SPRN_DSCR, r3
+	mtspr	SPRN_XER, r4
+	mtspr	SPRN_AMR, r5
+	mtcr	r12
+	HMT_MEDIUM
+
 	/*
 	 * We were in fake suspend, so we are not going to save the
 	 * register state as the guest checkpointed state (since
@@ -3192,7 +3224,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_P9_TM_XER_SO_BUG)
 	std	r5, VCPU_TFHAR(r9)
 	std	r6, VCPU_TFIAR(r9)
 
-	addi	r1, r1, PPC_MIN_STKFRM
+	addi	r1, r1, TM_FRAME_SIZE
 	ld	r0, PPC_LR_STKOFF(r1)
 	mtlr	r0
 	blr

From 0511d099db6f92680dc4f780d27492211454a02a Mon Sep 17 00:00:00 2001
From: Edwin Peer <edwin.peer@broadcom.com>
Date: Sun, 12 Sep 2021 12:34:48 -0400
Subject: [PATCH 0355/1750] bnxt_en: make bnxt_free_skbs() safe to call after
 bnxt_free_mem()

commit 1affc01fdc6035189a5ab2a24948c9419ee0ecf2 upstream.

The call to bnxt_free_mem(..., false) in the bnxt_half_open_nic() error
path will deallocate ring descriptor memory via bnxt_free_?x_rings(),
but because irq_re_init is false, the ring info itself is not freed.

To simplify error paths, deallocation functions have generally been
written to be safe when called on unallocated memory. It should always
be safe to call dev_close(), which calls bnxt_free_skbs() a second time,
even in this semi- allocated ring state.

Calling bnxt_free_skbs() a second time with the rings already freed will
cause NULL pointer dereference.  Fix it by checking the rings are valid
before proceeding in bnxt_free_tx_skbs() and
bnxt_free_one_rx_ring_skbs().

Fixes: 975bc99a4a39 ("bnxt_en: Refactor bnxt_free_rx_skbs().")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 849ae99a955a..1def6caba349 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2591,6 +2591,9 @@ static void bnxt_free_tx_skbs(struct bnxt *bp)
 		struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
 		int j;
 
+		if (!txr->tx_buf_ring)
+			continue;
+
 		for (j = 0; j < max_idx;) {
 			struct bnxt_sw_tx_bd *tx_buf = &txr->tx_buf_ring[j];
 			struct sk_buff *skb;
@@ -2675,6 +2678,9 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr)
 	}
 
 skip_rx_tpa_free:
+	if (!rxr->rx_buf_ring)
+		goto skip_rx_buf_free;
+
 	for (i = 0; i < max_idx; i++) {
 		struct bnxt_sw_rx_bd *rx_buf = &rxr->rx_buf_ring[i];
 		dma_addr_t mapping = rx_buf->mapping;
@@ -2697,6 +2703,11 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr)
 			kfree(data);
 		}
 	}
+
+skip_rx_buf_free:
+	if (!rxr->rx_agg_ring)
+		goto skip_rx_agg_free;
+
 	for (i = 0; i < max_agg_idx; i++) {
 		struct bnxt_sw_rx_agg_bd *rx_agg_buf = &rxr->rx_agg_ring[i];
 		struct page *page = rx_agg_buf->page;
@@ -2713,6 +2724,8 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr)
 
 		__free_page(page);
 	}
+
+skip_rx_agg_free:
 	if (rxr->rx_page) {
 		__free_page(rxr->rx_page);
 		rxr->rx_page = NULL;

From 34fc06d0477e83088243702be08fa503b31e41c0 Mon Sep 17 00:00:00 2001
From: Yufeng Mo <moyufeng@huawei.com>
Date: Mon, 13 Sep 2021 21:08:21 +0800
Subject: [PATCH 0356/1750] net: hns3: pad the short tunnel frame before
 sending to hardware

commit d18e81183b1cb9c309266cbbce9acd3e0c528d04 upstream.

The hardware cannot handle short tunnel frames below 65 bytes,
and will cause vlan tag missing problem. So pads packet size to
65 bytes for tunnel frames to fix this bug.

Fixes: 3db084d28dc0("net: hns3: Fix for vxlan tx checksum bug")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 92ca3b21968f..936b9cfe1a62 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -60,6 +60,7 @@ MODULE_PARM_DESC(debug, " Network interface message level setting");
 #define HNS3_OUTER_VLAN_TAG	2
 
 #define HNS3_MIN_TX_LEN		33U
+#define HNS3_MIN_TUN_PKT_LEN	65U
 
 /* hns3_pci_tbl - PCI Device ID Table
  *
@@ -913,8 +914,11 @@ static int hns3_set_l2l3l4(struct sk_buff *skb, u8 ol4_proto,
 			       l4.tcp->doff);
 		break;
 	case IPPROTO_UDP:
-		if (hns3_tunnel_csum_bug(skb))
-			return skb_checksum_help(skb);
+		if (hns3_tunnel_csum_bug(skb)) {
+			int ret = skb_put_padto(skb, HNS3_MIN_TUN_PKT_LEN);
+
+			return ret ? ret : skb_checksum_help(skb);
+		}
 
 		hns3_set_field(*type_cs_vlan_tso, HNS3_TXD_L4CS_B, 1);
 		hns3_set_field(*type_cs_vlan_tso, HNS3_TXD_L4T_S,

From b76522c7c349ef35333c8d11e0bba720a5e03244 Mon Sep 17 00:00:00 2001
From: Yufeng Mo <moyufeng@huawei.com>
Date: Mon, 13 Sep 2021 21:08:22 +0800
Subject: [PATCH 0357/1750] net: hns3: change affinity_mask to numa node range

commit 1dc839ec09d3ab2a4156dc98328b8bc3586f2b70 upstream.

Currently, affinity_mask is set to a single cpu. As a result,
irqbalance becomes invalid in SUBSET or EXACT mode. To solve
this problem, change affinity_mask to numa node range. In this
way, irqbalance can be performed on the cpu of the numa node.

Fixes: 0812545487ec ("net: hns3: add interrupt affinity support for misc interrupt")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 2261de5caf86..3311719408cb 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -1463,9 +1463,10 @@ static void hclge_init_kdump_kernel_config(struct hclge_dev *hdev)
 
 static int hclge_configure(struct hclge_dev *hdev)
 {
+	const struct cpumask *cpumask = cpu_online_mask;
 	struct hclge_cfg cfg;
 	unsigned int i;
-	int ret;
+	int node, ret;
 
 	ret = hclge_get_cfg(hdev, &cfg);
 	if (ret)
@@ -1526,11 +1527,12 @@ static int hclge_configure(struct hclge_dev *hdev)
 
 	hclge_init_kdump_kernel_config(hdev);
 
-	/* Set the init affinity based on pci func number */
-	i = cpumask_weight(cpumask_of_node(dev_to_node(&hdev->pdev->dev)));
-	i = i ? PCI_FUNC(hdev->pdev->devfn) % i : 0;
-	cpumask_set_cpu(cpumask_local_spread(i, dev_to_node(&hdev->pdev->dev)),
-			&hdev->affinity_mask);
+	/* Set the affinity based on numa node */
+	node = dev_to_node(&hdev->pdev->dev);
+	if (node != NUMA_NO_NODE)
+		cpumask = cpumask_of_node(node);
+
+	cpumask_copy(&hdev->affinity_mask, cpumask);
 
 	return ret;
 }

From ad47e092210882ae1b5a2239ea59c4e8339cc980 Mon Sep 17 00:00:00 2001
From: Yufeng Mo <moyufeng@huawei.com>
Date: Mon, 13 Sep 2021 21:08:23 +0800
Subject: [PATCH 0358/1750] net: hns3: disable mac in flr process

commit b81d8948746520f989e86d66292ff72b5056114a upstream.

The firmware will not disable mac in flr process. Therefore, the driver
needs to proactively disable mac during flr, which is the same as the
function reset.

Fixes: 35d93a30040c ("net: hns3: adjust the process of PF reset")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 3311719408cb..59ec538eba1f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -7005,11 +7005,12 @@ static void hclge_ae_stop(struct hnae3_handle *handle)
 	hclge_clear_arfs_rules(handle);
 	spin_unlock_bh(&hdev->fd_rule_lock);
 
-	/* If it is not PF reset, the firmware will disable the MAC,
+	/* If it is not PF reset or FLR, the firmware will disable the MAC,
 	 * so it only need to stop phy here.
 	 */
 	if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) &&
-	    hdev->reset_type != HNAE3_FUNC_RESET) {
+	    hdev->reset_type != HNAE3_FUNC_RESET &&
+	    hdev->reset_type != HNAE3_FLR_RESET) {
 		hclge_mac_stop_phy(hdev);
 		hclge_update_link_status(hdev);
 		return;

From aa39eb744a82e35ca6dde7c2279a1b1c315cb357 Mon Sep 17 00:00:00 2001
From: Jiaran Zhang <zhangjiaran@huawei.com>
Date: Mon, 13 Sep 2021 21:08:25 +0800
Subject: [PATCH 0359/1750] net: hns3: fix the timing issue of VF clearing
 interrupt sources

commit 427900d27d86b820c559037a984bd403f910860f upstream.

Currently, the VF does not clear the interrupt source immediately after
receiving the interrupt. As a result, if the second interrupt task is
triggered when processing the first interrupt task, clearing the
interrupt source before exiting will clear the interrupt sources of the
two tasks at the same time. As a result, no interrupt is triggered for
the second task. The VF detects the missed message only when the next
interrupt is generated.

Clearing it immediately after executing check_evt_cause ensures that:
1. Even if two interrupt tasks are triggered at the same time, they can
be processed.
2. If the second task is triggered during the processing of the first
task and the interrupt source is not cleared, the interrupt is reported
after vector0 is enabled.

Fixes: b90fcc5bd904 ("net: hns3: add reset handling for VF when doing Core/Global/IMP reset")
Signed-off-by: Jiaran Zhang <zhangjiaran@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index d3010d5ab366..447457cacf97 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -2352,6 +2352,8 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data)
 
 	hclgevf_enable_vector(&hdev->misc_vector, false);
 	event_cause = hclgevf_check_evt_cause(hdev, &clearval);
+	if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER)
+		hclgevf_clear_event_cause(hdev, clearval);
 
 	switch (event_cause) {
 	case HCLGEVF_VECTOR0_EVENT_RST:
@@ -2364,10 +2366,8 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data)
 		break;
 	}
 
-	if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER) {
-		hclgevf_clear_event_cause(hdev, clearval);
+	if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER)
 		hclgevf_enable_vector(&hdev->misc_vector, true);
-	}
 
 	return IRQ_HANDLED;
 }

From 49cf30ebb35c50234144dd2a34fe7a6d50b966e2 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Tue, 7 Sep 2021 19:54:59 -0700
Subject: [PATCH 0360/1750] mm/memory_hotplug: use "unsigned long" for PFN in
 zone_for_pfn_range()

commit 7cf209ba8a86410939a24cb1aeb279479a7e0ca6 upstream.

Patch series "mm/memory_hotplug: preparatory patches for new online policy and memory"

These are all cleanups and one fix previously sent as part of [1]:
[PATCH v1 00/12] mm/memory_hotplug: "auto-movable" online policy and memory
groups.

These patches make sense even without the other series, therefore I pulled
them out to make the other series easier to digest.

[1] https://lkml.kernel.org/r/20210607195430.48228-1-david@redhat.com

This patch (of 4):

Checkpatch complained on a follow-up patch that we are using "unsigned"
here, which defaults to "unsigned int" and checkpatch is correct.

As we will search for a fitting zone using the wrong pfn, we might end
up onlining memory to one of the special kernel zones, such as ZONE_DMA,
which can end badly as the onlined memory does not satisfy properties of
these zones.

Use "unsigned long" instead, just as we do in other places when handling
PFNs.  This can bite us once we have physical addresses in the range of
multiple TB.

Link: https://lkml.kernel.org/r/20210712124052.26491-2-david@redhat.com
Fixes: e5e689302633 ("mm, memory_hotplug: display allowed zones in the preferred ordering")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Pankaj Gupta <pankaj.gupta@ionos.com>
Reviewed-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@redhat.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Cc: Wei Yang <richard.weiyang@linux.alibaba.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: Len Brown <lenb@kernel.org>
Cc: Pavel Tatashin <pasha.tatashin@soleen.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: virtualization@lists.linux-foundation.org
Cc: Andy Lutomirski <luto@kernel.org>
Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
Cc: Anton Blanchard <anton@ozlabs.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Christophe Leroy <christophe.leroy@c-s.fr>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jia He <justin.he@arm.com>
Cc: Joe Perches <joe@perches.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Laurent Dufour <ldufour@linux.ibm.com>
Cc: Michel Lespinasse <michel@lespinasse.org>
Cc: Nathan Lynch <nathanl@linux.ibm.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Pierre Morel <pmorel@linux.ibm.com>
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Cc: Rich Felker <dalias@libc.org>
Cc: Scott Cheloha <cheloha@linux.ibm.com>
Cc: Sergei Trofimovich <slyfox@gentoo.org>
Cc: Thiago Jung Bauermann <bauerman@linux.ibm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Will Deacon <will@kernel.org>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/memory_hotplug.h | 4 ++--
 mm/memory_hotplug.c            | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 551093b74596..1dafc7c7f5cf 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -359,8 +359,8 @@ extern void sparse_remove_section(struct mem_section *ms,
 		unsigned long map_offset, struct vmem_altmap *altmap);
 extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map,
 					  unsigned long pnum);
-extern struct zone *zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
-		unsigned long nr_pages);
+extern struct zone *zone_for_pfn_range(int online_type, int nid,
+		unsigned long start_pfn, unsigned long nr_pages);
 #endif /* CONFIG_MEMORY_HOTPLUG */
 
 #endif /* __LINUX_MEMORY_HOTPLUG_H */
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index b9de2df5b835..6275b1c05f11 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -765,8 +765,8 @@ static inline struct zone *default_zone_for_pfn(int nid, unsigned long start_pfn
 	return movable_node_enabled ? movable_zone : kernel_zone;
 }
 
-struct zone * zone_for_pfn_range(int online_type, int nid, unsigned start_pfn,
-		unsigned long nr_pages)
+struct zone *zone_for_pfn_range(int online_type, int nid,
+		unsigned long start_pfn, unsigned long nr_pages)
 {
 	if (online_type == MMOP_ONLINE_KERNEL)
 		return default_kernel_zone_for_pfn(nid, start_pfn, nr_pages);

From 619f137ffd691708fec72c785db497fb85b16cd5 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Thu, 10 Jun 2021 16:39:45 +0200
Subject: [PATCH 0361/1750] dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB
 bytes equation

[ Upstream commit 778cb8e39f6ec252be50fc3850d66f3dcbd5dd5a ]

"PAGESIZE / 512" is the number of ECC chunks.
"ECC_BYTES" is the number of bytes needed to store a single ECC code.
"2" is the space reserved by the bad block marker.

"2 + (PAGESIZE / 512) * ECC_BYTES" should of course be lower or equal
than the total number of OOB bytes, otherwise it won't fit.

Fix the equation by substituting s/>=/<=/.

Suggested-by: Ryan J. Barnett <ryan.barnett@collins.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Acked-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/linux-mtd/20210610143945.3504781-1-miquel.raynal@bootlin.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/devicetree/bindings/mtd/gpmc-nand.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
index 44919d48d241..c459f169a904 100644
--- a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
+++ b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt
@@ -122,7 +122,7 @@ on various other factors also like;
 	so the device should have enough free bytes available its OOB/Spare
 	area to accommodate ECC for entire page. In general following expression
 	helps in determining if given device can accommodate ECC syndrome:
-	"2 + (PAGESIZE / 512) * ECC_BYTES" >= OOBSIZE"
+	"2 + (PAGESIZE / 512) * ECC_BYTES" <= OOBSIZE"
 	where
 		OOBSIZE		number of bytes in OOB/spare area
 		PAGESIZE	number of bytes in main-area of device page

From 7a44361a1f6ac2085e1fb64170a4342898b37f6b Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Mon, 2 Aug 2021 01:33:13 +0200
Subject: [PATCH 0362/1750] mfd: db8500-prcmu: Adjust map to reality

[ Upstream commit ec343111c056ec3847800302f6dbc57281f833fa ]

These are the actual frequencies reported by the PLL, so let's
report these. The roundoffs are inappropriate, we should round
to the frequency that the clock will later report.

Drop some whitespace at the same time.

Cc: phone-devel@vger.kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/db8500-prcmu.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index a5983d515db0..8d5f8f07d8a6 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -1622,22 +1622,20 @@ static long round_clock_rate(u8 clock, unsigned long rate)
 }
 
 static const unsigned long db8500_armss_freqs[] = {
-	200000000,
-	400000000,
-	800000000,
+	199680000,
+	399360000,
+	798720000,
 	998400000
 };
 
 /* The DB8520 has slightly higher ARMSS max frequency */
 static const unsigned long db8520_armss_freqs[] = {
-	200000000,
-	400000000,
-	800000000,
+	199680000,
+	399360000,
+	798720000,
 	1152000000
 };
 
-
-
 static long round_armss_rate(unsigned long rate)
 {
 	unsigned long freq = 0;

From 03cc3a2923d62f847d148f545c711f73f79617f0 Mon Sep 17 00:00:00 2001
From: Wasim Khan <wasim.khan@nxp.com>
Date: Thu, 29 Jul 2021 14:17:47 +0200
Subject: [PATCH 0363/1750] PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2
 platforms

[ Upstream commit d08c8b855140e9f5240b3ffd1b8b9d435675e281 ]

Root Ports in NXP LX2xx0 and LX2xx2, where each Root Port is a Root Complex
with unique segment numbers, do provide isolation features to disable peer
transactions and validate bus numbers in requests, but do not provide an
actual PCIe ACS capability.

Add ACS quirks for NXP LX2xx0 A/C/E/N and LX2xx2 A/C/E/N platforms.

  LX2xx0A : without security features + CAN-FD
    LX2160A (0x8d81) - 16 cores
    LX2120A (0x8da1) - 12 cores
    LX2080A (0x8d83) -  8 cores

  LX2xx0C : security features + CAN-FD
    LX2160C (0x8d80) - 16 cores
    LX2120C (0x8da0) - 12 cores
    LX2080C (0x8d82) -  8 cores

  LX2xx0E : security features + CAN
    LX2160E (0x8d90) - 16 cores
    LX2120E (0x8db0) - 12 cores
    LX2080E (0x8d92) -  8 cores

  LX2xx0N : without security features + CAN
    LX2160N (0x8d91) - 16 cores
    LX2120N (0x8db1) - 12 cores
    LX2080N (0x8d93) -  8 cores

  LX2xx2A : without security features + CAN-FD
    LX2162A (0x8d89) - 16 cores
    LX2122A (0x8da9) - 12 cores
    LX2082A (0x8d8b) -  8 cores

  LX2xx2C : security features + CAN-FD
    LX2162C (0x8d88) - 16 cores
    LX2122C (0x8da8) - 12 cores
    LX2082C (0x8d8a) -  8 cores

  LX2xx2E : security features + CAN
    LX2162E (0x8d98) - 16 cores
    LX2122E (0x8db8) - 12 cores
    LX2082E (0x8d9a) -  8 cores

  LX2xx2N : without security features + CAN
    LX2162N (0x8d99) - 16 cores
    LX2122N (0x8db9) - 12 cores
    LX2082N (0x8d9b) -  8 cores

[bhelgaas: put PCI_VENDOR_ID_NXP definition next to PCI_VENDOR_ID_FREESCALE
as a clue that they share the same Device ID namespace]
Link: https://lore.kernel.org/r/20210729121747.1823086-1-wasim.khan@oss.nxp.com
Link: https://lore.kernel.org/r/20210803180021.3252886-1-wasim.khan@oss.nxp.com
Signed-off-by: Wasim Khan <wasim.khan@nxp.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c    | 45 +++++++++++++++++++++++++++++++++++++++++
 include/linux/pci_ids.h |  3 ++-
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8dac8dcc02c6..f2e95944f681 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4626,6 +4626,18 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
 		PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
 }
 
+/*
+ * Each of these NXP Root Ports is in a Root Complex with a unique segment
+ * number and does provide isolation features to disable peer transactions
+ * and validate bus numbers in requests, but does not provide an ACS
+ * capability.
+ */
+static int pci_quirk_nxp_rp_acs(struct pci_dev *dev, u16 acs_flags)
+{
+	return pci_acs_ctrl_enabled(acs_flags,
+		PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
+}
+
 static int pci_quirk_al_acs(struct pci_dev *dev, u16 acs_flags)
 {
 	if (pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT)
@@ -4872,6 +4884,39 @@ static const struct pci_dev_acs_enabled {
 	{ PCI_VENDOR_ID_ZHAOXIN, 0x3038, pci_quirk_mf_endpoint_acs },
 	{ PCI_VENDOR_ID_ZHAOXIN, 0x3104, pci_quirk_mf_endpoint_acs },
 	{ PCI_VENDOR_ID_ZHAOXIN, 0x9083, pci_quirk_mf_endpoint_acs },
+	/* NXP root ports, xx=16, 12, or 08 cores */
+	/* LX2xx0A : without security features + CAN-FD */
+	{ PCI_VENDOR_ID_NXP, 0x8d81, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8da1, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d83, pci_quirk_nxp_rp_acs },
+	/* LX2xx0C : security features + CAN-FD */
+	{ PCI_VENDOR_ID_NXP, 0x8d80, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8da0, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d82, pci_quirk_nxp_rp_acs },
+	/* LX2xx0E : security features + CAN */
+	{ PCI_VENDOR_ID_NXP, 0x8d90, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8db0, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d92, pci_quirk_nxp_rp_acs },
+	/* LX2xx0N : without security features + CAN */
+	{ PCI_VENDOR_ID_NXP, 0x8d91, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8db1, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d93, pci_quirk_nxp_rp_acs },
+	/* LX2xx2A : without security features + CAN-FD */
+	{ PCI_VENDOR_ID_NXP, 0x8d89, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8da9, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d8b, pci_quirk_nxp_rp_acs },
+	/* LX2xx2C : security features + CAN-FD */
+	{ PCI_VENDOR_ID_NXP, 0x8d88, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8da8, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d8a, pci_quirk_nxp_rp_acs },
+	/* LX2xx2E : security features + CAN */
+	{ PCI_VENDOR_ID_NXP, 0x8d98, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8db8, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d9a, pci_quirk_nxp_rp_acs },
+	/* LX2xx2N : without security features + CAN */
+	{ PCI_VENDOR_ID_NXP, 0x8d99, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8db9, pci_quirk_nxp_rp_acs },
+	{ PCI_VENDOR_ID_NXP, 0x8d9b, pci_quirk_nxp_rp_acs },
 	/* Zhaoxin Root/Downstream Ports */
 	{ PCI_VENDOR_ID_ZHAOXIN, PCI_ANY_ID, pci_quirk_zhaoxin_pcie_ports_acs },
 	{ 0 }
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 1ab1e24bcbce..635a9243cce0 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2476,7 +2476,8 @@
 #define PCI_VENDOR_ID_TDI               0x192E
 #define PCI_DEVICE_ID_TDI_EHCI          0x0101
 
-#define PCI_VENDOR_ID_FREESCALE		0x1957
+#define PCI_VENDOR_ID_FREESCALE		0x1957	/* duplicate: NXP */
+#define PCI_VENDOR_ID_NXP		0x1957	/* duplicate: FREESCALE */
 #define PCI_DEVICE_ID_MPC8308		0xc006
 #define PCI_DEVICE_ID_MPC8315E		0x00b4
 #define PCI_DEVICE_ID_MPC8315		0x00b5

From b7d4f310bb8f605cff7c4c70014a9e2b866625c4 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Wed, 4 Aug 2021 13:22:58 +0200
Subject: [PATCH 0364/1750] fuse: fix use after free in fuse_read_interrupt()

[ Upstream commit e1e71c168813564be0f6ea3d6740a059ca42d177 ]

There is a potential race between fuse_read_interrupt() and
fuse_request_end().

TASK1
  in fuse_read_interrupt(): delete req->intr_entry (while holding
  fiq->lock)

TASK2
  in fuse_request_end(): req->intr_entry is empty -> skip fiq->lock
  wake up TASK3

TASK3
  request is freed

TASK1
  in fuse_read_interrupt(): dereference req->in.h.unique ***BAM***

Fix by always grabbing fiq->lock if the request was ever interrupted
(FR_INTERRUPTED set) thereby serializing with concurrent
fuse_read_interrupt() calls.

FR_INTERRUPTED is set before the request is queued on fiq->interrupts.
Dequeing the request is done with list_del_init() but FR_INTERRUPTED is not
cleared in this case.

Reported-by: lijiazi <lijiazi@xiaomi.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fuse/dev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 4140d5c3ab5a..f943eea9fe4e 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -288,10 +288,10 @@ void fuse_request_end(struct fuse_req *req)
 
 	/*
 	 * test_and_set_bit() implies smp_mb() between bit
-	 * changing and below intr_entry check. Pairs with
+	 * changing and below FR_INTERRUPTED check. Pairs with
 	 * smp_mb() from queue_interrupt().
 	 */
-	if (!list_empty(&req->intr_entry)) {
+	if (test_bit(FR_INTERRUPTED, &req->flags)) {
 		spin_lock(&fiq->lock);
 		list_del_init(&req->intr_entry);
 		spin_unlock(&fiq->lock);

From 13f366bab07724d12c8ed73977870c0a9e964ad7 Mon Sep 17 00:00:00 2001
From: Om Prakash Singh <omp@nvidia.com>
Date: Wed, 23 Jun 2021 15:35:21 +0530
Subject: [PATCH 0365/1750] PCI: tegra194: Fix handling BME_CHGED event

[ Upstream commit ceb1412c1c8ca5b28c4252bdb15f2f1f17b4a1b0 ]

In tegra_pcie_ep_hard_irq(), APPL_INTR_STATUS_L0 is stored in val and again
APPL_INTR_STATUS_L1_0_0 is also stored in val. So when execution reaches
"if (val & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT)", val is not correct.

Link: https://lore.kernel.org/r/20210623100525.19944-2-omp@nvidia.com
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Vidya Sagar <vidyas@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pcie-tegra194.c | 30 +++++++++++-----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index 506f6a294eac..c2827a8d208f 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -515,19 +515,19 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg)
 	struct tegra_pcie_dw *pcie = arg;
 	struct dw_pcie_ep *ep = &pcie->pci.ep;
 	int spurious = 1;
-	u32 val, tmp;
+	u32 status_l0, status_l1, link_status;
 
-	val = appl_readl(pcie, APPL_INTR_STATUS_L0);
-	if (val & APPL_INTR_STATUS_L0_LINK_STATE_INT) {
-		val = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0);
-		appl_writel(pcie, val, APPL_INTR_STATUS_L1_0_0);
+	status_l0 = appl_readl(pcie, APPL_INTR_STATUS_L0);
+	if (status_l0 & APPL_INTR_STATUS_L0_LINK_STATE_INT) {
+		status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_0_0);
+		appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_0_0);
 
-		if (val & APPL_INTR_STATUS_L1_0_0_HOT_RESET_DONE)
+		if (status_l1 & APPL_INTR_STATUS_L1_0_0_HOT_RESET_DONE)
 			pex_ep_event_hot_rst_done(pcie);
 
-		if (val & APPL_INTR_STATUS_L1_0_0_RDLH_LINK_UP_CHGED) {
-			tmp = appl_readl(pcie, APPL_LINK_STATUS);
-			if (tmp & APPL_LINK_STATUS_RDLH_LINK_UP) {
+		if (status_l1 & APPL_INTR_STATUS_L1_0_0_RDLH_LINK_UP_CHGED) {
+			link_status = appl_readl(pcie, APPL_LINK_STATUS);
+			if (link_status & APPL_LINK_STATUS_RDLH_LINK_UP) {
 				dev_dbg(pcie->dev, "Link is up with Host\n");
 				dw_pcie_ep_linkup(ep);
 			}
@@ -536,11 +536,11 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg)
 		spurious = 0;
 	}
 
-	if (val & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT) {
-		val = appl_readl(pcie, APPL_INTR_STATUS_L1_15);
-		appl_writel(pcie, val, APPL_INTR_STATUS_L1_15);
+	if (status_l0 & APPL_INTR_STATUS_L0_PCI_CMD_EN_INT) {
+		status_l1 = appl_readl(pcie, APPL_INTR_STATUS_L1_15);
+		appl_writel(pcie, status_l1, APPL_INTR_STATUS_L1_15);
 
-		if (val & APPL_INTR_STATUS_L1_15_CFG_BME_CHGED)
+		if (status_l1 & APPL_INTR_STATUS_L1_15_CFG_BME_CHGED)
 			return IRQ_WAKE_THREAD;
 
 		spurious = 0;
@@ -548,8 +548,8 @@ static irqreturn_t tegra_pcie_ep_hard_irq(int irq, void *arg)
 
 	if (spurious) {
 		dev_warn(pcie->dev, "Random interrupt (STATUS = 0x%08X)\n",
-			 val);
-		appl_writel(pcie, val, APPL_INTR_STATUS_L0);
+			 status_l0);
+		appl_writel(pcie, status_l0, APPL_INTR_STATUS_L0);
 	}
 
 	return IRQ_HANDLED;

From d5c5d1b141faee0be01c93f48f2b714838004ef1 Mon Sep 17 00:00:00 2001
From: Om Prakash Singh <omp@nvidia.com>
Date: Wed, 23 Jun 2021 15:35:22 +0530
Subject: [PATCH 0366/1750] PCI: tegra194: Fix MSI-X programming

[ Upstream commit 43537cf7e351264a1f05ed42ad402942bfc9140e ]

Lower order MSI-X address is programmed in MSIX_ADDR_MATCH_HIGH_OFF
DBI register instead of higher order address. This patch fixes this
programming mistake.

Link: https://lore.kernel.org/r/20210623100525.19944-3-omp@nvidia.com
Signed-off-by: Om Prakash Singh <omp@nvidia.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Vidya Sagar <vidyas@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pcie-tegra194.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/dwc/pcie-tegra194.c b/drivers/pci/controller/dwc/pcie-tegra194.c
index c2827a8d208f..a5b677ec0769 100644
--- a/drivers/pci/controller/dwc/pcie-tegra194.c
+++ b/drivers/pci/controller/dwc/pcie-tegra194.c
@@ -1778,7 +1778,7 @@ static void pex_ep_event_pex_rst_deassert(struct tegra_pcie_dw *pcie)
 	val = (ep->msi_mem_phys & MSIX_ADDR_MATCH_LOW_OFF_MASK);
 	val |= MSIX_ADDR_MATCH_LOW_OFF_EN;
 	dw_pcie_writel_dbi(pci, MSIX_ADDR_MATCH_LOW_OFF, val);
-	val = (lower_32_bits(ep->msi_mem_phys) & MSIX_ADDR_MATCH_HIGH_OFF_MASK);
+	val = (upper_32_bits(ep->msi_mem_phys) & MSIX_ADDR_MATCH_HIGH_OFF_MASK);
 	dw_pcie_writel_dbi(pci, MSIX_ADDR_MATCH_HIGH_OFF, val);
 
 	ret = dw_pcie_ep_init_complete(ep);

From aa638669c8a47f856eb4a096ca4f18d612f6cd95 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Tue, 4 May 2021 19:17:42 +0200
Subject: [PATCH 0367/1750] PCI: tegra: Fix OF node reference leak

[ Upstream commit eff21f5da308265678e7e59821795e606f3e560f ]

Commit 9e38e690ace3 ("PCI: tegra: Fix OF node reference leak") has fixed
some node reference leaks in this function but missed some of them.

In fact, having 'port' referenced in the 'rp' structure is not enough to
prevent the leak, until 'rp' is actually added in the 'pcie->ports' list.

Add the missing 'goto err_node_put' accordingly.

Link: https://lore.kernel.org/r/55b11e9a7fa2987fbc0869d68ae59888954d65e2.1620148539.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Vidya Sagar <vidyas@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pci-tegra.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
index 1a2af963599c..b4eb75f25906 100644
--- a/drivers/pci/controller/pci-tegra.c
+++ b/drivers/pci/controller/pci-tegra.c
@@ -2160,13 +2160,15 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
 		rp->np = port;
 
 		rp->base = devm_pci_remap_cfg_resource(dev, &rp->regs);
-		if (IS_ERR(rp->base))
-			return PTR_ERR(rp->base);
+		if (IS_ERR(rp->base)) {
+			err = PTR_ERR(rp->base);
+			goto err_node_put;
+		}
 
 		label = devm_kasprintf(dev, GFP_KERNEL, "pex-reset-%u", index);
 		if (!label) {
-			dev_err(dev, "failed to create reset GPIO label\n");
-			return -ENOMEM;
+			err = -ENOMEM;
+			goto err_node_put;
 		}
 
 		/*
@@ -2184,7 +2186,8 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
 			} else {
 				dev_err(dev, "failed to get reset GPIO: %ld\n",
 					PTR_ERR(rp->reset_gpio));
-				return PTR_ERR(rp->reset_gpio);
+				err = PTR_ERR(rp->reset_gpio);
+				goto err_node_put;
 			}
 		}
 

From b6352e2e276469ce756e5d698ea95855535e62a4 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Sun, 25 Jul 2021 19:07:54 +0100
Subject: [PATCH 0368/1750] mfd: Don't use irq_create_mapping() to resolve a
 mapping

[ Upstream commit 9ff80e2de36d0554e3a6da18a171719fe8663c17 ]

Although irq_create_mapping() is able to deal with duplicate
mappings, it really isn't supposed to be a substitute for
irq_find_mapping(), and can result in allocations that take place
in atomic context if the mapping didn't exist.

Fix the handful of MFD drivers that use irq_create_mapping() in
interrupt context by using irq_find_mapping() instead.

Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: Lee Jones <lee.jones@linaro.org>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/ab8500-core.c | 2 +-
 drivers/mfd/stmpe.c       | 4 ++--
 drivers/mfd/tc3589x.c     | 2 +-
 drivers/mfd/wm8994-irq.c  | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index a3bac9da8cbb..4cea63a4cab7 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -493,7 +493,7 @@ static int ab8500_handle_hierarchical_line(struct ab8500 *ab8500,
 		if (line == AB8540_INT_GPIO43F || line == AB8540_INT_GPIO44F)
 			line += 1;
 
-		handle_nested_irq(irq_create_mapping(ab8500->domain, line));
+		handle_nested_irq(irq_find_mapping(ab8500->domain, line));
 	}
 
 	return 0;
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 1aee3b3253fc..508349399f8a 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -1091,7 +1091,7 @@ static irqreturn_t stmpe_irq(int irq, void *data)
 
 	if (variant->id_val == STMPE801_ID ||
 	    variant->id_val == STMPE1600_ID) {
-		int base = irq_create_mapping(stmpe->domain, 0);
+		int base = irq_find_mapping(stmpe->domain, 0);
 
 		handle_nested_irq(base);
 		return IRQ_HANDLED;
@@ -1119,7 +1119,7 @@ static irqreturn_t stmpe_irq(int irq, void *data)
 		while (status) {
 			int bit = __ffs(status);
 			int line = bank * 8 + bit;
-			int nestedirq = irq_create_mapping(stmpe->domain, line);
+			int nestedirq = irq_find_mapping(stmpe->domain, line);
 
 			handle_nested_irq(nestedirq);
 			status &= ~(1 << bit);
diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c
index 7882a37ffc35..5c2d5a6a6da9 100644
--- a/drivers/mfd/tc3589x.c
+++ b/drivers/mfd/tc3589x.c
@@ -187,7 +187,7 @@ static irqreturn_t tc3589x_irq(int irq, void *data)
 
 	while (status) {
 		int bit = __ffs(status);
-		int virq = irq_create_mapping(tc3589x->domain, bit);
+		int virq = irq_find_mapping(tc3589x->domain, bit);
 
 		handle_nested_irq(virq);
 		status &= ~(1 << bit);
diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c
index 6c3a619e2628..651a028bc519 100644
--- a/drivers/mfd/wm8994-irq.c
+++ b/drivers/mfd/wm8994-irq.c
@@ -154,7 +154,7 @@ static irqreturn_t wm8994_edge_irq(int irq, void *data)
 	struct wm8994 *wm8994 = data;
 
 	while (gpio_get_value_cansleep(wm8994->pdata.irq_gpio))
-		handle_nested_irq(irq_create_mapping(wm8994->edge_irq, 0));
+		handle_nested_irq(irq_find_mapping(wm8994->edge_irq, 0));
 
 	return IRQ_HANDLED;
 }

From 75420f9400a6792dc4b43e5a43ee0f105dd3f9ee Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Thu, 8 Apr 2021 15:24:02 +0800
Subject: [PATCH 0369/1750] PCI: rcar: Fix runtime PM imbalance in
 rcar_pcie_ep_probe()

[ Upstream commit 1e29cd9983eba1b596bc07f94d81d728007f8a25 ]

pm_runtime_get_sync() will increase the runtime PM counter
even it returns an error. Thus a pairing decrement is needed
to prevent refcount leak. Fix this by replacing this API with
pm_runtime_resume_and_get(), which will not change the runtime
PM counter on error.

Link: https://lore.kernel.org/r/20210408072402.15069-1-dinghao.liu@zju.edu.cn
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-rcar-ep.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c
index b4a288e24aaf..c91d85b15129 100644
--- a/drivers/pci/controller/pcie-rcar-ep.c
+++ b/drivers/pci/controller/pcie-rcar-ep.c
@@ -492,9 +492,9 @@ static int rcar_pcie_ep_probe(struct platform_device *pdev)
 	pcie->dev = dev;
 
 	pm_runtime_enable(dev);
-	err = pm_runtime_get_sync(dev);
+	err = pm_runtime_resume_and_get(dev);
 	if (err < 0) {
-		dev_err(dev, "pm_runtime_get_sync failed\n");
+		dev_err(dev, "pm_runtime_resume_and_get failed\n");
 		goto err_pm_disable;
 	}
 

From 3aedfe4b080026157a36bf2be6495e158c7d0c62 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Thu, 19 Aug 2021 19:26:02 +0900
Subject: [PATCH 0370/1750] tracing/probes: Reject events which have the same
 name of existing one

[ Upstream commit 8e242060c6a4947e8ae7d29794af6a581db08841 ]

Since kprobe_events and uprobe_events only check whether the
other same-type probe event has the same name or not, if the
user gives the same name of the existing tracepoint event (or
the other type of probe events), it silently fails to create
the tracefs entry (but registered.) as below.

/sys/kernel/tracing # ls events/task/task_rename
enable   filter   format   hist     id       trigger
/sys/kernel/tracing # echo p:task/task_rename vfs_read >> kprobe_events
[  113.048508] Could not create tracefs 'task_rename' directory
/sys/kernel/tracing # cat kprobe_events
p:task/task_rename vfs_read

To fix this issue, check whether the existing events have the
same name or not in trace_probe_register_event_call(). If exists,
it rejects to register the new event.

Link: https://lkml.kernel.org/r/162936876189.187130.17558311387542061930.stgit@devnote2

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_kprobe.c |  6 +++++-
 kernel/trace/trace_probe.c  | 25 +++++++++++++++++++++++++
 kernel/trace/trace_probe.h  |  1 +
 kernel/trace/trace_uprobe.c |  6 +++++-
 4 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 68150b9cbde9..552dbc9d5226 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -647,7 +647,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk)
 	/* Register new event */
 	ret = register_kprobe_event(tk);
 	if (ret) {
-		pr_warn("Failed to register probe event(%d)\n", ret);
+		if (ret == -EEXIST) {
+			trace_probe_log_set_index(0);
+			trace_probe_log_err(0, EVENT_EXIST);
+		} else
+			pr_warn("Failed to register probe event(%d)\n", ret);
 		goto end;
 	}
 
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index d2867ccc6aca..1d31bc4acf7a 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -1029,11 +1029,36 @@ int trace_probe_init(struct trace_probe *tp, const char *event,
 	return ret;
 }
 
+static struct trace_event_call *
+find_trace_event_call(const char *system, const char *event_name)
+{
+	struct trace_event_call *tp_event;
+	const char *name;
+
+	list_for_each_entry(tp_event, &ftrace_events, list) {
+		if (!tp_event->class->system ||
+		    strcmp(system, tp_event->class->system))
+			continue;
+		name = trace_event_name(tp_event);
+		if (!name || strcmp(event_name, name))
+			continue;
+		return tp_event;
+	}
+
+	return NULL;
+}
+
 int trace_probe_register_event_call(struct trace_probe *tp)
 {
 	struct trace_event_call *call = trace_probe_event_call(tp);
 	int ret;
 
+	lockdep_assert_held(&event_mutex);
+
+	if (find_trace_event_call(trace_probe_group_name(tp),
+				  trace_probe_name(tp)))
+		return -EEXIST;
+
 	ret = register_trace_event(&call->event);
 	if (!ret)
 		return -ENODEV;
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 2f703a20c724..6d41e20c47ce 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -398,6 +398,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
 	C(NO_EVENT_NAME,	"Event name is not specified"),		\
 	C(EVENT_TOO_LONG,	"Event name is too long"),		\
 	C(BAD_EVENT_NAME,	"Event name must follow the same rules as C identifiers"), \
+	C(EVENT_EXIST,		"Given group/event name is already used by another event"), \
 	C(RETVAL_ON_PROBE,	"$retval is not available on probe"),	\
 	C(BAD_STACK_NUM,	"Invalid stack number"),		\
 	C(BAD_ARG_NUM,		"Invalid argument number"),		\
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 3cf7128e1ad3..0dd6e286e519 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -514,7 +514,11 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
 
 	ret = register_uprobe_event(tu);
 	if (ret) {
-		pr_warn("Failed to register probe event(%d)\n", ret);
+		if (ret == -EEXIST) {
+			trace_probe_log_set_index(0);
+			trace_probe_log_err(0, EVENT_EXIST);
+		} else
+			pr_warn("Failed to register probe event(%d)\n", ret);
 		goto end;
 	}
 

From a83e032cc48981a77c9fead708fc0f49ad842085 Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Wed, 11 Aug 2021 18:03:32 +0530
Subject: [PATCH 0371/1750] PCI: cadence: Use bitfield for *quirk_retrain_flag*
 instead of bool

[ Upstream commit f4455748b2126a9ba2bcc9cfb2fbcaa08de29bb2 ]

No functional change. As we are intending to add additional 1-bit
members in struct j721e_pcie_data/struct cdns_pcie_rc, use bitfields
instead of bool since it takes less space. As discussed in [1],
the preference is to use bitfileds instead of bool inside structures.

[1] -> https://lore.kernel.org/linux-fsdevel/CA+55aFzKQ6Pj18TB8p4Yr0M4t+S+BsiHH=BJNmn=76-NcjTj-g@mail.gmail.com/

Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://lore.kernel.org/r/20210811123336.31357-2-kishon@ti.com
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/cadence/pci-j721e.c    | 2 +-
 drivers/pci/controller/cadence/pcie-cadence.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
index d34ca0fda0f6..973b309ac9ba 100644
--- a/drivers/pci/controller/cadence/pci-j721e.c
+++ b/drivers/pci/controller/cadence/pci-j721e.c
@@ -63,7 +63,7 @@ enum j721e_pcie_mode {
 
 struct j721e_pcie_data {
 	enum j721e_pcie_mode	mode;
-	bool quirk_retrain_flag;
+	unsigned int		quirk_retrain_flag:1;
 };
 
 static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset)
diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
index 6705a5fedfbb..60981877f65b 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.h
+++ b/drivers/pci/controller/cadence/pcie-cadence.h
@@ -299,7 +299,7 @@ struct cdns_pcie_rc {
 	u32			vendor_id;
 	u32			device_id;
 	bool			avail_ib_bar[CDNS_PCIE_RP_MAX_IB];
-	bool                    quirk_retrain_flag;
+	unsigned int		quirk_retrain_flag:1;
 };
 
 /**

From 4892b1515b402b9279ad747f28b087bbdafc1412 Mon Sep 17 00:00:00 2001
From: Nadeem Athani <nadeem@cadence.com>
Date: Wed, 11 Aug 2021 18:03:33 +0530
Subject: [PATCH 0372/1750] PCI: cadence: Add quirk flag to set minimum delay
 in LTSSM Detect.Quiet state

[ Upstream commit 09c24094b2e3a15ef3fc44f54a191b3db522fb11 ]

PCIe fails to link up if SERDES lanes not used by PCIe are assigned to
another protocol. For example, link training fails if lanes 2 and 3 are
assigned to another protocol while lanes 0 and 1 are used for PCIe to
form a two lane link. This failure is due to an incorrect tie-off on an
internal status signal indicating electrical idle.

Status signals going from SERDES to PCIe Controller are tied-off when a
lane is not assigned to PCIe. Signal indicating electrical idle is
incorrectly tied-off to a state that indicates non-idle. As a result,
PCIe sees unused lanes to be out of electrical idle and this causes
LTSSM to exit Detect.Quiet state without waiting for 12ms timeout to
occur. If a receiver is not detected on the first receiver detection
attempt in Detect.Active state, LTSSM goes back to Detect.Quiet and
again moves forward to Detect.Active state without waiting for 12ms as
required by PCIe base specification. Since wait time in Detect.Quiet is
skipped, multiple receiver detect operations are performed back-to-back
without allowing time for capacitance on the transmit lines to
discharge. This causes subsequent receiver detection to always fail even
if a receiver gets connected eventually.

Add a quirk flag "quirk_detect_quiet_flag" to program the minimum
time the LTSSM should wait on entering Detect.Quiet state here.
This has to be set for J7200 as it has an incorrect tie-off on unused
lanes.

Link: https://lore.kernel.org/r/20210811123336.31357-3-kishon@ti.com
Signed-off-by: Nadeem Athani <nadeem@cadence.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/cadence/pcie-cadence-ep.c |  4 ++++
 .../pci/controller/cadence/pcie-cadence-host.c   |  3 +++
 drivers/pci/controller/cadence/pcie-cadence.c    | 16 ++++++++++++++++
 drivers/pci/controller/cadence/pcie-cadence.h    | 15 +++++++++++++++
 4 files changed, 38 insertions(+)

diff --git a/drivers/pci/controller/cadence/pcie-cadence-ep.c b/drivers/pci/controller/cadence/pcie-cadence-ep.c
index 84cc58dc8512..1af14474abcf 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-ep.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-ep.c
@@ -578,6 +578,10 @@ int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep)
 	ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE;
 	/* Reserve region 0 for IRQs */
 	set_bit(0, &ep->ob_region_map);
+
+	if (ep->quirk_detect_quiet_flag)
+		cdns_pcie_detect_quiet_min_delay_set(&ep->pcie);
+
 	spin_lock_init(&ep->lock);
 
 	return 0;
diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index 73dcf8cf98fb..a40ed9e12b4b 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -497,6 +497,9 @@ int cdns_pcie_host_setup(struct cdns_pcie_rc *rc)
 		return PTR_ERR(rc->cfg_base);
 	rc->cfg_res = res;
 
+	if (rc->quirk_detect_quiet_flag)
+		cdns_pcie_detect_quiet_min_delay_set(&rc->pcie);
+
 	ret = cdns_pcie_start_link(pcie);
 	if (ret) {
 		dev_err(dev, "Failed to start link\n");
diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
index 3c3646502d05..52767f26048f 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.c
+++ b/drivers/pci/controller/cadence/pcie-cadence.c
@@ -7,6 +7,22 @@
 
 #include "pcie-cadence.h"
 
+void cdns_pcie_detect_quiet_min_delay_set(struct cdns_pcie *pcie)
+{
+	u32 delay = 0x3;
+	u32 ltssm_control_cap;
+
+	/*
+	 * Set the LTSSM Detect Quiet state min. delay to 2ms.
+	 */
+	ltssm_control_cap = cdns_pcie_readl(pcie, CDNS_PCIE_LTSSM_CONTROL_CAP);
+	ltssm_control_cap = ((ltssm_control_cap &
+			    ~CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK) |
+			    CDNS_PCIE_DETECT_QUIET_MIN_DELAY(delay));
+
+	cdns_pcie_writel(pcie, CDNS_PCIE_LTSSM_CONTROL_CAP, ltssm_control_cap);
+}
+
 void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
 				   u32 r, bool is_io,
 				   u64 cpu_addr, u64 pci_addr, size_t size)
diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
index 60981877f65b..e0b59730bffb 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.h
+++ b/drivers/pci/controller/cadence/pcie-cadence.h
@@ -189,6 +189,14 @@
 /* AXI link down register */
 #define CDNS_PCIE_AT_LINKDOWN (CDNS_PCIE_AT_BASE + 0x0824)
 
+/* LTSSM Capabilities register */
+#define CDNS_PCIE_LTSSM_CONTROL_CAP             (CDNS_PCIE_LM_BASE + 0x0054)
+#define  CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK  GENMASK(2, 1)
+#define  CDNS_PCIE_DETECT_QUIET_MIN_DELAY_SHIFT 1
+#define  CDNS_PCIE_DETECT_QUIET_MIN_DELAY(delay) \
+	 (((delay) << CDNS_PCIE_DETECT_QUIET_MIN_DELAY_SHIFT) & \
+	 CDNS_PCIE_DETECT_QUIET_MIN_DELAY_MASK)
+
 enum cdns_pcie_rp_bar {
 	RP_BAR_UNDEFINED = -1,
 	RP_BAR0,
@@ -291,6 +299,7 @@ struct cdns_pcie {
  * @avail_ib_bar: Satus of RP_BAR0, RP_BAR1 and	RP_NO_BAR if it's free or
  *                available
  * @quirk_retrain_flag: Retrain link as quirk for PCIe Gen2
+ * @quirk_detect_quiet_flag: LTSSM Detect Quiet min delay set as quirk
  */
 struct cdns_pcie_rc {
 	struct cdns_pcie	pcie;
@@ -300,6 +309,7 @@ struct cdns_pcie_rc {
 	u32			device_id;
 	bool			avail_ib_bar[CDNS_PCIE_RP_MAX_IB];
 	unsigned int		quirk_retrain_flag:1;
+	unsigned int		quirk_detect_quiet_flag:1;
 };
 
 /**
@@ -330,6 +340,7 @@ struct cdns_pcie_epf {
  *        registers fields (RMW) accessible by both remote RC and EP to
  *        minimize time between read and write
  * @epf: Structure to hold info about endpoint function
+ * @quirk_detect_quiet_flag: LTSSM Detect Quiet min delay set as quirk
  */
 struct cdns_pcie_ep {
 	struct cdns_pcie	pcie;
@@ -344,6 +355,7 @@ struct cdns_pcie_ep {
 	/* protect writing to PCI_STATUS while raising legacy interrupts */
 	spinlock_t		lock;
 	struct cdns_pcie_epf	*epf;
+	unsigned int		quirk_detect_quiet_flag:1;
 };
 
 
@@ -504,6 +516,9 @@ static inline int cdns_pcie_ep_setup(struct cdns_pcie_ep *ep)
 	return 0;
 }
 #endif
+
+void cdns_pcie_detect_quiet_min_delay_set(struct cdns_pcie *pcie);
+
 void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
 				   u32 r, bool is_io,
 				   u64 cpu_addr, u64 pci_addr, size_t size);

From 81381b72f40ca6632402f5cc6dda789b1b6f6310 Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Wed, 11 Aug 2021 18:03:34 +0530
Subject: [PATCH 0373/1750] PCI: j721e: Add PCIe support for J7200

[ Upstream commit f1de58802f0fff364cf49f5e47d1be744baa434f ]

J7200 has the same PCIe IP as in J721E with minor changes in the
wrapper. J7200 allows byte access of bridge configuration space
registers and the register field for LINK_DOWN interrupt is different.
J7200 also requires "quirk_detect_quiet_flag" to be set. Configure these
changes as part of driver data applicable only to J7200.

Link: https://lore.kernel.org/r/20210811123336.31357-4-kishon@ti.com
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/cadence/pci-j721e.c | 40 +++++++++++++++++++---
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
index 973b309ac9ba..2f5a49c77074 100644
--- a/drivers/pci/controller/cadence/pci-j721e.c
+++ b/drivers/pci/controller/cadence/pci-j721e.c
@@ -25,6 +25,7 @@
 #define STATUS_REG_SYS_2	0x508
 #define STATUS_CLR_REG_SYS_2	0x708
 #define LINK_DOWN		BIT(1)
+#define J7200_LINK_DOWN		BIT(10)
 
 #define J721E_PCIE_USER_CMD_STATUS	0x4
 #define LINK_TRAINING_ENABLE		BIT(0)
@@ -54,6 +55,7 @@ struct j721e_pcie {
 	struct cdns_pcie	*cdns_pcie;
 	void __iomem		*user_cfg_base;
 	void __iomem		*intd_cfg_base;
+	u32			linkdown_irq_regfield;
 };
 
 enum j721e_pcie_mode {
@@ -64,6 +66,9 @@ enum j721e_pcie_mode {
 struct j721e_pcie_data {
 	enum j721e_pcie_mode	mode;
 	unsigned int		quirk_retrain_flag:1;
+	unsigned int		quirk_detect_quiet_flag:1;
+	u32			linkdown_irq_regfield;
+	unsigned int		byte_access_allowed:1;
 };
 
 static inline u32 j721e_pcie_user_readl(struct j721e_pcie *pcie, u32 offset)
@@ -95,12 +100,12 @@ static irqreturn_t j721e_pcie_link_irq_handler(int irq, void *priv)
 	u32 reg;
 
 	reg = j721e_pcie_intd_readl(pcie, STATUS_REG_SYS_2);
-	if (!(reg & LINK_DOWN))
+	if (!(reg & pcie->linkdown_irq_regfield))
 		return IRQ_NONE;
 
 	dev_err(dev, "LINK DOWN!\n");
 
-	j721e_pcie_intd_writel(pcie, STATUS_CLR_REG_SYS_2, LINK_DOWN);
+	j721e_pcie_intd_writel(pcie, STATUS_CLR_REG_SYS_2, pcie->linkdown_irq_regfield);
 	return IRQ_HANDLED;
 }
 
@@ -109,7 +114,7 @@ static void j721e_pcie_config_link_irq(struct j721e_pcie *pcie)
 	u32 reg;
 
 	reg = j721e_pcie_intd_readl(pcie, ENABLE_REG_SYS_2);
-	reg |= LINK_DOWN;
+	reg |= pcie->linkdown_irq_regfield;
 	j721e_pcie_intd_writel(pcie, ENABLE_REG_SYS_2, reg);
 }
 
@@ -272,10 +277,25 @@ static struct pci_ops cdns_ti_pcie_host_ops = {
 static const struct j721e_pcie_data j721e_pcie_rc_data = {
 	.mode = PCI_MODE_RC,
 	.quirk_retrain_flag = true,
+	.byte_access_allowed = false,
+	.linkdown_irq_regfield = LINK_DOWN,
 };
 
 static const struct j721e_pcie_data j721e_pcie_ep_data = {
 	.mode = PCI_MODE_EP,
+	.linkdown_irq_regfield = LINK_DOWN,
+};
+
+static const struct j721e_pcie_data j7200_pcie_rc_data = {
+	.mode = PCI_MODE_RC,
+	.quirk_detect_quiet_flag = true,
+	.linkdown_irq_regfield = J7200_LINK_DOWN,
+	.byte_access_allowed = true,
+};
+
+static const struct j721e_pcie_data j7200_pcie_ep_data = {
+	.mode = PCI_MODE_EP,
+	.quirk_detect_quiet_flag = true,
 };
 
 static const struct of_device_id of_j721e_pcie_match[] = {
@@ -287,6 +307,14 @@ static const struct of_device_id of_j721e_pcie_match[] = {
 		.compatible = "ti,j721e-pcie-ep",
 		.data = &j721e_pcie_ep_data,
 	},
+	{
+		.compatible = "ti,j7200-pcie-host",
+		.data = &j7200_pcie_rc_data,
+	},
+	{
+		.compatible = "ti,j7200-pcie-ep",
+		.data = &j7200_pcie_ep_data,
+	},
 	{},
 };
 
@@ -319,6 +347,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
 
 	pcie->dev = dev;
 	pcie->mode = mode;
+	pcie->linkdown_irq_regfield = data->linkdown_irq_regfield;
 
 	base = devm_platform_ioremap_resource_byname(pdev, "intd_cfg");
 	if (IS_ERR(base))
@@ -378,9 +407,11 @@ static int j721e_pcie_probe(struct platform_device *pdev)
 			goto err_get_sync;
 		}
 
-		bridge->ops = &cdns_ti_pcie_host_ops;
+		if (!data->byte_access_allowed)
+			bridge->ops = &cdns_ti_pcie_host_ops;
 		rc = pci_host_bridge_priv(bridge);
 		rc->quirk_retrain_flag = data->quirk_retrain_flag;
+		rc->quirk_detect_quiet_flag = data->quirk_detect_quiet_flag;
 
 		cdns_pcie = &rc->pcie;
 		cdns_pcie->dev = dev;
@@ -430,6 +461,7 @@ static int j721e_pcie_probe(struct platform_device *pdev)
 			ret = -ENOMEM;
 			goto err_get_sync;
 		}
+		ep->quirk_detect_quiet_flag = data->quirk_detect_quiet_flag;
 
 		cdns_pcie = &ep->pcie;
 		cdns_pcie->dev = dev;

From 365cdfcc6eba04124f22dc74e4355d307bd4fe05 Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Wed, 11 Aug 2021 18:03:35 +0530
Subject: [PATCH 0374/1750] PCI: j721e: Add PCIe support for AM64

[ Upstream commit c8a375a8e15ac31293d7fda08008d6da8f5df3db ]

AM64 has the same PCIe IP as in J7200 with certain erratas not
applicable (quirk_detect_quiet_flag). Add support for "ti,am64-pcie-host"
compatible and "ti,am64-pcie-ep" compatible that is specific to AM64.

Link: https://lore.kernel.org/r/20210811123336.31357-5-kishon@ti.com
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/cadence/pci-j721e.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/pci/controller/cadence/pci-j721e.c b/drivers/pci/controller/cadence/pci-j721e.c
index 2f5a49c77074..8a6d68e13f30 100644
--- a/drivers/pci/controller/cadence/pci-j721e.c
+++ b/drivers/pci/controller/cadence/pci-j721e.c
@@ -298,6 +298,17 @@ static const struct j721e_pcie_data j7200_pcie_ep_data = {
 	.quirk_detect_quiet_flag = true,
 };
 
+static const struct j721e_pcie_data am64_pcie_rc_data = {
+	.mode = PCI_MODE_RC,
+	.linkdown_irq_regfield = J7200_LINK_DOWN,
+	.byte_access_allowed = true,
+};
+
+static const struct j721e_pcie_data am64_pcie_ep_data = {
+	.mode = PCI_MODE_EP,
+	.linkdown_irq_regfield = J7200_LINK_DOWN,
+};
+
 static const struct of_device_id of_j721e_pcie_match[] = {
 	{
 		.compatible = "ti,j721e-pcie-host",
@@ -315,6 +326,14 @@ static const struct of_device_id of_j721e_pcie_match[] = {
 		.compatible = "ti,j7200-pcie-ep",
 		.data = &j7200_pcie_ep_data,
 	},
+	{
+		.compatible = "ti,am64-pcie-host",
+		.data = &am64_pcie_rc_data,
+	},
+	{
+		.compatible = "ti,am64-pcie-ep",
+		.data = &am64_pcie_ep_data,
+	},
 	{},
 };
 

From e5609d3fd57d4ab53db3bbe291fff2b525abbce1 Mon Sep 17 00:00:00 2001
From: George Cherian <george.cherian@marvell.com>
Date: Tue, 10 Aug 2021 17:54:25 +0530
Subject: [PATCH 0375/1750] PCI: Add ACS quirks for Cavium multi-function
 devices

[ Upstream commit 32837d8a8f63eb95dcb9cd005524a27f06478832 ]

Some Cavium endpoints are implemented as multi-function devices without ACS
capability, but they actually don't support peer-to-peer transactions.

Add ACS quirks to declare DMA isolation for the following devices:

  - BGX device found on Octeon-TX (8xxx)
  - CGX device found on Octeon-TX2 (9xxx)
  - RPM device found on Octeon-TX3 (10xxx)

Link: https://lore.kernel.org/r/20210810122425.1115156-1-george.cherian@marvell.com
Signed-off-by: George Cherian <george.cherian@marvell.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/quirks.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index f2e95944f681..5d2acebc3e96 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4864,6 +4864,10 @@ static const struct pci_dev_acs_enabled {
 	{ 0x10df, 0x720, pci_quirk_mf_endpoint_acs }, /* Emulex Skyhawk-R */
 	/* Cavium ThunderX */
 	{ PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
+	/* Cavium multi-function devices */
+	{ PCI_VENDOR_ID_CAVIUM, 0xA026, pci_quirk_mf_endpoint_acs },
+	{ PCI_VENDOR_ID_CAVIUM, 0xA059, pci_quirk_mf_endpoint_acs },
+	{ PCI_VENDOR_ID_CAVIUM, 0xA060, pci_quirk_mf_endpoint_acs },
 	/* APM X-Gene */
 	{ PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
 	/* Ampere Computing */

From 1cac475eeb9f5c46c1b5ddb4ca79f531ad15e1c8 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Sun, 1 Aug 2021 09:56:25 +0200
Subject: [PATCH 0376/1750] watchdog: Start watchdog in
 watchdog_set_last_hw_keepalive only if appropriate

[ Upstream commit dbe80cf471f940db3063197b7adb1169f89be9ed ]

We must not pet a running watchdog when handle_boot_enabled is off
because this will kick off automatic triggering before userland is
running, defeating the purpose of the handle_boot_enabled control.
Furthermore, don't ping in case watchdog_set_last_hw_keepalive was
called incorrectly when the hardware watchdog is actually not running.

Fixed: cef9572e9af3 ("watchdog: add support for adjusting last known HW keepalive time")
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/93d56386-6e37-060b-55ce-84de8cde535f@web.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/watchdog_dev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index 2946f3a63110..2ee017442dfc 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
@@ -1164,7 +1164,10 @@ int watchdog_set_last_hw_keepalive(struct watchdog_device *wdd,
 
 	wd_data->last_hw_keepalive = ktime_sub(now, ms_to_ktime(last_ping_ms));
 
-	return __watchdog_ping(wdd);
+	if (watchdog_hw_running(wdd) && handle_boot_enabled)
+		return __watchdog_ping(wdd);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(watchdog_set_last_hw_keepalive);
 

From c422c555053e5adc192b0f08d16d26cb59e4f249 Mon Sep 17 00:00:00 2001
From: Smadar Fuks <smadarf@marvell.com>
Date: Wed, 1 Sep 2021 11:08:59 +0530
Subject: [PATCH 0377/1750] octeontx2-af: Add additional register check to
 rvu_poll_reg()

[ Upstream commit 21274aa1781941884599a97ab59be7f8f36af98c ]

Check one more time before exiting the API with an error.
Fix API to poll at least twice, in case there are other high priority
tasks and this API doesn't get CPU cycles for multiple jiffies update.

In addition, increase timeout from usecs_to_jiffies(10000) to
usecs_to_jiffies(20000), to prevent the case that for CONFIG_100HZ
timeout will be a single jiffies.
A single jiffies results actual timeout that can be any time between
1usec and 10msec. To solve this, a value of usecs_to_jiffies(20000)
ensures that timeout is 2 jiffies.

Signed-off-by: Smadar Fuks <smadarf@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
index 644d28b0692b..c26652436c53 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu.c
@@ -84,7 +84,8 @@ static void rvu_setup_hw_capabilities(struct rvu *rvu)
  */
 int rvu_poll_reg(struct rvu *rvu, u64 block, u64 offset, u64 mask, bool zero)
 {
-	unsigned long timeout = jiffies + usecs_to_jiffies(10000);
+	unsigned long timeout = jiffies + usecs_to_jiffies(20000);
+	bool twice = false;
 	void __iomem *reg;
 	u64 reg_val;
 
@@ -99,6 +100,15 @@ int rvu_poll_reg(struct rvu *rvu, u64 block, u64 offset, u64 mask, bool zero)
 		usleep_range(1, 5);
 		goto again;
 	}
+	/* In scenarios where CPU is scheduled out before checking
+	 * 'time_before' (above) and gets scheduled in such that
+	 * jiffies are beyond timeout value, then check again if HW is
+	 * done with the operation in the meantime.
+	 */
+	if (!twice) {
+		twice = true;
+		goto again;
+	}
 	return -EBUSY;
 }
 

From ca8ecd7444a9f4295bc7bed1be908564bcc206f0 Mon Sep 17 00:00:00 2001
From: Ryoga Saito <contact@proelbtn.com>
Date: Thu, 2 Sep 2021 05:20:14 +0000
Subject: [PATCH 0378/1750] Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6

[ Upstream commit 9aca491e0dccf8a9d84a5b478e5eee3c6ea7803b ]

This patch fixes kernel NULL pointer dereference when creating nexthop
which is bound with SRv6 decapsulation. In the creation of nexthop,
__seg6_end_dt_vrf_build is called. __seg6_end_dt_vrf_build expects
fc_lninfo in fib6_config is set correctly, but it isn't set in
nh_create_ipv6, which causes kernel crash.

Here is steps to reproduce kernel crash:

1. modprobe vrf
2. ip -6 nexthop add encap seg6local action End.DT4 vrftable 1 dev eth0

We got the following message:

[  901.370336] BUG: kernel NULL pointer dereference, address: 0000000000000ba0
[  901.371658] #PF: supervisor read access in kernel mode
[  901.372672] #PF: error_code(0x0000) - not-present page
[  901.373672] PGD 0 P4D 0
[  901.374248] Oops: 0000 [#1] SMP PTI
[  901.374944] CPU: 0 PID: 8593 Comm: ip Not tainted 5.14-051400-generic #202108310811-Ubuntu
[  901.376404] Hardware name: Red Hat KVM, BIOS 1.11.1-4.module_el8.2.0+320+13f867d7 04/01/2014
[  901.377907] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf]
[  901.379182] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00
[  901.382652] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282
[  901.383746] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8
[  901.385436] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000
[  901.386924] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40
[  901.388537] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000
[  901.389937] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b
[  901.391226] FS:  00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000
[  901.392737] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  901.393803] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0
[  901.395122] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  901.396496] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  901.397833] PKRU: 55555554
[  901.398578] Call Trace:
[  901.399144]  l3mdev_ifindex_lookup_by_table_id+0x3b/0x70
[  901.400179]  __seg6_end_dt_vrf_build+0x34/0xd0
[  901.401067]  seg6_end_dt4_build+0x16/0x20
[  901.401904]  seg6_local_build_state+0x271/0x430
[  901.402797]  lwtunnel_build_state+0x81/0x130
[  901.403645]  fib_nh_common_init+0x82/0x100
[  901.404465]  ? sock_def_readable+0x4b/0x80
[  901.405285]  fib6_nh_init+0x115/0x7c0
[  901.406033]  nh_create_ipv6.isra.0+0xe1/0x140
[  901.406932]  rtm_new_nexthop+0x3b7/0xeb0
[  901.407828]  rtnetlink_rcv_msg+0x152/0x3a0
[  901.408663]  ? rtnl_calcit.isra.0+0x130/0x130
[  901.409535]  netlink_rcv_skb+0x55/0x100
[  901.410319]  rtnetlink_rcv+0x15/0x20
[  901.411026]  netlink_unicast+0x1a8/0x250
[  901.411813]  netlink_sendmsg+0x238/0x470
[  901.412602]  ? _copy_from_user+0x2b/0x60
[  901.413394]  sock_sendmsg+0x65/0x70
[  901.414112]  ____sys_sendmsg+0x218/0x290
[  901.414929]  ? copy_msghdr_from_user+0x5c/0x90
[  901.415814]  ___sys_sendmsg+0x81/0xc0
[  901.416559]  ? fsnotify_destroy_marks+0x27/0xf0
[  901.417447]  ? call_rcu+0xa4/0x230
[  901.418153]  ? kmem_cache_free+0x23f/0x410
[  901.418972]  ? dentry_free+0x37/0x70
[  901.419705]  ? mntput_no_expire+0x4c/0x260
[  901.420574]  __sys_sendmsg+0x62/0xb0
[  901.421297]  __x64_sys_sendmsg+0x1f/0x30
[  901.422057]  do_syscall_64+0x5c/0xc0
[  901.422756]  ? syscall_exit_to_user_mode+0x27/0x50
[  901.423675]  ? __x64_sys_close+0x12/0x40
[  901.424462]  ? do_syscall_64+0x69/0xc0
[  901.425219]  ? irqentry_exit_to_user_mode+0x9/0x20
[  901.426149]  ? irqentry_exit+0x19/0x30
[  901.426901]  ? exc_page_fault+0x89/0x160
[  901.427709]  ? asm_exc_page_fault+0x8/0x30
[  901.428536]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  901.429514] RIP: 0033:0x7fe493945747
[  901.430248] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[  901.433549] RSP: 002b:00007ffe9932cf68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  901.434981] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe493945747
[  901.436303] RDX: 0000000000000000 RSI: 00007ffe9932cfe0 RDI: 0000000000000003
[  901.437607] RBP: 00000000613053f7 R08: 0000000000000001 R09: 00007ffe9932d07c
[  901.438990] R10: 000055f4a903a010 R11: 0000000000000246 R12: 0000000000000001
[  901.440340] R13: 0000000000000001 R14: 000055f4a802b163 R15: 000055f4a8042020
[  901.441630] Modules linked in: vrf nls_utf8 isofs nls_iso8859_1 dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua intel_rapl_msr intel_rapl_common isst_if_mbox_msr isst_if_common nfit rapl input_leds joydev serio_raw qemu_fw_cfg mac_hid sch_fq_codel drm virtio_rng ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd virtio_net net_failover cryptd psmouse virtio_blk failover i2c_piix4 pata_acpi floppy
[  901.450808] CR2: 0000000000000ba0
[  901.451514] ---[ end trace c27b934b99ade304 ]---
[  901.452403] RIP: 0010:vrf_ifindex_lookup_by_table_id+0x19/0x90 [vrf]
[  901.453626] Code: c1 e9 72 ff ff ff e8 96 49 01 c2 66 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 89 f5 41 54 53 8b 05 47 4c 00 00 <48> 8b 97 a0 0b 00 00 48 8b 1c c2 e8 57 27 53 c1 4c 8d a3 88 00 00
[  901.456910] RSP: 0018:ffffbf2d02043590 EFLAGS: 00010282
[  901.457912] RAX: 000000000000000b RBX: ffff990808255e70 RCX: ffffbf2d02043aa8
[  901.459238] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 0000000000000000
[  901.460552] RBP: ffffbf2d020435b0 R08: 00000000000000c0 R09: ffff990808255e40
[  901.461882] R10: ffffffff83b08c90 R11: 0000000000000009 R12: 0000000000000000
[  901.463208] R13: 0000000000000001 R14: 0000000000000000 R15: 000000000000000b
[  901.464529] FS:  00007fe49381f740(0000) GS:ffff99087dc00000(0000) knlGS:0000000000000000
[  901.466058] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  901.467189] CR2: 0000000000000ba0 CR3: 000000000e3e8003 CR4: 0000000000770ef0
[  901.468515] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  901.469858] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  901.471139] PKRU: 55555554

Signed-off-by: Ryoga Saito <contact@proelbtn.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/nexthop.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index f2d313c5900d..1075cc2136ac 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -1303,6 +1303,7 @@ static int nh_create_ipv4(struct net *net, struct nexthop *nh,
 		.fc_gw4   = cfg->gw.ipv4,
 		.fc_gw_family = cfg->gw.ipv4 ? AF_INET : 0,
 		.fc_flags = cfg->nh_flags,
+		.fc_nlinfo = cfg->nlinfo,
 		.fc_encap = cfg->nh_encap,
 		.fc_encap_type = cfg->nh_encap_type,
 	};
@@ -1341,6 +1342,7 @@ static int nh_create_ipv6(struct net *net,  struct nexthop *nh,
 		.fc_ifindex = cfg->nh_ifindex,
 		.fc_gateway = cfg->gw.ipv6,
 		.fc_flags = cfg->nh_flags,
+		.fc_nlinfo = cfg->nlinfo,
 		.fc_encap = cfg->nh_encap,
 		.fc_encap_type = cfg->nh_encap_type,
 		.fc_is_fdb = cfg->nh_fdb,

From 7f2b3242f0d4c276dc4caf966c0870159d6ef37c Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Thu, 2 Sep 2021 12:51:22 +0200
Subject: [PATCH 0379/1750] net: usb: cdc_mbim: avoid altsetting toggling for
 Telit LN920

[ Upstream commit aabbdc67f3485b5db27ab4eba01e5fbf1ffea62c ]

Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit LN920
0x1061 composition in order to avoid bind error.

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/cdc_mbim.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index eb100eb33de3..77ac5a721e7b 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -653,6 +653,11 @@ static const struct usb_device_id mbim_devs[] = {
 	  .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
 	},
 
+	/* Telit LN920 */
+	{ USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1061, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+	  .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+	},
+
 	/* default entry */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
 	  .driver_info = (unsigned long)&cdc_mbim_info_zlp,

From 9ae759a36b6145df9c3cca198f8fcb198044ab34 Mon Sep 17 00:00:00 2001
From: Paolo Valente <paolo.valente@linaro.org>
Date: Mon, 2 Aug 2021 16:13:52 +0200
Subject: [PATCH 0380/1750] block, bfq: honor already-setup queue merges

[ Upstream commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b ]

The function bfq_setup_merge prepares the merging between two
bfq_queues, say bfqq and new_bfqq. To this goal, it assigns
bfqq->new_bfqq = new_bfqq. Then, each time some I/O for bfqq arrives,
the process that generated that I/O is disassociated from bfqq and
associated with new_bfqq (merging is actually a redirection). In this
respect, bfq_setup_merge increases new_bfqq->ref in advance, adding
the number of processes that are expected to be associated with
new_bfqq.

Unfortunately, the stable-merging mechanism interferes with this
setup. After bfqq->new_bfqq has been set by bfq_setup_merge, and
before all the expected processes have been associated with
bfqq->new_bfqq, bfqq may happen to be stably merged with a different
queue than the current bfqq->new_bfqq. In this case, bfqq->new_bfqq
gets changed. So, some of the processes that have been already
accounted for in the ref counter of the previous new_bfqq will not be
associated with that queue.  This creates an unbalance, because those
references will never be decremented.

This commit fixes this issue by reestablishing the previous, natural
behaviour: once bfqq->new_bfqq has been set, it will not be changed
until all expected redirections have occurred.

Signed-off-by: Davide Zini <davidezini2@gmail.com>
Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
Link: https://lore.kernel.org/r/20210802141352.74353-2-paolo.valente@linaro.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/bfq-iosched.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index b8c2ddc01aec..65c200e0ecb5 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2526,6 +2526,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
 	 * are likely to increase the throughput.
 	 */
 	bfqq->new_bfqq = new_bfqq;
+	/*
+	 * The above assignment schedules the following redirections:
+	 * each time some I/O for bfqq arrives, the process that
+	 * generated that I/O is disassociated from bfqq and
+	 * associated with new_bfqq. Here we increases new_bfqq->ref
+	 * in advance, adding the number of processes that are
+	 * expected to be associated with new_bfqq as they happen to
+	 * issue I/O.
+	 */
 	new_bfqq->ref += process_refs;
 	return new_bfqq;
 }
@@ -2585,6 +2594,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 {
 	struct bfq_queue *in_service_bfqq, *new_bfqq;
 
+	/* if a merge has already been setup, then proceed with that first */
+	if (bfqq->new_bfqq)
+		return bfqq->new_bfqq;
+
 	/*
 	 * Do not perform queue merging if the device is non
 	 * rotational and performs internal queueing. In fact, such a
@@ -2639,9 +2652,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 	if (bfq_too_late_for_merging(bfqq))
 		return NULL;
 
-	if (bfqq->new_bfqq)
-		return bfqq->new_bfqq;
-
 	if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
 		return NULL;
 

From 70ac967a7b886329f7308b966a690f9d4a94f958 Mon Sep 17 00:00:00 2001
From: Vishal Aslot <os.vaslot@gmail.com>
Date: Wed, 18 Aug 2021 11:57:51 -0500
Subject: [PATCH 0381/1750] PCI: ibmphp: Fix double unmap of io_mem

[ Upstream commit faa2e05ad0dccf37f995bcfbb8d1980d66c02c11 ]

ebda_rsrc_controller() calls iounmap(io_mem) on the error path. Its caller,
ibmphp_access_ebda(), also calls iounmap(io_mem) on good and error paths.

Remove the iounmap(io_mem) invocation from ebda_rsrc_controller().

[bhelgaas: remove item from TODO]
Link: https://lore.kernel.org/r/20210818165751.591185-1-os.vaslot@gmail.com
Signed-off-by: Vishal Aslot <os.vaslot@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/hotplug/TODO          | 3 ---
 drivers/pci/hotplug/ibmphp_ebda.c | 5 +----
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/pci/hotplug/TODO b/drivers/pci/hotplug/TODO
index a32070be5adf..cc6194aa24c1 100644
--- a/drivers/pci/hotplug/TODO
+++ b/drivers/pci/hotplug/TODO
@@ -40,9 +40,6 @@ ibmphp:
 
 * The return value of pci_hp_register() is not checked.
 
-* iounmap(io_mem) is called in the error path of ebda_rsrc_controller()
-  and once more in the error path of its caller ibmphp_access_ebda().
-
 * The various slot data structures are difficult to follow and need to be
   simplified.  A lot of functions are too large and too complex, they need
   to be broken up into smaller, manageable pieces.  Negative examples are
diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c
index 11a2661dc062..7fb75401ad8a 100644
--- a/drivers/pci/hotplug/ibmphp_ebda.c
+++ b/drivers/pci/hotplug/ibmphp_ebda.c
@@ -714,8 +714,7 @@ static int __init ebda_rsrc_controller(void)
 		/* init hpc structure */
 		hpc_ptr = alloc_ebda_hpc(slot_num, bus_num);
 		if (!hpc_ptr) {
-			rc = -ENOMEM;
-			goto error_no_hpc;
+			return -ENOMEM;
 		}
 		hpc_ptr->ctlr_id = ctlr_id;
 		hpc_ptr->ctlr_relative_id = ctlr;
@@ -910,8 +909,6 @@ static int __init ebda_rsrc_controller(void)
 	kfree(tmp_slot);
 error_no_slot:
 	free_ebda_hpc(hpc_ptr);
-error_no_hpc:
-	iounmap(io_mem);
 	return rc;
 }
 

From e76ccbdedbddaf14c65b50bbf2ffe8118958d15e Mon Sep 17 00:00:00 2001
From: Yang Li <yang.lee@linux.alibaba.com>
Date: Fri, 3 Sep 2021 14:42:33 +0800
Subject: [PATCH 0382/1750] ethtool: Fix an error code in cxgb2.c

[ Upstream commit 7db8263a12155c7ae4ad97e850f1e499c73765fc ]

When adapter->registered_device_map is NULL, the value of err is
uncertain, we set err to -EINVAL to avoid ambiguity.

Clean up smatch warning:
drivers/net/ethernet/chelsio/cxgb/cxgb2.c:1114 init_one() warn: missing
error code 'err'

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb/cxgb2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
index 0e4a0f413960..c6db85fe1629 100644
--- a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
+++ b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c
@@ -1153,6 +1153,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 	if (!adapter->registered_device_map) {
 		pr_err("%s: could not register any net devices\n",
 		       pci_name(pdev));
+		err = -EINVAL;
 		goto out_release_adapter_res;
 	}
 

From ce660d6dfcdd2836883673154835636438928929 Mon Sep 17 00:00:00 2001
From: Yang Li <yang.lee@linux.alibaba.com>
Date: Mon, 7 Jun 2021 13:56:20 +0800
Subject: [PATCH 0383/1750] NTB: Fix an error code in ntb_msit_probe()

[ Upstream commit 319f83ac98d7afaabab84ce5281a819a358b9895 ]

When the value of nm->isr_ctx is false, the value of ret is 0.
So, we set ret to -ENOMEM to indicate this error.

Clean up smatch warning:
drivers/ntb/test/ntb_msi_test.c:373 ntb_msit_probe() warn: missing
error code 'ret'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ntb/test/ntb_msi_test.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ntb/test/ntb_msi_test.c b/drivers/ntb/test/ntb_msi_test.c
index 7095ecd6223a..4e18e08776c9 100644
--- a/drivers/ntb/test/ntb_msi_test.c
+++ b/drivers/ntb/test/ntb_msi_test.c
@@ -369,8 +369,10 @@ static int ntb_msit_probe(struct ntb_client *client, struct ntb_dev *ntb)
 	if (ret)
 		goto remove_dbgfs;
 
-	if (!nm->isr_ctx)
+	if (!nm->isr_ctx) {
+		ret = -ENOMEM;
 		goto remove_dbgfs;
+	}
 
 	ntb_link_enable(ntb, NTB_SPEED_AUTO, NTB_WIDTH_AUTO);
 

From 4a933932033854fc7be495ed966e47a42132a8c4 Mon Sep 17 00:00:00 2001
From: Yang Li <yang.lee@linux.alibaba.com>
Date: Mon, 7 Jun 2021 16:40:36 +0800
Subject: [PATCH 0384/1750] NTB: perf: Fix an error code in perf_setup_inbuf()

[ Upstream commit 0097ae5f7af5684f961a5f803ff7ad3e6f933668 ]

When the function IS_ALIGNED() returns false, the value of ret is 0.
So, we set ret to -EINVAL to indicate this error.

Clean up smatch warning:
drivers/ntb/test/ntb_perf.c:602 perf_setup_inbuf() warn: missing error
code 'ret'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ntb/test/ntb_perf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index 89df1350fefd..65e1e5cf1b29 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -598,6 +598,7 @@ static int perf_setup_inbuf(struct perf_peer *peer)
 		return -ENOMEM;
 	}
 	if (!IS_ALIGNED(peer->inbuf_xlat, xlat_align)) {
+		ret = -EINVAL;
 		dev_err(&perf->ntb->dev, "Unaligned inbuf allocated\n");
 		goto err_free_inbuf;
 	}

From d92d3a9c2b6541f29f800fc2bd44620578b8f8a6 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Mon, 6 Sep 2021 15:04:14 +0200
Subject: [PATCH 0385/1750] s390/bpf: Fix optimizing out zero-extensions

commit db7bee653859ef7179be933e7d1384644f795f26 upstream.

Currently the JIT completely removes things like `reg32 += 0`,
however, the BPF_ALU semantics requires the target register to be
zero-extended in such cases.

Fix by optimizing out only the arithmetic operation, but not the
subsequent zero-extension.

Reported-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/net/bpf_jit_comp.c | 58 +++++++++++++++++++-----------------
 1 file changed, 30 insertions(+), 28 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index dee01d3b23a4..28476328f6cb 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -761,10 +761,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT4(0xb9080000, dst_reg, src_reg);
 		break;
 	case BPF_ALU | BPF_ADD | BPF_K: /* dst = (u32) dst + (u32) imm */
-		if (!imm)
-			break;
-		/* alfi %dst,imm */
-		EMIT6_IMM(0xc20b0000, dst_reg, imm);
+		if (imm != 0) {
+			/* alfi %dst,imm */
+			EMIT6_IMM(0xc20b0000, dst_reg, imm);
+		}
 		EMIT_ZERO(dst_reg);
 		break;
 	case BPF_ALU64 | BPF_ADD | BPF_K: /* dst = dst + imm */
@@ -786,10 +786,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT4(0xb9090000, dst_reg, src_reg);
 		break;
 	case BPF_ALU | BPF_SUB | BPF_K: /* dst = (u32) dst - (u32) imm */
-		if (!imm)
-			break;
-		/* alfi %dst,-imm */
-		EMIT6_IMM(0xc20b0000, dst_reg, -imm);
+		if (imm != 0) {
+			/* alfi %dst,-imm */
+			EMIT6_IMM(0xc20b0000, dst_reg, -imm);
+		}
 		EMIT_ZERO(dst_reg);
 		break;
 	case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */
@@ -811,10 +811,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT4(0xb90c0000, dst_reg, src_reg);
 		break;
 	case BPF_ALU | BPF_MUL | BPF_K: /* dst = (u32) dst * (u32) imm */
-		if (imm == 1)
-			break;
-		/* msfi %r5,imm */
-		EMIT6_IMM(0xc2010000, dst_reg, imm);
+		if (imm != 1) {
+			/* msfi %r5,imm */
+			EMIT6_IMM(0xc2010000, dst_reg, imm);
+		}
 		EMIT_ZERO(dst_reg);
 		break;
 	case BPF_ALU64 | BPF_MUL | BPF_K: /* dst = dst * imm */
@@ -867,6 +867,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 			if (BPF_OP(insn->code) == BPF_MOD)
 				/* lhgi %dst,0 */
 				EMIT4_IMM(0xa7090000, dst_reg, 0);
+			else
+				EMIT_ZERO(dst_reg);
 			break;
 		}
 		/* lhi %w0,0 */
@@ -999,10 +1001,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT4(0xb9820000, dst_reg, src_reg);
 		break;
 	case BPF_ALU | BPF_XOR | BPF_K: /* dst = (u32) dst ^ (u32) imm */
-		if (!imm)
-			break;
-		/* xilf %dst,imm */
-		EMIT6_IMM(0xc0070000, dst_reg, imm);
+		if (imm != 0) {
+			/* xilf %dst,imm */
+			EMIT6_IMM(0xc0070000, dst_reg, imm);
+		}
 		EMIT_ZERO(dst_reg);
 		break;
 	case BPF_ALU64 | BPF_XOR | BPF_K: /* dst = dst ^ imm */
@@ -1033,10 +1035,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, src_reg, 0);
 		break;
 	case BPF_ALU | BPF_LSH | BPF_K: /* dst = (u32) dst << (u32) imm */
-		if (imm == 0)
-			break;
-		/* sll %dst,imm(%r0) */
-		EMIT4_DISP(0x89000000, dst_reg, REG_0, imm);
+		if (imm != 0) {
+			/* sll %dst,imm(%r0) */
+			EMIT4_DISP(0x89000000, dst_reg, REG_0, imm);
+		}
 		EMIT_ZERO(dst_reg);
 		break;
 	case BPF_ALU64 | BPF_LSH | BPF_K: /* dst = dst << imm */
@@ -1058,10 +1060,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, src_reg, 0);
 		break;
 	case BPF_ALU | BPF_RSH | BPF_K: /* dst = (u32) dst >> (u32) imm */
-		if (imm == 0)
-			break;
-		/* srl %dst,imm(%r0) */
-		EMIT4_DISP(0x88000000, dst_reg, REG_0, imm);
+		if (imm != 0) {
+			/* srl %dst,imm(%r0) */
+			EMIT4_DISP(0x88000000, dst_reg, REG_0, imm);
+		}
 		EMIT_ZERO(dst_reg);
 		break;
 	case BPF_ALU64 | BPF_RSH | BPF_K: /* dst = dst >> imm */
@@ -1083,10 +1085,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 		EMIT6_DISP_LH(0xeb000000, 0x000a, dst_reg, dst_reg, src_reg, 0);
 		break;
 	case BPF_ALU | BPF_ARSH | BPF_K: /* ((s32) dst >> imm */
-		if (imm == 0)
-			break;
-		/* sra %dst,imm(%r0) */
-		EMIT4_DISP(0x8a000000, dst_reg, REG_0, imm);
+		if (imm != 0) {
+			/* sra %dst,imm(%r0) */
+			EMIT4_DISP(0x8a000000, dst_reg, REG_0, imm);
+		}
 		EMIT_ZERO(dst_reg);
 		break;
 	case BPF_ALU64 | BPF_ARSH | BPF_K: /* ((s64) dst) >>= imm */

From 4320c222c2ffe778a8aff5b8bc4ac33af6d54eba Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 7 Sep 2021 13:41:16 +0200
Subject: [PATCH 0386/1750] s390/bpf: Fix 64-bit subtraction of the -0x80000000
 constant

commit 6e61dc9da0b7a0d91d57c2e20b5ea4fd2d4e7e53 upstream.

The JIT uses agfi for subtracting constants, but -(-0x80000000) cannot
be represented as a 32-bit signed binary integer. Fix by using algfi in
this particular case.

Reported-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/net/bpf_jit_comp.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 28476328f6cb..cba6e9825fb8 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -795,8 +795,13 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
 	case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */
 		if (!imm)
 			break;
-		/* agfi %dst,-imm */
-		EMIT6_IMM(0xc2080000, dst_reg, -imm);
+		if (imm == -0x80000000) {
+			/* algfi %dst,0x80000000 */
+			EMIT6_IMM(0xc20a0000, dst_reg, 0x80000000);
+		} else {
+			/* agfi %dst,-imm */
+			EMIT6_IMM(0xc2080000, dst_reg, -imm);
+		}
 		break;
 	/*
 	 * BPF_MUL

From ab7cf225016159bc2c3590be6fa12965565d903b Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 7 Sep 2021 11:58:59 +0200
Subject: [PATCH 0387/1750] s390/bpf: Fix branch shortening during codegen pass

commit 1511df6f5e9ef32826f20db2ee81f8527154dc14 upstream.

EMIT6_PCREL() macro assumes that the previous pass generated 6 bytes
of code, which is not the case if branch shortening took place. Fix by
using jit->prg, like all the other EMIT6_PCREL_*() macros.

Reported-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Fixes: 4e9b4a6883dd ("s390/bpf: Use relative long branches")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/net/bpf_jit_comp.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index cba6e9825fb8..8d9047d2d1e1 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -248,8 +248,7 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1)
 
 #define EMIT6_PCREL(op1, op2, b1, b2, i, off, mask)		\
 ({								\
-	/* Branch instruction needs 6 bytes */			\
-	int rel = (addrs[(i) + (off) + 1] - (addrs[(i) + 1] - 6)) / 2;\
+	int rel = (addrs[(i) + (off) + 1] - jit->prg) / 2;	\
 	_EMIT6((op1) | reg(b1, b2) << 16 | (rel & 0xffff), (op2) | (mask));\
 	REG_SET_SEEN(b1);					\
 	REG_SET_SEEN(b2);					\

From 00303e459251c31d1206f261d598ab94ebd8cbaa Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 29 Jun 2021 19:12:39 +0200
Subject: [PATCH 0388/1750] mfd: axp20x: Update AXP288 volatile ranges

[ Upstream commit f949a9ebce7a18005266b859a17f10c891bb13d7 ]

On Cherry Trail devices with an AXP288 PMIC the external SD-card slot
used the AXP's DLDO2 as card-voltage and either DLDO3 or GPIO1LDO
(GPIO1 pin in low noise LDO mode) as signal-voltage.

These regulators are turned on/off and in case of the signal-voltage
also have their output-voltage changed by the _PS0 and _PS3 power-
management ACPI methods on the MMC-controllers ACPI fwnode as well as
by the _DSM ACPI method for changing the signal voltage.

The AML code implementing these methods is directly accessing the
PMIC through ACPI I2C OpRegion accesses, instead of using the special
PMIC OpRegion handled by drivers/acpi/pmic/intel_pmic_xpower.c .

This means that the contents of the involved PMIC registers can change
without the change being made through the regmap interface, so regmap
should not cache the contents of these registers.

Mark the regulator power on/off, the regulator voltage control and the
GPIO1 control registers as volatile, to avoid regmap caching them.

Specifically this fixes an issue on some models where the i915 driver
toggles another LDO using the same on/off register on/off through
MIPI sequences (through intel_soc_pmic_exec_mipi_pmic_seq_element())
which then writes back a cached on/off register-value where the
card-voltage is off causing the external sdcard slot to stop working
when the screen goes blank, or comes back on again.

The regulator register-range now marked volatile also includes the
buck regulator control registers. This is done on purpose these are
normally not touched by the AML code, but they are updated directly
by the SoC's PUNIT which means that they may also change without going
through regmap.

Note the AXP288 PMIC is only used on Bay- and Cherry-Trail platforms,
so even though this is an ACPI specific problem there is no need to
make the new volatile ranges conditional since these platforms always
use ACPI.

Fixes: dc91c3b6fe66 ("mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile")
Fixes: cd53216625a0 ("mfd: axp20x: Fix axp288 volatile ranges")
Reported-and-tested-by: Clamshell <clamfly@163.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/axp20x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c
index aa59496e4376..9db1000944c3 100644
--- a/drivers/mfd/axp20x.c
+++ b/drivers/mfd/axp20x.c
@@ -125,12 +125,13 @@ static const struct regmap_range axp288_writeable_ranges[] = {
 
 static const struct regmap_range axp288_volatile_ranges[] = {
 	regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON),
+	regmap_reg_range(AXP22X_PWR_OUT_CTRL1, AXP22X_ALDO3_V_OUT),
 	regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL),
 	regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT),
 	regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL),
 	regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L),
 	regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL),
-	regmap_reg_range(AXP22X_GPIO_STATE, AXP22X_GPIO_STATE),
+	regmap_reg_range(AXP20X_GPIO1_CTRL, AXP22X_GPIO_STATE),
 	regmap_reg_range(AXP288_RT_BATT_V_H, AXP288_RT_BATT_V_L),
 	regmap_reg_range(AXP20X_FG_RES, AXP288_FG_CC_CAP_REG),
 };

From 063c3d980d78484996cfcfe299b5111b9dd6f03d Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Thu, 15 Jul 2021 13:36:36 +0200
Subject: [PATCH 0389/1750] backlight: ktd253: Stabilize backlight

[ Upstream commit daa37361518bf2d1f591bbdaa7c68b2a43d7af48 ]

Remove interrupt disablement during backlight setting. It is
way to dangerous and makes platforms instable by having it
miss vblank IRQs leading to the graphics derailing.

The code is using ndelay() which is not available on
platforms such as ARM and will result in 32 * udelay(1)
which is substantial.

Add some code to detect if an interrupt occurs during the
tight loop and in that case just redo it from the top.

Fixes: 5317f37e48b9 ("backlight: Add Kinetic KTD253 backlight driver")
Cc: Stephan Gerhold <stephan@gerhold.net>
Reported-by: newbyte@disroot.org
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/backlight/ktd253-backlight.c | 75 ++++++++++++++++------
 1 file changed, 55 insertions(+), 20 deletions(-)

diff --git a/drivers/video/backlight/ktd253-backlight.c b/drivers/video/backlight/ktd253-backlight.c
index e3fee3f1f582..9d355fd989d8 100644
--- a/drivers/video/backlight/ktd253-backlight.c
+++ b/drivers/video/backlight/ktd253-backlight.c
@@ -25,6 +25,7 @@
 
 #define KTD253_T_LOW_NS (200 + 10) /* Additional 10ns as safety factor */
 #define KTD253_T_HIGH_NS (200 + 10) /* Additional 10ns as safety factor */
+#define KTD253_T_OFF_CRIT_NS 100000 /* 100 us, now it doesn't look good */
 #define KTD253_T_OFF_MS 3
 
 struct ktd253_backlight {
@@ -34,13 +35,50 @@ struct ktd253_backlight {
 	u16 ratio;
 };
 
+static void ktd253_backlight_set_max_ratio(struct ktd253_backlight *ktd253)
+{
+	gpiod_set_value_cansleep(ktd253->gpiod, 1);
+	ndelay(KTD253_T_HIGH_NS);
+	/* We always fall back to this when we power on */
+}
+
+static int ktd253_backlight_stepdown(struct ktd253_backlight *ktd253)
+{
+	/*
+	 * These GPIO operations absolutely can NOT sleep so no _cansleep
+	 * suffixes, and no using GPIO expanders on slow buses for this!
+	 *
+	 * The maximum number of cycles of the loop is 32  so the time taken
+	 * should nominally be:
+	 * (T_LOW_NS + T_HIGH_NS + loop_time) * 32
+	 *
+	 * Architectures do not always support ndelay() and we will get a few us
+	 * instead. If we get to a critical time limit an interrupt has likely
+	 * occured in the low part of the loop and we need to restart from the
+	 * top so we have the backlight in a known state.
+	 */
+	u64 ns;
+
+	ns = ktime_get_ns();
+	gpiod_set_value(ktd253->gpiod, 0);
+	ndelay(KTD253_T_LOW_NS);
+	gpiod_set_value(ktd253->gpiod, 1);
+	ns = ktime_get_ns() - ns;
+	if (ns >= KTD253_T_OFF_CRIT_NS) {
+		dev_err(ktd253->dev, "PCM on backlight took too long (%llu ns)\n", ns);
+		return -EAGAIN;
+	}
+	ndelay(KTD253_T_HIGH_NS);
+	return 0;
+}
+
 static int ktd253_backlight_update_status(struct backlight_device *bl)
 {
 	struct ktd253_backlight *ktd253 = bl_get_data(bl);
 	int brightness = backlight_get_brightness(bl);
 	u16 target_ratio;
 	u16 current_ratio = ktd253->ratio;
-	unsigned long flags;
+	int ret;
 
 	dev_dbg(ktd253->dev, "new brightness/ratio: %d/32\n", brightness);
 
@@ -62,37 +100,34 @@ static int ktd253_backlight_update_status(struct backlight_device *bl)
 	}
 
 	if (current_ratio == 0) {
-		gpiod_set_value_cansleep(ktd253->gpiod, 1);
-		ndelay(KTD253_T_HIGH_NS);
-		/* We always fall back to this when we power on */
+		ktd253_backlight_set_max_ratio(ktd253);
 		current_ratio = KTD253_MAX_RATIO;
 	}
 
-	/*
-	 * WARNING:
-	 * The loop to set the correct current level is performed
-	 * with interrupts disabled as it is timing critical.
-	 * The maximum number of cycles of the loop is 32
-	 * so the time taken will be (T_LOW_NS + T_HIGH_NS + loop_time) * 32,
-	 */
-	local_irq_save(flags);
 	while (current_ratio != target_ratio) {
 		/*
 		 * These GPIO operations absolutely can NOT sleep so no
 		 * _cansleep suffixes, and no using GPIO expanders on
 		 * slow buses for this!
 		 */
-		gpiod_set_value(ktd253->gpiod, 0);
-		ndelay(KTD253_T_LOW_NS);
-		gpiod_set_value(ktd253->gpiod, 1);
-		ndelay(KTD253_T_HIGH_NS);
-		/* After 1/32 we loop back to 32/32 */
-		if (current_ratio == KTD253_MIN_RATIO)
+		ret = ktd253_backlight_stepdown(ktd253);
+		if (ret == -EAGAIN) {
+			/*
+			 * Something disturbed the backlight setting code when
+			 * running so we need to bring the PWM back to a known
+			 * state. This shouldn't happen too much.
+			 */
+			gpiod_set_value_cansleep(ktd253->gpiod, 0);
+			msleep(KTD253_T_OFF_MS);
+			ktd253_backlight_set_max_ratio(ktd253);
 			current_ratio = KTD253_MAX_RATIO;
-		else
+		} else if (current_ratio == KTD253_MIN_RATIO) {
+			/* After 1/32 we loop back to 32/32 */
+			current_ratio = KTD253_MAX_RATIO;
+		} else {
 			current_ratio--;
+		}
 	}
-	local_irq_restore(flags);
 	ktd253->ratio = current_ratio;
 
 	dev_dbg(ktd253->dev, "new ratio set to %d/32\n", target_ratio);

From b1f3be0c302a75ce2c712b9b5da930888426d686 Mon Sep 17 00:00:00 2001
From: Rob Herring <robh@kernel.org>
Date: Tue, 3 Aug 2021 15:56:55 -0600
Subject: [PATCH 0390/1750] PCI: of: Don't fail devm_pci_alloc_host_bridge() on
 missing 'ranges'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d277f6e88c88729b1d57d40bbfb00d0bfc961972 ]

Commit 669cbc708122 ("PCI: Move DT resource setup into
devm_pci_alloc_host_bridge()") made devm_pci_alloc_host_bridge() fail on
any DT resource parsing errors, but Broadcom iProc uses
devm_pci_alloc_host_bridge() on BCMA bus devices that don't have DT
resources. In particular, there is no 'ranges' property. Fix iProc by
making 'ranges' optional.

If 'ranges' is required by a platform, there's going to be more errors
latter on if it is missing.

Link: https://lore.kernel.org/r/20210803215656.3803204-1-robh@kernel.org
Fixes: 669cbc708122 ("PCI: Move DT resource setup into devm_pci_alloc_host_bridge()")
Reported-by: Rafał Miłecki <zajec5@gmail.com>
Tested-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: Srinath Mannam <srinath.mannam@broadcom.com>
Cc: Roman Bacik <roman.bacik@broadcom.com>
Cc: Bharat Gooty <bharat.gooty@broadcom.com>
Cc: Abhishek Shah <abhishek.shah@broadcom.com>
Cc: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
Cc: Ray Jui <ray.jui@broadcom.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: BCM Kernel Feedback <bcm-kernel-feedback-list@broadcom.com>
Cc: Scott Branden <sbranden@broadcom.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/of.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/of.c b/drivers/pci/of.c
index ac24cd5439a9..3f6ef2f45e57 100644
--- a/drivers/pci/of.c
+++ b/drivers/pci/of.c
@@ -295,7 +295,7 @@ static int devm_of_pci_get_host_bridge_resources(struct device *dev,
 	/* Check for ranges property */
 	err = of_pci_range_parser_init(&parser, dev_node);
 	if (err)
-		goto failed;
+		return 0;
 
 	dev_dbg(dev, "Parsing ranges property...\n");
 	for_each_of_pci_range(&parser, &range) {

From 9e89c22d1c949d7123a2edd8abc8e18f24895e80 Mon Sep 17 00:00:00 2001
From: Rob Herring <robh@kernel.org>
Date: Tue, 3 Aug 2021 15:56:56 -0600
Subject: [PATCH 0391/1750] PCI: iproc: Fix BCMA probe resource handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit aeaea8969b402e0081210cc9144404d13996efed ]

In commit 7ef1c871da16 ("PCI: iproc: Use
pci_parse_request_of_pci_ranges()"), calling
devm_request_pci_bus_resources() was dropped from the common iProc
probe code, but is still needed for BCMA bus probing. Without it, there
will be lots of warnings like this:

pci 0000:00:00.0: BAR 8: no space for [mem size 0x00c00000]
pci 0000:00:00.0: BAR 8: failed to assign [mem size 0x00c00000]

Add back calling devm_request_pci_bus_resources() and adding the
resources to pci_host_bridge.windows for BCMA bus probe.

Link: https://lore.kernel.org/r/20210803215656.3803204-2-robh@kernel.org
Fixes: 7ef1c871da16 ("PCI: iproc: Use pci_parse_request_of_pci_ranges()")
Reported-by: Rafał Miłecki <zajec5@gmail.com>
Tested-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Srinath Mannam <srinath.mannam@broadcom.com>
Cc: Roman Bacik <roman.bacik@broadcom.com>
Cc: Bharat Gooty <bharat.gooty@broadcom.com>
Cc: Abhishek Shah <abhishek.shah@broadcom.com>
Cc: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
Cc: Ray Jui <ray.jui@broadcom.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: BCM Kernel Feedback <bcm-kernel-feedback-list@broadcom.com>
Cc: Scott Branden <sbranden@broadcom.com>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: "Krzysztof Wilczyński" <kw@linux.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pcie-iproc-bcma.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/drivers/pci/controller/pcie-iproc-bcma.c b/drivers/pci/controller/pcie-iproc-bcma.c
index 56b8ee7bf330..f918c713afb0 100644
--- a/drivers/pci/controller/pcie-iproc-bcma.c
+++ b/drivers/pci/controller/pcie-iproc-bcma.c
@@ -35,7 +35,6 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 {
 	struct device *dev = &bdev->dev;
 	struct iproc_pcie *pcie;
-	LIST_HEAD(resources);
 	struct pci_host_bridge *bridge;
 	int ret;
 
@@ -60,19 +59,16 @@ static int iproc_pcie_bcma_probe(struct bcma_device *bdev)
 	pcie->mem.end = bdev->addr_s[0] + SZ_128M - 1;
 	pcie->mem.name = "PCIe MEM space";
 	pcie->mem.flags = IORESOURCE_MEM;
-	pci_add_resource(&resources, &pcie->mem);
+	pci_add_resource(&bridge->windows, &pcie->mem);
+	ret = devm_request_pci_bus_resources(dev, &bridge->windows);
+	if (ret)
+		return ret;
 
 	pcie->map_irq = iproc_pcie_bcma_map_irq;
 
-	ret = iproc_pcie_setup(pcie, &resources);
-	if (ret) {
-		dev_err(dev, "PCIe controller setup failed\n");
-		pci_free_resource_list(&resources);
-		return ret;
-	}
-
 	bcma_set_drvdata(bdev, pcie);
-	return 0;
+
+	return iproc_pcie_setup(pcie, &bridge->windows);
 }
 
 static void iproc_pcie_bcma_remove(struct bcma_device *bdev)

From 1cf43a1e5782167cff8afcc35074994517436269 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Fri, 5 Mar 2021 02:42:09 -0600
Subject: [PATCH 0392/1750] netfilter: Fix fall-through warnings for Clang

[ Upstream commit c2168e6bd7ec50cedb69b3be1ba6146e28893c69 ]

In preparation to enable -Wimplicit-fallthrough for Clang, fix multiple
warnings by explicitly adding multiple break statements instead of just
letting the code fall through to the next case.

Link: https://github.com/KSPP/linux/issues/115
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_proto_dccp.c | 1 +
 net/netfilter/nf_tables_api.c           | 1 +
 net/netfilter/nft_ct.c                  | 1 +
 3 files changed, 3 insertions(+)

diff --git a/net/netfilter/nf_conntrack_proto_dccp.c b/net/netfilter/nf_conntrack_proto_dccp.c
index b3f4a334f9d7..94001eb51ffe 100644
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -397,6 +397,7 @@ dccp_new(struct nf_conn *ct, const struct sk_buff *skb,
 			msg = "not picking up existing connection ";
 			goto out_invalid;
 		}
+		break;
 	case CT_DCCP_REQUEST:
 		break;
 	case CT_DCCP_INVALID:
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 2b5f97e1d40b..c605a3e713e7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8394,6 +8394,7 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
 							data->verdict.chain);
 				if (err < 0)
 					return err;
+				break;
 			default:
 				break;
 			}
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 70d46e0bbf06..7af822a02ce9 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -528,6 +528,7 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 	case NFT_CT_ZONE:
 		if (--nft_ct_pcpu_template_refcnt == 0)
 			nft_ct_tmpl_put_pcpu();
+		break;
 #endif
 	default:
 		break;

From 62f813769f50bb0010ab9a63c021d2af39d156e4 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Tue, 10 Aug 2021 15:59:20 +0300
Subject: [PATCH 0393/1750] netfilter: nft_ct: protect
 nft_ct_pcpu_template_refcnt with mutex

[ Upstream commit e3245a7b7b34bd2e97f744fd79463add6e9d41f4 ]

Syzbot hit use-after-free in nf_tables_dump_sets. The problem was in
missing lock protection for nft_ct_pcpu_template_refcnt.

Before commit f102d66b335a ("netfilter: nf_tables: use dedicated
mutex to guard transactions") all transactions were serialized by global
mutex, but then global mutex was changed to local per netnamespace
commit_mutex.

This change causes use-after-free bug, when 2 netnamespaces concurently
changing nft_ct_pcpu_template_refcnt without proper locking. Fix it by
adding nft_ct_pcpu_mutex and protect all nft_ct_pcpu_template_refcnt
changes with it.

Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
Reported-and-tested-by: syzbot+649e339fa6658ee623d3@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_ct.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index 7af822a02ce9..7fcb73ac2e6e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -41,6 +41,7 @@ struct nft_ct_helper_obj  {
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
+static DEFINE_MUTEX(nft_ct_pcpu_mutex);
 #endif
 
 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
@@ -526,8 +527,10 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
 #endif
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 	case NFT_CT_ZONE:
+		mutex_lock(&nft_ct_pcpu_mutex);
 		if (--nft_ct_pcpu_template_refcnt == 0)
 			nft_ct_tmpl_put_pcpu();
+		mutex_unlock(&nft_ct_pcpu_mutex);
 		break;
 #endif
 	default:
@@ -565,9 +568,13 @@ static int nft_ct_set_init(const struct nft_ctx *ctx,
 #endif
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 	case NFT_CT_ZONE:
-		if (!nft_ct_tmpl_alloc_pcpu())
+		mutex_lock(&nft_ct_pcpu_mutex);
+		if (!nft_ct_tmpl_alloc_pcpu()) {
+			mutex_unlock(&nft_ct_pcpu_mutex);
 			return -ENOMEM;
+		}
 		nft_ct_pcpu_template_refcnt++;
+		mutex_unlock(&nft_ct_pcpu_mutex);
 		len = sizeof(u16);
 		break;
 #endif

From ed44be1cbe5e1b3a032c5e20e4c4e6a6378c8bcd Mon Sep 17 00:00:00 2001
From: Anshuman Khandual <anshuman.khandual@arm.com>
Date: Wed, 11 Aug 2021 16:41:15 +0530
Subject: [PATCH 0394/1750] KVM: arm64: Restrict IPA size to maximum 48 bits on
 4K and 16K page size

[ Upstream commit 5e5df9571c319fb107d7a523cc96fcc99961ee70 ]

Even though ID_AA64MMFR0.PARANGE reports 52 bit PA size support, it cannot
be enabled as guest IPA size on 4K or 16K page size configurations. Hence
kvm_ipa_limit must be restricted to 48 bits. This change achieves required
IPA capping.

Before the commit c9b69a0cf0b4 ("KVM: arm64: Don't constrain maximum IPA
size based on host configuration"), the problem here would have been just
latent via PHYS_MASK_SHIFT (which earlier in turn capped kvm_ipa_limit),
which remains capped at 48 bits on 4K and 16K configs.

Cc: Marc Zyngier <maz@kernel.org>
Cc: James Morse <james.morse@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: kvmarm@lists.cs.columbia.edu
Cc: linux-kernel@vger.kernel.org
Fixes: c9b69a0cf0b4 ("KVM: arm64: Don't constrain maximum IPA size based on host configuration")
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/1628680275-16578-1-git-send-email-anshuman.khandual@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/reset.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index b969c2157ad2..6058a80ec9ec 100644
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -366,6 +366,14 @@ int kvm_set_ipa_limit(void)
 	mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1);
 	parange = cpuid_feature_extract_unsigned_field(mmfr0,
 				ID_AA64MMFR0_PARANGE_SHIFT);
+	/*
+	 * IPA size beyond 48 bits could not be supported
+	 * on either 4K or 16K page size. Hence let's cap
+	 * it to 48 bits, in case it's reported as larger
+	 * on the system.
+	 */
+	if (PAGE_SIZE != SZ_64K)
+		parange = min(parange, (unsigned int)ID_AA64MMFR0_PARANGE_48);
 
 	/*
 	 * Check with ARMv8.5-GTG that our PAGE_SIZE is supported at

From f10f727cf9f452909be535a4e2db51baca7dff41 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 12 Aug 2021 10:00:04 +0300
Subject: [PATCH 0395/1750] PCI: Fix pci_dev_str_match_path() alloc while
 atomic bug

[ Upstream commit 7eb6ea4148579b85540a41d57bcec315b8af8ff8 ]

pci_dev_str_match_path() is often called with a spinlock held so the
allocation has to be atomic.  The call tree is:

  pci_specified_resource_alignment() <-- takes spin_lock();
    pci_dev_str_match()
      pci_dev_str_match_path()

Fixes: 45db33709ccc ("PCI: Allow specifying devices using a base bus and path of devfns")
Link: https://lore.kernel.org/r/20210812070004.GC31863@kili
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index eae6a9fdd33d..0d7109018a91 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -265,7 +265,7 @@ static int pci_dev_str_match_path(struct pci_dev *dev, const char *path,
 
 	*endptr = strchrnul(path, ';');
 
-	wpath = kmemdup_nul(path, *endptr - path, GFP_KERNEL);
+	wpath = kmemdup_nul(path, *endptr - path, GFP_ATOMIC);
 	if (!wpath)
 		return -ENOMEM;
 

From 87479b10eb72f82aa45e8dc6a3dd9bfaec38f9d7 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
Date: Fri, 16 Jul 2021 12:00:48 +0200
Subject: [PATCH 0396/1750] mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is
 set

[ Upstream commit a946506c48f3bd09363c9d2b0a178e55733bcbb6 ]

The driver was registering IRQ 0 when no IRQ was set. This leads to
warnings with newer kernels.

Clear the resource flags, so no resource is registered at all in this
case.

Fixes: 2f17dd34ffed ("mfd: tqmx86: IO controller with I2C, Wachdog and GPIO")
Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/tqmx86.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c
index ddddf08b6a4c..732013f40e4e 100644
--- a/drivers/mfd/tqmx86.c
+++ b/drivers/mfd/tqmx86.c
@@ -209,6 +209,8 @@ static int tqmx86_probe(struct platform_device *pdev)
 
 		/* Assumes the IRQ resource is first. */
 		tqmx_gpio_resources[0].start = gpio_irq;
+	} else {
+		tqmx_gpio_resources[0].flags = 0;
 	}
 
 	ocores_platfom_data.clock_khz = tqmx86_board_id_to_clk_rate(board_id);

From e8dfc446a16a81b5a12c87de7367d79ba3ff8b54 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Tue, 10 Aug 2021 11:07:14 +0900
Subject: [PATCH 0397/1750] tracing/boot: Fix a hist trigger dependency for
 boot time tracing

[ Upstream commit 6fe7c745f2acb73e4cc961d7f91125eef5a8861f ]

Fixes a build error when CONFIG_HIST_TRIGGERS=n with boot-time
tracing. Since the trigger_process_regex() is defined only
when CONFIG_HIST_TRIGGERS=y, if it is disabled, the 'actions'
event option also must be disabled.

Link: https://lkml.kernel.org/r/162856123376.203126.582144262622247352.stgit@devnote2

Fixes: 81a59555ff15 ("tracing/boot: Add per-event settings")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/trace_boot.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace_boot.c b/kernel/trace/trace_boot.c
index a82f03f385f8..0996d59750ff 100644
--- a/kernel/trace/trace_boot.c
+++ b/kernel/trace/trace_boot.c
@@ -205,12 +205,15 @@ trace_boot_init_one_event(struct trace_array *tr, struct xbc_node *gnode,
 			pr_err("Failed to apply filter: %s\n", buf);
 	}
 
-	xbc_node_for_each_array_value(enode, "actions", anode, p) {
-		if (strlcpy(buf, p, ARRAY_SIZE(buf)) >= ARRAY_SIZE(buf))
-			pr_err("action string is too long: %s\n", p);
-		else if (trigger_process_regex(file, buf) < 0)
-			pr_err("Failed to apply an action: %s\n", buf);
-	}
+	if (IS_ENABLED(CONFIG_HIST_TRIGGERS)) {
+		xbc_node_for_each_array_value(enode, "actions", anode, p) {
+			if (strlcpy(buf, p, ARRAY_SIZE(buf)) >= ARRAY_SIZE(buf))
+				pr_err("action string is too long: %s\n", p);
+			else if (trigger_process_regex(file, buf) < 0)
+				pr_err("Failed to apply an action: %s\n", buf);
+		}
+	} else if (xbc_node_find_value(enode, "actions", NULL))
+		pr_err("Failed to apply event actions because CONFIG_HIST_TRIGGERS is not set.\n");
 
 	if (xbc_node_find_value(enode, "enable", NULL)) {
 		if (trace_event_enable_disable(file, 1, 0) < 0)

From 812cbb143c12596ad2f2cc289e73a5afe462675f Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Tue, 17 Aug 2021 19:48:56 +0800
Subject: [PATCH 0398/1750] mtd: mtdconcat: Judge callback existence based on
 the master

[ Upstream commit f9e109a209a8e01e16f37e1252304f1eb3908be4 ]

Since commit 46b5889cc2c5("mtd: implement proper partition handling")
applied, mtd partition device won't hold some callback functions, such
as _block_isbad, _block_markbad, etc. Besides, function mtd_block_isbad()
will get mtd device's master mtd device, then invokes master mtd device's
callback function. So, following process may result mtd_block_isbad()
always return 0, even though mtd device has bad blocks:

1. Split a mtd device into 3 partitions: PA, PB, PC
[ Each mtd partition device won't has callback function _block_isbad(). ]
2. Concatenate PA and PB as a new mtd device PN
[ mtd_concat_create() finds out each subdev has no callback function
_block_isbad(), so PN won't be assigned callback function
concat_block_isbad(). ]
Then, mtd_block_isbad() checks "!master->_block_isbad" is true, will
always return 0.

Reproducer:
// reproduce.c
static int __init init_diy_module(void)
{
	struct mtd_info *mtd[2];
	struct mtd_info *mtd_combine = NULL;

	mtd[0] = get_mtd_device_nm("NAND simulator partition 0");
	if (!mtd[0]) {
		pr_err("cannot find mtd1\n");
		return -EINVAL;
	}
	mtd[1] = get_mtd_device_nm("NAND simulator partition 1");
	if (!mtd[1]) {
		pr_err("cannot find mtd2\n");
		return -EINVAL;
	}

	put_mtd_device(mtd[0]);
	put_mtd_device(mtd[1]);

	mtd_combine = mtd_concat_create(mtd, 2, "Combine mtd");
	if (mtd_combine == NULL) {
		pr_err("combine failed\n");
		return -EINVAL;
	}

	mtd_device_register(mtd_combine, NULL, 0);
	pr_info("Combine success\n");

	return 0;
}

1. ID="0x20,0xac,0x00,0x15"
2. modprobe nandsim id_bytes=$ID parts=50,100 badblocks=100
3. insmod reproduce.ko
4. flash_erase /dev/mtd3 0 0
  libmtd: error!: MEMERASE64 ioctl failed for eraseblock 100 (mtd3)
  error 5 (Input/output error)
  // Should be "flash_erase: Skipping bad block at 00c80000"

Fixes: 46b5889cc2c54bac ("mtd: implement proper partition handling")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-2-chengzhihao1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdconcat.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 6e4d0017c0bd..af51eee6b5e8 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -641,6 +641,7 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
 	int i;
 	size_t size;
 	struct mtd_concat *concat;
+	struct mtd_info *subdev_master = NULL;
 	uint32_t max_erasesize, curr_erasesize;
 	int num_erase_region;
 	int max_writebufsize = 0;
@@ -679,17 +680,19 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
 	concat->mtd.subpage_sft = subdev[0]->subpage_sft;
 	concat->mtd.oobsize = subdev[0]->oobsize;
 	concat->mtd.oobavail = subdev[0]->oobavail;
-	if (subdev[0]->_writev)
+
+	subdev_master = mtd_get_master(subdev[0]);
+	if (subdev_master->_writev)
 		concat->mtd._writev = concat_writev;
-	if (subdev[0]->_read_oob)
+	if (subdev_master->_read_oob)
 		concat->mtd._read_oob = concat_read_oob;
-	if (subdev[0]->_write_oob)
+	if (subdev_master->_write_oob)
 		concat->mtd._write_oob = concat_write_oob;
-	if (subdev[0]->_block_isbad)
+	if (subdev_master->_block_isbad)
 		concat->mtd._block_isbad = concat_block_isbad;
-	if (subdev[0]->_block_markbad)
+	if (subdev_master->_block_markbad)
 		concat->mtd._block_markbad = concat_block_markbad;
-	if (subdev[0]->_panic_write)
+	if (subdev_master->_panic_write)
 		concat->mtd._panic_write = concat_panic_write;
 
 	concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks;
@@ -721,14 +724,22 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
 				    subdev[i]->flags & MTD_WRITEABLE;
 		}
 
+		subdev_master = mtd_get_master(subdev[i]);
 		concat->mtd.size += subdev[i]->size;
 		concat->mtd.ecc_stats.badblocks +=
 			subdev[i]->ecc_stats.badblocks;
 		if (concat->mtd.writesize   !=  subdev[i]->writesize ||
 		    concat->mtd.subpage_sft != subdev[i]->subpage_sft ||
 		    concat->mtd.oobsize    !=  subdev[i]->oobsize ||
-		    !concat->mtd._read_oob  != !subdev[i]->_read_oob ||
-		    !concat->mtd._write_oob != !subdev[i]->_write_oob) {
+		    !concat->mtd._read_oob  != !subdev_master->_read_oob ||
+		    !concat->mtd._write_oob != !subdev_master->_write_oob) {
+			/*
+			 * Check against subdev[i] for data members, because
+			 * subdev's attributes may be different from master
+			 * mtd device. Check against subdev's master mtd
+			 * device for callbacks, because the existence of
+			 * subdev's callbacks is decided by master mtd device.
+			 */
 			kfree(concat);
 			printk("Incompatible OOB or ECC data on \"%s\"\n",
 			       subdev[i]->name);

From b9b89da56af761fbb12da26ca5eb0c068446ec16 Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Tue, 17 Aug 2021 19:48:57 +0800
Subject: [PATCH 0399/1750] mtd: mtdconcat: Check _read, _write callbacks
 existence before assignment

[ Upstream commit a89d69a44e282be95ae76125dddc79515541efeb ]

Since 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() as wrappers
around mtd_{read,write}_oob()") don't allow _write|_read and
_write_oob|_read_oob existing at the same time, we should check the
existence of callbacks "_read and _write" from subdev's master device
(We can trust master device since it has been registered) before
assigning, otherwise following warning occurs while making
concatenated device:

  WARNING: CPU: 2 PID: 6728 at drivers/mtd/mtdcore.c:595
  add_mtd_device+0x7f/0x7b0

Fixes: 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() around ...")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-3-chengzhihao1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdconcat.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index af51eee6b5e8..f685a581df48 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -694,6 +694,10 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
 		concat->mtd._block_markbad = concat_block_markbad;
 	if (subdev_master->_panic_write)
 		concat->mtd._panic_write = concat_panic_write;
+	if (subdev_master->_read)
+		concat->mtd._read = concat_read;
+	if (subdev_master->_write)
+		concat->mtd._write = concat_write;
 
 	concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks;
 
@@ -755,8 +759,6 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[],	/* subdevices to c
 	concat->mtd.name = name;
 
 	concat->mtd._erase = concat_erase;
-	concat->mtd._read = concat_read;
-	concat->mtd._write = concat_write;
 	concat->mtd._sync = concat_sync;
 	concat->mtd._lock = concat_lock;
 	concat->mtd._unlock = concat_unlock;

From 53921242cf995a6c9867154696ba9f07b6bd7957 Mon Sep 17 00:00:00 2001
From: Oliver Upton <oupton@google.com>
Date: Wed, 18 Aug 2021 20:21:30 +0000
Subject: [PATCH 0400/1750] KVM: arm64: Fix read-side race on updates to vcpu
 reset state

[ Upstream commit 6654f9dfcb88fea3b9affc180dc3c04333d0f306 ]

KVM correctly serializes writes to a vCPU's reset state, however since
we do not take the KVM lock on the read side it is entirely possible to
read state from two different reset requests.

Cure the race for now by taking the KVM lock when reading the
reset_state structure.

Fixes: 358b28f09f0a ("arm/arm64: KVM: Allow a VCPU to fully reset itself")
Signed-off-by: Oliver Upton <oupton@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210818202133.1106786-2-oupton@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/reset.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index 6058a80ec9ec..204c62debf06 100644
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -263,10 +263,16 @@ static bool vcpu_allowed_register_width(struct kvm_vcpu *vcpu)
  */
 int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
 {
+	struct vcpu_reset_state reset_state;
 	int ret;
 	bool loaded;
 	u32 pstate;
 
+	mutex_lock(&vcpu->kvm->lock);
+	reset_state = vcpu->arch.reset_state;
+	WRITE_ONCE(vcpu->arch.reset_state.reset, false);
+	mutex_unlock(&vcpu->kvm->lock);
+
 	/* Reset PMU outside of the non-preemptible section */
 	kvm_pmu_vcpu_reset(vcpu);
 
@@ -325,8 +331,8 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
 	 * Additional reset state handling that PSCI may have imposed on us.
 	 * Must be done after all the sys_reg reset.
 	 */
-	if (vcpu->arch.reset_state.reset) {
-		unsigned long target_pc = vcpu->arch.reset_state.pc;
+	if (reset_state.reset) {
+		unsigned long target_pc = reset_state.pc;
 
 		/* Gracefully handle Thumb2 entry point */
 		if (vcpu_mode_is_32bit(vcpu) && (target_pc & 1)) {
@@ -335,13 +341,11 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
 		}
 
 		/* Propagate caller endianness */
-		if (vcpu->arch.reset_state.be)
+		if (reset_state.be)
 			kvm_vcpu_set_be(vcpu);
 
 		*vcpu_pc(vcpu) = target_pc;
-		vcpu_set_reg(vcpu, 0, vcpu->arch.reset_state.r0);
-
-		vcpu->arch.reset_state.reset = false;
+		vcpu_set_reg(vcpu, 0, reset_state.r0);
 	}
 
 	/* Reset timer */

From a957d82b23161f175b124ef30b005a56e84e7ef2 Mon Sep 17 00:00:00 2001
From: Oliver Upton <oupton@google.com>
Date: Wed, 18 Aug 2021 20:21:31 +0000
Subject: [PATCH 0401/1750] KVM: arm64: Handle PSCI resets before userspace
 touches vCPU state

[ Upstream commit 6826c6849b46aaa91300201213701eb861af4ba0 ]

The CPU_ON PSCI call takes a payload that KVM uses to configure a
destination vCPU to run. This payload is non-architectural state and not
exposed through any existing UAPI. Effectively, we have a race between
CPU_ON and userspace saving/restoring a guest: if the target vCPU isn't
ran again before the VMM saves its state, the requested PC and context
ID are lost. When restored, the target vCPU will be runnable and start
executing at its old PC.

We can avoid this race by making sure the reset payload is serviced
before userspace can access a vCPU's state.

Fixes: 358b28f09f0a ("arm/arm64: KVM: Allow a VCPU to fully reset itself")
Signed-off-by: Oliver Upton <oupton@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210818202133.1106786-3-oupton@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/arm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 5e5dd99e8cee..5bc978be8043 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -1143,6 +1143,14 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
 		if (copy_from_user(&reg, argp, sizeof(reg)))
 			break;
 
+		/*
+		 * We could owe a reset due to PSCI. Handle the pending reset
+		 * here to ensure userspace register accesses are ordered after
+		 * the reset.
+		 */
+		if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu))
+			kvm_reset_vcpu(vcpu);
+
 		if (ioctl == KVM_SET_ONE_REG)
 			r = kvm_arm_set_reg(vcpu, &reg);
 		else

From 5402b31c0c46fde28bbbc7993ce0d2823847d80c Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Fri, 13 Aug 2021 18:36:19 +0300
Subject: [PATCH 0402/1750] PCI: Sync __pci_register_driver() stub for
 CONFIG_PCI=n

[ Upstream commit 817f9916a6e96ae43acdd4e75459ef4f92d96eb1 ]

The CONFIG_PCI=y case got a new parameter long time ago.  Sync the stub as
well.

[bhelgaas: add parameter names]
Fixes: 725522b5453d ("PCI: add the sysfs driver name to all modules")
Link: https://lore.kernel.org/r/20210813153619.89574-1-andriy.shevchenko@linux.intel.com
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/pci.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/linux/pci.h b/include/linux/pci.h
index 22207a79762c..a55097b4d992 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1713,8 +1713,9 @@ static inline void pci_disable_device(struct pci_dev *dev) { }
 static inline int pcim_enable_device(struct pci_dev *pdev) { return -EIO; }
 static inline int pci_assign_resource(struct pci_dev *dev, int i)
 { return -EBUSY; }
-static inline int __pci_register_driver(struct pci_driver *drv,
-					struct module *owner)
+static inline int __must_check __pci_register_driver(struct pci_driver *drv,
+						     struct module *owner,
+						     const char *mod_name)
 { return 0; }
 static inline int pci_register_driver(struct pci_driver *drv)
 { return 0; }

From 9da1fb128c5492fb7204eabf32d2f80575beed23 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 21 Aug 2021 09:58:45 +0200
Subject: [PATCH 0403/1750] mtd: rawnand: cafe: Fix a resource leak in the
 error handling path of 'cafe_nand_probe()'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6b430c7595e4eb95fae8fb54adc3c3ce002e75ae ]

A successful 'init_rs_non_canonical()' call should be balanced by a
corresponding 'free_rs()' call in the error handling path of the probe, as
already done in the remove function.

Update the error handling path accordingly.

Fixes: 8c61b7a7f4d4 ("[MTD] [NAND] Use rslib for CAFÉ ECC")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/fd313d3fb787458bcc73189e349f481133a2cdc9.1629532640.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/nand/raw/cafe_nand.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/cafe_nand.c b/drivers/mtd/nand/raw/cafe_nand.c
index 2b94f385a1a8..04502d22efc9 100644
--- a/drivers/mtd/nand/raw/cafe_nand.c
+++ b/drivers/mtd/nand/raw/cafe_nand.c
@@ -751,7 +751,7 @@ static int cafe_nand_probe(struct pci_dev *pdev,
 			  "CAFE NAND", mtd);
 	if (err) {
 		dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq);
-		goto out_ior;
+		goto out_free_rs;
 	}
 
 	/* Disable master reset, enable NAND clock */
@@ -795,6 +795,8 @@ static int cafe_nand_probe(struct pci_dev *pdev,
 	/* Disable NAND IRQ in global IRQ mask register */
 	cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK);
 	free_irq(pdev->irq, mtd);
+ out_free_rs:
+	free_rs(cafe->rs);
  out_ior:
 	pci_iounmap(pdev, cafe->mmio);
  out_free_mtd:

From f5176a0798bd286a1fb2061a28f136fe1fdb0cc2 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Mon, 16 Aug 2021 14:05:33 -0700
Subject: [PATCH 0404/1750] ARC: export clear_user_page() for modules

[ Upstream commit 6b5ff0405e4190f23780362ea324b250bc495683 ]

0day bot reports a build error:
  ERROR: modpost: "clear_user_page" [drivers/media/v4l2-core/videobuf-dma-sg.ko] undefined!
so export it in arch/arc/ to fix the build error.

In most ARCHes, clear_user_page() is a macro. OTOH, in a few
ARCHes it is a function and needs to be exported.
PowerPC exported it in 2004. It looks like nds32 and nios2
still need to have it exported.

Fixes: 4102b53392d63 ("ARC: [mm] Aliasing VIPT dcache support 2/4")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: linux-snps-arc@lists.infradead.org
Signed-off-by: Vineet Gupta <vgupta@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arc/mm/cache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index a2fbea3ee07c..102418ac5ff4 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -1123,7 +1123,7 @@ void clear_user_page(void *to, unsigned long u_vaddr, struct page *page)
 	clear_page(to);
 	clear_bit(PG_dc_clean, &page->flags);
 }
-
+EXPORT_SYMBOL(clear_user_page);
 
 /**********************************************************************
  * Explicit Cache flush request from user space via syscall

From 5a20adc388114bdfe5f8c1fee39703f840a1ddbb Mon Sep 17 00:00:00 2001
From: Li Huafei <lihuafei1@huawei.com>
Date: Mon, 23 Aug 2021 21:43:40 +0800
Subject: [PATCH 0405/1750] perf unwind: Do not overwrite
 FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64}

[ Upstream commit cdf32b44678c382a31dc183d9a767306915cda7b ]

When setting LIBUNWIND_DIR, we first set

 FEATURE_CHECK_LDFLAGS-libunwind-{aarch64,x86} = -L$(LIBUNWIND_DIR)/lib.

<committer note>
This happens a bit before, the overwritting, in:

  libunwind_arch_set_flags = $(eval $(libunwind_arch_set_flags_code))
  define libunwind_arch_set_flags_code
    FEATURE_CHECK_CFLAGS-libunwind-$(1)  = -I$(LIBUNWIND_DIR)/include
    FEATURE_CHECK_LDFLAGS-libunwind-$(1) = -L$(LIBUNWIND_DIR)/lib
  endef

  ifdef LIBUNWIND_DIR
    LIBUNWIND_CFLAGS  = -I$(LIBUNWIND_DIR)/include
    LIBUNWIND_LDFLAGS = -L$(LIBUNWIND_DIR)/lib
    LIBUNWIND_ARCHS = x86 x86_64 arm aarch64 debug-frame-arm debug-frame-aarch64
    $(foreach libunwind_arch,$(LIBUNWIND_ARCHS),$(call libunwind_arch_set_flags,$(libunwind_arch)))
  endif

Look at that 'foreach' on all the LIBUNWIND_ARCHS.
</>

After commit 5c4d7c82c0dc ("perf unwind: Do not put libunwind-{x86,aarch64}
in FEATURE_TESTS_BASIC"), FEATURE_CHECK_LDFLAGS-libunwind-{x86,aarch64} is
overwritten. As a result, the remote libunwind libraries cannot be searched
from $(LIBUNWIND_DIR)/lib directory during feature check tests. Fix it with
variable appending.

Before this patch:

  perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64
   BUILD:   Doing 'make -j16' parallel build
  <SNIP>
  ...
  ...                    libopencsd: [ OFF ]
  ...                 libunwind-x86: [ OFF ]
  ...              libunwind-x86_64: [ OFF ]
  ...                 libunwind-arm: [ OFF ]
  ...             libunwind-aarch64: [ OFF ]
  ...         libunwind-debug-frame: [ OFF ]
  ...     libunwind-debug-frame-arm: [ OFF ]
  ... libunwind-debug-frame-aarch64: [ OFF ]
  ...                           cxx: [ OFF ]
  <SNIP>

  perf$ cat ../build/feature/test-libunwind-aarch64.make.output
  /usr/bin/ld: cannot find -lunwind-aarch64
  /usr/bin/ld: cannot find -lunwind-aarch64
  collect2: error: ld returned 1 exit status

After this patch:

  perf$ make VF=1 LIBUNWIND_DIR=/opt/libunwind_aarch64
   BUILD:   Doing 'make -j16' parallel build
  <SNIP>
  ...                    libopencsd: [ OFF ]
  ...                 libunwind-x86: [ OFF ]
  ...              libunwind-x86_64: [ OFF ]
  ...                 libunwind-arm: [ OFF ]
  ...             libunwind-aarch64: [ on  ]
  ...         libunwind-debug-frame: [ OFF ]
  ...     libunwind-debug-frame-arm: [ OFF ]
  ... libunwind-debug-frame-aarch64: [ OFF ]
  ...                           cxx: [ OFF ]
  <SNIP>

  perf$ cat ../build/feature/test-libunwind-aarch64.make.output

  perf$ ldd ./perf
        linux-vdso.so.1 (0x00007ffdf07da000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f30953dc000)
        librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f30951d4000)
        libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f3094e36000)
        libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f3094c32000)
        libelf.so.1 => /usr/lib/x86_64-linux-gnu/libelf.so.1 (0x00007f3094a18000)
        libdw.so.1 => /usr/lib/x86_64-linux-gnu/libdw.so.1 (0x00007f30947cc000)
        libunwind-x86_64.so.8 => /usr/lib/x86_64-linux-gnu/libunwind-x86_64.so.8 (0x00007f30945ad000)
        libunwind.so.8 => /usr/lib/x86_64-linux-gnu/libunwind.so.8 (0x00007f3094392000)
        liblzma.so.5 => /lib/x86_64-linux-gnu/liblzma.so.5 (0x00007f309416c000)
        libunwind-aarch64.so.8 => not found
        libslang.so.2 => /lib/x86_64-linux-gnu/libslang.so.2 (0x00007f3093c8a000)
        libpython2.7.so.1.0 => /usr/local/lib/libpython2.7.so.1.0 (0x00007f309386b000)
        libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f309364e000)
        libnuma.so.1 => /usr/lib/x86_64-linux-gnu/libnuma.so.1 (0x00007f3093443000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3093052000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f3096097000)
        libbz2.so.1.0 => /lib/x86_64-linux-gnu/libbz2.so.1.0 (0x00007f3092e42000)
        libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f3092c3f000)

Fixes: 5c4d7c82c0dceccf ("perf unwind: Do not put libunwind-{x86,aarch64} in FEATURE_TESTS_BASIC")
Signed-off-by: Li Huafei <lihuafei1@huawei.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: He Kuang <hekuang@huawei.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Zhang Jinhao <zhangjinhao2@huawei.com>
Link: http://lore.kernel.org/lkml/20210823134340.60955-1-lihuafei1@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/Makefile.config | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
index 2abbd75fbf2e..014b959575ca 100644
--- a/tools/perf/Makefile.config
+++ b/tools/perf/Makefile.config
@@ -127,10 +127,10 @@ FEATURE_CHECK_LDFLAGS-libunwind = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS)
 FEATURE_CHECK_CFLAGS-libunwind-debug-frame = $(LIBUNWIND_CFLAGS)
 FEATURE_CHECK_LDFLAGS-libunwind-debug-frame = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS)
 
-FEATURE_CHECK_LDFLAGS-libunwind-arm = -lunwind -lunwind-arm
-FEATURE_CHECK_LDFLAGS-libunwind-aarch64 = -lunwind -lunwind-aarch64
-FEATURE_CHECK_LDFLAGS-libunwind-x86 = -lunwind -llzma -lunwind-x86
-FEATURE_CHECK_LDFLAGS-libunwind-x86_64 = -lunwind -llzma -lunwind-x86_64
+FEATURE_CHECK_LDFLAGS-libunwind-arm += -lunwind -lunwind-arm
+FEATURE_CHECK_LDFLAGS-libunwind-aarch64 += -lunwind -lunwind-aarch64
+FEATURE_CHECK_LDFLAGS-libunwind-x86 += -lunwind -llzma -lunwind-x86
+FEATURE_CHECK_LDFLAGS-libunwind-x86_64 += -lunwind -llzma -lunwind-x86_64
 
 FEATURE_CHECK_LDFLAGS-libcrypto = -lcrypto
 

From c2b52963fd0c2ceda4c75df66ff4a3129f148436 Mon Sep 17 00:00:00 2001
From: Arnaldo Carvalho de Melo <acme@redhat.com>
Date: Wed, 25 Aug 2021 11:50:37 -0300
Subject: [PATCH 0406/1750] perf bench inject-buildid: Handle writen() errors

[ Upstream commit edf7b4a2d85e37a1ee77156bddaed4aa6af9c5e1 ]

The build on fedora:35 and fedora:rawhide with clang is failing with:

  49    41.00 fedora:35                     : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35)
    bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable]
            u64 len = 0;
                ^
    1 error generated.
    make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2
  50    41.11 fedora:rawhide                : FAIL clang version 13.0.0 (Fedora 13.0.0~rc1-1.fc35)
    bench/inject-buildid.c:351:6: error: variable 'len' set but not used [-Werror,-Wunused-but-set-variable]
            u64 len = 0;
                ^
    1 error generated.
    make[3]: *** [/git/perf-5.14.0-rc7/tools/build/Makefile.build:139: bench] Error 2

That 'len' variable is not used at all, so just make sure all the
synthesize_RECORD() routines return ssize_t to propagate the writen()
return, as it may fail, ditch the 'ret' var and bail out if those
routines fail.

Fixes: 0bf02a0d80427f26 ("perf bench: Add build-id injection benchmark")
Acked-by: Namhyung Kim <namhyung@kernel.org>
Link: http://lore.kernel.org/lkml/CAM9d7cgEZNSor+B+7Y2C+QYGme_v5aH0Zn0RLfxoQ+Fy83EHrg@mail.gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/bench/inject-buildid.c | 52 ++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 22 deletions(-)

diff --git a/tools/perf/bench/inject-buildid.c b/tools/perf/bench/inject-buildid.c
index 280227e3ffd7..f4ec01da8da6 100644
--- a/tools/perf/bench/inject-buildid.c
+++ b/tools/perf/bench/inject-buildid.c
@@ -133,7 +133,7 @@ static u64 dso_map_addr(struct bench_dso *dso)
 	return 0x400000ULL + dso->ino * 8192ULL;
 }
 
-static u32 synthesize_attr(struct bench_data *data)
+static ssize_t synthesize_attr(struct bench_data *data)
 {
 	union perf_event event;
 
@@ -151,7 +151,7 @@ static u32 synthesize_attr(struct bench_data *data)
 	return writen(data->input_pipe[1], &event, event.header.size);
 }
 
-static u32 synthesize_fork(struct bench_data *data)
+static ssize_t synthesize_fork(struct bench_data *data)
 {
 	union perf_event event;
 
@@ -169,8 +169,7 @@ static u32 synthesize_fork(struct bench_data *data)
 	return writen(data->input_pipe[1], &event, event.header.size);
 }
 
-static u32 synthesize_mmap(struct bench_data *data, struct bench_dso *dso,
-			   u64 timestamp)
+static ssize_t synthesize_mmap(struct bench_data *data, struct bench_dso *dso, u64 timestamp)
 {
 	union perf_event event;
 	size_t len = offsetof(struct perf_record_mmap2, filename);
@@ -198,23 +197,25 @@ static u32 synthesize_mmap(struct bench_data *data, struct bench_dso *dso,
 
 	if (len > sizeof(event.mmap2)) {
 		/* write mmap2 event first */
-		writen(data->input_pipe[1], &event, len - bench_id_hdr_size);
+		if (writen(data->input_pipe[1], &event, len - bench_id_hdr_size) < 0)
+			return -1;
 		/* zero-fill sample id header */
 		memset(id_hdr_ptr, 0, bench_id_hdr_size);
 		/* put timestamp in the right position */
 		ts_idx = (bench_id_hdr_size / sizeof(u64)) - 2;
 		id_hdr_ptr[ts_idx] = timestamp;
-		writen(data->input_pipe[1], id_hdr_ptr, bench_id_hdr_size);
-	} else {
-		ts_idx = (len / sizeof(u64)) - 2;
-		id_hdr_ptr[ts_idx] = timestamp;
-		writen(data->input_pipe[1], &event, len);
+		if (writen(data->input_pipe[1], id_hdr_ptr, bench_id_hdr_size) < 0)
+			return -1;
+
+		return len;
 	}
-	return len;
+
+	ts_idx = (len / sizeof(u64)) - 2;
+	id_hdr_ptr[ts_idx] = timestamp;
+	return writen(data->input_pipe[1], &event, len);
 }
 
-static u32 synthesize_sample(struct bench_data *data, struct bench_dso *dso,
-			     u64 timestamp)
+static ssize_t synthesize_sample(struct bench_data *data, struct bench_dso *dso, u64 timestamp)
 {
 	union perf_event event;
 	struct perf_sample sample = {
@@ -233,7 +234,7 @@ static u32 synthesize_sample(struct bench_data *data, struct bench_dso *dso,
 	return writen(data->input_pipe[1], &event, event.header.size);
 }
 
-static u32 synthesize_flush(struct bench_data *data)
+static ssize_t synthesize_flush(struct bench_data *data)
 {
 	struct perf_event_header header = {
 		.size = sizeof(header),
@@ -348,14 +349,16 @@ static int inject_build_id(struct bench_data *data, u64 *max_rss)
 	int status;
 	unsigned int i, k;
 	struct rusage rusage;
-	u64 len = 0;
 
 	/* this makes the child to run */
 	if (perf_header__write_pipe(data->input_pipe[1]) < 0)
 		return -1;
 
-	len += synthesize_attr(data);
-	len += synthesize_fork(data);
+	if (synthesize_attr(data) < 0)
+		return -1;
+
+	if (synthesize_fork(data) < 0)
+		return -1;
 
 	for (i = 0; i < nr_mmaps; i++) {
 		int idx = rand() % (nr_dsos - 1);
@@ -363,13 +366,18 @@ static int inject_build_id(struct bench_data *data, u64 *max_rss)
 		u64 timestamp = rand() % 1000000;
 
 		pr_debug2("   [%d] injecting: %s\n", i+1, dso->name);
-		len += synthesize_mmap(data, dso, timestamp);
+		if (synthesize_mmap(data, dso, timestamp) < 0)
+			return -1;
 
-		for (k = 0; k < nr_samples; k++)
-			len += synthesize_sample(data, dso, timestamp + k * 1000);
+		for (k = 0; k < nr_samples; k++) {
+			if (synthesize_sample(data, dso, timestamp + k * 1000) < 0)
+				return -1;
+		}
 
-		if ((i + 1) % 10 == 0)
-			len += synthesize_flush(data);
+		if ((i + 1) % 10 == 0) {
+			if (synthesize_flush(data) < 0)
+				return -1;
+		}
 	}
 
 	/* tihs makes the child to finish */

From f86956143da9a32f5f7c5cef248563c65dbee47c Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Fri, 20 Aug 2021 17:37:55 +0200
Subject: [PATCH 0407/1750] gpio: mpc8xxx: Fix a resources leak in the error
 handling path of 'mpc8xxx_probe()'

[ Upstream commit 555bda42b0c1a5ffb72d3227c043e8afde778f1f ]

Commit 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal")
has introduced a new 'goto err;' at the very end of the function, but has
not updated the error handling path accordingly.

Add the now missing 'irq_domain_remove()' call which balances a previous
'irq_domain_create_linear() call.

Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mpc8xxx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 3c2fa44d9279..5b2a919a6644 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -406,6 +406,8 @@ static int mpc8xxx_probe(struct platform_device *pdev)
 
 	return 0;
 err:
+	if (mpc8xxx_gc->irq)
+		irq_domain_remove(mpc8xxx_gc->irq);
 	iounmap(mpc8xxx_gc->regs);
 	return ret;
 }

From b167a0cec18772a52c04445b1c46f62f737d10e3 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Fri, 20 Aug 2021 17:38:13 +0200
Subject: [PATCH 0408/1750] gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to
 simplify the code and avoid a leak

[ Upstream commit 889a1b3f35db6ba5ba6a0c23a3a55594570b6a17 ]

If an error occurs after a 'gpiochip_add_data()' call it must be undone by
a corresponding 'gpiochip_remove()' as already done in the remove function.

To simplify the code a fix a leak in the error handling path of the probe,
use the managed version instead (i.e. 'devm_gpiochip_add_data()')

Fixes: 698b8eeaed72 ("gpio/mpc8xxx: change irq handler from chained to normal")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mpc8xxx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-mpc8xxx.c b/drivers/gpio/gpio-mpc8xxx.c
index 5b2a919a6644..d60d5520707d 100644
--- a/drivers/gpio/gpio-mpc8xxx.c
+++ b/drivers/gpio/gpio-mpc8xxx.c
@@ -374,7 +374,7 @@ static int mpc8xxx_probe(struct platform_device *pdev)
 	    of_device_is_compatible(np, "fsl,ls1088a-gpio"))
 		gc->write_reg(mpc8xxx_gc->regs + GPIO_IBE, 0xffffffff);
 
-	ret = gpiochip_add_data(gc, mpc8xxx_gc);
+	ret = devm_gpiochip_add_data(&pdev->dev, gc, mpc8xxx_gc);
 	if (ret) {
 		pr_err("%pOF: GPIO chip registration failed with status %d\n",
 		       np, ret);
@@ -421,7 +421,6 @@ static int mpc8xxx_remove(struct platform_device *pdev)
 		irq_domain_remove(mpc8xxx_gc->irq);
 	}
 
-	gpiochip_remove(&mpc8xxx_gc->gc);
 	iounmap(mpc8xxx_gc->regs);
 
 	return 0;

From 5711ced58eb4ad37b3b71409294505abe572e26b Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Tue, 31 Aug 2021 20:50:50 +0200
Subject: [PATCH 0409/1750] net: dsa: tag_rtl4_a: Fix egress tags

[ Upstream commit 0e90dfa7a8d817db755c7b5d89d77b9c485e4180 ]

I noticed that only port 0 worked on the RTL8366RB since we
started to use custom tags.

It turns out that the format of egress custom tags is actually
different from ingress custom tags. While the lower bits just
contain the port number in ingress tags, egress tags need to
indicate destination port by setting the bit for the
corresponding port.

It was working on port 0 because port 0 added 0x00 as port
number in the lower bits, and if you do this the packet appears
at all ports, including the intended port. Ooops.

Fix this and all ports work again. Use the define for shifting
the "type A" into place while we're at it.

Tested on the D-Link DIR-685 by sending traffic to each of
the ports in turn. It works.

Fixes: 86dd9868b878 ("net: dsa: tag_rtl4_a: Support also egress tags")
Cc: DENG Qingfang <dqfext@gmail.com>
Cc: Mauri Sandberg <sandberg@mailfence.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dsa/tag_rtl4_a.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/dsa/tag_rtl4_a.c b/net/dsa/tag_rtl4_a.c
index e9176475bac8..24375ebd684e 100644
--- a/net/dsa/tag_rtl4_a.c
+++ b/net/dsa/tag_rtl4_a.c
@@ -54,9 +54,10 @@ static struct sk_buff *rtl4a_tag_xmit(struct sk_buff *skb,
 	p = (__be16 *)tag;
 	*p = htons(RTL4_A_ETHERTYPE);
 
-	out = (RTL4_A_PROTOCOL_RTL8366RB << 12) | (2 << 8);
-	/* The lower bits is the port number */
-	out |= (u8)dp->index;
+	out = (RTL4_A_PROTOCOL_RTL8366RB << RTL4_A_PROTOCOL_SHIFT) | (2 << 8);
+	/* The lower bits indicate the port number */
+	out |= BIT(dp->index);
+
 	p = (__be16 *)(tag + 2);
 	*p = htons(out);
 

From f450958f7ff8e99a3e511ae4732dbe67f54c5223 Mon Sep 17 00:00:00 2001
From: Matthieu Baerts <matthieu.baerts@tessares.net>
Date: Wed, 1 Sep 2021 10:15:37 -0700
Subject: [PATCH 0410/1750] selftests: mptcp: clean tmp files in simult_flows

[ Upstream commit bfd862a7e9318dd906844807a713d27cdd1a72b1 ]

'$cin' and '$sin' variables are local to a function: they are then not
available from the cleanup trap.

Instead, we need to use '$large' and '$small' that are not local and
defined just before setting the trap.

Without this patch, running this script in a loop might cause a:

  write: No space left on device

issue.

Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests")
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/mptcp/simult_flows.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/simult_flows.sh b/tools/testing/selftests/net/mptcp/simult_flows.sh
index 2f649b431456..8fcb28927818 100755
--- a/tools/testing/selftests/net/mptcp/simult_flows.sh
+++ b/tools/testing/selftests/net/mptcp/simult_flows.sh
@@ -21,8 +21,8 @@ usage() {
 
 cleanup()
 {
-	rm -f "$cin" "$cout"
-	rm -f "$sin" "$sout"
+	rm -f "$cout" "$sout"
+	rm -f "$large" "$small"
 	rm -f "$capout"
 
 	local netns

From f89b0d032f86df6174f4c542ccb0bcdc2630718d Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Thu, 2 Sep 2021 16:36:09 +0800
Subject: [PATCH 0411/1750] net: hso: add failure handler for add_net_device

[ Upstream commit ecdc28defc46af476566fffd9e5cb4495a2f176e ]

If the network devices connected to the system beyond
HSO_MAX_NET_DEVICES. add_net_device() in hso_create_net_device()
will be failed for the network_table is full. It will lead to
business failure which rely on network_table, for example,
hso_suspend() and hso_resume(). It will also lead to memory leak
because resource release process can not search the hso_device
object from network_table in hso_free_interface().

Add failure handler for add_net_device() in hso_create_net_device()
to solve the above problems.

Fixes: 72dc1c096c70 ("HSO: add option hso driver")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/hso.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 5b3aff2c279f..f269337c82c5 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2537,13 +2537,17 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
 	if (!hso_net->mux_bulk_tx_buf)
 		goto err_free_tx_urb;
 
-	add_net_device(hso_dev);
+	result = add_net_device(hso_dev);
+	if (result) {
+		dev_err(&interface->dev, "Failed to add net device\n");
+		goto err_free_tx_buf;
+	}
 
 	/* registering our net device */
 	result = register_netdev(net);
 	if (result) {
 		dev_err(&interface->dev, "Failed to register device\n");
-		goto err_free_tx_buf;
+		goto err_rmv_ndev;
 	}
 
 	hso_log_port(hso_dev);
@@ -2552,8 +2556,9 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
 
 	return hso_dev;
 
-err_free_tx_buf:
+err_rmv_ndev:
 	remove_net_device(hso_dev);
+err_free_tx_buf:
 	kfree(hso_net->mux_bulk_tx_buf);
 err_free_tx_urb:
 	usb_free_urb(hso_net->mux_bulk_tx_urb);

From 0db7e0d9f67da8789d2aea12e0464e40359f9bd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Thu, 2 Sep 2021 10:30:50 +0200
Subject: [PATCH 0412/1750] net: dsa: b53: Fix calculating number of switch
 ports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit cdb067d31c0fe4cce98b9d15f1f2ef525acaa094 ]

It isn't true that CPU port is always the last one. Switches BCM5301x
have 9 ports (port 6 being inactive) and they use port 5 as CPU by
default (depending on design some other may be CPU ports too).

A more reliable way of determining number of ports is to check for the
last set bit in the "enabled_ports" bitfield.

This fixes b53 internal state, it will allow providing accurate info to
the DSA and is required to fix BCM5301x support.

Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/b53/b53_common.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 52100d4fe5a2..a8e915dd826a 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2556,9 +2556,8 @@ static int b53_switch_init(struct b53_device *dev)
 			dev->cpu_port = 5;
 	}
 
-	/* cpu port is always last */
-	dev->num_ports = dev->cpu_port + 1;
 	dev->enabled_ports |= BIT(dev->cpu_port);
+	dev->num_ports = fls(dev->enabled_ports);
 
 	/* Include non standard CPU port built-in PHYs to be probed */
 	if (is539x(dev) || is531x5(dev)) {

From c361c955609a48d993f07caa93fdcc516de20849 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Thu, 2 Sep 2021 10:30:51 +0200
Subject: [PATCH 0413/1750] net: dsa: b53: Set correct number of ports in the
 DSA struct
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d12e1c4649883e8ca5e8ff341e1948b3b6313259 ]

Setting DSA_MAX_PORTS caused DSA to call b53 callbacks (e.g.
b53_disable_port() during dsa_register_switch()) for invalid
(non-existent) ports. That made b53 modify unrelated registers and is
one of reasons for a broken BCM5301x support.

This problem exists for years but DSA_MAX_PORTS usage has changed few
times. It seems the most accurate to reference commit dropping
dsa_switch_alloc() in the Fixes tag.

Fixes: 7e99e3470172 ("net: dsa: remove dsa_switch_alloc helper")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/b53/b53_common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index a8e915dd826a..54558f47b633 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2559,6 +2559,8 @@ static int b53_switch_init(struct b53_device *dev)
 	dev->enabled_ports |= BIT(dev->cpu_port);
 	dev->num_ports = fls(dev->enabled_ports);
 
+	dev->ds->num_ports = min_t(unsigned int, dev->num_ports, DSA_MAX_PORTS);
+
 	/* Include non standard CPU port built-in PHYs to be probed */
 	if (is539x(dev) || is531x5(dev)) {
 		for (i = 0; i < dev->num_ports; i++) {
@@ -2603,7 +2605,6 @@ struct b53_device *b53_switch_alloc(struct device *base,
 		return NULL;
 
 	ds->dev = base;
-	ds->num_ports = DSA_MAX_PORTS;
 
 	dev = devm_kzalloc(base, sizeof(*dev), GFP_KERNEL);
 	if (!dev)

From 6e2d36f2b1d19bee1096a53e6cbc9e0c0f0b05b4 Mon Sep 17 00:00:00 2001
From: Benjamin Hesmans <benjamin.hesmans@tessares.net>
Date: Fri, 3 Sep 2021 15:23:35 +0200
Subject: [PATCH 0414/1750] netfilter: socket: icmp6: fix use-after-scope

[ Upstream commit 730affed24bffcd1eebd5903171960f5ff9f1f22 ]

Bug reported by KASAN:

BUG: KASAN: use-after-scope in inet6_ehashfn (net/ipv6/inet6_hashtables.c:40)
Call Trace:
(...)
inet6_ehashfn (net/ipv6/inet6_hashtables.c:40)
(...)
nf_sk_lookup_slow_v6 (net/ipv6/netfilter/nf_socket_ipv6.c:91
net/ipv6/netfilter/nf_socket_ipv6.c:146)

It seems that this bug has already been fixed by Eric Dumazet in the
past in:
commit 78296c97ca1f ("netfilter: xt_socket: fix a stack corruption bug")

But a variant of the same issue has been introduced in
commit d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match")

`daddr` and `saddr` potentially hold a reference to ipv6_var that is no
longer in scope when the call to `nf_socket_get_sock_v6` is made.

Fixes: d64d80a2cde9 ("netfilter: x_tables: don't extract flow keys on early demuxed sks in socket match")
Acked-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Benjamin Hesmans <benjamin.hesmans@tessares.net>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/netfilter/nf_socket_ipv6.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c
index 6fd54744cbc3..aa5bb8789ba0 100644
--- a/net/ipv6/netfilter/nf_socket_ipv6.c
+++ b/net/ipv6/netfilter/nf_socket_ipv6.c
@@ -99,7 +99,7 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
 {
 	__be16 dport, sport;
 	const struct in6_addr *daddr = NULL, *saddr = NULL;
-	struct ipv6hdr *iph = ipv6_hdr(skb);
+	struct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var;
 	struct sk_buff *data_skb = NULL;
 	int doff = 0;
 	int thoff = 0, tproto;
@@ -129,8 +129,6 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb,
 			thoff + sizeof(*hp);
 
 	} else if (tproto == IPPROTO_ICMPV6) {
-		struct ipv6hdr ipv6_var;
-
 		if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
 					 &sport, &dport, &ipv6_var))
 			return NULL;

From 8c01c620ae61142760d8924ee96a3ff8eec00aa6 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 3 Sep 2021 15:03:43 -0700
Subject: [PATCH 0415/1750] fq_codel: reject silly quantum parameters

[ Upstream commit c7c5e6ff533fe1f9afef7d2fa46678987a1335a7 ]

syzbot found that forcing a big quantum attribute would crash hosts fast,
essentially using this:

tc qd replace dev eth0 root fq_codel quantum 4294967295

This is because fq_codel_dequeue() would have to loop
~2^31 times in :

	if (flow->deficit <= 0) {
		flow->deficit += q->quantum;
		list_move_tail(&flow->flowchain, &q->old_flows);
		goto begin;
	}

SFQ max quantum is 2^19 (half a megabyte)
Lets adopt a max quantum of one megabyte for FQ_CODEL.

Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/pkt_sched.h |  2 ++
 net/sched/sch_fq_codel.c       | 12 ++++++++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h
index 9e7c2c607845..69079fbf3ed2 100644
--- a/include/uapi/linux/pkt_sched.h
+++ b/include/uapi/linux/pkt_sched.h
@@ -826,6 +826,8 @@ struct tc_codel_xstats {
 
 /* FQ_CODEL */
 
+#define FQ_CODEL_QUANTUM_MAX (1 << 20)
+
 enum {
 	TCA_FQ_CODEL_UNSPEC,
 	TCA_FQ_CODEL_TARGET,
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index bbd5f8753600..99e8db262198 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -369,6 +369,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
 {
 	struct fq_codel_sched_data *q = qdisc_priv(sch);
 	struct nlattr *tb[TCA_FQ_CODEL_MAX + 1];
+	u32 quantum = 0;
 	int err;
 
 	if (!opt)
@@ -386,6 +387,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
 		    q->flows_cnt > 65536)
 			return -EINVAL;
 	}
+	if (tb[TCA_FQ_CODEL_QUANTUM]) {
+		quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
+		if (quantum > FQ_CODEL_QUANTUM_MAX) {
+			NL_SET_ERR_MSG(extack, "Invalid quantum");
+			return -EINVAL;
+		}
+	}
 	sch_tree_lock(sch);
 
 	if (tb[TCA_FQ_CODEL_TARGET]) {
@@ -412,8 +420,8 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt,
 	if (tb[TCA_FQ_CODEL_ECN])
 		q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]);
 
-	if (tb[TCA_FQ_CODEL_QUANTUM])
-		q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM]));
+	if (quantum)
+		q->quantum = quantum;
 
 	if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE])
 		q->drop_batch_size = max(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]));

From 9c98d2bd143420a26d3ba1b096326f28247a058d Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Fri, 3 Sep 2021 15:35:43 +0800
Subject: [PATCH 0416/1750] qlcnic: Remove redundant unlock in
 qlcnic_pinit_from_rom

[ Upstream commit 9ddbc2a00d7f63fa9748f4278643193dac985f2d ]

Previous commit 68233c583ab4 removes the qlcnic_rom_lock()
in qlcnic_pinit_from_rom(), but remains its corresponding
unlock function, which is odd. I'm not very sure whether the
lock is missing, or the unlock is redundant. This bug is
suggested by a static analysis tool, please advise.

Fixes: 68233c583ab4 ("qlcnic: updated reset sequence")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index e6784023bce4..aa7ee43f9252 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -439,7 +439,6 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter)
 	QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, 1);
 	msleep(20);
 
-	qlcnic_rom_unlock(adapter);
 	/* big hammer don't reset CAM block on reset */
 	QLCWR32(adapter, QLCNIC_ROMUSB_GLB_SW_RESET, 0xfeffffff);
 

From 87b34cd6485192777f632f92d592f2a71d8801a6 Mon Sep 17 00:00:00 2001
From: Willem de Bruijn <willemb@google.com>
Date: Sun, 5 Sep 2021 11:21:09 -0400
Subject: [PATCH 0417/1750] ip_gre: validate csum_start only on pull

[ Upstream commit 8a0ed250f911da31a2aef52101bc707846a800ff ]

The GRE tunnel device can pull existing outer headers in ipge_xmit.
This is a rare path, apparently unique to this device. The below
commit ensured that pulling does not move skb->data beyond csum_start.

But it has a false positive if ip_summed is not CHECKSUM_PARTIAL and
thus csum_start is irrelevant.

Refine to exclude this. At the same time simplify and strengthen the
test.

Simplify, by moving the check next to the offending pull, making it
more self documenting and removing an unnecessary branch from other
code paths.

Strengthen, by also ensuring that the transport header is correct and
therefore the inner headers will be after skb_reset_inner_headers.
The transport header is set to csum_start in skb_partial_csum_set.

Link: https://lore.kernel.org/netdev/YS+h%2FtqCJJiQei+W@shredder/
Fixes: 1d011c4803c7 ("ip_gre: add validation for csum_start")
Reported-by: Ido Schimmel <idosch@idosch.org>
Suggested-by: Alexander Duyck <alexander.duyck@gmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/ip_gre.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index a0829495b211..a9cc05043fa4 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -468,8 +468,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
 
 static int gre_handle_offloads(struct sk_buff *skb, bool csum)
 {
-	if (csum && skb_checksum_start(skb) < skb->data)
-		return -EINVAL;
 	return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
 }
 
@@ -627,15 +625,20 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
 	}
 
 	if (dev->header_ops) {
+		const int pull_len = tunnel->hlen + sizeof(struct iphdr);
+
 		if (skb_cow_head(skb, 0))
 			goto free_skb;
 
 		tnl_params = (const struct iphdr *)skb->data;
 
+		if (pull_len > skb_transport_offset(skb))
+			goto free_skb;
+
 		/* Pull skb since ip_tunnel_xmit() needs skb->data pointing
 		 * to gre header.
 		 */
-		skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
+		skb_pull(skb, pull_len);
 		skb_reset_mac_header(skb);
 	} else {
 		if (skb_cow_head(skb, dev->needed_headroom))

From eb635e008cb1d9845e19ac5910c82ff77e660306 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Sun, 5 Sep 2021 19:23:28 +0200
Subject: [PATCH 0418/1750] net: dsa: b53: Fix IMP port setup on BCM5301x
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 63f8428b4077de3664eb0b252393c839b0b293ec ]

Broadcom's b53 switches have one IMP (Inband Management Port) that needs
to be programmed using its own designed register. IMP port may be
different than CPU port - especially on devices with multiple CPU ports.

For that reason it's required to explicitly note IMP port index and
check for it when choosing a register to use.

This commit fixes BCM5301x support. Those switches use CPU port 5 while
their IMP port is 8. Before this patch b53 was trying to program port 5
with B53_PORT_OVERRIDE_CTRL instead of B53_GMII_PORT_OVERRIDE_CTRL(5).

It may be possible to also replace "cpu_port" usages with
dsa_is_cpu_port() but that is out of the scope of thix BCM5301x fix.

Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/b53/b53_common.c | 27 ++++++++++++++++++++++++---
 drivers/net/dsa/b53/b53_priv.h   |  1 +
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 54558f47b633..d3b37cebcfde 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1083,7 +1083,7 @@ static void b53_force_link(struct b53_device *dev, int port, int link)
 	u8 reg, val, off;
 
 	/* Override the port settings */
-	if (port == dev->cpu_port) {
+	if (port == dev->imp_port) {
 		off = B53_PORT_OVERRIDE_CTRL;
 		val = PORT_OVERRIDE_EN;
 	} else {
@@ -1107,7 +1107,7 @@ static void b53_force_port_config(struct b53_device *dev, int port,
 	u8 reg, val, off;
 
 	/* Override the port settings */
-	if (port == dev->cpu_port) {
+	if (port == dev->imp_port) {
 		off = B53_PORT_OVERRIDE_CTRL;
 		val = PORT_OVERRIDE_EN;
 	} else {
@@ -1175,7 +1175,7 @@ static void b53_adjust_link(struct dsa_switch *ds, int port,
 	b53_force_link(dev, port, phydev->link);
 
 	if (is531x5(dev) && phy_interface_is_rgmii(phydev)) {
-		if (port == 8)
+		if (port == dev->imp_port)
 			off = B53_RGMII_CTRL_IMP;
 		else
 			off = B53_RGMII_CTRL_P(port);
@@ -2238,6 +2238,7 @@ struct b53_chip_data {
 	const char *dev_name;
 	u16 vlans;
 	u16 enabled_ports;
+	u8 imp_port;
 	u8 cpu_port;
 	u8 vta_regs[3];
 	u8 arl_bins;
@@ -2262,6 +2263,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 2,
 		.arl_buckets = 1024,
+		.imp_port = 5,
 		.cpu_port = B53_CPU_PORT_25,
 		.duplex_reg = B53_DUPLEX_STAT_FE,
 	},
@@ -2272,6 +2274,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 2,
 		.arl_buckets = 1024,
+		.imp_port = 5,
 		.cpu_port = B53_CPU_PORT_25,
 		.duplex_reg = B53_DUPLEX_STAT_FE,
 	},
@@ -2282,6 +2285,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2295,6 +2299,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2308,6 +2313,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS_9798,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2321,6 +2327,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x7f,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS_9798,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2335,6 +2342,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.arl_bins = 4,
 		.arl_buckets = 1024,
 		.vta_regs = B53_VTA_REGS,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
 		.jumbo_pm_reg = B53_JUMBO_PORT_MASK,
@@ -2347,6 +2355,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0xff,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2360,6 +2369,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1ff,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2373,6 +2383,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0, /* pdata must provide them */
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS_63XX,
 		.duplex_reg = B53_DUPLEX_STAT_63XX,
@@ -2386,6 +2397,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2399,6 +2411,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1bf,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2412,6 +2425,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1bf,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2425,6 +2439,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2438,6 +2453,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1f,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT_25, /* TODO: auto detect */
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2451,6 +2467,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1ff,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2464,6 +2481,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x103,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2477,6 +2495,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1ff,
 		.arl_bins = 4,
 		.arl_buckets = 1024,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2490,6 +2509,7 @@ static const struct b53_chip_data b53_switch_chips[] = {
 		.enabled_ports = 0x1ff,
 		.arl_bins = 4,
 		.arl_buckets = 256,
+		.imp_port = 8,
 		.cpu_port = B53_CPU_PORT,
 		.vta_regs = B53_VTA_REGS,
 		.duplex_reg = B53_DUPLEX_STAT_GE,
@@ -2515,6 +2535,7 @@ static int b53_switch_init(struct b53_device *dev)
 			dev->vta_regs[1] = chip->vta_regs[1];
 			dev->vta_regs[2] = chip->vta_regs[2];
 			dev->jumbo_pm_reg = chip->jumbo_pm_reg;
+			dev->imp_port = chip->imp_port;
 			dev->cpu_port = chip->cpu_port;
 			dev->num_vlans = chip->vlans;
 			dev->num_arl_bins = chip->arl_bins;
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 7c67409bb186..bdb2ade7ad62 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -122,6 +122,7 @@ struct b53_device {
 
 	/* used ports mask */
 	u16 enabled_ports;
+	unsigned int imp_port;
 	unsigned int cpu_port;
 
 	/* connect specific data */

From 72450231845518503833b8cc1892f44e59dd10e3 Mon Sep 17 00:00:00 2001
From: Edwin Peer <edwin.peer@broadcom.com>
Date: Sun, 5 Sep 2021 14:10:55 -0400
Subject: [PATCH 0419/1750] bnxt_en: fix stored FW_PSID version masks

[ Upstream commit 1656db67233e4259281d2ac35b25f712edbbc20b ]

The FW_PSID version components are 8 bits wide, not 4.

Fixes: db28b6c77f40 ("bnxt_en: Fix devlink info's stored fw.psid version format.")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 8b0e916afe6b..2bd476a501bd 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -474,8 +474,8 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
 	if (BNXT_PF(bp) && !bnxt_hwrm_get_nvm_cfg_ver(bp, &nvm_cfg_ver)) {
 		u32 ver = nvm_cfg_ver.vu32;
 
-		sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xf, (ver >> 8) & 0xf,
-			ver & 0xf);
+		sprintf(buf, "%d.%d.%d", (ver >> 16) & 0xff, (ver >> 8) & 0xff,
+			ver & 0xff);
 		rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_STORED,
 				      DEVLINK_INFO_VERSION_GENERIC_FW_PSID,
 				      buf);

From f90a34fabaa5f6c62fb0dcf4990c10ad84678eff Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Sun, 5 Sep 2021 14:10:57 -0400
Subject: [PATCH 0420/1750] bnxt_en: Fix asic.rev in devlink dev info command

[ Upstream commit 6fdab8a3ade2adc123bbf5c4fdec3394560b1fb1 ]

The current asic.rev is incomplete and does not include the metal
revision.  Add the metal revision and decode the complete asic
revision into the more common and readable form (A0, B0, etc).

Fixes: 7154917a12b2 ("bnxt_en: Refactor bnxt_dl_info_get().")
Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 2bd476a501bd..e2fd625fc6d2 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
@@ -452,7 +452,7 @@ static int bnxt_dl_info_get(struct devlink *dl, struct devlink_info_req *req,
 		return rc;
 
 	ver_resp = &bp->ver_resp;
-	sprintf(buf, "%X", ver_resp->chip_rev);
+	sprintf(buf, "%c%d", 'A' + ver_resp->chip_rev, ver_resp->chip_metal);
 	rc = bnxt_dl_info_put(bp, req, BNXT_VERSION_FIXED,
 			      DEVLINK_INFO_VERSION_GENERIC_ASIC_REV, buf);
 	if (rc)

From fad75e046363ebf37c42c04dc8e3f68e0ed4c130 Mon Sep 17 00:00:00 2001
From: Edwin Peer <edwin.peer@broadcom.com>
Date: Mon, 25 Jan 2021 02:08:13 -0500
Subject: [PATCH 0421/1750] bnxt_en: log firmware debug notifications

[ Upstream commit a44daa8fcbcf572545c4c1a7908b3fbb38388048 ]

Firmware is capable of generating asynchronous debug notifications.
The event data is opaque to the driver and is simply logged. Debug
notifications can be enabled by turning on hardware status messages
using the ethtool msglvl interface.

Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 1def6caba349..621634d40966 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -272,6 +272,7 @@ static const u16 bnxt_async_events_arr[] = {
 	ASYNC_EVENT_CMPL_EVENT_ID_PORT_PHY_CFG_CHANGE,
 	ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY,
 	ASYNC_EVENT_CMPL_EVENT_ID_ERROR_RECOVERY,
+	ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION,
 	ASYNC_EVENT_CMPL_EVENT_ID_RING_MONITOR_MSG,
 };
 
@@ -2132,6 +2133,13 @@ static int bnxt_async_event_process(struct bnxt *bp,
 			bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
 		goto async_event_process_exit;
 	}
+	case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:
+		if (netif_msg_hw(bp)) {
+			netdev_notice(bp->dev,
+				      "Received firmware debug notification, data1: 0x%x, data2: 0x%x\n",
+				      data1, data2);
+		}
+		goto async_event_process_exit;
 	case ASYNC_EVENT_CMPL_EVENT_ID_RING_MONITOR_MSG: {
 		struct bnxt_rx_ring_info *rxr;
 		u16 grp_idx;

From 01cad477a96834c16f76019698aac57c779893b4 Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Mon, 25 Jan 2021 02:08:20 -0500
Subject: [PATCH 0422/1750] bnxt_en: Consolidate firmware reset event logging.

[ Upstream commit 5863b10aa86a5f5f69a25b55a5c15806c834471a ]

Combine the three netdev_warn() calls into a single call, printed at
the NETIF_MSG_HW log level.

Reviewed-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 621634d40966..4ee77e1c8de0 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2082,10 +2082,9 @@ static int bnxt_async_event_process(struct bnxt *bp,
 			goto async_event_process_exit;
 		set_bit(BNXT_RESET_TASK_SILENT_SP_EVENT, &bp->sp_event);
 		break;
-	case ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY:
-		if (netif_msg_hw(bp))
-			netdev_warn(bp->dev, "Received RESET_NOTIFY event, data1: 0x%x, data2: 0x%x\n",
-				    data1, data2);
+	case ASYNC_EVENT_CMPL_EVENT_ID_RESET_NOTIFY: {
+		char *fatal_str = "non-fatal";
+
 		if (!bp->fw_health)
 			goto async_event_process_exit;
 
@@ -2097,14 +2096,18 @@ static int bnxt_async_event_process(struct bnxt *bp,
 		if (!bp->fw_reset_max_dsecs)
 			bp->fw_reset_max_dsecs = BNXT_DFLT_FW_RST_MAX_DSECS;
 		if (EVENT_DATA1_RESET_NOTIFY_FATAL(data1)) {
-			netdev_warn(bp->dev, "Firmware fatal reset event received\n");
+			fatal_str = "fatal";
 			set_bit(BNXT_STATE_FW_FATAL_COND, &bp->state);
-		} else {
-			netdev_warn(bp->dev, "Firmware non-fatal reset event received, max wait time %d msec\n",
+		}
+		if (netif_msg_hw(bp)) {
+			netdev_warn(bp->dev, "Firmware %s reset event, data1: 0x%x, data2: 0x%x, min wait %u ms, max wait %u ms\n",
+				    fatal_str, data1, data2,
+				    bp->fw_reset_min_dsecs * 100,
 				    bp->fw_reset_max_dsecs * 100);
 		}
 		set_bit(BNXT_FW_RESET_NOTIFY_SP_EVENT, &bp->sp_event);
 		break;
+	}
 	case ASYNC_EVENT_CMPL_EVENT_ID_ERROR_RECOVERY: {
 		struct bnxt_fw_health *fw_health = bp->fw_health;
 

From 639a2eddb7310bf6e76377a2e5610184712204a3 Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Tue, 26 Jan 2021 01:20:24 -0500
Subject: [PATCH 0423/1750] bnxt_en: Convert to use netif_level() helpers.

[ Upstream commit 871127e6ab0d6abb904cec81fc022baf6953be1f ]

Use the various netif_level() helpers to simplify the C code.  This was
suggested by Joe Perches.

Cc: Joe Perches <joe@perches.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/1611642024-3166-1-git-send-email-michael.chan@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 34 ++++++++++-------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 4ee77e1c8de0..563a169e06ca 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -1305,8 +1305,7 @@ static void bnxt_tpa_start(struct bnxt *bp, struct bnxt_rx_ring_info *rxr,
 	} else {
 		tpa_info->hash_type = PKT_HASH_TYPE_NONE;
 		tpa_info->gso_type = 0;
-		if (netif_msg_rx_err(bp))
-			netdev_warn(bp->dev, "TPA packet without valid hash\n");
+		netif_warn(bp, rx_err, bp->dev, "TPA packet without valid hash\n");
 	}
 	tpa_info->flags2 = le32_to_cpu(tpa_start1->rx_tpa_start_cmp_flags2);
 	tpa_info->metadata = le32_to_cpu(tpa_start1->rx_tpa_start_cmp_metadata);
@@ -2099,12 +2098,11 @@ static int bnxt_async_event_process(struct bnxt *bp,
 			fatal_str = "fatal";
 			set_bit(BNXT_STATE_FW_FATAL_COND, &bp->state);
 		}
-		if (netif_msg_hw(bp)) {
-			netdev_warn(bp->dev, "Firmware %s reset event, data1: 0x%x, data2: 0x%x, min wait %u ms, max wait %u ms\n",
-				    fatal_str, data1, data2,
-				    bp->fw_reset_min_dsecs * 100,
-				    bp->fw_reset_max_dsecs * 100);
-		}
+		netif_warn(bp, hw, bp->dev,
+			   "Firmware %s reset event, data1: 0x%x, data2: 0x%x, min wait %u ms, max wait %u ms\n",
+			   fatal_str, data1, data2,
+			   bp->fw_reset_min_dsecs * 100,
+			   bp->fw_reset_max_dsecs * 100);
 		set_bit(BNXT_FW_RESET_NOTIFY_SP_EVENT, &bp->sp_event);
 		break;
 	}
@@ -2119,13 +2117,11 @@ static int bnxt_async_event_process(struct bnxt *bp,
 		if (!fw_health->enabled)
 			break;
 
-		if (netif_msg_drv(bp))
-			netdev_info(bp->dev, "Error recovery info: error recovery[%d], master[%d], reset count[0x%x], health status: 0x%x\n",
-				    fw_health->enabled, fw_health->master,
-				    bnxt_fw_health_readl(bp,
-							 BNXT_FW_RESET_CNT_REG),
-				    bnxt_fw_health_readl(bp,
-							 BNXT_FW_HEALTH_REG));
+		netif_info(bp, drv, bp->dev,
+			   "Error recovery info: error recovery[%d], master[%d], reset count[0x%x], health status: 0x%x\n",
+			   fw_health->enabled, fw_health->master,
+			   bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG),
+			   bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
 		fw_health->tmr_multiplier =
 			DIV_ROUND_UP(fw_health->polling_dsecs * HZ,
 				     bp->current_interval * 10);
@@ -2137,11 +2133,9 @@ static int bnxt_async_event_process(struct bnxt *bp,
 		goto async_event_process_exit;
 	}
 	case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:
-		if (netif_msg_hw(bp)) {
-			netdev_notice(bp->dev,
-				      "Received firmware debug notification, data1: 0x%x, data2: 0x%x\n",
-				      data1, data2);
-		}
+		netif_notice(bp, hw, bp->dev,
+			     "Received firmware debug notification, data1: 0x%x, data2: 0x%x\n",
+			     data1, data2);
 		goto async_event_process_exit;
 	case ASYNC_EVENT_CMPL_EVENT_ID_RING_MONITOR_MSG: {
 		struct bnxt_rx_ring_info *rxr;

From 9a3f52f73c04dd8dddf9209fbf555f530b315ec3 Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Sun, 14 Feb 2021 18:05:01 -0500
Subject: [PATCH 0424/1750] bnxt_en: Improve logging of error recovery settings
 information.

[ Upstream commit f4d95c3c194de04ae7b44f850131321c7ceb9312 ]

We currently only log the error recovery settings if it is enabled.
In some cases, firmware disables error recovery after it was
initially enabled.  Without logging anything, the user will not be
aware of this change in setting.

Log it when error recovery is disabled.  Also, change the reset count
value from hexadecimal to decimal.

Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 563a169e06ca..4c1c41495e9f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2114,14 +2114,11 @@ static int bnxt_async_event_process(struct bnxt *bp,
 
 		fw_health->enabled = EVENT_DATA1_RECOVERY_ENABLED(data1);
 		fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1);
-		if (!fw_health->enabled)
+		if (!fw_health->enabled) {
+			netif_info(bp, drv, bp->dev,
+				   "Error recovery info: error recovery[0]\n");
 			break;
-
-		netif_info(bp, drv, bp->dev,
-			   "Error recovery info: error recovery[%d], master[%d], reset count[0x%x], health status: 0x%x\n",
-			   fw_health->enabled, fw_health->master,
-			   bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG),
-			   bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
+		}
 		fw_health->tmr_multiplier =
 			DIV_ROUND_UP(fw_health->polling_dsecs * HZ,
 				     bp->current_interval * 10);
@@ -2130,6 +2127,10 @@ static int bnxt_async_event_process(struct bnxt *bp,
 			bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG);
 		fw_health->last_fw_reset_cnt =
 			bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
+		netif_info(bp, drv, bp->dev,
+			   "Error recovery info: error recovery[1], master[%d], reset count[%u], health status: 0x%x\n",
+			   fw_health->master, fw_health->last_fw_reset_cnt,
+			   bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
 		goto async_event_process_exit;
 	}
 	case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:

From 52a7e6667133553a51f93076f96c9294314ae44f Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Sun, 5 Sep 2021 14:10:59 -0400
Subject: [PATCH 0425/1750] bnxt_en: Fix possible unintended driver initiated
 error recovery

[ Upstream commit 1b2b91831983aeac3adcbb469aa8b0dc71453f89 ]

If error recovery is already enabled, bnxt_timer() will periodically
check the heartbeat register and the reset counter.  If we get an
error recovery async. notification from the firmware (e.g. change in
primary/secondary role), we will immediately read and update the
heartbeat register and the reset counter.  If the timer for the next
health check expires soon after this, we may read the heartbeat register
again in quick succession and find that it hasn't changed.  This will
trigger error recovery unintentionally.

The likelihood is small because we also reset fw_health->tmr_counter
which will reset the interval for the next health check.  But the
update is not protected and bnxt_timer() can miss the update and
perform the health check without waiting for the full interval.

Fix it by only reading the heartbeat register and reset counter in
bnxt_async_event_process() if error recovery is trasitioning to the
enabled state.  Also add proper memory barriers so that when enabling
for the first time, bnxt_timer() will see the tmr_counter interval and
perform the health check after the full interval has elapsed.

Fixes: 7e914027f757 ("bnxt_en: Enable health monitoring.")
Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 ++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 4c1c41495e9f..71656e669755 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2112,25 +2112,34 @@ static int bnxt_async_event_process(struct bnxt *bp,
 		if (!fw_health)
 			goto async_event_process_exit;
 
-		fw_health->enabled = EVENT_DATA1_RECOVERY_ENABLED(data1);
-		fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1);
-		if (!fw_health->enabled) {
+		if (!EVENT_DATA1_RECOVERY_ENABLED(data1)) {
+			fw_health->enabled = false;
 			netif_info(bp, drv, bp->dev,
 				   "Error recovery info: error recovery[0]\n");
 			break;
 		}
+		fw_health->master = EVENT_DATA1_RECOVERY_MASTER_FUNC(data1);
 		fw_health->tmr_multiplier =
 			DIV_ROUND_UP(fw_health->polling_dsecs * HZ,
 				     bp->current_interval * 10);
 		fw_health->tmr_counter = fw_health->tmr_multiplier;
-		fw_health->last_fw_heartbeat =
-			bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG);
-		fw_health->last_fw_reset_cnt =
-			bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
+		if (!fw_health->enabled) {
+			fw_health->last_fw_heartbeat =
+				bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG);
+			fw_health->last_fw_reset_cnt =
+				bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
+		}
 		netif_info(bp, drv, bp->dev,
 			   "Error recovery info: error recovery[1], master[%d], reset count[%u], health status: 0x%x\n",
 			   fw_health->master, fw_health->last_fw_reset_cnt,
 			   bnxt_fw_health_readl(bp, BNXT_FW_HEALTH_REG));
+		if (!fw_health->enabled) {
+			/* Make sure tmr_counter is set and visible to
+			 * bnxt_health_check() before setting enabled to true.
+			 */
+			smp_wmb();
+			fw_health->enabled = true;
+		}
 		goto async_event_process_exit;
 	}
 	case ASYNC_EVENT_CMPL_EVENT_ID_DEBUG_NOTIFICATION:
@@ -10738,6 +10747,8 @@ static void bnxt_fw_health_check(struct bnxt *bp)
 	if (!fw_health->enabled || test_bit(BNXT_STATE_IN_FW_RESET, &bp->state))
 		return;
 
+	/* Make sure it is enabled before checking the tmr_counter. */
+	smp_rmb();
 	if (fw_health->tmr_counter) {
 		fw_health->tmr_counter--;
 		return;

From 027c44b8c8e4140d8dc1633fb32586ab07f1ed3a Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Wed, 3 Mar 2021 18:49:44 +0200
Subject: [PATCH 0426/1750] mfd: lpc_sch: Partially revert "Add support for
 Intel Quark X1000"

[ Upstream commit 922e8ce883e59b52786b2c11656d84dc58ef084a ]

The IRQ support for SCH GPIO is not specific to the Intel Quark SoC.
Moreover the IRQ routing is quite interesting there, so while it's
needs a special support, the driver haven't it anyway yet.

Due to above remove basically redundant code of IRQ support.

This reverts commit ec689a8a8155ce8b966bd5d7737a3916f5e48be3.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/lpc_sch.c | 32 ++++++--------------------------
 1 file changed, 6 insertions(+), 26 deletions(-)

diff --git a/drivers/mfd/lpc_sch.c b/drivers/mfd/lpc_sch.c
index f27eb8dabc1c..428a526cbe86 100644
--- a/drivers/mfd/lpc_sch.c
+++ b/drivers/mfd/lpc_sch.c
@@ -26,9 +26,6 @@
 #define GPIO_IO_SIZE	64
 #define GPIO_IO_SIZE_CENTERTON	128
 
-/* Intel Quark X1000 GPIO IRQ Number */
-#define GPIO_IRQ_QUARK_X1000	9
-
 #define WDTBASE		0x84
 #define WDT_IO_SIZE	64
 
@@ -43,30 +40,25 @@ struct lpc_sch_info {
 	unsigned int io_size_smbus;
 	unsigned int io_size_gpio;
 	unsigned int io_size_wdt;
-	int irq_gpio;
 };
 
 static struct lpc_sch_info sch_chipset_info[] = {
 	[LPC_SCH] = {
 		.io_size_smbus = SMBUS_IO_SIZE,
 		.io_size_gpio = GPIO_IO_SIZE,
-		.irq_gpio = -1,
 	},
 	[LPC_ITC] = {
 		.io_size_smbus = SMBUS_IO_SIZE,
 		.io_size_gpio = GPIO_IO_SIZE,
 		.io_size_wdt = WDT_IO_SIZE,
-		.irq_gpio = -1,
 	},
 	[LPC_CENTERTON] = {
 		.io_size_smbus = SMBUS_IO_SIZE,
 		.io_size_gpio = GPIO_IO_SIZE_CENTERTON,
 		.io_size_wdt = WDT_IO_SIZE,
-		.irq_gpio = -1,
 	},
 	[LPC_QUARK_X1000] = {
 		.io_size_gpio = GPIO_IO_SIZE,
-		.irq_gpio = GPIO_IRQ_QUARK_X1000,
 		.io_size_wdt = WDT_IO_SIZE,
 	},
 };
@@ -113,13 +105,13 @@ static int lpc_sch_get_io(struct pci_dev *pdev, int where, const char *name,
 }
 
 static int lpc_sch_populate_cell(struct pci_dev *pdev, int where,
-				 const char *name, int size, int irq,
-				 int id, struct mfd_cell *cell)
+				 const char *name, int size, int id,
+				 struct mfd_cell *cell)
 {
 	struct resource *res;
 	int ret;
 
-	res = devm_kcalloc(&pdev->dev, 2, sizeof(*res), GFP_KERNEL);
+	res = devm_kzalloc(&pdev->dev, sizeof(*res), GFP_KERNEL);
 	if (!res)
 		return -ENOMEM;
 
@@ -135,18 +127,6 @@ static int lpc_sch_populate_cell(struct pci_dev *pdev, int where,
 	cell->ignore_resource_conflicts = true;
 	cell->id = id;
 
-	/* Check if we need to add an IRQ resource */
-	if (irq < 0)
-		return 0;
-
-	res++;
-
-	res->start = irq;
-	res->end = irq;
-	res->flags = IORESOURCE_IRQ;
-
-	cell->num_resources++;
-
 	return 0;
 }
 
@@ -158,7 +138,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	int ret;
 
 	ret = lpc_sch_populate_cell(dev, SMBASE, "isch_smbus",
-				    info->io_size_smbus, -1,
+				    info->io_size_smbus,
 				    id->device, &lpc_sch_cells[cells]);
 	if (ret < 0)
 		return ret;
@@ -166,7 +146,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
 		cells++;
 
 	ret = lpc_sch_populate_cell(dev, GPIOBASE, "sch_gpio",
-				    info->io_size_gpio, info->irq_gpio,
+				    info->io_size_gpio,
 				    id->device, &lpc_sch_cells[cells]);
 	if (ret < 0)
 		return ret;
@@ -174,7 +154,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
 		cells++;
 
 	ret = lpc_sch_populate_cell(dev, WDTBASE, "ie6xx_wdt",
-				    info->io_size_wdt, -1,
+				    info->io_size_wdt,
 				    id->device, &lpc_sch_cells[cells]);
 	if (ret < 0)
 		return ret;

From b2f9b7455baf8ba12113520cdf0398b6141ae42f Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Mon, 6 Sep 2021 17:19:49 -0700
Subject: [PATCH 0427/1750] mfd: lpc_sch: Rename GPIOBASE to prevent build
 error

[ Upstream commit cdff1eda69326fb46de10c5454212b3efcf4bb41 ]

One MIPS platform (mach-rc32434) defines GPIOBASE. This macro
conflicts with one of the same name in lpc_sch.c. Rename the latter one
to prevent the build error.

../drivers/mfd/lpc_sch.c:25: error: "GPIOBASE" redefined [-Werror]
   25 | #define GPIOBASE        0x44
../arch/mips/include/asm/mach-rc32434/rb.h:32: note: this is the location of the previous definition
   32 | #define GPIOBASE        0x050000

Cc: Denis Turischev <denis@compulab.co.il>
Fixes: e82c60ae7d3a ("mfd: Introduce lpc_sch for Intel SCH LPC bridge")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/lpc_sch.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mfd/lpc_sch.c b/drivers/mfd/lpc_sch.c
index 428a526cbe86..9ab9adce06fd 100644
--- a/drivers/mfd/lpc_sch.c
+++ b/drivers/mfd/lpc_sch.c
@@ -22,7 +22,7 @@
 #define SMBASE		0x40
 #define SMBUS_IO_SIZE	64
 
-#define GPIOBASE	0x44
+#define GPIO_BASE	0x44
 #define GPIO_IO_SIZE	64
 #define GPIO_IO_SIZE_CENTERTON	128
 
@@ -145,7 +145,7 @@ static int lpc_sch_probe(struct pci_dev *dev, const struct pci_device_id *id)
 	if (ret == 0)
 		cells++;
 
-	ret = lpc_sch_populate_cell(dev, GPIOBASE, "sch_gpio",
+	ret = lpc_sch_populate_cell(dev, GPIO_BASE, "sch_gpio",
 				    info->io_size_gpio,
 				    id->device, &lpc_sch_cells[cells]);
 	if (ret < 0)

From 47bc9c3929eb0bafe805bf87474615c8596d16bc Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Tue, 7 Sep 2021 20:29:40 +0900
Subject: [PATCH 0428/1750] net: renesas: sh_eth: Fix freeing wrong tx
 descriptor

[ Upstream commit 0341d5e3d1ee2a36dd5a49b5bef2ce4ad1cfa6b4 ]

The cur_tx counter must be incremented after TACT bit of
txdesc->status was set. However, a CPU is possible to reorder
instructions and/or memory accesses between cur_tx and
txdesc->status. And then, if TX interrupt happened at such a
timing, the sh_eth_tx_free() may free the descriptor wrongly.
So, add wmb() before cur_tx++.
Otherwise NETDEV WATCHDOG timeout is possible to happen.

Fixes: 86a74ff21a7a ("net: sh_eth: add support for Renesas SuperH Ethernet")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/renesas/sh_eth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 5cab2d3c0023..8927d5997745 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2533,6 +2533,7 @@ static netdev_tx_t sh_eth_start_xmit(struct sk_buff *skb,
 	else
 		txdesc->status |= cpu_to_le32(TD_TACT);
 
+	wmb(); /* cur_tx must be incremented after TACT bit was set */
 	mdp->cur_tx++;
 
 	if (!(sh_eth_read(ndev, EDTRR) & mdp->cd->edtrr_trns))

From 619d747c1850bab61625ca9d8b4730f470a5947b Mon Sep 17 00:00:00 2001
From: Tony Luck <tony.luck@intel.com>
Date: Mon, 13 Sep 2021 14:52:39 -0700
Subject: [PATCH 0429/1750] x86/mce: Avoid infinite loop for copy from user
 recovery

commit 81065b35e2486c024c7aa86caed452e1f01a59d4 upstream.

There are two cases for machine check recovery:

1) The machine check was triggered by ring3 (application) code.
   This is the simpler case. The machine check handler simply queues
   work to be executed on return to user. That code unmaps the page
   from all users and arranges to send a SIGBUS to the task that
   triggered the poison.

2) The machine check was triggered in kernel code that is covered by
   an exception table entry. In this case the machine check handler
   still queues a work entry to unmap the page, etc. but this will
   not be called right away because the #MC handler returns to the
   fix up code address in the exception table entry.

Problems occur if the kernel triggers another machine check before the
return to user processes the first queued work item.

Specifically, the work is queued using the ->mce_kill_me callback
structure in the task struct for the current thread. Attempting to queue
a second work item using this same callback results in a loop in the
linked list of work functions to call. So when the kernel does return to
user, it enters an infinite loop processing the same entry for ever.

There are some legitimate scenarios where the kernel may take a second
machine check before returning to the user.

1) Some code (e.g. futex) first tries a get_user() with page faults
   disabled. If this fails, the code retries with page faults enabled
   expecting that this will resolve the page fault.

2) Copy from user code retries a copy in byte-at-time mode to check
   whether any additional bytes can be copied.

On the other side of the fence are some bad drivers that do not check
the return value from individual get_user() calls and may access
multiple user addresses without noticing that some/all calls have
failed.

Fix by adding a counter (current->mce_count) to keep track of repeated
machine checks before task_work() is called. First machine check saves
the address information and calls task_work_add(). Subsequent machine
checks before that task_work call back is executed check that the address
is in the same page as the first machine check (since the callback will
offline exactly one page).

Expected worst case is four machine checks before moving on (e.g. one
user access with page faults disabled, then a repeat to the same address
with page faults enabled ... repeat in copy tail bytes). Just in case
there is some code that loops forever enforce a limit of 10.

 [ bp: Massage commit message, drop noinstr, fix typo, extend panic
   messages. ]

Fixes: 5567d11c21a1 ("x86/mce: Send #MC singal from task work")
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/YT/IJ9ziLqmtqEPu@agluck-desk2.amr.corp.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/mce/core.c | 43 +++++++++++++++++++++++++---------
 include/linux/sched.h          |  1 +
 2 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 056d0367864e..14b34963eb1f 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -1241,6 +1241,9 @@ static void __mc_scan_banks(struct mce *m, struct pt_regs *regs, struct mce *fin
 
 static void kill_me_now(struct callback_head *ch)
 {
+	struct task_struct *p = container_of(ch, struct task_struct, mce_kill_me);
+
+	p->mce_count = 0;
 	force_sig(SIGBUS);
 }
 
@@ -1249,6 +1252,7 @@ static void kill_me_maybe(struct callback_head *cb)
 	struct task_struct *p = container_of(cb, struct task_struct, mce_kill_me);
 	int flags = MF_ACTION_REQUIRED;
 
+	p->mce_count = 0;
 	pr_err("Uncorrected hardware memory error in user-access at %llx", p->mce_addr);
 
 	if (!p->mce_ripv)
@@ -1269,17 +1273,34 @@ static void kill_me_maybe(struct callback_head *cb)
 	}
 }
 
-static void queue_task_work(struct mce *m, int kill_it)
+static void queue_task_work(struct mce *m, char *msg, int kill_current_task)
 {
-	current->mce_addr = m->addr;
-	current->mce_kflags = m->kflags;
-	current->mce_ripv = !!(m->mcgstatus & MCG_STATUS_RIPV);
-	current->mce_whole_page = whole_page(m);
+	int count = ++current->mce_count;
 
-	if (kill_it)
-		current->mce_kill_me.func = kill_me_now;
-	else
-		current->mce_kill_me.func = kill_me_maybe;
+	/* First call, save all the details */
+	if (count == 1) {
+		current->mce_addr = m->addr;
+		current->mce_kflags = m->kflags;
+		current->mce_ripv = !!(m->mcgstatus & MCG_STATUS_RIPV);
+		current->mce_whole_page = whole_page(m);
+
+		if (kill_current_task)
+			current->mce_kill_me.func = kill_me_now;
+		else
+			current->mce_kill_me.func = kill_me_maybe;
+	}
+
+	/* Ten is likely overkill. Don't expect more than two faults before task_work() */
+	if (count > 10)
+		mce_panic("Too many consecutive machine checks while accessing user data", m, msg);
+
+	/* Second or later call, make sure page address matches the one from first call */
+	if (count > 1 && (current->mce_addr >> PAGE_SHIFT) != (m->addr >> PAGE_SHIFT))
+		mce_panic("Consecutive machine checks to different user pages", m, msg);
+
+	/* Do not call task_work_add() more than once */
+	if (count > 1)
+		return;
 
 	task_work_add(current, &current->mce_kill_me, TWA_RESUME);
 }
@@ -1427,7 +1448,7 @@ noinstr void do_machine_check(struct pt_regs *regs)
 		/* If this triggers there is no way to recover. Die hard. */
 		BUG_ON(!on_thread_stack() || !user_mode(regs));
 
-		queue_task_work(&m, kill_it);
+		queue_task_work(&m, msg, kill_it);
 
 	} else {
 		/*
@@ -1445,7 +1466,7 @@ noinstr void do_machine_check(struct pt_regs *regs)
 		}
 
 		if (m.kflags & MCE_IN_KERNEL_COPYIN)
-			queue_task_work(&m, kill_it);
+			queue_task_work(&m, msg, kill_it);
 	}
 out:
 	mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 2660ee4b08ad..29c7ccd5ae42 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1354,6 +1354,7 @@ struct task_struct {
 					mce_whole_page : 1,
 					__mce_reserved : 62;
 	struct callback_head		mce_kill_me;
+	int				mce_count;
 #endif
 
 	/*

From 9f2972e151dd16d3286c1407bec4e66395f30135 Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Sun, 12 Sep 2021 12:34:47 -0400
Subject: [PATCH 0430/1750] bnxt_en: Fix error recovery regression

commit eca4cf12acda306f851f6d2a05b1c9ef62cf0e81 upstream.

The recent patch has introduced a regression by not reading the reset
count in the ERROR_RECOVERY async event handler.  We may have just
gone through a reset and the reset count has just incremented.  If
we don't update the reset count in the ERROR_RECOVERY event handler,
the health check timer will see that the reset count has changed and
will initiate an unintended reset.

Restore the unconditional update of the reset count in
bnxt_async_event_process() if error recovery watchdog is enabled.
Also, update the reset count at the end of the reset sequence to
make it even more robust.

Fixes: 1b2b91831983 ("bnxt_en: Fix possible unintended driver initiated error recovery")
Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 71656e669755..26179e437bbf 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -2123,12 +2123,11 @@ static int bnxt_async_event_process(struct bnxt *bp,
 			DIV_ROUND_UP(fw_health->polling_dsecs * HZ,
 				     bp->current_interval * 10);
 		fw_health->tmr_counter = fw_health->tmr_multiplier;
-		if (!fw_health->enabled) {
+		if (!fw_health->enabled)
 			fw_health->last_fw_heartbeat =
 				bnxt_fw_health_readl(bp, BNXT_FW_HEARTBEAT_REG);
-			fw_health->last_fw_reset_cnt =
-				bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
-		}
+		fw_health->last_fw_reset_cnt =
+			bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
 		netif_info(bp, drv, bp->dev,
 			   "Error recovery info: error recovery[1], master[%d], reset count[%u], health status: 0x%x\n",
 			   fw_health->master, fw_health->last_fw_reset_cnt,
@@ -11653,6 +11652,11 @@ static void bnxt_fw_reset_task(struct work_struct *work)
 			dev_close(bp->dev);
 		}
 
+		if ((bp->fw_cap & BNXT_FW_CAP_ERROR_RECOVERY) &&
+		    bp->fw_health->enabled) {
+			bp->fw_health->last_fw_reset_cnt =
+				bnxt_fw_health_readl(bp, BNXT_FW_RESET_CNT_REG);
+		}
 		bp->fw_reset_state = 0;
 		/* Make sure fw_reset_state is 0 before clearing the flag */
 		smp_mb__before_atomic();

From a23d3576215f7447c547976817b33cb975ecec84 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Thu, 16 Sep 2021 14:33:35 -0700
Subject: [PATCH 0431/1750] net: dsa: bcm_sf2: Fix array overrun in
 bcm_sf2_num_active_ports()

commit 02319bf15acf54004216e40ac9c171437f24be24 upstream.

After d12e1c464988 ("net: dsa: b53: Set correct number of ports in the
DSA struct") we stopped setting dsa_switch::num_ports to DSA_MAX_PORTS,
which created an off by one error between the statically allocated
bcm_sf2_priv::port_sts array (of size DSA_MAX_PORTS). When
dsa_is_cpu_port() is used, we end-up accessing an out of bounds member
and causing a NPD.

Fix this by iterating with the appropriate port count using
ds->num_ports.

Fixes: d12e1c464988 ("net: dsa: b53: Set correct number of ports in the DSA struct")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/bcm_sf2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 510324916e91..690e9d9495e7 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -38,7 +38,7 @@ static unsigned int bcm_sf2_num_active_ports(struct dsa_switch *ds)
 	struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
 	unsigned int port, count = 0;
 
-	for (port = 0; port < ARRAY_SIZE(priv->port_sts); port++) {
+	for (port = 0; port < ds->num_ports; port++) {
 		if (dsa_is_cpu_port(ds, port))
 			continue;
 		if (priv->port_sts[port].enabled)

From 4d8524048a35c03ff04c25ca1bcdf569f9aeb14a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 22 Sep 2021 12:28:07 +0200
Subject: [PATCH 0432/1750] Linux 5.10.68

Link: https://lore.kernel.org/r/20210920163915.757887582@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index a47273ecfdf2..e50581c9db50 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 67
+SUBLEVEL = 68
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 1b6d7b3a2162f55441d3d0774c41a4fc6378798f Mon Sep 17 00:00:00 2001
From: Alistair Delva <adelva@google.com>
Date: Wed, 22 Sep 2021 15:51:44 -0700
Subject: [PATCH 0433/1750] ANDROID: GKI: Update symbol list for new modules

virtio-snd, gs-usb and the mac80211 modularization were done without
regenerating the symbol list for the virtual device. Fix it.

Bug: 175151042
Change-Id: Ie6ca12c9dcbcb29057d4fb9c7478abac086e4088
Signed-off-by: Alistair Delva <adelva@google.com>
---
 android/abi_gki_aarch64_virtual_device | 321 +++++++++++++++++--------
 1 file changed, 226 insertions(+), 95 deletions(-)

diff --git a/android/abi_gki_aarch64_virtual_device b/android/abi_gki_aarch64_virtual_device
index 7dbe5d853d7d..e2a5103e1b75 100644
--- a/android/abi_gki_aarch64_virtual_device
+++ b/android/abi_gki_aarch64_virtual_device
@@ -3,6 +3,7 @@
   alloc_anon_inode
   __alloc_disk_node
   alloc_etherdev_mqs
+  alloc_netdev_mqs
   __alloc_pages_nodemask
   __alloc_skb
   alloc_workqueue
@@ -27,10 +28,15 @@
   blk_queue_physical_block_size
   blk_queue_write_cache
   blk_status_to_errno
+  bpf_trace_run1
   bpf_trace_run2
   bpf_trace_run3
+  bpf_trace_run4
+  bpf_trace_run5
+  bpf_trace_run6
   bus_register
   bus_unregister
+  cancel_delayed_work
   cancel_delayed_work_sync
   cancel_work_sync
   capable
@@ -38,6 +44,8 @@
   __check_object_size
   __class_create
   class_destroy
+  __class_register
+  class_unregister
   __ClearPageMovable
   clk_disable
   clk_enable
@@ -58,6 +66,8 @@
   cpu_number
   __cpu_online_mask
   __cpu_possible_mask
+  crc32_le
+  crypto_destroy_tfm
   crypto_register_alg
   crypto_register_scomp
   crypto_unregister_alg
@@ -71,9 +81,14 @@
   del_timer
   del_timer_sync
   destroy_workqueue
+  dev_alloc_name
+  dev_close
   _dev_err
+  __dev_get_by_index
+  device_add
   device_add_disk
   device_create
+  device_del
   device_initialize
   device_register
   device_release_driver
@@ -86,6 +101,7 @@
   devm_kmalloc
   devm_request_threaded_irq
   _dev_notice
+  dev_printk
   dev_queue_xmit
   dev_set_name
   _dev_warn
@@ -104,7 +120,9 @@
   down_read
   down_write
   ether_setup
+  eth_mac_addr
   ethtool_op_get_link
+  eth_type_trans
   eth_validate_addr
   event_triggers_call
   failure_tracking
@@ -117,7 +135,11 @@
   free_netdev
   __free_pages
   free_pages
+  free_percpu
   fs_bio_set
+  genlmsg_put
+  genl_register_family
+  genl_unregister_family
   get_device
   __get_free_pages
   get_random_bytes
@@ -129,7 +151,11 @@
   ida_free
   idr_alloc
   idr_destroy
+  idr_find
+  idr_for_each
+  idr_get_next
   idr_remove
+  init_net
   init_pseudo
   __init_rwsem
   __init_swait_queue_head
@@ -153,11 +179,13 @@
   kern_mount
   kern_unmount
   kfree
+  kfree_sensitive
   kfree_skb
   kill_anon_super
   kimage_voffset
   __kmalloc
   kmalloc_caches
+  kmalloc_order_trace
   kmem_cache_alloc
   kmem_cache_alloc_trace
   kmem_cache_create
@@ -183,6 +211,7 @@
   ktime_get_ts64
   ktime_get_with_offset
   kvfree
+  kvfree_call_rcu
   kvmalloc_node
   __list_add_valid
   __list_del_entry_valid
@@ -200,6 +229,7 @@
   memunmap
   misc_deregister
   misc_register
+  mod_delayed_work_on
   mod_timer
   module_layout
   module_put
@@ -210,17 +240,31 @@
   mutex_lock_interruptible
   mutex_trylock
   mutex_unlock
+  napi_gro_receive
+  __netdev_alloc_skb
   netdev_err
   netdev_info
   netdev_rx_handler_register
   netdev_rx_handler_unregister
   netdev_upper_dev_unlink
+  netdev_warn
   netif_carrier_off
   netif_carrier_on
   netif_device_detach
+  netif_rx
+  netif_rx_ni
   netif_tx_stop_all_queues
   netif_tx_wake_queue
+  netlink_broadcast
+  netlink_register_notifier
+  netlink_unicast
+  netlink_unregister_notifier
+  net_ratelimit
   nf_conntrack_destroy
+  nla_memcpy
+  __nla_parse
+  nla_put_64bit
+  nla_put
   no_llseek
   nonseekable_open
   noop_llseek
@@ -253,6 +297,7 @@
   __per_cpu_offset
   perf_trace_buf_alloc
   perf_trace_run_bpf_submit
+  platform_device_register_full
   platform_device_unregister
   __platform_driver_register
   platform_driver_unregister
@@ -273,6 +318,7 @@
   prepare_to_wait
   prepare_to_wait_event
   printk
+  __pskb_pull_tail
   put_device
   put_disk
   __put_page
@@ -296,6 +342,7 @@
   register_netdev
   register_netdevice
   register_netdevice_notifier
+  register_pernet_device
   register_shrinker
   register_virtio_device
   register_virtio_driver
@@ -303,10 +350,19 @@
   __regmap_init
   regmap_read
   regmap_write
+  release_firmware
   remap_pfn_range
+  request_firmware
   __request_module
   request_threaded_irq
   revalidate_disk_size
+  rhashtable_insert_slow
+  __rht_bucket_nested
+  rht_bucket_nested
+  rht_bucket_nested_insert
+  rtnl_is_locked
+  rtnl_link_register
+  rtnl_link_unregister
   rtnl_lock
   rtnl_unlock
   schedule
@@ -334,10 +390,18 @@
   sg_next
   simple_strtoul
   skb_add_rx_frag
+  skb_clone
+  skb_copy
+  skb_copy_bits
+  skb_copy_expand
   skb_dequeue
+  skb_pull
   skb_push
   skb_put
+  skb_queue_head
+  skb_queue_purge
   skb_queue_tail
+  skb_trim
   snd_card_disconnect
   snd_card_free
   snd_card_new
@@ -355,6 +419,8 @@
   snd_device_new
   snd_dma_alloc_pages
   snd_dma_free_pages
+  snd_jack_new
+  snd_jack_report
   snd_pci_quirk_lookup
   snd_pcm_add_chmap_ctls
   snd_pcm_alt_chmaps
@@ -368,6 +434,7 @@
   snprintf
   sort
   sprintf
+  sscanf
   __stack_chk_fail
   __stack_chk_guard
   strcmp
@@ -378,13 +445,23 @@
   strncpy
   strsep
   submit_bio
+  __sw_hweight16
+  __sw_hweight32
+  __sw_hweight64
+  __sw_hweight8
   sync_file_create
+  synchronize_net
   synchronize_rcu
   sysfs_create_group
+  sysfs_create_link
   __sysfs_match_string
   sysfs_remove_group
   sysfs_remove_link
+  system_freezable_wq
   system_wq
+  tasklet_init
+  tasklet_kill
+  __tasklet_schedule
   trace_event_buffer_commit
   trace_event_buffer_reserve
   trace_event_ignore_this_pid
@@ -404,8 +481,10 @@
   unlock_page
   unregister_blkdev
   unregister_netdev
+  unregister_netdevice_many
   unregister_netdevice_notifier
   unregister_netdevice_queue
+  unregister_pernet_device
   unregister_shrinker
   unregister_virtio_device
   unregister_virtio_driver
@@ -483,6 +562,48 @@
   sg_miter_start
   sg_miter_stop
 
+# required by cfg80211.ko
+  bpf_trace_run10
+  bpf_trace_run7
+  debugfs_rename
+  dev_change_net_namespace
+  dev_get_by_index
+  device_rename
+  gcd
+  genlmsg_multicast_allns
+  get_net_ns_by_fd
+  get_net_ns_by_pid
+  inet_csk_get_port
+  init_uts_ns
+  key_create_or_update
+  key_put
+  keyring_alloc
+  ktime_get_coarse_with_offset
+  memcmp
+  net_ns_type_operations
+  nla_find
+  nla_reserve
+  __nla_validate
+  of_prop_next_u32
+  __put_net
+  rb_erase
+  rb_insert_color
+  request_firmware_nowait
+  rfkill_alloc
+  rfkill_blocked
+  rfkill_destroy
+  rfkill_pause_polling
+  rfkill_register
+  rfkill_resume_polling
+  rfkill_set_hw_state
+  rfkill_unregister
+  __sock_create
+  sock_release
+  system_power_efficient_wq
+  trace_print_array_seq
+  verify_pkcs7_signature
+  wireless_nlevent_flush
+
 # required by clk-vexpress-osc.ko
   clk_hw_set_rate_range
   devm_clk_hw_register
@@ -497,7 +618,6 @@
 
 # required by failover.ko
   netdev_master_upper_dev_link
-  rtnl_is_locked
 
 # required by gnss-cmdline.ko
   bus_find_device
@@ -529,15 +649,37 @@
 # required by goldfish_pipe.ko
   get_user_pages_fast
   set_page_dirty
-  tasklet_init
-  tasklet_kill
-  __tasklet_schedule
 
 # required by goldfish_sync.ko
   __close_fd
   dma_fence_default_wait
   dma_fence_free
 
+# required by gs_usb.ko
+  alloc_candev_mqs
+  alloc_can_err_skb
+  alloc_can_skb
+  can_change_mtu
+  can_free_echo_skb
+  can_get_echo_skb
+  can_put_echo_skb
+  close_candev
+  free_candev
+  open_candev
+  register_candev
+  unregister_candev
+  usb_alloc_coherent
+  usb_alloc_urb
+  usb_anchor_urb
+  usb_control_msg
+  usb_deregister
+  usb_free_coherent
+  usb_free_urb
+  usb_kill_anchored_urbs
+  usb_register_driver
+  usb_submit_urb
+  usb_unanchor_urb
+
 # required by hci_vhci.ko
   bt_err
   _copy_from_iter_full
@@ -546,9 +688,6 @@
   hci_recv_frame
   hci_register_dev
   hci_unregister_dev
-  skb_pull
-  skb_queue_head
-  skb_queue_purge
 
 # required by ledtrig-audio.ko
   led_set_brightness_nosleep
@@ -564,51 +703,82 @@
 # required by lzo.ko
   lzo1x_1_compress
 
+# required by mac80211.ko
+  __alloc_percpu_gfp
+  arc4_crypt
+  arc4_setkey
+  call_rcu
+  crc32_be
+  crypto_aead_decrypt
+  crypto_aead_encrypt
+  crypto_aead_setauthsize
+  crypto_aead_setkey
+  crypto_alloc_aead
+  crypto_alloc_shash
+  crypto_alloc_skcipher
+  __crypto_memneq
+  crypto_shash_digest
+  crypto_shash_finup
+  crypto_shash_setkey
+  crypto_shash_update
+  crypto_skcipher_decrypt
+  crypto_skcipher_encrypt
+  crypto_skcipher_setkey
+  __crypto_xor
+  dev_fetch_sw_netstats
+  find_next_bit
+  flush_delayed_work
+  get_random_u32
+  __hw_addr_init
+  __hw_addr_sync
+  __hw_addr_unsync
+  kernel_param_lock
+  kernel_param_unlock
+  kfree_skb_list
+  ktime_get_seconds
+  netdev_set_default_ethtool_ops
+  netif_receive_skb
+  netif_receive_skb_list
+  prandom_bytes
+  prandom_u32
+  pskb_expand_head
+  ___pskb_trim
+  rcu_barrier
+  register_inet6addr_notifier
+  register_inetaddr_notifier
+  rhashtable_free_and_destroy
+  rhltable_init
+  round_jiffies
+  round_jiffies_relative
+  round_jiffies_up
+  skb_checksum_help
+  skb_clone_sk
+  skb_complete_wifi_ack
+  skb_ensure_writable
+  __skb_get_hash
+  __skb_gso_segment
+  unregister_inet6addr_notifier
+  unregister_inetaddr_notifier
+
 # required by mac80211_hwsim.ko
-  alloc_netdev_mqs
   debugfs_attr_read
   debugfs_attr_write
-  dev_alloc_name
   device_bind_driver
   dst_release
-  eth_mac_addr
-  genlmsg_put
   genl_notify
-  genl_register_family
-  genl_unregister_family
   hrtimer_cancel
   hrtimer_forward
   hrtimer_init
   hrtimer_start_range_ns
-  init_net
-  __netdev_alloc_skb
-  netif_rx
-  netlink_broadcast
-  netlink_register_notifier
-  netlink_unicast
-  netlink_unregister_notifier
   net_namespace_list
-  nla_memcpy
-  __nla_parse
-  nla_put_64bit
-  nla_put
   param_ops_ushort
-  register_pernet_device
   rhashtable_destroy
   rhashtable_init
-  rhashtable_insert_slow
-  __rht_bucket_nested
-  rht_bucket_nested
-  rht_bucket_nested_insert
   schedule_timeout_interruptible
   simple_attr_open
   simple_attr_release
-  skb_copy
-  skb_copy_expand
   __skb_ext_put
-  skb_trim
   skb_unlink
-  unregister_pernet_device
 
 # required by md-mod.ko
   ack_all_badblocks
@@ -686,7 +856,6 @@
   submit_bh
   submit_bio_wait
   sync_blockdev
-  sysfs_create_link
   unregister_reboot_notifier
   unregister_sysctl_table
   vfs_fsync
@@ -698,7 +867,6 @@
 
 # required by net_failover.ko
   call_netdevice_notifiers
-  dev_close
   dev_get_stats
   dev_mc_sync_multiple
   dev_mc_unsync
@@ -775,6 +943,15 @@
   rtc_tm_to_time64
   rtc_update_irq
 
+# required by slcan.ko
+  hex_asc_upper
+  hex_to_bin
+  msleep_interruptible
+  tty_hangup
+  tty_mode_ioctl
+  tty_register_ldisc
+  tty_unregister_ldisc
+
 # required by snd-ac97-codec.ko
   snd_ctl_remove_id
   snd_info_create_card_entry
@@ -788,10 +965,8 @@
   snd_ctl_boolean_stereo_info
   strchr
   strlcat
-  __sw_hweight32
 
 # required by snd-hda-codec.ko
-  bpf_trace_run4
   current_work
   device_attach
   driver_register
@@ -807,8 +982,6 @@
   snd_ctl_remove
   snd_device_disconnect
   snd_device_free
-  snd_jack_new
-  snd_jack_report
   snd_jack_set_key
   snd_pcm_hw_constraint_minmax
   snd_pcm_hw_constraint_step
@@ -819,8 +992,6 @@
 
 # required by snd-hda-core.ko
   add_uevent_var
-  device_add
-  device_del
   kasprintf
   kobject_create_and_add
   pm_runtime_get_if_active
@@ -829,11 +1000,9 @@
   regcache_sync
   regmap_update_bits_base
   snd_pcm_format_width
-  __sw_hweight64
   timecounter_init
 
 # required by snd-hda-intel.ko
-  bpf_trace_run1
   complete_all
   param_array_ops
   param_get_int
@@ -879,7 +1048,6 @@
   efi
   efi_tpm_final_log_size
   hash_digest_size
-  idr_get_next
   idr_replace
   jiffies_to_usecs
   memchr_inv
@@ -896,6 +1064,9 @@
   anon_inode_getfile
   compat_ptr_ioctl
 
+# required by vcan.ko
+  sock_efree
+
 # required by vexpress-config.ko
   devres_add
   devres_alloc_node
@@ -913,19 +1084,9 @@
   devm_mfd_add_devices
 
 # required by virt_wifi.ko
-  __dev_get_by_index
-  dev_printk
   __module_get
   netdev_upper_dev_link
   netif_stacked_transfer_operstate
-  rtnl_link_register
-  rtnl_link_unregister
-  skb_clone
-  unregister_netdevice_many
-
-# required by virt_wifi_sim.ko
-  release_firmware
-  request_firmware
 
 # required by virtio-gpu.ko
   __devm_request_region
@@ -1042,7 +1203,6 @@
   __get_task_comm
   iomem_resource
   is_vmalloc_addr
-  kmalloc_order_trace
   memdup_user
   seq_puts
   sync_file_get_fence
@@ -1072,7 +1232,6 @@
   register_oom_notifier
   si_mem_available
   si_meminfo
-  system_freezable_wq
   unregister_oom_notifier
   vm_event_states
   vm_node_stat
@@ -1130,8 +1289,6 @@
 # required by virtio_mmio.ko
   device_for_each_child
   devm_platform_ioremap_resource
-  platform_device_register_full
-  sscanf
 
 # required by virtio_net.ko
   bpf_dispatcher_xdp_func
@@ -1148,17 +1305,14 @@
   eth_prepare_mac_addr_change
   ethtool_op_get_ts_info
   ethtool_virtdev_set_link_ksettings
-  eth_type_trans
   flow_keys_basic_dissector
   __napi_alloc_skb
   napi_complete_done
   napi_consume_skb
   napi_disable
-  napi_gro_receive
   __napi_schedule
   napi_schedule_prep
   netdev_notify_peers
-  netdev_warn
   netif_device_attach
   netif_napi_add
   __netif_napi_del
@@ -1166,8 +1320,6 @@
   netif_set_real_num_rx_queues
   netif_set_real_num_tx_queues
   __netif_set_xps_queue
-  net_ratelimit
-  __pskb_pull_tail
   _raw_spin_trylock
   sched_clock
   skb_coalesce_rx_frag
@@ -1177,7 +1329,6 @@
   skb_to_sgvec
   skb_tstamp_tx
   softnet_data
-  synchronize_net
   __traceiter_xdp_exception
   __tracepoint_xdp_exception
   virtqueue_add_inbuf_ctx
@@ -1220,6 +1371,17 @@
   nvdimm_bus_unregister
   nvdimm_pmem_region_create
 
+# required by virtio_snd.ko
+  snd_ctl_notify
+  snd_pcm_format_physical_width
+  snd_pcm_lib_free_pages
+  snd_pcm_lib_ioctl
+  snd_pcm_lib_malloc_pages
+  snd_pcm_lib_preallocate_pages
+  _snd_pcm_stream_lock_irqsave
+  snd_pcm_stream_unlock_irqrestore
+  wait_for_completion_interruptible_timeout
+
 # required by vmw_vsock_virtio_transport.ko
   lock_sock_nested
   release_sock
@@ -1261,20 +1423,14 @@
   __alloc_percpu
   bdget_disk
   bdput
-  __class_register
-  class_unregister
   crypto_alloc_base
   crypto_comp_compress
   crypto_comp_decompress
-  crypto_destroy_tfm
   crypto_has_alg
   disk_end_io_acct
   disk_start_io_acct
   flush_dcache_page
-  free_percpu
   fsync_bdev
-  idr_find
-  idr_for_each
   kstrtou16
   memset64
   mutex_is_locked
@@ -1291,28 +1447,3 @@
   _raw_read_unlock
   _raw_write_lock
   _raw_write_unlock
-
-# required by gs_usb.ko
-  usb_kill_anchored_urbs
-  alloc_candev_mqs
-  register_candev
-  free_candev
-  can_change_mtu
-  open_candev
-  usb_anchor_urb
-  usb_unanchor_urb
-  alloc_can_skb
-  can_get_echo_skb
-  alloc_can_err_skb
-  close_candev
-  can_put_echo_skb
-  can_free_echo_skb
-  unregister_candev
-
-# required by vcan.ko
-  sock_efree
-
-# required by slcan.ko
-  tty_mode_ioctl
-  tty_hangup
-  hex_asc_upper

From 9e766b86a9ef653a8ca48a9f70d3dbb580284594 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 22 Jul 2021 16:40:40 +0200
Subject: [PATCH 0434/1750] PCI: pci-bridge-emul: Add PCIe Root Capabilities
 Register
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e902bb7c24a7099d0eb0eb4cba06f2d91e9299f3 upstream.

The 16-bit Root Capabilities register is at offset 0x1e in the PCIe
Capability. Rename current 'rsvd' struct member to 'rootcap'.

Link: https://lore.kernel.org/r/20210722144041.12661-4-pali@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pci-bridge-emul.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci-bridge-emul.h b/drivers/pci/pci-bridge-emul.h
index b31883022a8e..49bbd37ee318 100644
--- a/drivers/pci/pci-bridge-emul.h
+++ b/drivers/pci/pci-bridge-emul.h
@@ -54,7 +54,7 @@ struct pci_bridge_emul_pcie_conf {
 	__le16 slotctl;
 	__le16 slotsta;
 	__le16 rootctl;
-	__le16 rsvd;
+	__le16 rootcap;
 	__le32 rootsta;
 	__le32 devcap2;
 	__le16 devctl2;

From 9493e92a395330787def2b1980e930f5082de2f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 22 Jul 2021 16:40:41 +0200
Subject: [PATCH 0435/1750] PCI: aardvark: Fix reporting CRS value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 43f5c77bcbd27cce70bf33c2b86d6726ce95dd66 upstream.

Set CRSVIS flag in emulated root PCI bridge to indicate support for
Completion Retry Status.

Add check for CRSSVE flag from root PCI brige when issuing Configuration
Read Request via PIO to correctly returns fabricated CRS value as it is
required by PCIe spec.

Link: https://lore.kernel.org/r/20210722144041.12661-5-pali@kernel.org
Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org # e0d9d30b7354 ("PCI: pci-bridge-emul: Fix big-endian support")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 67 +++++++++++++++++++++++++--
 1 file changed, 63 insertions(+), 4 deletions(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 88e19ad54f64..f175cff39b46 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -225,6 +225,8 @@
 
 #define MSI_IRQ_NUM			32
 
+#define CFG_RD_CRS_VAL			0xffff0001
+
 struct advk_pcie {
 	struct platform_device *pdev;
 	void __iomem *base;
@@ -587,7 +589,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 	advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG);
 }
 
-static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)
+static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u32 *val)
 {
 	struct device *dev = &pcie->pdev->dev;
 	u32 reg;
@@ -629,9 +631,30 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val)
 		strcomp_status = "UR";
 		break;
 	case PIO_COMPLETION_STATUS_CRS:
+		if (allow_crs && val) {
+			/* PCIe r4.0, sec 2.3.2, says:
+			 * If CRS Software Visibility is enabled:
+			 * For a Configuration Read Request that includes both
+			 * bytes of the Vendor ID field of a device Function's
+			 * Configuration Space Header, the Root Complex must
+			 * complete the Request to the host by returning a
+			 * read-data value of 0001h for the Vendor ID field and
+			 * all '1's for any additional bytes included in the
+			 * request.
+			 *
+			 * So CRS in this case is not an error status.
+			 */
+			*val = CFG_RD_CRS_VAL;
+			strcomp_status = NULL;
+			break;
+		}
 		/* PCIe r4.0, sec 2.3.2, says:
 		 * If CRS Software Visibility is not enabled, the Root Complex
 		 * must re-issue the Configuration Request as a new Request.
+		 * If CRS Software Visibility is enabled: For a Configuration
+		 * Write Request or for any other Configuration Read Request,
+		 * the Root Complex must re-issue the Configuration Request as
+		 * a new Request.
 		 * A Root Complex implementation may choose to limit the number
 		 * of Configuration Request/CRS Completion Status loops before
 		 * determining that something is wrong with the target of the
@@ -700,6 +723,7 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
 	case PCI_EXP_RTCTL: {
 		u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG);
 		*value = (val & PCIE_MSG_PM_PME_MASK) ? 0 : PCI_EXP_RTCTL_PMEIE;
+		*value |= PCI_EXP_RTCAP_CRSVIS << 16;
 		return PCI_BRIDGE_EMUL_HANDLED;
 	}
 
@@ -781,6 +805,7 @@ static struct pci_bridge_emul_ops advk_pci_bridge_emul_ops = {
 static int advk_sw_pci_bridge_init(struct advk_pcie *pcie)
 {
 	struct pci_bridge_emul *bridge = &pcie->bridge;
+	int ret;
 
 	bridge->conf.vendor =
 		cpu_to_le16(advk_readl(pcie, PCIE_CORE_DEV_ID_REG) & 0xffff);
@@ -804,7 +829,15 @@ static int advk_sw_pci_bridge_init(struct advk_pcie *pcie)
 	bridge->data = pcie;
 	bridge->ops = &advk_pci_bridge_emul_ops;
 
-	return pci_bridge_emul_init(bridge, 0);
+	/* PCIe config space can be initialized after pci_bridge_emul_init() */
+	ret = pci_bridge_emul_init(bridge, 0);
+	if (ret < 0)
+		return ret;
+
+	/* Indicates supports for Completion Retry Status */
+	bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS);
+
+	return 0;
 }
 
 static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus,
@@ -856,6 +889,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
 			     int where, int size, u32 *val)
 {
 	struct advk_pcie *pcie = bus->sysdata;
+	bool allow_crs;
 	u32 reg;
 	int ret;
 
@@ -868,7 +902,24 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
 		return pci_bridge_emul_conf_read(&pcie->bridge, where,
 						 size, val);
 
+	/*
+	 * Completion Retry Status is possible to return only when reading all
+	 * 4 bytes from PCI_VENDOR_ID and PCI_DEVICE_ID registers at once and
+	 * CRSSVE flag on Root Bridge is enabled.
+	 */
+	allow_crs = (where == PCI_VENDOR_ID) && (size == 4) &&
+		    (le16_to_cpu(pcie->bridge.pcie_conf.rootctl) &
+		     PCI_EXP_RTCTL_CRSSVE);
+
 	if (advk_pcie_pio_is_running(pcie)) {
+		/*
+		 * If it is possible return Completion Retry Status so caller
+		 * tries to issue the request again instead of failing.
+		 */
+		if (allow_crs) {
+			*val = CFG_RD_CRS_VAL;
+			return PCIBIOS_SUCCESSFUL;
+		}
 		*val = 0xffffffff;
 		return PCIBIOS_SET_FAILED;
 	}
@@ -896,12 +947,20 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
 
 	ret = advk_pcie_wait_pio(pcie);
 	if (ret < 0) {
+		/*
+		 * If it is possible return Completion Retry Status so caller
+		 * tries to issue the request again instead of failing.
+		 */
+		if (allow_crs) {
+			*val = CFG_RD_CRS_VAL;
+			return PCIBIOS_SUCCESSFUL;
+		}
 		*val = 0xffffffff;
 		return PCIBIOS_SET_FAILED;
 	}
 
 	/* Check PIO status and get the read result */
-	ret = advk_pcie_check_pio_status(pcie, val);
+	ret = advk_pcie_check_pio_status(pcie, allow_crs, val);
 	if (ret < 0) {
 		*val = 0xffffffff;
 		return PCIBIOS_SET_FAILED;
@@ -970,7 +1029,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
 	if (ret < 0)
 		return PCIBIOS_SET_FAILED;
 
-	ret = advk_pcie_check_pio_status(pcie, NULL);
+	ret = advk_pcie_check_pio_status(pcie, false, NULL);
 	if (ret < 0)
 		return PCIBIOS_SET_FAILED;
 

From 74d54e5ceba3f50b9b695e4740172d876327815a Mon Sep 17 00:00:00 2001
From: nick black <dankamongmen@gmail.com>
Date: Mon, 30 Aug 2021 04:56:15 -0400
Subject: [PATCH 0436/1750] console: consume APC, DM, DCS

commit 3a2b2eb55681158d3e3ef464fbf47574cf0c517c upstream.

The Linux console's VT102 implementation already consumes OSC
("Operating System Command") sequences, probably because that's how
palette changes are transmitted.

In addition to OSC, there are three other major clases of ANSI control
strings: APC ("Application Program Command"), PM ("Privacy Message"),
and DCS ("Device Control String").  They are handled similarly to OSC in
terms of termination.

Source: vt100.net

Add three new enumerated states, one for each of these types.  All three
are handled the same way right now--they simply consume input until
terminated.  I hope to expand upon this firmament in the future.  Add
new predicate ansi_control_string(), returning true for any of these
states.  Replace explicit checks against ESosc with calls to this
function.  Transition to these states appropriately from the escape
initiation (ESesc) state.

This was motivated by the following Notcurses bugs:

 https://github.com/dankamongmen/notcurses/issues/2050
 https://github.com/dankamongmen/notcurses/issues/1828
 https://github.com/dankamongmen/notcurses/issues/2069

where standard VT sequences are not consumed by the Linux console.  It's
not necessary that the Linux console *support* these sequences, but it
ought *consume* these well-specified classes of sequences.

Tested by sending a variety of escape sequences to the console, and
verifying that they still worked, or were now properly consumed.
Verified that the escapes were properly terminated at a generic level.
Verified that the Notcurses tools continued to show expected output on
the Linux console, except now without escape bleedthrough.

Link: https://lore.kernel.org/lkml/YSydL0q8iaUfkphg@schwarzgerat.orthanc/
Signed-off-by: nick black <dankamongmen@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jirislaby@kernel.org>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vt/vt.c | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index 06757b1d4aec..cea40ef090b7 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -2060,7 +2060,7 @@ static void restore_cur(struct vc_data *vc)
 
 enum { ESnormal, ESesc, ESsquare, ESgetpars, ESfunckey,
 	EShash, ESsetG0, ESsetG1, ESpercent, EScsiignore, ESnonstd,
-	ESpalette, ESosc };
+	ESpalette, ESosc, ESapc, ESpm, ESdcs };
 
 /* console_lock is held (except via vc_init()) */
 static void reset_terminal(struct vc_data *vc, int do_clear)
@@ -2134,20 +2134,28 @@ static void vc_setGx(struct vc_data *vc, unsigned int which, int c)
 		vc->vc_translate = set_translate(*charset, vc);
 }
 
+/* is this state an ANSI control string? */
+static bool ansi_control_string(unsigned int state)
+{
+	if (state == ESosc || state == ESapc || state == ESpm || state == ESdcs)
+		return true;
+	return false;
+}
+
 /* console_lock is held */
 static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
 {
 	/*
 	 *  Control characters can be used in the _middle_
-	 *  of an escape sequence.
+	 *  of an escape sequence, aside from ANSI control strings.
 	 */
-	if (vc->vc_state == ESosc && c>=8 && c<=13) /* ... except for OSC */
+	if (ansi_control_string(vc->vc_state) && c >= 8 && c <= 13)
 		return;
 	switch (c) {
 	case 0:
 		return;
 	case 7:
-		if (vc->vc_state == ESosc)
+		if (ansi_control_string(vc->vc_state))
 			vc->vc_state = ESnormal;
 		else if (vc->vc_bell_duration)
 			kd_mksound(vc->vc_bell_pitch, vc->vc_bell_duration);
@@ -2208,6 +2216,12 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
 		case ']':
 			vc->vc_state = ESnonstd;
 			return;
+		case '_':
+			vc->vc_state = ESapc;
+			return;
+		case '^':
+			vc->vc_state = ESpm;
+			return;
 		case '%':
 			vc->vc_state = ESpercent;
 			return;
@@ -2225,6 +2239,9 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
 			if (vc->state.x < VC_TABSTOPS_COUNT)
 				set_bit(vc->state.x, vc->vc_tab_stop);
 			return;
+		case 'P':
+			vc->vc_state = ESdcs;
+			return;
 		case 'Z':
 			respond_ID(tty);
 			return;
@@ -2521,8 +2538,14 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c)
 		vc_setGx(vc, 1, c);
 		vc->vc_state = ESnormal;
 		return;
+	case ESapc:
+		return;
 	case ESosc:
 		return;
+	case ESpm:
+		return;
+	case ESdcs:
+		return;
 	default:
 		vc->vc_state = ESnormal;
 	}

From 79286ea830b3922b38bcefbd150b2010f91a55ce Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Thu, 9 Sep 2021 16:59:42 +0200
Subject: [PATCH 0437/1750] s390/pci_mmio: fully validate the VMA before
 calling follow_pte()

commit a8b92b8c1eac8d655a97b1e90f4d83c25d9b9a18 upstream.

We should not walk/touch page tables outside of VMA boundaries when
holding only the mmap sem in read mode. Evil user space can modify the
VMA layout just before this function runs and e.g., trigger races with
page table removal code since commit dd2283f2605e ("mm: mmap: zap pages
with read mmap_sem in munmap").

find_vma() does not check if the address is >= the VMA start address;
use vma_lookup() instead.

Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/pci/pci_mmio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
index 401cf670a243..37b1bbd1a27c 100644
--- a/arch/s390/pci/pci_mmio.c
+++ b/arch/s390/pci/pci_mmio.c
@@ -128,7 +128,7 @@ static long get_pfn(unsigned long user_addr, unsigned long access,
 	mmap_read_lock(current->mm);
 	ret = -EINVAL;
 	vma = find_vma(current->mm, user_addr);
-	if (!vma)
+	if (!vma || user_addr < vma->vm_start)
 		goto out;
 	ret = -EACCES;
 	if (!(vma->vm_flags & access))

From eb46d7c8ae838b37ad4acee44fa3828af3062ce7 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Thu, 18 Mar 2021 21:03:33 -0700
Subject: [PATCH 0438/1750] ARM: Qualify enabling of swiotlb_init()

commit fcf044891c84e38fc90eb736b818781bccf94e38 upstream.

We do not need a SWIOTLB unless we have DRAM that is addressable beyond
the arm_dma_limit. Compare max_pfn with arm_dma_pfn_limit to determine
whether we do need a SWIOTLB to be initialized.

Fixes: ad3c7b18c5b3 ("arm: use swiotlb for bounce buffering on LPAE configs")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/mm/init.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index d54d69cf1732..75f3ab531bdf 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -378,7 +378,11 @@ static void __init free_highpages(void)
 void __init mem_init(void)
 {
 #ifdef CONFIG_ARM_LPAE
-	swiotlb_init(1);
+	if (swiotlb_force == SWIOTLB_FORCE ||
+	    max_pfn > arm_dma_pfn_limit)
+		swiotlb_init(1);
+	else
+		swiotlb_force = SWIOTLB_NO_FORCE;
 #endif
 
 	set_max_mapnr(pfn_to_page(max_pfn) - mem_map);

From ce90c6706d5a95ddda8d3cea01768bd0b4445851 Mon Sep 17 00:00:00 2001
From: Alex Sverdlin <alexander.sverdlin@nokia.com>
Date: Wed, 22 Sep 2021 09:59:55 -0700
Subject: [PATCH 0439/1750] ARM: 9077/1: PLT: Move struct plt_entries
 definition to header

commit 4e271701c17dee70c6e1351c4d7d42e70405c6a9 upstream upstream

No functional change, later it will be re-used in several files.

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/include/asm/module.h | 9 +++++++++
 arch/arm/kernel/module-plts.c | 9 ---------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h
index 4b0df09cbe67..09b9ad55b83d 100644
--- a/arch/arm/include/asm/module.h
+++ b/arch/arm/include/asm/module.h
@@ -19,6 +19,15 @@ enum {
 };
 #endif
 
+#define PLT_ENT_STRIDE		L1_CACHE_BYTES
+#define PLT_ENT_COUNT		(PLT_ENT_STRIDE / sizeof(u32))
+#define PLT_ENT_SIZE		(sizeof(struct plt_entries) / PLT_ENT_COUNT)
+
+struct plt_entries {
+	u32	ldr[PLT_ENT_COUNT];
+	u32	lit[PLT_ENT_COUNT];
+};
+
 struct mod_plt_sec {
 	struct elf32_shdr	*plt;
 	int			plt_count;
diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c
index 6e626abaefc5..d330e9ec2de3 100644
--- a/arch/arm/kernel/module-plts.c
+++ b/arch/arm/kernel/module-plts.c
@@ -12,10 +12,6 @@
 #include <asm/cache.h>
 #include <asm/opcodes.h>
 
-#define PLT_ENT_STRIDE		L1_CACHE_BYTES
-#define PLT_ENT_COUNT		(PLT_ENT_STRIDE / sizeof(u32))
-#define PLT_ENT_SIZE		(sizeof(struct plt_entries) / PLT_ENT_COUNT)
-
 #ifdef CONFIG_THUMB2_KERNEL
 #define PLT_ENT_LDR		__opcode_to_mem_thumb32(0xf8dff000 | \
 							(PLT_ENT_STRIDE - 4))
@@ -24,11 +20,6 @@
 						    (PLT_ENT_STRIDE - 8))
 #endif
 
-struct plt_entries {
-	u32	ldr[PLT_ENT_COUNT];
-	u32	lit[PLT_ENT_COUNT];
-};
-
 static bool in_init(const struct module *mod, unsigned long loc)
 {
 	return loc - (u32)mod->init_layout.base < mod->init_layout.size;

From ad00533858f7b1436f7dc9c555ccac85c0e28c9a Mon Sep 17 00:00:00 2001
From: Alex Sverdlin <alexander.sverdlin@nokia.com>
Date: Wed, 22 Sep 2021 09:59:56 -0700
Subject: [PATCH 0440/1750] ARM: 9078/1: Add warn suppress parameter to
 arm_gen_branch_link()

commit 890cb057a46d323fd8c77ebecb6485476614cd21 upstream

Will be used in the following patch. No functional change.

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/include/asm/insn.h |  8 ++++----
 arch/arm/kernel/ftrace.c    |  2 +-
 arch/arm/kernel/insn.c      | 19 ++++++++++---------
 3 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/arch/arm/include/asm/insn.h b/arch/arm/include/asm/insn.h
index f20e08ac85ae..5475cbf9fb6b 100644
--- a/arch/arm/include/asm/insn.h
+++ b/arch/arm/include/asm/insn.h
@@ -13,18 +13,18 @@ arm_gen_nop(void)
 }
 
 unsigned long
-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link);
+__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn);
 
 static inline unsigned long
 arm_gen_branch(unsigned long pc, unsigned long addr)
 {
-	return __arm_gen_branch(pc, addr, false);
+	return __arm_gen_branch(pc, addr, false, true);
 }
 
 static inline unsigned long
-arm_gen_branch_link(unsigned long pc, unsigned long addr)
+arm_gen_branch_link(unsigned long pc, unsigned long addr, bool warn)
 {
-	return __arm_gen_branch(pc, addr, true);
+	return __arm_gen_branch(pc, addr, true, warn);
 }
 
 #endif
diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c
index 9a79ef6b1876..61de8172a044 100644
--- a/arch/arm/kernel/ftrace.c
+++ b/arch/arm/kernel/ftrace.c
@@ -70,7 +70,7 @@ int ftrace_arch_code_modify_post_process(void)
 
 static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr)
 {
-	return arm_gen_branch_link(pc, addr);
+	return arm_gen_branch_link(pc, addr, true);
 }
 
 static int ftrace_modify_code(unsigned long pc, unsigned long old,
diff --git a/arch/arm/kernel/insn.c b/arch/arm/kernel/insn.c
index 2e844b70386b..db0acbb7d7a0 100644
--- a/arch/arm/kernel/insn.c
+++ b/arch/arm/kernel/insn.c
@@ -3,8 +3,9 @@
 #include <linux/kernel.h>
 #include <asm/opcodes.h>
 
-static unsigned long
-__arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link)
+static unsigned long __arm_gen_branch_thumb2(unsigned long pc,
+					     unsigned long addr, bool link,
+					     bool warn)
 {
 	unsigned long s, j1, j2, i1, i2, imm10, imm11;
 	unsigned long first, second;
@@ -12,7 +13,7 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link)
 
 	offset = (long)addr - (long)(pc + 4);
 	if (offset < -16777216 || offset > 16777214) {
-		WARN_ON_ONCE(1);
+		WARN_ON_ONCE(warn);
 		return 0;
 	}
 
@@ -33,8 +34,8 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link)
 	return __opcode_thumb32_compose(first, second);
 }
 
-static unsigned long
-__arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link)
+static unsigned long __arm_gen_branch_arm(unsigned long pc, unsigned long addr,
+					  bool link, bool warn)
 {
 	unsigned long opcode = 0xea000000;
 	long offset;
@@ -44,7 +45,7 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link)
 
 	offset = (long)addr - (long)(pc + 8);
 	if (unlikely(offset < -33554432 || offset > 33554428)) {
-		WARN_ON_ONCE(1);
+		WARN_ON_ONCE(warn);
 		return 0;
 	}
 
@@ -54,10 +55,10 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link)
 }
 
 unsigned long
-__arm_gen_branch(unsigned long pc, unsigned long addr, bool link)
+__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn)
 {
 	if (IS_ENABLED(CONFIG_THUMB2_KERNEL))
-		return __arm_gen_branch_thumb2(pc, addr, link);
+		return __arm_gen_branch_thumb2(pc, addr, link, warn);
 	else
-		return __arm_gen_branch_arm(pc, addr, link);
+		return __arm_gen_branch_arm(pc, addr, link, warn);
 }

From f91d25a7c89e2f246a541603430ce2420bab58c5 Mon Sep 17 00:00:00 2001
From: Alex Sverdlin <alexander.sverdlin@nokia.com>
Date: Wed, 22 Sep 2021 09:59:57 -0700
Subject: [PATCH 0441/1750] ARM: 9079/1: ftrace: Add MODULE_PLTS support

commit 79f32b221b18c15a98507b101ef4beb52444cc6f upstream

Teach ftrace_make_call() and ftrace_make_nop() about PLTs.
Teach PLT code about FTRACE and all its callbacks.
Otherwise the following might happen:

------------[ cut here ]------------
WARNING: CPU: 14 PID: 2265 at .../arch/arm/kernel/insn.c:14 __arm_gen_branch+0x83/0x8c()
...
Hardware name: LSI Axxia AXM55XX
[<c0314a49>] (unwind_backtrace) from [<c03115e9>] (show_stack+0x11/0x14)
[<c03115e9>] (show_stack) from [<c0519f51>] (dump_stack+0x81/0xa8)
[<c0519f51>] (dump_stack) from [<c032185d>] (warn_slowpath_common+0x69/0x90)
[<c032185d>] (warn_slowpath_common) from [<c03218f3>] (warn_slowpath_null+0x17/0x1c)
[<c03218f3>] (warn_slowpath_null) from [<c03143cf>] (__arm_gen_branch+0x83/0x8c)
[<c03143cf>] (__arm_gen_branch) from [<c0314337>] (ftrace_make_nop+0xf/0x24)
[<c0314337>] (ftrace_make_nop) from [<c038ebcb>] (ftrace_process_locs+0x27b/0x3e8)
[<c038ebcb>] (ftrace_process_locs) from [<c0378d79>] (load_module+0x11e9/0x1a44)
[<c0378d79>] (load_module) from [<c037974d>] (SyS_finit_module+0x59/0x84)
[<c037974d>] (SyS_finit_module) from [<c030e981>] (ret_fast_syscall+0x1/0x18)
---[ end trace e1b64ced7a89adcc ]---
------------[ cut here ]------------
WARNING: CPU: 14 PID: 2265 at .../kernel/trace/ftrace.c:1979 ftrace_bug+0x1b1/0x234()
...
Hardware name: LSI Axxia AXM55XX
[<c0314a49>] (unwind_backtrace) from [<c03115e9>] (show_stack+0x11/0x14)
[<c03115e9>] (show_stack) from [<c0519f51>] (dump_stack+0x81/0xa8)
[<c0519f51>] (dump_stack) from [<c032185d>] (warn_slowpath_common+0x69/0x90)
[<c032185d>] (warn_slowpath_common) from [<c03218f3>] (warn_slowpath_null+0x17/0x1c)
[<c03218f3>] (warn_slowpath_null) from [<c038e87d>] (ftrace_bug+0x1b1/0x234)
[<c038e87d>] (ftrace_bug) from [<c038ebd5>] (ftrace_process_locs+0x285/0x3e8)
[<c038ebd5>] (ftrace_process_locs) from [<c0378d79>] (load_module+0x11e9/0x1a44)
[<c0378d79>] (load_module) from [<c037974d>] (SyS_finit_module+0x59/0x84)
[<c037974d>] (SyS_finit_module) from [<c030e981>] (ret_fast_syscall+0x1/0x18)
---[ end trace e1b64ced7a89adcd ]---
ftrace failed to modify [<e9ef7006>] 0xe9ef7006
actual: 02:f0:3b:fa
ftrace record flags: 0
(0) expected tramp: c0314265

Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/include/asm/ftrace.h |  3 +++
 arch/arm/include/asm/module.h |  1 +
 arch/arm/kernel/ftrace.c      | 46 +++++++++++++++++++++++++++++------
 arch/arm/kernel/module-plts.c | 44 ++++++++++++++++++++++++++++++---
 4 files changed, 82 insertions(+), 12 deletions(-)

diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h
index 48ec1d0337da..a4dbac07e4ef 100644
--- a/arch/arm/include/asm/ftrace.h
+++ b/arch/arm/include/asm/ftrace.h
@@ -15,6 +15,9 @@ extern void __gnu_mcount_nc(void);
 
 #ifdef CONFIG_DYNAMIC_FTRACE
 struct dyn_arch_ftrace {
+#ifdef CONFIG_ARM_MODULE_PLTS
+	struct module *mod;
+#endif
 };
 
 static inline unsigned long ftrace_call_adjust(unsigned long addr)
diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h
index 09b9ad55b83d..cfffae67c04e 100644
--- a/arch/arm/include/asm/module.h
+++ b/arch/arm/include/asm/module.h
@@ -30,6 +30,7 @@ struct plt_entries {
 
 struct mod_plt_sec {
 	struct elf32_shdr	*plt;
+	struct plt_entries	*plt_ent;
 	int			plt_count;
 };
 
diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c
index 61de8172a044..3c83b5d29697 100644
--- a/arch/arm/kernel/ftrace.c
+++ b/arch/arm/kernel/ftrace.c
@@ -68,9 +68,10 @@ int ftrace_arch_code_modify_post_process(void)
 	return 0;
 }
 
-static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr)
+static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr,
+					 bool warn)
 {
-	return arm_gen_branch_link(pc, addr, true);
+	return arm_gen_branch_link(pc, addr, warn);
 }
 
 static int ftrace_modify_code(unsigned long pc, unsigned long old,
@@ -104,14 +105,14 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
 	int ret;
 
 	pc = (unsigned long)&ftrace_call;
-	new = ftrace_call_replace(pc, (unsigned long)func);
+	new = ftrace_call_replace(pc, (unsigned long)func, true);
 
 	ret = ftrace_modify_code(pc, 0, new, false);
 
 #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
 	if (!ret) {
 		pc = (unsigned long)&ftrace_regs_call;
-		new = ftrace_call_replace(pc, (unsigned long)func);
+		new = ftrace_call_replace(pc, (unsigned long)func, true);
 
 		ret = ftrace_modify_code(pc, 0, new, false);
 	}
@@ -124,10 +125,22 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
 {
 	unsigned long new, old;
 	unsigned long ip = rec->ip;
+	unsigned long aaddr = adjust_address(rec, addr);
+	struct module *mod = NULL;
+
+#ifdef CONFIG_ARM_MODULE_PLTS
+	mod = rec->arch.mod;
+#endif
 
 	old = ftrace_nop_replace(rec);
 
-	new = ftrace_call_replace(ip, adjust_address(rec, addr));
+	new = ftrace_call_replace(ip, aaddr, !mod);
+#ifdef CONFIG_ARM_MODULE_PLTS
+	if (!new && mod) {
+		aaddr = get_module_plt(mod, ip, aaddr);
+		new = ftrace_call_replace(ip, aaddr, true);
+	}
+#endif
 
 	return ftrace_modify_code(rec->ip, old, new, true);
 }
@@ -140,9 +153,9 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
 	unsigned long new, old;
 	unsigned long ip = rec->ip;
 
-	old = ftrace_call_replace(ip, adjust_address(rec, old_addr));
+	old = ftrace_call_replace(ip, adjust_address(rec, old_addr), true);
 
-	new = ftrace_call_replace(ip, adjust_address(rec, addr));
+	new = ftrace_call_replace(ip, adjust_address(rec, addr), true);
 
 	return ftrace_modify_code(rec->ip, old, new, true);
 }
@@ -152,12 +165,29 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
 int ftrace_make_nop(struct module *mod,
 		    struct dyn_ftrace *rec, unsigned long addr)
 {
+	unsigned long aaddr = adjust_address(rec, addr);
 	unsigned long ip = rec->ip;
 	unsigned long old;
 	unsigned long new;
 	int ret;
 
-	old = ftrace_call_replace(ip, adjust_address(rec, addr));
+#ifdef CONFIG_ARM_MODULE_PLTS
+	/* mod is only supplied during module loading */
+	if (!mod)
+		mod = rec->arch.mod;
+	else
+		rec->arch.mod = mod;
+#endif
+
+	old = ftrace_call_replace(ip, aaddr,
+				  !IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || !mod);
+#ifdef CONFIG_ARM_MODULE_PLTS
+	if (!old && mod) {
+		aaddr = get_module_plt(mod, ip, aaddr);
+		old = ftrace_call_replace(ip, aaddr, true);
+	}
+#endif
+
 	new = ftrace_nop_replace(rec);
 	ret = ftrace_modify_code(ip, old, new, true);
 
diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c
index d330e9ec2de3..a0524ad84e4d 100644
--- a/arch/arm/kernel/module-plts.c
+++ b/arch/arm/kernel/module-plts.c
@@ -4,6 +4,7 @@
  */
 
 #include <linux/elf.h>
+#include <linux/ftrace.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/sort.h>
@@ -20,19 +21,52 @@
 						    (PLT_ENT_STRIDE - 8))
 #endif
 
+static const u32 fixed_plts[] = {
+#ifdef CONFIG_FUNCTION_TRACER
+	FTRACE_ADDR,
+	MCOUNT_ADDR,
+#endif
+};
+
 static bool in_init(const struct module *mod, unsigned long loc)
 {
 	return loc - (u32)mod->init_layout.base < mod->init_layout.size;
 }
 
+static void prealloc_fixed(struct mod_plt_sec *pltsec, struct plt_entries *plt)
+{
+	int i;
+
+	if (!ARRAY_SIZE(fixed_plts) || pltsec->plt_count)
+		return;
+	pltsec->plt_count = ARRAY_SIZE(fixed_plts);
+
+	for (i = 0; i < ARRAY_SIZE(plt->ldr); ++i)
+		plt->ldr[i] = PLT_ENT_LDR;
+
+	BUILD_BUG_ON(sizeof(fixed_plts) > sizeof(plt->lit));
+	memcpy(plt->lit, fixed_plts, sizeof(fixed_plts));
+}
+
 u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val)
 {
 	struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core :
 							  &mod->arch.init;
+	struct plt_entries *plt;
+	int idx;
 
-	struct plt_entries *plt = (struct plt_entries *)pltsec->plt->sh_addr;
-	int idx = 0;
+	/* cache the address, ELF header is available only during module load */
+	if (!pltsec->plt_ent)
+		pltsec->plt_ent = (struct plt_entries *)pltsec->plt->sh_addr;
+	plt = pltsec->plt_ent;
 
+	prealloc_fixed(pltsec, plt);
+
+	for (idx = 0; idx < ARRAY_SIZE(fixed_plts); ++idx)
+		if (plt->lit[idx] == val)
+			return (u32)&plt->ldr[idx];
+
+	idx = 0;
 	/*
 	 * Look for an existing entry pointing to 'val'. Given that the
 	 * relocations are sorted, this will be the last entry we allocated.
@@ -180,8 +214,8 @@ static unsigned int count_plts(const Elf32_Sym *syms, Elf32_Addr base,
 int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
 			      char *secstrings, struct module *mod)
 {
-	unsigned long core_plts = 0;
-	unsigned long init_plts = 0;
+	unsigned long core_plts = ARRAY_SIZE(fixed_plts);
+	unsigned long init_plts = ARRAY_SIZE(fixed_plts);
 	Elf32_Shdr *s, *sechdrs_end = sechdrs + ehdr->e_shnum;
 	Elf32_Sym *syms = NULL;
 
@@ -236,6 +270,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
 	mod->arch.core.plt->sh_size = round_up(core_plts * PLT_ENT_SIZE,
 					       sizeof(struct plt_entries));
 	mod->arch.core.plt_count = 0;
+	mod->arch.core.plt_ent = NULL;
 
 	mod->arch.init.plt->sh_type = SHT_NOBITS;
 	mod->arch.init.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
@@ -243,6 +278,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
 	mod->arch.init.plt->sh_size = round_up(init_plts * PLT_ENT_SIZE,
 					       sizeof(struct plt_entries));
 	mod->arch.init.plt_count = 0;
+	mod->arch.init.plt_ent = NULL;
 
 	pr_debug("%s: plt=%x, init.plt=%x\n", __func__,
 		 mod->arch.core.plt->sh_size, mod->arch.init.plt->sh_size);

From 5ce134e65f3b8034220c416ab8cecd8652fdeb2d Mon Sep 17 00:00:00 2001
From: Alex Sverdlin <alexander.sverdlin@nokia.com>
Date: Wed, 22 Sep 2021 09:59:58 -0700
Subject: [PATCH 0442/1750] ARM: 9098/1: ftrace: MODULE_PLT: Fix build problem
 without DYNAMIC_FTRACE

commit 6fa630bf473827aee48cbf0efbbdf6f03134e890 upstream

FTRACE_ADDR is only defined when CONFIG_DYNAMIC_FTRACE is defined, the
latter is even stronger requirement than CONFIG_FUNCTION_TRACER (which is
enough for MCOUNT_ADDR).

Link: https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org/thread/ZUVCQBHDMFVR7CCB7JPESLJEWERZDJ3T/

Fixes: 1f12fb25c5c5d22f ("ARM: 9079/1: ftrace: Add MODULE_PLTS support")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kernel/module-plts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c
index a0524ad84e4d..1fc309b41f94 100644
--- a/arch/arm/kernel/module-plts.c
+++ b/arch/arm/kernel/module-plts.c
@@ -22,7 +22,7 @@
 #endif
 
 static const u32 fixed_plts[] = {
-#ifdef CONFIG_FUNCTION_TRACER
+#ifdef CONFIG_DYNAMIC_FTRACE
 	FTRACE_ADDR,
 	MCOUNT_ADDR,
 #endif

From 473cea4983b582fedb10f84b43e8924716ebc4fc Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 23 Sep 2021 13:01:44 +0200
Subject: [PATCH 0443/1750] Revert "net/mlx5: Register to devlink ingress VLAN
 filter trap"

This reverts commit fe6322774ca28669868a7e231e173e09f7422118 which was
commit 82e6c96f04e13c72d91777455836ffd012853caa upstream.

It has been reported to cause regressions so should be dropped.

Reported-by: <Patrick.Mclean@sony.com>
Link: https://lore.kernel.org/r/BY5PR13MB3604D3031E984CA34A57B7C9EEA09@BY5PR13MB3604.namprd13.prod.outlook.com
Cc: Aya Levin <ayal@nvidia.com>
Cc: Tariq Toukan <tariqt@nvidia.com>
Cc: Tariq Toukan <tariqt@nvidia.com>
Cc: Saeed Mahameed <saeedm@nvidia.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/mellanox/mlx5/core/devlink.c | 51 -------------------
 1 file changed, 51 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index 4cba110f6ef8..0e699330ae77 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -376,48 +376,6 @@ static void mlx5_devlink_set_params_init_values(struct devlink *devlink)
 #endif
 }
 
-#define MLX5_TRAP_DROP(_id, _group_id)					\
-	DEVLINK_TRAP_GENERIC(DROP, DROP, _id,				\
-			     DEVLINK_TRAP_GROUP_GENERIC_ID_##_group_id, \
-			     DEVLINK_TRAP_METADATA_TYPE_F_IN_PORT)
-
-static const struct devlink_trap mlx5_traps_arr[] = {
-	MLX5_TRAP_DROP(INGRESS_VLAN_FILTER, L2_DROPS),
-};
-
-static const struct devlink_trap_group mlx5_trap_groups_arr[] = {
-	DEVLINK_TRAP_GROUP_GENERIC(L2_DROPS, 0),
-};
-
-static int mlx5_devlink_traps_register(struct devlink *devlink)
-{
-	struct mlx5_core_dev *core_dev = devlink_priv(devlink);
-	int err;
-
-	err = devlink_trap_groups_register(devlink, mlx5_trap_groups_arr,
-					   ARRAY_SIZE(mlx5_trap_groups_arr));
-	if (err)
-		return err;
-
-	err = devlink_traps_register(devlink, mlx5_traps_arr, ARRAY_SIZE(mlx5_traps_arr),
-				     &core_dev->priv);
-	if (err)
-		goto err_trap_group;
-	return 0;
-
-err_trap_group:
-	devlink_trap_groups_unregister(devlink, mlx5_trap_groups_arr,
-				       ARRAY_SIZE(mlx5_trap_groups_arr));
-	return err;
-}
-
-static void mlx5_devlink_traps_unregister(struct devlink *devlink)
-{
-	devlink_traps_unregister(devlink, mlx5_traps_arr, ARRAY_SIZE(mlx5_traps_arr));
-	devlink_trap_groups_unregister(devlink, mlx5_trap_groups_arr,
-				       ARRAY_SIZE(mlx5_trap_groups_arr));
-}
-
 int mlx5_devlink_register(struct devlink *devlink, struct device *dev)
 {
 	int err;
@@ -432,16 +390,8 @@ int mlx5_devlink_register(struct devlink *devlink, struct device *dev)
 		goto params_reg_err;
 	mlx5_devlink_set_params_init_values(devlink);
 	devlink_params_publish(devlink);
-
-	err = mlx5_devlink_traps_register(devlink);
-	if (err)
-		goto traps_reg_err;
-
 	return 0;
 
-traps_reg_err:
-	devlink_params_unregister(devlink, mlx5_devlink_params,
-				  ARRAY_SIZE(mlx5_devlink_params));
 params_reg_err:
 	devlink_unregister(devlink);
 	return err;
@@ -449,7 +399,6 @@ int mlx5_devlink_register(struct devlink *devlink, struct device *dev)
 
 void mlx5_devlink_unregister(struct devlink *devlink)
 {
-	mlx5_devlink_traps_unregister(devlink);
 	devlink_params_unpublish(devlink);
 	devlink_params_unregister(devlink, mlx5_devlink_params,
 				  ARRAY_SIZE(mlx5_devlink_params));

From ffca46766850d4b96a26ad511a7997f74da2df8c Mon Sep 17 00:00:00 2001
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date: Mon, 28 Jun 2021 16:13:43 -0300
Subject: [PATCH 0444/1750] sctp: validate chunk size in __rcv_asconf_lookup

commit b6ffe7671b24689c09faa5675dd58f93758a97ae upstream.

In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.

Similar check already exists in actual asconf handling in
sctp_verify_asconf().

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/input.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sctp/input.c b/net/sctp/input.c
index ddb5b5c2550e..49c49a4d203f 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -1168,6 +1168,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
 	union sctp_addr_param *param;
 	union sctp_addr paddr;
 
+	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
+		return NULL;
+
 	/* Skip over the ADDIP header and find the Address parameter */
 	param = (union sctp_addr_param *)(asconf + 1);
 

From ccb79116c37242c07c34c991868acded87509e4c Mon Sep 17 00:00:00 2001
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Date: Mon, 28 Jun 2021 16:13:44 -0300
Subject: [PATCH 0445/1750] sctp: add param size validation for
 SCTP_PARAM_SET_PRIMARY

commit ef6c8d6ccf0c1dccdda092ebe8782777cd7803c9 upstream.

When SCTP handles an INIT chunk, it calls for example:
sctp_sf_do_5_1B_init
  sctp_verify_init
    sctp_verify_param
  sctp_process_init
    sctp_process_param
      handling of SCTP_PARAM_SET_PRIMARY

sctp_verify_init() wasn't doing proper size validation and neither the
later handling, allowing it to work over the chunk itself, possibly being
uninitialized memory.

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/sm_make_chunk.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 7411fa442821..fa0d96320baa 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2150,9 +2150,16 @@ static enum sctp_ierror sctp_verify_param(struct net *net,
 		break;
 
 	case SCTP_PARAM_SET_PRIMARY:
-		if (ep->asconf_enable)
-			break;
-		goto unhandled;
+		if (!ep->asconf_enable)
+			goto unhandled;
+
+		if (ntohs(param.p->length) < sizeof(struct sctp_addip_param) +
+					     sizeof(struct sctp_paramhdr)) {
+			sctp_process_inv_paramlength(asoc, param.p,
+						     chunk, err_chunk);
+			retval = SCTP_IERROR_ABORT;
+		}
+		break;
 
 	case SCTP_PARAM_HOST_NAME_ADDRESS:
 		/* Tell the peer, we won't support this param.  */

From 6b24588708fe7cb680d433a0492abb651bb1d5b0 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Sat, 14 Aug 2021 16:56:26 -0700
Subject: [PATCH 0446/1750] staging: rtl8192u: Fix bitwise vs logical operator
 in TranslateRxSignalStuff819xUsb()

commit 099ec97ac92911abfb102bb5c68ed270fc12e0dd upstream.

clang warns:

drivers/staging/rtl8192u/r8192U_core.c:4268:20: warning: bitwise and of
boolean expressions; did you mean logical and? [-Wbool-operation-and]
        bpacket_toself =  bpacket_match_bssid &
                          ^~~~~~~~~~~~~~~~~~~~~
                                              &&
1 warning generated.

Replace the bitwise AND with a logical one to clear up the warning, as
that is clearly what was intended.

Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20210814235625.1780033-1-nathan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8192u/r8192U_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index 03d31e52b399..4523e825a61a 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -4271,7 +4271,7 @@ static void TranslateRxSignalStuff819xUsb(struct sk_buff *skb,
 	bpacket_match_bssid = (type != IEEE80211_FTYPE_CTL) &&
 			       (ether_addr_equal(priv->ieee80211->current_network.bssid,  (fc & IEEE80211_FCTL_TODS) ? hdr->addr1 : (fc & IEEE80211_FCTL_FROMDS) ? hdr->addr2 : hdr->addr3))
 			       && (!pstats->bHwError) && (!pstats->bCRC) && (!pstats->bICV);
-	bpacket_toself =  bpacket_match_bssid &
+	bpacket_toself =  bpacket_match_bssid &&
 			  (ether_addr_equal(praddr, priv->ieee80211->dev->dev_addr));
 
 	if (WLAN_FC_GET_FRAMETYPE(fc) == IEEE80211_STYPE_BEACON)

From 5d0e6a5e44416cdfd8b391fa46c69f7d08f9dd0d Mon Sep 17 00:00:00 2001
From: QiuXi <qiuxi1@huawei.com>
Date: Tue, 7 Sep 2021 20:00:32 -0700
Subject: [PATCH 0447/1750] coredump: fix memleak in dump_vma_snapshot()

commit 6fcac87e1f9e5b27805a2a404f4849194bb51de8 upstream.

dump_vma_snapshot() allocs memory for *vma_meta, when dump_vma_snapshot()
returns -EFAULT, the memory will be leaked, so we free it correctly.

Link: https://lkml.kernel.org/r/20210810020441.62806-1-qiuxi1@huawei.com
Fixes: a07279c9a8cd7 ("binfmt_elf, binfmt_elf_fdpic: use a VMA list snapshot")
Signed-off-by: QiuXi <qiuxi1@huawei.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Jann Horn <jannh@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/coredump.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/coredump.c b/fs/coredump.c
index c6acfc694f65..c56a3bdce7cd 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -1111,8 +1111,10 @@ int dump_vma_snapshot(struct coredump_params *cprm, int *vma_count,
 
 	mmap_write_unlock(mm);
 
-	if (WARN_ON(i != *vma_count))
+	if (WARN_ON(i != *vma_count)) {
+		kvfree(*vma_meta);
 		return -EFAULT;
+	}
 
 	*vma_data_size_ptr = vma_data_size;
 	return 0;

From 9d49973b08488f59dd0ada269d9dca210d1fd365 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 25 Jun 2021 10:34:37 +0200
Subject: [PATCH 0448/1750] um: virtio_uml: fix memory leak on init failures

commit 7ad28e0df7ee9dbcb793bb88dd81d4d22bb9a10e upstream.

If initialization fails, e.g. because the connection failed,
we leak the 'vu_dev'. Fix that. Reported by smatch.

Fixes: 5d38f324993f ("um: drivers: Add virtio vhost-user driver")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/um/drivers/virtio_uml.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c
index c17b8e5ec186..d11b3d41c378 100644
--- a/arch/um/drivers/virtio_uml.c
+++ b/arch/um/drivers/virtio_uml.c
@@ -1113,7 +1113,7 @@ static int virtio_uml_probe(struct platform_device *pdev)
 		rc = os_connect_socket(pdata->socket_path);
 	} while (rc == -EINTR);
 	if (rc < 0)
-		return rc;
+		goto error_free;
 	vu_dev->sock = rc;
 
 	spin_lock_init(&vu_dev->sock_lock);
@@ -1132,6 +1132,8 @@ static int virtio_uml_probe(struct platform_device *pdev)
 
 error_init:
 	os_close_file(vu_dev->sock);
+error_free:
+	kfree(vu_dev);
 	return rc;
 }
 

From fa64b08931ee27bec3513aed8f7936e99b8d1212 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Fri, 30 Jul 2021 23:27:15 +0300
Subject: [PATCH 0449/1750] dmaengine: acpi: Avoid comparison GSI with Linux
 vIRQ

commit 67db87dc8284070adb15b3c02c1c31d5cf51c5d6 upstream.

Currently the CRST parsing relies on the fact that on most of x86 devices
the IRQ mapping is 1:1 with Linux vIRQ. However, it may be not true for
some. Fix this by converting GSI to Linux vIRQ before checking it.

Fixes: ee8209fd026b ("dma: acpi-dma: parse CSRT to extract additional resources")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210730202715.24375-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/dma/acpi-dma.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c
index 235f1396f968..52768dc8ce12 100644
--- a/drivers/dma/acpi-dma.c
+++ b/drivers/dma/acpi-dma.c
@@ -70,10 +70,14 @@ static int acpi_dma_parse_resource_group(const struct acpi_csrt_group *grp,
 
 	si = (const struct acpi_csrt_shared_info *)&grp[1];
 
-	/* Match device by MMIO and IRQ */
+	/* Match device by MMIO */
 	if (si->mmio_base_low != lower_32_bits(mem) ||
-	    si->mmio_base_high != upper_32_bits(mem) ||
-	    si->gsi_interrupt != irq)
+	    si->mmio_base_high != upper_32_bits(mem))
+		return 0;
+
+	/* Match device by Linux vIRQ */
+	ret = acpi_register_gsi(NULL, si->gsi_interrupt, si->interrupt_mode, si->interrupt_polarity);
+	if (ret != irq)
 		return 0;
 
 	dev_dbg(&adev->dev, "matches with %.4s%04X (rev %u)\n",

From ebcd3fd9207c98f0c01c317ef3aca7f2df41b72d Mon Sep 17 00:00:00 2001
From: Michael Petlan <mpetlan@redhat.com>
Date: Thu, 5 Aug 2021 18:06:11 +0200
Subject: [PATCH 0450/1750] perf test: Fix bpf test sample mismatch reporting

commit 3e11300cdfd5f1bc13a05dfc6dccf69aca5dd1dc upstream.

When the expected sample count in the condition changed, the message
needs to be changed too, otherwise we'll get:

  0x1001f2091d8: mmap mask[0]:
  BPF filter result incorrect, expected 56, got 56 samples

Fixes: 4b04e0decd2518e5 ("perf test: Fix basic bpf filtering test")
Signed-off-by: Michael Petlan <mpetlan@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Sumanth Korikkar <sumanthk@linux.ibm.com>
Link: https //lore.kernel.org/r/20210805160611.5542-1-mpetlan@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/tests/bpf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/tests/bpf.c b/tools/perf/tests/bpf.c
index 8345ff4acedf..e5832b74a845 100644
--- a/tools/perf/tests/bpf.c
+++ b/tools/perf/tests/bpf.c
@@ -199,7 +199,7 @@ static int do_test(struct bpf_object *obj, int (*func)(void),
 	}
 
 	if (count != expect * evlist->core.nr_entries) {
-		pr_debug("BPF filter result incorrect, expected %d, got %d samples\n", expect, count);
+		pr_debug("BPF filter result incorrect, expected %d, got %d samples\n", expect * evlist->core.nr_entries, count);
 		goto out_delete_evlist;
 	}
 

From 87c4144450e6f09afeb2adc336f35b5f5274205c Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@kernel.org>
Date: Thu, 26 Nov 2020 18:00:06 +0100
Subject: [PATCH 0451/1750] tools lib: Adopt memchr_inv() from kernel

commit b3e453272d436aab8adbe810c6d7043670281487 upstream.

We'll use it to check for undefined/zero data.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Suggested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Stephane Eranian <eranian@google.com>
Link: http://lore.kernel.org/lkml/20201126170026.2619053-6-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/include/linux/string.h |  1 +
 tools/lib/string.c           | 58 ++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+)

diff --git a/tools/include/linux/string.h b/tools/include/linux/string.h
index 5e9e781905ed..db5c99318c79 100644
--- a/tools/include/linux/string.h
+++ b/tools/include/linux/string.h
@@ -46,4 +46,5 @@ extern char * __must_check skip_spaces(const char *);
 
 extern char *strim(char *);
 
+extern void *memchr_inv(const void *start, int c, size_t bytes);
 #endif /* _TOOLS_LINUX_STRING_H_ */
diff --git a/tools/lib/string.c b/tools/lib/string.c
index f645343815de..8b6892f959ab 100644
--- a/tools/lib/string.c
+++ b/tools/lib/string.c
@@ -168,3 +168,61 @@ char *strreplace(char *s, char old, char new)
 			*s = new;
 	return s;
 }
+
+static void *check_bytes8(const u8 *start, u8 value, unsigned int bytes)
+{
+	while (bytes) {
+		if (*start != value)
+			return (void *)start;
+		start++;
+		bytes--;
+	}
+	return NULL;
+}
+
+/**
+ * memchr_inv - Find an unmatching character in an area of memory.
+ * @start: The memory area
+ * @c: Find a character other than c
+ * @bytes: The size of the area.
+ *
+ * returns the address of the first character other than @c, or %NULL
+ * if the whole buffer contains just @c.
+ */
+void *memchr_inv(const void *start, int c, size_t bytes)
+{
+	u8 value = c;
+	u64 value64;
+	unsigned int words, prefix;
+
+	if (bytes <= 16)
+		return check_bytes8(start, value, bytes);
+
+	value64 = value;
+	value64 |= value64 << 8;
+	value64 |= value64 << 16;
+	value64 |= value64 << 32;
+
+	prefix = (unsigned long)start % 8;
+	if (prefix) {
+		u8 *r;
+
+		prefix = 8 - prefix;
+		r = check_bytes8(start, value, prefix);
+		if (r)
+			return r;
+		start += prefix;
+		bytes -= prefix;
+	}
+
+	words = bytes / 8;
+
+	while (words) {
+		if (*(u64 *)start != value64)
+			return check_bytes8(start, value, 8);
+		start += 8;
+		words--;
+	}
+
+	return check_bytes8(start, value, bytes % 8);
+}

From 38ab04186fb3f3b50f33e5cfde38066c5227e89d Mon Sep 17 00:00:00 2001
From: Namhyung Kim <namhyung@kernel.org>
Date: Fri, 10 Sep 2021 15:46:30 -0700
Subject: [PATCH 0452/1750] perf tools: Allow build-id with trailing zeros

commit 4a86d41404005a3c7e7b6065e8169ac6202887a9 upstream.

Currently perf saves a build-id with size but old versions assumes the
size of 20.  In case the build-id is less than 20 (like for MD5), it'd
fill the rest with 0s.

I saw a problem when old version of perf record saved a binary in the
build-id cache and new version of perf reads the data.  The symbols
should be read from the build-id cache (as the path no longer has the
same binary) but it failed due to mismatch in the build-id.

  symsrc__init: build id mismatch for /home/namhyung/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf.

The build-id event in the data has 20 byte build-ids, but it saw a
different size (16) when it reads the build-id of the elf file in the
build-id cache.

  $ readelf -n ~/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf

  Displaying notes found in: .note.gnu.build-id
    Owner                Data size 	Description
    GNU                  0x00000010	NT_GNU_BUILD_ID (unique build ID bitstring)
      Build ID: 53e4c2f42a4c61a2d632d92a72afa08f

Let's fix this by allowing trailing zeros if the size is different.

Fixes: 39be8d0115b321ed ("perf tools: Pass build_id object to dso__build_id_equal()")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20210910224630.1084877-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/util/dso.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index b1ff0c9f32da..5e9902fa1dc8 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -1336,6 +1336,16 @@ void dso__set_build_id(struct dso *dso, struct build_id *bid)
 
 bool dso__build_id_equal(const struct dso *dso, struct build_id *bid)
 {
+	if (dso->bid.size > bid->size && dso->bid.size == BUILD_ID_SIZE) {
+		/*
+		 * For the backward compatibility, it allows a build-id has
+		 * trailing zeros.
+		 */
+		return !memcmp(dso->bid.data, bid->data, bid->size) &&
+			!memchr_inv(&dso->bid.data[bid->size], 0,
+				    dso->bid.size - bid->size);
+	}
+
 	return dso->bid.size == bid->size &&
 	       memcmp(dso->bid.data, bid->data, dso->bid.size) == 0;
 }

From 375e779ec32a87edeb6bb26582c1c9a1f59876f9 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 10 Aug 2021 11:44:13 +0300
Subject: [PATCH 0453/1750] thermal/drivers/exynos: Fix an error code in
 exynos_tmu_probe()

commit 02d438f62c05f0d055ceeedf12a2f8796b258c08 upstream.

This error path return success but it should propagate the negative
error code from devm_clk_get().

Fixes: 6c247393cfdd ("thermal: exynos: Add TMU support for Exynos7 SoC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210810084413.GA23810@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/thermal/samsung/exynos_tmu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index e9a90bc23b11..f4ab4c5b4b62 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -1073,6 +1073,7 @@ static int exynos_tmu_probe(struct platform_device *pdev)
 		data->sclk = devm_clk_get(&pdev->dev, "tmu_sclk");
 		if (IS_ERR(data->sclk)) {
 			dev_err(&pdev->dev, "Failed to get sclk\n");
+			ret = PTR_ERR(data->sclk);
 			goto err_clk;
 		} else {
 			ret = clk_prepare_enable(data->sclk);

From e464b3876b022c0c4e0eb21518c491c6eb38130c Mon Sep 17 00:00:00 2001
From: Xie Yongji <xieyongji@bytedance.com>
Date: Mon, 17 May 2021 16:35:57 +0800
Subject: [PATCH 0454/1750] 9p/trans_virtio: Remove sysfs file on probe failure

commit f997ea3b7afc108eb9761f321b57de2d089c7c48 upstream.

This ensures we don't leak the sysfs file if we failed to
allocate chan->vc_wq during probe.

Link: http://lkml.kernel.org/r/20210517083557.172-1-xieyongji@bytedance.com
Fixes: 86c8437383ac ("net/9p: Add sysfs mount_tag file for virtio 9P device")
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/9p/trans_virtio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index a3cd90a74012..f582351d84ec 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -605,7 +605,7 @@ static int p9_virtio_probe(struct virtio_device *vdev)
 	chan->vc_wq = kmalloc(sizeof(wait_queue_head_t), GFP_KERNEL);
 	if (!chan->vc_wq) {
 		err = -ENOMEM;
-		goto out_free_tag;
+		goto out_remove_file;
 	}
 	init_waitqueue_head(chan->vc_wq);
 	chan->ring_bufs_avail = 1;
@@ -623,6 +623,8 @@ static int p9_virtio_probe(struct virtio_device *vdev)
 
 	return 0;
 
+out_remove_file:
+	sysfs_remove_file(&vdev->dev.kobj, &dev_attr_mount_tag.attr);
 out_free_tag:
 	kfree(tag);
 out_free_vq:

From 30417cbeccffeaaf5d7fa5a9e9feffe246a1430f Mon Sep 17 00:00:00 2001
From: Cyrill Gorcunov <gorcunov@gmail.com>
Date: Tue, 7 Sep 2021 20:00:41 -0700
Subject: [PATCH 0455/1750] prctl: allow to setup brk for et_dyn executables

commit e1fbbd073137a9d63279f6bf363151a938347640 upstream.

Keno Fischer reported that when a binray loaded via ld-linux-x the
prctl(PR_SET_MM_MAP) doesn't allow to setup brk value because it lays
before mm:end_data.

For example a test program shows

 | # ~/t
 |
 | start_code      401000
 | end_code        401a15
 | start_stack     7ffce4577dd0
 | start_data	   403e10
 | end_data        40408c
 | start_brk	   b5b000
 | sbrk(0)         b5b000

and when executed via ld-linux

 | # /lib64/ld-linux-x86-64.so.2 ~/t
 |
 | start_code      7fc25b0a4000
 | end_code        7fc25b0c4524
 | start_stack     7fffcc6b2400
 | start_data	   7fc25b0ce4c0
 | end_data        7fc25b0cff98
 | start_brk	   55555710c000
 | sbrk(0)         55555710c000

This of course prevent criu from restoring such programs.  Looking into
how kernel operates with brk/start_brk inside brk() syscall I don't see
any problem if we allow to setup brk/start_brk without checking for
end_data.  Even if someone pass some weird address here on a purpose then
the worst possible result will be an unexpected unmapping of existing vma
(own vma, since prctl works with the callers memory) but test for
RLIMIT_DATA is still valid and a user won't be able to gain more memory in
case of expanding VMAs via new values shipped with prctl call.

Link: https://lkml.kernel.org/r/20210121221207.GB2174@grain
Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec")
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Reported-by: Keno Fischer <keno@juliacomputing.com>
Acked-by: Andrey Vagin <avagin@gmail.com>
Tested-by: Andrey Vagin <avagin@gmail.com>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/sys.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/kernel/sys.c b/kernel/sys.c
index a730c03ee607..24a3a28ae228 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1941,13 +1941,6 @@ static int validate_prctl_map_addr(struct prctl_mm_map *prctl_map)
 
 	error = -EINVAL;
 
-	/*
-	 * @brk should be after @end_data in traditional maps.
-	 */
-	if (prctl_map->start_brk <= prctl_map->end_data ||
-	    prctl_map->brk <= prctl_map->end_data)
-		goto out;
-
 	/*
 	 * Neither we should allow to override limits if they set.
 	 */

From 0796d99c1b16f03fd34024a26da2e81ec1c728c1 Mon Sep 17 00:00:00 2001
From: Zhen Lei <thunder.leizhen@huawei.com>
Date: Tue, 7 Sep 2021 20:00:26 -0700
Subject: [PATCH 0456/1750] nilfs2: use refcount_dec_and_lock() to fix
 potential UAF

commit 98e2e409e76ef7781d8511f997359e9c504a95c1 upstream.

When the refcount is decreased to 0, the resource reclamation branch is
entered.  Before CPU0 reaches the race point (1), CPU1 may obtain the
spinlock and traverse the rbtree to find 'root', see
nilfs_lookup_root().

Although CPU1 will call refcount_inc() to increase the refcount, it is
obviously too late.  CPU0 will release 'root' directly, CPU1 then
accesses 'root' and triggers UAF.

Use refcount_dec_and_lock() to ensure that both the operations of
decrease refcount to 0 and link deletion are lock protected eliminates
this risk.

	     CPU0                      CPU1
	nilfs_put_root():
		    <-------- (1)
				spin_lock(&nilfs->ns_cptree_lock);
				rb_erase(&root->rb_node, &nilfs->ns_cptree);
				spin_unlock(&nilfs->ns_cptree_lock);

	kfree(root);
		    <-------- use-after-free

  refcount_t: underflow; use-after-free.
  WARNING: CPU: 2 PID: 9476 at lib/refcount.c:28 \
  refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28
  Modules linked in:
  CPU: 2 PID: 9476 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ...
  RIP: 0010:refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28
  ... ...
  Call Trace:
     __refcount_sub_and_test include/linux/refcount.h:283 [inline]
     __refcount_dec_and_test include/linux/refcount.h:315 [inline]
     refcount_dec_and_test include/linux/refcount.h:333 [inline]
     nilfs_put_root+0xc1/0xd0 fs/nilfs2/the_nilfs.c:795
     nilfs_segctor_destroy fs/nilfs2/segment.c:2749 [inline]
     nilfs_detach_log_writer+0x3fa/0x570 fs/nilfs2/segment.c:2812
     nilfs_put_super+0x2f/0xf0 fs/nilfs2/super.c:467
     generic_shutdown_super+0xcd/0x1f0 fs/super.c:464
     kill_block_super+0x4a/0x90 fs/super.c:1446
     deactivate_locked_super+0x6a/0xb0 fs/super.c:335
     deactivate_super+0x85/0x90 fs/super.c:366
     cleanup_mnt+0x277/0x2e0 fs/namespace.c:1118
     __cleanup_mnt+0x15/0x20 fs/namespace.c:1125
     task_work_run+0x8e/0x110 kernel/task_work.c:151
     tracehook_notify_resume include/linux/tracehook.h:188 [inline]
     exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
     exit_to_user_mode_prepare+0x13c/0x170 kernel/entry/common.c:191
     syscall_exit_to_user_mode+0x16/0x30 kernel/entry/common.c:266
     do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56
     entry_SYSCALL_64_after_hwframe+0x44/0xa9

There is no reproduction program, and the above is only theoretical
analysis.

Link: https://lkml.kernel.org/r/1629859428-5906-1-git-send-email-konishi.ryusuke@gmail.com
Fixes: ba65ae4729bf ("nilfs2: add checkpoint tree to nilfs object")
Link: https://lkml.kernel.org/r/20210723012317.4146-1-thunder.leizhen@huawei.com
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nilfs2/the_nilfs.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 221a1cc597f0..c20ebecd7bc2 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -792,14 +792,13 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno)
 
 void nilfs_put_root(struct nilfs_root *root)
 {
-	if (refcount_dec_and_test(&root->count)) {
-		struct the_nilfs *nilfs = root->nilfs;
+	struct the_nilfs *nilfs = root->nilfs;
 
-		nilfs_sysfs_delete_snapshot_group(root);
-
-		spin_lock(&nilfs->ns_cptree_lock);
+	if (refcount_dec_and_lock(&root->count, &nilfs->ns_cptree_lock)) {
 		rb_erase(&root->rb_node, &nilfs->ns_cptree);
 		spin_unlock(&nilfs->ns_cptree_lock);
+
+		nilfs_sysfs_delete_snapshot_group(root);
 		iput(root->ifile);
 
 		kfree(root);

From 74190973ab01fb88e8b685f417651e30112ed4a1 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Tue, 7 Sep 2021 19:58:21 -0700
Subject: [PATCH 0457/1750] profiling: fix shift-out-of-bounds bugs

commit 2d186afd04d669fe9c48b994c41a7405a3c9f16d upstream.

Syzbot reported shift-out-of-bounds bug in profile_init().
The problem was in incorrect prof_shift. Since prof_shift value comes from
userspace we need to clamp this value into [0, BITS_PER_LONG -1]
boundaries.

Second possible shiht-out-of-bounds was found by Tetsuo:
sample_step local variable in read_profile() had "unsigned int" type,
but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent
possible shiht-out-of-bounds sample_step type was changed to
"unsigned long".

Also, "unsigned short int" will be sufficient for storing
[0, BITS_PER_LONG] value, that's why there is no need for
"unsigned long" prof_shift.

Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com
Suggested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/profile.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/kernel/profile.c b/kernel/profile.c
index 6f69a4195d56..b47fe52f0ade 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -41,7 +41,8 @@ struct profile_hit {
 #define NR_PROFILE_GRP		(NR_PROFILE_HIT/PROFILE_GRPSZ)
 
 static atomic_t *prof_buffer;
-static unsigned long prof_len, prof_shift;
+static unsigned long prof_len;
+static unsigned short int prof_shift;
 
 int prof_on __read_mostly;
 EXPORT_SYMBOL_GPL(prof_on);
@@ -67,8 +68,8 @@ int profile_setup(char *str)
 		if (str[strlen(sleepstr)] == ',')
 			str += strlen(sleepstr) + 1;
 		if (get_option(&str, &par))
-			prof_shift = par;
-		pr_info("kernel sleep profiling enabled (shift: %ld)\n",
+			prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+		pr_info("kernel sleep profiling enabled (shift: %u)\n",
 			prof_shift);
 #else
 		pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n");
@@ -78,21 +79,21 @@ int profile_setup(char *str)
 		if (str[strlen(schedstr)] == ',')
 			str += strlen(schedstr) + 1;
 		if (get_option(&str, &par))
-			prof_shift = par;
-		pr_info("kernel schedule profiling enabled (shift: %ld)\n",
+			prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+		pr_info("kernel schedule profiling enabled (shift: %u)\n",
 			prof_shift);
 	} else if (!strncmp(str, kvmstr, strlen(kvmstr))) {
 		prof_on = KVM_PROFILING;
 		if (str[strlen(kvmstr)] == ',')
 			str += strlen(kvmstr) + 1;
 		if (get_option(&str, &par))
-			prof_shift = par;
-		pr_info("kernel KVM profiling enabled (shift: %ld)\n",
+			prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
+		pr_info("kernel KVM profiling enabled (shift: %u)\n",
 			prof_shift);
 	} else if (get_option(&str, &par)) {
-		prof_shift = par;
+		prof_shift = clamp(par, 0, BITS_PER_LONG - 1);
 		prof_on = CPU_PROFILING;
-		pr_info("kernel profiling enabled (shift: %ld)\n",
+		pr_info("kernel profiling enabled (shift: %u)\n",
 			prof_shift);
 	}
 	return 1;
@@ -468,7 +469,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 	unsigned long p = *ppos;
 	ssize_t read;
 	char *pnt;
-	unsigned int sample_step = 1 << prof_shift;
+	unsigned long sample_step = 1UL << prof_shift;
 
 	profile_flip_buffers();
 	if (p >= (prof_len+1)*sizeof(unsigned int))

From c63df77c40ca40979ed8bb02b4a07500eef6cd28 Mon Sep 17 00:00:00 2001
From: Prasad Sodagudi <psodagud@codeaurora.org>
Date: Tue, 7 Sep 2021 04:24:23 -0700
Subject: [PATCH 0458/1750] PM: sleep: core: Avoid setting power.must_resume to
 false

commit 4a9344cd0aa4499beb3772bbecb40bb78888c0e1 upstream.

There are variables(power.may_skip_resume and dev->power.must_resume)
and DPM_FLAG_MAY_SKIP_RESUME flags to control the resume of devices after
a system wide suspend transition.

Setting the DPM_FLAG_MAY_SKIP_RESUME flag means that the driver allows
its "noirq" and "early" resume callbacks to be skipped if the device
can be left in suspend after a system-wide transition into the working
state. PM core determines that the driver's "noirq" and "early" resume
callbacks should be skipped or not with dev_pm_skip_resume() function by
checking power.may_skip_resume variable.

power.must_resume variable is getting set to false in __device_suspend()
function without checking device's DPM_FLAG_MAY_SKIP_RESUME settings.
In problematic scenario, where all the devices in the suspend_late
stage are successful and some device can fail to suspend in
suspend_noirq phase. So some devices successfully suspended in suspend_late
stage are not getting chance to execute __device_suspend_noirq()
to set dev->power.must_resume variable to true and not getting
resumed in early_resume phase.

Add a check for device's DPM_FLAG_MAY_SKIP_RESUME flag before
setting power.must_resume variable in __device_suspend function.

Fixes: 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the resume phase")
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/power/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index c7ac49042cee..192b1c7286b3 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1644,7 +1644,7 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async)
 	}
 
 	dev->power.may_skip_resume = true;
-	dev->power.must_resume = false;
+	dev->power.must_resume = !dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME);
 
 	dpm_watchdog_set(&wd, dev);
 	device_lock(dev);

From 322b70b522abe03cd59712bb47a72eddd835d19d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Wed, 7 Jul 2021 18:27:49 +0200
Subject: [PATCH 0459/1750] pwm: lpc32xx: Don't modify HW state in .probe()
 after the PWM chip was registered
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e upstream.

This fixes a race condition: After pwmchip_add() is called there might
already be a consumer and then modifying the hardware behind the
consumer's back is bad. So set the default before.

(Side-note: I don't know what this register setting actually does, if
this modifies the polarity there is an inconsistency because the
inversed polarity isn't considered if the PWM is already running during
.probe().)

Fixes: acfd92fdfb93 ("pwm: lpc32xx: Set PWM_PIN_LEVEL bit to default value")
Cc: Sylvain Lemieux <slemieux@tycoint.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pwm/pwm-lpc32xx.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/pwm/pwm-lpc32xx.c b/drivers/pwm/pwm-lpc32xx.c
index 710d9a207d2b..522f862eca52 100644
--- a/drivers/pwm/pwm-lpc32xx.c
+++ b/drivers/pwm/pwm-lpc32xx.c
@@ -120,17 +120,17 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev)
 	lpc32xx->chip.npwm = 1;
 	lpc32xx->chip.base = -1;
 
+	/* If PWM is disabled, configure the output to the default value */
+	val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+	val &= ~PWM_PIN_LEVEL;
+	writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+
 	ret = pwmchip_add(&lpc32xx->chip);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "failed to add PWM chip, error %d\n", ret);
 		return ret;
 	}
 
-	/* When PWM is disable, configure the output to the default value */
-	val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
-	val &= ~PWM_PIN_LEVEL;
-	writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
-
 	platform_set_drvdata(pdev, lpc32xx);
 
 	return 0;

From 777344da345a374eb74f2a743b5399e6e60d566b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Wed, 7 Jul 2021 18:27:50 +0200
Subject: [PATCH 0460/1750] pwm: mxs: Don't modify HW state in .probe() after
 the PWM chip was registered
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 020162d6f49f2963062229814a56a89c86cbeaa8 upstream.

This fixes a race condition: After pwmchip_add() is called there might
already be a consumer and then modifying the hardware behind the
consumer's back is bad. So reset before calling pwmchip_add().

Note that reseting the hardware isn't the right thing to do if the PWM
is already running as it might e.g. disable (or even enable) a backlight
that is supposed to be on (or off).

Fixes: 4dce82c1e840 ("pwm: add pwm-mxs support")
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Cc: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pwm/pwm-mxs.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/drivers/pwm/pwm-mxs.c b/drivers/pwm/pwm-mxs.c
index 7ce616923c52..41bdbe71ae46 100644
--- a/drivers/pwm/pwm-mxs.c
+++ b/drivers/pwm/pwm-mxs.c
@@ -148,6 +148,11 @@ static int mxs_pwm_probe(struct platform_device *pdev)
 		return ret;
 	}
 
+	/* FIXME: Only do this if the PWM isn't already running */
+	ret = stmp_reset_block(mxs->base);
+	if (ret)
+		return dev_err_probe(&pdev->dev, ret, "failed to reset PWM\n");
+
 	ret = pwmchip_add(&mxs->chip);
 	if (ret < 0) {
 		dev_err(&pdev->dev, "failed to add pwm chip %d\n", ret);
@@ -156,15 +161,7 @@ static int mxs_pwm_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, mxs);
 
-	ret = stmp_reset_block(mxs->base);
-	if (ret)
-		goto pwm_remove;
-
 	return 0;
-
-pwm_remove:
-	pwmchip_remove(&mxs->chip);
-	return ret;
 }
 
 static int mxs_pwm_remove(struct platform_device *pdev)

From 48271d10bf4cbdd4693ad4f94fb14c2aa7fcc4c5 Mon Sep 17 00:00:00 2001
From: Dave Jiang <dave.jiang@intel.com>
Date: Thu, 22 Jul 2021 10:54:10 -0700
Subject: [PATCH 0461/1750] dmaengine: idxd: fix wq slot allocation index check

[ Upstream commit 673d812d30be67942762bb9e8548abb26a3ba4a7 ]

The sbitmap wait and allocate routine checks the index that is returned
from sbitmap_queue_get(). It should be idxd >= 0 as 0 is also a valid
index. This fixes issue where submission path hangs when WQ size is 1.

Fixes: 0705107fcc80 ("dmaengine: idxd: move submission to sbitmap_queue")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/162697645067.3478714.506720687816951762.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/idxd/submit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/idxd/submit.c b/drivers/dma/idxd/submit.c
index 417048e3c42a..0368c5490788 100644
--- a/drivers/dma/idxd/submit.c
+++ b/drivers/dma/idxd/submit.c
@@ -45,7 +45,7 @@ struct idxd_desc *idxd_alloc_desc(struct idxd_wq *wq, enum idxd_op_type optype)
 		if (signal_pending_state(TASK_INTERRUPTIBLE, current))
 			break;
 		idx = sbitmap_queue_get(sbq, &cpu);
-		if (idx > 0)
+		if (idx >= 0)
 			break;
 		schedule();
 	}

From 113a69460de5e82ae3be12b01ec1daee81fd9929 Mon Sep 17 00:00:00 2001
From: Gwendal Grignou <gwendal@chromium.org>
Date: Thu, 13 May 2021 17:57:33 -0700
Subject: [PATCH 0462/1750] platform/chrome: sensorhub: Add trace events for
 sample

[ Upstream commit d453ceb6549af8798913de6a20444cb7200fdb69 ]

Add trace event to report samples and their timestamp coming from the
EC. It allows to check if the timestamps are correct and the filter is
working correctly without introducing too much latency.

To enable these events:

cd /sys/kernel/debug/tracing/
echo 1 > events/cros_ec/enable
echo 0 > events/cros_ec/cros_ec_request_start/enable
echo 0 > events/cros_ec/cros_ec_request_done/enable
echo 1 > tracing_on
cat trace_pipe
Observe event flowing:
irq/105-chromeo-95      [000] ....   613.659758: cros_ec_sensorhub_timestamp: ...
irq/105-chromeo-95      [000] ....   613.665219: cros_ec_sensorhub_filter: dx: ...

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/chrome/Makefile              |  2 +-
 .../platform/chrome/cros_ec_sensorhub_ring.c  | 14 +++
 drivers/platform/chrome/cros_ec_trace.h       | 94 +++++++++++++++++++
 3 files changed, 109 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/Makefile b/drivers/platform/chrome/Makefile
index 41baccba033f..f901d2e43166 100644
--- a/drivers/platform/chrome/Makefile
+++ b/drivers/platform/chrome/Makefile
@@ -20,7 +20,7 @@ obj-$(CONFIG_CROS_EC_CHARDEV)		+= cros_ec_chardev.o
 obj-$(CONFIG_CROS_EC_LIGHTBAR)		+= cros_ec_lightbar.o
 obj-$(CONFIG_CROS_EC_VBC)		+= cros_ec_vbc.o
 obj-$(CONFIG_CROS_EC_DEBUGFS)		+= cros_ec_debugfs.o
-cros-ec-sensorhub-objs			:= cros_ec_sensorhub.o cros_ec_sensorhub_ring.o
+cros-ec-sensorhub-objs			:= cros_ec_sensorhub.o cros_ec_sensorhub_ring.o cros_ec_trace.o
 obj-$(CONFIG_CROS_EC_SENSORHUB)		+= cros-ec-sensorhub.o
 obj-$(CONFIG_CROS_EC_SYSFS)		+= cros_ec_sysfs.o
 obj-$(CONFIG_CROS_USBPD_LOGGER)		+= cros_usbpd_logger.o
diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
index 8921f24e83ba..98e37080f760 100644
--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
@@ -17,6 +17,8 @@
 #include <linux/sort.h>
 #include <linux/slab.h>
 
+#include "cros_ec_trace.h"
+
 /* Precision of fixed point for the m values from the filter */
 #define M_PRECISION BIT(23)
 
@@ -291,6 +293,7 @@ cros_ec_sensor_ring_ts_filter_update(struct cros_ec_sensors_ts_filter_state
 		state->median_m = 0;
 		state->median_error = 0;
 	}
+	trace_cros_ec_sensorhub_filter(state, dx, dy);
 }
 
 /**
@@ -427,6 +430,11 @@ cros_ec_sensor_ring_process_event(struct cros_ec_sensorhub *sensorhub,
 			if (new_timestamp - *current_timestamp > 0)
 				*current_timestamp = new_timestamp;
 		}
+		trace_cros_ec_sensorhub_timestamp(in->timestamp,
+						  fifo_info->timestamp,
+						  fifo_timestamp,
+						  *current_timestamp,
+						  now);
 	}
 
 	if (in->flags & MOTIONSENSE_SENSOR_FLAG_ODR) {
@@ -460,6 +468,12 @@ cros_ec_sensor_ring_process_event(struct cros_ec_sensorhub *sensorhub,
 
 	/* Regular sample */
 	out->sensor_id = in->sensor_num;
+	trace_cros_ec_sensorhub_data(in->sensor_num,
+				     fifo_info->timestamp,
+				     fifo_timestamp,
+				     *current_timestamp,
+				     now);
+
 	if (*current_timestamp - now > 0) {
 		/*
 		 * This fix is needed to overcome the timestamp filter putting
diff --git a/drivers/platform/chrome/cros_ec_trace.h b/drivers/platform/chrome/cros_ec_trace.h
index f744b21bc655..f50b9f9b8610 100644
--- a/drivers/platform/chrome/cros_ec_trace.h
+++ b/drivers/platform/chrome/cros_ec_trace.h
@@ -15,6 +15,7 @@
 #include <linux/types.h>
 #include <linux/platform_data/cros_ec_commands.h>
 #include <linux/platform_data/cros_ec_proto.h>
+#include <linux/platform_data/cros_ec_sensorhub.h>
 
 #include <linux/tracepoint.h>
 
@@ -70,6 +71,99 @@ TRACE_EVENT(cros_ec_request_done,
 		  __entry->retval)
 );
 
+TRACE_EVENT(cros_ec_sensorhub_timestamp,
+	    TP_PROTO(u32 ec_sample_timestamp, u32 ec_fifo_timestamp, s64 fifo_timestamp,
+		     s64 current_timestamp, s64 current_time),
+	TP_ARGS(ec_sample_timestamp, ec_fifo_timestamp, fifo_timestamp, current_timestamp,
+		current_time),
+	TP_STRUCT__entry(
+		__field(u32, ec_sample_timestamp)
+		__field(u32, ec_fifo_timestamp)
+		__field(s64, fifo_timestamp)
+		__field(s64, current_timestamp)
+		__field(s64, current_time)
+		__field(s64, delta)
+	),
+	TP_fast_assign(
+		__entry->ec_sample_timestamp = ec_sample_timestamp;
+		__entry->ec_fifo_timestamp = ec_fifo_timestamp;
+		__entry->fifo_timestamp = fifo_timestamp;
+		__entry->current_timestamp = current_timestamp;
+		__entry->current_time = current_time;
+		__entry->delta = current_timestamp - current_time;
+	),
+	TP_printk("ec_ts: %12lld, ec_fifo_ts: %12lld, fifo_ts: %12lld, curr_ts: %12lld, curr_time: %12lld, delta %12lld",
+		  __entry->ec_sample_timestamp,
+		__entry->ec_fifo_timestamp,
+		__entry->fifo_timestamp,
+		__entry->current_timestamp,
+		__entry->current_time,
+		__entry->delta
+	)
+);
+
+TRACE_EVENT(cros_ec_sensorhub_data,
+	    TP_PROTO(u32 ec_sensor_num, u32 ec_fifo_timestamp, s64 fifo_timestamp,
+		     s64 current_timestamp, s64 current_time),
+	TP_ARGS(ec_sensor_num, ec_fifo_timestamp, fifo_timestamp, current_timestamp, current_time),
+	TP_STRUCT__entry(
+		__field(u32, ec_sensor_num)
+		__field(u32, ec_fifo_timestamp)
+		__field(s64, fifo_timestamp)
+		__field(s64, current_timestamp)
+		__field(s64, current_time)
+		__field(s64, delta)
+	),
+	TP_fast_assign(
+		__entry->ec_sensor_num = ec_sensor_num;
+		__entry->ec_fifo_timestamp = ec_fifo_timestamp;
+		__entry->fifo_timestamp = fifo_timestamp;
+		__entry->current_timestamp = current_timestamp;
+		__entry->current_time = current_time;
+		__entry->delta = current_timestamp - current_time;
+	),
+	TP_printk("ec_num: %4d, ec_fifo_ts: %12lld, fifo_ts: %12lld, curr_ts: %12lld, curr_time: %12lld, delta %12lld",
+		  __entry->ec_sensor_num,
+		__entry->ec_fifo_timestamp,
+		__entry->fifo_timestamp,
+		__entry->current_timestamp,
+		__entry->current_time,
+		__entry->delta
+	)
+);
+
+TRACE_EVENT(cros_ec_sensorhub_filter,
+	    TP_PROTO(struct cros_ec_sensors_ts_filter_state *state, s64 dx, s64 dy),
+	TP_ARGS(state, dx, dy),
+	TP_STRUCT__entry(
+		__field(s64, dx)
+		__field(s64, dy)
+		__field(s64, median_m)
+		__field(s64, median_error)
+		__field(s64, history_len)
+		__field(s64, x)
+		__field(s64, y)
+	),
+	TP_fast_assign(
+		__entry->dx = dx;
+		__entry->dy = dy;
+		__entry->median_m = state->median_m;
+		__entry->median_error = state->median_error;
+		__entry->history_len = state->history_len;
+		__entry->x = state->x_offset;
+		__entry->y = state->y_offset;
+	),
+	TP_printk("dx: %12lld. dy: %12lld median_m: %12lld median_error: %12lld len: %d x: %12lld y: %12lld",
+		  __entry->dx,
+		__entry->dy,
+		__entry->median_m,
+		__entry->median_error,
+		__entry->history_len,
+		__entry->x,
+		__entry->y
+	)
+);
+
 
 #endif /* _CROS_EC_TRACE_H_ */
 

From 41aa215734868ba7cb195e2cc5f00cdba5bd1578 Mon Sep 17 00:00:00 2001
From: Gwendal Grignou <gwendal@chromium.org>
Date: Mon, 30 Aug 2021 11:00:50 -0700
Subject: [PATCH 0463/1750] platform/chrome: cros_ec_trace: Fix format warnings

[ Upstream commit 4665584888ad2175831c972c004115741ec799e9 ]

Fix printf format issues in new tracing events.

Fixes: 814318242687 ("platform/chrome: cros_ec_trace: Add fields to command traces")

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Link: https://lore.kernel.org/r/20210830180050.2077261-1-gwendal@chromium.org
Signed-off-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/chrome/cros_ec_trace.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_trace.h b/drivers/platform/chrome/cros_ec_trace.h
index f50b9f9b8610..7e7cfc98657a 100644
--- a/drivers/platform/chrome/cros_ec_trace.h
+++ b/drivers/platform/chrome/cros_ec_trace.h
@@ -92,7 +92,7 @@ TRACE_EVENT(cros_ec_sensorhub_timestamp,
 		__entry->current_time = current_time;
 		__entry->delta = current_timestamp - current_time;
 	),
-	TP_printk("ec_ts: %12lld, ec_fifo_ts: %12lld, fifo_ts: %12lld, curr_ts: %12lld, curr_time: %12lld, delta %12lld",
+	TP_printk("ec_ts: %9u, ec_fifo_ts: %9u, fifo_ts: %12lld, curr_ts: %12lld, curr_time: %12lld, delta %12lld",
 		  __entry->ec_sample_timestamp,
 		__entry->ec_fifo_timestamp,
 		__entry->fifo_timestamp,
@@ -122,7 +122,7 @@ TRACE_EVENT(cros_ec_sensorhub_data,
 		__entry->current_time = current_time;
 		__entry->delta = current_timestamp - current_time;
 	),
-	TP_printk("ec_num: %4d, ec_fifo_ts: %12lld, fifo_ts: %12lld, curr_ts: %12lld, curr_time: %12lld, delta %12lld",
+	TP_printk("ec_num: %4u, ec_fifo_ts: %9u, fifo_ts: %12lld, curr_ts: %12lld, curr_time: %12lld, delta %12lld",
 		  __entry->ec_sensor_num,
 		__entry->ec_fifo_timestamp,
 		__entry->fifo_timestamp,
@@ -153,7 +153,7 @@ TRACE_EVENT(cros_ec_sensorhub_filter,
 		__entry->x = state->x_offset;
 		__entry->y = state->y_offset;
 	),
-	TP_printk("dx: %12lld. dy: %12lld median_m: %12lld median_error: %12lld len: %d x: %12lld y: %12lld",
+	TP_printk("dx: %12lld. dy: %12lld median_m: %12lld median_error: %12lld len: %lld x: %12lld y: %12lld",
 		  __entry->dx,
 		__entry->dy,
 		__entry->median_m,

From 8193ad306ea0005bbe1f2f8fc600ab270d27c8dd Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Wed, 9 Jun 2021 14:09:52 -0400
Subject: [PATCH 0464/1750] ceph: allow ceph_put_mds_session to take NULL or
 ERR_PTR

[ Upstream commit 7e65624d32b6e0429b1d3559e5585657f34f74a1 ]

...to simplify some error paths.

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Luis Henriques <lhenriques@suse.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/dir.c        | 3 +--
 fs/ceph/inode.c      | 6 ++----
 fs/ceph/mds_client.c | 6 ++++--
 fs/ceph/metric.c     | 3 +--
 4 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index a4d48370b2b3..f63c1a090139 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1797,8 +1797,7 @@ static void ceph_d_release(struct dentry *dentry)
 	dentry->d_fsdata = NULL;
 	spin_unlock(&dentry->d_lock);
 
-	if (di->lease_session)
-		ceph_put_mds_session(di->lease_session);
+	ceph_put_mds_session(di->lease_session);
 	kmem_cache_free(ceph_dentry_cachep, di);
 }
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 57cd78e942c0..63e781e4f7e4 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1121,8 +1121,7 @@ static inline void update_dentry_lease(struct inode *dir, struct dentry *dentry,
 	__update_dentry_lease(dir, dentry, lease, session, from_time,
 			      &old_lease_session);
 	spin_unlock(&dentry->d_lock);
-	if (old_lease_session)
-		ceph_put_mds_session(old_lease_session);
+	ceph_put_mds_session(old_lease_session);
 }
 
 /*
@@ -1167,8 +1166,7 @@ static void update_dentry_lease_careful(struct dentry *dentry,
 			      from_time, &old_lease_session);
 out_unlock:
 	spin_unlock(&dentry->d_lock);
-	if (old_lease_session)
-		ceph_put_mds_session(old_lease_session);
+	ceph_put_mds_session(old_lease_session);
 }
 
 /*
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 816cea497537..8cbbb611e0ca 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -661,6 +661,9 @@ struct ceph_mds_session *ceph_get_mds_session(struct ceph_mds_session *s)
 
 void ceph_put_mds_session(struct ceph_mds_session *s)
 {
+	if (IS_ERR_OR_NULL(s))
+		return;
+
 	dout("mdsc put_session %p %d -> %d\n", s,
 	     refcount_read(&s->s_ref), refcount_read(&s->s_ref)-1);
 	if (refcount_dec_and_test(&s->s_ref)) {
@@ -1435,8 +1438,7 @@ static void __open_export_target_sessions(struct ceph_mds_client *mdsc,
 
 	for (i = 0; i < mi->num_export_targets; i++) {
 		ts = __open_export_target_session(mdsc, mi->export_targets[i]);
-		if (!IS_ERR(ts))
-			ceph_put_mds_session(ts);
+		ceph_put_mds_session(ts);
 	}
 }
 
diff --git a/fs/ceph/metric.c b/fs/ceph/metric.c
index fee4c4778313..3b2ef8ee544e 100644
--- a/fs/ceph/metric.c
+++ b/fs/ceph/metric.c
@@ -233,8 +233,7 @@ void ceph_metric_destroy(struct ceph_client_metric *m)
 
 	cancel_delayed_work_sync(&m->delayed_work);
 
-	if (m->session)
-		ceph_put_mds_session(m->session);
+	ceph_put_mds_session(m->session);
 }
 
 static inline void __update_latency(ktime_t *totalp, ktime_t *lsump,

From e418ce8b8dfd47c3555b6e53757382d1fb609b54 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Tue, 27 Jul 2021 15:47:12 -0400
Subject: [PATCH 0465/1750] ceph: cancel delayed work instead of flushing on
 mdsc teardown

[ Upstream commit b4002173b7989588b6feaefc42edaf011b596782 ]

The first thing metric_delayed_work does is check mdsc->stopping,
and then return immediately if it's set. That's good since we would
have already torn down the metric structures at this point, otherwise,
but there is no locking around mdsc->stopping.

It's possible that the ceph_metric_destroy call could race with the
delayed_work, in which case we could end up with the delayed_work
accessing destroyed percpu variables.

At this point in the mdsc teardown, the "stopping" flag has already been
set, so there's no benefit to flushing the work. Move the work
cancellation in ceph_metric_destroy ahead of the percpu variable
destruction, and eliminate the flush_delayed_work call in
ceph_mdsc_destroy.

Fixes: 18f473b384a6 ("ceph: periodically send perf metrics to MDSes")
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c | 1 -
 fs/ceph/metric.c     | 4 ++--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 8cbbb611e0ca..46606fb5b886 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -4859,7 +4859,6 @@ void ceph_mdsc_destroy(struct ceph_fs_client *fsc)
 
 	ceph_metric_destroy(&mdsc->metric);
 
-	flush_delayed_work(&mdsc->metric.delayed_work);
 	fsc->mdsc = NULL;
 	kfree(mdsc);
 	dout("mdsc_destroy %p done\n", mdsc);
diff --git a/fs/ceph/metric.c b/fs/ceph/metric.c
index 3b2ef8ee544e..9e0a0e26294e 100644
--- a/fs/ceph/metric.c
+++ b/fs/ceph/metric.c
@@ -224,6 +224,8 @@ void ceph_metric_destroy(struct ceph_client_metric *m)
 	if (!m)
 		return;
 
+	cancel_delayed_work_sync(&m->delayed_work);
+
 	percpu_counter_destroy(&m->total_inodes);
 	percpu_counter_destroy(&m->opened_inodes);
 	percpu_counter_destroy(&m->i_caps_mis);
@@ -231,8 +233,6 @@ void ceph_metric_destroy(struct ceph_client_metric *m)
 	percpu_counter_destroy(&m->d_lease_mis);
 	percpu_counter_destroy(&m->d_lease_hit);
 
-	cancel_delayed_work_sync(&m->delayed_work);
-
 	ceph_put_mds_session(m->session);
 }
 

From 912afe602eacf4c9cf75a74d3cdb5c9f9c7c4698 Mon Sep 17 00:00:00 2001
From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Date: Tue, 7 Sep 2021 20:00:47 -0700
Subject: [PATCH 0466/1750] Kconfig.debug: drop selecting non-existing
 HARDLOCKUP_DETECTOR_ARCH

[ Upstream commit 6fe26259b4884b657cbc233fb9cdade9d704976e ]

Commit 05a4a9527931 ("kernel/watchdog: split up config options") adds a
new config HARDLOCKUP_DETECTOR, which selects the non-existing config
HARDLOCKUP_DETECTOR_ARCH.

Hence, ./scripts/checkkconfigsymbols.py warns:

HARDLOCKUP_DETECTOR_ARCH Referencing files: lib/Kconfig.debug

Simply drop selecting the non-existing HARDLOCKUP_DETECTOR_ARCH.

Link: https://lkml.kernel.org/r/20210806115618.22088-1-lukas.bulwahn@gmail.com
Fixes: 05a4a9527931 ("kernel/watchdog: split up config options")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Babu Moger <babu.moger@oracle.com>
Cc: Don Zickus <dzickus@redhat.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/Kconfig.debug | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index bf174798afcb..95f909540587 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -981,7 +981,6 @@ config HARDLOCKUP_DETECTOR
 	depends on HAVE_HARDLOCKUP_DETECTOR_PERF || HAVE_HARDLOCKUP_DETECTOR_ARCH
 	select LOCKUP_DETECTOR
 	select HARDLOCKUP_DETECTOR_PERF if HAVE_HARDLOCKUP_DETECTOR_PERF
-	select HARDLOCKUP_DETECTOR_ARCH if HAVE_HARDLOCKUP_DETECTOR_ARCH
 	help
 	  Say Y here to enable the kernel to act as a watchdog to detect
 	  hard lockups.

From d1f9ecc00da1bb6af558251d3eb88ea33aa0c307 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Sun, 5 Sep 2021 00:54:31 +0900
Subject: [PATCH 0467/1750] tools/bootconfig: Fix tracing_on option checking in
 ftrace2bconf.sh

[ Upstream commit 32ba9f0fb027cc43074e3ea26fcf831adeee8e03 ]

Since tracing_on indicates only "1" (default) or "0", ftrace2bconf.sh
only need to check the value is "0".

Link: https://lkml.kernel.org/r/163077087144.222577.6888011847727968737.stgit@devnote2

Fixes: 55ed4560774d ("tools/bootconfig: Add tracing_on support to helper scripts")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bootconfig/scripts/ftrace2bconf.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/bootconfig/scripts/ftrace2bconf.sh b/tools/bootconfig/scripts/ftrace2bconf.sh
index a0c3bcc6da4f..fb201d5afe2c 100755
--- a/tools/bootconfig/scripts/ftrace2bconf.sh
+++ b/tools/bootconfig/scripts/ftrace2bconf.sh
@@ -222,8 +222,8 @@ instance_options() { # [instance-name]
 		emit_kv $PREFIX.cpumask = $val
 	fi
 	val=`cat $INSTANCE/tracing_on`
-	if [ `echo $val | sed -e s/f//g`x != x ]; then
-		emit_kv $PREFIX.tracing_on = $val
+	if [ "$val" = "0" ]; then
+		emit_kv $PREFIX.tracing_on = 0
 	fi
 
 	val=

From c9538018cb2d61c269c4c622131545763f24a9ee Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Thu, 22 Jul 2021 11:06:44 +0200
Subject: [PATCH 0468/1750] thermal/core: Fix thermal_cooling_device_register()
 prototype

[ Upstream commit fb83610762dd5927212aa62a468dd3b756b57a88 ]

There are two pairs of declarations for thermal_cooling_device_register()
and thermal_of_cooling_device_register(), and only one set was changed
in a recent patch, so the other one now causes a compile-time warning:

drivers/net/wireless/mediatek/mt76/mt7915/init.c: In function 'mt7915_thermal_init':
drivers/net/wireless/mediatek/mt76/mt7915/init.c:134:48: error: passing argument 1 of 'thermal_cooling_device_register' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
  134 |         cdev = thermal_cooling_device_register(wiphy_name(wiphy), phy,
      |                                                ^~~~~~~~~~~~~~~~~
In file included from drivers/net/wireless/mediatek/mt76/mt7915/init.c:7:
include/linux/thermal.h:407:39: note: expected 'char *' but argument is of type 'const char *'
  407 | thermal_cooling_device_register(char *type, void *devdata,
      |                                 ~~~~~~^~~~

Change the dummy helper functions to have the same arguments as the
normal version.

Fixes: f991de53a8ab ("thermal: make device_register's type argument const")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jean-Francois Dagenais <jeff.dagenais@gmail.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210722090717.1116748-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/thermal.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/linux/thermal.h b/include/linux/thermal.h
index d07ea27e72a9..176d9454e8f3 100644
--- a/include/linux/thermal.h
+++ b/include/linux/thermal.h
@@ -410,12 +410,13 @@ static inline void thermal_zone_device_unregister(
 	struct thermal_zone_device *tz)
 { }
 static inline struct thermal_cooling_device *
-thermal_cooling_device_register(char *type, void *devdata,
+thermal_cooling_device_register(const char *type, void *devdata,
 	const struct thermal_cooling_device_ops *ops)
 { return ERR_PTR(-ENODEV); }
 static inline struct thermal_cooling_device *
 thermal_of_cooling_device_register(struct device_node *np,
-	char *type, void *devdata, const struct thermal_cooling_device_ops *ops)
+	const char *type, void *devdata,
+	const struct thermal_cooling_device_ops *ops)
 { return ERR_PTR(-ENODEV); }
 static inline struct thermal_cooling_device *
 devm_thermal_of_cooling_device_register(struct device *dev,

From 45bd9dd1bee8aedc4cbd409b1ba7f9b4f941eea6 Mon Sep 17 00:00:00 2001
From: Koba Ko <koba.ko@canonical.com>
Date: Mon, 30 Aug 2021 10:02:00 +0800
Subject: [PATCH 0469/1750] drm/amdgpu: Disable PCIE_DPM on Intel RKL Platform

[ Upstream commit b3dc549986eb7b38eba4a144e979dc93f386751f ]

Due to high latency in PCIE clock switching on RKL platforms,
switching the PCIE clock dynamically at runtime can lead to HDMI/DP
audio problems. On newer asics this is handled in the SMU firmware.
For SMU7-based asics, disable PCIE clock switching to avoid the issue.

AMD provide a parameter to disable PICE_DPM.

modprobe amdgpu ppfeaturemask=0xfff7bffb

It's better to contorl PCIE_DPM in amd gpu driver,
switch PCI_DPM by determining intel RKL platform for SMU7-based asics.

Fixes: 1a31474cdb48 ("drm/amd/pm: workaround for audio noise issue")
Ref: https://lists.freedesktop.org/archives/amd-gfx/2021-August/067413.html
Signed-off-by: Koba Ko <koba.ko@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
index b76425164e29..7931528bc864 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -27,6 +27,9 @@
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <asm/div64.h>
+#if IS_ENABLED(CONFIG_X86_64)
+#include <asm/intel-family.h>
+#endif
 #include <drm/amdgpu_drm.h>
 #include "ppatomctrl.h"
 #include "atombios.h"
@@ -1606,6 +1609,17 @@ static int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr)
 	return result;
 }
 
+static bool intel_core_rkl_chk(void)
+{
+#if IS_ENABLED(CONFIG_X86_64)
+	struct cpuinfo_x86 *c = &cpu_data(0);
+
+	return (c->x86 == 6 && c->x86_model == INTEL_FAM6_ROCKETLAKE);
+#else
+	return false;
+#endif
+}
+
 static void smu7_init_dpm_defaults(struct pp_hwmgr *hwmgr)
 {
 	struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
@@ -1629,7 +1643,8 @@ static void smu7_init_dpm_defaults(struct pp_hwmgr *hwmgr)
 
 	data->mclk_dpm_key_disabled = hwmgr->feature_mask & PP_MCLK_DPM_MASK ? false : true;
 	data->sclk_dpm_key_disabled = hwmgr->feature_mask & PP_SCLK_DPM_MASK ? false : true;
-	data->pcie_dpm_key_disabled = hwmgr->feature_mask & PP_PCIE_DPM_MASK ? false : true;
+	data->pcie_dpm_key_disabled =
+		intel_core_rkl_chk() || !(hwmgr->feature_mask & PP_PCIE_DPM_MASK);
 	/* need to set voltage control types before EVV patching */
 	data->voltage_control = SMU7_VOLTAGE_CONTROL_NONE;
 	data->vddci_control = SMU7_VOLTAGE_CONTROL_NONE;

From b9a1526d51744075a6245d3f3a5544b10a5405c9 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 31 Aug 2021 13:48:34 +0200
Subject: [PATCH 0470/1750] drivers: base: cacheinfo: Get rid of
 DEFINE_SMP_CALL_CACHE_FUNCTION()

[ Upstream commit 4b92d4add5f6dcf21275185c997d6ecb800054cd ]

DEFINE_SMP_CALL_CACHE_FUNCTION() was usefel before the CPU hotplug rework
to ensure that the cache related functions are called on the upcoming CPU
because the notifier itself could run on any online CPU.

The hotplug state machine guarantees that the callbacks are invoked on the
upcoming CPU. So there is no need to have this SMP function call
obfuscation. That indirection was missed when the hotplug notifiers were
converted.

This also solves the problem of ARM64 init_cache_level() invoking ACPI
functions which take a semaphore in that context. That's invalid as SMP
function calls run with interrupts disabled. Running it just from the
callback in context of the CPU hotplug thread solves this.

Fixes: 8571890e1513 ("arm64: Add support for ACPI based firmware tables")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Will Deacon <will@kernel.org>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/871r69ersb.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/cacheinfo.c   |  7 ++-----
 arch/mips/kernel/cacheinfo.c    |  7 ++-----
 arch/riscv/kernel/cacheinfo.c   |  7 ++-----
 arch/x86/kernel/cpu/cacheinfo.c |  7 ++-----
 include/linux/cacheinfo.h       | 18 ------------------
 5 files changed, 8 insertions(+), 38 deletions(-)

diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c
index 7fa6828bb488..587543c6c51c 100644
--- a/arch/arm64/kernel/cacheinfo.c
+++ b/arch/arm64/kernel/cacheinfo.c
@@ -43,7 +43,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
 	this_leaf->type = type;
 }
 
-static int __init_cache_level(unsigned int cpu)
+int init_cache_level(unsigned int cpu)
 {
 	unsigned int ctype, level, leaves, fw_level;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
@@ -78,7 +78,7 @@ static int __init_cache_level(unsigned int cpu)
 	return 0;
 }
 
-static int __populate_cache_leaves(unsigned int cpu)
+int populate_cache_leaves(unsigned int cpu)
 {
 	unsigned int level, idx;
 	enum cache_type type;
@@ -97,6 +97,3 @@ static int __populate_cache_leaves(unsigned int cpu)
 	}
 	return 0;
 }
-
-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c
index 47312c529410..529dab855aac 100644
--- a/arch/mips/kernel/cacheinfo.c
+++ b/arch/mips/kernel/cacheinfo.c
@@ -17,7 +17,7 @@ do {								\
 	leaf++;							\
 } while (0)
 
-static int __init_cache_level(unsigned int cpu)
+int init_cache_level(unsigned int cpu)
 {
 	struct cpuinfo_mips *c = &current_cpu_data;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
@@ -69,7 +69,7 @@ static void fill_cpumask_cluster(int cpu, cpumask_t *cpu_map)
 			cpumask_set_cpu(cpu1, cpu_map);
 }
 
-static int __populate_cache_leaves(unsigned int cpu)
+int populate_cache_leaves(unsigned int cpu)
 {
 	struct cpuinfo_mips *c = &current_cpu_data;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
@@ -98,6 +98,3 @@ static int __populate_cache_leaves(unsigned int cpu)
 
 	return 0;
 }
-
-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
diff --git a/arch/riscv/kernel/cacheinfo.c b/arch/riscv/kernel/cacheinfo.c
index d86781357044..90deabfe63ea 100644
--- a/arch/riscv/kernel/cacheinfo.c
+++ b/arch/riscv/kernel/cacheinfo.c
@@ -113,7 +113,7 @@ static void fill_cacheinfo(struct cacheinfo **this_leaf,
 	}
 }
 
-static int __init_cache_level(unsigned int cpu)
+int init_cache_level(unsigned int cpu)
 {
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
 	struct device_node *np = of_cpu_device_node_get(cpu);
@@ -155,7 +155,7 @@ static int __init_cache_level(unsigned int cpu)
 	return 0;
 }
 
-static int __populate_cache_leaves(unsigned int cpu)
+int populate_cache_leaves(unsigned int cpu)
 {
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
 	struct cacheinfo *this_leaf = this_cpu_ci->info_list;
@@ -187,6 +187,3 @@ static int __populate_cache_leaves(unsigned int cpu)
 
 	return 0;
 }
-
-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c
index f9ac682e75e7..b458b0fd98bf 100644
--- a/arch/x86/kernel/cpu/cacheinfo.c
+++ b/arch/x86/kernel/cpu/cacheinfo.c
@@ -985,7 +985,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf,
 	this_leaf->priv = base->nb;
 }
 
-static int __init_cache_level(unsigned int cpu)
+int init_cache_level(unsigned int cpu)
 {
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
 
@@ -1014,7 +1014,7 @@ static void get_cache_id(int cpu, struct _cpuid4_info_regs *id4_regs)
 	id4_regs->id = c->apicid >> index_msb;
 }
 
-static int __populate_cache_leaves(unsigned int cpu)
+int populate_cache_leaves(unsigned int cpu)
 {
 	unsigned int idx, ret;
 	struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
@@ -1033,6 +1033,3 @@ static int __populate_cache_leaves(unsigned int cpu)
 
 	return 0;
 }
-
-DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level)
-DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves)
diff --git a/include/linux/cacheinfo.h b/include/linux/cacheinfo.h
index 4f72b47973c3..2f909ed084c6 100644
--- a/include/linux/cacheinfo.h
+++ b/include/linux/cacheinfo.h
@@ -79,24 +79,6 @@ struct cpu_cacheinfo {
 	bool cpu_map_populated;
 };
 
-/*
- * Helpers to make sure "func" is executed on the cpu whose cache
- * attributes are being detected
- */
-#define DEFINE_SMP_CALL_CACHE_FUNCTION(func)			\
-static inline void _##func(void *ret)				\
-{								\
-	int cpu = smp_processor_id();				\
-	*(int *)ret = __##func(cpu);				\
-}								\
-								\
-int func(unsigned int cpu)					\
-{								\
-	int ret;						\
-	smp_call_function_single(cpu, _##func, &ret, true);	\
-	return ret;						\
-}
-
 struct cpu_cacheinfo *get_cpu_cacheinfo(unsigned int cpu);
 int init_cache_level(unsigned int cpu);
 int populate_cache_leaves(unsigned int cpu);

From ca907291e11619843ea8b555ca30cf322a8d2514 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Thu, 2 Sep 2021 14:49:11 +0200
Subject: [PATCH 0471/1750] dma-buf: DMABUF_MOVE_NOTIFY should depend on
 DMA_SHARED_BUFFER

[ Upstream commit c4f3a3460a5daebc772d9263500e4099b11e7300 ]

Move notify between drivers is an option of DMA-BUF.  Enabling
DMABUF_MOVE_NOTIFY without DMA_SHARED_BUFFER does not have any impact,
as drivers/dma-buf/ is not entered during the build when
DMA_SHARED_BUFFER is disabled.

Fixes: bb42df4662a44765 ("dma-buf: add dynamic DMA-buf handling v15")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210902124913.2698760-2-geert@linux-m68k.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma-buf/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma-buf/Kconfig b/drivers/dma-buf/Kconfig
index 4f8224a6ac95..3ca7de37dd8f 100644
--- a/drivers/dma-buf/Kconfig
+++ b/drivers/dma-buf/Kconfig
@@ -42,6 +42,7 @@ config UDMABUF
 config DMABUF_MOVE_NOTIFY
 	bool "Move notify between drivers (EXPERIMENTAL)"
 	default n
+	depends on DMA_SHARED_BUFFER
 	help
 	  Don't pin buffers if the dynamic DMA-buf interface is available on
 	  both the exporter as well as the importer. This fixes a security

From 2a07348e9821d7014b27ba3cd7a27318cbc5f4c9 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 8 Sep 2021 08:30:41 -0700
Subject: [PATCH 0472/1750] parisc: Move pci_dev_is_behind_card_dino to where
 it is used

[ Upstream commit 907872baa9f1538eed02ec737b8e89eba6c6e4b9 ]

parisc build test images fail to compile with the following error.

drivers/parisc/dino.c:160:12: error:
	'pci_dev_is_behind_card_dino' defined but not used

Move the function just ahead of its only caller to avoid the error.

Fixes: 5fa1659105fa ("parisc: Disable HP HSC-PCI Cards to prevent kernel crash")
Cc: Helge Deller <deller@gmx.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/parisc/dino.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c
index 889d7ce282eb..952a92504df6 100644
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -156,15 +156,6 @@ static inline struct dino_device *DINO_DEV(struct pci_hba_data *hba)
 	return container_of(hba, struct dino_device, hba);
 }
 
-/* Check if PCI device is behind a Card-mode Dino. */
-static int pci_dev_is_behind_card_dino(struct pci_dev *dev)
-{
-	struct dino_device *dino_dev;
-
-	dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge));
-	return is_card_dino(&dino_dev->hba.dev->id);
-}
-
 /*
  * Dino Configuration Space Accessor Functions
  */
@@ -447,6 +438,15 @@ static void quirk_cirrus_cardbus(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_6832, quirk_cirrus_cardbus );
 
 #ifdef CONFIG_TULIP
+/* Check if PCI device is behind a Card-mode Dino. */
+static int pci_dev_is_behind_card_dino(struct pci_dev *dev)
+{
+	struct dino_device *dino_dev;
+
+	dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge));
+	return is_card_dino(&dino_dev->hba.dev->id);
+}
+
 static void pci_fixup_tulip(struct pci_dev *dev)
 {
 	if (!pci_dev_is_behind_card_dino(dev))

From b4bb0b171b6ef63474bbbcfcb0b90660c27f8fcc Mon Sep 17 00:00:00 2001
From: Wei Huang <wei.huang2@amd.com>
Date: Fri, 20 Aug 2021 15:29:55 -0500
Subject: [PATCH 0473/1750] iommu/amd: Relocate GAMSup check to
 early_enable_iommus

[ Upstream commit c3811a50addd23b9bb5a36278609ee1638debcf6 ]

Currently, iommu_init_ga() checks and disables IOMMU VAPIC support
(i.e. AMD AVIC support in IOMMU) when GAMSup feature bit is not set.
However it forgets to clear IRQ_POSTING_CAP from the previously set
amd_iommu_irq_ops.capability.

This triggers an invalid page fault bug during guest VM warm reboot
if AVIC is enabled since the irq_remapping_cap(IRQ_POSTING_CAP) is
incorrectly set, and crash the system with the following kernel trace.

    BUG: unable to handle page fault for address: 0000000000400dd8
    RIP: 0010:amd_iommu_deactivate_guest_mode+0x19/0xbc
    Call Trace:
     svm_set_pi_irte_mode+0x8a/0xc0 [kvm_amd]
     ? kvm_make_all_cpus_request_except+0x50/0x70 [kvm]
     kvm_request_apicv_update+0x10c/0x150 [kvm]
     svm_toggle_avic_for_irq_window+0x52/0x90 [kvm_amd]
     svm_enable_irq_window+0x26/0xa0 [kvm_amd]
     vcpu_enter_guest+0xbbe/0x1560 [kvm]
     ? avic_vcpu_load+0xd5/0x120 [kvm_amd]
     ? kvm_arch_vcpu_load+0x76/0x240 [kvm]
     ? svm_get_segment_base+0xa/0x10 [kvm_amd]
     kvm_arch_vcpu_ioctl_run+0x103/0x590 [kvm]
     kvm_vcpu_ioctl+0x22a/0x5d0 [kvm]
     __x64_sys_ioctl+0x84/0xc0
     do_syscall_64+0x33/0x40
     entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes by moving the initializing of AMD IOMMU interrupt remapping mode
(amd_iommu_guest_ir) earlier before setting up the
amd_iommu_irq_ops.capability with appropriate IRQ_POSTING_CAP flag.

[joro:	Squashed the two patches and limited
	check_features_on_all_iommus() to CONFIG_IRQ_REMAP
	to fix a compile warning.]

Signed-off-by: Wei Huang <wei.huang2@amd.com>
Co-developed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Link: https://lore.kernel.org/r/20210820202957.187572-2-suravee.suthikulpanit@amd.com
Link: https://lore.kernel.org/r/20210820202957.187572-3-suravee.suthikulpanit@amd.com
Fixes: 8bda0cfbdc1a ("iommu/amd: Detect and initialize guest vAPIC log")
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iommu/amd/init.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index fa57986c2309..28de889aa516 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -298,6 +298,22 @@ int amd_iommu_get_num_iommus(void)
 	return amd_iommus_present;
 }
 
+#ifdef CONFIG_IRQ_REMAP
+static bool check_feature_on_all_iommus(u64 mask)
+{
+	bool ret = false;
+	struct amd_iommu *iommu;
+
+	for_each_iommu(iommu) {
+		ret = iommu_feature(iommu, mask);
+		if (!ret)
+			return false;
+	}
+
+	return true;
+}
+#endif
+
 /*
  * For IVHD type 0x11/0x40, EFR is also available via IVHD.
  * Default to IVHD EFR since it is available sooner
@@ -854,13 +870,6 @@ static int iommu_init_ga(struct amd_iommu *iommu)
 	int ret = 0;
 
 #ifdef CONFIG_IRQ_REMAP
-	/* Note: We have already checked GASup from IVRS table.
-	 *       Now, we need to make sure that GAMSup is set.
-	 */
-	if (AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) &&
-	    !iommu_feature(iommu, FEATURE_GAM_VAPIC))
-		amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY_GA;
-
 	ret = iommu_init_ga_log(iommu);
 #endif /* CONFIG_IRQ_REMAP */
 
@@ -2396,6 +2405,14 @@ static void early_enable_iommus(void)
 	}
 
 #ifdef CONFIG_IRQ_REMAP
+	/*
+	 * Note: We have already checked GASup from IVRS table.
+	 *       Now, we need to make sure that GAMSup is set.
+	 */
+	if (AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) &&
+	    !check_feature_on_all_iommus(FEATURE_GAM_VAPIC))
+		amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY_GA;
+
 	if (AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir))
 		amd_iommu_irq_ops.capability |= (1 << IRQ_POSTING_CAP);
 #endif

From c12cf7f9afe23eef40cb5cff5fd28a0f39745232 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Fri, 25 Jun 2021 10:38:10 +0200
Subject: [PATCH 0474/1750] dmaengine: idxd: depends on !UML

[ Upstream commit b2296eeac91555bd13f774efa7ab7d4b12fb71ef ]

Now that UML has PCI support, this driver must depend also on
!UML since it pokes at X86_64 architecture internals that don't
exist on ARCH=um.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Dave Jiang <dave.jiang@intel.com>
Acked-By: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Link: https://lore.kernel.org/r/20210625103810.fe877ae0aef4.If240438e3f50ae226f3f755fc46ea498c6858393@changeid
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index f28bb2334e74..3a745e8a0f42 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -285,7 +285,7 @@ config INTEL_IDMA64
 
 config INTEL_IDXD
 	tristate "Intel Data Accelerators support"
-	depends on PCI && X86_64
+	depends on PCI && X86_64 && !UML
 	depends on PCI_MSI
 	depends on SBITMAP
 	select DMA_ENGINE

From 35492619e010b312d0d3fe94bbe182bce0bae5ee Mon Sep 17 00:00:00 2001
From: Zou Wei <zou_wei@huawei.com>
Date: Tue, 4 May 2021 10:22:57 +0800
Subject: [PATCH 0475/1750] dmaengine: sprd: Add missing MODULE_DEVICE_TABLE

[ Upstream commit 4faee8b65ec32346f8096e64c5fa1d5a73121742 ]

This patch adds missing MODULE_DEVICE_TABLE definition which generates
correct modalias for automatic loading of this driver when it is built
as an external module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zou Wei <zou_wei@huawei.com>
Reviewed-by: Baolin Wang <baolin.wang7@gmail.com>
Link: https://lore.kernel.org/r/1620094977-70146-1-git-send-email-zou_wei@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/sprd-dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
index 0ef5ca81ba4d..4357d2395e6b 100644
--- a/drivers/dma/sprd-dma.c
+++ b/drivers/dma/sprd-dma.c
@@ -1265,6 +1265,7 @@ static const struct of_device_id sprd_dma_match[] = {
 	{ .compatible = "sprd,sc9860-dma", },
 	{},
 };
+MODULE_DEVICE_TABLE(of, sprd_dma_match);
 
 static int __maybe_unused sprd_dma_runtime_suspend(struct device *dev)
 {

From 9c1ea8537730790ee183fa32379932f777c95d17 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 9 Aug 2021 11:24:09 +0200
Subject: [PATCH 0476/1750] dmaengine: ioat: depends on !UML

[ Upstream commit bbac7a92a46f0876e588722ebe552ddfe6fd790f ]

Now that UML has PCI support, this driver must depend also on
!UML since it pokes at X86_64 architecture internals that don't
exist on ARCH=um.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Acked-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20210809112409.a3a0974874d2.I2ffe3d11ed37f735da2f39884a74c953b258b995@changeid
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 3a745e8a0f42..08013345d1f2 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -299,7 +299,7 @@ config INTEL_IDXD
 
 config INTEL_IOATDMA
 	tristate "Intel I/OAT DMA support"
-	depends on PCI && X86_64
+	depends on PCI && X86_64 && !UML
 	select DMA_ENGINE
 	select DMA_ENGINE_RAID
 	select DCA

From b26ced26251cc26cc6c8327535687b77af0c55db Mon Sep 17 00:00:00 2001
From: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Date: Thu, 19 Aug 2021 14:28:48 +0530
Subject: [PATCH 0477/1750] dmaengine: xilinx_dma: Set DMA mask for coherent
 APIs

[ Upstream commit aac6c0f90799d66b8989be1e056408f33fd99fe6 ]

The xilinx dma driver uses the consistent allocations, so for correct
operation also set the DMA mask for coherent APIs. It fixes the below
kernel crash with dmatest client when DMA IP is configured with 64-bit
address width and linux is booted from high (>4GB) memory.

Call trace:
[  489.531257]  dma_alloc_from_pool+0x8c/0x1c0
[  489.535431]  dma_direct_alloc+0x284/0x330
[  489.539432]  dma_alloc_attrs+0x80/0xf0
[  489.543174]  dma_pool_alloc+0x160/0x2c0
[  489.547003]  xilinx_cdma_prep_memcpy+0xa4/0x180
[  489.551524]  dmatest_func+0x3cc/0x114c
[  489.555266]  kthread+0x124/0x130
[  489.558486]  ret_from_fork+0x10/0x3c
[  489.562051] ---[ end trace 248625b2d596a90a ]---

Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
Reviewed-by: Harini Katakam <harini.katakam@xilinx.com>
Link: https://lore.kernel.org/r/1629363528-30347-1-git-send-email-radhey.shyam.pandey@xilinx.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/xilinx/xilinx_dma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
index 9ffdbeec436b..cab4719e4cf9 100644
--- a/drivers/dma/xilinx/xilinx_dma.c
+++ b/drivers/dma/xilinx/xilinx_dma.c
@@ -3070,7 +3070,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
 		xdev->ext_addr = false;
 
 	/* Set the dma mask bits */
-	dma_set_mask(xdev->dev, DMA_BIT_MASK(addr_width));
+	dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
 
 	/* Initialize the DMA engine */
 	xdev->common.dev = &pdev->dev;

From 386fd6fd01bd1ee92640f97c0d0e06e204641c9f Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Wed, 11 Aug 2021 06:40:42 -0400
Subject: [PATCH 0478/1750] ceph: request Fw caps before updating the mtime in
 ceph_write_iter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b11ed50346683a749632ea664959b28d524d7395 ]

The current code will update the mtime and then try to get caps to
handle the write. If we end up having to request caps from the MDS, then
the mtime in the cap grant will clobber the updated mtime and it'll be
lost.

This is most noticable when two clients are alternately writing to the
same file. Fw caps are continually being granted and revoked, and the
mtime ends up stuck because the updated mtimes are always being
overwritten with the old one.

Fix this by changing the order of operations in ceph_write_iter to get
the caps before updating the times. Also, make sure we check the pool
full conditions before even getting any caps or uninlining.

URL: https://tracker.ceph.com/issues/46574
Reported-by: Jozef Kováč <kovac@firma.zoznam.sk>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Luis Henriques <lhenriques@suse.de>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/file.c | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 3d2e3dd4ee01..f1895f78ab45 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1723,22 +1723,6 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
 		goto out;
 	}
 
-	err = file_remove_privs(file);
-	if (err)
-		goto out;
-
-	err = file_update_time(file);
-	if (err)
-		goto out;
-
-	inode_inc_iversion_raw(inode);
-
-	if (ci->i_inline_version != CEPH_INLINE_NONE) {
-		err = ceph_uninline_data(file, NULL);
-		if (err < 0)
-			goto out;
-	}
-
 	down_read(&osdc->lock);
 	map_flags = osdc->osdmap->flags;
 	pool_flags = ceph_pg_pool_flags(osdc->osdmap, ci->i_layout.pool_id);
@@ -1749,6 +1733,16 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
 		goto out;
 	}
 
+	err = file_remove_privs(file);
+	if (err)
+		goto out;
+
+	if (ci->i_inline_version != CEPH_INLINE_NONE) {
+		err = ceph_uninline_data(file, NULL);
+		if (err < 0)
+			goto out;
+	}
+
 	dout("aio_write %p %llx.%llx %llu~%zd getting caps. i_size %llu\n",
 	     inode, ceph_vinop(inode), pos, count, i_size_read(inode));
 	if (fi->fmode & CEPH_FILE_MODE_LAZY)
@@ -1761,6 +1755,12 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	if (err < 0)
 		goto out;
 
+	err = file_update_time(file);
+	if (err)
+		goto out_caps;
+
+	inode_inc_iversion_raw(inode);
+
 	dout("aio_write %p %llx.%llx %llu~%zd got cap refs on %s\n",
 	     inode, ceph_vinop(inode), pos, count, ceph_cap_string(got));
 
@@ -1844,6 +1844,8 @@ static ssize_t ceph_write_iter(struct kiocb *iocb, struct iov_iter *from)
 	}
 
 	goto out_unlocked;
+out_caps:
+	ceph_put_cap_refs(ci, got);
 out:
 	if (direct_lock)
 		ceph_end_io_direct(inode);

From 487ead34a208c1da9da7fc9f776b517680255ca1 Mon Sep 17 00:00:00 2001
From: Xiubo Li <xiubli@redhat.com>
Date: Wed, 25 Aug 2021 21:45:43 +0800
Subject: [PATCH 0479/1750] ceph: remove the capsnaps when removing caps

[ Upstream commit a6d37ccdd240e80f26aaea0e62cda310e0e184d7 ]

capsnaps will take inode references via ihold when queueing to flush.
When force unmounting, the client will just close the sessions and
may never get a flush reply, causing a leak and inode ref leak.

Fix this by removing the capsnaps for an inode when removing the caps.

URL: https://tracker.ceph.com/issues/52295
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/caps.c       | 68 +++++++++++++++++++++++++++++++++-----------
 fs/ceph/mds_client.c | 31 +++++++++++++++++++-
 fs/ceph/super.h      |  6 ++++
 3 files changed, 87 insertions(+), 18 deletions(-)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 678dac8365ed..f303e0d87c3f 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -3169,7 +3169,16 @@ void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
 				break;
 			}
 		}
-		BUG_ON(!found);
+
+		if (!found) {
+			/*
+			 * The capsnap should already be removed when removing
+			 * auth cap in the case of a forced unmount.
+			 */
+			WARN_ON_ONCE(ci->i_auth_cap);
+			goto unlock;
+		}
+
 		capsnap->dirty_pages -= nr;
 		if (capsnap->dirty_pages == 0) {
 			complete_capsnap = true;
@@ -3191,6 +3200,7 @@ void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
 		     complete_capsnap ? " (complete capsnap)" : "");
 	}
 
+unlock:
 	spin_unlock(&ci->i_ceph_lock);
 
 	if (last) {
@@ -3657,6 +3667,43 @@ static void handle_cap_flush_ack(struct inode *inode, u64 flush_tid,
 		iput(inode);
 }
 
+void __ceph_remove_capsnap(struct inode *inode, struct ceph_cap_snap *capsnap,
+			   bool *wake_ci, bool *wake_mdsc)
+{
+	struct ceph_inode_info *ci = ceph_inode(inode);
+	struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc;
+	bool ret;
+
+	lockdep_assert_held(&ci->i_ceph_lock);
+
+	dout("removing capsnap %p, inode %p ci %p\n", capsnap, inode, ci);
+
+	list_del_init(&capsnap->ci_item);
+	ret = __detach_cap_flush_from_ci(ci, &capsnap->cap_flush);
+	if (wake_ci)
+		*wake_ci = ret;
+
+	spin_lock(&mdsc->cap_dirty_lock);
+	if (list_empty(&ci->i_cap_flush_list))
+		list_del_init(&ci->i_flushing_item);
+
+	ret = __detach_cap_flush_from_mdsc(mdsc, &capsnap->cap_flush);
+	if (wake_mdsc)
+		*wake_mdsc = ret;
+	spin_unlock(&mdsc->cap_dirty_lock);
+}
+
+void ceph_remove_capsnap(struct inode *inode, struct ceph_cap_snap *capsnap,
+			 bool *wake_ci, bool *wake_mdsc)
+{
+	struct ceph_inode_info *ci = ceph_inode(inode);
+
+	lockdep_assert_held(&ci->i_ceph_lock);
+
+	WARN_ON_ONCE(capsnap->dirty_pages || capsnap->writing);
+	__ceph_remove_capsnap(inode, capsnap, wake_ci, wake_mdsc);
+}
+
 /*
  * Handle FLUSHSNAP_ACK.  MDS has flushed snap data to disk and we can
  * throw away our cap_snap.
@@ -3694,23 +3741,10 @@ static void handle_cap_flushsnap_ack(struct inode *inode, u64 flush_tid,
 			     capsnap, capsnap->follows);
 		}
 	}
-	if (flushed) {
-		WARN_ON(capsnap->dirty_pages || capsnap->writing);
-		dout(" removing %p cap_snap %p follows %lld\n",
-		     inode, capsnap, follows);
-		list_del(&capsnap->ci_item);
-		wake_ci |= __detach_cap_flush_from_ci(ci, &capsnap->cap_flush);
-
-		spin_lock(&mdsc->cap_dirty_lock);
-
-		if (list_empty(&ci->i_cap_flush_list))
-			list_del_init(&ci->i_flushing_item);
-
-		wake_mdsc |= __detach_cap_flush_from_mdsc(mdsc,
-							  &capsnap->cap_flush);
-		spin_unlock(&mdsc->cap_dirty_lock);
-	}
+	if (flushed)
+		ceph_remove_capsnap(inode, capsnap, &wake_ci, &wake_mdsc);
 	spin_unlock(&ci->i_ceph_lock);
+
 	if (flushed) {
 		ceph_put_snap_context(capsnap->context);
 		ceph_put_cap_snap(capsnap);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 46606fb5b886..0f57b7d09457 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1587,14 +1587,39 @@ int ceph_iterate_session_caps(struct ceph_mds_session *session,
 	return ret;
 }
 
+static int remove_capsnaps(struct ceph_mds_client *mdsc, struct inode *inode)
+{
+	struct ceph_inode_info *ci = ceph_inode(inode);
+	struct ceph_cap_snap *capsnap;
+	int capsnap_release = 0;
+
+	lockdep_assert_held(&ci->i_ceph_lock);
+
+	dout("removing capsnaps, ci is %p, inode is %p\n", ci, inode);
+
+	while (!list_empty(&ci->i_cap_snaps)) {
+		capsnap = list_first_entry(&ci->i_cap_snaps,
+					   struct ceph_cap_snap, ci_item);
+		__ceph_remove_capsnap(inode, capsnap, NULL, NULL);
+		ceph_put_snap_context(capsnap->context);
+		ceph_put_cap_snap(capsnap);
+		capsnap_release++;
+	}
+	wake_up_all(&ci->i_cap_wq);
+	wake_up_all(&mdsc->cap_flushing_wq);
+	return capsnap_release;
+}
+
 static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
 				  void *arg)
 {
 	struct ceph_fs_client *fsc = (struct ceph_fs_client *)arg;
+	struct ceph_mds_client *mdsc = fsc->mdsc;
 	struct ceph_inode_info *ci = ceph_inode(inode);
 	LIST_HEAD(to_remove);
 	bool dirty_dropped = false;
 	bool invalidate = false;
+	int capsnap_release = 0;
 
 	dout("removing cap %p, ci is %p, inode is %p\n",
 	     cap, ci, &ci->vfs_inode);
@@ -1602,7 +1627,6 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
 	__ceph_remove_cap(cap, false);
 	if (!ci->i_auth_cap) {
 		struct ceph_cap_flush *cf;
-		struct ceph_mds_client *mdsc = fsc->mdsc;
 
 		if (READ_ONCE(fsc->mount_state) == CEPH_MOUNT_SHUTDOWN) {
 			if (inode->i_data.nrpages > 0)
@@ -1666,6 +1690,9 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
 			list_add(&ci->i_prealloc_cap_flush->i_list, &to_remove);
 			ci->i_prealloc_cap_flush = NULL;
 		}
+
+		if (!list_empty(&ci->i_cap_snaps))
+			capsnap_release = remove_capsnaps(mdsc, inode);
 	}
 	spin_unlock(&ci->i_ceph_lock);
 	while (!list_empty(&to_remove)) {
@@ -1682,6 +1709,8 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
 		ceph_queue_invalidate(inode);
 	if (dirty_dropped)
 		iput(inode);
+	while (capsnap_release--)
+		iput(inode);
 	return 0;
 }
 
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index a8c460393b01..9362eeb5812d 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -1134,6 +1134,12 @@ extern void ceph_put_cap_refs_no_check_caps(struct ceph_inode_info *ci,
 					    int had);
 extern void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
 				       struct ceph_snap_context *snapc);
+extern void __ceph_remove_capsnap(struct inode *inode,
+				  struct ceph_cap_snap *capsnap,
+				  bool *wake_ci, bool *wake_mdsc);
+extern void ceph_remove_capsnap(struct inode *inode,
+				struct ceph_cap_snap *capsnap,
+				bool *wake_ci, bool *wake_mdsc);
 extern void ceph_flush_snaps(struct ceph_inode_info *ci,
 			     struct ceph_mds_session **psession);
 extern bool __ceph_should_report_size(struct ceph_inode_info *ci);

From 921ef7cfef15a7e25511089c9941ee37c3dc9fec Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Thu, 2 Sep 2021 08:31:03 -0400
Subject: [PATCH 0480/1750] ceph: lockdep annotations for
 try_nonblocking_invalidate

[ Upstream commit 3eaf5aa1cfa8c97c72f5824e2e9263d6cc977b03 ]

Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/caps.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index f303e0d87c3f..48ea95b81df8 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1868,6 +1868,8 @@ static u64 __mark_caps_flushing(struct inode *inode,
  * try to invalidate mapping pages without blocking.
  */
 static int try_nonblocking_invalidate(struct inode *inode)
+	__releases(ci->i_ceph_lock)
+	__acquires(ci->i_ceph_lock)
 {
 	struct ceph_inode_info *ci = ceph_inode(inode);
 	u32 invalidating_gen = ci->i_rdcache_gen;

From c43803c1aa76f2cc15ee641564412741a18028ff Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 27 Jul 2021 17:01:16 -0400
Subject: [PATCH 0481/1750] btrfs: update the bdev time directly when closing

[ Upstream commit 8f96a5bfa1503e0a5f3c78d51e993a1794d4aff1 ]

We update the ctime/mtime of a block device when we remove it so that
blkid knows the device changed.  However we do this by re-opening the
block device and calling filp_update_time.  This is more correct because
it'll call the inode->i_op->update_time if it exists, but the block dev
inodes do not do this.  Instead call generic_update_time() on the
bd_inode in order to avoid the blkdev_open path and get rid of the
following lockdep splat:

======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc2+ #406 Not tainted
------------------------------------------------------
losetup/11596 is trying to acquire lock:
ffff939640d2f538 ((wq_completion)loop0){+.+.}-{0:0}, at: flush_workqueue+0x67/0x5e0

but task is already holding lock:
ffff939655510c68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop]

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #4 (&lo->lo_mutex){+.+.}-{3:3}:
       __mutex_lock+0x7d/0x750
       lo_open+0x28/0x60 [loop]
       blkdev_get_whole+0x25/0xf0
       blkdev_get_by_dev.part.0+0x168/0x3c0
       blkdev_open+0xd2/0xe0
       do_dentry_open+0x161/0x390
       path_openat+0x3cc/0xa20
       do_filp_open+0x96/0x120
       do_sys_openat2+0x7b/0x130
       __x64_sys_openat+0x46/0x70
       do_syscall_64+0x38/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #3 (&disk->open_mutex){+.+.}-{3:3}:
       __mutex_lock+0x7d/0x750
       blkdev_get_by_dev.part.0+0x56/0x3c0
       blkdev_open+0xd2/0xe0
       do_dentry_open+0x161/0x390
       path_openat+0x3cc/0xa20
       do_filp_open+0x96/0x120
       file_open_name+0xc7/0x170
       filp_open+0x2c/0x50
       btrfs_scratch_superblocks.part.0+0x10f/0x170
       btrfs_rm_device.cold+0xe8/0xed
       btrfs_ioctl+0x2a31/0x2e70
       __x64_sys_ioctl+0x80/0xb0
       do_syscall_64+0x38/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

-> #2 (sb_writers#12){.+.+}-{0:0}:
       lo_write_bvec+0xc2/0x240 [loop]
       loop_process_work+0x238/0xd00 [loop]
       process_one_work+0x26b/0x560
       worker_thread+0x55/0x3c0
       kthread+0x140/0x160
       ret_from_fork+0x1f/0x30

-> #1 ((work_completion)(&lo->rootcg_work)){+.+.}-{0:0}:
       process_one_work+0x245/0x560
       worker_thread+0x55/0x3c0
       kthread+0x140/0x160
       ret_from_fork+0x1f/0x30

-> #0 ((wq_completion)loop0){+.+.}-{0:0}:
       __lock_acquire+0x10ea/0x1d90
       lock_acquire+0xb5/0x2b0
       flush_workqueue+0x91/0x5e0
       drain_workqueue+0xa0/0x110
       destroy_workqueue+0x36/0x250
       __loop_clr_fd+0x9a/0x660 [loop]
       block_ioctl+0x3f/0x50
       __x64_sys_ioctl+0x80/0xb0
       do_syscall_64+0x38/0x90
       entry_SYSCALL_64_after_hwframe+0x44/0xae

other info that might help us debug this:

Chain exists of:
  (wq_completion)loop0 --> &disk->open_mutex --> &lo->lo_mutex

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&lo->lo_mutex);
                               lock(&disk->open_mutex);
                               lock(&lo->lo_mutex);
  lock((wq_completion)loop0);

 *** DEADLOCK ***

1 lock held by losetup/11596:
 #0: ffff939655510c68 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x660 [loop]

stack backtrace:
CPU: 1 PID: 11596 Comm: losetup Not tainted 5.14.0-rc2+ #406
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
Call Trace:
 dump_stack_lvl+0x57/0x72
 check_noncircular+0xcf/0xf0
 ? stack_trace_save+0x3b/0x50
 __lock_acquire+0x10ea/0x1d90
 lock_acquire+0xb5/0x2b0
 ? flush_workqueue+0x67/0x5e0
 ? lockdep_init_map_type+0x47/0x220
 flush_workqueue+0x91/0x5e0
 ? flush_workqueue+0x67/0x5e0
 ? verify_cpu+0xf0/0x100
 drain_workqueue+0xa0/0x110
 destroy_workqueue+0x36/0x250
 __loop_clr_fd+0x9a/0x660 [loop]
 ? blkdev_ioctl+0x8d/0x2a0
 block_ioctl+0x3f/0x50
 __x64_sys_ioctl+0x80/0xb0
 do_syscall_64+0x38/0x90
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index b4fcc48f255b..994ec44fc597 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1855,15 +1855,17 @@ static int btrfs_add_dev_item(struct btrfs_trans_handle *trans,
  * Function to update ctime/mtime for a given device path.
  * Mainly used for ctime/mtime based probe like libblkid.
  */
-static void update_dev_time(const char *path_name)
+static void update_dev_time(struct block_device *bdev)
 {
-	struct file *filp;
+	struct inode *inode = bdev->bd_inode;
+	struct timespec64 now;
 
-	filp = filp_open(path_name, O_RDWR, 0);
-	if (IS_ERR(filp))
+	/* Shouldn't happen but just in case. */
+	if (!inode)
 		return;
-	file_update_time(filp);
-	filp_close(filp, NULL);
+
+	now = current_time(inode);
+	generic_update_time(inode, &now, S_MTIME | S_CTIME);
 }
 
 static int btrfs_rm_dev_item(struct btrfs_device *device)
@@ -2038,7 +2040,7 @@ void btrfs_scratch_superblocks(struct btrfs_fs_info *fs_info,
 	btrfs_kobject_uevent(bdev, KOBJ_CHANGE);
 
 	/* Update ctime/mtime for device path for libblkid */
-	update_dev_time(device_path);
+	update_dev_time(bdev);
 }
 
 int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,
@@ -2681,7 +2683,7 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path
 	btrfs_forget_devices(device_path);
 
 	/* Update ctime/mtime for blkid or udev */
-	update_dev_time(device_path);
+	update_dev_time(bdev);
 
 	return ret;
 

From aa1af89a6697ed8f1f0d3d62029036158a4486d9 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain@oracle.com>
Date: Tue, 31 Aug 2021 09:21:28 +0800
Subject: [PATCH 0482/1750] btrfs: fix lockdep warning while mounting sprout fs

[ Upstream commit c124706900c20dee70f921bb3a90492431561a0a ]

Following test case reproduces lockdep warning.

  Test case:

  $ mkfs.btrfs -f <dev1>
  $ btrfstune -S 1 <dev1>
  $ mount <dev1> <mnt>
  $ btrfs device add <dev2> <mnt> -f
  $ umount <mnt>
  $ mount <dev2> <mnt>
  $ umount <mnt>

The warning claims a possible ABBA deadlock between the threads
initiated by [#1] btrfs device add and [#0] the mount.

  [ 540.743122] WARNING: possible circular locking dependency detected
  [ 540.743129] 5.11.0-rc7+ #5 Not tainted
  [ 540.743135] ------------------------------------------------------
  [ 540.743142] mount/2515 is trying to acquire lock:
  [ 540.743149] ffffa0c5544c2ce0 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: clone_fs_devices+0x6d/0x210 [btrfs]
  [ 540.743458] but task is already holding lock:
  [ 540.743461] ffffa0c54a7932b8 (btrfs-chunk-00){++++}-{4:4}, at: __btrfs_tree_read_lock+0x32/0x200 [btrfs]
  [ 540.743541] which lock already depends on the new lock.
  [ 540.743543] the existing dependency chain (in reverse order) is:

  [ 540.743546] -> #1 (btrfs-chunk-00){++++}-{4:4}:
  [ 540.743566] down_read_nested+0x48/0x2b0
  [ 540.743585] __btrfs_tree_read_lock+0x32/0x200 [btrfs]
  [ 540.743650] btrfs_read_lock_root_node+0x70/0x200 [btrfs]
  [ 540.743733] btrfs_search_slot+0x6c6/0xe00 [btrfs]
  [ 540.743785] btrfs_update_device+0x83/0x260 [btrfs]
  [ 540.743849] btrfs_finish_chunk_alloc+0x13f/0x660 [btrfs] <--- device_list_mutex
  [ 540.743911] btrfs_create_pending_block_groups+0x18d/0x3f0 [btrfs]
  [ 540.743982] btrfs_commit_transaction+0x86/0x1260 [btrfs]
  [ 540.744037] btrfs_init_new_device+0x1600/0x1dd0 [btrfs]
  [ 540.744101] btrfs_ioctl+0x1c77/0x24c0 [btrfs]
  [ 540.744166] __x64_sys_ioctl+0xe4/0x140
  [ 540.744170] do_syscall_64+0x4b/0x80
  [ 540.744174] entry_SYSCALL_64_after_hwframe+0x44/0xa9

  [ 540.744180] -> #0 (&fs_devs->device_list_mutex){+.+.}-{4:4}:
  [ 540.744184] __lock_acquire+0x155f/0x2360
  [ 540.744188] lock_acquire+0x10b/0x5c0
  [ 540.744190] __mutex_lock+0xb1/0xf80
  [ 540.744193] mutex_lock_nested+0x27/0x30
  [ 540.744196] clone_fs_devices+0x6d/0x210 [btrfs]
  [ 540.744270] btrfs_read_chunk_tree+0x3c7/0xbb0 [btrfs]
  [ 540.744336] open_ctree+0xf6e/0x2074 [btrfs]
  [ 540.744406] btrfs_mount_root.cold.72+0x16/0x127 [btrfs]
  [ 540.744472] legacy_get_tree+0x38/0x90
  [ 540.744475] vfs_get_tree+0x30/0x140
  [ 540.744478] fc_mount+0x16/0x60
  [ 540.744482] vfs_kern_mount+0x91/0x100
  [ 540.744484] btrfs_mount+0x1e6/0x670 [btrfs]
  [ 540.744536] legacy_get_tree+0x38/0x90
  [ 540.744537] vfs_get_tree+0x30/0x140
  [ 540.744539] path_mount+0x8d8/0x1070
  [ 540.744541] do_mount+0x8d/0xc0
  [ 540.744543] __x64_sys_mount+0x125/0x160
  [ 540.744545] do_syscall_64+0x4b/0x80
  [ 540.744547] entry_SYSCALL_64_after_hwframe+0x44/0xa9

  [ 540.744551] other info that might help us debug this:
  [ 540.744552] Possible unsafe locking scenario:

  [ 540.744553] CPU0 				CPU1
  [ 540.744554] ---- 				----
  [ 540.744555] lock(btrfs-chunk-00);
  [ 540.744557] 					lock(&fs_devs->device_list_mutex);
  [ 540.744560] 					lock(btrfs-chunk-00);
  [ 540.744562] lock(&fs_devs->device_list_mutex);
  [ 540.744564]
   *** DEADLOCK ***

  [ 540.744565] 3 locks held by mount/2515:
  [ 540.744567] #0: ffffa0c56bf7a0e0 (&type->s_umount_key#42/1){+.+.}-{4:4}, at: alloc_super.isra.16+0xdf/0x450
  [ 540.744574] #1: ffffffffc05a9628 (uuid_mutex){+.+.}-{4:4}, at: btrfs_read_chunk_tree+0x63/0xbb0 [btrfs]
  [ 540.744640] #2: ffffa0c54a7932b8 (btrfs-chunk-00){++++}-{4:4}, at: __btrfs_tree_read_lock+0x32/0x200 [btrfs]
  [ 540.744708]
   stack backtrace:
  [ 540.744712] CPU: 2 PID: 2515 Comm: mount Not tainted 5.11.0-rc7+ #5

But the device_list_mutex in clone_fs_devices() is redundant, as
explained below.  Two threads [1]  and [2] (below) could lead to
clone_fs_device().

  [1]
  open_ctree <== mount sprout fs
   btrfs_read_chunk_tree()
    mutex_lock(&uuid_mutex) <== global lock
    read_one_dev()
     open_seed_devices()
      clone_fs_devices() <== seed fs_devices
       mutex_lock(&orig->device_list_mutex) <== seed fs_devices

  [2]
  btrfs_init_new_device() <== sprouting
   mutex_lock(&uuid_mutex); <== global lock
   btrfs_prepare_sprout()
     lockdep_assert_held(&uuid_mutex)
     clone_fs_devices(seed_fs_device) <== seed fs_devices

Both of these threads hold uuid_mutex which is sufficient to protect
getting the seed device(s) freed while we are trying to clone it for
sprouting [2] or mounting a sprout [1] (as above). A mounted seed device
can not free/write/replace because it is read-only. An unmounted seed
device can be freed by btrfs_free_stale_devices(), but it needs
uuid_mutex.  So this patch removes the unnecessary device_list_mutex in
clone_fs_devices().  And adds a lockdep_assert_held(&uuid_mutex) in
clone_fs_devices().

Reported-by: Su Yue <l@damenly.su>
Tested-by: Su Yue <l@damenly.su>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 994ec44fc597..509811aabb3f 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -568,6 +568,8 @@ static int btrfs_free_stale_devices(const char *path,
 	struct btrfs_device *device, *tmp_device;
 	int ret = 0;
 
+	lockdep_assert_held(&uuid_mutex);
+
 	if (path)
 		ret = -ENOENT;
 
@@ -999,11 +1001,12 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
 	struct btrfs_device *orig_dev;
 	int ret = 0;
 
+	lockdep_assert_held(&uuid_mutex);
+
 	fs_devices = alloc_fs_devices(orig->fsid, NULL);
 	if (IS_ERR(fs_devices))
 		return fs_devices;
 
-	mutex_lock(&orig->device_list_mutex);
 	fs_devices->total_devices = orig->total_devices;
 
 	list_for_each_entry(orig_dev, &orig->devices, dev_list) {
@@ -1035,10 +1038,8 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
 		device->fs_devices = fs_devices;
 		fs_devices->num_devices++;
 	}
-	mutex_unlock(&orig->device_list_mutex);
 	return fs_devices;
 error:
-	mutex_unlock(&orig->device_list_mutex);
 	free_fs_devices(fs_devices);
 	return ERR_PTR(ret);
 }

From d95b50ff07b831495a87eb47dd3a7f23eaec2a40 Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 7 Sep 2021 20:00:09 -0700
Subject: [PATCH 0483/1750] nilfs2: fix memory leak in
 nilfs_sysfs_create_device_group

[ Upstream commit 5f5dec07aca7067216ed4c1342e464e7307a9197 ]

Patch series "nilfs2: fix incorrect usage of kobject".

This patchset from Nanyong Sun fixes memory leak issues and a NULL
pointer dereference issue caused by incorrect usage of kboject in nilfs2
sysfs implementation.

This patch (of 6):

Reported by syzkaller:

  BUG: memory leak
  unreferenced object 0xffff888100ca8988 (size 8):
  comm "syz-executor.1", pid 1930, jiffies 4294745569 (age 18.052s)
  hex dump (first 8 bytes):
  6c 6f 6f 70 31 00 ff ff loop1...
  backtrace:
    kstrdup+0x36/0x70 mm/util.c:60
    kstrdup_const+0x35/0x60 mm/util.c:83
    kvasprintf_const+0xf1/0x180 lib/kasprintf.c:48
    kobject_set_name_vargs+0x56/0x150 lib/kobject.c:289
    kobject_add_varg lib/kobject.c:384 [inline]
    kobject_init_and_add+0xc9/0x150 lib/kobject.c:473
    nilfs_sysfs_create_device_group+0x150/0x7d0 fs/nilfs2/sysfs.c:986
    init_nilfs+0xa21/0xea0 fs/nilfs2/the_nilfs.c:637
    nilfs_fill_super fs/nilfs2/super.c:1046 [inline]
    nilfs_mount+0x7b4/0xe80 fs/nilfs2/super.c:1316
    legacy_get_tree+0x105/0x210 fs/fs_context.c:592
    vfs_get_tree+0x8e/0x2d0 fs/super.c:1498
    do_new_mount fs/namespace.c:2905 [inline]
    path_mount+0xf9b/0x1990 fs/namespace.c:3235
    do_mount+0xea/0x100 fs/namespace.c:3248
    __do_sys_mount fs/namespace.c:3456 [inline]
    __se_sys_mount fs/namespace.c:3433 [inline]
    __x64_sys_mount+0x14b/0x1f0 fs/namespace.c:3433
    do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
    entry_SYSCALL_64_after_hwframe+0x44/0xae

If kobject_init_and_add return with error, then the cleanup of kobject
is needed because memory may be allocated in kobject_init_and_add
without freeing.

And the place of cleanup_dev_kobject should use kobject_put to free the
memory associated with the kobject.  As the section "Kobject removal" of
"Documentation/core-api/kobject.rst" says, kobject_del() just makes the
kobject "invisible", but it is not cleaned up.  And no more cleanup will
do after cleanup_dev_kobject, so kobject_put is needed here.

Link: https://lkml.kernel.org/r/1625651306-10829-1-git-send-email-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/1625651306-10829-2-git-send-email-konishi.ryusuke@gmail.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Link: https://lkml.kernel.org/r/20210629022556.3985106-2-sunnanyong@huawei.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 9c6c0e2e5880..b6a48492fed2 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -999,7 +999,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
 	err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL,
 				    "%s", sb->s_id);
 	if (err)
-		goto free_dev_subgroups;
+		goto cleanup_dev_kobject;
 
 	err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
 	if (err)
@@ -1036,9 +1036,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
 	nilfs_sysfs_delete_mounted_snapshots_group(nilfs);
 
 cleanup_dev_kobject:
-	kobject_del(&nilfs->ns_dev_kobj);
-
-free_dev_subgroups:
+	kobject_put(&nilfs->ns_dev_kobj);
 	kfree(nilfs->ns_dev_subgroups);
 
 failed_create_device_group:

From 0480f7a480bccdd5e747e64365b703105ccae350 Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 7 Sep 2021 20:00:12 -0700
Subject: [PATCH 0484/1750] nilfs2: fix NULL pointer in
 nilfs_##name##_attr_release

[ Upstream commit dbc6e7d44a514f231a64d9d5676e001b660b6448 ]

In nilfs_##name##_attr_release, kobj->parent should not be referenced
because it is a NULL pointer.  The release() method of kobject is always
called in kobject_put(kobj), in the implementation of kobject_put(), the
kobj->parent will be assigned as NULL before call the release() method.
So just use kobj to get the subgroups, which is more efficient and can fix
a NULL pointer reference problem.

Link: https://lkml.kernel.org/r/20210629022556.3985106-3-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-3-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index b6a48492fed2..43f660beb9b4 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -64,11 +64,9 @@ static const struct sysfs_ops nilfs_##name##_attr_ops = { \
 #define NILFS_DEV_INT_GROUP_TYPE(name, parent_name) \
 static void nilfs_##name##_attr_release(struct kobject *kobj) \
 { \
-	struct nilfs_sysfs_##parent_name##_subgroups *subgroups; \
-	struct the_nilfs *nilfs = container_of(kobj->parent, \
-						struct the_nilfs, \
-						ns_##parent_name##_kobj); \
-	subgroups = nilfs->ns_##parent_name##_subgroups; \
+	struct nilfs_sysfs_##parent_name##_subgroups *subgroups = container_of(kobj, \
+						struct nilfs_sysfs_##parent_name##_subgroups, \
+						sg_##name##_kobj); \
 	complete(&subgroups->sg_##name##_kobj_unregister); \
 } \
 static struct kobj_type nilfs_##name##_ktype = { \

From 5acb21e30d85f90b658bae7fb3f53b5e42952292 Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 7 Sep 2021 20:00:15 -0700
Subject: [PATCH 0485/1750] nilfs2: fix memory leak in
 nilfs_sysfs_create_##name##_group

[ Upstream commit 24f8cb1ed057c840728167dab33b32e44147c86f ]

If kobject_init_and_add return with error, kobject_put() is needed here to
avoid memory leak, because kobject_init_and_add may return error without
freeing the memory associated with the kobject it allocated.

Link: https://lkml.kernel.org/r/20210629022556.3985106-4-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-4-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 43f660beb9b4..5dc468ff5903 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -92,8 +92,8 @@ static int nilfs_sysfs_create_##name##_group(struct the_nilfs *nilfs) \
 	err = kobject_init_and_add(kobj, &nilfs_##name##_ktype, parent, \
 				    #name); \
 	if (err) \
-		return err; \
-	return 0; \
+		kobject_put(kobj); \
+	return err; \
 } \
 static void nilfs_sysfs_delete_##name##_group(struct the_nilfs *nilfs) \
 { \

From 5770b54b112e3ea252fc0547dd1fbc5af5c7e7c3 Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 7 Sep 2021 20:00:18 -0700
Subject: [PATCH 0486/1750] nilfs2: fix memory leak in
 nilfs_sysfs_delete_##name##_group

[ Upstream commit a3e181259ddd61fd378390977a1e4e2316853afa ]

The kobject_put() should be used to cleanup the memory associated with the
kobject instead of kobject_del.  See the section "Kobject removal" of
"Documentation/core-api/kobject.rst".

Link: https://lkml.kernel.org/r/20210629022556.3985106-5-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-5-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 5dc468ff5903..34893a57a7b9 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -97,7 +97,7 @@ static int nilfs_sysfs_create_##name##_group(struct the_nilfs *nilfs) \
 } \
 static void nilfs_sysfs_delete_##name##_group(struct the_nilfs *nilfs) \
 { \
-	kobject_del(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \
+	kobject_put(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \
 }
 
 /************************************************************************

From 0f36028d01339976c0d3dd67f11dd99f374f2e49 Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 7 Sep 2021 20:00:21 -0700
Subject: [PATCH 0487/1750] nilfs2: fix memory leak in
 nilfs_sysfs_create_snapshot_group

[ Upstream commit b2fe39c248f3fa4bbb2a20759b4fdd83504190f7 ]

If kobject_init_and_add returns with error, kobject_put() is needed here
to avoid memory leak, because kobject_init_and_add may return error
without freeing the memory associated with the kobject it allocated.

Link: https://lkml.kernel.org/r/20210629022556.3985106-6-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-6-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 34893a57a7b9..44b9ad70a564 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -208,9 +208,9 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
 	}
 
 	if (err)
-		return err;
+		kobject_put(&root->snapshot_kobj);
 
-	return 0;
+	return err;
 }
 
 void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)

From d7736e2faa13b0c0b677b901044d1e21879bd314 Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 7 Sep 2021 20:00:23 -0700
Subject: [PATCH 0488/1750] nilfs2: fix memory leak in
 nilfs_sysfs_delete_snapshot_group

[ Upstream commit 17243e1c3072b8417a5ebfc53065d0a87af7ca77 ]

kobject_put() should be used to cleanup the memory associated with the
kobject instead of kobject_del().  See the section "Kobject removal" of
"Documentation/core-api/kobject.rst".

Link: https://lkml.kernel.org/r/20210629022556.3985106-7-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-7-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nilfs2/sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 44b9ad70a564..57afd06db62d 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -215,7 +215,7 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
 
 void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)
 {
-	kobject_del(&root->snapshot_kobj);
+	kobject_put(&root->snapshot_kobj);
 }
 
 /************************************************************************

From db8838e48a0a7f30bc6d4d6f0f9cd4e2f06c289f Mon Sep 17 00:00:00 2001
From: Ofir Bitton <obitton@habana.ai>
Date: Tue, 20 Jul 2021 09:16:05 +0300
Subject: [PATCH 0489/1750] habanalabs: add validity check for event ID
 received from F/W

[ Upstream commit a6c849012b0f51c674f52384bd9a4f3dc0a33c31 ]

Currently there is no validity check for event ID received from F/W,
Thus exposing driver to memory overrun.

Signed-off-by: Ofir Bitton <obitton@habana.ai>
Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/habanalabs/gaudi/gaudi.c | 6 ++++++
 drivers/misc/habanalabs/goya/goya.c   | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
index 37edd663603f..ebac53a73bd1 100644
--- a/drivers/misc/habanalabs/gaudi/gaudi.c
+++ b/drivers/misc/habanalabs/gaudi/gaudi.c
@@ -5723,6 +5723,12 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
 	u8 cause;
 	bool reset_required;
 
+	if (event_type >= GAUDI_EVENT_SIZE) {
+		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
+				event_type, GAUDI_EVENT_SIZE - 1);
+		return;
+	}
+
 	gaudi->events_stat[event_type]++;
 	gaudi->events_stat_aggregate[event_type]++;
 
diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c
index 5b5d6275c249..c8023b4428c5 100644
--- a/drivers/misc/habanalabs/goya/goya.c
+++ b/drivers/misc/habanalabs/goya/goya.c
@@ -4623,6 +4623,12 @@ void goya_handle_eqe(struct hl_device *hdev, struct hl_eq_entry *eq_entry)
 				>> EQ_CTL_EVENT_TYPE_SHIFT);
 	struct goya_device *goya = hdev->asic_specific;
 
+	if (event_type >= GOYA_ASYNC_EVENT_ID_SIZE) {
+		dev_err(hdev->dev, "Event type %u exceeds maximum of %u",
+				event_type, GOYA_ASYNC_EVENT_ID_SIZE - 1);
+		return;
+	}
+
 	goya->events_stat[event_type]++;
 	goya->events_stat_aggregate[event_type]++;
 

From 0a2ea5c0e5d1076fc189f695f18f6341f58f469d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Wed, 7 Jul 2021 18:27:51 +0200
Subject: [PATCH 0490/1750] pwm: img: Don't modify HW state in .remove()
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c68eb29c8e9067c08175dd0414f6984f236f719d ]

A consumer is expected to disable a PWM before calling pwm_put(). And if
they didn't there is hopefully a good reason (or the consumer needs
fixing). Also if disabling an enabled PWM was the right thing to do,
this should better be done in the framework instead of in each low level
driver.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-img.c | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/drivers/pwm/pwm-img.c b/drivers/pwm/pwm-img.c
index 22c002e685b3..37f9b688661d 100644
--- a/drivers/pwm/pwm-img.c
+++ b/drivers/pwm/pwm-img.c
@@ -329,23 +329,7 @@ static int img_pwm_probe(struct platform_device *pdev)
 static int img_pwm_remove(struct platform_device *pdev)
 {
 	struct img_pwm_chip *pwm_chip = platform_get_drvdata(pdev);
-	u32 val;
-	unsigned int i;
-	int ret;
 
-	ret = pm_runtime_get_sync(&pdev->dev);
-	if (ret < 0) {
-		pm_runtime_put(&pdev->dev);
-		return ret;
-	}
-
-	for (i = 0; i < pwm_chip->chip.npwm; i++) {
-		val = img_pwm_readl(pwm_chip, PWM_CTRL_CFG);
-		val &= ~BIT(i);
-		img_pwm_writel(pwm_chip, PWM_CTRL_CFG, val);
-	}
-
-	pm_runtime_put(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	if (!pm_runtime_status_suspended(&pdev->dev))
 		img_pwm_runtime_suspend(&pdev->dev);

From a6a2b36a8cc45bf9063cdc4bde7434e8eac66ecd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Wed, 7 Jul 2021 18:27:52 +0200
Subject: [PATCH 0491/1750] pwm: rockchip: Don't modify HW state in .remove()
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9d768cd7fd42bb0be16f36aec48548fca5260759 ]

A consumer is expected to disable a PWM before calling pwm_put(). And if
they didn't there is hopefully a good reason (or the consumer needs
fixing). Also if disabling an enabled PWM was the right thing to do,
this should better be done in the framework instead of in each low level
driver.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-rockchip.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c
index 3b8da7b0091b..1f3079562b38 100644
--- a/drivers/pwm/pwm-rockchip.c
+++ b/drivers/pwm/pwm-rockchip.c
@@ -382,20 +382,6 @@ static int rockchip_pwm_remove(struct platform_device *pdev)
 {
 	struct rockchip_pwm_chip *pc = platform_get_drvdata(pdev);
 
-	/*
-	 * Disable the PWM clk before unpreparing it if the PWM device is still
-	 * running. This should only happen when the last PWM user left it
-	 * enabled, or when nobody requested a PWM that was previously enabled
-	 * by the bootloader.
-	 *
-	 * FIXME: Maybe the core should disable all PWM devices in
-	 * pwmchip_remove(). In this case we'd only have to call
-	 * clk_unprepare() after pwmchip_remove().
-	 *
-	 */
-	if (pwm_is_enabled(pc->chip.pwms))
-		clk_disable(pc->clk);
-
 	clk_unprepare(pc->pclk);
 	clk_unprepare(pc->clk);
 

From a2551d0a29e937515a9711b604d88cd1a31c386f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Wed, 7 Jul 2021 18:27:53 +0200
Subject: [PATCH 0492/1750] pwm: stm32-lp: Don't modify HW state in .remove()
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d44084c93427bb0a9261432db1a8ca76a42d805e ]

A consumer is expected to disable a PWM before calling pwm_put(). And if
they didn't there is hopefully a good reason (or the consumer needs
fixing). Also if disabling an enabled PWM was the right thing to do,
this should better be done in the framework instead of in each low level
driver.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pwm/pwm-stm32-lp.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c
index 134c14621ee0..945a8b2b8564 100644
--- a/drivers/pwm/pwm-stm32-lp.c
+++ b/drivers/pwm/pwm-stm32-lp.c
@@ -225,8 +225,6 @@ static int stm32_pwm_lp_remove(struct platform_device *pdev)
 {
 	struct stm32_pwm_lp *priv = platform_get_drvdata(pdev);
 
-	pwm_disable(&priv->chip.pwms[0]);
-
 	return pwmchip_remove(&priv->chip);
 }
 

From 23dfb959c6cbb8346a5143f44a970373fcb4ce8f Mon Sep 17 00:00:00 2001
From: Li Jinlin <lijinlin3@huawei.com>
Date: Tue, 7 Sep 2021 20:12:42 +0800
Subject: [PATCH 0493/1750] blk-throttle: fix UAF by deleteing timer in
 blk_throtl_exit()

[ Upstream commit 884f0e84f1e3195b801319c8ec3d5774e9bf2710 ]

The pending timer has been set up in blk_throtl_init(). However, the
timer is not deleted in blk_throtl_exit(). This means that the timer
handler may still be running after freeing the timer, which would
result in a use-after-free.

Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit().

Signed-off-by: Li Jinlin <lijinlin3@huawei.com>
Link: https://lore.kernel.org/r/20210907121242.2885564-1-lijinlin3@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-throttle.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index 63e9d00a0832..c53a254171a2 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -2452,6 +2452,7 @@ int blk_throtl_init(struct request_queue *q)
 void blk_throtl_exit(struct request_queue *q)
 {
 	BUG_ON(!q->td);
+	del_timer_sync(&q->td->service_queue.pending_timer);
 	throtl_shutdown_wq(q);
 	blkcg_deactivate_policy(q, &blkcg_policy_throtl);
 	free_percpu(q->td->latency_buckets[READ]);

From 9a14014df72d00d87a199e1f77896f7ea62cc126 Mon Sep 17 00:00:00 2001
From: Song Liu <songliubraving@fb.com>
Date: Tue, 7 Sep 2021 16:03:38 -0700
Subject: [PATCH 0494/1750] blk-mq: allow 4x BLK_MAX_REQUEST_COUNT at blk_plug
 for multiple_queues

[ Upstream commit 7f2a6a69f7ced6db8220298e0497cf60482a9d4b ]

Limiting number of request to BLK_MAX_REQUEST_COUNT at blk_plug hurts
performance for large md arrays. [1] shows resync speed of md array drops
for md array with more than 16 HDDs.

Fix this by allowing more request at plug queue. The multiple_queue flag
is used to only apply higher limit to multiple queue cases.

[1] https://lore.kernel.org/linux-raid/CAFDAVznS71BXW8Jxv6k9dXc2iR3ysX3iZRBww_rzA8WifBFxGg@mail.gmail.com/
Tested-by: Marcin Wanat <marcin.wanat@gmail.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 9e3fedbaa644..6dcb86c1c985 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2109,6 +2109,18 @@ static void blk_add_rq_to_plug(struct blk_plug *plug, struct request *rq)
 	}
 }
 
+/*
+ * Allow 4x BLK_MAX_REQUEST_COUNT requests on plug queue for multiple
+ * queues. This is important for md arrays to benefit from merging
+ * requests.
+ */
+static inline unsigned short blk_plug_max_rq_count(struct blk_plug *plug)
+{
+	if (plug->multiple_queues)
+		return BLK_MAX_REQUEST_COUNT * 4;
+	return BLK_MAX_REQUEST_COUNT;
+}
+
 /**
  * blk_mq_submit_bio - Create and send a request to block device.
  * @bio: Bio pointer.
@@ -2202,7 +2214,7 @@ blk_qc_t blk_mq_submit_bio(struct bio *bio)
 		else
 			last = list_entry_rq(plug->mq_list.prev);
 
-		if (request_count >= BLK_MAX_REQUEST_COUNT || (last &&
+		if (request_count >= blk_plug_max_rq_count(plug) || (last &&
 		    blk_rq_bytes(last) >= BLK_PLUG_FLUSH_SIZE)) {
 			blk_flush_plug_list(plug, false);
 			trace_block_plug(q);

From 647c19bc61023b305389f5b027b2f7edab0feca2 Mon Sep 17 00:00:00 2001
From: Yu-Tung Chang <mtwget@gmail.com>
Date: Mon, 30 Aug 2021 13:25:32 +0800
Subject: [PATCH 0495/1750] rtc: rx8010: select REGMAP_I2C

[ Upstream commit 0c45d3e24ef3d3d87c5e0077b8f38d1372af7176 ]

The rtc-rx8010 uses the I2C regmap but doesn't select it in Kconfig so
depending on the configuration the build may fail. Fix it.

Signed-off-by: Yu-Tung Chang <mtwget@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20210830052532.40356-1-mtwget@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 33e4ecd6c665..54cf5ec8f401 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -624,6 +624,7 @@ config RTC_DRV_FM3130
 
 config RTC_DRV_RX8010
 	tristate "Epson RX8010SJ"
+	select REGMAP_I2C
 	help
 	  If you say yes here you get support for the Epson RX8010SJ RTC
 	  chip.

From 83a3cb200effb8f61d51516bd64fd94dea4c7805 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Mon, 6 Sep 2021 13:30:34 +0200
Subject: [PATCH 0496/1750] sched/idle: Make the idle timer expire in hard
 interrupt context

[ Upstream commit 9848417926353daa59d2b05eb26e185063dbac6e ]

The intel powerclamp driver will setup a per-CPU worker with RT
priority. The worker will then invoke play_idle() in which it remains in
the idle poll loop until it is stopped by the timer it started earlier.

That timer needs to expire in hard interrupt context on PREEMPT_RT.
Otherwise the timer will expire in ksoftirqd as a SOFT timer but that task
won't be scheduled on the CPU because its priority is lower than the
priority of the worker which is in the idle loop.

Always expire the idle timer in hard interrupt context.

Reported-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210906113034.jgfxrjdvxnjqgtmc@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/idle.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 36b545f17206..2593a733c084 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -372,10 +372,10 @@ void play_idle_precise(u64 duration_ns, u64 latency_ns)
 	cpuidle_use_deepest_state(latency_ns);
 
 	it.done = 0;
-	hrtimer_init_on_stack(&it.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+	hrtimer_init_on_stack(&it.timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD);
 	it.timer.function = idle_inject_timer_fn;
 	hrtimer_start(&it.timer, ns_to_ktime(duration_ns),
-		      HRTIMER_MODE_REL_PINNED);
+		      HRTIMER_MODE_REL_PINNED_HARD);
 
 	while (!READ_ONCE(it.done))
 		do_idle();

From 7c09505e9e6b1461cddf7c85fdb4f4ff1cc3fd23 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 8 Sep 2021 12:08:17 -0700
Subject: [PATCH 0497/1750] drm/nouveau/nvkm: Replace -ENOSYS with -ENODEV

commit e8f71f89236ef82d449991bfbc237e3cb6ea584f upstream.

nvkm test builds fail with the following error.

  drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c: In function 'nvkm_control_mthd_pstate_info':
  drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c:60:35: error: overflow in conversion from 'int' to '__s8' {aka 'signed char'} changes value from '-251' to '5'

The code builds on most architectures, but fails on parisc where ENOSYS
is defined as 251.

Replace the error code with -ENODEV (-19).  The actual error code does
not really matter and is not passed to userspace - it just has to be
negative.

Fixes: 7238eca4cf18 ("drm/nouveau: expose pstate selection per-power source in sysfs")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c
index b0ece71aefde..ce774579c89d 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c
@@ -57,7 +57,7 @@ nvkm_control_mthd_pstate_info(struct nvkm_control *ctrl, void *data, u32 size)
 		args->v0.count = 0;
 		args->v0.ustate_ac = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE;
 		args->v0.ustate_dc = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE;
-		args->v0.pwrsrc = -ENOSYS;
+		args->v0.pwrsrc = -ENODEV;
 		args->v0.pstate = NVIF_CONTROL_PSTATE_INFO_V0_PSTATE_UNKNOWN;
 	}
 

From 5f4196eaa90c139ac470111b8e2deabf5f283baa Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 26 Sep 2021 14:09:02 +0200
Subject: [PATCH 0498/1750] Linux 5.10.69

Link: https://lore.kernel.org/r/20210924124334.228235870@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Link: https://lore.kernel.org/r/20210925120750.056868347@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e50581c9db50..e14943205b83 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 68
+SUBLEVEL = 69
 EXTRAVERSION =
 NAME = Dare mighty things
 

From f04036b092ee7f50f0279e2a3909c9c1f899725b Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 29 Sep 2021 13:28:28 +0200
Subject: [PATCH 0499/1750] ANDROID: GKI: update .xml file to handle previous
 issues

The .xml file has been updated incorrectly somehow, as developers use
LTO=thin and treehugger uses LTO=full.  This can cause problems
sometimes when dealing with some types.

So update the .xml file again, with LTO=full to get rid of the current
difference to allow future real api changes to show up properly.

The root cause is being worked on, but for now, this update is required
to allow LTS updates to move forward.  No real ABI changes are happening
here at all, this is ONLY a .xml file update to make the tools happy.

Functions changes summary: 0 Removed, 6 Changed (4103 filtered out), 0 Added functions
Variables changes summary: 0 Removed, 0 Changed (355 filtered out), 0 Added variables

6 functions with some indirect sub-type change:

  [C] 'function int migrate_pages(list_head*, page* (page*, unsigned long int)*, void (page*, unsigned long int)*, unsigned long int, migrate_mode, int)' at migrate.c:1391:1 has some indirect sub-type changes:
    parameter 2 of type 'page* (page*, unsigned long int)*' has sub-type changes:
      in pointed to type 'function type page* (page*, unsigned long int)' at migrate.h:10:1:
        entity changed from 'function type page* (page*, unsigned long int)' to 'typedef new_page_t' at migrate.h:10:1
        type size hasn't changed
    parameter 3 of type 'void (page*, unsigned long int)*' has sub-type changes:
      in pointed to type 'function type void (page*, unsigned long int)' at migrate.h:11:1:
        entity changed from 'function type void (page*, unsigned long int)' to 'typedef free_page_t' at migrate.h:11:1
        type size hasn't changed

  [C] 'function __kernel_old_timeval ns_to_kernel_old_timeval(long long int)' at time.c:452:1 has some indirect sub-type changes:
    parameter 1 of type 'long long int' changed:
      entity changed from 'long long int' to 'const s64'
      type size hasn't changed

  [C] 'function timespec64 ns_to_timespec64(long long int)' at time.c:506:1 has some indirect sub-type changes:
    parameter 1 of type 'long long int' changed:
      entity changed from 'long long int' to 'const s64'
      type size hasn't changed

  [C] 'function void percpu_ref_kill_and_confirm(percpu_ref*, void (percpu_ref*)*)' at percpu-refcount.c:375:1 has some indirect sub-type changes:
    parameter 2 of type 'void (percpu_ref*)*' changed:
      in pointed to type 'function type void (percpu_ref*)' at percpu-refcount.h:60:1:
        entity changed from 'function type void (percpu_ref*)' to 'typedef percpu_ref_func_t' at percpu-refcount.h:60:1
        type size hasn't changed

  [C] 'function int request_threaded_irq(unsigned int, enum irqreturn (int, void*)*, enum irqreturn (int, void*)*, unsigned long int, const char*, void*)' at manage.c:2007:1 has some indirect sub-type changes:
    parameter 2 of type 'enum irqreturn (int, void*)*' changed:
      entity changed from 'enum irqreturn (int, void*)*' to compatible type 'typedef irq_handler_t' at interrupt.h:92:1
    parameter 3 of type 'enum irqreturn (int, void*)*' changed:
      entity changed from 'enum irqreturn (int, void*)*' to compatible type 'typedef irq_handler_t' at interrupt.h:92:1

  [C] 'function void unmap_mapping_range(address_space*, long long int, long long int, int)' at memory.c:3548:1 has some indirect sub-type changes:
    parameter 2 of type 'long long int' changed:
      entity changed from 'long long int' to 'const loff_t'
      type size hasn't changed
    parameter 3 of type 'long long int' changed:
      entity changed from 'long long int' to 'const loff_t'
      type size hasn't changed

Bug: 210255585
Cc: Giuliano Procida <gprocida@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I73c2435d37d6b32257d35ccc559e36956108917a
---
 android/abi_gki_aarch64.xml | 10321 +++++++++++++++++-----------------
 1 file changed, 5072 insertions(+), 5249 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index b4d1bc964601..3688e997b2cc 100755
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -8178,9 +8178,9 @@
         <return type-id='48b5725f'/>
       </function-type>
       <function-type size-in-bits='64' id='07cce116'>
-        <parameter type-id='723d4d79'/>
-        <parameter type-id='c21baddd'/>
-        <parameter type-id='7c3e509a'/>
+        <parameter type-id='723d4d79' name='bdev'/>
+        <parameter type-id='c21baddd' name='ttm'/>
+        <parameter type-id='7c3e509a' name='ctx'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='fc87d78f' size-in-bits='64' id='07d0a3e7'/>
@@ -8193,7 +8193,6 @@
       </function-type>
       <pointer-type-def type-id='f8a4685d' size-in-bits='64' id='07df1a3d'/>
       <pointer-type-def type-id='6a0fd5a6' size-in-bits='64' id='07e65680'/>
-      <pointer-type-def type-id='ae5a8333' size-in-bits='64' id='07e9eb27'/>
       <pointer-type-def type-id='56731789' size-in-bits='64' id='07ebb4cd'/>
       <typedef-decl name='rht_hashfn_t' type-id='bc00c03b' filepath='include/linux/rhashtable-types.h' line='38' column='1' id='07fa0d18'/>
       <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/asm-generic/siginfo.h' line='104' column='1' id='07fe0781'>
@@ -8275,7 +8274,6 @@
       <pointer-type-def type-id='0d8f8c87' size-in-bits='64' id='086f0793'/>
       <pointer-type-def type-id='1d6846fa' size-in-bits='64' id='0871ecbc'/>
       <pointer-type-def type-id='ff1c7c9b' size-in-bits='64' id='087d687b'/>
-      <pointer-type-def type-id='96650caf' size-in-bits='64' id='08873c53'/>
       <class-decl name='uclamp_se' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/linux/sched.h' line='631' column='1' id='0888126c'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='value' type-id='f0981eeb' visibility='default' filepath='include/linux/sched.h' line='632' column='1'/>
@@ -8685,7 +8683,14 @@
         <enumerator name='MDIOBUS_C45' value='2'/>
         <enumerator name='MDIOBUS_C22_C45' value='3'/>
       </enum-decl>
-      <enum-decl name='__anonymous_enum__' is-anonymous='yes' filepath='include/net/bluetooth/hci_core.h' line='66' column='1' id='08f5ca1d'>
+      <enum-decl name='__anonymous_enum__' is-anonymous='yes' filepath='include/drm/ttm/ttm_bo_api.h' line='187' column='1' id='08f5ca1d'>
+        <underlying-type type-id='9cac1fee'/>
+        <enumerator name='ttm_bo_map_iomap' value='129'/>
+        <enumerator name='ttm_bo_map_vmap' value='2'/>
+        <enumerator name='ttm_bo_map_kmap' value='3'/>
+        <enumerator name='ttm_bo_map_premapped' value='132'/>
+      </enum-decl>
+      <enum-decl name='__anonymous_enum__' is-anonymous='yes' filepath='include/net/bluetooth/hci_core.h' line='66' column='1' id='08f5ca1e'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='DISCOVERY_STOPPED' value='0'/>
         <enumerator name='DISCOVERY_STARTING' value='1'/>
@@ -8693,13 +8698,6 @@
         <enumerator name='DISCOVERY_RESOLVING' value='3'/>
         <enumerator name='DISCOVERY_STOPPING' value='4'/>
       </enum-decl>
-      <enum-decl name='__anonymous_enum__' is-anonymous='yes' filepath='include/drm/ttm/ttm_bo_api.h' line='187' column='1' id='08f5ca1e'>
-        <underlying-type type-id='9cac1fee'/>
-        <enumerator name='ttm_bo_map_iomap' value='129'/>
-        <enumerator name='ttm_bo_map_vmap' value='2'/>
-        <enumerator name='ttm_bo_map_kmap' value='3'/>
-        <enumerator name='ttm_bo_map_premapped' value='132'/>
-      </enum-decl>
       <typedef-decl name='efi_memory_desc_t' type-id='60cb14c6' filepath='include/linux/efi.h' line='142' column='1' id='08f73f9b'/>
       <class-decl name='tcp_options_received' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/tcp.h' line='82' column='1' id='08f80c5d'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -11068,6 +11066,7 @@
         <parameter type-id='7359adad'/>
         <return type-id='7359adad'/>
       </function-type>
+      <pointer-type-def type-id='cba59087' size-in-bits='64' id='0fb09eeb'/>
       <pointer-type-def type-id='5257f496' size-in-bits='64' id='0fb373c0'/>
       <pointer-type-def type-id='c968032b' size-in-bits='64' id='0fbcba93'/>
       <pointer-type-def type-id='ae8bfcdd' size-in-bits='64' id='0fbf3cfd'/>
@@ -11419,8 +11418,8 @@
       </function-type>
       <pointer-type-def type-id='5e5241e2' size-in-bits='64' id='10b92604'/>
       <function-type size-in-bits='64' id='10c448af'>
-        <parameter type-id='00cf0c80' name='pc'/>
-        <parameter type-id='af02a266' name='args'/>
+        <parameter type-id='00cf0c80'/>
+        <parameter type-id='af02a266'/>
         <return type-id='f06adae0'/>
       </function-type>
       <pointer-type-def type-id='fdc939a7' size-in-bits='64' id='10c598f7'/>
@@ -12036,7 +12035,23 @@
         <parameter type-id='f7b0e1b4'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <class-decl name='drm_self_refresh_data' is-struct='yes' visibility='default' is-declaration-only='yes' id='12506762'/>
+      <class-decl name='drm_self_refresh_data' size-in-bits='1664' is-struct='yes' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='58' column='1' id='12506762'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='crtc' type-id='b64ad7cb' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='59' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='entry_work' type-id='5ad6e0ef' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='60' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1152'>
+          <var-decl name='avg_mutex' type-id='925167dc' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='62' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1536'>
+          <var-decl name='entry_avg_ms' type-id='6e15744f' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='63' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1600'>
+          <var-decl name='exit_avg_ms' type-id='6e15744f' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='64' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='v4l2_event_subscription' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2413' column='1' id='1251351e'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2414' column='1'/>
@@ -12634,6 +12649,7 @@
           <var-decl name='slots' type-id='5b559658' visibility='default' filepath='include/linux/keyslot-manager.h' line='105' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='d61bf978' size-in-bits='64' id='14061e47'/>
       <pointer-type-def type-id='772a4ddf' size-in-bits='64' id='141b6427'/>
       <class-decl name='neigh_parms' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/net/neighbour.h' line='71' column='1' id='1429eee4'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -14181,12 +14197,6 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d34384db' size-in-bits='64' id='17451907'/>
-      <function-type size-in-bits='64' id='17483488'>
-        <parameter type-id='e579788a'/>
-        <parameter type-id='2ae08426'/>
-        <parameter type-id='d02f4143'/>
-        <return type-id='e9265215'/>
-      </function-type>
       <function-type size-in-bits='64' id='174aa761'>
         <parameter type-id='69a866d8'/>
         <parameter type-id='f9b06939'/>
@@ -14656,6 +14666,9 @@
       </array-type-def>
       <pointer-type-def type-id='32406f0a' size-in-bits='64' id='187ae308'/>
       <pointer-type-def type-id='22b04425' size-in-bits='64' id='187c2c79'/>
+      <array-type-def dimensions='1' type-id='7359adad' size-in-bits='8192' id='187c43b2'>
+        <subrange length='128' type-id='7ff19f0f' id='1eb1687a'/>
+      </array-type-def>
       <function-type size-in-bits='64' id='187fa8c7'>
         <parameter type-id='6dca061b'/>
         <parameter type-id='4c98e95d'/>
@@ -14850,7 +14863,29 @@
           <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/fs.h' line='1035' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='cgroup_taskset' is-struct='yes' visibility='default' is-declaration-only='yes' id='19596889'/>
+      <class-decl name='cgroup_taskset' size-in-bits='512' is-struct='yes' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='89' column='1' id='19596889'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='src_csets' type-id='72f469ec' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='91' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='dst_csets' type-id='72f469ec' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='92' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='nr_tasks' type-id='95e97e5e' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='95' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='288'>
+          <var-decl name='ssid' type-id='95e97e5e' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='98' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='csets' type-id='e84b031a' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='111' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='cur_cset' type-id='85d57723' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='112' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='cur_task' type-id='f23e2572' visibility='default' filepath='kernel/cgroup/cgroup-internal.h' line='113' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='195ce0ad'>
         <parameter type-id='69a866d8'/>
         <return type-id='48b5725f'/>
@@ -17708,7 +17743,6 @@
           <var-decl name='reserved' type-id='3faaea70' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2480' column='1'/>
         </data-member>
       </class-decl>
-      <pointer-type-def type-id='5824bc76' size-in-bits='64' id='20d19810'/>
       <function-type size-in-bits='64' id='20d6a08a'>
         <parameter type-id='88a6d23d'/>
         <return type-id='48b5725f'/>
@@ -18082,11 +18116,7 @@
       </class-decl>
       <qualified-type-def type-id='a9cdb48b' const='yes' id='220a92c2'/>
       <qualified-type-def type-id='47692c1a' const='yes' id='2212bd2d'/>
-      <class-decl name='internal_state' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/linux/zlib.h' line='592' column='1' id='221461a6'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dummy' type-id='95e97e5e' visibility='default' filepath='include/linux/zlib.h' line='592' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='internal_state' is-struct='yes' visibility='default' is-declaration-only='yes' id='221461a6'/>
       <pointer-type-def type-id='cd6fc142' size-in-bits='64' id='221c3010'/>
       <pointer-type-def type-id='345f1a5f' size-in-bits='64' id='2227a3ab'/>
       <pointer-type-def type-id='359a7eea' size-in-bits='64' id='22358840'/>
@@ -19033,7 +19063,6 @@
       </class-decl>
       <pointer-type-def type-id='5ad3f0d0' size-in-bits='64' id='249ef586'/>
       <qualified-type-def type-id='4d1a8c39' const='yes' id='24a174c6'/>
-      <pointer-type-def type-id='d19a2f20' size-in-bits='64' id='24a339f6'/>
       <array-type-def dimensions='1' type-id='91ce1af9' size-in-bits='128' id='24a375b2'>
         <subrange length='2' type-id='7ff19f0f' id='52efc4ef'/>
       </array-type-def>
@@ -19100,7 +19129,6 @@
         <parameter type-id='ecb0ce18'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='17483488' size-in-bits='64' id='24e78d82'/>
       <function-type size-in-bits='64' id='24f3731d'>
         <parameter type-id='fa0b179b'/>
         <parameter type-id='29d28711'/>
@@ -19538,14 +19566,6 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='117b6b23' size-in-bits='64' id='25c6126f'/>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/cfg802154.h' line='233' column='1' id='25cb4d60'>
-        <data-member access='public'>
-          <var-decl name='short_addr' type-id='23119536' visibility='default' filepath='include/net/cfg802154.h' line='234' column='1'/>
-        </data-member>
-        <data-member access='public'>
-          <var-decl name='extended_addr' type-id='a30e8d1f' visibility='default' filepath='include/net/cfg802154.h' line='235' column='1'/>
-        </data-member>
-      </union-decl>
       <class-decl name='xhci_ep_ctx' size-in-bits='256' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='704' column='1' id='25cf7d45'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='ep_info' type-id='2f162548' visibility='default' filepath='drivers/usb/host/xhci.h' line='705' column='1'/>
@@ -19896,7 +19916,7 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='ecabee4c' size-in-bits='64' id='268afde6'/>
-      <qualified-type-def type-id='61227239' const='yes' id='268fa5d8'/>
+      <qualified-type-def type-id='61227238' const='yes' id='268fa5d8'/>
       <pointer-type-def type-id='066f541d' size-in-bits='64' id='26989ff9'/>
       <qualified-type-def type-id='16e7829f' const='yes' id='269d8092'/>
       <function-type size-in-bits='64' id='26a5fedd'>
@@ -20607,6 +20627,7 @@
       </function-type>
       <pointer-type-def type-id='67d8ed84' size-in-bits='64' id='287e28ea'/>
       <pointer-type-def type-id='d72e913e' size-in-bits='64' id='287e3e50'/>
+      <typedef-decl name='key_ref_t' type-id='446f28fb' filepath='include/linux/key.h' line='147' column='1' id='28804ffa'/>
       <union-decl name='key_payload' size-in-bits='256' visibility='default' filepath='include/linux/key.h' line='128' column='1' id='2888d74a'>
         <data-member access='public'>
           <var-decl name='rcu_data0' type-id='eaa32e2f' visibility='default' filepath='include/linux/key.h' line='129' column='1'/>
@@ -21347,6 +21368,11 @@
       <array-type-def dimensions='1' type-id='3158a266' size-in-bits='8160' id='29cc01cd'>
         <subrange length='255' type-id='7ff19f0f' id='36e7f891'/>
       </array-type-def>
+      <function-type size-in-bits='64' id='29ce7f43'>
+        <parameter type-id='f23e2572'/>
+        <parameter type-id='95e97e5e'/>
+        <return type-id='b50a4934'/>
+      </function-type>
       <function-type size-in-bits='64' id='29cf1864'>
         <parameter type-id='68a2d05b'/>
         <parameter type-id='c2074578'/>
@@ -23359,7 +23385,7 @@
       <qualified-type-def type-id='5b3ea0c8' const='yes' id='2fecddf7'/>
       <pointer-type-def type-id='d0b77cf6' size-in-bits='64' id='2fed99fc'/>
       <function-type size-in-bits='64' id='2fedb035'>
-        <parameter type-id='0cb0b26f'/>
+        <parameter type-id='0cb0b26f' name='hwlock'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='3ae87f87' size-in-bits='64' id='2feec21f'/>
@@ -23563,6 +23589,7 @@
         <parameter type-id='bccad679'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='d3130597' size-in-bits='64' id='30dcd536'/>
       <pointer-type-def type-id='f1415d4d' size-in-bits='64' id='30e60925'/>
       <pointer-type-def type-id='63e171df' size-in-bits='64' id='30e664af'/>
       <function-type size-in-bits='64' id='30e75f3e'>
@@ -23867,7 +23894,23 @@
         <parameter type-id='001b67aa'/>
         <return type-id='79a0948f'/>
       </function-type>
-      <class-decl name='mctrl_gpios' is-struct='yes' visibility='default' is-declaration-only='yes' id='31bf052e'/>
+      <class-decl name='mctrl_gpios' size-in-bits='704' is-struct='yes' visibility='default' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='19' column='1' id='31bf052e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='port' type-id='af051c69' visibility='default' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='20' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='gpio' type-id='e83fe618' visibility='default' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='21' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='irq' type-id='e41bdf22' visibility='default' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='22' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='mctrl_prev' type-id='f0981eeb' visibility='default' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='23' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='672'>
+          <var-decl name='mctrl_on' type-id='b50a4934' visibility='default' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='24' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='23a55350' size-in-bits='64' id='31ca1cfa'/>
       <pointer-type-def type-id='e0d0028a' size-in-bits='64' id='31cc9254'/>
       <pointer-type-def type-id='c69a48a7' size-in-bits='64' id='31e035f7'/>
@@ -24510,7 +24553,7 @@
       </function-type>
       <pointer-type-def type-id='cbc88d4a' size-in-bits='64' id='339c87e8'/>
       <function-type size-in-bits='64' id='339cba5e'>
-        <parameter type-id='0c2c419d'/>
+        <parameter type-id='0c2c419d' name='iovad'/>
         <return type-id='48b5725f'/>
       </function-type>
       <class-decl name='__anonymous_struct__' size-in-bits='192' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/netdevice.h' line='917' column='1' id='33bba89f'>
@@ -24859,7 +24902,6 @@
         <parameter type-id='4a935625'/>
         <return type-id='4a935625'/>
       </function-type>
-      <pointer-type-def type-id='53fb272e' size-in-bits='64' id='34e69a54'/>
       <class-decl name='in_addr' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/in.h' line='89' column='1' id='34f03654'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='s_addr' type-id='78a133c2' visibility='default' filepath='include/uapi/linux/in.h' line='90' column='1'/>
@@ -24937,7 +24979,7 @@
         <return type-id='48b5725f'/>
       </function-type>
       <function-type size-in-bits='64' id='35213710'>
-        <parameter type-id='97fbef77'/>
+        <parameter type-id='97fbef77' name='serdev'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='79ba66e0' size-in-bits='64' id='352b95f6'/>
@@ -24994,6 +25036,7 @@
           <var-decl name='smark' type-id='0084df72' visibility='default' filepath='include/net/xfrm.h' line='184' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='e61ec55f' size-in-bits='64' id='355404d0'/>
       <function-type size-in-bits='64' id='3554a6c7'>
         <parameter type-id='ac2666b2'/>
         <parameter type-id='eaa32e2f'/>
@@ -25344,6 +25387,7 @@
           <var-decl name='downmix' type-id='3f1a6b60' visibility='default' filepath='include/uapi/sound/compress_params.h' line='277' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='59efae17' size-in-bits='64' id='369435a4'/>
       <class-decl name='s3_save' size-in-bits='384' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1686' column='1' id='369534b9'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='command' type-id='19c2251e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1687' column='1'/>
@@ -26900,7 +26944,6 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='cc2d5b01' size-in-bits='64' id='3aa8795d'/>
-      <qualified-type-def type-id='f0136291' const='yes' id='3aa8a3a4'/>
       <pointer-type-def type-id='cf8d7d81' size-in-bits='64' id='3aaeef89'/>
       <qualified-type-def type-id='c571b65b' const='yes' id='3ab32f02'/>
       <pointer-type-def type-id='fa4d7704' size-in-bits='64' id='3ab7d422'/>
@@ -30591,9 +30634,9 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='44b564e4'>
-        <parameter type-id='a585cbc4' name='tfm'/>
-        <parameter type-id='bbaf3419' name='key'/>
-        <parameter type-id='f0981eeb' name='keylen'/>
+        <parameter type-id='a585cbc4'/>
+        <parameter type-id='bbaf3419'/>
+        <parameter type-id='f0981eeb'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='9281c70f' size-in-bits='64' id='44bef697'/>
@@ -31467,7 +31510,6 @@
           <var-decl name='size' type-id='d3130597' visibility='default' filepath='include/uapi/drm/drm_mode.h' line='813' column='1'/>
         </data-member>
       </class-decl>
-      <pointer-type-def type-id='faa28adf' size-in-bits='64' id='46d78c8b'/>
       <pointer-type-def type-id='5ee42ab3' size-in-bits='64' id='46eaf6b3'/>
       <qualified-type-def type-id='2eec6999' const='yes' id='46f53066'/>
       <array-type-def dimensions='1' type-id='19c2251e' size-in-bits='544' id='46fc18d9'>
@@ -31722,7 +31764,68 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='32197ce9' size-in-bits='64' id='47877f81'/>
-      <class-decl name='gs_port' is-struct='yes' visibility='default' is-declaration-only='yes' id='4788f063'/>
+      <class-decl name='gs_port' size-in-bits='6016' is-struct='yes' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='98' column='1' id='4788f063'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='port' type-id='7e1e521a' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='99' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3392'>
+          <var-decl name='port_lock' type-id='fb4018a0' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='100' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3456'>
+          <var-decl name='port_usb' type-id='3921c1a0' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='102' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3520'>
+          <var-decl name='port_num' type-id='f9b06939' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='107' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3584'>
+          <var-decl name='read_pool' type-id='72f469ec' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='109' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3712'>
+          <var-decl name='read_started' type-id='95e97e5e' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='110' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3744'>
+          <var-decl name='read_allocated' type-id='95e97e5e' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='111' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3776'>
+          <var-decl name='read_queue' type-id='72f469ec' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='112' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3904'>
+          <var-decl name='n_read' type-id='f0981eeb' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='113' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3968'>
+          <var-decl name='push' type-id='5ad6e0ef' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='114' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5056'>
+          <var-decl name='write_pool' type-id='72f469ec' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='116' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5184'>
+          <var-decl name='write_started' type-id='95e97e5e' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='117' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5216'>
+          <var-decl name='write_allocated' type-id='95e97e5e' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='118' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5248'>
+          <var-decl name='port_write_buf' type-id='7664edcc' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='119' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5440'>
+          <var-decl name='drain_wait' type-id='b5ab048f' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='120' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5632'>
+          <var-decl name='write_busy' type-id='b50a4934' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='121' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5696'>
+          <var-decl name='close_wait' type-id='b5ab048f' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='122' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5888'>
+          <var-decl name='suspended' type-id='b50a4934' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='123' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5896'>
+          <var-decl name='start_delayed' type-id='b50a4934' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='124' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5904'>
+          <var-decl name='port_line_coding' type-id='d4a32434' visibility='default' filepath='drivers/usb/gadget/function/u_serial.c' line='127' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='deferred_freelist_item' size-in-bits='256' is-struct='yes' visibility='default' filepath='drivers/dma-buf/heaps/deferred-free-helper.h' line='37' column='1' id='479592e1'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='nr_pages' type-id='b59d7dce' visibility='default' filepath='drivers/dma-buf/heaps/deferred-free-helper.h' line='38' column='1'/>
@@ -32226,7 +32329,6 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='f4c2725e' size-in-bits='64' id='498944b4'/>
-      <pointer-type-def type-id='6cb6dd61' size-in-bits='64' id='498d7045'/>
       <pointer-type-def type-id='0e15337c' size-in-bits='64' id='498f47da'/>
       <function-type size-in-bits='64' id='4993d1b5'>
         <parameter type-id='4dfe71de'/>
@@ -32641,6 +32743,7 @@
           <var-decl name='data' type-id='e84913bd' visibility='default' filepath='include/linux/kprobes.h' line='167' column='1'/>
         </data-member>
       </class-decl>
+      <typedef-decl name='dr_match_t' type-id='7e69f315' filepath='include/linux/device.h' line='167' column='1' id='4a798fcf'/>
       <class-decl name='uio_port' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/uio_driver.h' line='60' column='1' id='4a82abb2'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/uio_driver.h' line='61' column='1'/>
@@ -36382,7 +36485,6 @@
         <parameter type-id='b7c1d7d5'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='f106d0e5' size-in-bits='64' id='538ece95'/>
       <qualified-type-def type-id='b4470bcd' const='yes' id='5392630e'/>
       <pointer-type-def type-id='1d8506ad' size-in-bits='64' id='53955211'/>
       <pointer-type-def type-id='10216dc5' size-in-bits='64' id='53a00f3d'/>
@@ -37172,8 +37274,8 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='54faec06'>
-        <parameter type-id='723d4d79' name='bdev'/>
-        <parameter type-id='c21baddd' name='ttm'/>
+        <parameter type-id='723d4d79'/>
+        <parameter type-id='c21baddd'/>
         <return type-id='48b5725f'/>
       </function-type>
       <class-decl name='i3c_ccc_cmd_dest' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/i3c/ccc.h' line='361' column='1' id='55059246'>
@@ -38096,17 +38198,6 @@
       <pointer-type-def type-id='92a295b4' size-in-bits='64' id='57c9915e'/>
       <pointer-type-def type-id='f2dcb698' size-in-bits='64' id='57ca5882'/>
       <pointer-type-def type-id='2b4e6dbe' size-in-bits='64' id='57d10d30'/>
-      <class-decl name='ieee802154_addr' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/net/cfg802154.h' line='230' column='1' id='57d8dd3d'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='mode' type-id='f9b06939' visibility='default' filepath='include/net/cfg802154.h' line='231' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='pan_id' type-id='23119536' visibility='default' filepath='include/net/cfg802154.h' line='232' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='' type-id='25cb4d60' visibility='default' filepath='include/net/cfg802154.h' line='233' column='1'/>
-        </data-member>
-      </class-decl>
       <enum-decl name='thermal_trip_type' filepath='include/uapi/linux/thermal.h' line='12' column='1' id='57e8e954'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='THERMAL_TRIP_ACTIVE' value='0'/>
@@ -38385,9 +38476,9 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='58c82a2b'>
-        <parameter type-id='fc4f83c1'/>
-        <parameter type-id='ab85b8f2'/>
-        <parameter type-id='3eb7c31c'/>
+        <parameter type-id='fc4f83c1' name='hcd'/>
+        <parameter type-id='ab85b8f2' name='urb'/>
+        <parameter type-id='3eb7c31c' name='mem_flags'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='514d8c48' size-in-bits='64' id='58cfaa0e'/>
@@ -38893,6 +38984,7 @@
           <var-decl name='pdata' type-id='616ec7d2' visibility='default' filepath='include/media/v4l2-subdev.h' line='889' column='1'/>
         </data-member>
       </class-decl>
+      <typedef-decl name='z_stream' type-id='d19a2f20' filepath='include/linux/zlib.h' line='101' column='1' id='59efae17'/>
       <pointer-type-def type-id='7a7ea727' size-in-bits='64' id='59f1923f'/>
       <enum-decl name='drm_panel_orientation' filepath='include/drm/drm_connector.h' line='249' column='1' id='59f3d325'>
         <underlying-type type-id='9cac1fee'/>
@@ -39849,7 +39941,6 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='86607661' size-in-bits='64' id='5afa70dd'/>
-      <pointer-type-def type-id='bb1a67f7' size-in-bits='64' id='5afbd3c3'/>
       <pointer-type-def type-id='537d88b1' size-in-bits='64' id='5afdaa66'/>
       <array-type-def dimensions='1' type-id='7799da43' size-in-bits='256' id='5b02a6fc'>
         <subrange length='2' type-id='7ff19f0f' id='52efc4ef'/>
@@ -42281,15 +42372,7 @@
         <parameter type-id='18d76f87'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <function-type size-in-bits='64' id='60a1cbff'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='3a47d82b'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <pointer-type-def type-id='c46c1f27' size-in-bits='64' id='60a257ef'/>
-      <array-type-def dimensions='1' type-id='e7d2a5fc' size-in-bits='infinite' id='60a540a8'>
-        <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
-      </array-type-def>
       <class-decl name='snd_dec_flac' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/sound/compress_params.h' line='325' column='1' id='60b3851a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='sample_size' type-id='d315442e' visibility='default' filepath='include/uapi/sound/compress_params.h' line='326' column='1'/>
@@ -42626,18 +42709,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='b35335c8' size-in-bits='64' id='611a28de'/>
-      <union-decl name='fscrypt_policy' size-in-bits='192' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='105' column='1' id='61227238'>
-        <data-member access='public'>
-          <var-decl name='version' type-id='f9b06939' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='106' column='1'/>
-        </data-member>
-        <data-member access='public'>
-          <var-decl name='v1' type-id='74e2c23b' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='107' column='1'/>
-        </data-member>
-        <data-member access='public'>
-          <var-decl name='v2' type-id='75e2c3ce' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='108' column='1'/>
-        </data-member>
-      </union-decl>
-      <union-decl name='fscrypt_policy' visibility='default' is-declaration-only='yes' id='61227239'/>
+      <union-decl name='fscrypt_policy' visibility='default' is-declaration-only='yes' id='61227238'/>
       <class-decl name='nvdimm_key_data' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/libnvdimm.h' line='175' column='1' id='61250075'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='data' type-id='e3dc4fdb' visibility='default' filepath='include/linux/libnvdimm.h' line='176' column='1'/>
@@ -42733,12 +42805,12 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='616601a4'>
-        <parameter type-id='8582e5ec'/>
-        <parameter type-id='67bbaeda'/>
-        <parameter type-id='35078cb9'/>
-        <parameter type-id='249ef586'/>
-        <parameter type-id='19c2251e'/>
-        <parameter type-id='807869d3'/>
+        <parameter type-id='8582e5ec' name='bridge'/>
+        <parameter type-id='67bbaeda' name='bridge_state'/>
+        <parameter type-id='35078cb9' name='crtc_state'/>
+        <parameter type-id='249ef586' name='conn_state'/>
+        <parameter type-id='19c2251e' name='output_fmt'/>
+        <parameter type-id='807869d3' name='num_input_fmts'/>
         <return type-id='f9409001'/>
       </function-type>
       <qualified-type-def type-id='edd6cd80' const='yes' id='61675bc7'/>
@@ -42843,7 +42915,6 @@
         <parameter type-id='c3e18af8'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='987967c6' size-in-bits='64' id='61a6a060'/>
       <pointer-type-def type-id='4aa6929c' size-in-bits='64' id='61ae4386'/>
       <function-type size-in-bits='64' id='61b18a3b'>
         <parameter type-id='68a2d05b'/>
@@ -43585,21 +43656,21 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/mmc/host/sdhci.h' line='660' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='gpio_desc' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/../drivers/gpio/gpiolib.h' line='99' column='1' id='63b74212'>
+      <class-decl name='gpio_desc' size-in-bits='320' is-struct='yes' visibility='default' filepath='drivers/pinctrl/../gpio/gpiolib.h' line='99' column='1' id='63b74212'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='gdev' type-id='fb7dc22d' visibility='default' filepath='include/../drivers/gpio/gpiolib.h' line='100' column='1'/>
+          <var-decl name='gdev' type-id='fb7dc22d' visibility='default' filepath='drivers/pinctrl/../gpio/gpiolib.h' line='100' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='flags' type-id='7359adad' visibility='default' filepath='include/../drivers/gpio/gpiolib.h' line='101' column='1'/>
+          <var-decl name='flags' type-id='7359adad' visibility='default' filepath='drivers/pinctrl/../gpio/gpiolib.h' line='101' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='label' type-id='80f4b756' visibility='default' filepath='include/../drivers/gpio/gpiolib.h' line='121' column='1'/>
+          <var-decl name='label' type-id='80f4b756' visibility='default' filepath='drivers/pinctrl/../gpio/gpiolib.h' line='121' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/../drivers/gpio/gpiolib.h' line='123' column='1'/>
+          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='drivers/pinctrl/../gpio/gpiolib.h' line='123' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='debounce_period_us' type-id='f0981eeb' visibility='default' filepath='include/../drivers/gpio/gpiolib.h' line='129' column='1'/>
+          <var-decl name='debounce_period_us' type-id='f0981eeb' visibility='default' filepath='drivers/pinctrl/../gpio/gpiolib.h' line='129' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='xhci_doorbell_array' size-in-bits='8192' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='549' column='1' id='63b99761'>
@@ -44034,7 +44105,6 @@
           <var-decl name='index' type-id='8f048e17' visibility='default' filepath='include/media/h264-ctrls.h' line='152' column='1'/>
         </data-member>
       </class-decl>
-      <pointer-type-def type-id='80a367ec' size-in-bits='64' id='65936caa'/>
       <pointer-type-def type-id='b9acff95' size-in-bits='64' id='659a1059'/>
       <pointer-type-def type-id='f8a88be2' size-in-bits='64' id='65a8a3df'/>
       <union-decl name='__anonymous_union__' size-in-bits='32' is-anonymous='yes' visibility='default' filepath='include/linux/ethtool.h' line='96' column='1' id='65b20802'>
@@ -45658,8 +45728,8 @@
         <subrange length='4' type-id='7ff19f0f' id='16fe7105'/>
       </array-type-def>
       <function-type size-in-bits='64' id='686e5e33'>
-        <parameter type-id='eb572b74' name='sdev'/>
-        <parameter type-id='95e97e5e' name='depth'/>
+        <parameter type-id='eb572b74'/>
+        <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <class-decl name='pinctrl_map_configs' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/pinctrl/machine.h' line='47' column='1' id='687781fc'>
@@ -46005,7 +46075,35 @@
           <var-decl name='release' type-id='06412f4e' visibility='default' filepath='include/linux/remoteproc.h' line='344' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='key_user' is-struct='yes' visibility='default' is-declaration-only='yes' id='696d238e'/>
+      <class-decl name='key_user' size-in-bits='832' is-struct='yes' visibility='default' filepath='security/keys/internal.h' line='54' column='1' id='696d238e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='node' type-id='2a8a6332' visibility='default' filepath='security/keys/internal.h' line='55' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='cons_lock' type-id='925167dc' visibility='default' filepath='security/keys/internal.h' line='56' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='576'>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='security/keys/internal.h' line='57' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='608'>
+          <var-decl name='usage' type-id='64615833' visibility='default' filepath='security/keys/internal.h' line='58' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='nkeys' type-id='49178f86' visibility='default' filepath='security/keys/internal.h' line='59' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='672'>
+          <var-decl name='nikeys' type-id='49178f86' visibility='default' filepath='security/keys/internal.h' line='60' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='704'>
+          <var-decl name='uid' type-id='d80b72e6' visibility='default' filepath='security/keys/internal.h' line='61' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='736'>
+          <var-decl name='qnkeys' type-id='95e97e5e' visibility='default' filepath='security/keys/internal.h' line='62' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='768'>
+          <var-decl name='qnbytes' type-id='95e97e5e' visibility='default' filepath='security/keys/internal.h' line='63' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='c372d726' size-in-bits='64' id='696df79c'/>
       <pointer-type-def type-id='986a13e4' size-in-bits='64' id='696ed472'/>
       <pointer-type-def type-id='e98813cb' size-in-bits='64' id='6972ad8b'/>
@@ -46566,7 +46664,14 @@
       <pointer-type-def type-id='3e1d184a' size-in-bits='64' id='6aee814c'/>
       <pointer-type-def type-id='74e7a035' size-in-bits='64' id='6af64a09'/>
       <pointer-type-def type-id='8d6d779c' size-in-bits='64' id='6b0f20ae'/>
-      <class-decl name='uncached_list' is-struct='yes' visibility='default' is-declaration-only='yes' id='6b1203e5'/>
+      <class-decl name='uncached_list' size-in-bits='192' is-struct='yes' visibility='default' filepath='net/ipv4/route.c' line='1530' column='1' id='6b1203e5'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='net/ipv4/route.c' line='1531' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='head' type-id='72f469ec' visibility='default' filepath='net/ipv4/route.c' line='1532' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='bfbf7968' size-in-bits='64' id='6b1642ae'/>
       <class-decl name='tty_bufhead' size-in-bits='1344' is-struct='yes' visibility='default' filepath='include/linux/tty.h' line='86' column='1' id='6b1bde38'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -47212,11 +47317,6 @@
           <var-decl name='driver_data' type-id='0791d6c8' visibility='default' filepath='include/linux/mod_devicetable.h' line='42' column='1'/>
         </data-member>
       </class-decl>
-      <function-type size-in-bits='64' id='6cb6dd61'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='c0190993'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <function-type size-in-bits='64' id='6cb7d4e4'>
         <parameter type-id='6dca061b'/>
         <parameter type-id='b50a4934'/>
@@ -47617,7 +47717,7 @@
       </function-type>
       <pointer-type-def type-id='9ebab137' size-in-bits='64' id='6ddb149f'/>
       <function-type size-in-bits='64' id='6ddd203f'>
-        <parameter type-id='a2bff676'/>
+        <parameter type-id='a2bff676' name='net'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='69e72089' size-in-bits='64' id='6de64ec1'/>
@@ -47743,6 +47843,11 @@
         <enumerator name='REGCACHE_COMPRESSED' value='2'/>
         <enumerator name='REGCACHE_FLAT' value='3'/>
       </enum-decl>
+      <class-decl name='ewma_psr_time' size-in-bits='64' is-struct='yes' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='56' column='1' id='6e15744f'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='internal' type-id='7359adad' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='56' column='1'/>
+        </data-member>
+      </class-decl>
       <typedef-decl name='uint' type-id='f0981eeb' filepath='include/linux/types.h' line='87' column='1' id='6e160b14'/>
       <class-decl name='cec_event_entry' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/media/cec.h' line='75' column='1' id='6e21d41e'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -48048,7 +48153,7 @@
           <var-decl name='page' type-id='02f11ed4' visibility='default' filepath='include/drm/ttm/ttm_bo_api.h' line='186' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='bo_kmap_type' type-id='08f5ca1e' visibility='default' filepath='include/drm/ttm/ttm_bo_api.h' line='192' column='1'/>
+          <var-decl name='bo_kmap_type' type-id='08f5ca1d' visibility='default' filepath='include/drm/ttm/ttm_bo_api.h' line='192' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
           <var-decl name='bo' type-id='9d57e433' visibility='default' filepath='include/drm/ttm/ttm_bo_api.h' line='193' column='1'/>
@@ -48193,56 +48298,7 @@
       <pointer-type-def type-id='5113b296' size-in-bits='64' id='70487b28'/>
       <pointer-type-def type-id='f5c90b3f' size-in-bits='64' id='704982b4'/>
       <class-decl name='writeback_control' is-struct='yes' visibility='default' is-declaration-only='yes' id='705711f5'/>
-      <class-decl name='mmc_blk_data' size-in-bits='5760' is-struct='yes' visibility='default' filepath='drivers/mmc/core/block.c' line='104' column='1' id='705909a1'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='parent' type-id='fa0b179b' visibility='default' filepath='drivers/mmc/core/block.c' line='105' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='disk' type-id='33c599da' visibility='default' filepath='drivers/mmc/core/block.c' line='106' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='queue' type-id='260fd734' visibility='default' filepath='drivers/mmc/core/block.c' line='107' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='4608'>
-          <var-decl name='part' type-id='72f469ec' visibility='default' filepath='drivers/mmc/core/block.c' line='108' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='4736'>
-          <var-decl name='rpmbs' type-id='72f469ec' visibility='default' filepath='drivers/mmc/core/block.c' line='109' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='4864'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='drivers/mmc/core/block.c' line='111' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='4896'>
-          <var-decl name='usage' type-id='f0981eeb' visibility='default' filepath='drivers/mmc/core/block.c' line='115' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='4928'>
-          <var-decl name='read_only' type-id='f0981eeb' visibility='default' filepath='drivers/mmc/core/block.c' line='116' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='4960'>
-          <var-decl name='part_type' type-id='f0981eeb' visibility='default' filepath='drivers/mmc/core/block.c' line='117' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='4992'>
-          <var-decl name='reset_done' type-id='f0981eeb' visibility='default' filepath='drivers/mmc/core/block.c' line='118' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='5024'>
-          <var-decl name='part_curr' type-id='f0981eeb' visibility='default' filepath='drivers/mmc/core/block.c' line='130' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='5056'>
-          <var-decl name='force_ro' type-id='dbf3947c' visibility='default' filepath='drivers/mmc/core/block.c' line='131' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='5312'>
-          <var-decl name='power_ro_lock' type-id='dbf3947c' visibility='default' filepath='drivers/mmc/core/block.c' line='132' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='5568'>
-          <var-decl name='area_type' type-id='95e97e5e' visibility='default' filepath='drivers/mmc/core/block.c' line='133' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='5632'>
-          <var-decl name='status_dentry' type-id='27675065' visibility='default' filepath='drivers/mmc/core/block.c' line='136' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='5696'>
-          <var-decl name='ext_csd_dentry' type-id='27675065' visibility='default' filepath='drivers/mmc/core/block.c' line='137' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='mmc_blk_data' is-struct='yes' visibility='default' is-declaration-only='yes' id='705909a1'/>
       <pointer-type-def type-id='2181e5cc' size-in-bits='64' id='705eaeca'/>
       <function-type size-in-bits='64' id='706f3909'>
         <parameter type-id='e324928d'/>
@@ -48583,6 +48639,7 @@
         <subrange length='5' type-id='7ff19f0f' id='53010e10'/>
       </array-type-def>
       <pointer-type-def type-id='17d4a823' size-in-bits='64' id='71399c6f'/>
+      <pointer-type-def type-id='c3b7ba7d' size-in-bits='64' id='713a56f5'/>
       <function-type size-in-bits='64' id='713ac427'>
         <parameter type-id='1d2c2b85'/>
         <parameter type-id='7359adad'/>
@@ -49516,7 +49573,7 @@
       </class-decl>
       <pointer-type-def type-id='0c71d025' size-in-bits='64' id='72fa5619'/>
       <function-type size-in-bits='64' id='72fc7982'>
-        <parameter type-id='c1547255'/>
+        <parameter type-id='c1547255' name='rng'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='fe695434' size-in-bits='64' id='72fd300e'/>
@@ -50360,26 +50417,8 @@
         <parameter type-id='5799dc94'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='637cfeaf' size-in-bits='64' id='74c91557'/>
       <pointer-type-def type-id='b8cdc165' size-in-bits='64' id='74d5ef65'/>
       <pointer-type-def type-id='d12f4a1d' size-in-bits='64' id='74d89ebd'/>
-      <class-decl name='fscrypt_policy_v1' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='40' column='1' id='74e2c23b'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='version' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='41' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='contents_encryption_mode' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='42' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='filenames_encryption_mode' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='43' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='24'>
-          <var-decl name='flags' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='44' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='master_key_descriptor' type-id='0209ab38' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='45' column='1'/>
-        </data-member>
-      </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/drm/drm_edid.h' line='172' column='1' id='74e410f1'>
         <data-member access='public'>
           <var-decl name='pixel_data' type-id='42c5f701' visibility='default' filepath='include/drm/drm_edid.h' line='173' column='1'/>
@@ -50638,26 +50677,6 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='5a7d7f6d' size-in-bits='64' id='75d4b09d'/>
-      <class-decl name='fscrypt_policy_v2' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='66' column='1' id='75e2c3ce'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='version' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='67' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='contents_encryption_mode' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='68' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='filenames_encryption_mode' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='69' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='24'>
-          <var-decl name='flags' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='70' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='__reserved' type-id='c213d3d4' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='71' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='master_key_identifier' type-id='9396cabb' visibility='default' filepath='include/uapi/linux/fscrypt.h' line='72' column='1'/>
-        </data-member>
-      </class-decl>
       <array-type-def dimensions='1' type-id='80f4b756' size-in-bits='64' id='75e4a9bd'>
         <subrange length='1' type-id='7ff19f0f' id='52f813b4'/>
       </array-type-def>
@@ -50844,6 +50863,7 @@
       <array-type-def dimensions='1' type-id='f22a8abb' size-in-bits='512' id='7698c98a'>
         <subrange length='8' type-id='7ff19f0f' id='56e0c0b1'/>
       </array-type-def>
+      <pointer-type-def type-id='84a5c3d4' size-in-bits='64' id='769cf345'/>
       <class-decl name='v4l2_encoder_cmd' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2033' column='1' id='769f1ed1'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='cmd' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2034' column='1'/>
@@ -51433,7 +51453,23 @@
           <var-decl name='up_req_work' type-id='ef9025d0' visibility='default' filepath='include/drm/drm_dp_mst_helper.h' line='753' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='eventfd_ctx' is-struct='yes' visibility='default' is-declaration-only='yes' id='77dc8383'/>
+      <class-decl name='eventfd_ctx' size-in-bits='384' is-struct='yes' visibility='default' filepath='fs/eventfd.c' line='32' column='1' id='77dc8383'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='kref' type-id='400fb07b' visibility='default' filepath='fs/eventfd.c' line='33' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='wqh' type-id='b5ab048f' visibility='default' filepath='fs/eventfd.c' line='34' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='count' type-id='d3130597' visibility='default' filepath='fs/eventfd.c' line='43' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='fs/eventfd.c' line='44' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='352'>
+          <var-decl name='id' type-id='95e97e5e' visibility='default' filepath='fs/eventfd.c' line='45' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='llist_head' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/llist.h' line='54' column='1' id='77df194e'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='first' type-id='023b769e' visibility='default' filepath='include/linux/llist.h' line='55' column='1'/>
@@ -51795,7 +51831,6 @@
       <pointer-type-def type-id='70084cf7' size-in-bits='64' id='78efe913'/>
       <pointer-type-def type-id='cf081899' size-in-bits='64' id='78faece1'/>
       <qualified-type-def type-id='8a1bdab0' const='yes' id='78fc3761'/>
-      <pointer-type-def type-id='ff37489f' size-in-bits='64' id='790774ef'/>
       <function-type size-in-bits='64' id='7908d890'>
         <parameter type-id='5e4f599b'/>
         <return type-id='48b5725f'/>
@@ -52714,9 +52749,9 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='7b596412'>
-        <parameter type-id='5474f420' name='tfm'/>
-        <parameter type-id='bbaf3419' name='seed'/>
-        <parameter type-id='f0981eeb' name='slen'/>
+        <parameter type-id='5474f420'/>
+        <parameter type-id='bbaf3419'/>
+        <parameter type-id='f0981eeb'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='ebf8e47f' size-in-bits='64' id='7b5a288b'/>
@@ -53436,6 +53471,7 @@
       <pointer-type-def type-id='0a84ab07' size-in-bits='64' id='7d18218b'/>
       <qualified-type-def type-id='842b8964' const='yes' id='7d1bac73'/>
       <qualified-type-def type-id='2117397c' const='yes' id='7d20a6e7'/>
+      <pointer-type-def type-id='b8791da7' size-in-bits='64' id='7d2f2ada'/>
       <pointer-type-def type-id='80f4b756' size-in-bits='64' id='7d3cd834'/>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/trace_events.h' line='281' column='1' id='7d3eb798'>
         <data-member access='public'>
@@ -54020,7 +54056,7 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='b6c1136f' size-in-bits='64' id='7e20177b'/>
-      <typedef-decl name='__uint128_t' type-id='4f340252' filepath='drivers/irqchip/irq-sun4i.c' line='178' column='1' id='7e2609cc'/>
+      <typedef-decl name='__uint128_t' type-id='4f340252' filepath='init/version.c' line='27' column='1' id='7e2609cc'/>
       <function-type size-in-bits='64' id='7e2beda2'>
         <parameter type-id='f772df6d'/>
         <parameter type-id='f9b06939'/>
@@ -54485,7 +54521,7 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='7f3ed7a2'>
-        <parameter type-id='352b95f6' name='hp'/>
+        <parameter type-id='352b95f6'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='7f416417'>
@@ -55346,26 +55382,6 @@
       </function-type>
       <pointer-type-def type-id='9488f766' size-in-bits='64' id='809cdefc'/>
       <qualified-type-def type-id='60498a7e' const='yes' id='809e8e55'/>
-      <class-decl name='fscrypt_mode' size-in-bits='256' is-struct='yes' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='580' column='1' id='80a367ec'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='friendly_name' type-id='80f4b756' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='581' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='cipher_str' type-id='80f4b756' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='582' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='keysize' type-id='95e97e5e' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='583' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='ivsize' type-id='95e97e5e' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='584' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='logged_impl_name' type-id='95e97e5e' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='585' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='blk_crypto_mode' type-id='e951e732' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='586' column='1'/>
-        </data-member>
-      </class-decl>
       <function-type size-in-bits='64' id='80b3d6aa'>
         <parameter type-id='8898134d'/>
         <parameter type-id='9e99ecc1'/>
@@ -56703,7 +56719,6 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='72fc7982' size-in-bits='64' id='844c2e84'/>
-      <pointer-type-def type-id='08f5ca19' size-in-bits='64' id='84548db8'/>
       <function-type size-in-bits='64' id='845f3205'>
         <parameter type-id='42c8f564'/>
         <parameter type-id='5760dcb0'/>
@@ -57166,11 +57181,6 @@
       </class-decl>
       <pointer-type-def type-id='d52c7591' size-in-bits='64' id='855e3679'/>
       <pointer-type-def type-id='be97e3d8' size-in-bits='64' id='855e70d2'/>
-      <pointer-type-def type-id='e6ea37b8' size-in-bits='64' id='8567d8b0'/>
-      <pointer-type-def type-id='52365588' size-in-bits='64' id='8567d8b1'/>
-      <pointer-type-def type-id='79faeff3' size-in-bits='64' id='8567d8b2'/>
-      <pointer-type-def type-id='d7ab0a14' size-in-bits='64' id='8567d8b3'/>
-      <pointer-type-def type-id='8425539a' size-in-bits='64' id='8567d8b4'/>
       <pointer-type-def type-id='9a537bbe' size-in-bits='64' id='856b89fc'/>
       <class-decl name='seq_buf' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/seq_buf.h' line='19' column='1' id='857188d6'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -58385,44 +58395,7 @@
       <typedef-decl name='__kernel_clock_t' type-id='6a11bd61' filepath='include/uapi/asm-generic/posix_types.h' line='94' column='1' id='880ebc01'/>
       <pointer-type-def type-id='52126317' size-in-bits='64' id='880ef693'/>
       <pointer-type-def type-id='c16a2224' size-in-bits='64' id='88139c0a'/>
-      <class-decl name='serial_icounter_struct' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/uapi/linux/serial.h' line='102' column='1' id='8816ddc1'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='cts' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='103' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='dsr' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='103' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='rng' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='103' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='dcd' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='103' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='rx' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='104' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='tx' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='104' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='frame' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='105' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='overrun' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='105' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='parity' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='105' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='288'>
-          <var-decl name='brk' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='105' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='buf_overrun' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/serial.h' line='106' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='reserved' type-id='e415235d' visibility='default' filepath='include/uapi/linux/serial.h' line='107' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='serial_icounter_struct' is-struct='yes' visibility='default' is-declaration-only='yes' id='8816ddc1'/>
       <function-type size-in-bits='64' id='8826ec36'>
         <parameter type-id='6ee1a870'/>
         <return type-id='95e97e5e'/>
@@ -59586,65 +59559,7 @@
           <var-decl name='vtd' type-id='8b85ffcf' visibility='default' filepath='include/uapi/linux/iommu.h' line='337' column='1'/>
         </data-member>
       </union-decl>
-      <class-decl name='wpan_dev' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/cfg802154.h' line='326' column='1' id='8ae2fb1d'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='wpan_phy' type-id='82398c35' visibility='default' filepath='include/net/cfg802154.h' line='327' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='iftype' type-id='95e97e5e' visibility='default' filepath='include/net/cfg802154.h' line='328' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/cfg802154.h' line='331' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='netdev' type-id='68a2d05b' visibility='default' filepath='include/net/cfg802154.h' line='332' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='header_ops' type-id='790774ef' visibility='default' filepath='include/net/cfg802154.h' line='334' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='lowpan_dev' type-id='68a2d05b' visibility='default' filepath='include/net/cfg802154.h' line='337' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='identifier' type-id='19c2251e' visibility='default' filepath='include/net/cfg802154.h' line='339' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='480'>
-          <var-decl name='pan_id' type-id='23119536' visibility='default' filepath='include/net/cfg802154.h' line='342' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='496'>
-          <var-decl name='short_addr' type-id='23119536' visibility='default' filepath='include/net/cfg802154.h' line='343' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='extended_addr' type-id='a30e8d1f' visibility='default' filepath='include/net/cfg802154.h' line='344' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='bsn' type-id='49178f86' visibility='default' filepath='include/net/cfg802154.h' line='347' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='608'>
-          <var-decl name='dsn' type-id='49178f86' visibility='default' filepath='include/net/cfg802154.h' line='349' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='min_be' type-id='f9b06939' visibility='default' filepath='include/net/cfg802154.h' line='351' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='648'>
-          <var-decl name='max_be' type-id='f9b06939' visibility='default' filepath='include/net/cfg802154.h' line='352' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='656'>
-          <var-decl name='csma_retries' type-id='f9b06939' visibility='default' filepath='include/net/cfg802154.h' line='353' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='664'>
-          <var-decl name='frame_retries' type-id='fdbf7a0f' visibility='default' filepath='include/net/cfg802154.h' line='354' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='672'>
-          <var-decl name='lbt' type-id='b50a4934' visibility='default' filepath='include/net/cfg802154.h' line='356' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='680'>
-          <var-decl name='promiscuous_mode' type-id='b50a4934' visibility='default' filepath='include/net/cfg802154.h' line='358' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='688'>
-          <var-decl name='ackreq' type-id='b50a4934' visibility='default' filepath='include/net/cfg802154.h' line='361' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='wpan_dev' is-struct='yes' visibility='default' is-declaration-only='yes' id='8ae2fb1d'/>
       <enum-decl name='dma_desc_metadata_mode' filepath='include/linux/dmaengine.h' line='289' column='1' id='8ae66bc4'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='DESC_METADATA_NONE' value='0'/>
@@ -60419,7 +60334,6 @@
         <parameter type-id='a47d3467'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='9df4c74e' size-in-bits='64' id='8ce270a4'/>
       <class-decl name='quotactl_ops' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/quota.h' line='434' column='1' id='8ce4ff83'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='quota_on' type-id='de6b64d0' visibility='default' filepath='include/linux/quota.h' line='435' column='1'/>
@@ -61355,7 +61269,17 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d6574e69' size-in-bits='64' id='8f19938d'/>
-      <class-decl name='iova_cpu_rcache' is-struct='yes' visibility='default' is-declaration-only='yes' id='8f19d02e'/>
+      <class-decl name='iova_cpu_rcache' size-in-bits='192' is-struct='yes' visibility='default' filepath='drivers/iommu/iova.c' line='884' column='1' id='8f19d02e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/iommu/iova.c' line='885' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='loaded' type-id='0a981d27' visibility='default' filepath='drivers/iommu/iova.c' line='886' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='prev' type-id='0a981d27' visibility='default' filepath='drivers/iommu/iova.c' line='887' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='734a42c0' size-in-bits='64' id='8f20abb2'/>
       <typedef-decl name='__poll_t' type-id='f0981eeb' filepath='include/uapi/linux/types.h' line='52' column='1' id='8f254b08'/>
       <pointer-type-def type-id='73627a37' size-in-bits='64' id='8f2ea2db'/>
@@ -62398,7 +62322,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='9102a0ad'>
-        <parameter type-id='eb572b74'/>
+        <parameter type-id='eb572b74' name='sdev'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='d89691b6' size-in-bits='64' id='91073894'/>
@@ -62884,10 +62808,10 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='925166cb'>
-        <parameter type-id='41ebc58b' name='rpdev'/>
-        <parameter type-id='f0966175' name='cb'/>
-        <parameter type-id='eaa32e2f' name='priv'/>
-        <parameter type-id='e2b27ed1' name='chinfo'/>
+        <parameter type-id='41ebc58b'/>
+        <parameter type-id='f0966175'/>
+        <parameter type-id='eaa32e2f'/>
+        <parameter type-id='e2b27ed1'/>
         <return type-id='feb59272'/>
       </function-type>
       <class-decl name='mutex' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/mutex.h' line='54' column='1' id='925167dc'>
@@ -62937,6 +62861,12 @@
           <var-decl name='func' type-id='f48b73f6' visibility='default' filepath='include/linux/irq_work.h' line='24' column='1'/>
         </data-member>
       </class-decl>
+      <typedef-decl name='wchar_t' type-id='1dc6a898' filepath='include/linux/nls.h' line='19' column='1' id='928221d2'/>
+      <function-type size-in-bits='64' id='92892da6'>
+        <parameter type-id='eaa32e2f'/>
+        <parameter type-id='3df9fd28'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <typedef-decl name='regmap_hw_write' type-id='02a757da' filepath='include/linux/regmap.h' line='450' column='1' id='928c5b64'/>
       <function-type size-in-bits='64' id='928ea938'>
         <parameter type-id='6f3c82ac'/>
@@ -63196,6 +63126,7 @@
       </class-decl>
       <pointer-type-def type-id='144e93b2' size-in-bits='64' id='933bd18c'/>
       <pointer-type-def type-id='47f058fa' size-in-bits='64' id='933bd96c'/>
+      <typedef-decl name='xa_mark_t' type-id='f0981eeb' filepath='include/linux/xarray.h' line='246' column='1' id='933bf462'/>
       <function-type size-in-bits='64' id='933e0e21'>
         <parameter type-id='27675065'/>
         <parameter type-id='7e666abe'/>
@@ -63518,47 +63449,7 @@
         <enumerator name='OPP_TABLE_ACCESS_SHARED' value='2'/>
       </enum-decl>
       <pointer-type-def type-id='a272e179' size-in-bits='64' id='94411a61'/>
-      <class-decl name='fscrypt_info' size-in-bits='1088' is-struct='yes' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='195' column='1' id='9441bb37'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='ci_enc_key' type-id='a28355c2' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='198' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='ci_owns_key' type-id='b50a4934' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='201' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='136'>
-          <var-decl name='ci_inlinecrypt' type-id='b50a4934' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='208' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='ci_mode' type-id='65936caa' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='215' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='ci_inode' type-id='7e666abe' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='218' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='ci_master_key' type-id='204a4632' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='225' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='ci_master_key_link' type-id='72f469ec' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='231' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='ci_direct_key' type-id='8ce270a4' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='237' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='ci_dirhash_key' type-id='7799da43' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='244' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='ci_dirhash_key_initialized' type-id='b50a4934' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='245' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='712'>
-          <var-decl name='ci_policy' type-id='61227238' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='248' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='904'>
-          <var-decl name='ci_nonce' type-id='0d8415b5' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='251' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1056'>
-          <var-decl name='ci_hashed_ino' type-id='19c2251e' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='254' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='fscrypt_info' is-struct='yes' visibility='default' is-declaration-only='yes' id='9441bb37'/>
       <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/linux/kprobes.h' line='159' column='1' id='944884a1'>
         <data-member access='public'>
           <var-decl name='hlist' type-id='03a4a074' visibility='default' filepath='include/linux/kprobes.h' line='160' column='1'/>
@@ -64128,11 +64019,6 @@
       </function-type>
       <pointer-type-def type-id='21767af6' size-in-bits='64' id='95e6deec'/>
       <type-decl name='int' size-in-bits='32' id='95e97e5e'/>
-      <class-decl name='wpan_dev_header_ops' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/cfg802154.h' line='315' column='1' id='95fcbc94'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='create' type-id='5afbd3c3' visibility='default' filepath='include/net/cfg802154.h' line='320' column='1'/>
-        </data-member>
-      </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='192' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/if.h' line='241' column='1' id='95fd560f'>
         <data-member access='public'>
           <var-decl name='ifru_addr' type-id='5221b18a' visibility='default' filepath='include/uapi/linux/if.h' line='242' column='1'/>
@@ -65159,11 +65045,6 @@
         <parameter type-id='3eb7c31c'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <function-type size-in-bits='64' id='987967c6'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='c894953d'/>
-      </function-type>
       <pointer-type-def type-id='db1d8e86' size-in-bits='64' id='988d1520'/>
       <function-type size-in-bits='64' id='98985516'>
         <parameter type-id='339c87e8'/>
@@ -65616,7 +65497,7 @@
       </union-decl>
       <pointer-type-def type-id='c7253970' size-in-bits='64' id='9a2b46ca'/>
       <function-type size-in-bits='64' id='9a2d1cbc'>
-        <parameter type-id='59f1923f' name='t'/>
+        <parameter type-id='59f1923f'/>
         <return type-id='48b5725f'/>
       </function-type>
       <qualified-type-def type-id='81954c90' const='yes' id='9a2ef795'/>
@@ -67184,7 +67065,7 @@
         <return type-id='48b5725f'/>
       </function-type>
       <function-type size-in-bits='64' id='9d4a3248'>
-        <parameter type-id='798c29b7'/>
+        <parameter type-id='798c29b7' name='vdev'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='40afefd0' size-in-bits='64' id='9d5147b2'/>
@@ -67460,7 +67341,6 @@
         <parameter type-id='7292109c'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='fscrypt_direct_key' is-struct='yes' visibility='default' is-declaration-only='yes' id='9df4c74e'/>
       <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/pm_domain.h' line='157' column='1' id='9df67ae2'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='slock' type-id='fb4018a0' visibility='default' filepath='include/linux/pm_domain.h' line='158' column='1'/>
@@ -67657,6 +67537,7 @@
           <var-decl name='end' type-id='3b8255e6' visibility='default' filepath='include/linux/pci.h' line='773' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='daf33c64' size-in-bits='64' id='9e80f729'/>
       <class-decl name='lruvec' size-in-bits='1088' is-struct='yes' visibility='default' filepath='include/linux/mmzone.h' line='280' column='1' id='9e8c0698'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='lists' type-id='e4e01aff' visibility='default' filepath='include/linux/mmzone.h' line='281' column='1'/>
@@ -69178,14 +69059,7 @@
           <var-decl name='android_oem_data1' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='535' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='unicode_map' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/unicode.h' line='8' column='1' id='a24978a1'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='charset' type-id='80f4b756' visibility='default' filepath='include/linux/unicode.h' line='9' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='version' type-id='95e97e5e' visibility='default' filepath='include/linux/unicode.h' line='10' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='unicode_map' is-struct='yes' visibility='default' is-declaration-only='yes' id='a24978a1'/>
       <function-type size-in-bits='64' id='a249930e'>
         <parameter type-id='b9608bfc'/>
         <parameter type-id='8efea9e5'/>
@@ -69311,14 +69185,6 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='2871909b'/>
       </function-type>
-      <class-decl name='fscrypt_prepared_key' size-in-bits='128' is-struct='yes' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='181' column='1' id='a28355c2'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='tfm' type-id='72bb8c36' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='182' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='blk_key' type-id='cb6e5180' visibility='default' filepath='fs/crypto/fscrypt_private.h' line='184' column='1'/>
-        </data-member>
-      </class-decl>
       <function-type size-in-bits='64' id='a286a01c'>
         <parameter type-id='414ea452'/>
         <parameter type-id='bdcee7ae'/>
@@ -70004,8 +69870,8 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='a41d4f0c'>
-        <parameter type-id='a585cbc4' name='tfm'/>
-        <parameter type-id='f0981eeb' name='authsize'/>
+        <parameter type-id='a585cbc4'/>
+        <parameter type-id='f0981eeb'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='a41f849f'>
@@ -70124,7 +69990,6 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='e063028f' size-in-bits='64' id='a47d3467'/>
-      <pointer-type-def type-id='60a1cbff' size-in-bits='64' id='a47ececb'/>
       <function-type size-in-bits='64' id='a48b0884'>
         <parameter type-id='7e666abe'/>
         <parameter type-id='69bf7bee'/>
@@ -70790,8 +70655,8 @@
         <return type-id='79a0948f'/>
       </function-type>
       <function-type size-in-bits='64' id='a6676061'>
-        <parameter type-id='855e3679' name='genpd'/>
-        <parameter type-id='fa0b179b' name='dev'/>
+        <parameter type-id='855e3679'/>
+        <parameter type-id='fa0b179b'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <class-decl name='irq_domain' size-in-bits='1536' is-struct='yes' visibility='default' filepath='include/linux/irqdomain.h' line='163' column='1' id='a667f60e'>
@@ -70863,6 +70728,7 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='60f2213f' size-in-bits='64' id='a6711537'/>
+      <pointer-type-def type-id='b9930aae' size-in-bits='64' id='a6798dcc'/>
       <pointer-type-def type-id='e079fe29' size-in-bits='64' id='a68064b1'/>
       <pointer-type-def type-id='feeb4c2f' size-in-bits='64' id='a6892387'/>
       <pointer-type-def type-id='332a260c' size-in-bits='64' id='a6945abe'/>
@@ -71298,38 +71164,7 @@
         </data-member>
       </class-decl>
       <typedef-decl name='async_cookie_t' type-id='91ce1af9' filepath='include/linux/async.h' line='16' column='1' id='a7465fe4'/>
-      <class-decl name='prefix_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/addrconf.h' line='27' column='1' id='a7502152'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='type' type-id='8f048e17' visibility='default' filepath='include/net/addrconf.h' line='28' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='length' type-id='8f048e17' visibility='default' filepath='include/net/addrconf.h' line='29' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='prefix_len' type-id='8f048e17' visibility='default' filepath='include/net/addrconf.h' line='30' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='reserved' type-id='8f048e17' visibility='default' filepath='include/net/addrconf.h' line='37' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='6'>
-          <var-decl name='autoconf' type-id='8f048e17' visibility='default' filepath='include/net/addrconf.h' line='38' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='onlink' type-id='8f048e17' visibility='default' filepath='include/net/addrconf.h' line='39' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='valid' type-id='78a133c2' visibility='default' filepath='include/net/addrconf.h' line='43' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='prefered' type-id='78a133c2' visibility='default' filepath='include/net/addrconf.h' line='44' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='reserved2' type-id='78a133c2' visibility='default' filepath='include/net/addrconf.h' line='45' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='prefix' type-id='f6ed712a' visibility='default' filepath='include/net/addrconf.h' line='47' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='prefix_info' is-struct='yes' visibility='default' is-declaration-only='yes' id='a7502152'/>
       <pointer-type-def type-id='4e7ef9a4' size-in-bits='64' id='a75080c6'/>
       <class-decl name='perf_event_mmap_page' size-in-bits='8704' is-struct='yes' visibility='default' filepath='include/uapi/linux/perf_event.h' line='485' column='1' id='a752caf1'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -71440,7 +71275,7 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='a796a301'>
-        <parameter type-id='182be7cc' name='dsi'/>
+        <parameter type-id='182be7cc'/>
         <return type-id='48b5725f'/>
       </function-type>
       <typedef-decl name='raw_hdlc_proto' type-id='f9167bd9' filepath='include/uapi/linux/hdlc/ioctl.h' line='56' column='1' id='a79adfa3'/>
@@ -74119,7 +73954,6 @@
         <return type-id='f0981eeb'/>
       </function-type>
       <pointer-type-def type-id='ccf6c819' size-in-bits='64' id='ae4d1761'/>
-      <pointer-type-def type-id='cf536864' size-in-bits='64' id='ae4d32ca'/>
       <function-type size-in-bits='64' id='ae542eb6'>
         <parameter type-id='8582e5ec'/>
         <parameter type-id='67bbaeda'/>
@@ -75514,11 +75348,11 @@
       <pointer-type-def type-id='cddfb84e' size-in-bits='64' id='b07c2494'/>
       <pointer-type-def type-id='270dc7da' size-in-bits='64' id='b07c56ec'/>
       <function-type size-in-bits='64' id='b083f9b9'>
-        <parameter type-id='db362995' name='dev'/>
+        <parameter type-id='db362995'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='b086bddd'>
-        <parameter type-id='3921c1a0'/>
+        <parameter type-id='3921c1a0' name='gser'/>
         <return type-id='48b5725f'/>
       </function-type>
       <function-type size-in-bits='64' id='b08da511'>
@@ -76560,12 +76394,12 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='b32e5b88'>
-        <parameter type-id='18d76f87' name='node'/>
-        <parameter type-id='19c2251e' name='tag'/>
-        <parameter type-id='19c2251e' name='avg_bw'/>
-        <parameter type-id='19c2251e' name='peak_bw'/>
-        <parameter type-id='f9409001' name='agg_avg'/>
-        <parameter type-id='f9409001' name='agg_peak'/>
+        <parameter type-id='18d76f87'/>
+        <parameter type-id='19c2251e'/>
+        <parameter type-id='19c2251e'/>
+        <parameter type-id='19c2251e'/>
+        <parameter type-id='f9409001'/>
+        <parameter type-id='f9409001'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <class-decl name='__anonymous_struct__' size-in-bits='320' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/mm_types.h' line='148' column='1' id='b32fec8c'>
@@ -77849,6 +77683,7 @@
           <var-decl name='last_qtail' type-id='f0981eeb' visibility='default' filepath='include/linux/netdevice.h' line='691' column='1'/>
         </data-member>
       </class-decl>
+      <typedef-decl name='dr_release_t' type-id='680bf43c' filepath='include/linux/device.h' line='166' column='1' id='b6609e5b'/>
       <pointer-type-def type-id='690d3bc2' size-in-bits='64' id='b6633a3c'/>
       <pointer-type-def type-id='5452befe' size-in-bits='64' id='b66e3fa0'/>
       <pointer-type-def type-id='ff22cb55' size-in-bits='64' id='b6733265'/>
@@ -78086,7 +77921,6 @@
           <var-decl name='timings' type-id='9a25f4b0' visibility='default' filepath='include/uapi/linux/videodev2.h' line='1589' column='1'/>
         </data-member>
       </class-decl>
-      <pointer-type-def type-id='340461fe' size-in-bits='64' id='b6e600bc'/>
       <pointer-type-def type-id='60023af2' size-in-bits='64' id='b6ee62dc'/>
       <function-type size-in-bits='64' id='b7022237'>
         <parameter type-id='ca9354d1'/>
@@ -78803,6 +78637,7 @@
           <var-decl name='twsk_destructor' type-id='841969d0' visibility='default' filepath='include/net/timewait_sock.h' line='20' column='1'/>
         </data-member>
       </class-decl>
+      <typedef-decl name='free_page_t' type-id='ae5a8333' filepath='include/linux/migrate.h' line='11' column='1' id='b8791da7'/>
       <pointer-type-def type-id='1b893cc5' size-in-bits='64' id='b88dd945'/>
       <pointer-type-def type-id='1a648909' size-in-bits='64' id='b8905925'/>
       <pointer-type-def type-id='f214de7d' size-in-bits='64' id='b89d0409'/>
@@ -79614,6 +79449,7 @@
         <parameter type-id='66b0cee4'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <qualified-type-def type-id='8f92235e' const='yes' id='b9930aae'/>
       <function-type size-in-bits='64' id='b99a3102'>
         <parameter type-id='572fbdca'/>
         <parameter type-id='77e79a4b'/>
@@ -79686,6 +79522,9 @@
         <parameter type-id='cd1b45ab'/>
         <return type-id='3f1a6b60'/>
       </function-type>
+      <array-type-def dimensions='1' type-id='e151255a' size-in-bits='131072' id='b9cedcb8'>
+        <subrange length='2048' type-id='7ff19f0f' id='e5323efb'/>
+      </array-type-def>
       <function-type size-in-bits='64' id='b9d8dce4'>
         <parameter type-id='807b7702'/>
         <parameter type-id='95e97e5e'/>
@@ -79702,11 +79541,6 @@
           <var-decl name='chain' type-id='aa804387' visibility='default' filepath='include/net/ip_fib.h' line='73' column='1'/>
         </data-member>
       </class-decl>
-      <function-type size-in-bits='64' id='ba05298e'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
-        <return type-id='8086ea38'/>
-      </function-type>
       <pointer-type-def type-id='850738b3' size-in-bits='64' id='ba09778f'/>
       <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/linux/dcache.h' line='117' column='1' id='ba0a0e48'>
         <data-member access='public'>
@@ -79729,7 +79563,6 @@
         </data-member>
       </union-decl>
       <pointer-type-def type-id='43489bca' size-in-bits='64' id='ba18e248'/>
-      <pointer-type-def type-id='d37aa9fa' size-in-bits='64' id='ba195270'/>
       <pointer-type-def type-id='d9609309' size-in-bits='64' id='ba1d878d'/>
       <pointer-type-def type-id='e82a9f1d' size-in-bits='64' id='ba21bbb1'/>
       <pointer-type-def type-id='636cc9ab' size-in-bits='64' id='ba21e62b'/>
@@ -80184,7 +80017,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='bb068c9f'>
-        <parameter type-id='37175e4d'/>
+        <parameter type-id='37175e4d' name='hdev'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <class-decl name='irq_chip_generic' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/linux/irq.h' line='1058' column='1' id='bb06f572'>
@@ -80260,14 +80093,6 @@
       </class-decl>
       <pointer-type-def type-id='a9ab8935' size-in-bits='64' id='bb0baf11'/>
       <pointer-type-def type-id='9bc083a1' size-in-bits='64' id='bb0f13d1'/>
-      <function-type size-in-bits='64' id='bb1a67f7'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='ba195270'/>
-        <parameter type-id='ba195270'/>
-        <parameter type-id='f0981eeb'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <qualified-type-def type-id='32858f34' const='yes' id='bb21a21f'/>
       <pointer-type-def type-id='ecbaa04a' size-in-bits='64' id='bb28da1c'/>
       <pointer-type-def type-id='02c44ccf' size-in-bits='64' id='bb2cb7cb'/>
@@ -83185,6 +83010,7 @@
           <var-decl name='priv' type-id='eaa32e2f' visibility='default' filepath='include/linux/interrupt.h' line='300' column='1'/>
         </data-member>
       </class-decl>
+      <qualified-type-def type-id='69bf7bee' const='yes' id='bf352dfe'/>
       <pointer-type-def type-id='663acc25' size-in-bits='64' id='bf3ef905'/>
       <class-decl name='spi_statistics' size-in-bits='1856' is-struct='yes' visibility='default' filepath='include/linux/spi/spi.h' line='57' column='1' id='bf41d149'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -83803,7 +83629,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='c0de8daa'>
-        <parameter type-id='146bc842' name='req'/>
+        <parameter type-id='146bc842'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='d83a2db1' size-in-bits='64' id='c0e2acc9'/>
@@ -84483,9 +84309,9 @@
       <class-decl name='ip_mc_list' is-struct='yes' visibility='default' is-declaration-only='yes' id='c2a59aaa'/>
       <pointer-type-def type-id='5e80f131' size-in-bits='64' id='c2ab7955'/>
       <function-type size-in-bits='64' id='c2b07168'>
-        <parameter type-id='1351523a' name='tfm'/>
-        <parameter type-id='bbaf3419' name='key'/>
-        <parameter type-id='f0981eeb' name='keylen'/>
+        <parameter type-id='1351523a'/>
+        <parameter type-id='bbaf3419'/>
+        <parameter type-id='f0981eeb'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='9b27c78b' size-in-bits='64' id='c2b4b27b'/>
@@ -84953,26 +84779,7 @@
       </function-type>
       <pointer-type-def type-id='bb56dd02' size-in-bits='64' id='c398045c'/>
       <pointer-type-def type-id='d2c7a2c1' size-in-bits='64' id='c39cf839'/>
-      <class-decl name='xol_area' size-in-bits='768' is-struct='yes' visibility='default' filepath='kernel/events/uprobes.c' line='98' column='1' id='c39df2b8'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='wq' type-id='b5ab048f' visibility='default' filepath='kernel/events/uprobes.c' line='99' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='slot_count' type-id='49178f86' visibility='default' filepath='kernel/events/uprobes.c' line='100' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='bitmap' type-id='1d2c2b85' visibility='default' filepath='kernel/events/uprobes.c' line='101' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='xol_mapping' type-id='f0136291' visibility='default' filepath='kernel/events/uprobes.c' line='103' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='pages' type-id='daa7f9e0' visibility='default' filepath='kernel/events/uprobes.c' line='104' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='vaddr' type-id='7359adad' visibility='default' filepath='kernel/events/uprobes.c' line='110' column='1'/>
-        </data-member>
-      </class-decl>
+      <class-decl name='xol_area' is-struct='yes' visibility='default' is-declaration-only='yes' id='c39df2b8'/>
       <pointer-type-def type-id='449a6017' size-in-bits='64' id='c3a1efbb'/>
       <pointer-type-def type-id='e0a68fea' size-in-bits='64' id='c3a28778'/>
       <pointer-type-def type-id='a5390025' size-in-bits='64' id='c3a655b9'/>
@@ -84997,7 +84804,7 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='c3b2916f'>
-        <parameter type-id='b26c7631'/>
+        <parameter type-id='b26c7631' name='up'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='7a773bd0' size-in-bits='64' id='c3b36a8e'/>
@@ -85022,6 +84829,7 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <qualified-type-def type-id='9c313c2d' const='yes' id='c3b7ba7d'/>
       <class-decl name='ethtool_wolinfo' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/uapi/linux/ethtool.h' line='203' column='1' id='c3b8a83b'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='cmd' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/ethtool.h' line='204' column='1'/>
@@ -85060,6 +84868,7 @@
           <var-decl name='' type-id='e873af3e' visibility='default' filepath='include/linux/user_namespace.h' line='28' column='1'/>
         </data-member>
       </union-decl>
+      <qualified-type-def type-id='6bac1cb5' const='yes' id='c3f0f7d9'/>
       <pointer-type-def type-id='76b325f9' size-in-bits='64' id='c3f1f74d'/>
       <function-type size-in-bits='64' id='c3f42608'>
         <parameter type-id='3dad1a48'/>
@@ -86429,7 +86238,7 @@
       </class-decl>
       <pointer-type-def type-id='22ddde2b' size-in-bits='64' id='c6485e8f'/>
       <function-type size-in-bits='64' id='c64b743f'>
-        <parameter type-id='898c1076' name='this_tr'/>
+        <parameter type-id='898c1076'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='692fa8cc' size-in-bits='64' id='c64e62ba'/>
@@ -87059,8 +86868,8 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='c85f87a7'>
-        <parameter type-id='343c3ae4'/>
-        <parameter type-id='f0981eeb'/>
+        <parameter type-id='343c3ae4' name='policy'/>
+        <parameter type-id='f0981eeb' name='target_freq'/>
         <return type-id='f0981eeb'/>
       </function-type>
       <class-decl name='ipv6_stub' size-in-bits='1344' is-struct='yes' visibility='default' filepath='include/net/ipv6_stubs.h' line='22' column='1' id='c8604f6d'>
@@ -88120,7 +87929,6 @@
       <array-type-def dimensions='1' type-id='d3130597' size-in-bits='1984' id='cb6b7280'>
         <subrange length='31' type-id='7ff19f0f' id='ae5e1d19'/>
       </array-type-def>
-      <pointer-type-def type-id='d509ab32' size-in-bits='64' id='cb6e5180'/>
       <qualified-type-def type-id='cfe4f8a2' const='yes' id='cb71e1ad'/>
       <enum-decl name='ieee80211_bss_type' filepath='include/net/cfg80211.h' line='225' column='1' id='cb952348'>
         <underlying-type type-id='9cac1fee'/>
@@ -88280,6 +88088,14 @@
       <pointer-type-def type-id='c9196d18' size-in-bits='64' id='cba10b6e'/>
       <pointer-type-def type-id='4b7a84f4' size-in-bits='64' id='cba114b6'/>
       <pointer-type-def type-id='284260b8' size-in-bits='64' id='cba1f2de'/>
+      <array-type-def dimensions='1' type-id='e151255a' size-in-bits='65536' id='cba3052b'>
+        <subrange length='1024' type-id='7ff19f0f' id='c60446f8'/>
+      </array-type-def>
+      <function-type size-in-bits='64' id='cba59087'>
+        <parameter type-id='eaa32e2f'/>
+        <parameter type-id='91ce1af9'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <function-type size-in-bits='64' id='cbab5390'>
         <parameter type-id='7837cd88'/>
         <parameter type-id='80f4b756'/>
@@ -88714,7 +88530,20 @@
       <pointer-type-def type-id='72028e1c' size-in-bits='64' id='cc8d835a'/>
       <pointer-type-def type-id='8eb07132' size-in-bits='64' id='cc8decc0'/>
       <pointer-type-def type-id='47ca6fd3' size-in-bits='64' id='cc91152f'/>
-      <class-decl name='kernfs_open_node' is-struct='yes' visibility='default' is-declaration-only='yes' id='cc9b8e48'/>
+      <class-decl name='kernfs_open_node' size-in-bits='384' is-struct='yes' visibility='default' filepath='fs/kernfs/file.c' line='35' column='1' id='cc9b8e48'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='refcnt' type-id='49178f86' visibility='default' filepath='fs/kernfs/file.c' line='36' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='event' type-id='49178f86' visibility='default' filepath='fs/kernfs/file.c' line='37' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='poll' type-id='b5ab048f' visibility='default' filepath='fs/kernfs/file.c' line='38' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='files' type-id='72f469ec' visibility='default' filepath='fs/kernfs/file.c' line='39' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='db281924' size-in-bits='64' id='cc9f99b2'/>
       <function-type size-in-bits='64' id='cca56d7c'>
         <parameter type-id='32efad44'/>
@@ -89271,7 +89100,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='ce6ad852'>
-        <parameter type-id='182be7cc' name='dsi'/>
+        <parameter type-id='182be7cc'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='20047fcf' size-in-bits='64' id='ce713533'/>
@@ -89351,7 +89180,7 @@
         <subrange length='31' type-id='7ff19f0f' id='ae5e1d19'/>
       </array-type-def>
       <function-type size-in-bits='64' id='cecfa2ad'>
-        <parameter type-id='4db02c58' name='connector'/>
+        <parameter type-id='4db02c58'/>
         <return type-id='48b5725f'/>
       </function-type>
       <class-decl name='snd_device' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/sound/core.h' line='69' column='1' id='ced794e3'>
@@ -89646,6 +89475,7 @@
           <var-decl name='slot_map' type-id='f0981eeb' visibility='default' filepath='include/uapi/linux/hdlc/ioctl.h' line='50' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='29ce7f43' size-in-bits='64' id='cf77d29f'/>
       <pointer-type-def type-id='117e939c' size-in-bits='64' id='cf781f0e'/>
       <class-decl name='thermal_zone_device_ops' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/thermal.h' line='62' column='1' id='cf7993c1'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -89782,7 +89612,7 @@
       </function-type>
       <qualified-type-def type-id='63b6be81' const='yes' id='cfa9604e'/>
       <function-type size-in-bits='64' id='cfb839d2'>
-        <parameter type-id='db362995'/>
+        <parameter type-id='db362995' name='pdev'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='94dd3300' size-in-bits='64' id='cfbdf512'/>
@@ -91244,7 +91074,6 @@
       <pointer-type-def type-id='0ad12489' size-in-bits='64' id='d3769ffd'/>
       <pointer-type-def type-id='4dedc1bb' size-in-bits='64' id='d379869f'/>
       <pointer-type-def type-id='08dd4249' size-in-bits='64' id='d37a2705'/>
-      <qualified-type-def type-id='57d8dd3d' const='yes' id='d37aa9fa'/>
       <pointer-type-def type-id='7e8ddfae' size-in-bits='64' id='d3807eb0'/>
       <function-type size-in-bits='64' id='d385bfac'>
         <parameter type-id='b9af02c3'/>
@@ -91739,17 +91568,6 @@
       </array-type-def>
       <pointer-type-def type-id='9b08f7cd' size-in-bits='64' id='d504f73d'/>
       <pointer-type-def type-id='8edc59cf' size-in-bits='64' id='d507826b'/>
-      <class-decl name='fscrypt_blk_crypto_key' size-in-bits='1280' is-struct='yes' visibility='default' filepath='fs/crypto/inline_crypt.c' line='25' column='1' id='d509ab32'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='base' type-id='7b61b7b4' visibility='default' filepath='fs/crypto/inline_crypt.c' line='26' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='num_devs' type-id='95e97e5e' visibility='default' filepath='fs/crypto/inline_crypt.c' line='27' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='devs' type-id='60a540a8' visibility='default' filepath='fs/crypto/inline_crypt.c' line='28' column='1'/>
-        </data-member>
-      </class-decl>
       <class-decl name='kmsg_dumper' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/kmsg_dump.h' line='40' column='1' id='d50d3459'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/linux/kmsg_dump.h' line='41' column='1'/>
@@ -92509,7 +92327,7 @@
       </function-type>
       <pointer-type-def type-id='e6fedf36' size-in-bits='64' id='d65efcf0'/>
       <function-type size-in-bits='64' id='d660dfdd'>
-        <parameter type-id='c1547255' name='rng'/>
+        <parameter type-id='c1547255'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='4b09229d' size-in-bits='64' id='d661a615'/>
@@ -93053,7 +92871,7 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='d7b840f9'>
-        <parameter type-id='e5411c2c'/>
+        <parameter type-id='e5411c2c' name='f'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='8741a34d' size-in-bits='64' id='d7b98f89'/>
@@ -93491,7 +93309,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='0cf765ad' size-in-bits='64' id='d8db14d1'/>
-      <pointer-type-def type-id='c894953d' size-in-bits='64' id='d8e6b335'/>
+      <pointer-type-def type-id='b50a4934' size-in-bits='64' id='d8e6b335'/>
       <pointer-type-def type-id='a73d96cf' size-in-bits='64' id='d8e759a7'/>
       <qualified-type-def type-id='27dec419' const='yes' id='d8e81cd4'/>
       <class-decl name='iommu_inv_addr_info' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/uapi/linux/iommu.h' line='189' column='1' id='d8e8de01'>
@@ -94188,9 +94006,6 @@
         <parameter type-id='f9b37274'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <array-type-def dimensions='1' type-id='02f11ed4' size-in-bits='128' id='daa7f9e0'>
-        <subrange length='2' type-id='7ff19f0f' id='52efc4ef'/>
-      </array-type-def>
       <pointer-type-def type-id='1d334f81' size-in-bits='64' id='daa81219'/>
       <function-type size-in-bits='64' id='daae3cc8'>
         <parameter type-id='ee406209'/>
@@ -95425,6 +95240,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='e0ed16c6' size-in-bits='64' id='dc18a9b0'/>
+      <typedef-decl name='gro_result_t' type-id='3facc5aa' filepath='include/linux/netdevice.h' line='389' column='1' id='dc1b1685'/>
       <class-decl name='dwc3_ep' size-in-bits='1856' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='705' column='1' id='dc1b9a32'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='endpoint' type-id='8005701f' visibility='default' filepath='drivers/usb/dwc3/core.h' line='706' column='1'/>
@@ -95700,8 +95516,8 @@
       <pointer-type-def type-id='3b1012d7' size-in-bits='64' id='dcab5203'/>
       <pointer-type-def type-id='3ec9b040' size-in-bits='64' id='dcad5492'/>
       <function-type size-in-bits='64' id='dcb10fbf'>
-        <parameter type-id='af5eeab9'/>
-        <parameter type-id='95e97e5e'/>
+        <parameter type-id='af5eeab9' name='req'/>
+        <parameter type-id='95e97e5e' name='err'/>
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='bb05a47a' size-in-bits='64' id='dcbbb1fc'/>
@@ -95898,8 +95714,8 @@
         <return type-id='48b5725f'/>
       </function-type>
       <function-type size-in-bits='64' id='dd8f90df'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='f0981eeb'/>
+        <parameter type-id='68a2d05b' name='dev'/>
+        <parameter type-id='f0981eeb' name='txq'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <typedef-decl name='local_t' type-id='de878dd6' filepath='include/asm-generic/local.h' line='25' column='1' id='dd91f264'/>
@@ -97019,6 +96835,7 @@
           <var-decl name='count' type-id='2020bac4' visibility='default' filepath='include/linux/mm_types_task.h' line='56' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='92892da6' size-in-bits='64' id='dffc7428'/>
       <typedef-decl name='efi_time_t' type-id='5c952537' filepath='include/linux/efi.h' line='193' column='1' id='dffd2b75'/>
       <pointer-type-def type-id='7f73c08c' size-in-bits='64' id='e003b5ce'/>
       <pointer-type-def type-id='42b16dba' size-in-bits='64' id='e0087b68'/>
@@ -97991,7 +97808,14 @@
         <return type-id='b50a4934'/>
       </function-type>
       <typedef-decl name='seqcount_t' type-id='3a74ff0b' filepath='include/linux/seqlock.h' line='70' column='1' id='e14c3b11'/>
-      <class-decl name='iova_magazine' is-struct='yes' visibility='default' is-declaration-only='yes' id='e14d461f'/>
+      <class-decl name='iova_magazine' size-in-bits='8256' is-struct='yes' visibility='default' filepath='drivers/iommu/iova.c' line='879' column='1' id='e14d461f'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='size' type-id='7359adad' visibility='default' filepath='drivers/iommu/iova.c' line='880' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='pfns' type-id='187c43b2' visibility='default' filepath='drivers/iommu/iova.c' line='881' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='hlist_head' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/types.h' line='182' column='1' id='e151255a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='first' type-id='08cbad52' visibility='default' filepath='include/linux/types.h' line='183' column='1'/>
@@ -99052,10 +98876,10 @@
       </function-type>
       <qualified-type-def type-id='06dfa6bb' const='yes' id='e4083e44'/>
       <pointer-type-def type-id='44b3a0ac' size-in-bits='64' id='e40f7bda'/>
-      <array-type-def dimensions='1' type-id='95e97e5e' size-in-bits='288' id='e415235d'>
-        <subrange length='9' type-id='7ff19f0f' id='12e4273c'/>
-      </array-type-def>
       <pointer-type-def type-id='94111b83' size-in-bits='64' id='e4163de3'/>
+      <array-type-def dimensions='1' type-id='95e97e5e' size-in-bits='192' id='e41bdf22'>
+        <subrange length='6' type-id='7ff19f0f' id='52fa524b'/>
+      </array-type-def>
       <enum-decl name='scsi_host_state' filepath='include/scsi/scsi_host.h' line='520' column='1' id='e41e14c7'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='SHOST_CREATED' value='1'/>
@@ -99079,7 +98903,7 @@
       <typedef-decl name='tracepoint_ptr_t' type-id='2448a865' filepath='include/linux/tracepoint-defs.h' line='44' column='1' id='e431ac27'/>
       <pointer-type-def type-id='879dea4a' size-in-bits='64' id='e4330308'/>
       <function-type size-in-bits='64' id='e4357afb'>
-        <parameter type-id='c062d7a5' name='dev'/>
+        <parameter type-id='c062d7a5'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <class-decl name='v4l2_vp8_loopfilter_header' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/media/vp8-ctrls.h' line='37' column='1' id='e4362873'>
@@ -99220,8 +99044,8 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='e4a6917b'>
-        <parameter type-id='51a94113'/>
-        <parameter type-id='2f9b8041'/>
+        <parameter type-id='51a94113' name='dma_spec'/>
+        <parameter type-id='2f9b8041' name='ofdma'/>
         <return type-id='27f3f5d8'/>
       </function-type>
       <pointer-type-def type-id='d1a7f9af' size-in-bits='64' id='e4a73b37'/>
@@ -99821,7 +99645,6 @@
           <var-decl name='__reserved_3' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/perf_event.h' line='438' column='1'/>
         </data-member>
       </class-decl>
-      <pointer-type-def type-id='3aa8a3a4' size-in-bits='64' id='e579788a'/>
       <enum-decl name='drm_color_encoding' filepath='include/drm/drm_color_mgmt.h' line='77' column='1' id='e57e5f2b'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='DRM_COLOR_YCBCR_BT601' value='0'/>
@@ -100090,6 +99913,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='35213710' size-in-bits='64' id='e61cb0da'/>
+      <typedef-decl name='new_page_t' type-id='5824bc76' filepath='include/linux/migrate.h' line='10' column='1' id='e61ec55f'/>
       <function-type size-in-bits='64' id='e625eab0'>
         <parameter type-id='80f4b756'/>
         <parameter type-id='edcbd723'/>
@@ -100615,7 +100439,20 @@
           <var-decl name='branch_reg' type-id='a80839c0' visibility='default' filepath='include/linux/perf_event.h' line='148' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='can_dev_rcv_lists' is-struct='yes' visibility='default' is-declaration-only='yes' id='e82476af'/>
+      <class-decl name='can_dev_rcv_lists' size-in-bits='196928' is-struct='yes' visibility='default' filepath='include/linux/can/can-ml.h' line='55' column='1' id='e82476af'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='rx' type-id='fc3a8480' visibility='default' filepath='include/linux/can/can-ml.h' line='56' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='rx_sff' type-id='b9cedcb8' visibility='default' filepath='include/linux/can/can-ml.h' line='57' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='131328'>
+          <var-decl name='rx_eff' type-id='cba3052b' visibility='default' filepath='include/linux/can/can-ml.h' line='58' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='196864'>
+          <var-decl name='entries' type-id='95e97e5e' visibility='default' filepath='include/linux/can/can-ml.h' line='59' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='e82a9f1d'>
         <parameter type-id='77e79a4b'/>
         <parameter type-id='eaa32e2f'/>
@@ -100674,6 +100511,9 @@
       <pointer-type-def type-id='cf29c9b3' size-in-bits='64' id='e835b5d8'/>
       <pointer-type-def type-id='72a2bb90' size-in-bits='64' id='e83ba222'/>
       <pointer-type-def type-id='0790750c' size-in-bits='64' id='e83d6bbe'/>
+      <array-type-def dimensions='1' type-id='26760480' size-in-bits='384' id='e83fe618'>
+        <subrange length='6' type-id='7ff19f0f' id='52fa524b'/>
+      </array-type-def>
       <array-type-def dimensions='1' type-id='a84c031d' size-in-bits='infinite' id='e84913bd'>
         <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
       </array-type-def>
@@ -104039,20 +103879,7 @@
         <return type-id='4adb0e6a'/>
       </function-type>
       <pointer-type-def type-id='2a4c87c4' size-in-bits='64' id='eff2bbc2'/>
-      <class-decl name='vm_special_mapping' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/mm_types.h' line='794' column='1' id='f0136291'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/mm_types.h' line='795' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='pages' type-id='9f93c9da' visibility='default' filepath='include/linux/mm_types.h' line='803' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='fault' type-id='24e78d82' visibility='default' filepath='include/linux/mm_types.h' line='809' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='mremap' type-id='46d78c8b' visibility='default' filepath='include/linux/mm_types.h' line='813' column='1'/>
-        </data-member>
-      </class-decl>
+      <qualified-type-def type-id='928221d2' const='yes' id='effb3702'/>
       <pointer-type-def type-id='a9918a4d' size-in-bits='64' id='f0150b1d'/>
       <array-type-def dimensions='1' type-id='a84c031d' size-in-bits='112' id='f01a039e'>
         <subrange length='14' type-id='7ff19f0f' id='48882d96'/>
@@ -104387,6 +104214,7 @@
       <array-type-def dimensions='1' type-id='7359adad' size-in-bits='320' id='f06fd798'>
         <subrange length='5' type-id='7ff19f0f' id='53010e10'/>
       </array-type-def>
+      <pointer-type-def type-id='effb3702' size-in-bits='64' id='f077d3f8'/>
       <enum-decl name='snd_soc_bias_level' filepath='include/sound/soc-dapm.h' line='392' column='1' id='f078c744'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='SND_SOC_BIAS_OFF' value='0'/>
@@ -107696,7 +107524,7 @@
           <var-decl name='type' type-id='95e97e5e' visibility='default' filepath='include/net/bluetooth/hci_core.h' line='65' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='state' type-id='08f5ca1d' visibility='default' filepath='include/net/bluetooth/hci_core.h' line='72' column='1'/>
+          <var-decl name='state' type-id='08f5ca1e' visibility='default' filepath='include/net/bluetooth/hci_core.h' line='72' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
           <var-decl name='all' type-id='72f469ec' visibility='default' filepath='include/net/bluetooth/hci_core.h' line='73' column='1'/>
@@ -108236,11 +108064,6 @@
           <var-decl name='alg_key' type-id='e84913bd' visibility='default' filepath='include/uapi/linux/xfrm.h' line='112' column='1'/>
         </data-member>
       </class-decl>
-      <function-type size-in-bits='64' id='faa28adf'>
-        <parameter type-id='e579788a'/>
-        <parameter type-id='2ae08426'/>
-        <return type-id='95e97e5e'/>
-      </function-type>
       <array-type-def dimensions='1' type-id='59b5b331' size-in-bits='16384' id='faa42463'>
         <subrange length='64' type-id='7ff19f0f' id='b10be967'/>
       </array-type-def>
@@ -108567,6 +108390,7 @@
           <var-decl name='buffer' type-id='460b55b1' visibility='default' filepath='include/linux/fs_context.h' line='188' column='1'/>
         </data-member>
       </class-decl>
+      <typedef-decl name='z_streamp' type-id='369435a4' filepath='include/linux/zlib.h' line='103' column='1' id='fb4f8c25'/>
       <array-type-def dimensions='1' type-id='f9fef04f' size-in-bits='7936' id='fb518993'>
         <subrange length='31' type-id='7ff19f0f' id='ae5e1d19'/>
       </array-type-def>
@@ -110291,7 +110115,6 @@
           <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/fdtable.h' line='33' column='1'/>
         </data-member>
       </class-decl>
-      <qualified-type-def type-id='95fcbc94' const='yes' id='ff37489f'/>
       <class-decl name='timerqueue_head' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/timerqueue.h' line='14' column='1' id='ff3c7f20'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='rb_root' type-id='6fe1603d' visibility='default' filepath='include/linux/timerqueue.h' line='15' column='1'/>
@@ -110376,7 +110199,6 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <pointer-type-def type-id='ba05298e' size-in-bits='64' id='ff9465c8'/>
       <function-type size-in-bits='64' id='ff95f77c'>
         <parameter type-id='77e79a4b'/>
         <parameter type-id='69bf7bee'/>
@@ -110495,8 +110317,8 @@
       </function-type>
       <pointer-type-def type-id='46f53066' size-in-bits='64' id='fffb07a4'/>
       <qualified-type-def type-id='55efd1a3' const='yes' id='fffdaf52'/>
-      <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='include/linux/proc_fs.h' line='112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
-        <parameter type-id='c5a4eb7f'/>
+      <function-decl name='PDE_DATA' mangled-name='PDE_DATA' filepath='fs/proc/generic.c' line='799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='PDE_DATA'>
+        <parameter type-id='c5a4eb7f' name='inode' filepath='fs/proc/generic.c' line='799' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='__ClearPageMovable' mangled-name='__ClearPageMovable' filepath='mm/compaction.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__ClearPageMovable'>
@@ -111028,6 +110850,7 @@
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <var-decl name='__drm_debug' type-id='f0981eeb' mangled-name='__drm_debug' visibility='default' filepath='drivers/gpu/drm/drm_print.c' line='43' column='1' elf-symbol-id='__drm_debug'/>
       <function-decl name='__drm_err' mangled-name='__drm_err' filepath='drivers/gpu/drm/drm_print.c' line='302' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_err'>
         <parameter type-id='80f4b756' name='format' filepath='drivers/gpu/drm/drm_print.c' line='302' column='1'/>
         <parameter is-variadic='yes'/>
@@ -114218,38 +114041,38 @@
         <parameter type-id='b50a4934' name='sync' filepath='net/xfrm/xfrm_state.c' line='640' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_atomic_dec_and_lock' mangled-name='_atomic_dec_and_lock' filepath='include/linux/spinlock.h' line='470' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_atomic_dec_and_lock'>
-        <parameter type-id='8567d8b2'/>
-        <parameter type-id='34e69a54'/>
+      <function-decl name='_atomic_dec_and_lock' mangled-name='_atomic_dec_and_lock' filepath='lib/dec_and_lock.c' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_atomic_dec_and_lock'>
+        <parameter type-id='8a47abc3' name='atomic' filepath='lib/dec_and_lock.c' line='21' column='1'/>
+        <parameter type-id='cff2d845' name='lock' filepath='lib/dec_and_lock.c' line='21' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='_copy_from_iter' mangled-name='_copy_from_iter' filepath='include/linux/uio.h' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_copy_from_iter'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='4fa10f9e'/>
-        <return type-id='7359adad'/>
+      <function-decl name='_copy_from_iter' mangled-name='_copy_from_iter' filepath='lib/iov_iter.c' line='765' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_copy_from_iter'>
+        <parameter type-id='eaa32e2f' name='addr' filepath='lib/iov_iter.c' line='765' column='1'/>
+        <parameter type-id='b59d7dce' name='bytes' filepath='lib/iov_iter.c' line='765' column='1'/>
+        <parameter type-id='4fa10f9e' name='i' filepath='lib/iov_iter.c' line='765' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
-      <function-decl name='_copy_from_iter_full' mangled-name='_copy_from_iter_full' filepath='include/linux/uio.h' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_copy_from_iter_full'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='4fa10f9e'/>
-        <return type-id='c894953d'/>
+      <function-decl name='_copy_from_iter_full' mangled-name='_copy_from_iter_full' filepath='lib/iov_iter.c' line='785' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_copy_from_iter_full'>
+        <parameter type-id='eaa32e2f' name='addr' filepath='lib/iov_iter.c' line='785' column='1'/>
+        <parameter type-id='b59d7dce' name='bytes' filepath='lib/iov_iter.c' line='785' column='1'/>
+        <parameter type-id='4fa10f9e' name='i' filepath='lib/iov_iter.c' line='785' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='_copy_to_iter' mangled-name='_copy_to_iter' filepath='include/linux/uio.h' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_copy_to_iter'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='4fa10f9e'/>
-        <return type-id='7359adad'/>
+      <function-decl name='_copy_to_iter' mangled-name='_copy_to_iter' filepath='lib/iov_iter.c' line='630' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_copy_to_iter'>
+        <parameter type-id='eaa32e2f' name='addr' filepath='lib/iov_iter.c' line='630' column='1'/>
+        <parameter type-id='b59d7dce' name='bytes' filepath='lib/iov_iter.c' line='630' column='1'/>
+        <parameter type-id='4fa10f9e' name='i' filepath='lib/iov_iter.c' line='630' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
-      <function-decl name='_dev_alert' mangled-name='_dev_alert' filepath='include/linux/dev_printk.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_alert'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='_dev_alert' mangled-name='_dev_alert' filepath='drivers/base/core.c' line='4498' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_alert'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4498' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4498' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_dev_crit' mangled-name='_dev_crit' filepath='include/linux/dev_printk.h' line='48' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_crit'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='_dev_crit' mangled-name='_dev_crit' filepath='drivers/base/core.c' line='4499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_crit'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4499' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4499' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
@@ -114259,32 +114082,32 @@
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_dev_err' mangled-name='_dev_err' filepath='include/linux/dev_printk.h' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_err'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='_dev_err' mangled-name='_dev_err' filepath='drivers/base/core.c' line='4500' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_err'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4500' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4500' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_dev_info' mangled-name='_dev_info' filepath='include/linux/dev_printk.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_info'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='_dev_info' mangled-name='_dev_info' filepath='drivers/base/core.c' line='4503' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_info'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4503' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4503' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_dev_notice' mangled-name='_dev_notice' filepath='include/linux/dev_printk.h' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_notice'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='_dev_notice' mangled-name='_dev_notice' filepath='drivers/base/core.c' line='4502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_notice'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4502' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4502' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_dev_warn' mangled-name='_dev_warn' filepath='include/linux/dev_printk.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_warn'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='_dev_warn' mangled-name='_dev_warn' filepath='drivers/base/core.c' line='4501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_dev_warn'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4501' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4501' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_read_lock' mangled-name='_raw_read_lock' filepath='include/linux/rwlock_api_smp.h' line='18' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_read_lock'>
-        <parameter type-id='8567d8b3'/>
+      <function-decl name='_raw_read_lock' mangled-name='_raw_read_lock' filepath='kernel/locking/spinlock.c' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_read_lock'>
+        <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='221' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_read_lock_bh' mangled-name='_raw_read_lock_bh' filepath='kernel/locking/spinlock.c' line='245' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_read_lock_bh'>
@@ -114303,8 +114126,8 @@
         <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='213' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='_raw_read_unlock' mangled-name='_raw_read_unlock' filepath='include/linux/rwlock_api_smp.h' line='30' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_read_unlock'>
-        <parameter type-id='8567d8b3'/>
+      <function-decl name='_raw_read_unlock' mangled-name='_raw_read_unlock' filepath='kernel/locking/spinlock.c' line='253' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_read_unlock'>
+        <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='253' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_read_unlock_bh' mangled-name='_raw_read_unlock_bh' filepath='kernel/locking/spinlock.c' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_read_unlock_bh'>
@@ -114320,57 +114143,57 @@
         <parameter type-id='7359adad' name='flags' filepath='kernel/locking/spinlock.c' line='261' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_spin_lock' mangled-name='_raw_spin_lock' filepath='include/linux/spinlock_api_smp.h' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_lock'>
-        <parameter type-id='538ece95'/>
+      <function-decl name='_raw_spin_lock' mangled-name='_raw_spin_lock' filepath='kernel/locking/spinlock.c' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_lock'>
+        <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='149' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_spin_lock_bh' mangled-name='_raw_spin_lock_bh' filepath='kernel/locking/spinlock.c' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_lock_bh'>
         <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='173' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_spin_lock_irq' mangled-name='_raw_spin_lock_irq' filepath='include/linux/spinlock_api_smp.h' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_lock_irq'>
-        <parameter type-id='538ece95'/>
+      <function-decl name='_raw_spin_lock_irq' mangled-name='_raw_spin_lock_irq' filepath='kernel/locking/spinlock.c' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_lock_irq'>
+        <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='165' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_spin_lock_irqsave' mangled-name='_raw_spin_lock_irqsave' filepath='include/linux/spinlock_api_smp.h' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_lock_irqsave'>
-        <parameter type-id='538ece95'/>
+      <function-decl name='_raw_spin_lock_irqsave' mangled-name='_raw_spin_lock_irqsave' filepath='kernel/locking/spinlock.c' line='157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_lock_irqsave'>
+        <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='157' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='_raw_spin_trylock' mangled-name='_raw_spin_trylock' filepath='include/linux/spinlock_api_smp.h' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_trylock'>
-        <parameter type-id='538ece95'/>
+      <function-decl name='_raw_spin_trylock' mangled-name='_raw_spin_trylock' filepath='kernel/locking/spinlock.c' line='133' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_trylock'>
+        <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='133' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='_raw_spin_trylock_bh' mangled-name='_raw_spin_trylock_bh' filepath='kernel/locking/spinlock.c' line='141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_trylock_bh'>
         <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='141' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='_raw_spin_unlock' mangled-name='_raw_spin_unlock' filepath='include/linux/spinlock_api_smp.h' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_unlock'>
-        <parameter type-id='538ece95'/>
+      <function-decl name='_raw_spin_unlock' mangled-name='_raw_spin_unlock' filepath='kernel/locking/spinlock.c' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_unlock'>
+        <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='181' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_spin_unlock_bh' mangled-name='_raw_spin_unlock_bh' filepath='kernel/locking/spinlock.c' line='205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_unlock_bh'>
         <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='205' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_spin_unlock_irq' mangled-name='_raw_spin_unlock_irq' filepath='include/linux/spinlock_api_smp.h' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_unlock_irq'>
-        <parameter type-id='538ece95'/>
+      <function-decl name='_raw_spin_unlock_irq' mangled-name='_raw_spin_unlock_irq' filepath='kernel/locking/spinlock.c' line='197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_unlock_irq'>
+        <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='197' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_spin_unlock_irqrestore' mangled-name='_raw_spin_unlock_irqrestore' filepath='include/linux/spinlock_api_smp.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_unlock_irqrestore'>
-        <parameter type-id='538ece95'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='_raw_spin_unlock_irqrestore' mangled-name='_raw_spin_unlock_irqrestore' filepath='kernel/locking/spinlock.c' line='189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_spin_unlock_irqrestore'>
+        <parameter type-id='704982b4' name='lock' filepath='kernel/locking/spinlock.c' line='189' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='kernel/locking/spinlock.c' line='189' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_write_lock' mangled-name='_raw_write_lock' filepath='include/linux/rwlock_api_smp.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_lock'>
-        <parameter type-id='8567d8b3'/>
+      <function-decl name='_raw_write_lock' mangled-name='_raw_write_lock' filepath='kernel/locking/spinlock.c' line='293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_lock'>
+        <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='293' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_write_lock_bh' mangled-name='_raw_write_lock_bh' filepath='kernel/locking/spinlock.c' line='317' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_lock_bh'>
         <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='317' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_write_lock_irq' mangled-name='_raw_write_lock_irq' filepath='include/linux/rwlock_api_smp.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_lock_irq'>
-        <parameter type-id='8567d8b3'/>
+      <function-decl name='_raw_write_lock_irq' mangled-name='_raw_write_lock_irq' filepath='kernel/locking/spinlock.c' line='309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_lock_irq'>
+        <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='309' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_write_lock_irqsave' mangled-name='_raw_write_lock_irqsave' filepath='kernel/locking/spinlock.c' line='301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_lock_irqsave'>
@@ -114381,16 +114204,16 @@
         <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='285' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='_raw_write_unlock' mangled-name='_raw_write_unlock' filepath='include/linux/rwlock_api_smp.h' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_unlock'>
-        <parameter type-id='8567d8b3'/>
+      <function-decl name='_raw_write_unlock' mangled-name='_raw_write_unlock' filepath='kernel/locking/spinlock.c' line='325' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_unlock'>
+        <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='325' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_write_unlock_bh' mangled-name='_raw_write_unlock_bh' filepath='kernel/locking/spinlock.c' line='349' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_unlock_bh'>
         <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='349' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='_raw_write_unlock_irq' mangled-name='_raw_write_unlock_irq' filepath='include/linux/rwlock_api_smp.h' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_unlock_irq'>
-        <parameter type-id='8567d8b3'/>
+      <function-decl name='_raw_write_unlock_irq' mangled-name='_raw_write_unlock_irq' filepath='kernel/locking/spinlock.c' line='341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_unlock_irq'>
+        <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='341' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='_raw_write_unlock_irqrestore' mangled-name='_raw_write_unlock_irqrestore' filepath='kernel/locking/spinlock.c' line='333' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_write_unlock_irqrestore'>
@@ -114414,12 +114237,12 @@
         <parameter type-id='e0ea832a' name='lock' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='1109' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='access_process_vm' mangled-name='access_process_vm' filepath='include/linux/mm.h' line='1869' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='access_process_vm'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='access_process_vm' mangled-name='access_process_vm' filepath='mm/memory.c' line='5560' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='access_process_vm'>
+        <parameter type-id='f23e2572' name='tsk' filepath='mm/memory.c' line='5560' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='mm/memory.c' line='5560' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='mm/memory.c' line='5561' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='mm/memory.c' line='5561' column='1'/>
+        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/memory.c' line='5561' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='ack_all_badblocks' mangled-name='ack_all_badblocks' filepath='block/badblocks.c' line='433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ack_all_badblocks'>
@@ -114436,9 +114259,9 @@
         <parameter type-id='f0981eeb' name='cpu' filepath='kernel/cpu.c' line='1612' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='add_device_randomness' mangled-name='add_device_randomness' filepath='include/linux/random.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_device_randomness'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='add_device_randomness' mangled-name='add_device_randomness' filepath='drivers/char/random.c' line='1124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_device_randomness'>
+        <parameter type-id='eaa32e2f' name='buf' filepath='drivers/char/random.c' line='1124' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='drivers/char/random.c' line='1124' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='add_memory' mangled-name='add_memory' filepath='mm/memory_hotplug.c' line='1121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_memory'>
@@ -114454,33 +114277,33 @@
         <parameter type-id='91ce1af9' name='size' filepath='mm/memory_hotplug.c' line='1133' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='add_random_ready_callback' mangled-name='add_random_ready_callback' filepath='include/linux/random.h' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_random_ready_callback'>
-        <parameter type-id='b47c553a'/>
+      <function-decl name='add_random_ready_callback' mangled-name='add_random_ready_callback' filepath='drivers/char/random.c' line='1680' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_random_ready_callback'>
+        <parameter type-id='b47c553a' name='rdy' filepath='drivers/char/random.c' line='1680' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='add_taint' mangled-name='add_taint' filepath='include/linux/kernel.h' line='565' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_taint'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='5da9c47b'/>
+      <function-decl name='add_taint' mangled-name='add_taint' filepath='kernel/panic.c' line='441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_taint'>
+        <parameter type-id='f0981eeb' name='flag' filepath='kernel/panic.c' line='441' column='1'/>
+        <parameter type-id='5da9c47b' name='lockdep_ok' filepath='kernel/panic.c' line='441' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='add_timer' mangled-name='add_timer' filepath='include/linux/timer.h' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_timer'>
-        <parameter type-id='9248e67f'/>
+      <function-decl name='add_timer' mangled-name='add_timer' filepath='kernel/time/timer.c' line='1147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_timer'>
+        <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='1147' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='add_timer_on' mangled-name='add_timer_on' filepath='include/linux/timer.h' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_timer_on'>
-        <parameter type-id='9248e67f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='add_timer_on' mangled-name='add_timer_on' filepath='kernel/time/timer.c' line='1161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_timer_on'>
+        <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='1161' column='1'/>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/timer.c' line='1161' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='add_uevent_var' mangled-name='add_uevent_var' filepath='include/linux/kobject.h' line='261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_uevent_var'>
-        <parameter type-id='d9d65b21'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='add_uevent_var' mangled-name='add_uevent_var' filepath='lib/kobject_uevent.c' line='654' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_uevent_var'>
+        <parameter type-id='d9d65b21' name='env' filepath='lib/kobject_uevent.c' line='654' column='1'/>
+        <parameter type-id='80f4b756' name='format' filepath='lib/kobject_uevent.c' line='654' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='add_wait_queue' mangled-name='add_wait_queue' filepath='include/linux/wait.h' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_wait_queue'>
-        <parameter type-id='3f8b2ed3'/>
-        <parameter type-id='db9d03e3'/>
+      <function-decl name='add_wait_queue' mangled-name='add_wait_queue' filepath='kernel/sched/wait.c' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='add_wait_queue'>
+        <parameter type-id='3f8b2ed3' name='wq_head' filepath='kernel/sched/wait.c' line='19' column='1'/>
+        <parameter type-id='db9d03e3' name='wq_entry' filepath='kernel/sched/wait.c' line='19' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='adjust_managed_page_count' mangled-name='adjust_managed_page_count' filepath='mm/page_alloc.c' line='7751' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='adjust_managed_page_count'>
@@ -114493,22 +114316,22 @@
         <parameter type-id='69bd57be' name='inst' filepath='crypto/aead.c' line='287' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='aes_decrypt' mangled-name='aes_decrypt' filepath='include/crypto/aes.h' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='aes_decrypt'>
-        <parameter type-id='825271e7'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='354f7eb9'/>
+      <function-decl name='aes_decrypt' mangled-name='aes_decrypt' filepath='lib/crypto/aes.c' line='324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='aes_decrypt'>
+        <parameter type-id='825271e7' name='ctx' filepath='lib/crypto/aes.c' line='324' column='1'/>
+        <parameter type-id='8bff8096' name='out' filepath='lib/crypto/aes.c' line='324' column='1'/>
+        <parameter type-id='bbaf3419' name='in' filepath='lib/crypto/aes.c' line='324' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='aes_encrypt' mangled-name='aes_encrypt' filepath='include/crypto/aes.h' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='aes_encrypt'>
-        <parameter type-id='825271e7'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='354f7eb9'/>
+      <function-decl name='aes_encrypt' mangled-name='aes_encrypt' filepath='lib/crypto/aes.c' line='266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='aes_encrypt'>
+        <parameter type-id='825271e7' name='ctx' filepath='lib/crypto/aes.c' line='266' column='1'/>
+        <parameter type-id='8bff8096' name='out' filepath='lib/crypto/aes.c' line='266' column='1'/>
+        <parameter type-id='bbaf3419' name='in' filepath='lib/crypto/aes.c' line='266' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='aes_expandkey' mangled-name='aes_expandkey' filepath='include/crypto/aes.h' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='aes_expandkey'>
-        <parameter type-id='21370cb4'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='aes_expandkey' mangled-name='aes_expandkey' filepath='lib/crypto/aes.c' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='aes_expandkey'>
+        <parameter type-id='21370cb4' name='ctx' filepath='lib/crypto/aes.c' line='186' column='1'/>
+        <parameter type-id='bbaf3419' name='in_key' filepath='lib/crypto/aes.c' line='186' column='1'/>
+        <parameter type-id='f0981eeb' name='key_len' filepath='lib/crypto/aes.c' line='187' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='alarm_cancel' mangled-name='alarm_cancel' filepath='kernel/time/alarmtimer.c' line='429' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alarm_cancel'>
@@ -114582,13 +114405,13 @@
         <parameter type-id='eaa32e2f' name='cookie' filepath='drivers/iommu/io-pgtable.c' line='31' column='1'/>
         <return type-id='bf4bdb64'/>
       </function-decl>
-      <function-decl name='alloc_netdev_mqs' mangled-name='alloc_netdev_mqs' filepath='include/linux/netdevice.h' line='4457' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_netdev_mqs'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='548eee3a'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='alloc_netdev_mqs' mangled-name='alloc_netdev_mqs' filepath='net/core/dev.c' line='10547' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_netdev_mqs'>
+        <parameter type-id='95e97e5e' name='sizeof_priv' filepath='net/core/dev.c' line='10547' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='net/core/dev.c' line='10547' column='1'/>
+        <parameter type-id='002ac4a6' name='name_assign_type' filepath='net/core/dev.c' line='10548' column='1'/>
+        <parameter type-id='548eee3a' name='setup' filepath='net/core/dev.c' line='10549' column='1'/>
+        <parameter type-id='f0981eeb' name='txqs' filepath='net/core/dev.c' line='10550' column='1'/>
+        <parameter type-id='f0981eeb' name='rxqs' filepath='net/core/dev.c' line='10550' column='1'/>
         <return type-id='68a2d05b'/>
       </function-decl>
       <function-decl name='alloc_page_buffers' mangled-name='alloc_page_buffers' filepath='fs/buffer.c' line='839' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_page_buffers'>
@@ -114597,29 +114420,29 @@
         <parameter type-id='b50a4934' name='retry' filepath='fs/buffer.c' line='840' column='1'/>
         <return type-id='c485c22c'/>
       </function-decl>
-      <function-decl name='alloc_pages_exact' mangled-name='alloc_pages_exact' filepath='include/linux/gfp.h' line='589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_pages_exact'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='alloc_pages_exact' mangled-name='alloc_pages_exact' filepath='mm/page_alloc.c' line='5333' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_pages_exact'>
+        <parameter type-id='b59d7dce' name='size' filepath='mm/page_alloc.c' line='5333' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/page_alloc.c' line='5333' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='alloc_skb_with_frags' mangled-name='alloc_skb_with_frags' filepath='include/linux/skbuff.h' line='1104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_skb_with_frags'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='7292109c'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='alloc_skb_with_frags' mangled-name='alloc_skb_with_frags' filepath='net/core/skbuff.c' line='5877' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_skb_with_frags'>
+        <parameter type-id='7359adad' name='header_len' filepath='net/core/skbuff.c' line='5877' column='1'/>
+        <parameter type-id='7359adad' name='data_len' filepath='net/core/skbuff.c' line='5878' column='1'/>
+        <parameter type-id='95e97e5e' name='max_page_order' filepath='net/core/skbuff.c' line='5879' column='1'/>
+        <parameter type-id='7292109c' name='errcode' filepath='net/core/skbuff.c' line='5880' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='5881' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='alloc_workqueue' mangled-name='alloc_workqueue' filepath='include/linux/workqueue.h' line='413' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_workqueue'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='alloc_workqueue' mangled-name='alloc_workqueue' filepath='kernel/workqueue.c' line='4271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='alloc_workqueue'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/workqueue.c' line='4271' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='kernel/workqueue.c' line='4272' column='1'/>
+        <parameter type-id='95e97e5e' name='max_active' filepath='kernel/workqueue.c' line='4273' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='242e3d19'/>
       </function-decl>
       <var-decl name='amba_bustype' type-id='b31bfc8a' mangled-name='amba_bustype' visibility='default' filepath='drivers/amba/bus.c' line='215' column='1' elf-symbol-id='amba_bustype'/>
-      <function-decl name='amba_driver_register' mangled-name='amba_driver_register' filepath='include/linux/amba/bus.h' line='113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='amba_driver_register'>
-        <parameter type-id='6e829429'/>
+      <function-decl name='amba_driver_register' mangled-name='amba_driver_register' filepath='drivers/amba/bus.c' line='335' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='amba_driver_register'>
+        <parameter type-id='6e829429' name='drv' filepath='drivers/amba/bus.c' line='335' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='amba_driver_unregister' mangled-name='amba_driver_unregister' filepath='drivers/amba/bus.c' line='356' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='amba_driver_unregister'>
@@ -114661,11 +114484,11 @@
         <parameter type-id='95e97e5e' name='flags' filepath='fs/anon_inodes.c' line='198' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='anon_inode_getfile' mangled-name='anon_inode_getfile' filepath='include/linux/anon_inodes.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='anon_inode_getfile'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='61758ee5'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='anon_inode_getfile' mangled-name='anon_inode_getfile' filepath='fs/anon_inodes.c' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='anon_inode_getfile'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/anon_inodes.c' line='143' column='1'/>
+        <parameter type-id='61758ee5' name='fops' filepath='fs/anon_inodes.c' line='144' column='1'/>
+        <parameter type-id='eaa32e2f' name='priv' filepath='fs/anon_inodes.c' line='145' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='fs/anon_inodes.c' line='145' column='1'/>
         <return type-id='77e79a4b'/>
       </function-decl>
       <function-decl name='arc4_crypt' mangled-name='arc4_crypt' filepath='lib/crypto/arc4.c' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='arc4_crypt'>
@@ -114685,14 +114508,14 @@
         <return type-id='7359adad'/>
       </function-decl>
       <var-decl name='arch_timer_read_counter' type-id='0e70db3e' mangled-name='arch_timer_read_counter' visibility='default' filepath='drivers/clocksource/arm_arch_timer.c' line='179' column='1' elf-symbol-id='arch_timer_read_counter'/>
-      <function-decl name='argv_free' mangled-name='argv_free' filepath='include/linux/string.h' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='argv_free'>
-        <parameter type-id='9b23c9ad'/>
+      <function-decl name='argv_free' mangled-name='argv_free' filepath='lib/argv_split.c' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='argv_free'>
+        <parameter type-id='9b23c9ad' name='argv' filepath='lib/argv_split.c' line='35' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='argv_split' mangled-name='argv_split' filepath='include/linux/string.h' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='argv_split'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='argv_split' mangled-name='argv_split' filepath='lib/argv_split.c' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='argv_split'>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='lib/argv_split.c' line='60' column='1'/>
+        <parameter type-id='80f4b756' name='str' filepath='lib/argv_split.c' line='60' column='1'/>
+        <parameter type-id='7292109c' name='argcp' filepath='lib/argv_split.c' line='60' column='1'/>
         <return type-id='9b23c9ad'/>
       </function-decl>
       <var-decl name='arm64_const_caps_ready' type-id='237c0d27' mangled-name='arm64_const_caps_ready' visibility='default' filepath='arch/arm64/kernel/cpufeature.c' line='137' column='1' elf-symbol-id='arm64_const_caps_ready'/>
@@ -114715,15 +114538,15 @@
         <parameter type-id='fc616182' name='domain' filepath='kernel/async.c' line='273' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='atomic_notifier_call_chain' mangled-name='atomic_notifier_call_chain' filepath='include/linux/notifier.h' line='162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='atomic_notifier_call_chain'>
-        <parameter type-id='02162584'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='atomic_notifier_call_chain' mangled-name='atomic_notifier_call_chain' filepath='kernel/notifier.c' line='211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='atomic_notifier_call_chain'>
+        <parameter type-id='02162584' name='nh' filepath='kernel/notifier.c' line='211' column='1'/>
+        <parameter type-id='7359adad' name='val' filepath='kernel/notifier.c' line='212' column='1'/>
+        <parameter type-id='eaa32e2f' name='v' filepath='kernel/notifier.c' line='212' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='atomic_notifier_chain_register' mangled-name='atomic_notifier_chain_register' filepath='include/linux/notifier.h' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='atomic_notifier_chain_register'>
-        <parameter type-id='02162584'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='atomic_notifier_chain_register' mangled-name='atomic_notifier_chain_register' filepath='kernel/notifier.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='atomic_notifier_chain_register'>
+        <parameter type-id='02162584' name='nh' filepath='kernel/notifier.c' line='139' column='1'/>
+        <parameter type-id='d504f73d' name='n' filepath='kernel/notifier.c' line='140' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='atomic_notifier_chain_unregister' mangled-name='atomic_notifier_chain_unregister' filepath='kernel/notifier.c' line='161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='atomic_notifier_chain_unregister'>
@@ -114731,11 +114554,11 @@
         <parameter type-id='d504f73d' name='n' filepath='kernel/notifier.c' line='162' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='autoremove_wake_function' mangled-name='autoremove_wake_function' filepath='include/linux/wait.h' line='1134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='autoremove_wake_function'>
-        <parameter type-id='db9d03e3'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='autoremove_wake_function' mangled-name='autoremove_wake_function' filepath='kernel/sched/wait.c' line='396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='autoremove_wake_function'>
+        <parameter type-id='db9d03e3' name='wq_entry' filepath='kernel/sched/wait.c' line='396' column='1'/>
+        <parameter type-id='f0981eeb' name='mode' filepath='kernel/sched/wait.c' line='396' column='1'/>
+        <parameter type-id='95e97e5e' name='sync' filepath='kernel/sched/wait.c' line='397' column='1'/>
+        <parameter type-id='eaa32e2f' name='key' filepath='kernel/sched/wait.c' line='397' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='available_idle_cpu' mangled-name='available_idle_cpu' filepath='kernel/sched/core.c' line='5360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='available_idle_cpu'>
@@ -114785,21 +114608,21 @@
         <parameter type-id='95e97e5e' name='acknowledged' filepath='block/badblocks.c' line='164' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='badblocks_show' mangled-name='badblocks_show' filepath='include/linux/badblocks.h' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='badblocks_show'>
-        <parameter type-id='5760652c'/>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='badblocks_show' mangled-name='badblocks_show' filepath='block/badblocks.c' line='467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='badblocks_show'>
+        <parameter type-id='5760652c' name='bb' filepath='block/badblocks.c' line='467' column='1'/>
+        <parameter type-id='26a90f95' name='page' filepath='block/badblocks.c' line='467' column='1'/>
+        <parameter type-id='95e97e5e' name='unack' filepath='block/badblocks.c' line='467' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='badblocks_store' mangled-name='badblocks_store' filepath='include/linux/badblocks.h' line='51' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='badblocks_store'>
-        <parameter type-id='5760652c'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='badblocks_store' mangled-name='badblocks_store' filepath='block/badblocks.c' line='517' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='badblocks_store'>
+        <parameter type-id='5760652c' name='bb' filepath='block/badblocks.c' line='517' column='1'/>
+        <parameter type-id='80f4b756' name='page' filepath='block/badblocks.c' line='517' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='block/badblocks.c' line='517' column='1'/>
+        <parameter type-id='95e97e5e' name='unack' filepath='block/badblocks.c' line='518' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='balance_dirty_pages_ratelimited' mangled-name='balance_dirty_pages_ratelimited' filepath='include/linux/writeback.h' line='383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='balance_dirty_pages_ratelimited'>
-        <parameter type-id='f57039f0'/>
+      <function-decl name='balance_dirty_pages_ratelimited' mangled-name='balance_dirty_pages_ratelimited' filepath='mm/page-writeback.c' line='1883' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='balance_dirty_pages_ratelimited'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/page-writeback.c' line='1883' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='balloon_aops' type-id='38ce7f2c' mangled-name='balloon_aops' visibility='default' filepath='mm/balloon_compaction.c' line='253' column='1' elf-symbol-id='balloon_aops'/>
@@ -114840,18 +114663,18 @@
         <parameter type-id='b88dd945' name='bdev' filepath='block/genhd.c' line='2102' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='bdev_read_only' mangled-name='bdev_read_only' filepath='include/linux/blkdev.h' line='2004' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bdev_read_only'>
-        <parameter type-id='b88dd945'/>
+      <function-decl name='bdev_read_only' mangled-name='bdev_read_only' filepath='block/genhd.c' line='1875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bdev_read_only'>
+        <parameter type-id='b88dd945' name='bdev' filepath='block/genhd.c' line='1875' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bdevname' mangled-name='bdevname' filepath='include/linux/blkdev.h' line='2007' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bdevname'>
-        <parameter type-id='b88dd945'/>
-        <parameter type-id='26a90f95'/>
+      <function-decl name='bdevname' mangled-name='bdevname' filepath='block/genhd.c' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bdevname'>
+        <parameter type-id='b88dd945' name='bdev' filepath='block/genhd.c' line='89' column='1'/>
+        <parameter type-id='26a90f95' name='buf' filepath='block/genhd.c' line='89' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='bdget_disk' mangled-name='bdget_disk' filepath='include/linux/genhd.h' line='320' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bdget_disk'>
-        <parameter type-id='33c599da'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='bdget_disk' mangled-name='bdget_disk' filepath='block/genhd.c' line='1048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bdget_disk'>
+        <parameter type-id='33c599da' name='disk' filepath='block/genhd.c' line='1048' column='1'/>
+        <parameter type-id='95e97e5e' name='partno' filepath='block/genhd.c' line='1048' column='1'/>
         <return type-id='b88dd945'/>
       </function-decl>
       <function-decl name='bdi_alloc' mangled-name='bdi_alloc' filepath='mm/backing-dev.c' line='734' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bdi_alloc'>
@@ -114884,17 +114707,17 @@
         <parameter type-id='7359adad' name='flags' filepath='drivers/gpio/gpio-mmio.c' line='602' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bin2hex' mangled-name='bin2hex' filepath='include/linux/kernel.h' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bin2hex'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='bin2hex' mangled-name='bin2hex' filepath='lib/hexdump.c' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bin2hex'>
+        <parameter type-id='26a90f95' name='dst' filepath='lib/hexdump.c' line='66' column='1'/>
+        <parameter type-id='eaa32e2f' name='src' filepath='lib/hexdump.c' line='66' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/hexdump.c' line='66' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='bio_add_page' mangled-name='bio_add_page' filepath='include/linux/bio.h' line='443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_page'>
-        <parameter type-id='fb55efa1'/>
-        <parameter type-id='02f11ed4'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='bio_add_page' mangled-name='bio_add_page' filepath='block/bio.c' line='933' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_page'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='933' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='block/bio.c' line='933' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='block/bio.c' line='934' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='934' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='bio_add_pc_page' mangled-name='bio_add_pc_page' filepath='block/bio.c' line='845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_add_pc_page'>
@@ -114905,58 +114728,58 @@
         <parameter type-id='f0981eeb' name='offset' filepath='block/bio.c' line='846' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bio_alloc_bioset' mangled-name='bio_alloc_bioset' filepath='include/linux/bio.h' line='397' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_alloc_bioset'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='38b1e3a0'/>
+      <function-decl name='bio_alloc_bioset' mangled-name='bio_alloc_bioset' filepath='block/bio.c' line='437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_alloc_bioset'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/bio.c' line='437' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_iovecs' filepath='block/bio.c' line='437' column='1'/>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='438' column='1'/>
         <return type-id='fb55efa1'/>
       </function-decl>
-      <function-decl name='bio_associate_blkg' mangled-name='bio_associate_blkg' filepath='include/linux/bio.h' line='494' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_associate_blkg'>
-        <parameter type-id='fb55efa1'/>
+      <function-decl name='bio_associate_blkg' mangled-name='bio_associate_blkg' filepath='block/blk-cgroup.c' line='1867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_associate_blkg'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-cgroup.c' line='1867' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_chain' mangled-name='bio_chain' filepath='include/linux/bio.h' line='441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_chain'>
-        <parameter type-id='fb55efa1'/>
-        <parameter type-id='fb55efa1'/>
+      <function-decl name='bio_chain' mangled-name='bio_chain' filepath='block/bio.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_chain'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='338' column='1'/>
+        <parameter type-id='fb55efa1' name='parent' filepath='block/bio.c' line='338' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_clone_blkg_association' mangled-name='bio_clone_blkg_association' filepath='include/linux/bio.h' line='497' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_clone_blkg_association'>
-        <parameter type-id='fb55efa1'/>
-        <parameter type-id='fb55efa1'/>
+      <function-decl name='bio_clone_blkg_association' mangled-name='bio_clone_blkg_association' filepath='block/blk-cgroup.c' line='1889' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_clone_blkg_association'>
+        <parameter type-id='fb55efa1' name='dst' filepath='block/blk-cgroup.c' line='1889' column='1'/>
+        <parameter type-id='fb55efa1' name='src' filepath='block/blk-cgroup.c' line='1889' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_endio' mangled-name='bio_endio' filepath='include/linux/bio.h' line='417' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_endio'>
-        <parameter type-id='fb55efa1'/>
+      <function-decl name='bio_endio' mangled-name='bio_endio' filepath='block/bio.c' line='1428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_endio'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1428' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_init' mangled-name='bio_init' filepath='include/linux/bio.h' line='437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_init'>
-        <parameter type-id='fb55efa1'/>
-        <parameter type-id='cddcb53e'/>
-        <parameter type-id='8efea9e5'/>
+      <function-decl name='bio_init' mangled-name='bio_init' filepath='block/bio.c' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_init'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='278' column='1'/>
+        <parameter type-id='cddcb53e' name='table' filepath='block/bio.c' line='278' column='1'/>
+        <parameter type-id='8efea9e5' name='max_vecs' filepath='block/bio.c' line='279' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_put' mangled-name='bio_put' filepath='include/linux/bio.h' line='398' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_put'>
-        <parameter type-id='fb55efa1'/>
+      <function-decl name='bio_put' mangled-name='bio_put' filepath='block/bio.c' line='647' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_put'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='647' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_reset' mangled-name='bio_reset' filepath='include/linux/bio.h' line='440' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_reset'>
-        <parameter type-id='fb55efa1'/>
+      <function-decl name='bio_reset' mangled-name='bio_reset' filepath='block/bio.c' line='300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_reset'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='300' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bioset_exit' mangled-name='bioset_exit' filepath='include/linux/bio.h' line='393' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_exit'>
-        <parameter type-id='38b1e3a0'/>
+      <function-decl name='bioset_exit' mangled-name='bioset_exit' filepath='block/bio.c' line='1551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_exit'>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1551' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bioset_init' mangled-name='bioset_init' filepath='include/linux/bio.h' line='392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_init'>
-        <parameter type-id='38b1e3a0'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='bioset_init' mangled-name='bioset_init' filepath='block/bio.c' line='1588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bioset_init'>
+        <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='1588' column='1'/>
+        <parameter type-id='f0981eeb' name='pool_size' filepath='block/bio.c' line='1589' column='1'/>
+        <parameter type-id='f0981eeb' name='front_pad' filepath='block/bio.c' line='1590' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='block/bio.c' line='1591' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bitmap_alloc' mangled-name='bitmap_alloc' filepath='include/linux/bitmap.h' line='121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_alloc'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='bitmap_alloc' mangled-name='bitmap_alloc' filepath='lib/bitmap.c' line='1246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_alloc'>
+        <parameter type-id='f0981eeb' name='nbits' filepath='lib/bitmap.c' line='1246' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='lib/bitmap.c' line='1246' column='1'/>
         <return type-id='1d2c2b85'/>
       </function-decl>
       <function-decl name='bitmap_allocate_region' mangled-name='bitmap_allocate_region' filepath='lib/bitmap.c' line='1215' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_allocate_region'>
@@ -114965,49 +114788,49 @@
         <parameter type-id='95e97e5e' name='order' filepath='lib/bitmap.c' line='1215' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bitmap_find_free_region' mangled-name='bitmap_find_free_region' filepath='include/linux/bitmap.h' line='211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_find_free_region'>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='bitmap_find_free_region' mangled-name='bitmap_find_free_region' filepath='lib/bitmap.c' line='1173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_find_free_region'>
+        <parameter type-id='1d2c2b85' name='bitmap' filepath='lib/bitmap.c' line='1173' column='1'/>
+        <parameter type-id='f0981eeb' name='bits' filepath='lib/bitmap.c' line='1173' column='1'/>
+        <parameter type-id='95e97e5e' name='order' filepath='lib/bitmap.c' line='1173' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bitmap_find_next_zero_area_off' mangled-name='bitmap_find_next_zero_area_off' filepath='include/linux/bitmap.h' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_find_next_zero_area_off'>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='bitmap_find_next_zero_area_off' mangled-name='bitmap_find_next_zero_area_off' filepath='lib/bitmap.c' line='404' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_find_next_zero_area_off'>
+        <parameter type-id='1d2c2b85' name='map' filepath='lib/bitmap.c' line='404' column='1'/>
+        <parameter type-id='7359adad' name='size' filepath='lib/bitmap.c' line='405' column='1'/>
+        <parameter type-id='7359adad' name='start' filepath='lib/bitmap.c' line='406' column='1'/>
+        <parameter type-id='f0981eeb' name='nr' filepath='lib/bitmap.c' line='407' column='1'/>
+        <parameter type-id='7359adad' name='align_mask' filepath='lib/bitmap.c' line='408' column='1'/>
+        <parameter type-id='7359adad' name='align_offset' filepath='lib/bitmap.c' line='409' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='bitmap_free' mangled-name='bitmap_free' filepath='lib/bitmap.c' line='1259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_free'>
         <parameter type-id='f9b37274' name='bitmap' filepath='lib/bitmap.c' line='1259' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bitmap_from_arr32' mangled-name='bitmap_from_arr32' filepath='include/linux/bitmap.h' line='270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_from_arr32'>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='5b2fd8e8'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='bitmap_from_arr32' mangled-name='bitmap_from_arr32' filepath='lib/bitmap.c' line='1272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_from_arr32'>
+        <parameter type-id='1d2c2b85' name='bitmap' filepath='lib/bitmap.c' line='1272' column='1'/>
+        <parameter type-id='aded214c' name='buf' filepath='lib/bitmap.c' line='1272' column='1'/>
+        <parameter type-id='f0981eeb' name='nbits' filepath='lib/bitmap.c' line='1272' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bitmap_parse' mangled-name='bitmap_parse' filepath='include/linux/bitmap.h' line='195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_parse'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='bitmap_parse' mangled-name='bitmap_parse' filepath='lib/bitmap.c' line='737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_parse'>
+        <parameter type-id='80f4b756' name='start' filepath='lib/bitmap.c' line='737' column='1'/>
+        <parameter type-id='f0981eeb' name='buflen' filepath='lib/bitmap.c' line='737' column='1'/>
+        <parameter type-id='1d2c2b85' name='maskp' filepath='lib/bitmap.c' line='738' column='1'/>
+        <parameter type-id='95e97e5e' name='nmaskbits' filepath='lib/bitmap.c' line='738' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bitmap_parselist' mangled-name='bitmap_parselist' filepath='include/linux/bitmap.h' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_parselist'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='bitmap_parselist' mangled-name='bitmap_parselist' filepath='lib/bitmap.c' line='638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_parselist'>
+        <parameter type-id='80f4b756' name='buf' filepath='lib/bitmap.c' line='638' column='1'/>
+        <parameter type-id='1d2c2b85' name='maskp' filepath='lib/bitmap.c' line='638' column='1'/>
+        <parameter type-id='95e97e5e' name='nmaskbits' filepath='lib/bitmap.c' line='638' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bitmap_parselist_user' mangled-name='bitmap_parselist_user' filepath='include/linux/bitmap.h' line='201' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_parselist_user'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='bitmap_parselist_user' mangled-name='bitmap_parselist_user' filepath='lib/bitmap.c' line='679' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_parselist_user'>
+        <parameter type-id='80f4b756' name='ubuf' filepath='lib/bitmap.c' line='679' column='1'/>
+        <parameter type-id='f0981eeb' name='ulen' filepath='lib/bitmap.c' line='680' column='1'/>
+        <parameter type-id='1d2c2b85' name='maskp' filepath='lib/bitmap.c' line='680' column='1'/>
+        <parameter type-id='95e97e5e' name='nmaskbits' filepath='lib/bitmap.c' line='681' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='bitmap_print_to_pagebuf' mangled-name='bitmap_print_to_pagebuf' filepath='lib/bitmap.c' line='478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_print_to_pagebuf'>
@@ -115017,10 +114840,10 @@
         <parameter type-id='95e97e5e' name='nmaskbits' filepath='lib/bitmap.c' line='479' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bitmap_release_region' mangled-name='bitmap_release_region' filepath='include/linux/bitmap.h' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_release_region'>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='bitmap_release_region' mangled-name='bitmap_release_region' filepath='lib/bitmap.c' line='1198' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_release_region'>
+        <parameter type-id='1d2c2b85' name='bitmap' filepath='lib/bitmap.c' line='1198' column='1'/>
+        <parameter type-id='f0981eeb' name='pos' filepath='lib/bitmap.c' line='1198' column='1'/>
+        <parameter type-id='95e97e5e' name='order' filepath='lib/bitmap.c' line='1198' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bitmap_to_arr32' mangled-name='bitmap_to_arr32' filepath='lib/bitmap.c' line='1295' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bitmap_to_arr32'>
@@ -115064,17 +114887,17 @@
         <parameter type-id='5afdaa66' name='done' filepath='block/blk-exec.c' line='50' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='include/linux/blkdev.h' line='1264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
-        <parameter type-id='39944481'/>
+      <function-decl name='blk_finish_plug' mangled-name='blk_finish_plug' filepath='block/blk-core.c' line='1772' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_finish_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1772' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_freeze_queue_start' mangled-name='blk_freeze_queue_start' filepath='include/linux/blk-mq.h' line='525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_freeze_queue_start'>
-        <parameter type-id='e7d2a5fc'/>
+      <function-decl name='blk_freeze_queue_start' mangled-name='blk_freeze_queue_start' filepath='block/blk-mq.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_freeze_queue_start'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='136' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='include/linux/blkdev.h' line='1226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
-        <parameter type-id='e7d2a5fc'/>
-        <return type-id='c894953d'/>
+      <function-decl name='blk_get_queue' mangled-name='blk_get_queue' filepath='block/blk-core.c' line='609' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='609' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='blk_get_request' mangled-name='blk_get_request' filepath='block/blk-core.c' line='626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_get_request'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='626' column='1'/>
@@ -115109,10 +114932,10 @@
         <parameter type-id='bf8a20d2' name='ksm' filepath='block/keyslot-manager.c' line='414' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_request' mangled-name='blk_mq_alloc_request' filepath='include/linux/blk-mq.h' line='455' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request'>
-        <parameter type-id='e7d2a5fc'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='blk_mq_alloc_request' mangled-name='blk_mq_alloc_request' filepath='block/blk-mq.c' line='403' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='403' column='1'/>
+        <parameter type-id='f0981eeb' name='op' filepath='block/blk-mq.c' line='403' column='1'/>
+        <parameter type-id='346d62be' name='flags' filepath='block/blk-mq.c' line='404' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
       <function-decl name='blk_mq_alloc_request_hctx' mangled-name='blk_mq_alloc_request_hctx' filepath='block/blk-mq.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_request_hctx'>
@@ -115144,13 +114967,13 @@
         <parameter type-id='7359adad' name='msecs' filepath='block/blk-mq.c' line='855' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_end_request' mangled-name='blk_mq_end_request' filepath='include/linux/blk-mq.h' line='499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_end_request'>
-        <parameter type-id='3dad1a48'/>
-        <parameter type-id='002ac4a6'/>
+      <function-decl name='blk_mq_end_request' mangled-name='blk_mq_end_request' filepath='block/blk-mq.c' line='564' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_end_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='564' column='1'/>
+        <parameter type-id='f4e2facd' name='error' filepath='block/blk-mq.c' line='564' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_free_request' mangled-name='blk_mq_free_request' filepath='include/linux/blk-mq.h' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_request'>
-        <parameter type-id='3dad1a48'/>
+      <function-decl name='blk_mq_free_request' mangled-name='blk_mq_free_request' filepath='block/blk-mq.c' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_request'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='508' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_free_tag_set' mangled-name='blk_mq_free_tag_set' filepath='block/blk-mq.c' line='3591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_tag_set'>
@@ -115181,8 +115004,8 @@
         <parameter type-id='f0981eeb' name='set_flags' filepath='block/blk-mq.c' line='3155' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
-      <function-decl name='blk_mq_map_queues' mangled-name='blk_mq_map_queues' filepath='include/linux/blk-mq.h' line='530' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_map_queues'>
-        <parameter type-id='187ae308'/>
+      <function-decl name='blk_mq_map_queues' mangled-name='blk_mq_map_queues' filepath='block/blk-mq-cpumap.c' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_map_queues'>
+        <parameter type-id='187ae308' name='qmap' filepath='block/blk-mq-cpumap.c' line='35' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='blk_mq_pci_map_queues' mangled-name='blk_mq_pci_map_queues' filepath='block/blk-mq-pci.c' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_pci_map_queues'>
@@ -115191,8 +115014,8 @@
         <parameter type-id='95e97e5e' name='offset' filepath='block/blk-mq-pci.c' line='27' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_quiesce_queue' mangled-name='blk_mq_quiesce_queue' filepath='include/linux/blk-mq.h' line='514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_quiesce_queue'>
-        <parameter type-id='e7d2a5fc'/>
+      <function-decl name='blk_mq_quiesce_queue' mangled-name='blk_mq_quiesce_queue' filepath='block/blk-mq.c' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_quiesce_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='224' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_requeue_request' mangled-name='blk_mq_requeue_request' filepath='block/blk-mq.c' line='774' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_requeue_request'>
@@ -115214,8 +115037,8 @@
         <parameter type-id='b50a4934' name='async' filepath='block/blk-mq.c' line='1692' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_sched_mark_restart_hctx' mangled-name='blk_mq_sched_mark_restart_hctx' filepath='block/blk-mq-sched.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_sched_mark_restart_hctx'>
-        <parameter type-id='a47d3467'/>
+      <function-decl name='blk_mq_sched_mark_restart_hctx' mangled-name='blk_mq_sched_mark_restart_hctx' filepath='block/blk-mq-sched.c' line='51' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_sched_mark_restart_hctx'>
+        <parameter type-id='a47d3467' name='hctx' filepath='block/blk-mq-sched.c' line='51' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_sched_request_inserted' mangled-name='blk_mq_sched_request_inserted' filepath='block/blk-mq-sched.c' line='389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_sched_request_inserted'>
@@ -115262,8 +115085,8 @@
         <parameter type-id='cc26d15f' name='tagset' filepath='block/blk-mq-tag.c' line='408' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_unfreeze_queue' mangled-name='blk_mq_unfreeze_queue' filepath='include/linux/blk-mq.h' line='524' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unfreeze_queue'>
-        <parameter type-id='e7d2a5fc'/>
+      <function-decl name='blk_mq_unfreeze_queue' mangled-name='blk_mq_unfreeze_queue' filepath='block/blk-mq.c' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unfreeze_queue'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='192' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_unique_tag' mangled-name='blk_mq_unique_tag' filepath='block/blk-mq-tag.c' line='638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_unique_tag'>
@@ -115285,10 +115108,10 @@
         <parameter type-id='95e97e5e' name='first_vec' filepath='block/blk-mq-virtio.c' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='include/linux/blkdev.h' line='962' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
-        <parameter type-id='e7d2a5fc'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='block/blk-mq.c' line='3958' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='3958' column='1'/>
+        <parameter type-id='041bc907' name='cookie' filepath='block/blk-mq.c' line='3958' column='1'/>
+        <parameter type-id='b50a4934' name='spin' filepath='block/blk-mq.c' line='3958' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='blk_put_queue' mangled-name='blk_put_queue' filepath='block/blk-core.c' line='335' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_queue'>
@@ -115324,9 +115147,9 @@
         <parameter type-id='95e97e5e' name='mask' filepath='block/blk-settings.c' line='732' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_queue_flag_clear' mangled-name='blk_queue_flag_clear' filepath='include/linux/blkdev.h' line='642' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_clear'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='e7d2a5fc'/>
+      <function-decl name='blk_queue_flag_clear' mangled-name='blk_queue_flag_clear' filepath='block/blk-core.c' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_clear'>
+        <parameter type-id='f0981eeb' name='flag' filepath='block/blk-core.c' line='90' column='1'/>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-core.c' line='90' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_queue_flag_set' mangled-name='blk_queue_flag_set' filepath='block/blk-core.c' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_queue_flag_set'>
@@ -115470,16 +115293,16 @@
         <parameter type-id='7604ff1d' name='lim' filepath='block/blk-settings.c' line='74' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='include/linux/blkdev.h' line='1263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
-        <parameter type-id='39944481'/>
+      <function-decl name='blk_start_plug' mangled-name='blk_start_plug' filepath='block/blk-core.c' line='1688' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_start_plug'>
+        <parameter type-id='39944481' name='plug' filepath='block/blk-core.c' line='1688' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_stat_enable_accounting' mangled-name='blk_stat_enable_accounting' filepath='block/blk-stat.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_stat_enable_accounting'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-stat.c' line='187' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_status_to_errno' mangled-name='blk_status_to_errno' filepath='include/linux/blkdev.h' line='959' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_status_to_errno'>
-        <parameter type-id='002ac4a6'/>
+      <function-decl name='blk_status_to_errno' mangled-name='blk_status_to_errno' filepath='block/blk-core.c' line='209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_status_to_errno'>
+        <parameter type-id='f4e2facd' name='status' filepath='block/blk-core.c' line='209' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='blk_sync_queue' mangled-name='blk_sync_queue' filepath='block/blk-core.c' line='297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_sync_queue'>
@@ -115509,53 +115332,53 @@
         <parameter type-id='95e97e5e' name='datasync' filepath='fs/block_dev.c' line='691' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blkdev_get_by_dev' mangled-name='blkdev_get_by_dev' filepath='include/linux/blkdev.h' line='2022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_get_by_dev'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='blkdev_get_by_dev' mangled-name='blkdev_get_by_dev' filepath='fs/block_dev.c' line='1723' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_get_by_dev'>
+        <parameter type-id='8504f260' name='dev' filepath='fs/block_dev.c' line='1723' column='1'/>
+        <parameter type-id='2665334e' name='mode' filepath='fs/block_dev.c' line='1723' column='1'/>
+        <parameter type-id='eaa32e2f' name='holder' filepath='fs/block_dev.c' line='1723' column='1'/>
         <return type-id='b88dd945'/>
       </function-decl>
-      <function-decl name='blkdev_get_by_path' mangled-name='blkdev_get_by_path' filepath='include/linux/blkdev.h' line='2020' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_get_by_path'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='blkdev_get_by_path' mangled-name='blkdev_get_by_path' filepath='fs/block_dev.c' line='1678' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_get_by_path'>
+        <parameter type-id='80f4b756' name='path' filepath='fs/block_dev.c' line='1678' column='1'/>
+        <parameter type-id='2665334e' name='mode' filepath='fs/block_dev.c' line='1678' column='1'/>
+        <parameter type-id='eaa32e2f' name='holder' filepath='fs/block_dev.c' line='1679' column='1'/>
         <return type-id='b88dd945'/>
       </function-decl>
-      <function-decl name='blkdev_issue_flush' mangled-name='blkdev_issue_flush' filepath='include/linux/blkdev.h' line='1292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_issue_flush'>
-        <parameter type-id='b88dd945'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='blkdev_issue_flush' mangled-name='blkdev_issue_flush' filepath='block/blk-flush.c' line='453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_issue_flush'>
+        <parameter type-id='b88dd945' name='bdev' filepath='block/blk-flush.c' line='453' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='block/blk-flush.c' line='453' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blkdev_put' mangled-name='blkdev_put' filepath='include/linux/blkdev.h' line='2027' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_put'>
-        <parameter type-id='b88dd945'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='blkdev_put' mangled-name='blkdev_put' filepath='fs/block_dev.c' line='1817' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blkdev_put'>
+        <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='1817' column='1'/>
+        <parameter type-id='2665334e' name='mode' filepath='fs/block_dev.c' line='1817' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blocking_notifier_call_chain' mangled-name='blocking_notifier_call_chain' filepath='include/linux/notifier.h' line='164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blocking_notifier_call_chain'>
-        <parameter type-id='282b7312'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='blocking_notifier_call_chain' mangled-name='blocking_notifier_call_chain' filepath='kernel/notifier.c' line='325' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blocking_notifier_call_chain'>
+        <parameter type-id='282b7312' name='nh' filepath='kernel/notifier.c' line='325' column='1'/>
+        <parameter type-id='7359adad' name='val' filepath='kernel/notifier.c' line='326' column='1'/>
+        <parameter type-id='eaa32e2f' name='v' filepath='kernel/notifier.c' line='326' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blocking_notifier_chain_register' mangled-name='blocking_notifier_chain_register' filepath='include/linux/notifier.h' line='146' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blocking_notifier_chain_register'>
-        <parameter type-id='282b7312'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='blocking_notifier_chain_register' mangled-name='blocking_notifier_chain_register' filepath='kernel/notifier.c' line='240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blocking_notifier_chain_register'>
+        <parameter type-id='282b7312' name='nh' filepath='kernel/notifier.c' line='240' column='1'/>
+        <parameter type-id='d504f73d' name='n' filepath='kernel/notifier.c' line='241' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blocking_notifier_chain_unregister' mangled-name='blocking_notifier_chain_unregister' filepath='include/linux/notifier.h' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blocking_notifier_chain_unregister'>
-        <parameter type-id='282b7312'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='blocking_notifier_chain_unregister' mangled-name='blocking_notifier_chain_unregister' filepath='kernel/notifier.c' line='270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blocking_notifier_chain_unregister'>
+        <parameter type-id='282b7312' name='nh' filepath='kernel/notifier.c' line='270' column='1'/>
+        <parameter type-id='d504f73d' name='n' filepath='kernel/notifier.c' line='271' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bmap' mangled-name='bmap' filepath='include/linux/fs.h' line='2808' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bmap'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='bmap' mangled-name='bmap' filepath='fs/inode.c' line='1702' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bmap'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1702' column='1'/>
+        <parameter type-id='5c39fc92' name='block' filepath='fs/inode.c' line='1702' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bpf_dispatcher_xdp_func' mangled-name='bpf_dispatcher_xdp_func' filepath='include/linux/filter.h' line='747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_dispatcher_xdp_func'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='acada613'/>
-        <parameter type-id='531a7450'/>
+      <function-decl name='bpf_dispatcher_xdp_func' mangled-name='bpf_dispatcher_xdp_func' filepath='net/core/filter.c' line='10265' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_dispatcher_xdp_func'>
+        <parameter type-id='eaa32e2f' name='ctx' filepath='net/core/filter.c' line='10265' column='1'/>
+        <parameter type-id='acada613' name='insnsi' filepath='net/core/filter.c' line='10265' column='1'/>
+        <parameter type-id='531a7450' name='bpf_func' filepath='net/core/filter.c' line='10265' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='bpf_prog_add' mangled-name='bpf_prog_add' filepath='kernel/bpf/syscall.c' line='1857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_prog_add'>
@@ -115573,9 +115396,9 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='bpf_stats_enabled_key' type-id='237c0d27' mangled-name='bpf_stats_enabled_key' visibility='default' filepath='kernel/bpf/core.c' line='2339' column='1' elf-symbol-id='bpf_stats_enabled_key'/>
-      <function-decl name='bpf_trace_run1' mangled-name='bpf_trace_run1' filepath='include/linux/trace_events.h' line='752' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run1'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run1' mangled-name='bpf_trace_run1' filepath='kernel/trace/bpf_trace.c' line='2083' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run1'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2083' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2083' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bpf_trace_run10' mangled-name='bpf_trace_run10' filepath='kernel/trace/bpf_trace.c' line='2092' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run10'>
@@ -115623,67 +115446,67 @@
         <parameter type-id='91ce1af9' name='arg11' filepath='kernel/trace/bpf_trace.c' line='2094' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run2' mangled-name='bpf_trace_run2' filepath='include/linux/trace_events.h' line='753' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run2'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run2' mangled-name='bpf_trace_run2' filepath='kernel/trace/bpf_trace.c' line='2084' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run2'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2084' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2084' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2084' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run3' mangled-name='bpf_trace_run3' filepath='include/linux/trace_events.h' line='754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run3'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run3' mangled-name='bpf_trace_run3' filepath='kernel/trace/bpf_trace.c' line='2085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run3'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2085' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2085' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2085' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2085' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run4' mangled-name='bpf_trace_run4' filepath='include/linux/trace_events.h' line='756' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run4'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run4' mangled-name='bpf_trace_run4' filepath='kernel/trace/bpf_trace.c' line='2086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run4'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2086' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2086' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2086' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2086' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2086' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run5' mangled-name='bpf_trace_run5' filepath='include/linux/trace_events.h' line='758' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run5'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run5' mangled-name='bpf_trace_run5' filepath='kernel/trace/bpf_trace.c' line='2087' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run5'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2087' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2087' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2087' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2087' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2087' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2087' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run6' mangled-name='bpf_trace_run6' filepath='include/linux/trace_events.h' line='760' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run6'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run6' mangled-name='bpf_trace_run6' filepath='kernel/trace/bpf_trace.c' line='2088' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run6'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2088' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2088' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2088' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2088' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2088' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2088' column='1'/>
+        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2088' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run7' mangled-name='bpf_trace_run7' filepath='include/linux/trace_events.h' line='762' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run7'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run7' mangled-name='bpf_trace_run7' filepath='kernel/trace/bpf_trace.c' line='2089' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run7'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
+        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
+        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2089' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_trace_run8' mangled-name='bpf_trace_run8' filepath='include/linux/trace_events.h' line='764' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run8'>
-        <parameter type-id='bdcee7ae'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='bpf_trace_run8' mangled-name='bpf_trace_run8' filepath='kernel/trace/bpf_trace.c' line='2090' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run8'>
+        <parameter type-id='bdcee7ae' name='prog' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg0' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg1' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg2' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg3' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg4' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg5' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg6' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
+        <parameter type-id='91ce1af9' name='arg7' filepath='kernel/trace/bpf_trace.c' line='2090' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bpf_trace_run9' mangled-name='bpf_trace_run9' filepath='kernel/trace/bpf_trace.c' line='2091' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_trace_run9'>
@@ -115699,16 +115522,16 @@
         <parameter type-id='91ce1af9' name='arg8' filepath='kernel/trace/bpf_trace.c' line='2091' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bpf_warn_invalid_xdp_action' mangled-name='bpf_warn_invalid_xdp_action' filepath='include/linux/filter.h' line='980' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_warn_invalid_xdp_action'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='bpf_warn_invalid_xdp_action' mangled-name='bpf_warn_invalid_xdp_action' filepath='net/core/filter.c' line='7900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bpf_warn_invalid_xdp_action'>
+        <parameter type-id='19c2251e' name='act' filepath='net/core/filter.c' line='7900' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bsearch' mangled-name='bsearch' filepath='include/linux/bsearch.h' line='30' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bsearch'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='585e1de9'/>
+      <function-decl name='bsearch' mangled-name='bsearch' filepath='lib/bsearch.c' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bsearch'>
+        <parameter type-id='eaa32e2f' name='key' filepath='lib/bsearch.c' line='31' column='1'/>
+        <parameter type-id='eaa32e2f' name='base' filepath='lib/bsearch.c' line='31' column='1'/>
+        <parameter type-id='b59d7dce' name='num' filepath='lib/bsearch.c' line='31' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/bsearch.c' line='31' column='1'/>
+        <parameter type-id='a08bda3c' name='cmp' filepath='lib/bsearch.c' line='31' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='bsg_job_done' mangled-name='bsg_job_done' filepath='block/bsg-lib.c' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bsg_job_done'>
@@ -115729,33 +115552,33 @@
         <parameter type-id='95e97e5e' name='dd_job_size' filepath='block/bsg-lib.c' line='366' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
-      <function-decl name='bt_err' mangled-name='bt_err' filepath='include/net/bluetooth/bluetooth.h' line='161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bt_err'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='bt_err' mangled-name='bt_err' filepath='net/bluetooth/lib.c' line='170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bt_err'>
+        <parameter type-id='80f4b756' name='format' filepath='net/bluetooth/lib.c' line='170' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bt_info' mangled-name='bt_info' filepath='include/net/bluetooth/bluetooth.h' line='157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bt_info'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='bt_info' mangled-name='bt_info' filepath='net/bluetooth/lib.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bt_info'>
+        <parameter type-id='80f4b756' name='format' filepath='net/bluetooth/lib.c' line='138' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='build_skb' mangled-name='build_skb' filepath='include/linux/skbuff.h' line='1087' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='build_skb'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='build_skb' mangled-name='build_skb' filepath='net/core/skbuff.c' line='331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='build_skb'>
+        <parameter type-id='eaa32e2f' name='data' filepath='net/core/skbuff.c' line='331' column='1'/>
+        <parameter type-id='f0981eeb' name='frag_size' filepath='net/core/skbuff.c' line='331' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='bus_find_device' mangled-name='bus_find_device' filepath='include/linux/device/bus.h' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_find_device'>
-        <parameter type-id='5e2671f8'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='92d15ae9'/>
+      <function-decl name='bus_find_device' mangled-name='bus_find_device' filepath='drivers/base/bus.c' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_find_device'>
+        <parameter type-id='5e2671f8' name='bus' filepath='drivers/base/bus.c' line='326' column='1'/>
+        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/bus.c' line='327' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/bus.c' line='327' column='1'/>
+        <parameter type-id='92d15ae9' name='match' filepath='drivers/base/bus.c' line='328' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='bus_for_each_dev' mangled-name='bus_for_each_dev' filepath='include/linux/device/bus.h' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_for_each_dev'>
-        <parameter type-id='5e2671f8'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='92d15ae9'/>
+      <function-decl name='bus_for_each_dev' mangled-name='bus_for_each_dev' filepath='drivers/base/bus.c' line='292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_for_each_dev'>
+        <parameter type-id='5e2671f8' name='bus' filepath='drivers/base/bus.c' line='292' column='1'/>
+        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/bus.c' line='292' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/bus.c' line='293' column='1'/>
+        <parameter type-id='92d15ae9' name='fn' filepath='drivers/base/bus.c' line='293' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='bus_for_each_drv' mangled-name='bus_for_each_drv' filepath='drivers/base/bus.c' line='418' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_for_each_drv'>
@@ -115765,8 +115588,8 @@
         <parameter type-id='24a62f42' name='fn' filepath='drivers/base/bus.c' line='419' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bus_register' mangled-name='bus_register' filepath='include/linux/device/bus.h' line='122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_register'>
-        <parameter type-id='5e2671f8'/>
+      <function-decl name='bus_register' mangled-name='bus_register' filepath='drivers/base/bus.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_register'>
+        <parameter type-id='5e2671f8' name='bus' filepath='drivers/base/bus.c' line='802' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='bus_register_notifier' mangled-name='bus_register_notifier' filepath='drivers/base/bus.c' line='901' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_register_notifier'>
@@ -115779,8 +115602,8 @@
         <parameter type-id='f1ac64d0' name='ops' filepath='drivers/iommu/iommu.c' line='1835' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='bus_unregister' mangled-name='bus_unregister' filepath='include/linux/device/bus.h' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_unregister'>
-        <parameter type-id='5e2671f8'/>
+      <function-decl name='bus_unregister' mangled-name='bus_unregister' filepath='drivers/base/bus.c' line='887' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_unregister'>
+        <parameter type-id='5e2671f8' name='bus' filepath='drivers/base/bus.c' line='887' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bus_unregister_notifier' mangled-name='bus_unregister_notifier' filepath='drivers/base/bus.c' line='907' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bus_unregister_notifier'>
@@ -115850,9 +115673,9 @@
         <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='3187' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='capable' mangled-name='capable' filepath='include/linux/capability.h' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='capable'>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='c894953d'/>
+      <function-decl name='capable' mangled-name='capable' filepath='kernel/capability.c' line='447' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='capable'>
+        <parameter type-id='95e97e5e' name='cap' filepath='kernel/capability.c' line='447' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='cdev_add' mangled-name='cdev_add' filepath='fs/char_dev.c' line='479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_add'>
         <parameter type-id='3e6eb939' name='p' filepath='fs/char_dev.c' line='479' column='1'/>
@@ -115867,19 +115690,19 @@
         <parameter type-id='3e6eb939' name='p' filepath='fs/char_dev.c' line='594' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cdev_device_add' mangled-name='cdev_device_add' filepath='include/linux/cdev.h' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_device_add'>
-        <parameter type-id='3e6eb939'/>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='cdev_device_add' mangled-name='cdev_device_add' filepath='fs/char_dev.c' line='537' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_device_add'>
+        <parameter type-id='3e6eb939' name='cdev' filepath='fs/char_dev.c' line='537' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='fs/char_dev.c' line='537' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cdev_device_del' mangled-name='cdev_device_del' filepath='include/linux/cdev.h' line='33' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_device_del'>
-        <parameter type-id='3e6eb939'/>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='cdev_device_del' mangled-name='cdev_device_del' filepath='fs/char_dev.c' line='571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_device_del'>
+        <parameter type-id='3e6eb939' name='cdev' filepath='fs/char_dev.c' line='571' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='fs/char_dev.c' line='571' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cdev_init' mangled-name='cdev_init' filepath='include/linux/cdev.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_init'>
-        <parameter type-id='3e6eb939'/>
-        <parameter type-id='61758ee5'/>
+      <function-decl name='cdev_init' mangled-name='cdev_init' filepath='fs/char_dev.c' line='651' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_init'>
+        <parameter type-id='3e6eb939' name='cdev' filepath='fs/char_dev.c' line='651' column='1'/>
+        <parameter type-id='61758ee5' name='fops' filepath='fs/char_dev.c' line='651' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ce_aes_expandkey' mangled-name='ce_aes_expandkey' filepath='arch/arm64/crypto/aes-ce-glue.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ce_aes_expandkey'>
@@ -115911,9 +115734,9 @@
         <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-notifier.c' line='148' column='1'/>
         <return type-id='33ceb73d'/>
       </function-decl>
-      <function-decl name='cec_notifier_cec_adap_unregister' mangled-name='cec_notifier_cec_adap_unregister' filepath='include/media/cec-notifier.h' line='75' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_notifier_cec_adap_unregister'>
-        <parameter type-id='33ceb73d'/>
-        <parameter type-id='b94a2f7c'/>
+      <function-decl name='cec_notifier_cec_adap_unregister' mangled-name='cec_notifier_cec_adap_unregister' filepath='drivers/media/cec/core/cec-notifier.c' line='170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_notifier_cec_adap_unregister'>
+        <parameter type-id='33ceb73d' name='n' filepath='drivers/media/cec/core/cec-notifier.c' line='170' column='1'/>
+        <parameter type-id='b94a2f7c' name='adap' filepath='drivers/media/cec/core/cec-notifier.c' line='171' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='cec_notifier_conn_register' mangled-name='cec_notifier_conn_register' filepath='drivers/media/cec/core/cec-notifier.c' line='104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cec_notifier_conn_register'>
@@ -115991,14 +115814,14 @@
         <parameter type-id='f774a955' name='ns' filepath='kernel/cgroup/cgroup.c' line='2244' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cgroup_taskset_first' mangled-name='cgroup_taskset_first' filepath='include/linux/cgroup.h' line='154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_first'>
-        <parameter type-id='8cffa561'/>
-        <parameter type-id='e7f9d97b'/>
+      <function-decl name='cgroup_taskset_first' mangled-name='cgroup_taskset_first' filepath='kernel/cgroup/cgroup.c' line='2345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_first'>
+        <parameter type-id='8cffa561' name='tset' filepath='kernel/cgroup/cgroup.c' line='2345' column='1'/>
+        <parameter type-id='e7f9d97b' name='dst_cssp' filepath='kernel/cgroup/cgroup.c' line='2346' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
-      <function-decl name='cgroup_taskset_next' mangled-name='cgroup_taskset_next' filepath='include/linux/cgroup.h' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_next'>
-        <parameter type-id='8cffa561'/>
-        <parameter type-id='e7f9d97b'/>
+      <function-decl name='cgroup_taskset_next' mangled-name='cgroup_taskset_next' filepath='kernel/cgroup/cgroup.c' line='2363' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cgroup_taskset_next'>
+        <parameter type-id='8cffa561' name='tset' filepath='kernel/cgroup/cgroup.c' line='2363' column='1'/>
+        <parameter type-id='e7f9d97b' name='dst_cssp' filepath='kernel/cgroup/cgroup.c' line='2364' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
       <function-decl name='check_preempt_curr' mangled-name='check_preempt_curr' filepath='kernel/sched/core.c' line='1776' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_preempt_curr'>
@@ -116007,65 +115830,65 @@
         <parameter type-id='95e97e5e' name='flags' filepath='kernel/sched/core.c' line='1776' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='check_zeroed_user' mangled-name='check_zeroed_user' filepath='include/linux/uaccess.h' line='295' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_zeroed_user'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='check_zeroed_user' mangled-name='check_zeroed_user' filepath='lib/usercopy.c' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='check_zeroed_user'>
+        <parameter type-id='eaa32e2f' name='from' filepath='lib/usercopy.c' line='54' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/usercopy.c' line='54' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='class_create_file_ns' mangled-name='class_create_file_ns' filepath='include/linux/device/class.h' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_create_file_ns'>
-        <parameter type-id='67aca04f'/>
-        <parameter type-id='9a53a8a3'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='class_create_file_ns' mangled-name='class_create_file_ns' filepath='drivers/base/class.c' line='88' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_create_file_ns'>
+        <parameter type-id='67aca04f' name='cls' filepath='drivers/base/class.c' line='88' column='1'/>
+        <parameter type-id='9a53a8a3' name='attr' filepath='drivers/base/class.c' line='88' column='1'/>
+        <parameter type-id='eaa32e2f' name='ns' filepath='drivers/base/class.c' line='89' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='class_destroy' mangled-name='class_destroy' filepath='include/linux/device/class.h' line='261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_destroy'>
-        <parameter type-id='67aca04f'/>
+      <function-decl name='class_destroy' mangled-name='class_destroy' filepath='drivers/base/class.c' line='261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_destroy'>
+        <parameter type-id='67aca04f' name='cls' filepath='drivers/base/class.c' line='261' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='class_find_device' mangled-name='class_find_device' filepath='include/linux/device/class.h' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_find_device'>
-        <parameter type-id='67aca04f'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='92d15ae9'/>
+      <function-decl name='class_find_device' mangled-name='class_find_device' filepath='drivers/base/class.c' line='399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_find_device'>
+        <parameter type-id='67aca04f' name='class' filepath='drivers/base/class.c' line='399' column='1'/>
+        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/class.c' line='399' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/class.c' line='400' column='1'/>
+        <parameter type-id='92d15ae9' name='match' filepath='drivers/base/class.c' line='401' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='class_for_each_device' mangled-name='class_for_each_device' filepath='include/linux/device/class.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_for_each_device'>
-        <parameter type-id='67aca04f'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='92d15ae9'/>
+      <function-decl name='class_for_each_device' mangled-name='class_for_each_device' filepath='drivers/base/class.c' line='352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_for_each_device'>
+        <parameter type-id='67aca04f' name='class' filepath='drivers/base/class.c' line='352' column='1'/>
+        <parameter type-id='fa0b179b' name='start' filepath='drivers/base/class.c' line='352' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/class.c' line='353' column='1'/>
+        <parameter type-id='92d15ae9' name='fn' filepath='drivers/base/class.c' line='353' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='class_interface_unregister' mangled-name='class_interface_unregister' filepath='include/linux/device/class.h' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_interface_unregister'>
-        <parameter type-id='ec167ceb'/>
+      <function-decl name='class_interface_unregister' mangled-name='class_interface_unregister' filepath='drivers/base/class.c' line='453' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_interface_unregister'>
+        <parameter type-id='ec167ceb' name='class_intf' filepath='drivers/base/class.c' line='453' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='class_remove_file_ns' mangled-name='class_remove_file_ns' filepath='include/linux/device/class.h' line='215' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_remove_file_ns'>
-        <parameter type-id='67aca04f'/>
-        <parameter type-id='9a53a8a3'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='class_remove_file_ns' mangled-name='class_remove_file_ns' filepath='drivers/base/class.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_remove_file_ns'>
+        <parameter type-id='67aca04f' name='cls' filepath='drivers/base/class.c' line='101' column='1'/>
+        <parameter type-id='9a53a8a3' name='attr' filepath='drivers/base/class.c' line='101' column='1'/>
+        <parameter type-id='eaa32e2f' name='ns' filepath='drivers/base/class.c' line='102' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='class_unregister' mangled-name='class_unregister' filepath='include/linux/device/class.h' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_unregister'>
-        <parameter type-id='67aca04f'/>
+      <function-decl name='class_unregister' mangled-name='class_unregister' filepath='drivers/base/class.c' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='class_unregister'>
+        <parameter type-id='67aca04f' name='cls' filepath='drivers/base/class.c' line='199' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='cleancache_register_ops' mangled-name='cleancache_register_ops' filepath='mm/cleancache.c' line='51' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cleancache_register_ops'>
         <parameter type-id='fccfeeec' name='ops' filepath='mm/cleancache.c' line='51' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cleanup_srcu_struct' mangled-name='cleanup_srcu_struct' filepath='include/linux/srcu.h' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cleanup_srcu_struct'>
-        <parameter type-id='f7d7131a'/>
+      <function-decl name='cleanup_srcu_struct' mangled-name='cleanup_srcu_struct' filepath='kernel/rcu/srcutree.c' line='373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cleanup_srcu_struct'>
+        <parameter type-id='f7d7131a' name='ssp' filepath='kernel/rcu/srcutree.c' line='373' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_bulk_disable' mangled-name='clk_bulk_disable' filepath='include/linux/clk.h' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_disable'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f034b024'/>
+      <function-decl name='clk_bulk_disable' mangled-name='clk_bulk_disable' filepath='drivers/clk/clk-bulk.c' line='211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_disable'>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-bulk.c' line='211' column='1'/>
+        <parameter type-id='f034b024' name='clks' filepath='drivers/clk/clk-bulk.c' line='211' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_bulk_enable' mangled-name='clk_bulk_enable' filepath='include/linux/clk.h' line='520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_enable'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f034b024'/>
+      <function-decl name='clk_bulk_enable' mangled-name='clk_bulk_enable' filepath='drivers/clk/clk-bulk.c' line='227' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_enable'>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-bulk.c' line='227' column='1'/>
+        <parameter type-id='f034b024' name='clks' filepath='drivers/clk/clk-bulk.c' line='227' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='clk_bulk_get' mangled-name='clk_bulk_get' filepath='drivers/clk/clk-bulk.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_get'>
@@ -116074,55 +115897,55 @@
         <parameter type-id='2942e355' name='clks' filepath='drivers/clk/clk-bulk.c' line='115' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='clk_bulk_get_all' mangled-name='clk_bulk_get_all' filepath='include/linux/clk.h' line='350' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_get_all'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='734c20ed'/>
+      <function-decl name='clk_bulk_get_all' mangled-name='clk_bulk_get_all' filepath='drivers/clk/clk-bulk.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_get_all'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk-bulk.c' line='139' column='1'/>
+        <parameter type-id='734c20ed' name='clks' filepath='drivers/clk/clk-bulk.c' line='140' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='clk_bulk_prepare' mangled-name='clk_bulk_prepare' filepath='include/linux/clk.h' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_prepare'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f034b024'/>
+      <function-decl name='clk_bulk_prepare' mangled-name='clk_bulk_prepare' filepath='drivers/clk/clk-bulk.c' line='176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_prepare'>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-bulk.c' line='176' column='1'/>
+        <parameter type-id='f034b024' name='clks' filepath='drivers/clk/clk-bulk.c' line='177' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='clk_bulk_put' mangled-name='clk_bulk_put' filepath='include/linux/clk.h' line='587' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_put'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='2942e355'/>
+      <function-decl name='clk_bulk_put' mangled-name='clk_bulk_put' filepath='drivers/clk/clk-bulk.c' line='72' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_put'>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-bulk.c' line='72' column='1'/>
+        <parameter type-id='2942e355' name='clks' filepath='drivers/clk/clk-bulk.c' line='72' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_bulk_put_all' mangled-name='clk_bulk_put_all' filepath='include/linux/clk.h' line='600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_put_all'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='2942e355'/>
+      <function-decl name='clk_bulk_put_all' mangled-name='clk_bulk_put_all' filepath='drivers/clk/clk-bulk.c' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_put_all'>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-bulk.c' line='128' column='1'/>
+        <parameter type-id='2942e355' name='clks' filepath='drivers/clk/clk-bulk.c' line='128' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_bulk_unprepare' mangled-name='clk_bulk_unprepare' filepath='include/linux/clk.h' line='279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_unprepare'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f034b024'/>
+      <function-decl name='clk_bulk_unprepare' mangled-name='clk_bulk_unprepare' filepath='drivers/clk/clk-bulk.c' line='161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_bulk_unprepare'>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-bulk.c' line='161' column='1'/>
+        <parameter type-id='f034b024' name='clks' filepath='drivers/clk/clk-bulk.c' line='161' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_disable' mangled-name='clk_disable' filepath='include/linux/clk.h' line='537' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_disable'>
-        <parameter type-id='7d0bc0eb'/>
+      <function-decl name='clk_disable' mangled-name='clk_disable' filepath='drivers/clk/clk.c' line='995' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_disable'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='995' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='clk_divider_ops' type-id='92072f8b' mangled-name='clk_divider_ops' visibility='default' filepath='drivers/clk/clk-divider.c' line='453' column='1' elf-symbol-id='clk_divider_ops'/>
-      <function-decl name='clk_enable' mangled-name='clk_enable' filepath='include/linux/clk.h' line='509' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_enable'>
-        <parameter type-id='7d0bc0eb'/>
+      <function-decl name='clk_enable' mangled-name='clk_enable' filepath='drivers/clk/clk.c' line='1160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_enable'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='1160' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='clk_fixed_factor_ops' type-id='92072f8b' mangled-name='clk_fixed_factor_ops' visibility='default' filepath='drivers/clk/clk-fixed-factor.c' line='60' column='1' elf-symbol-id='clk_fixed_factor_ops'/>
       <var-decl name='clk_fixed_rate_ops' type-id='92072f8b' mangled-name='clk_fixed_rate_ops' visibility='default' filepath='drivers/clk/clk-fixed-rate.c' line='46' column='1' elf-symbol-id='clk_fixed_rate_ops'/>
       <var-decl name='clk_fractional_divider_ops' type-id='92072f8b' mangled-name='clk_fractional_divider_ops' visibility='default' filepath='drivers/clk/clk-fractional-divider.c' line='148' column='1' elf-symbol-id='clk_fractional_divider_ops'/>
       <var-decl name='clk_gate_ops' type-id='92072f8b' mangled-name='clk_gate_ops' visibility='default' filepath='drivers/clk/clk-gate.c' line='119' column='1' elf-symbol-id='clk_gate_ops'/>
-      <function-decl name='clk_get' mangled-name='clk_get' filepath='include/linux/clk.h' line='308' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_get'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='clk_get' mangled-name='clk_get' filepath='drivers/clk/clkdev.c' line='100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clkdev.c' line='100' column='1'/>
+        <parameter type-id='80f4b756' name='con_id' filepath='drivers/clk/clkdev.c' line='100' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='clk_get_parent' mangled-name='clk_get_parent' filepath='drivers/clk/clk.c' line='2489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_get_parent'>
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='2489' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='clk_get_rate' mangled-name='clk_get_rate' filepath='include/linux/clk.h' line='562' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_get_rate'>
-        <parameter type-id='7d0bc0eb'/>
+      <function-decl name='clk_get_rate' mangled-name='clk_get_rate' filepath='drivers/clk/clk.c' line='1673' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_get_rate'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='1673' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='clk_hw_get_flags' mangled-name='clk_hw_get_flags' filepath='drivers/clk/clk.c' line='505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_hw_get_flags'>
@@ -116239,8 +116062,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4444' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='clk_prepare' mangled-name='clk_prepare' filepath='include/linux/clk.h' line='250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_prepare'>
-        <parameter type-id='7d0bc0eb'/>
+      <function-decl name='clk_prepare' mangled-name='clk_prepare' filepath='drivers/clk/clk.c' line='938' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_prepare'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='938' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='clk_put' mangled-name='clk_put' filepath='drivers/clk/clkdev.c' line='115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_put'>
@@ -116323,28 +116146,28 @@
         <parameter type-id='7d0bc0eb' name='parent' filepath='drivers/clk/clk.c' line='2653' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='clk_set_rate' mangled-name='clk_set_rate' filepath='include/linux/clk.h' line='653' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_set_rate'>
-        <parameter type-id='7d0bc0eb'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='clk_set_rate' mangled-name='clk_set_rate' filepath='drivers/clk/clk.c' line='2309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_set_rate'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='2309' column='1'/>
+        <parameter type-id='7359adad' name='rate' filepath='drivers/clk/clk.c' line='2309' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='clk_sync_state' mangled-name='clk_sync_state' filepath='drivers/clk/clk.c' line='1327' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_sync_state'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk.c' line='1327' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clk_unprepare' mangled-name='clk_unprepare' filepath='include/linux/clk.h' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_unprepare'>
-        <parameter type-id='7d0bc0eb'/>
+      <function-decl name='clk_unprepare' mangled-name='clk_unprepare' filepath='drivers/clk/clk.c' line='857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_unprepare'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='857' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='clk_unregister' mangled-name='clk_unregister' filepath='drivers/clk/clk.c' line='4104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_unregister'>
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4104' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='clockevents_config_and_register' mangled-name='clockevents_config_and_register' filepath='include/linux/clockchips.h' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clockevents_config_and_register'>
-        <parameter type-id='aff725d5'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='clockevents_config_and_register' mangled-name='clockevents_config_and_register' filepath='kernel/time/clockevents.c' line='505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clockevents_config_and_register'>
+        <parameter type-id='aff725d5' name='dev' filepath='kernel/time/clockevents.c' line='505' column='1'/>
+        <parameter type-id='19c2251e' name='freq' filepath='kernel/time/clockevents.c' line='506' column='1'/>
+        <parameter type-id='7359adad' name='min_delta' filepath='kernel/time/clockevents.c' line='506' column='1'/>
+        <parameter type-id='7359adad' name='max_delta' filepath='kernel/time/clockevents.c' line='507' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='clocks_calc_mult_shift' mangled-name='clocks_calc_mult_shift' filepath='kernel/time/clocksource.c' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clocks_calc_mult_shift'>
@@ -116359,11 +116182,11 @@
         <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='902' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cma_alloc' mangled-name='cma_alloc' filepath='include/linux/cma.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cma_alloc'>
-        <parameter type-id='6f67b38a'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cma_alloc' mangled-name='cma_alloc' filepath='mm/cma.c' line='433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cma_alloc'>
+        <parameter type-id='6f67b38a' name='cma' filepath='mm/cma.c' line='433' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='mm/cma.c' line='433' column='1'/>
+        <parameter type-id='f0981eeb' name='align' filepath='mm/cma.c' line='433' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/cma.c' line='434' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
       <function-decl name='cma_for_each_area' mangled-name='cma_for_each_area' filepath='mm/cma.c' line='617' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cma_for_each_area'>
@@ -116375,11 +116198,11 @@
         <parameter type-id='4605de5b' name='cma' filepath='mm/cma.c' line='58' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='cma_release' mangled-name='cma_release' filepath='include/linux/cma.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cma_release'>
-        <parameter type-id='6f67b38a'/>
-        <parameter type-id='b72f2447'/>
-        <parameter type-id='f0981eeb'/>
-        <return type-id='c894953d'/>
+      <function-decl name='cma_release' mangled-name='cma_release' filepath='mm/cma.c' line='593' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cma_release'>
+        <parameter type-id='6f67b38a' name='cma' filepath='mm/cma.c' line='593' column='1'/>
+        <parameter type-id='b72f2447' name='pages' filepath='mm/cma.c' line='593' column='1'/>
+        <parameter type-id='f0981eeb' name='count' filepath='mm/cma.c' line='593' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='compat_alloc_user_space' mangled-name='compat_alloc_user_space' filepath='kernel/compat.c' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='compat_alloc_user_space'>
         <parameter type-id='7359adad' name='len' filepath='kernel/compat.c' line='277' column='1'/>
@@ -116398,8 +116221,8 @@
         <parameter type-id='7359adad' name='arg' filepath='fs/ioctl.c' line='784' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='complete' mangled-name='complete' filepath='include/linux/completion.h' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='complete'>
-        <parameter type-id='389faaf7'/>
+      <function-decl name='complete' mangled-name='complete' filepath='kernel/sched/completion.c' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='complete'>
+        <parameter type-id='389faaf7' name='x' filepath='kernel/sched/completion.c' line='28' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='complete_all' mangled-name='complete_all' filepath='kernel/sched/completion.c' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='complete_all'>
@@ -116436,10 +116259,10 @@
         <parameter type-id='14f24806' name='ops' filepath='drivers/base/component.c' line='757' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='component_master_add_with_match' mangled-name='component_master_add_with_match' filepath='include/linux/component.h' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='component_master_add_with_match'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='27729729'/>
-        <parameter type-id='7d9421ac'/>
+      <function-decl name='component_master_add_with_match' mangled-name='component_master_add_with_match' filepath='drivers/base/component.c' line='467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='component_master_add_with_match'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/component.c' line='467' column='1'/>
+        <parameter type-id='27729729' name='ops' filepath='drivers/base/component.c' line='468' column='1'/>
+        <parameter type-id='7d9421ac' name='match' filepath='drivers/base/component.c' line='469' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='component_master_del' mangled-name='component_master_del' filepath='drivers/base/component.c' line='512' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='component_master_del'>
@@ -116477,22 +116300,22 @@
         <parameter type-id='63a08bf7' name='_ep' filepath='drivers/usb/gadget/composite.c' line='281' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='config_group_init' mangled-name='config_group_init' filepath='include/linux/configfs.h' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_group_init'>
-        <parameter type-id='97aff453'/>
+      <function-decl name='config_group_init' mangled-name='config_group_init' filepath='fs/configfs/item.c' line='159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_group_init'>
+        <parameter type-id='97aff453' name='group' filepath='fs/configfs/item.c' line='159' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='config_group_init_type_name' mangled-name='config_group_init_type_name' filepath='include/linux/configfs.h' line='88' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_group_init_type_name'>
-        <parameter type-id='97aff453'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='596e8e55'/>
+      <function-decl name='config_group_init_type_name' mangled-name='config_group_init_type_name' filepath='fs/configfs/item.c' line='94' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_group_init_type_name'>
+        <parameter type-id='97aff453' name='group' filepath='fs/configfs/item.c' line='94' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='fs/configfs/item.c' line='94' column='1'/>
+        <parameter type-id='596e8e55' name='type' filepath='fs/configfs/item.c' line='95' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='config_item_get' mangled-name='config_item_get' filepath='include/linux/configfs.h' line='63' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_item_get'>
-        <parameter type-id='7a29ff27'/>
+      <function-decl name='config_item_get' mangled-name='config_item_get' filepath='fs/configfs/item.c' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_item_get'>
+        <parameter type-id='7a29ff27' name='item' filepath='fs/configfs/item.c' line='103' column='1'/>
         <return type-id='7a29ff27'/>
       </function-decl>
-      <function-decl name='config_item_put' mangled-name='config_item_put' filepath='include/linux/configfs.h' line='65' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_item_put'>
-        <parameter type-id='7a29ff27'/>
+      <function-decl name='config_item_put' mangled-name='config_item_put' filepath='fs/configfs/item.c' line='148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='config_item_put'>
+        <parameter type-id='7a29ff27' name='item' filepath='fs/configfs/item.c' line='148' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='configfs_register_subsystem' mangled-name='configfs_register_subsystem' filepath='fs/configfs/dir.c' line='1879' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='configfs_register_subsystem'>
@@ -116519,22 +116342,22 @@
       <function-decl name='console_unlock' mangled-name='console_unlock' filepath='kernel/printk/printk.c' line='2433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_unlock'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='consume_skb' mangled-name='consume_skb' filepath='include/linux/skbuff.h' line='1068' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='consume_skb'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='consume_skb' mangled-name='consume_skb' filepath='net/core/skbuff.c' line='845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='consume_skb'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='845' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='contig_page_data' type-id='54406315' mangled-name='contig_page_data' visibility='default' filepath='mm/memblock.c' line='96' column='1' elf-symbol-id='contig_page_data'/>
-      <function-decl name='copy_from_kernel_nofault' mangled-name='copy_from_kernel_nofault' filepath='include/linux/uaccess.h' line='367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='copy_from_kernel_nofault'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='copy_from_kernel_nofault' mangled-name='copy_from_kernel_nofault' filepath='mm/maccess.c' line='25' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='copy_from_kernel_nofault'>
+        <parameter type-id='eaa32e2f' name='dst' filepath='mm/maccess.c' line='25' column='1'/>
+        <parameter type-id='eaa32e2f' name='src' filepath='mm/maccess.c' line='25' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='mm/maccess.c' line='25' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
       <var-decl name='cpu_all_bits' type-id='afe549fd' mangled-name='cpu_all_bits' visibility='default' filepath='kernel/cpu.c' line='2748' column='1' elf-symbol-id='cpu_all_bits'/>
       <var-decl name='cpu_bit_bitmap' type-id='f959706c' mangled-name='cpu_bit_bitmap' visibility='default' filepath='kernel/cpu.c' line='2737' column='1' elf-symbol-id='cpu_bit_bitmap'/>
-      <function-decl name='cpu_have_feature' mangled-name='cpu_have_feature' filepath='arch/arm64/include/asm/cpufeature.h' line='416' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_have_feature'>
-        <parameter type-id='f0981eeb'/>
-        <return type-id='c894953d'/>
+      <function-decl name='cpu_have_feature' mangled-name='cpu_have_feature' filepath='arch/arm64/kernel/cpufeature.c' line='2847' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_have_feature'>
+        <parameter type-id='f0981eeb' name='num' filepath='arch/arm64/kernel/cpufeature.c' line='2847' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='cpu_hotplug_disable' mangled-name='cpu_hotplug_disable' filepath='kernel/cpu.c' line='358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpu_hotplug_disable'>
         <return type-id='48b5725f'/>
@@ -116595,8 +116418,8 @@
         <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/cpufreq_cooling.c' line='659' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_cpu_get' mangled-name='cpufreq_cpu_get' filepath='include/linux/cpufreq.h' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_cpu_get'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_cpu_get' mangled-name='cpufreq_cpu_get' filepath='drivers/cpufreq/cpufreq.c' line='220' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_cpu_get'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='220' column='1'/>
         <return type-id='343c3ae4'/>
       </function-decl>
       <function-decl name='cpufreq_cpu_get_raw' mangled-name='cpufreq_cpu_get_raw' filepath='drivers/cpufreq/cpufreq.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_cpu_get_raw'>
@@ -116607,18 +116430,18 @@
         <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='248' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_disable_fast_switch' mangled-name='cpufreq_disable_fast_switch' filepath='include/linux/cpufreq.h' line='229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_disable_fast_switch'>
-        <parameter type-id='343c3ae4'/>
+      <function-decl name='cpufreq_disable_fast_switch' mangled-name='cpufreq_disable_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_disable_fast_switch'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='520' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_driver_fast_switch' mangled-name='cpufreq_driver_fast_switch' filepath='include/linux/cpufreq.h' line='594' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_fast_switch'>
-        <parameter type-id='343c3ae4'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_driver_fast_switch' mangled-name='cpufreq_driver_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='2093' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_fast_switch'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='2093' column='1'/>
+        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='2094' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_driver_resolve_freq' mangled-name='cpufreq_driver_resolve_freq' filepath='include/linux/cpufreq.h' line='602' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_resolve_freq'>
-        <parameter type-id='343c3ae4'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_driver_resolve_freq' mangled-name='cpufreq_driver_resolve_freq' filepath='drivers/cpufreq/cpufreq.c' line='543' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_resolve_freq'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='543' column='1'/>
+        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/cpufreq.c' line='544' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='cpufreq_driver_target' mangled-name='cpufreq_driver_target' filepath='drivers/cpufreq/cpufreq.c' line='2244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_driver_target'>
@@ -116630,8 +116453,8 @@
       <function-decl name='cpufreq_enable_boost_support' mangled-name='cpufreq_enable_boost_support' filepath='drivers/cpufreq/cpufreq.c' line='2683' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_enable_boost_support'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_enable_fast_switch' mangled-name='cpufreq_enable_fast_switch' filepath='include/linux/cpufreq.h' line='228' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_enable_fast_switch'>
-        <parameter type-id='343c3ae4'/>
+      <function-decl name='cpufreq_enable_fast_switch' mangled-name='cpufreq_enable_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='496' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_enable_fast_switch'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='496' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='cpufreq_freq_attr_scaling_available_freqs' type-id='9f2d4ea3' mangled-name='cpufreq_freq_attr_scaling_available_freqs' visibility='default' filepath='drivers/cpufreq/freq_table.c' line='280' column='1' elf-symbol-id='cpufreq_freq_attr_scaling_available_freqs'/>
@@ -116647,9 +116470,9 @@
         <parameter type-id='95e97e5e' name='transition_failed' filepath='drivers/cpufreq/cpufreq.c' line='446' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_frequency_table_get_index' mangled-name='cpufreq_frequency_table_get_index' filepath='include/linux/cpufreq.h' line='754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_frequency_table_get_index'>
-        <parameter type-id='343c3ae4'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_frequency_table_get_index' mangled-name='cpufreq_frequency_table_get_index' filepath='drivers/cpufreq/freq_table.c' line='213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_frequency_table_get_index'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/freq_table.c' line='213' column='1'/>
+        <parameter type-id='f0981eeb' name='freq' filepath='drivers/cpufreq/freq_table.c' line='214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='cpufreq_frequency_table_verify' mangled-name='cpufreq_frequency_table_verify' filepath='drivers/cpufreq/freq_table.c' line='71' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_frequency_table_verify'>
@@ -116682,12 +116505,12 @@
         <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2436' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_policy_transition_delay_us' mangled-name='cpufreq_policy_transition_delay_us' filepath='include/linux/cpufreq.h' line='604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_policy_transition_delay_us'>
-        <parameter type-id='343c3ae4'/>
+      <function-decl name='cpufreq_policy_transition_delay_us' mangled-name='cpufreq_policy_transition_delay_us' filepath='drivers/cpufreq/cpufreq.c' line='565' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_policy_transition_delay_us'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='565' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpufreq_quick_get' mangled-name='cpufreq_quick_get' filepath='include/linux/cpufreq.h' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_quick_get'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_quick_get' mangled-name='cpufreq_quick_get' filepath='drivers/cpufreq/cpufreq.c' line='1725' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_quick_get'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='1725' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='cpufreq_quick_get_max' mangled-name='cpufreq_quick_get_max' filepath='drivers/cpufreq/cpufreq.c' line='1757' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_quick_get_max'>
@@ -116698,23 +116521,23 @@
         <parameter type-id='eb90c228' name='driver_data' filepath='drivers/cpufreq/cpufreq.c' line='2733' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_register_governor' mangled-name='cpufreq_register_governor' filepath='include/linux/cpufreq.h' line='605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_governor'>
-        <parameter type-id='6925355c'/>
+      <function-decl name='cpufreq_register_governor' mangled-name='cpufreq_register_governor' filepath='drivers/cpufreq/cpufreq.c' line='2373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_governor'>
+        <parameter type-id='6925355c' name='governor' filepath='drivers/cpufreq/cpufreq.c' line='2373' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpufreq_register_notifier' mangled-name='cpufreq_register_notifier' filepath='include/linux/cpufreq.h' line='501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_notifier'>
-        <parameter type-id='d504f73d'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_register_notifier' mangled-name='cpufreq_register_notifier' filepath='drivers/cpufreq/cpufreq.c' line='1991' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_register_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/cpufreq/cpufreq.c' line='1991' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/cpufreq/cpufreq.c' line='1991' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='cpufreq_remove_update_util_hook' mangled-name='cpufreq_remove_update_util_hook' filepath='kernel/sched/cpufreq.c' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_remove_update_util_hook'>
         <parameter type-id='95e97e5e' name='cpu' filepath='kernel/sched/cpufreq.c' line='58' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_table_index_unsorted' mangled-name='cpufreq_table_index_unsorted' filepath='include/linux/cpufreq.h' line='751' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_table_index_unsorted'>
-        <parameter type-id='343c3ae4'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_table_index_unsorted' mangled-name='cpufreq_table_index_unsorted' filepath='drivers/cpufreq/freq_table.c' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_table_index_unsorted'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/freq_table.c' line='120' column='1'/>
+        <parameter type-id='f0981eeb' name='target_freq' filepath='drivers/cpufreq/freq_table.c' line='121' column='1'/>
+        <parameter type-id='f0981eeb' name='relation' filepath='drivers/cpufreq/freq_table.c' line='122' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='cpufreq_this_cpu_can_update' mangled-name='cpufreq_this_cpu_can_update' filepath='kernel/sched/cpufreq.c' line='73' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_this_cpu_can_update'>
@@ -116729,9 +116552,9 @@
         <parameter type-id='6925355c' name='governor' filepath='drivers/cpufreq/cpufreq.c' line='2396' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpufreq_unregister_notifier' mangled-name='cpufreq_unregister_notifier' filepath='include/linux/cpufreq.h' line='502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_notifier'>
-        <parameter type-id='d504f73d'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpufreq_unregister_notifier' mangled-name='cpufreq_unregister_notifier' filepath='drivers/cpufreq/cpufreq.c' line='2035' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_unregister_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/cpufreq/cpufreq.c' line='2035' column='1'/>
+        <parameter type-id='f0981eeb' name='list' filepath='drivers/cpufreq/cpufreq.c' line='2035' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='cpufreq_update_policy' mangled-name='cpufreq_update_policy' filepath='drivers/cpufreq/cpufreq.c' line='2563' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_update_policy'>
@@ -116746,8 +116569,8 @@
         <parameter type-id='b50a4934' name='disable' filepath='drivers/cpuidle/driver.c' line='354' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpuidle_get_cpu_driver' mangled-name='cpuidle_get_cpu_driver' filepath='include/linux/cpuidle.h' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuidle_get_cpu_driver'>
-        <parameter type-id='1b0e1d00'/>
+      <function-decl name='cpuidle_get_cpu_driver' mangled-name='cpuidle_get_cpu_driver' filepath='drivers/cpuidle/driver.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuidle_get_cpu_driver'>
+        <parameter type-id='1b0e1d00' name='dev' filepath='drivers/cpuidle/driver.c' line='338' column='1'/>
         <return type-id='809cdefc'/>
       </function-decl>
       <function-decl name='cpuidle_get_driver' mangled-name='cpuidle_get_driver' filepath='drivers/cpuidle/driver.c' line='318' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuidle_get_driver'>
@@ -116767,52 +116590,52 @@
       <function-decl name='cpuidle_resume_and_unlock' mangled-name='cpuidle_resume_and_unlock' filepath='drivers/cpuidle/cpuidle.c' line='458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuidle_resume_and_unlock'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpumask_any_but' mangled-name='cpumask_any_but' filepath='include/linux/cpumask.h' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_any_but'>
-        <parameter type-id='5f8a1ac4'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='cpumask_any_but' mangled-name='cpumask_any_but' filepath='lib/cpumask.c' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_any_but'>
+        <parameter type-id='5f8a1ac4' name='mask' filepath='lib/cpumask.c' line='53' column='1'/>
+        <parameter type-id='f0981eeb' name='cpu' filepath='lib/cpumask.c' line='53' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpumask_next' mangled-name='cpumask_next' filepath='include/linux/cpumask.h' line='233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_next'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='5f8a1ac4'/>
+      <function-decl name='cpumask_next' mangled-name='cpumask_next' filepath='lib/cpumask.c' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_next'>
+        <parameter type-id='95e97e5e' name='n' filepath='lib/cpumask.c' line='17' column='1'/>
+        <parameter type-id='5f8a1ac4' name='srcp' filepath='lib/cpumask.c' line='17' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='cpumask_next_and' mangled-name='cpumask_next_and' filepath='include/linux/cpumask.h' line='250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_next_and'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='5f8a1ac4'/>
-        <parameter type-id='5f8a1ac4'/>
+      <function-decl name='cpumask_next_and' mangled-name='cpumask_next_and' filepath='lib/cpumask.c' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_next_and'>
+        <parameter type-id='95e97e5e' name='n' filepath='lib/cpumask.c' line='34' column='1'/>
+        <parameter type-id='5f8a1ac4' name='src1p' filepath='lib/cpumask.c' line='34' column='1'/>
+        <parameter type-id='5f8a1ac4' name='src2p' filepath='lib/cpumask.c' line='35' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpumask_next_wrap' mangled-name='cpumask_next_wrap' filepath='include/linux/cpumask.h' line='280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_next_wrap'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='5f8a1ac4'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='cpumask_next_wrap' mangled-name='cpumask_next_wrap' filepath='lib/cpumask.c' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpumask_next_wrap'>
+        <parameter type-id='95e97e5e' name='n' filepath='lib/cpumask.c' line='77' column='1'/>
+        <parameter type-id='5f8a1ac4' name='mask' filepath='lib/cpumask.c' line='77' column='1'/>
+        <parameter type-id='95e97e5e' name='start' filepath='lib/cpumask.c' line='77' column='1'/>
+        <parameter type-id='b50a4934' name='wrap' filepath='lib/cpumask.c' line='77' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpupri_find_fitness' mangled-name='cpupri_find_fitness' filepath='kernel/sched/cpupri.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpupri_find_fitness'>
-        <parameter type-id='15c7dfa4'/>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='74bccedd'/>
-        <parameter type-id='61a6a060'/>
+      <function-decl name='cpupri_find_fitness' mangled-name='cpupri_find_fitness' filepath='kernel/sched/cpupri.c' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpupri_find_fitness'>
+        <parameter type-id='15c7dfa4' name='cp' filepath='kernel/sched/cpupri.c' line='147' column='1'/>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/cpupri.c' line='147' column='1'/>
+        <parameter type-id='74bccedd' name='lowest_mask' filepath='kernel/sched/cpupri.c' line='148' column='1'/>
+        <parameter type-id='cf77d29f' name='fitness_fn' filepath='kernel/sched/cpupri.c' line='149' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='cpus_read_lock' mangled-name='cpus_read_lock' filepath='include/linux/cpu.h' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_lock'>
+      <function-decl name='cpus_read_lock' mangled-name='cpus_read_lock' filepath='kernel/cpu.c' line='299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_lock'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpus_read_unlock' mangled-name='cpus_read_unlock' filepath='include/linux/cpu.h' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_unlock'>
+      <function-decl name='cpus_read_unlock' mangled-name='cpus_read_unlock' filepath='kernel/cpu.c' line='311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpus_read_unlock'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='cpuset_cpus_allowed' mangled-name='cpuset_cpus_allowed' filepath='include/linux/cpuset.h' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuset_cpus_allowed'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='74bccedd'/>
+      <function-decl name='cpuset_cpus_allowed' mangled-name='cpuset_cpus_allowed' filepath='kernel/cgroup/cpuset.c' line='3346' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpuset_cpus_allowed'>
+        <parameter type-id='f23e2572' name='tsk' filepath='kernel/cgroup/cpuset.c' line='3346' column='1'/>
+        <parameter type-id='74bccedd' name='pmask' filepath='kernel/cgroup/cpuset.c' line='3346' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='crc32_be' mangled-name='crc32_be' filepath='include/linux/crc32.h' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crc32_be'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='f0981eeb'/>
+      <function-decl name='crc32_be' mangled-name='crc32_be' filepath='lib/crc32.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crc32_be'>
+        <parameter type-id='19c2251e' name='crc' filepath='lib/crc32.c' line='340' column='1'/>
+        <parameter type-id='354f7eb9' name='p' filepath='lib/crc32.c' line='340' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='lib/crc32.c' line='340' column='1'/>
+        <return type-id='19c2251e'/>
       </function-decl>
       <function-decl name='crc8' mangled-name='crc8' filepath='lib/crc8.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crc8'>
         <parameter type-id='bbaf3419' name='table' filepath='lib/crc8.c' line='74' column='1'/>
@@ -116855,12 +116678,12 @@
         <parameter type-id='f0981eeb' name='key_len' filepath='crypto/aes_generic.c' line='1137' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_ahash_digest' mangled-name='crypto_ahash_digest' filepath='include/crypto/hash.h' line='478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_ahash_digest'>
-        <parameter type-id='6f3c82ac'/>
+      <function-decl name='crypto_ahash_digest' mangled-name='crypto_ahash_digest' filepath='crypto/ahash.c' line='368' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_ahash_digest'>
+        <parameter type-id='6f3c82ac' name='req' filepath='crypto/ahash.c' line='368' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_ahash_finup' mangled-name='crypto_ahash_finup' filepath='include/crypto/hash.h' line='448' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_ahash_finup'>
-        <parameter type-id='6f3c82ac'/>
+      <function-decl name='crypto_ahash_finup' mangled-name='crypto_ahash_finup' filepath='crypto/ahash.c' line='354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_ahash_finup'>
+        <parameter type-id='6f3c82ac' name='req' filepath='crypto/ahash.c' line='354' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='crypto_ahash_setkey' mangled-name='crypto_ahash_setkey' filepath='crypto/ahash.c' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_ahash_setkey'>
@@ -116889,10 +116712,10 @@
         <parameter type-id='19c2251e' name='mask' filepath='crypto/ahash.c' line='556' column='1'/>
         <return type-id='1351523a'/>
       </function-decl>
-      <function-decl name='crypto_alloc_base' mangled-name='crypto_alloc_base' filepath='include/linux/crypto.h' line='676' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_alloc_base'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='crypto_alloc_base' mangled-name='crypto_alloc_base' filepath='crypto/api.c' line='402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_alloc_base'>
+        <parameter type-id='80f4b756' name='alg_name' filepath='crypto/api.c' line='402' column='1'/>
+        <parameter type-id='19c2251e' name='type' filepath='crypto/api.c' line='402' column='1'/>
+        <parameter type-id='19c2251e' name='mask' filepath='crypto/api.c' line='402' column='1'/>
         <return type-id='dfeb7f6c'/>
       </function-decl>
       <function-decl name='crypto_alloc_rng' mangled-name='crypto_alloc_rng' filepath='crypto/rng.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_alloc_rng'>
@@ -116947,42 +116770,42 @@
         <parameter type-id='f0981eeb' name='keylen' filepath='crypto/cipher.c' line='44' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_comp_compress' mangled-name='crypto_comp_compress' filepath='include/linux/crypto.h' line='784' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_comp_compress'>
-        <parameter type-id='a064fed8'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='crypto_comp_compress' mangled-name='crypto_comp_compress' filepath='crypto/compress.c' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_comp_compress'>
+        <parameter type-id='a064fed8' name='comp' filepath='crypto/compress.c' line='12' column='1'/>
+        <parameter type-id='bbaf3419' name='src' filepath='crypto/compress.c' line='13' column='1'/>
+        <parameter type-id='f0981eeb' name='slen' filepath='crypto/compress.c' line='13' column='1'/>
+        <parameter type-id='8bff8096' name='dst' filepath='crypto/compress.c' line='14' column='1'/>
+        <parameter type-id='807869d3' name='dlen' filepath='crypto/compress.c' line='14' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_comp_decompress' mangled-name='crypto_comp_decompress' filepath='include/linux/crypto.h' line='788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_comp_decompress'>
-        <parameter type-id='a064fed8'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='crypto_comp_decompress' mangled-name='crypto_comp_decompress' filepath='crypto/compress.c' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_comp_decompress'>
+        <parameter type-id='a064fed8' name='comp' filepath='crypto/compress.c' line='23' column='1'/>
+        <parameter type-id='bbaf3419' name='src' filepath='crypto/compress.c' line='24' column='1'/>
+        <parameter type-id='f0981eeb' name='slen' filepath='crypto/compress.c' line='24' column='1'/>
+        <parameter type-id='8bff8096' name='dst' filepath='crypto/compress.c' line='25' column='1'/>
+        <parameter type-id='807869d3' name='dlen' filepath='crypto/compress.c' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_dequeue_request' mangled-name='crypto_dequeue_request' filepath='include/crypto/algapi.h' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_dequeue_request'>
-        <parameter type-id='1a8fddbe'/>
+      <function-decl name='crypto_dequeue_request' mangled-name='crypto_dequeue_request' filepath='crypto/algapi.c' line='944' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_dequeue_request'>
+        <parameter type-id='1a8fddbe' name='queue' filepath='crypto/algapi.c' line='944' column='1'/>
         <return type-id='af5eeab9'/>
       </function-decl>
-      <function-decl name='crypto_destroy_tfm' mangled-name='crypto_destroy_tfm' filepath='include/linux/crypto.h' line='677' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_destroy_tfm'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='dfeb7f6c'/>
+      <function-decl name='crypto_destroy_tfm' mangled-name='crypto_destroy_tfm' filepath='crypto/api.c' line='561' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_destroy_tfm'>
+        <parameter type-id='eaa32e2f' name='mem' filepath='crypto/api.c' line='561' column='1'/>
+        <parameter type-id='dfeb7f6c' name='tfm' filepath='crypto/api.c' line='561' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='crypto_drop_spawn' mangled-name='crypto_drop_spawn' filepath='crypto/algapi.c' line='704' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_drop_spawn'>
         <parameter type-id='5f880e0e' name='spawn' filepath='crypto/algapi.c' line='704' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='crypto_enqueue_request' mangled-name='crypto_enqueue_request' filepath='include/crypto/algapi.h' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_enqueue_request'>
-        <parameter type-id='1a8fddbe'/>
-        <parameter type-id='af5eeab9'/>
+      <function-decl name='crypto_enqueue_request' mangled-name='crypto_enqueue_request' filepath='crypto/algapi.c' line='913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_enqueue_request'>
+        <parameter type-id='1a8fddbe' name='queue' filepath='crypto/algapi.c' line='913' column='1'/>
+        <parameter type-id='af5eeab9' name='request' filepath='crypto/algapi.c' line='914' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='crypto_ft_tab' type-id='350bcc55' mangled-name='crypto_ft_tab' visibility='default' filepath='crypto/aes_generic.c' line='65' column='1' elf-symbol-id='crypto_ft_tab'/>
-      <function-decl name='crypto_get_default_null_skcipher' mangled-name='crypto_get_default_null_skcipher' filepath='include/crypto/null.h' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_get_default_null_skcipher'>
+      <function-decl name='crypto_get_default_null_skcipher' mangled-name='crypto_get_default_null_skcipher' filepath='crypto/crypto_null.c' line='153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_get_default_null_skcipher'>
         <return type-id='2e6a2f40'/>
       </function-decl>
       <function-decl name='crypto_grab_aead' mangled-name='crypto_grab_aead' filepath='crypto/aead.c' line='205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_grab_aead'>
@@ -117017,10 +116840,10 @@
         <parameter type-id='19c2251e' name='mask' filepath='crypto/skcipher.c' line='752' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_has_alg' mangled-name='crypto_has_alg' filepath='include/linux/crypto.h' line='621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_has_alg'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='crypto_has_alg' mangled-name='crypto_has_alg' filepath='crypto/api.c' line='578' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_has_alg'>
+        <parameter type-id='80f4b756' name='name' filepath='crypto/api.c' line='578' column='1'/>
+        <parameter type-id='19c2251e' name='type' filepath='crypto/api.c' line='578' column='1'/>
+        <parameter type-id='19c2251e' name='mask' filepath='crypto/api.c' line='578' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='crypto_inc' mangled-name='crypto_inc' filepath='crypto/algapi.c' line='976' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_inc'>
@@ -117028,9 +116851,9 @@
         <parameter type-id='f0981eeb' name='size' filepath='crypto/algapi.c' line='976' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='crypto_init_queue' mangled-name='crypto_init_queue' filepath='include/crypto/algapi.h' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_init_queue'>
-        <parameter type-id='1a8fddbe'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='crypto_init_queue' mangled-name='crypto_init_queue' filepath='crypto/algapi.c' line='904' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_init_queue'>
+        <parameter type-id='1a8fddbe' name='queue' filepath='crypto/algapi.c' line='904' column='1'/>
+        <parameter type-id='f0981eeb' name='max_qlen' filepath='crypto/algapi.c' line='904' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='crypto_inst_setname' mangled-name='crypto_inst_setname' filepath='crypto/algapi.c' line='889' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_inst_setname'>
@@ -117040,7 +116863,7 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='crypto_it_tab' type-id='350bcc55' mangled-name='crypto_it_tab' visibility='default' filepath='crypto/aes_generic.c' line='593' column='1' elf-symbol-id='crypto_it_tab'/>
-      <function-decl name='crypto_put_default_null_skcipher' mangled-name='crypto_put_default_null_skcipher' filepath='include/crypto/null.h' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_put_default_null_skcipher'>
+      <function-decl name='crypto_put_default_null_skcipher' mangled-name='crypto_put_default_null_skcipher' filepath='crypto/crypto_null.c' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_put_default_null_skcipher'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='crypto_register_aead' mangled-name='crypto_register_aead' filepath='crypto/aead.c' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_aead'>
@@ -117051,8 +116874,8 @@
         <parameter type-id='16144ad1' name='alg' filepath='crypto/ahash.c' line='584' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_register_alg' mangled-name='crypto_register_alg' filepath='include/linux/crypto.h' line='613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_alg'>
-        <parameter type-id='67f526b5'/>
+      <function-decl name='crypto_register_alg' mangled-name='crypto_register_alg' filepath='crypto/algapi.c' line='412' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_alg'>
+        <parameter type-id='67f526b5' name='alg' filepath='crypto/algapi.c' line='412' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='crypto_register_algs' mangled-name='crypto_register_algs' filepath='crypto/algapi.c' line='467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_algs'>
@@ -117069,22 +116892,22 @@
         <parameter type-id='6e764b1e' name='alg' filepath='crypto/scompress.c' line='257' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_register_shash' mangled-name='crypto_register_shash' filepath='include/crypto/internal/hash.h' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_shash'>
-        <parameter type-id='1be0f6ab'/>
+      <function-decl name='crypto_register_shash' mangled-name='crypto_register_shash' filepath='crypto/shash.c' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_shash'>
+        <parameter type-id='1be0f6ab' name='alg' filepath='crypto/shash.c' line='555' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_register_shashes' mangled-name='crypto_register_shashes' filepath='include/crypto/internal/hash.h' line='105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_shashes'>
-        <parameter type-id='1be0f6ab'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='crypto_register_shashes' mangled-name='crypto_register_shashes' filepath='crypto/shash.c' line='574' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_shashes'>
+        <parameter type-id='1be0f6ab' name='algs' filepath='crypto/shash.c' line='574' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='crypto/shash.c' line='574' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='crypto_register_skcipher' mangled-name='crypto_register_skcipher' filepath='crypto/skcipher.c' line='816' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_skcipher'>
         <parameter type-id='613dff15' name='alg' filepath='crypto/skcipher.c' line='816' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_register_skciphers' mangled-name='crypto_register_skciphers' filepath='include/crypto/internal/skcipher.h' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_skciphers'>
-        <parameter type-id='613dff15'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='crypto_register_skciphers' mangled-name='crypto_register_skciphers' filepath='crypto/skcipher.c' line='835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_skciphers'>
+        <parameter type-id='613dff15' name='algs' filepath='crypto/skcipher.c' line='835' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='crypto/skcipher.c' line='835' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='crypto_register_template' mangled-name='crypto_register_template' filepath='crypto/algapi.c' line='496' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_register_template'>
@@ -117134,11 +116957,11 @@
         <parameter type-id='1be0f6ab' name='alg' filepath='crypto/shash.c' line='36' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='crypto_shash_digest' mangled-name='crypto_shash_digest' filepath='include/crypto/hash.h' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_digest'>
-        <parameter type-id='32efad44'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='crypto_shash_digest' mangled-name='crypto_shash_digest' filepath='crypto/shash.c' line='204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_digest'>
+        <parameter type-id='32efad44' name='desc' filepath='crypto/shash.c' line='204' column='1'/>
+        <parameter type-id='bbaf3419' name='data' filepath='crypto/shash.c' line='204' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='crypto/shash.c' line='205' column='1'/>
+        <parameter type-id='8bff8096' name='out' filepath='crypto/shash.c' line='205' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='crypto_shash_final' mangled-name='crypto_shash_final' filepath='crypto/shash.c' line='163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_final'>
@@ -117146,44 +116969,44 @@
         <parameter type-id='8bff8096' name='out' filepath='crypto/shash.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_shash_finup' mangled-name='crypto_shash_finup' filepath='include/crypto/hash.h' line='996' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_finup'>
-        <parameter type-id='32efad44'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='crypto_shash_finup' mangled-name='crypto_shash_finup' filepath='crypto/shash.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_finup'>
+        <parameter type-id='32efad44' name='desc' filepath='crypto/shash.c' line='183' column='1'/>
+        <parameter type-id='bbaf3419' name='data' filepath='crypto/shash.c' line='183' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='crypto/shash.c' line='184' column='1'/>
+        <parameter type-id='8bff8096' name='out' filepath='crypto/shash.c' line='184' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_shash_setkey' mangled-name='crypto_shash_setkey' filepath='include/crypto/hash.h' line='849' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_setkey'>
-        <parameter type-id='247dd85c'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='crypto_shash_setkey' mangled-name='crypto_shash_setkey' filepath='crypto/shash.c' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_setkey'>
+        <parameter type-id='247dd85c' name='tfm' filepath='crypto/shash.c' line='69' column='1'/>
+        <parameter type-id='bbaf3419' name='key' filepath='crypto/shash.c' line='69' column='1'/>
+        <parameter type-id='f0981eeb' name='keylen' filepath='crypto/shash.c' line='70' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_shash_tfm_digest' mangled-name='crypto_shash_tfm_digest' filepath='include/crypto/hash.h' line='886' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_tfm_digest'>
-        <parameter type-id='247dd85c'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='crypto_shash_tfm_digest' mangled-name='crypto_shash_tfm_digest' filepath='crypto/shash.c' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_tfm_digest'>
+        <parameter type-id='247dd85c' name='tfm' filepath='crypto/shash.c' line='221' column='1'/>
+        <parameter type-id='bbaf3419' name='data' filepath='crypto/shash.c' line='221' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='crypto/shash.c' line='222' column='1'/>
+        <parameter type-id='8bff8096' name='out' filepath='crypto/shash.c' line='222' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_shash_update' mangled-name='crypto_shash_update' filepath='include/crypto/hash.h' line='962' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_update'>
-        <parameter type-id='32efad44'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='crypto_shash_update' mangled-name='crypto_shash_update' filepath='crypto/shash.c' line='121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_shash_update'>
+        <parameter type-id='32efad44' name='desc' filepath='crypto/shash.c' line='121' column='1'/>
+        <parameter type-id='bbaf3419' name='data' filepath='crypto/shash.c' line='121' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='crypto/shash.c' line='122' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_skcipher_decrypt' mangled-name='crypto_skcipher_decrypt' filepath='include/crypto/skcipher.h' line='432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_skcipher_decrypt'>
-        <parameter type-id='c249b570'/>
+      <function-decl name='crypto_skcipher_decrypt' mangled-name='crypto_skcipher_decrypt' filepath='crypto/skcipher.c' line='642' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_skcipher_decrypt'>
+        <parameter type-id='c249b570' name='req' filepath='crypto/skcipher.c' line='642' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_skcipher_encrypt' mangled-name='crypto_skcipher_encrypt' filepath='include/crypto/skcipher.h' line='419' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_skcipher_encrypt'>
-        <parameter type-id='c249b570'/>
+      <function-decl name='crypto_skcipher_encrypt' mangled-name='crypto_skcipher_encrypt' filepath='crypto/skcipher.c' line='625' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_skcipher_encrypt'>
+        <parameter type-id='c249b570' name='req' filepath='crypto/skcipher.c' line='625' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='crypto_skcipher_setkey' mangled-name='crypto_skcipher_setkey' filepath='include/crypto/skcipher.h' line='364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_skcipher_setkey'>
-        <parameter type-id='72bb8c36'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='crypto_skcipher_setkey' mangled-name='crypto_skcipher_setkey' filepath='crypto/skcipher.c' line='600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_skcipher_setkey'>
+        <parameter type-id='72bb8c36' name='tfm' filepath='crypto/skcipher.c' line='600' column='1'/>
+        <parameter type-id='bbaf3419' name='key' filepath='crypto/skcipher.c' line='600' column='1'/>
+        <parameter type-id='f0981eeb' name='keylen' filepath='crypto/skcipher.c' line='601' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='crypto_spawn_tfm2' mangled-name='crypto_spawn_tfm2' filepath='crypto/algapi.c' line='770' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_spawn_tfm2'>
@@ -117198,8 +117021,8 @@
         <parameter type-id='16144ad1' name='alg' filepath='crypto/ahash.c' line='597' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='crypto_unregister_alg' mangled-name='crypto_unregister_alg' filepath='include/linux/crypto.h' line='614' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_alg'>
-        <parameter type-id='67f526b5'/>
+      <function-decl name='crypto_unregister_alg' mangled-name='crypto_unregister_alg' filepath='crypto/algapi.c' line='447' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_alg'>
+        <parameter type-id='67f526b5' name='alg' filepath='crypto/algapi.c' line='447' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='crypto_unregister_algs' mangled-name='crypto_unregister_algs' filepath='crypto/algapi.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_algs'>
@@ -117220,18 +117043,18 @@
         <parameter type-id='1be0f6ab' name='alg' filepath='crypto/shash.c' line='568' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='crypto_unregister_shashes' mangled-name='crypto_unregister_shashes' filepath='include/crypto/internal/hash.h' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_shashes'>
-        <parameter type-id='1be0f6ab'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='crypto_unregister_shashes' mangled-name='crypto_unregister_shashes' filepath='crypto/shash.c' line='594' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_shashes'>
+        <parameter type-id='1be0f6ab' name='algs' filepath='crypto/shash.c' line='594' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='crypto/shash.c' line='594' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='crypto_unregister_skcipher' mangled-name='crypto_unregister_skcipher' filepath='crypto/skcipher.c' line='829' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_skcipher'>
         <parameter type-id='613dff15' name='alg' filepath='crypto/skcipher.c' line='829' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='crypto_unregister_skciphers' mangled-name='crypto_unregister_skciphers' filepath='include/crypto/internal/skcipher.h' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_skciphers'>
-        <parameter type-id='613dff15'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='crypto_unregister_skciphers' mangled-name='crypto_unregister_skciphers' filepath='crypto/skcipher.c' line='855' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_skciphers'>
+        <parameter type-id='613dff15' name='algs' filepath='crypto/skcipher.c' line='855' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='crypto/skcipher.c' line='855' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='crypto_unregister_template' mangled-name='crypto_unregister_template' filepath='crypto/algapi.c' line='536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crypto_unregister_template'>
@@ -117256,11 +117079,11 @@
         <parameter type-id='fbd88bba' name='csum' filepath='arch/arm64/lib/csum.c' line='134' column='1'/>
         <return type-id='7dac1e36'/>
       </function-decl>
-      <function-decl name='csum_partial' mangled-name='csum_partial' filepath='include/asm-generic/checksum.h' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='csum_partial'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <return type-id='f0981eeb'/>
+      <function-decl name='csum_partial' mangled-name='csum_partial' filepath='lib/checksum.c' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='csum_partial'>
+        <parameter type-id='eaa32e2f' name='buff' filepath='lib/checksum.c' line='125' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='lib/checksum.c' line='125' column='1'/>
+        <parameter type-id='fbd88bba' name='wsum' filepath='lib/checksum.c' line='125' column='1'/>
+        <return type-id='fbd88bba'/>
       </function-decl>
       <function-decl name='csum_tcpudp_nofold' mangled-name='csum_tcpudp_nofold' filepath='lib/checksum.c' line='158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='csum_tcpudp_nofold'>
         <parameter type-id='78a133c2' name='saddr' filepath='lib/checksum.c' line='158' column='1'/>
@@ -117270,8 +117093,8 @@
         <parameter type-id='fbd88bba' name='sum' filepath='lib/checksum.c' line='159' column='1'/>
         <return type-id='fbd88bba'/>
       </function-decl>
-      <function-decl name='current_time' mangled-name='current_time' filepath='include/linux/fs.h' line='1611' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_time'>
-        <parameter type-id='7e666abe'/>
+      <function-decl name='current_time' mangled-name='current_time' filepath='fs/inode.c' line='2285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_time'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='2285' column='1'/>
         <return type-id='40a816ad'/>
       </function-decl>
       <function-decl name='current_work' mangled-name='current_work' filepath='kernel/workqueue.c' line='4517' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='current_work'>
@@ -117287,18 +117110,18 @@
         <parameter type-id='80f4b756' name='name' filepath='fs/dcache.c' line='1844' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
-      <function-decl name='d_delete' mangled-name='d_delete' filepath='include/linux/dcache.h' line='243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_delete'>
-        <parameter type-id='27675065'/>
+      <function-decl name='d_delete' mangled-name='d_delete' filepath='fs/dcache.c' line='2459' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_delete'>
+        <parameter type-id='27675065' name='dentry' filepath='fs/dcache.c' line='2459' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='d_make_root' mangled-name='d_make_root' filepath='include/linux/dcache.h' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_make_root'>
-        <parameter type-id='7e666abe'/>
+      <function-decl name='d_make_root' mangled-name='d_make_root' filepath='fs/dcache.c' line='2003' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_make_root'>
+        <parameter type-id='7e666abe' name='root_inode' filepath='fs/dcache.c' line='2003' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
-      <function-decl name='d_path' mangled-name='d_path' filepath='include/linux/dcache.h' line='308' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_path'>
-        <parameter type-id='a77efac3'/>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='d_path' mangled-name='d_path' filepath='fs/d_path.c' line='262' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='d_path'>
+        <parameter type-id='a77efac3' name='path' filepath='fs/d_path.c' line='262' column='1'/>
+        <parameter type-id='26a90f95' name='buf' filepath='fs/d_path.c' line='262' column='1'/>
+        <parameter type-id='95e97e5e' name='buflen' filepath='fs/d_path.c' line='262' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='dapm_clock_event' mangled-name='dapm_clock_event' filepath='sound/soc/soc-dapm.c' line='1402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dapm_clock_event'>
@@ -117329,8 +117152,8 @@
         <parameter type-id='a54c778f' name='wait' filepath='net/core/datagram.c' line='798' column='1'/>
         <return type-id='8f254b08'/>
       </function-decl>
-      <function-decl name='deactivate_locked_super' mangled-name='deactivate_locked_super' filepath='include/linux/fs.h' line='2328' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='deactivate_locked_super'>
-        <parameter type-id='42c8f564'/>
+      <function-decl name='deactivate_locked_super' mangled-name='deactivate_locked_super' filepath='fs/super.c' line='329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='deactivate_locked_super'>
+        <parameter type-id='42c8f564' name='s' filepath='fs/super.c' line='329' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='deactivate_task' mangled-name='deactivate_task' filepath='kernel/sched/core.c' line='1691' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='deactivate_task'>
@@ -117339,7 +117162,7 @@
         <parameter type-id='95e97e5e' name='flags' filepath='kernel/sched/core.c' line='1691' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='debug_locks_off' mangled-name='debug_locks_off' filepath='include/linux/debug_locks.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debug_locks_off'>
+      <function-decl name='debug_locks_off' mangled-name='debug_locks_off' filepath='lib/debug_locks.c' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debug_locks_off'>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='debugfs_attr_read' mangled-name='debugfs_attr_read' filepath='fs/debugfs/file.c' line='366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_attr_read'>
@@ -117370,11 +117193,11 @@
         <parameter type-id='3a843513' name='blob' filepath='fs/debugfs/file.c' line='919' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
-      <function-decl name='debugfs_create_bool' mangled-name='debugfs_create_bool' filepath='include/linux/debugfs.h' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_bool'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='27675065'/>
-        <parameter type-id='d8e6b335'/>
+      <function-decl name='debugfs_create_bool' mangled-name='debugfs_create_bool' filepath='fs/debugfs/file.c' line='864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_bool'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/debugfs/file.c' line='864' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/debugfs/file.c' line='864' column='1'/>
+        <parameter type-id='27675065' name='parent' filepath='fs/debugfs/file.c' line='865' column='1'/>
+        <parameter type-id='d8e6b335' name='value' filepath='fs/debugfs/file.c' line='865' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
       <function-decl name='debugfs_create_devm_seqfile' mangled-name='debugfs_create_devm_seqfile' filepath='fs/debugfs/file.c' line='1134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_devm_seqfile'>
@@ -117384,25 +117207,25 @@
         <parameter type-id='0131eb61' name='read_fn' filepath='fs/debugfs/file.c' line='1136' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='debugfs_create_dir' mangled-name='debugfs_create_dir' filepath='include/linux/debugfs.h' line='81' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_dir'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='27675065'/>
+      <function-decl name='debugfs_create_dir' mangled-name='debugfs_create_dir' filepath='fs/debugfs/inode.c' line='551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_dir'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/debugfs/inode.c' line='551' column='1'/>
+        <parameter type-id='27675065' name='parent' filepath='fs/debugfs/inode.c' line='551' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
-      <function-decl name='debugfs_create_file' mangled-name='debugfs_create_file' filepath='include/linux/debugfs.h' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_file'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='27675065'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='61758ee5'/>
+      <function-decl name='debugfs_create_file' mangled-name='debugfs_create_file' filepath='fs/debugfs/inode.c' line='450' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_file'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/debugfs/inode.c' line='450' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/debugfs/inode.c' line='450' column='1'/>
+        <parameter type-id='27675065' name='parent' filepath='fs/debugfs/inode.c' line='451' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/debugfs/inode.c' line='451' column='1'/>
+        <parameter type-id='61758ee5' name='fops' filepath='fs/debugfs/inode.c' line='452' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
-      <function-decl name='debugfs_create_file_unsafe' mangled-name='debugfs_create_file_unsafe' filepath='include/linux/debugfs.h' line='72' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_file_unsafe'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='27675065'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='61758ee5'/>
+      <function-decl name='debugfs_create_file_unsafe' mangled-name='debugfs_create_file_unsafe' filepath='fs/debugfs/inode.c' line='489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_file_unsafe'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/debugfs/inode.c' line='489' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/debugfs/inode.c' line='489' column='1'/>
+        <parameter type-id='27675065' name='parent' filepath='fs/debugfs/inode.c' line='490' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/debugfs/inode.c' line='490' column='1'/>
+        <parameter type-id='61758ee5' name='fops' filepath='fs/debugfs/inode.c' line='491' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
       <function-decl name='debugfs_create_regset32' mangled-name='debugfs_create_regset32' filepath='fs/debugfs/file.c' line='1094' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_regset32'>
@@ -117439,11 +117262,11 @@
         <parameter type-id='f9409001' name='value' filepath='fs/debugfs/file.c' line='515' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='debugfs_create_u64' mangled-name='debugfs_create_u64' filepath='include/linux/debugfs.h' line='113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_u64'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='27675065'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='debugfs_create_u64' mangled-name='debugfs_create_u64' filepath='fs/debugfs/file.c' line='551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_u64'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/debugfs/file.c' line='551' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/debugfs/file.c' line='551' column='1'/>
+        <parameter type-id='27675065' name='parent' filepath='fs/debugfs/file.c' line='551' column='1'/>
+        <parameter type-id='3df9fd28' name='value' filepath='fs/debugfs/file.c' line='552' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='debugfs_create_u8' mangled-name='debugfs_create_u8' filepath='fs/debugfs/file.c' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_u8'>
@@ -117453,11 +117276,11 @@
         <parameter type-id='8bff8096' name='value' filepath='fs/debugfs/file.c' line='443' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='debugfs_create_ulong' mangled-name='debugfs_create_ulong' filepath='include/linux/debugfs.h' line='115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_ulong'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='27675065'/>
-        <parameter type-id='1d2c2b85'/>
+      <function-decl name='debugfs_create_ulong' mangled-name='debugfs_create_ulong' filepath='fs/debugfs/file.c' line='599' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_ulong'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/debugfs/file.c' line='599' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/debugfs/file.c' line='599' column='1'/>
+        <parameter type-id='27675065' name='parent' filepath='fs/debugfs/file.c' line='600' column='1'/>
+        <parameter type-id='1d2c2b85' name='value' filepath='fs/debugfs/file.c' line='600' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
       <function-decl name='debugfs_create_x32' mangled-name='debugfs_create_x32' filepath='fs/debugfs/file.c' line='681' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_create_x32'>
@@ -117489,9 +117312,9 @@
         <parameter type-id='27675065' name='dentry' filepath='fs/debugfs/file.c' line='132' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='debugfs_lookup' mangled-name='debugfs_lookup' filepath='include/linux/debugfs.h' line='67' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_lookup'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='27675065'/>
+      <function-decl name='debugfs_lookup' mangled-name='debugfs_lookup' filepath='fs/debugfs/inode.c' line='296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_lookup'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/debugfs/inode.c' line='296' column='1'/>
+        <parameter type-id='27675065' name='parent' filepath='fs/debugfs/inode.c' line='296' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
       <function-decl name='debugfs_print_regs32' mangled-name='debugfs_print_regs32' filepath='fs/debugfs/file.c' line='1036' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_print_regs32'>
@@ -117502,8 +117325,8 @@
         <parameter type-id='26a90f95' name='prefix' filepath='fs/debugfs/file.c' line='1037' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='debugfs_remove' mangled-name='debugfs_remove' filepath='include/linux/debugfs.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_remove'>
-        <parameter type-id='27675065'/>
+      <function-decl name='debugfs_remove' mangled-name='debugfs_remove' filepath='fs/debugfs/inode.c' line='722' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_remove'>
+        <parameter type-id='27675065' name='dentry' filepath='fs/debugfs/inode.c' line='722' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='debugfs_rename' mangled-name='debugfs_rename' filepath='fs/debugfs/inode.c' line='752' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='debugfs_rename'>
@@ -117513,9 +117336,9 @@
         <parameter type-id='80f4b756' name='new_name' filepath='fs/debugfs/inode.c' line='753' column='1'/>
         <return type-id='27675065'/>
       </function-decl>
-      <function-decl name='dec_zone_page_state' mangled-name='dec_zone_page_state' filepath='include/linux/vmstat.h' line='273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dec_zone_page_state'>
-        <parameter type-id='02f11ed4'/>
-        <parameter type-id='a1f2d9a1'/>
+      <function-decl name='dec_zone_page_state' mangled-name='dec_zone_page_state' filepath='mm/vmstat.c' line='540' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dec_zone_page_state'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/vmstat.c' line='540' column='1'/>
+        <parameter type-id='a1f2d9a1' name='item' filepath='mm/vmstat.c' line='540' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='default_llseek' mangled-name='default_llseek' filepath='fs/read_write.c' line='236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='default_llseek'>
@@ -117524,11 +117347,11 @@
         <parameter type-id='95e97e5e' name='whence' filepath='fs/read_write.c' line='236' column='1'/>
         <return type-id='69bf7bee'/>
       </function-decl>
-      <function-decl name='default_wake_function' mangled-name='default_wake_function' filepath='include/linux/wait.h' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='default_wake_function'>
-        <parameter type-id='db9d03e3'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='default_wake_function' mangled-name='default_wake_function' filepath='kernel/sched/core.c' line='5042' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='default_wake_function'>
+        <parameter type-id='ba9aa326' name='curr' filepath='kernel/sched/core.c' line='5042' column='1'/>
+        <parameter type-id='f0981eeb' name='mode' filepath='kernel/sched/core.c' line='5042' column='1'/>
+        <parameter type-id='95e97e5e' name='wake_flags' filepath='kernel/sched/core.c' line='5042' column='1'/>
+        <parameter type-id='eaa32e2f' name='key' filepath='kernel/sched/core.c' line='5043' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='deferred_free' mangled-name='deferred_free' filepath='drivers/dma-buf/heaps/deferred-free-helper.c' line='25' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='deferred_free'>
@@ -117541,16 +117364,16 @@
         <parameter type-id='33c599da' name='disk' filepath='block/genhd.c' line='892' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='del_random_ready_callback' mangled-name='del_random_ready_callback' filepath='include/linux/random.h' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='del_random_ready_callback'>
-        <parameter type-id='b47c553a'/>
+      <function-decl name='del_random_ready_callback' mangled-name='del_random_ready_callback' filepath='drivers/char/random.c' line='1714' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='del_random_ready_callback'>
+        <parameter type-id='b47c553a' name='rdy' filepath='drivers/char/random.c' line='1714' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='del_timer' mangled-name='del_timer' filepath='include/linux/timer.h' line='176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='del_timer'>
-        <parameter type-id='9248e67f'/>
+      <function-decl name='del_timer' mangled-name='del_timer' filepath='kernel/time/timer.c' line='1204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='del_timer'>
+        <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='1204' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='del_timer_sync' mangled-name='del_timer_sync' filepath='include/linux/timer.h' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='del_timer_sync'>
-        <parameter type-id='9248e67f'/>
+      <function-decl name='del_timer_sync' mangled-name='del_timer_sync' filepath='kernel/time/timer.c' line='1358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='del_timer_sync'>
+        <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='1358' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='delayed_work_timer_fn' mangled-name='delayed_work_timer_fn' filepath='kernel/workqueue.c' line='1626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='delayed_work_timer_fn'>
@@ -117561,8 +117384,8 @@
         <parameter type-id='5bed570d' name='desc' filepath='drivers/gpio/gpiolib.c' line='164' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='destroy_workqueue' mangled-name='destroy_workqueue' filepath='include/linux/workqueue.h' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='destroy_workqueue'>
-        <parameter type-id='242e3d19'/>
+      <function-decl name='destroy_workqueue' mangled-name='destroy_workqueue' filepath='kernel/workqueue.c' line='4390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='destroy_workqueue'>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='4390' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_alloc_name' mangled-name='dev_alloc_name' filepath='net/core/dev.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_alloc_name'>
@@ -117598,49 +117421,49 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/base/devcoredump.c' line='186' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_driver_string' mangled-name='dev_driver_string' filepath='include/linux/device.h' line='939' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_driver_string'>
-        <parameter type-id='8df61054'/>
+      <function-decl name='dev_driver_string' mangled-name='dev_driver_string' filepath='drivers/base/core.c' line='1955' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_driver_string'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='1955' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='dev_err_probe' mangled-name='dev_err_probe' filepath='include/linux/device.h' line='950' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_err_probe'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dev_err_probe' mangled-name='dev_err_probe' filepath='drivers/base/core.c' line='4534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_err_probe'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4534' column='1'/>
+        <parameter type-id='95e97e5e' name='err' filepath='drivers/base/core.c' line='4534' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4534' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_fetch_sw_netstats' mangled-name='dev_fetch_sw_netstats' filepath='include/linux/netdevice.h' line='4607' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_fetch_sw_netstats'>
-        <parameter type-id='bd3860fe'/>
-        <parameter type-id='069eeb9e'/>
+      <function-decl name='dev_fetch_sw_netstats' mangled-name='dev_fetch_sw_netstats' filepath='net/core/dev.c' line='10472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_fetch_sw_netstats'>
+        <parameter type-id='bd3860fe' name='s' filepath='net/core/dev.c' line='10472' column='1'/>
+        <parameter type-id='069eeb9e' name='netstats' filepath='net/core/dev.c' line='10473' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_fwnode' mangled-name='dev_fwnode' filepath='include/linux/property.h' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_fwnode'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='dev_fwnode' mangled-name='dev_fwnode' filepath='drivers/base/property.c' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_fwnode'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/property.c' line='21' column='1'/>
         <return type-id='4a935625'/>
       </function-decl>
-      <function-decl name='dev_get_by_index' mangled-name='dev_get_by_index' filepath='include/linux/netdevice.h' line='2926' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_by_index'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='dev_get_by_index' mangled-name='dev_get_by_index' filepath='net/core/dev.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_by_index'>
+        <parameter type-id='a2bff676' name='net' filepath='net/core/dev.c' line='984' column='1'/>
+        <parameter type-id='95e97e5e' name='ifindex' filepath='net/core/dev.c' line='984' column='1'/>
         <return type-id='68a2d05b'/>
       </function-decl>
-      <function-decl name='dev_get_by_name' mangled-name='dev_get_by_name' filepath='include/linux/netdevice.h' line='2882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_by_name'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dev_get_by_name' mangled-name='dev_get_by_name' filepath='net/core/dev.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_by_name'>
+        <parameter type-id='a2bff676' name='net' filepath='net/core/dev.c' line='910' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='net/core/dev.c' line='910' column='1'/>
         <return type-id='68a2d05b'/>
       </function-decl>
-      <function-decl name='dev_get_by_name_rcu' mangled-name='dev_get_by_name_rcu' filepath='include/linux/netdevice.h' line='2883' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_by_name_rcu'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dev_get_by_name_rcu' mangled-name='dev_get_by_name_rcu' filepath='net/core/dev.c' line='889' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_by_name_rcu'>
+        <parameter type-id='a2bff676' name='net' filepath='net/core/dev.c' line='889' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='net/core/dev.c' line='889' column='1'/>
         <return type-id='68a2d05b'/>
       </function-decl>
-      <function-decl name='dev_get_regmap' mangled-name='dev_get_regmap' filepath='include/linux/regmap.h' line='1047' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_regmap'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dev_get_regmap' mangled-name='dev_get_regmap' filepath='drivers/base/regmap/regmap.c' line='1530' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_regmap'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/regmap/regmap.c' line='1530' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/base/regmap/regmap.c' line='1530' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
-      <function-decl name='dev_get_stats' mangled-name='dev_get_stats' filepath='include/linux/netdevice.h' line='4603' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_stats'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='bd3860fe'/>
+      <function-decl name='dev_get_stats' mangled-name='dev_get_stats' filepath='net/core/dev.c' line='10445' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_get_stats'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='10445' column='1'/>
+        <parameter type-id='bd3860fe' name='storage' filepath='net/core/dev.c' line='10446' column='1'/>
         <return type-id='bd3860fe'/>
       </function-decl>
       <function-decl name='dev_mc_sync_multiple' mangled-name='dev_mc_sync_multiple' filepath='net/core/dev_addr_lists.c' line='893' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_mc_sync_multiple'>
@@ -117662,9 +117485,9 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeirq.c' line='87' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_pm_domain_attach' mangled-name='dev_pm_domain_attach' filepath='include/linux/pm_domain.h' line='407' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_domain_attach'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='dev_pm_domain_attach' mangled-name='dev_pm_domain_attach' filepath='drivers/base/power/common.c' line='102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_domain_attach'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/common.c' line='102' column='1'/>
+        <parameter type-id='b50a4934' name='power_on' filepath='drivers/base/power/common.c' line='102' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dev_pm_domain_attach_by_id' mangled-name='dev_pm_domain_attach_by_id' filepath='drivers/base/power/common.c' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_domain_attach_by_id'>
@@ -117677,9 +117500,9 @@
         <parameter type-id='80f4b756' name='name' filepath='drivers/base/power/common.c' line='161' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='dev_pm_domain_detach' mangled-name='dev_pm_domain_detach' filepath='include/linux/pm_domain.h' line='412' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_domain_detach'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='dev_pm_domain_detach' mangled-name='dev_pm_domain_detach' filepath='drivers/base/power/common.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_domain_detach'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/common.c' line='183' column='1'/>
+        <parameter type-id='b50a4934' name='power_off' filepath='drivers/base/power/common.c' line='183' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_pm_genpd_add_notifier' mangled-name='dev_pm_genpd_add_notifier' filepath='drivers/base/power/domain.c' line='1716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_genpd_add_notifier'>
@@ -117701,10 +117524,10 @@
         <parameter type-id='f0981eeb' name='state' filepath='drivers/base/power/domain.c' line='391' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_add' mangled-name='dev_pm_opp_add' filepath='include/linux/pm_opp.h' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_add'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='dev_pm_opp_add' mangled-name='dev_pm_opp_add' filepath='drivers/opp/core.c' line='2182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_add'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='2182' column='1'/>
+        <parameter type-id='7359adad' name='freq' filepath='drivers/opp/core.c' line='2182' column='1'/>
+        <parameter type-id='7359adad' name='u_volt' filepath='drivers/opp/core.c' line='2182' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dev_pm_opp_adjust_voltage' mangled-name='dev_pm_opp_adjust_voltage' filepath='drivers/opp/core.c' line='2284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_adjust_voltage'>
@@ -117735,15 +117558,15 @@
         <parameter type-id='7359adad' name='u_volt' filepath='drivers/opp/core.c' line='592' column='1'/>
         <return type-id='02e48bc6'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_find_freq_exact' mangled-name='dev_pm_opp_find_freq_exact' filepath='include/linux/pm_opp.h' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_find_freq_exact'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='dev_pm_opp_find_freq_exact' mangled-name='dev_pm_opp_find_freq_exact' filepath='drivers/opp/core.c' line='369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_find_freq_exact'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='369' column='1'/>
+        <parameter type-id='7359adad' name='freq' filepath='drivers/opp/core.c' line='370' column='1'/>
+        <parameter type-id='b50a4934' name='available' filepath='drivers/opp/core.c' line='371' column='1'/>
         <return type-id='02e48bc6'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_find_freq_floor' mangled-name='dev_pm_opp_find_freq_floor' filepath='include/linux/pm_opp.h' line='116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_find_freq_floor'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='1d2c2b85'/>
+      <function-decl name='dev_pm_opp_find_freq_floor' mangled-name='dev_pm_opp_find_freq_floor' filepath='drivers/opp/core.c' line='534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_find_freq_floor'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='534' column='1'/>
+        <parameter type-id='1d2c2b85' name='freq' filepath='drivers/opp/core.c' line='535' column='1'/>
         <return type-id='02e48bc6'/>
       </function-decl>
       <function-decl name='dev_pm_opp_free_cpufreq_table' mangled-name='dev_pm_opp_free_cpufreq_table' filepath='drivers/opp/cpu.c' line='96' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_free_cpufreq_table'>
@@ -117763,8 +117586,8 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='270' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_get_opp_count' mangled-name='dev_pm_opp_get_opp_count' filepath='include/linux/pm_opp.h' line='104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_get_opp_count'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='dev_pm_opp_get_opp_count' mangled-name='dev_pm_opp_get_opp_count' filepath='drivers/opp/core.c' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_get_opp_count'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='326' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dev_pm_opp_get_opp_table' mangled-name='dev_pm_opp_get_opp_table' filepath='drivers/opp/core.c' line='1171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_get_opp_table'>
@@ -117780,8 +117603,8 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='284' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_get_voltage' mangled-name='dev_pm_opp_get_voltage' filepath='include/linux/pm_opp.h' line='96' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_get_voltage'>
-        <parameter type-id='02e48bc6'/>
+      <function-decl name='dev_pm_opp_get_voltage' mangled-name='dev_pm_opp_get_voltage' filepath='drivers/opp/core.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_get_voltage'>
+        <parameter type-id='02e48bc6' name='opp' filepath='drivers/opp/core.c' line='101' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='dev_pm_opp_init_cpufreq_table' mangled-name='dev_pm_opp_init_cpufreq_table' filepath='drivers/opp/cpu.c' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_init_cpufreq_table'>
@@ -117789,13 +117612,13 @@
         <parameter type-id='873a2591' name='table' filepath='drivers/opp/cpu.c' line='44' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_add_table' mangled-name='dev_pm_opp_of_add_table' filepath='include/linux/pm_opp.h' line='373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='dev_pm_opp_of_add_table' mangled-name='dev_pm_opp_of_add_table' filepath='drivers/opp/of.c' line='973' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='973' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_add_table_indexed' mangled-name='dev_pm_opp_of_add_table_indexed' filepath='include/linux/pm_opp.h' line='374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table_indexed'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='dev_pm_opp_of_add_table_indexed' mangled-name='dev_pm_opp_of_add_table_indexed' filepath='drivers/opp/of.c' line='1017' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table_indexed'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='1017' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/opp/of.c' line='1017' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dev_pm_opp_of_cpumask_add_table' mangled-name='dev_pm_opp_of_cpumask_add_table' filepath='drivers/opp/of.c' line='1066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_cpumask_add_table'>
@@ -117806,9 +117629,9 @@
         <parameter type-id='5f8a1ac4' name='cpumask' filepath='drivers/opp/of.c' line='1054' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_find_icc_paths' mangled-name='dev_pm_opp_of_find_icc_paths' filepath='include/linux/pm_opp.h' line='382' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_find_icc_paths'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='e62a60bd'/>
+      <function-decl name='dev_pm_opp_of_find_icc_paths' mangled-name='dev_pm_opp_of_find_icc_paths' filepath='drivers/opp/of.c' line='372' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_find_icc_paths'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='372' column='1'/>
+        <parameter type-id='e62a60bd' name='opp_table' filepath='drivers/opp/of.c' line='373' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dev_pm_opp_of_get_sharing_cpus' mangled-name='dev_pm_opp_of_get_sharing_cpus' filepath='drivers/opp/of.c' line='1123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_get_sharing_cpus'>
@@ -117825,16 +117648,16 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='636' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_put' mangled-name='dev_pm_opp_put' filepath='include/linux/pm_opp.h' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_put'>
-        <parameter type-id='02e48bc6'/>
+      <function-decl name='dev_pm_opp_put' mangled-name='dev_pm_opp_put' filepath='drivers/opp/core.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_put'>
+        <parameter type-id='02e48bc6' name='opp' filepath='drivers/opp/core.c' line='1271' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_pm_opp_put_clkname' mangled-name='dev_pm_opp_put_clkname' filepath='drivers/opp/core.c' line='1908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_put_clkname'>
         <parameter type-id='e62a60bd' name='opp_table' filepath='drivers/opp/core.c' line='1908' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_put_opp_table' mangled-name='dev_pm_opp_put_opp_table' filepath='include/linux/pm_opp.h' line='94' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_put_opp_table'>
-        <parameter type-id='e62a60bd'/>
+      <function-decl name='dev_pm_opp_put_opp_table' mangled-name='dev_pm_opp_put_opp_table' filepath='drivers/opp/core.c' line='1223' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_put_opp_table'>
+        <parameter type-id='e62a60bd' name='opp_table' filepath='drivers/opp/core.c' line='1223' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_pm_opp_put_regulators' mangled-name='dev_pm_opp_put_regulators' filepath='drivers/opp/core.c' line='1824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_put_regulators'>
@@ -117850,9 +117673,9 @@
         <parameter type-id='d504f73d' name='nb' filepath='drivers/opp/core.c' line='2388' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_remove' mangled-name='dev_pm_opp_remove' filepath='include/linux/pm_opp.h' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_remove'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='dev_pm_opp_remove' mangled-name='dev_pm_opp_remove' filepath='drivers/opp/core.c' line='1290' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_remove'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='1290' column='1'/>
+        <parameter type-id='7359adad' name='freq' filepath='drivers/opp/core.c' line='1290' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_pm_opp_remove_all_dynamic' mangled-name='dev_pm_opp_remove_all_dynamic' filepath='drivers/opp/core.c' line='1358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_remove_all_dynamic'>
@@ -117937,9 +117760,9 @@
         <parameter type-id='a7832498' name='new_value' filepath='drivers/base/power/qos.c' line='464' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_qos_update_user_latency_tolerance' mangled-name='dev_pm_qos_update_user_latency_tolerance' filepath='include/linux/pm_qos.h' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_qos_update_user_latency_tolerance'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='dev_pm_qos_update_user_latency_tolerance' mangled-name='dev_pm_qos_update_user_latency_tolerance' filepath='drivers/base/power/qos.c' line='905' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_qos_update_user_latency_tolerance'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/qos.c' line='905' column='1'/>
+        <parameter type-id='a7832498' name='val' filepath='drivers/base/power/qos.c' line='905' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dev_pm_set_dedicated_wake_irq' mangled-name='dev_pm_set_dedicated_wake_irq' filepath='drivers/base/power/wakeirq.c' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_set_dedicated_wake_irq'>
@@ -117952,17 +117775,17 @@
         <parameter type-id='95e97e5e' name='irq' filepath='drivers/base/power/wakeirq.c' line='53' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_printk' mangled-name='dev_printk' filepath='include/linux/dev_printk.h' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_printk'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dev_printk' mangled-name='dev_printk' filepath='drivers/base/core.c' line='4463' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_printk'>
+        <parameter type-id='80f4b756' name='level' filepath='drivers/base/core.c' line='4463' column='1'/>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4463' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4464' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_printk_emit' mangled-name='dev_printk_emit' filepath='include/linux/dev_printk.h' line='38' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_printk_emit'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dev_printk_emit' mangled-name='dev_printk_emit' filepath='drivers/base/core.c' line='4438' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_printk_emit'>
+        <parameter type-id='95e97e5e' name='level' filepath='drivers/base/core.c' line='4438' column='1'/>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/base/core.c' line='4438' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='4438' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -117975,9 +117798,9 @@
         <parameter type-id='95e97e5e' name='new_mtu' filepath='net/core/dev.c' line='8639' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_set_name' mangled-name='dev_set_name' filepath='include/linux/device.h' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_set_name'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dev_set_name' mangled-name='dev_set_name' filepath='drivers/base/core.c' line='3022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_set_name'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='3022' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='3022' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -117998,11 +117821,11 @@
         <parameter type-id='2aee9912' name='args' filepath='drivers/base/core.c' line='4428' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='include/linux/devfreq.h' line='213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='cba10b6e'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='devfreq_add_device' mangled-name='devfreq_add_device' filepath='drivers/devfreq/devfreq.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='746' column='1'/>
+        <parameter type-id='cba10b6e' name='profile' filepath='drivers/devfreq/devfreq.c' line='747' column='1'/>
+        <parameter type-id='80f4b756' name='governor_name' filepath='drivers/devfreq/devfreq.c' line='748' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='749' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
       <function-decl name='devfreq_add_governor' mangled-name='devfreq_add_governor' filepath='drivers/devfreq/devfreq.c' line='1193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_add_governor'>
@@ -118050,20 +117873,20 @@
         <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1932' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='include/linux/devfreq.h' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
-        <parameter type-id='f66fa7f4'/>
+      <function-decl name='devfreq_remove_device' mangled-name='devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='922' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='922' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devfreq_remove_governor' mangled-name='devfreq_remove_governor' filepath='drivers/devfreq/devfreq.c' line='1258' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_remove_governor'>
         <parameter type-id='247297cd' name='governor' filepath='drivers/devfreq/devfreq.c' line='1258' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='include/linux/devfreq.h' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
-        <parameter type-id='f66fa7f4'/>
+      <function-decl name='devfreq_resume_device' mangled-name='devfreq_resume_device' filepath='drivers/devfreq/devfreq.c' line='1116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_resume_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1116' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='include/linux/devfreq.h' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
-        <parameter type-id='f66fa7f4'/>
+      <function-decl name='devfreq_suspend_device' mangled-name='devfreq_suspend_device' filepath='drivers/devfreq/devfreq.c' line='1079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_suspend_device'>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1079' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devfreq_unregister_opp_notifier' mangled-name='devfreq_unregister_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_unregister_opp_notifier'>
@@ -118076,8 +117899,8 @@
         <parameter type-id='807869d3' name='delay' filepath='drivers/devfreq/devfreq.c' line='572' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_add' mangled-name='device_add' filepath='include/linux/device.h' line='800' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_add'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='device_add' mangled-name='device_add' filepath='drivers/base/core.c' line='3121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_add'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='3121' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='device_add_disk' mangled-name='device_add_disk' filepath='block/genhd.c' line='840' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_add_disk'>
@@ -118099,12 +117922,12 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/dd.c' line='460' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='device_create' mangled-name='device_create' filepath='include/linux/device.h' line='872' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_create'>
-        <parameter type-id='67aca04f'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='device_create' mangled-name='device_create' filepath='drivers/base/core.c' line='3927' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_create'>
+        <parameter type-id='67aca04f' name='class' filepath='drivers/base/core.c' line='3927' column='1'/>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/base/core.c' line='3927' column='1'/>
+        <parameter type-id='8504f260' name='devt' filepath='drivers/base/core.c' line='3928' column='1'/>
+        <parameter type-id='eaa32e2f' name='drvdata' filepath='drivers/base/core.c' line='3928' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='3928' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='fa0b179b'/>
       </function-decl>
@@ -118113,40 +117936,40 @@
         <parameter type-id='559ac6f0' name='attr' filepath='drivers/base/core.c' line='2660' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='device_create_file' mangled-name='device_create_file' filepath='include/linux/device.h' line='154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_create_file'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='de63df21'/>
+      <function-decl name='device_create_file' mangled-name='device_create_file' filepath='drivers/base/core.c' line='2605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_create_file'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='2605' column='1'/>
+        <parameter type-id='de63df21' name='attr' filepath='drivers/base/core.c' line='2606' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='device_create_with_groups' mangled-name='device_create_with_groups' filepath='include/linux/device.h' line='875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_create_with_groups'>
-        <parameter type-id='67aca04f'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='c97de1ac'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='device_create_with_groups' mangled-name='device_create_with_groups' filepath='drivers/base/core.c' line='3968' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_create_with_groups'>
+        <parameter type-id='67aca04f' name='class' filepath='drivers/base/core.c' line='3968' column='1'/>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/base/core.c' line='3969' column='1'/>
+        <parameter type-id='8504f260' name='devt' filepath='drivers/base/core.c' line='3969' column='1'/>
+        <parameter type-id='eaa32e2f' name='drvdata' filepath='drivers/base/core.c' line='3970' column='1'/>
+        <parameter type-id='c97de1ac' name='groups' filepath='drivers/base/core.c' line='3971' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/core.c' line='3972' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='device_del' mangled-name='device_del' filepath='include/linux/device.h' line='801' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_del'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='device_del' mangled-name='device_del' filepath='drivers/base/core.c' line='3376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_del'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='3376' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_destroy' mangled-name='device_destroy' filepath='include/linux/device.h' line='878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_destroy'>
-        <parameter type-id='67aca04f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='device_destroy' mangled-name='device_destroy' filepath='drivers/base/core.c' line='3993' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_destroy'>
+        <parameter type-id='67aca04f' name='class' filepath='drivers/base/core.c' line='3993' column='1'/>
+        <parameter type-id='8504f260' name='devt' filepath='drivers/base/core.c' line='3993' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_find_child' mangled-name='device_find_child' filepath='include/linux/device.h' line='806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_find_child'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='92d15ae9'/>
+      <function-decl name='device_find_child' mangled-name='device_find_child' filepath='drivers/base/core.c' line='3607' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_find_child'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/base/core.c' line='3607' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/core.c' line='3607' column='1'/>
+        <parameter type-id='92d15ae9' name='match' filepath='drivers/base/core.c' line='3608' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='device_for_each_child' mangled-name='device_for_each_child' filepath='include/linux/device.h' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_for_each_child'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='92d15ae9'/>
+      <function-decl name='device_for_each_child' mangled-name='device_for_each_child' filepath='drivers/base/core.c' line='3542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_for_each_child'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/base/core.c' line='3542' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/core.c' line='3542' column='1'/>
+        <parameter type-id='92d15ae9' name='fn' filepath='drivers/base/core.c' line='3543' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='device_get_child_node_count' mangled-name='device_get_child_node_count' filepath='drivers/base/property.c' line='851' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_get_child_node_count'>
@@ -118181,28 +118004,28 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/property.c' line='928' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='device_init_wakeup' mangled-name='device_init_wakeup' filepath='include/linux/pm_wakeup.h' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_init_wakeup'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='device_init_wakeup' mangled-name='device_init_wakeup' filepath='drivers/base/power/wakeup.c' line='516' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_init_wakeup'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='516' column='1'/>
+        <parameter type-id='b50a4934' name='enable' filepath='drivers/base/power/wakeup.c' line='516' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='device_initialize' mangled-name='device_initialize' filepath='include/linux/device.h' line='799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_initialize'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='device_initialize' mangled-name='device_initialize' filepath='drivers/base/core.c' line='2718' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_initialize'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='2718' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_link_add' mangled-name='device_link_add' filepath='include/linux/device.h' line='942' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_link_add'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='device_link_add' mangled-name='device_link_add' filepath='drivers/base/core.c' line='670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_link_add'>
+        <parameter type-id='fa0b179b' name='consumer' filepath='drivers/base/core.c' line='670' column='1'/>
+        <parameter type-id='fa0b179b' name='supplier' filepath='drivers/base/core.c' line='671' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/base/core.c' line='671' column='1'/>
         <return type-id='7acfb3fa'/>
       </function-decl>
       <function-decl name='device_link_del' mangled-name='device_link_del' filepath='drivers/base/core.c' line='899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_link_del'>
         <parameter type-id='7acfb3fa' name='link' filepath='drivers/base/core.c' line='899' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_link_remove' mangled-name='device_link_remove' filepath='include/linux/device.h' line='945' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_link_remove'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='device_link_remove' mangled-name='device_link_remove' filepath='drivers/base/core.c' line='915' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_link_remove'>
+        <parameter type-id='eaa32e2f' name='consumer' filepath='drivers/base/core.c' line='915' column='1'/>
+        <parameter type-id='fa0b179b' name='supplier' filepath='drivers/base/core.c' line='915' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='device_match_fwnode' mangled-name='device_match_fwnode' filepath='drivers/base/core.c' line='4644' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_match_fwnode'>
@@ -118224,10 +118047,10 @@
         <parameter type-id='9a537bbe' name='np' filepath='drivers/mfd/syscon.c' line='177' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
-      <function-decl name='device_property_present' mangled-name='device_property_present' filepath='include/linux/property.h' line='36' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_property_present'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
-        <return type-id='c894953d'/>
+      <function-decl name='device_property_present' mangled-name='device_property_present' filepath='drivers/base/property.c' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_property_present'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/property.c' line='35' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/base/property.c' line='35' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='device_property_read_string' mangled-name='device_property_read_string' filepath='drivers/base/property.c' line='200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_property_read_string'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/property.c' line='200' column='1'/>
@@ -118249,11 +118072,11 @@
         <parameter type-id='b59d7dce' name='nval' filepath='drivers/base/property.c' line='104' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='device_property_read_u32_array' mangled-name='device_property_read_u32_array' filepath='include/linux/property.h' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_property_read_u32_array'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='807869d3'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='device_property_read_u32_array' mangled-name='device_property_read_u32_array' filepath='drivers/base/property.c' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_property_read_u32_array'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/property.c' line='128' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/base/property.c' line='128' column='1'/>
+        <parameter type-id='f9409001' name='val' filepath='drivers/base/property.c' line='129' column='1'/>
+        <parameter type-id='b59d7dce' name='nval' filepath='drivers/base/property.c' line='129' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='device_property_read_u8_array' mangled-name='device_property_read_u8_array' filepath='drivers/base/property.c' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_property_read_u8_array'>
@@ -118276,15 +118099,15 @@
         <parameter type-id='559ac6f0' name='attr' filepath='drivers/base/core.c' line='2675' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_remove_file' mangled-name='device_remove_file' filepath='include/linux/device.h' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_remove_file'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='de63df21'/>
+      <function-decl name='device_remove_file' mangled-name='device_remove_file' filepath='drivers/base/core.c' line='2629' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_remove_file'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='2629' column='1'/>
+        <parameter type-id='de63df21' name='attr' filepath='drivers/base/core.c' line='2630' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_remove_file_self' mangled-name='device_remove_file_self' filepath='include/linux/device.h' line='158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_remove_file_self'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='de63df21'/>
-        <return type-id='c894953d'/>
+      <function-decl name='device_remove_file_self' mangled-name='device_remove_file_self' filepath='drivers/base/core.c' line='2644' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_remove_file_self'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='2644' column='1'/>
+        <parameter type-id='de63df21' name='attr' filepath='drivers/base/core.c' line='2645' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='device_remove_groups' mangled-name='device_remove_groups' filepath='drivers/base/core.c' line='2341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_remove_groups'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='2341' column='1'/>
@@ -118301,14 +118124,14 @@
         <parameter type-id='8df61054' name='dev2' filepath='drivers/base/core.c' line='4624' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_set_wakeup_capable' mangled-name='device_set_wakeup_capable' filepath='include/linux/pm_wakeup.h' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_set_wakeup_capable'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='device_set_wakeup_capable' mangled-name='device_set_wakeup_capable' filepath='drivers/base/power/wakeup.c' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_set_wakeup_capable'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='486' column='1'/>
+        <parameter type-id='b50a4934' name='capable' filepath='drivers/base/power/wakeup.c' line='486' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_set_wakeup_enable' mangled-name='device_set_wakeup_enable' filepath='include/linux/pm_wakeup.h' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_set_wakeup_enable'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='device_set_wakeup_enable' mangled-name='device_set_wakeup_enable' filepath='drivers/base/power/wakeup.c' line='539' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_set_wakeup_enable'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='539' column='1'/>
+        <parameter type-id='b50a4934' name='enable' filepath='drivers/base/power/wakeup.c' line='539' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='device_show_bool' mangled-name='device_show_bool' filepath='drivers/base/core.c' line='2073' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_show_bool'>
@@ -118337,22 +118160,22 @@
         <parameter type-id='b59d7dce' name='size' filepath='drivers/base/core.c' line='2033' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='device_unregister' mangled-name='device_unregister' filepath='include/linux/device.h' line='798' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_unregister'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='device_unregister' mangled-name='device_unregister' filepath='drivers/base/core.c' line='3451' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_unregister'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='3451' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='device_wakeup_disable' mangled-name='device_wakeup_disable' filepath='include/linux/pm_wakeup.h' line='105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_wakeup_disable'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='device_wakeup_disable' mangled-name='device_wakeup_disable' filepath='drivers/base/power/wakeup.c' line='461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_wakeup_disable'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='461' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='device_wakeup_enable' mangled-name='device_wakeup_enable' filepath='drivers/base/power/wakeup.c' line='339' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='device_wakeup_enable'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='339' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_add_action' mangled-name='devm_add_action' filepath='include/linux/device.h' line='254' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_add_action'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='b7f9d8e6'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='devm_add_action' mangled-name='devm_add_action' filepath='drivers/base/devres.c' line='739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_add_action'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='739' column='1'/>
+        <parameter type-id='b7f9d8e6' name='action' filepath='drivers/base/devres.c' line='739' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/base/devres.c' line='739' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_backlight_device_register' mangled-name='devm_backlight_device_register' filepath='drivers/video/backlight/backlight.c' line='602' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_backlight_device_register'>
@@ -118375,10 +118198,10 @@
         <parameter type-id='f0981eeb' name='num_slots' filepath='block/keyslot-manager.c' line='153' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_clk_bulk_get' mangled-name='devm_clk_bulk_get' filepath='include/linux/clk.h' line='377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_bulk_get'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='2942e355'/>
+      <function-decl name='devm_clk_bulk_get' mangled-name='devm_clk_bulk_get' filepath='drivers/clk/clk-devres.c' line='81' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_bulk_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk-devres.c' line='81' column='1'/>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-devres.c' line='81' column='1'/>
+        <parameter type-id='2942e355' name='clks' filepath='drivers/clk/clk-devres.c' line='82' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_clk_bulk_get_all' mangled-name='devm_clk_bulk_get_all' filepath='drivers/clk/clk-devres.c' line='102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_bulk_get_all'>
@@ -118386,15 +118209,15 @@
         <parameter type-id='734c20ed' name='clks' filepath='drivers/clk/clk-devres.c' line='103' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_clk_bulk_get_optional' mangled-name='devm_clk_bulk_get_optional' filepath='include/linux/clk.h' line='400' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_bulk_get_optional'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='2942e355'/>
+      <function-decl name='devm_clk_bulk_get_optional' mangled-name='devm_clk_bulk_get_optional' filepath='drivers/clk/clk-devres.c' line='88' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_bulk_get_optional'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk-devres.c' line='88' column='1'/>
+        <parameter type-id='95e97e5e' name='num_clks' filepath='drivers/clk/clk-devres.c' line='88' column='1'/>
+        <parameter type-id='2942e355' name='clks' filepath='drivers/clk/clk-devres.c' line='89' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_clk_get' mangled-name='devm_clk_get' filepath='include/linux/clk.h' line='437' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_get'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='devm_clk_get' mangled-name='devm_clk_get' filepath='drivers/clk/clk-devres.c' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk-devres.c' line='12' column='1'/>
+        <parameter type-id='80f4b756' name='id' filepath='drivers/clk/clk-devres.c' line='12' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='devm_clk_get_optional' mangled-name='devm_clk_get_optional' filepath='drivers/clk/clk-devres.c' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_clk_get_optional'>
@@ -118491,11 +118314,11 @@
         <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/devres.c' line='148' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_extcon_register_notifier' mangled-name='devm_extcon_register_notifier' filepath='include/linux/extcon.h' line='203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_extcon_register_notifier'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='c0d6fada'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='devm_extcon_register_notifier' mangled-name='devm_extcon_register_notifier' filepath='drivers/extcon/devres.c' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_extcon_register_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/extcon/devres.c' line='172' column='1'/>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/devres.c' line='172' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/devres.c' line='173' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/extcon/devres.c' line='173' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_free_irq' mangled-name='devm_free_irq' filepath='kernel/irq/devres.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_free_irq'>
@@ -118686,29 +118509,29 @@
         <parameter type-id='f0981eeb' name='set' filepath='kernel/irq/devres.c' line='264' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_kasprintf' mangled-name='devm_kasprintf' filepath='include/linux/device.h' line='214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kasprintf'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='devm_kasprintf' mangled-name='devm_kasprintf' filepath='drivers/base/devres.c' line='1036' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kasprintf'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='1036' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/base/devres.c' line='1036' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/base/devres.c' line='1036' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='devm_kfree' mangled-name='devm_kfree' filepath='include/linux/device.h' line='235' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kfree'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='devm_kfree' mangled-name='devm_kfree' filepath='drivers/base/devres.c' line='1056' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kfree'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='1056' column='1'/>
+        <parameter type-id='eaa32e2f' name='p' filepath='drivers/base/devres.c' line='1056' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_kmalloc' mangled-name='devm_kmalloc' filepath='include/linux/device.h' line='209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kmalloc'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='devm_kmalloc' mangled-name='devm_kmalloc' filepath='drivers/base/devres.c' line='826' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kmalloc'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='826' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='drivers/base/devres.c' line='826' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/base/devres.c' line='826' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='devm_kmemdup' mangled-name='devm_kmemdup' filepath='include/linux/device.h' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kmemdup'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='devm_kmemdup' mangled-name='devm_kmemdup' filepath='drivers/base/devres.c' line='1082' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kmemdup'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='1082' column='1'/>
+        <parameter type-id='eaa32e2f' name='src' filepath='drivers/base/devres.c' line='1082' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='drivers/base/devres.c' line='1082' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/base/devres.c' line='1082' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='devm_krealloc' mangled-name='devm_krealloc' filepath='drivers/base/devres.c' line='864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_krealloc'>
@@ -118718,10 +118541,10 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/base/devres.c' line='864' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='devm_kstrdup' mangled-name='devm_kstrdup' filepath='include/linux/device.h' line='236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kstrdup'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='devm_kstrdup' mangled-name='devm_kstrdup' filepath='drivers/base/devres.c' line='955' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kstrdup'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='955' column='1'/>
+        <parameter type-id='80f4b756' name='s' filepath='drivers/base/devres.c' line='955' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/base/devres.c' line='955' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='devm_kstrdup_const' mangled-name='devm_kstrdup_const' filepath='drivers/base/devres.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_kstrdup_const'>
@@ -118760,14 +118583,14 @@
         <parameter type-id='7359adad' name='flags' filepath='kernel/iomem.c' line='140' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='devm_mfd_add_devices' mangled-name='devm_mfd_add_devices' filepath='include/linux/mfd/core.h' line='159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_mfd_add_devices'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='1447e860'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='c9d64c0d'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='7544e824'/>
+      <function-decl name='devm_mfd_add_devices' mangled-name='devm_mfd_add_devices' filepath='drivers/mfd/mfd-core.c' line='417' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_mfd_add_devices'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/mfd/mfd-core.c' line='417' column='1'/>
+        <parameter type-id='95e97e5e' name='id' filepath='drivers/mfd/mfd-core.c' line='417' column='1'/>
+        <parameter type-id='1447e860' name='cells' filepath='drivers/mfd/mfd-core.c' line='418' column='1'/>
+        <parameter type-id='95e97e5e' name='n_devs' filepath='drivers/mfd/mfd-core.c' line='418' column='1'/>
+        <parameter type-id='c9d64c0d' name='mem_base' filepath='drivers/mfd/mfd-core.c' line='419' column='1'/>
+        <parameter type-id='95e97e5e' name='irq_base' filepath='drivers/mfd/mfd-core.c' line='420' column='1'/>
+        <parameter type-id='7544e824' name='domain' filepath='drivers/mfd/mfd-core.c' line='420' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_nvmem_cell_get' mangled-name='devm_nvmem_cell_get' filepath='drivers/nvmem/core.c' line='1142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_nvmem_cell_get'>
@@ -118780,9 +118603,9 @@
         <parameter type-id='80f4b756' name='id' filepath='drivers/nvmem/core.c' line='971' column='1'/>
         <return type-id='8179bc49'/>
       </function-decl>
-      <function-decl name='devm_nvmem_register' mangled-name='devm_nvmem_register' filepath='include/linux/nvmem-provider.h' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_nvmem_register'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='7bb280fa'/>
+      <function-decl name='devm_nvmem_register' mangled-name='devm_nvmem_register' filepath='drivers/nvmem/core.c' line='766' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_nvmem_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/nvmem/core.c' line='766' column='1'/>
+        <parameter type-id='7bb280fa' name='config' filepath='drivers/nvmem/core.c' line='767' column='1'/>
         <return type-id='8179bc49'/>
       </function-decl>
       <function-decl name='devm_of_clk_add_hw_provider' mangled-name='devm_of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4710' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_clk_add_hw_provider'>
@@ -118815,8 +118638,8 @@
         <parameter type-id='95e97e5e' name='index' filepath='drivers/phy/phy-core.c' line='825' column='1'/>
         <return type-id='503ff1ba'/>
       </function-decl>
-      <function-decl name='devm_of_platform_populate' mangled-name='devm_of_platform_populate' filepath='include/linux/of_platform.h' line='83' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_platform_populate'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='devm_of_platform_populate' mangled-name='devm_of_platform_populate' filepath='drivers/of/platform.c' line='611' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_platform_populate'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/of/platform.c' line='611' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_of_pwm_get' mangled-name='devm_of_pwm_get' filepath='drivers/pwm/core.c' line='1185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_of_pwm_get'>
@@ -118878,14 +118701,14 @@
         <parameter type-id='e359e165' name='res' filepath='drivers/base/platform.c' line='81' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='devm_platform_ioremap_resource' mangled-name='devm_platform_ioremap_resource' filepath='include/linux/platform_device.h' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_platform_ioremap_resource'>
-        <parameter type-id='db362995'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='devm_platform_ioremap_resource' mangled-name='devm_platform_ioremap_resource' filepath='drivers/base/platform.c' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_platform_ioremap_resource'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='103' column='1'/>
+        <parameter type-id='f0981eeb' name='index' filepath='drivers/base/platform.c' line='104' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='devm_platform_ioremap_resource_byname' mangled-name='devm_platform_ioremap_resource_byname' filepath='include/linux/platform_device.h' line='72' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_platform_ioremap_resource_byname'>
-        <parameter type-id='db362995'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='devm_platform_ioremap_resource_byname' mangled-name='devm_platform_ioremap_resource_byname' filepath='drivers/base/platform.c' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_platform_ioremap_resource_byname'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='143' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/base/platform.c' line='144' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='devm_power_supply_get_by_phandle' mangled-name='devm_power_supply_get_by_phandle' filepath='drivers/power/supply/power_supply_core.c' line='619' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_power_supply_get_by_phandle'>
@@ -118893,10 +118716,10 @@
         <parameter type-id='80f4b756' name='property' filepath='drivers/power/supply/power_supply_core.c' line='620' column='1'/>
         <return type-id='c0c93c9e'/>
       </function-decl>
-      <function-decl name='devm_power_supply_register' mangled-name='devm_power_supply_register' filepath='include/linux/power_supply.h' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_power_supply_register'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='cb9cd99f'/>
-        <parameter type-id='048b3ad6'/>
+      <function-decl name='devm_power_supply_register' mangled-name='devm_power_supply_register' filepath='drivers/power/supply/power_supply_core.c' line='1354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_power_supply_register'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/power/supply/power_supply_core.c' line='1354' column='1'/>
+        <parameter type-id='cb9cd99f' name='desc' filepath='drivers/power/supply/power_supply_core.c' line='1355' column='1'/>
+        <parameter type-id='048b3ad6' name='cfg' filepath='drivers/power/supply/power_supply_core.c' line='1356' column='1'/>
         <return type-id='c0c93c9e'/>
       </function-decl>
       <function-decl name='devm_pwm_get' mangled-name='devm_pwm_get' filepath='drivers/pwm/core.c' line='1153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_pwm_get'>
@@ -118941,15 +118764,15 @@
         <parameter type-id='d7d5e052' name='reg_field' filepath='drivers/base/regmap/regmap.c' line='1259' column='1'/>
         <return type-id='476eb32c'/>
       </function-decl>
-      <function-decl name='devm_regulator_bulk_get' mangled-name='devm_regulator_bulk_get' filepath='include/linux/regulator/consumer.h' line='232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_regulator_bulk_get'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='776946b4'/>
+      <function-decl name='devm_regulator_bulk_get' mangled-name='devm_regulator_bulk_get' filepath='drivers/regulator/devres.c' line='145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_regulator_bulk_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/devres.c' line='145' column='1'/>
+        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/devres.c' line='145' column='1'/>
+        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/devres.c' line='146' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_regulator_get' mangled-name='devm_regulator_get' filepath='include/linux/regulator/consumer.h' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_regulator_get'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='devm_regulator_get' mangled-name='devm_regulator_get' filepath='drivers/regulator/devres.c' line='51' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_regulator_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/regulator/devres.c' line='51' column='1'/>
+        <parameter type-id='80f4b756' name='id' filepath='drivers/regulator/devres.c' line='51' column='1'/>
         <return type-id='850c13f6'/>
       </function-decl>
       <function-decl name='devm_regulator_get_exclusive' mangled-name='devm_regulator_get_exclusive' filepath='drivers/regulator/devres.c' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_regulator_get_exclusive'>
@@ -119048,16 +118871,16 @@
         <parameter type-id='f0981eeb' name='flags' filepath='sound/soc/soc-devres.c' line='140' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_snd_soc_register_card' mangled-name='devm_snd_soc_register_card' filepath='include/sound/soc.h' line='410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_snd_soc_register_card'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='3059cd0b'/>
+      <function-decl name='devm_snd_soc_register_card' mangled-name='devm_snd_soc_register_card' filepath='sound/soc/soc-devres.c' line='102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_snd_soc_register_card'>
+        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-devres.c' line='102' column='1'/>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-devres.c' line='102' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_snd_soc_register_component' mangled-name='devm_snd_soc_register_component' filepath='include/sound/soc.h' line='435' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_snd_soc_register_component'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='f030c2b8'/>
-        <parameter type-id='763d26a2'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='devm_snd_soc_register_component' mangled-name='devm_snd_soc_register_component' filepath='sound/soc/soc-devres.c' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_snd_soc_register_component'>
+        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-devres.c' line='66' column='1'/>
+        <parameter type-id='f030c2b8' name='cmpnt_drv' filepath='sound/soc/soc-devres.c' line='67' column='1'/>
+        <parameter type-id='763d26a2' name='dai_drv' filepath='sound/soc/soc-devres.c' line='68' column='1'/>
+        <parameter type-id='95e97e5e' name='num_dai' filepath='sound/soc/soc-devres.c' line='68' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_spi_register_controller' mangled-name='devm_spi_register_controller' filepath='drivers/spi/spi.c' line='2828' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_spi_register_controller'>
@@ -119107,46 +118930,46 @@
         <parameter type-id='7bf5a5e5' name='wdd' filepath='drivers/watchdog/watchdog_core.c' line='382' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devres_add' mangled-name='devres_add' filepath='include/linux/device.h' line='190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_add'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='devres_add' mangled-name='devres_add' filepath='drivers/base/devres.c' line='245' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_add'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='245' column='1'/>
+        <parameter type-id='eaa32e2f' name='res' filepath='drivers/base/devres.c' line='245' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devres_alloc_node' mangled-name='devres_alloc_node' filepath='include/linux/device.h' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_alloc_node'>
-        <parameter type-id='680bf43c'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='devres_alloc_node' mangled-name='devres_alloc_node' filepath='drivers/base/devres.c' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_alloc_node'>
+        <parameter type-id='b6609e5b' name='release' filepath='drivers/base/devres.c' line='165' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='drivers/base/devres.c' line='165' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/base/devres.c' line='165' column='1'/>
+        <parameter type-id='95e97e5e' name='nid' filepath='drivers/base/devres.c' line='165' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='devres_destroy' mangled-name='devres_destroy' filepath='include/linux/device.h' line='197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_destroy'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='680bf43c'/>
-        <parameter type-id='7e69f315'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='devres_destroy' mangled-name='devres_destroy' filepath='drivers/base/devres.c' line='392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_destroy'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='392' column='1'/>
+        <parameter type-id='b6609e5b' name='release' filepath='drivers/base/devres.c' line='392' column='1'/>
+        <parameter type-id='4a798fcf' name='match' filepath='drivers/base/devres.c' line='393' column='1'/>
+        <parameter type-id='eaa32e2f' name='match_data' filepath='drivers/base/devres.c' line='393' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devres_free' mangled-name='devres_free' filepath='include/linux/device.h' line='189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_free'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='devres_free' mangled-name='devres_free' filepath='drivers/base/devres.c' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_free'>
+        <parameter type-id='eaa32e2f' name='res' filepath='drivers/base/devres.c' line='225' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devres_release' mangled-name='devres_release' filepath='include/linux/device.h' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_release'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='680bf43c'/>
-        <parameter type-id='7e69f315'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='devres_release' mangled-name='devres_release' filepath='drivers/base/devres.c' line='422' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devres_release'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/devres.c' line='422' column='1'/>
+        <parameter type-id='b6609e5b' name='release' filepath='drivers/base/devres.c' line='422' column='1'/>
+        <parameter type-id='4a798fcf' name='match' filepath='drivers/base/devres.c' line='423' column='1'/>
+        <parameter type-id='eaa32e2f' name='match_data' filepath='drivers/base/devres.c' line='423' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='disable_irq' mangled-name='disable_irq' filepath='kernel/irq/manage.c' line='622' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disable_irq'>
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='622' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disable_irq_nosync' mangled-name='disable_irq_nosync' filepath='include/linux/interrupt.h' line='235' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disable_irq_nosync'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='disable_irq_nosync' mangled-name='disable_irq_nosync' filepath='kernel/irq/manage.c' line='604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disable_irq_nosync'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='604' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='disable_percpu_irq' mangled-name='disable_percpu_irq' filepath='include/linux/interrupt.h' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disable_percpu_irq'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='disable_percpu_irq' mangled-name='disable_percpu_irq' filepath='kernel/irq/manage.c' line='2293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disable_percpu_irq'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2293' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='disk_end_io_acct' mangled-name='disk_end_io_acct' filepath='block/blk-core.c' line='1380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='disk_end_io_acct'>
@@ -119241,9 +119064,9 @@
         <parameter type-id='f0981eeb' name='len' filepath='drivers/dma-buf/dma-buf.c' line='1157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_detach' mangled-name='dma_buf_detach' filepath='include/linux/dma-buf.h' line='595' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_detach'>
-        <parameter type-id='5e4f599b'/>
-        <parameter type-id='e68e04c1'/>
+      <function-decl name='dma_buf_detach' mangled-name='dma_buf_detach' filepath='drivers/dma-buf/dma-buf.c' line='830' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_detach'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='830' column='1'/>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='830' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dma_buf_dynamic_attach' mangled-name='dma_buf_dynamic_attach' filepath='drivers/dma-buf/dma-buf.c' line='727' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_dynamic_attach'>
@@ -119265,17 +119088,17 @@
         <parameter type-id='f0981eeb' name='len' filepath='drivers/dma-buf/dma-buf.c' line='1207' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_export' mangled-name='dma_buf_export' filepath='include/linux/dma-buf.h' line='600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_export'>
-        <parameter type-id='aecb451e'/>
+      <function-decl name='dma_buf_export' mangled-name='dma_buf_export' filepath='drivers/dma-buf/dma-buf.c' line='545' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_export'>
+        <parameter type-id='aecb451e' name='exp_info' filepath='drivers/dma-buf/dma-buf.c' line='545' column='1'/>
         <return type-id='5e4f599b'/>
       </function-decl>
-      <function-decl name='dma_buf_fd' mangled-name='dma_buf_fd' filepath='include/linux/dma-buf.h' line='602' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_fd'>
-        <parameter type-id='5e4f599b'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='dma_buf_fd' mangled-name='dma_buf_fd' filepath='drivers/dma-buf/dma-buf.c' line='644' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_fd'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='644' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='drivers/dma-buf/dma-buf.c' line='644' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_get' mangled-name='dma_buf_get' filepath='include/linux/dma-buf.h' line='603' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_get'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='dma_buf_get' mangled-name='dma_buf_get' filepath='drivers/dma-buf/dma-buf.c' line='669' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_get'>
+        <parameter type-id='95e97e5e' name='fd' filepath='drivers/dma-buf/dma-buf.c' line='669' column='1'/>
         <return type-id='5e4f599b'/>
       </function-decl>
       <function-decl name='dma_buf_get_flags' mangled-name='dma_buf_get_flags' filepath='drivers/dma-buf/dma-buf.c' line='1348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_get_flags'>
@@ -119283,15 +119106,15 @@
         <parameter type-id='1d2c2b85' name='flags' filepath='drivers/dma-buf/dma-buf.c' line='1348' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_map_attachment' mangled-name='dma_buf_map_attachment' filepath='include/linux/dma-buf.h' line='606' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_map_attachment'>
-        <parameter type-id='e68e04c1'/>
-        <parameter type-id='eea6b025'/>
+      <function-decl name='dma_buf_map_attachment' mangled-name='dma_buf_map_attachment' filepath='drivers/dma-buf/dma-buf.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_map_attachment'>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='910' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='911' column='1'/>
         <return type-id='4adb0e6a'/>
       </function-decl>
-      <function-decl name='dma_buf_mmap' mangled-name='dma_buf_mmap' filepath='include/linux/dma-buf.h' line='622' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_mmap'>
-        <parameter type-id='5e4f599b'/>
-        <parameter type-id='2ae08426'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='dma_buf_mmap' mangled-name='dma_buf_mmap' filepath='drivers/dma-buf/dma-buf.c' line='1235' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_mmap'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1235' column='1'/>
+        <parameter type-id='2ae08426' name='vma' filepath='drivers/dma-buf/dma-buf.c' line='1235' column='1'/>
+        <parameter type-id='7359adad' name='pgoff' filepath='drivers/dma-buf/dma-buf.c' line='1236' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dma_buf_move_notify' mangled-name='dma_buf_move_notify' filepath='drivers/dma-buf/dma-buf.c' line='1006' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_move_notify'>
@@ -119302,34 +119125,34 @@
         <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='865' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_put' mangled-name='dma_buf_put' filepath='include/linux/dma-buf.h' line='604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_put'>
-        <parameter type-id='5e4f599b'/>
+      <function-decl name='dma_buf_put' mangled-name='dma_buf_put' filepath='drivers/dma-buf/dma-buf.c' line='697' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_put'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='697' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_unmap_attachment' mangled-name='dma_buf_unmap_attachment' filepath='include/linux/dma-buf.h' line='608' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_unmap_attachment'>
-        <parameter type-id='e68e04c1'/>
-        <parameter type-id='4adb0e6a'/>
-        <parameter type-id='eea6b025'/>
+      <function-decl name='dma_buf_unmap_attachment' mangled-name='dma_buf_unmap_attachment' filepath='drivers/dma-buf/dma-buf.c' line='972' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_unmap_attachment'>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='972' column='1'/>
+        <parameter type-id='4adb0e6a' name='sg_table' filepath='drivers/dma-buf/dma-buf.c' line='973' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='974' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dma_buf_unpin' mangled-name='dma_buf_unpin' filepath='drivers/dma-buf/dma-buf.c' line='884' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_unpin'>
         <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='884' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_vmap' mangled-name='dma_buf_vmap' filepath='include/linux/dma-buf.h' line='624' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vmap'>
-        <parameter type-id='5e4f599b'/>
+      <function-decl name='dma_buf_vmap' mangled-name='dma_buf_vmap' filepath='drivers/dma-buf/dma-buf.c' line='1289' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vmap'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1289' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='dma_buf_vunmap' mangled-name='dma_buf_vunmap' filepath='include/linux/dma-buf.h' line='625' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vunmap'>
-        <parameter type-id='5e4f599b'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='dma_buf_vunmap' mangled-name='dma_buf_vunmap' filepath='drivers/dma-buf/dma-buf.c' line='1329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vunmap'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1329' column='1'/>
+        <parameter type-id='eaa32e2f' name='vaddr' filepath='drivers/dma-buf/dma-buf.c' line='1329' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='dma_contiguous_default_area' type-id='6f67b38a' mangled-name='dma_contiguous_default_area' visibility='default' filepath='kernel/dma/contiguous.c' line='60' column='1' elf-symbol-id='dma_contiguous_default_area'/>
-      <function-decl name='dma_fence_add_callback' mangled-name='dma_fence_add_callback' filepath='include/linux/dma-fence.h' line='380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_add_callback'>
-        <parameter type-id='28271da3'/>
-        <parameter type-id='a47516e5'/>
-        <parameter type-id='75d065d2'/>
+      <function-decl name='dma_fence_add_callback' mangled-name='dma_fence_add_callback' filepath='drivers/dma-buf/dma-fence.c' line='612' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_add_callback'>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='612' column='1'/>
+        <parameter type-id='a47516e5' name='cb' filepath='drivers/dma-buf/dma-fence.c' line='612' column='1'/>
+        <parameter type-id='9c175524' name='func' filepath='drivers/dma-buf/dma-fence.c' line='613' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dma_fence_array_create' mangled-name='dma_fence_array_create' filepath='drivers/dma-buf/dma-fence-array.c' line='150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_array_create'>
@@ -119341,9 +119164,9 @@
         <return type-id='34135071'/>
       </function-decl>
       <var-decl name='dma_fence_array_ops' type-id='ee0fc87b' mangled-name='dma_fence_array_ops' visibility='default' filepath='drivers/dma-buf/dma-fence-array.c' line='122' column='1' elf-symbol-id='dma_fence_array_ops'/>
-      <function-decl name='dma_fence_context_alloc' mangled-name='dma_fence_context_alloc' filepath='include/linux/dma-fence.h' line='590' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_context_alloc'>
-        <parameter type-id='f0981eeb'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='dma_fence_context_alloc' mangled-name='dma_fence_context_alloc' filepath='drivers/dma-buf/dma-fence.c' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_context_alloc'>
+        <parameter type-id='f0981eeb' name='num' filepath='drivers/dma-buf/dma-fence.c' line='152' column='1'/>
+        <return type-id='91ce1af9'/>
       </function-decl>
       <function-decl name='dma_fence_default_wait' mangled-name='dma_fence_default_wait' filepath='drivers/dma-buf/dma-fence.c' line='730' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_default_wait'>
         <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='730' column='1'/>
@@ -119351,8 +119174,8 @@
         <parameter type-id='bd54fe1a' name='timeout' filepath='drivers/dma-buf/dma-fence.c' line='730' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='dma_fence_enable_sw_signaling' mangled-name='dma_fence_enable_sw_signaling' filepath='include/linux/dma-fence.h' line='385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_enable_sw_signaling'>
-        <parameter type-id='28271da3'/>
+      <function-decl name='dma_fence_enable_sw_signaling' mangled-name='dma_fence_enable_sw_signaling' filepath='drivers/dma-buf/dma-fence.c' line='574' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_enable_sw_signaling'>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='574' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dma_fence_free' mangled-name='dma_fence_free' filepath='drivers/dma-buf/dma-fence.c' line='536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_free'>
@@ -119363,15 +119186,15 @@
         <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='654' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_fence_get_stub' mangled-name='dma_fence_get_stub' filepath='include/linux/dma-fence.h' line='589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_get_stub'>
+      <function-decl name='dma_fence_get_stub' mangled-name='dma_fence_get_stub' filepath='drivers/dma-buf/dma-fence.c' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_get_stub'>
         <return type-id='28271da3'/>
       </function-decl>
-      <function-decl name='dma_fence_init' mangled-name='dma_fence_init' filepath='include/linux/dma-fence.h' line='266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_init'>
-        <parameter type-id='28271da3'/>
-        <parameter type-id='13d85783'/>
-        <parameter type-id='34e69a54'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='dma_fence_init' mangled-name='dma_fence_init' filepath='drivers/dma-buf/dma-fence.c' line='904' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_init'>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='904' column='1'/>
+        <parameter type-id='13d85783' name='ops' filepath='drivers/dma-buf/dma-fence.c' line='904' column='1'/>
+        <parameter type-id='cff2d845' name='lock' filepath='drivers/dma-buf/dma-fence.c' line='905' column='1'/>
+        <parameter type-id='91ce1af9' name='context' filepath='drivers/dma-buf/dma-fence.c' line='905' column='1'/>
+        <parameter type-id='91ce1af9' name='seqno' filepath='drivers/dma-buf/dma-fence.c' line='905' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dma_fence_match_context' mangled-name='dma_fence_match_context' filepath='drivers/dma-buf/dma-fence-array.c' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_match_context'>
@@ -119383,13 +119206,13 @@
         <parameter type-id='aa29ecab' name='kref' filepath='drivers/dma-buf/dma-fence.c' line='494' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_fence_remove_callback' mangled-name='dma_fence_remove_callback' filepath='include/linux/dma-fence.h' line='383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_remove_callback'>
-        <parameter type-id='28271da3'/>
-        <parameter type-id='a47516e5'/>
-        <return type-id='c894953d'/>
+      <function-decl name='dma_fence_remove_callback' mangled-name='dma_fence_remove_callback' filepath='drivers/dma-buf/dma-fence.c' line='686' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_remove_callback'>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='686' column='1'/>
+        <parameter type-id='a47516e5' name='cb' filepath='drivers/dma-buf/dma-fence.c' line='686' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='dma_fence_signal' mangled-name='dma_fence_signal' filepath='include/linux/dma-fence.h' line='373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_signal'>
-        <parameter type-id='28271da3'/>
+      <function-decl name='dma_fence_signal' mangled-name='dma_fence_signal' filepath='drivers/dma-buf/dma-fence.c' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_signal'>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='426' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='dma_fence_signal_locked' mangled-name='dma_fence_signal_locked' filepath='drivers/dma-buf/dma-fence.c' line='407' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_signal_locked'>
@@ -119409,10 +119232,10 @@
         <parameter type-id='90421557' name='idx' filepath='drivers/dma-buf/dma-fence.c' line='821' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='dma_fence_wait_timeout' mangled-name='dma_fence_wait_timeout' filepath='include/linux/dma-fence.h' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_wait_timeout'>
-        <parameter type-id='28271da3'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='dma_fence_wait_timeout' mangled-name='dma_fence_wait_timeout' filepath='drivers/dma-buf/dma-fence.c' line='466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_fence_wait_timeout'>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-fence.c' line='466' column='1'/>
+        <parameter type-id='b50a4934' name='intr' filepath='drivers/dma-buf/dma-fence.c' line='466' column='1'/>
+        <parameter type-id='bd54fe1a' name='timeout' filepath='drivers/dma-buf/dma-fence.c' line='466' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
       <function-decl name='dma_free_attrs' mangled-name='dma_free_attrs' filepath='kernel/dma/mapping.c' line='450' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_free_attrs'>
@@ -119562,46 +119385,46 @@
         <parameter type-id='80f4b756' name='name' filepath='drivers/dma/dmaengine.c' line='813' column='1'/>
         <return type-id='27f3f5d8'/>
       </function-decl>
-      <function-decl name='dma_resv_add_excl_fence' mangled-name='dma_resv_add_excl_fence' filepath='include/linux/dma-resv.h' line='279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_add_excl_fence'>
-        <parameter type-id='340cea9c'/>
-        <parameter type-id='28271da3'/>
+      <function-decl name='dma_resv_add_excl_fence' mangled-name='dma_resv_add_excl_fence' filepath='drivers/dma-buf/dma-resv.c' line='308' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_add_excl_fence'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='308' column='1'/>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-resv.c' line='308' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_resv_add_shared_fence' mangled-name='dma_resv_add_shared_fence' filepath='include/linux/dma-resv.h' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_add_shared_fence'>
-        <parameter type-id='340cea9c'/>
-        <parameter type-id='28271da3'/>
+      <function-decl name='dma_resv_add_shared_fence' mangled-name='dma_resv_add_shared_fence' filepath='drivers/dma-buf/dma-resv.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_add_shared_fence'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='263' column='1'/>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/dma-resv.c' line='263' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_resv_fini' mangled-name='dma_resv_fini' filepath='include/linux/dma-resv.h' line='275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_fini'>
-        <parameter type-id='340cea9c'/>
+      <function-decl name='dma_resv_fini' mangled-name='dma_resv_fini' filepath='drivers/dma-buf/dma-resv.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_fini'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='156' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_resv_get_fences_rcu' mangled-name='dma_resv_get_fences_rcu' filepath='include/linux/dma-resv.h' line='281' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_get_fences_rcu'>
-        <parameter type-id='340cea9c'/>
-        <parameter type-id='be937eab'/>
-        <parameter type-id='807869d3'/>
-        <parameter type-id='83302513'/>
+      <function-decl name='dma_resv_get_fences_rcu' mangled-name='dma_resv_get_fences_rcu' filepath='drivers/dma-buf/dma-resv.c' line='432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_get_fences_rcu'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='432' column='1'/>
+        <parameter type-id='be937eab' name='pfence_excl' filepath='drivers/dma-buf/dma-resv.c' line='433' column='1'/>
+        <parameter type-id='807869d3' name='pshared_count' filepath='drivers/dma-buf/dma-resv.c' line='434' column='1'/>
+        <parameter type-id='83302513' name='pshared' filepath='drivers/dma-buf/dma-resv.c' line='435' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_resv_init' mangled-name='dma_resv_init' filepath='include/linux/dma-resv.h' line='274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_init'>
-        <parameter type-id='340cea9c'/>
+      <function-decl name='dma_resv_init' mangled-name='dma_resv_init' filepath='drivers/dma-buf/dma-resv.c' line='142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_init'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='142' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_resv_reserve_shared' mangled-name='dma_resv_reserve_shared' filepath='include/linux/dma-resv.h' line='276' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_reserve_shared'>
-        <parameter type-id='340cea9c'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='dma_resv_reserve_shared' mangled-name='dma_resv_reserve_shared' filepath='drivers/dma-buf/dma-resv.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_reserve_shared'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='187' column='1'/>
+        <parameter type-id='f0981eeb' name='num_fences' filepath='drivers/dma-buf/dma-resv.c' line='187' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_resv_test_signaled_rcu' mangled-name='dma_resv_test_signaled_rcu' filepath='include/linux/dma-resv.h' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_test_signaled_rcu'>
-        <parameter type-id='340cea9c'/>
-        <parameter type-id='c894953d'/>
-        <return type-id='c894953d'/>
+      <function-decl name='dma_resv_test_signaled_rcu' mangled-name='dma_resv_test_signaled_rcu' filepath='drivers/dma-buf/dma-resv.c' line='634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_test_signaled_rcu'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='634' column='1'/>
+        <parameter type-id='b50a4934' name='test_all' filepath='drivers/dma-buf/dma-resv.c' line='634' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='dma_resv_wait_timeout_rcu' mangled-name='dma_resv_wait_timeout_rcu' filepath='include/linux/dma-resv.h' line='288' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_wait_timeout_rcu'>
-        <parameter type-id='340cea9c'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='dma_resv_wait_timeout_rcu' mangled-name='dma_resv_wait_timeout_rcu' filepath='drivers/dma-buf/dma-resv.c' line='532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_resv_wait_timeout_rcu'>
+        <parameter type-id='340cea9c' name='obj' filepath='drivers/dma-buf/dma-resv.c' line='532' column='1'/>
+        <parameter type-id='b50a4934' name='wait_all' filepath='drivers/dma-buf/dma-resv.c' line='533' column='1'/>
+        <parameter type-id='b50a4934' name='intr' filepath='drivers/dma-buf/dma-resv.c' line='533' column='1'/>
+        <parameter type-id='7359adad' name='timeout' filepath='drivers/dma-buf/dma-resv.c' line='534' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
       <function-decl name='dma_run_dependencies' mangled-name='dma_run_dependencies' filepath='drivers/dma/dmaengine.c' line='1612' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_run_dependencies'>
@@ -119734,8 +119557,8 @@
         <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_io.c' line='3042' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='do_exit' mangled-name='do_exit' filepath='include/linux/kernel.h' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='do_exit'>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='do_exit' mangled-name='do_exit' filepath='kernel/exit.c' line='715' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='do_exit'>
+        <parameter type-id='bd54fe1a' name='code' filepath='kernel/exit.c' line='715' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='do_trace_rcu_torture_read' mangled-name='do_trace_rcu_torture_read' filepath='kernel/rcu/update.c' line='467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='do_trace_rcu_torture_read'>
@@ -119768,16 +119591,16 @@
         <parameter type-id='a965a5b5' name='sem' filepath='kernel/locking/semaphore.c' line='101' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='down_read' mangled-name='down_read' filepath='include/linux/rwsem.h' line='141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_read'>
-        <parameter type-id='9b58df93'/>
+      <function-decl name='down_read' mangled-name='down_read' filepath='kernel/locking/rwsem.c' line='1511' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_read'>
+        <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1511' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='down_read_killable' mangled-name='down_read_killable' filepath='include/linux/rwsem.h' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_read_killable'>
-        <parameter type-id='9b58df93'/>
+      <function-decl name='down_read_killable' mangled-name='down_read_killable' filepath='kernel/locking/rwsem.c' line='1534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_read_killable'>
+        <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1534' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='down_read_trylock' mangled-name='down_read_trylock' filepath='include/linux/rwsem.h' line='148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_read_trylock'>
-        <parameter type-id='9b58df93'/>
+      <function-decl name='down_read_trylock' mangled-name='down_read_trylock' filepath='kernel/locking/rwsem.c' line='1551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_read_trylock'>
+        <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1551' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='down_timeout' mangled-name='down_timeout' filepath='kernel/locking/semaphore.c' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_timeout'>
@@ -119789,16 +119612,16 @@
         <parameter type-id='a965a5b5' name='sem' filepath='kernel/locking/semaphore.c' line='130' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='down_write' mangled-name='down_write' filepath='include/linux/rwsem.h' line='153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_write'>
-        <parameter type-id='9b58df93'/>
+      <function-decl name='down_write' mangled-name='down_write' filepath='kernel/locking/rwsem.c' line='1564' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_write'>
+        <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1564' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='downgrade_write' mangled-name='downgrade_write' filepath='kernel/locking/rwsem.c' line='1628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='downgrade_write'>
         <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1628' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dput' mangled-name='dput' filepath='include/linux/dcache.h' line='383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dput'>
-        <parameter type-id='27675065'/>
+      <function-decl name='dput' mangled-name='dput' filepath='fs/dcache.c' line='859' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dput'>
+        <parameter type-id='27675065' name='dentry' filepath='fs/dcache.c' line='859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dql_completed' mangled-name='dql_completed' filepath='lib/dynamic_queue_limits.c' line='18' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dql_completed'>
@@ -119814,9 +119637,9 @@
         <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2950' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='driver_create_file' mangled-name='driver_create_file' filepath='include/linux/device/driver.h' line='153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_create_file'>
-        <parameter type-id='00c7b870'/>
-        <parameter type-id='1a5996d5'/>
+      <function-decl name='driver_create_file' mangled-name='driver_create_file' filepath='drivers/base/driver.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_create_file'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='101' column='1'/>
+        <parameter type-id='1a5996d5' name='attr' filepath='drivers/base/driver.c' line='102' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='driver_find_device' mangled-name='driver_find_device' filepath='drivers/base/driver.c' line='76' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_find_device'>
@@ -119826,62 +119649,62 @@
         <parameter type-id='92d15ae9' name='match' filepath='drivers/base/driver.c' line='78' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='driver_register' mangled-name='driver_register' filepath='include/linux/device/driver.h' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_register'>
-        <parameter type-id='00c7b870'/>
+      <function-decl name='driver_register' mangled-name='driver_register' filepath='drivers/base/driver.c' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_register'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='147' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='driver_remove_file' mangled-name='driver_remove_file' filepath='include/linux/device/driver.h' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_remove_file'>
-        <parameter type-id='00c7b870'/>
-        <parameter type-id='1a5996d5'/>
+      <function-decl name='driver_remove_file' mangled-name='driver_remove_file' filepath='drivers/base/driver.c' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_remove_file'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='119' column='1'/>
+        <parameter type-id='1a5996d5' name='attr' filepath='drivers/base/driver.c' line='120' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='driver_unregister' mangled-name='driver_unregister' filepath='include/linux/device/driver.h' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_unregister'>
-        <parameter type-id='00c7b870'/>
+      <function-decl name='driver_unregister' mangled-name='driver_unregister' filepath='drivers/base/driver.c' line='191' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_unregister'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='191' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_add_edid_modes' mangled-name='drm_add_edid_modes' filepath='include/drm/drm_edid.h' line='491' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_add_edid_modes'>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='c91d1bf1'/>
+      <function-decl name='drm_add_edid_modes' mangled-name='drm_add_edid_modes' filepath='drivers/gpu/drm/drm_edid.c' line='5318' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_add_edid_modes'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_edid.c' line='5318' column='1'/>
+        <parameter type-id='c91d1bf1' name='edid' filepath='drivers/gpu/drm/drm_edid.c' line='5318' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_add_modes_noedid' mangled-name='drm_add_modes_noedid' filepath='include/drm/drm_edid.h' line='499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_add_modes_noedid'>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_add_modes_noedid' mangled-name='drm_add_modes_noedid' filepath='drivers/gpu/drm/drm_edid.c' line='5397' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_add_modes_noedid'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_edid.c' line='5397' column='1'/>
+        <parameter type-id='95e97e5e' name='hdisplay' filepath='drivers/gpu/drm/drm_edid.c' line='5398' column='1'/>
+        <parameter type-id='95e97e5e' name='vdisplay' filepath='drivers/gpu/drm/drm_edid.c' line='5398' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_add_affected_connectors' mangled-name='drm_atomic_add_affected_connectors' filepath='include/drm/drm_atomic.h' line='676' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_connectors'>
-        <parameter type-id='e3dd029e'/>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_atomic_add_affected_connectors' mangled-name='drm_atomic_add_affected_connectors' filepath='drivers/gpu/drm/drm_atomic.c' line='1156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_connectors'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1156' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='1157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_add_affected_planes' mangled-name='drm_atomic_add_affected_planes' filepath='include/drm/drm_atomic.h' line='679' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_planes'>
-        <parameter type-id='e3dd029e'/>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_atomic_add_affected_planes' mangled-name='drm_atomic_add_affected_planes' filepath='drivers/gpu/drm/drm_atomic.c' line='1219' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_add_affected_planes'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1219' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='1220' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_bridge_chain_enable' mangled-name='drm_atomic_bridge_chain_enable' filepath='include/drm/drm_bridge.h' line='860' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_bridge_chain_enable'>
-        <parameter type-id='8582e5ec'/>
-        <parameter type-id='e3dd029e'/>
+      <function-decl name='drm_atomic_bridge_chain_enable' mangled-name='drm_atomic_bridge_chain_enable' filepath='drivers/gpu/drm/drm_bridge.c' line='697' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_bridge_chain_enable'>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_bridge.c' line='697' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_bridge.c' line='698' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_bridge_chain_pre_enable' mangled-name='drm_atomic_bridge_chain_pre_enable' filepath='include/drm/drm_bridge.h' line='858' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_bridge_chain_pre_enable'>
-        <parameter type-id='8582e5ec'/>
-        <parameter type-id='e3dd029e'/>
+      <function-decl name='drm_atomic_bridge_chain_pre_enable' mangled-name='drm_atomic_bridge_chain_pre_enable' filepath='drivers/gpu/drm/drm_bridge.c' line='654' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_bridge_chain_pre_enable'>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_bridge.c' line='654' column='1'/>
+        <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_bridge.c' line='655' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_commit' mangled-name='drm_atomic_commit' filepath='include/drm/drm_atomic.h' line='683' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_commit'>
-        <parameter type-id='e3dd029e'/>
+      <function-decl name='drm_atomic_commit' mangled-name='drm_atomic_commit' filepath='drivers/gpu/drm/drm_atomic.c' line='1334' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_commit'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1334' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_connector_state' mangled-name='drm_atomic_get_connector_state' filepath='include/drm/drm_atomic.h' line='452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_connector_state'>
-        <parameter type-id='e3dd029e'/>
-        <parameter type-id='4db02c58'/>
+      <function-decl name='drm_atomic_get_connector_state' mangled-name='drm_atomic_get_connector_state' filepath='drivers/gpu/drm/drm_atomic.c' line='944' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_connector_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='944' column='1'/>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_atomic.c' line='945' column='1'/>
         <return type-id='249ef586'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_crtc_state' mangled-name='drm_atomic_get_crtc_state' filepath='include/drm/drm_atomic.h' line='446' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_crtc_state'>
-        <parameter type-id='e3dd029e'/>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_atomic_get_crtc_state' mangled-name='drm_atomic_get_crtc_state' filepath='drivers/gpu/drm/drm_atomic.c' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_crtc_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='291' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic.c' line='292' column='1'/>
         <return type-id='35078cb9'/>
       </function-decl>
       <function-decl name='drm_atomic_get_new_bridge_state' mangled-name='drm_atomic_get_new_bridge_state' filepath='drivers/gpu/drm/drm_atomic.c' line='1082' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_new_bridge_state'>
@@ -119899,14 +119722,14 @@
         <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_atomic.c' line='879' column='1'/>
         <return type-id='4db02c58'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_plane_state' mangled-name='drm_atomic_get_plane_state' filepath='include/drm/drm_atomic.h' line='449' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_plane_state'>
-        <parameter type-id='e3dd029e'/>
-        <parameter type-id='a6711537'/>
+      <function-decl name='drm_atomic_get_plane_state' mangled-name='drm_atomic_get_plane_state' filepath='drivers/gpu/drm/drm_atomic.c' line='464' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_plane_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='464' column='1'/>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic.c' line='465' column='1'/>
         <return type-id='d0835005'/>
       </function-decl>
-      <function-decl name='drm_atomic_get_private_obj_state' mangled-name='drm_atomic_get_private_obj_state' filepath='include/drm/drm_atomic.h' line='462' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_private_obj_state'>
-        <parameter type-id='e3dd029e'/>
-        <parameter type-id='11c98e9a'/>
+      <function-decl name='drm_atomic_get_private_obj_state' mangled-name='drm_atomic_get_private_obj_state' filepath='drivers/gpu/drm/drm_atomic.c' line='770' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_get_private_obj_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='770' column='1'/>
+        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='771' column='1'/>
         <return type-id='4ea020ae'/>
       </function-decl>
       <function-decl name='drm_atomic_helper_bridge_destroy_state' mangled-name='drm_atomic_helper_bridge_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_bridge_destroy_state'>
@@ -119941,13 +119764,13 @@
         <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='606' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_helper_check_plane_state' mangled-name='drm_atomic_helper_check_plane_state' filepath='include/drm/drm_atomic_helper.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_check_plane_state'>
-        <parameter type-id='d0835005'/>
-        <parameter type-id='c9982f26'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='drm_atomic_helper_check_plane_state' mangled-name='drm_atomic_helper_check_plane_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='790' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_check_plane_state'>
+        <parameter type-id='d0835005' name='plane_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='790' column='1'/>
+        <parameter type-id='c9982f26' name='crtc_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='791' column='1'/>
+        <parameter type-id='95e97e5e' name='min_scale' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='792' column='1'/>
+        <parameter type-id='95e97e5e' name='max_scale' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='793' column='1'/>
+        <parameter type-id='b50a4934' name='can_position' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='794' column='1'/>
+        <parameter type-id='b50a4934' name='can_update_disabled' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='795' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_atomic_helper_check_planes' mangled-name='drm_atomic_helper_check_planes' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_helper_check_planes'>
@@ -120171,62 +119994,62 @@
         <parameter type-id='e3dd029e' name='old_state' filepath='drivers/gpu/drm/drm_atomic_helper.c' line='1477' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_nonblocking_commit' mangled-name='drm_atomic_nonblocking_commit' filepath='include/drm/drm_atomic.h' line='684' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_nonblocking_commit'>
-        <parameter type-id='e3dd029e'/>
+      <function-decl name='drm_atomic_nonblocking_commit' mangled-name='drm_atomic_nonblocking_commit' filepath='drivers/gpu/drm/drm_atomic.c' line='1363' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_nonblocking_commit'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='1363' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_normalize_zpos' mangled-name='drm_atomic_normalize_zpos' filepath='include/drm/drm_blend.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_normalize_zpos'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='e3dd029e'/>
+      <function-decl name='drm_atomic_normalize_zpos' mangled-name='drm_atomic_normalize_zpos' filepath='drivers/gpu/drm/drm_blend.c' line='504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_normalize_zpos'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_blend.c' line='504' column='1'/>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_blend.c' line='505' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_private_obj_fini' mangled-name='drm_atomic_private_obj_fini' filepath='include/drm/drm_atomic.h' line='459' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_fini'>
-        <parameter type-id='11c98e9a'/>
+      <function-decl name='drm_atomic_private_obj_fini' mangled-name='drm_atomic_private_obj_fini' filepath='drivers/gpu/drm/drm_atomic.c' line='748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_fini'>
+        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='748' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_private_obj_init' mangled-name='drm_atomic_private_obj_init' filepath='include/drm/drm_atomic.h' line='455' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_init'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='11c98e9a'/>
-        <parameter type-id='4ea020ae'/>
-        <parameter type-id='515fa1af'/>
+      <function-decl name='drm_atomic_private_obj_init' mangled-name='drm_atomic_private_obj_init' filepath='drivers/gpu/drm/drm_atomic.c' line='726' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_private_obj_init'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='726' column='1'/>
+        <parameter type-id='11c98e9a' name='obj' filepath='drivers/gpu/drm/drm_atomic.c' line='727' column='1'/>
+        <parameter type-id='4ea020ae' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='728' column='1'/>
+        <parameter type-id='515fa1af' name='funcs' filepath='drivers/gpu/drm/drm_atomic.c' line='729' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_set_crtc_for_connector' mangled-name='drm_atomic_set_crtc_for_connector' filepath='include/drm/drm_atomic_uapi.h' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_crtc_for_connector'>
-        <parameter type-id='249ef586'/>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_atomic_set_crtc_for_connector' mangled-name='drm_atomic_set_crtc_for_connector' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_crtc_for_connector'>
+        <parameter type-id='249ef586' name='conn_state' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='296' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='297' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_set_crtc_for_plane' mangled-name='drm_atomic_set_crtc_for_plane' filepath='include/drm/drm_atomic_uapi.h' line='48' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_crtc_for_plane'>
-        <parameter type-id='d0835005'/>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_atomic_set_crtc_for_plane' mangled-name='drm_atomic_set_crtc_for_plane' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_crtc_for_plane'>
+        <parameter type-id='d0835005' name='plane_state' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='177' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='178' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_set_fb_for_plane' mangled-name='drm_atomic_set_fb_for_plane' filepath='include/drm/drm_atomic_uapi.h' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_fb_for_plane'>
-        <parameter type-id='d0835005'/>
-        <parameter type-id='7b332e1c'/>
+      <function-decl name='drm_atomic_set_fb_for_plane' mangled-name='drm_atomic_set_fb_for_plane' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='227' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_fb_for_plane'>
+        <parameter type-id='d0835005' name='plane_state' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='227' column='1'/>
+        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='228' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_set_fence_for_plane' mangled-name='drm_atomic_set_fence_for_plane' filepath='include/drm/drm_atomic_uapi.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_fence_for_plane'>
-        <parameter type-id='d0835005'/>
-        <parameter type-id='28271da3'/>
+      <function-decl name='drm_atomic_set_fence_for_plane' mangled-name='drm_atomic_set_fence_for_plane' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_fence_for_plane'>
+        <parameter type-id='d0835005' name='plane_state' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='269' column='1'/>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='270' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_atomic_set_mode_for_crtc' mangled-name='drm_atomic_set_mode_for_crtc' filepath='include/drm/drm_atomic_uapi.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_mode_for_crtc'>
-        <parameter type-id='35078cb9'/>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_atomic_set_mode_for_crtc' mangled-name='drm_atomic_set_mode_for_crtc' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_mode_for_crtc'>
+        <parameter type-id='35078cb9' name='state' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='64' column='1'/>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='65' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_set_mode_prop_for_crtc' mangled-name='drm_atomic_set_mode_prop_for_crtc' filepath='include/drm/drm_atomic_uapi.h' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_mode_prop_for_crtc'>
-        <parameter type-id='35078cb9'/>
-        <parameter type-id='c4126d52'/>
+      <function-decl name='drm_atomic_set_mode_prop_for_crtc' mangled-name='drm_atomic_set_mode_prop_for_crtc' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_set_mode_prop_for_crtc'>
+        <parameter type-id='35078cb9' name='state' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='114' column='1'/>
+        <parameter type-id='c4126d52' name='blob' filepath='drivers/gpu/drm/drm_atomic_uapi.c' line='115' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_atomic_state_alloc' mangled-name='drm_atomic_state_alloc' filepath='include/drm/drm_atomic.h' line='410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_alloc'>
-        <parameter type-id='8898134d'/>
+      <function-decl name='drm_atomic_state_alloc' mangled-name='drm_atomic_state_alloc' filepath='drivers/gpu/drm/drm_atomic.c' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_alloc'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_atomic.c' line='119' column='1'/>
         <return type-id='e3dd029e'/>
       </function-decl>
-      <function-decl name='drm_atomic_state_clear' mangled-name='drm_atomic_state_clear' filepath='include/drm/drm_atomic.h' line='411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_clear'>
-        <parameter type-id='e3dd029e'/>
+      <function-decl name='drm_atomic_state_clear' mangled-name='drm_atomic_state_clear' filepath='drivers/gpu/drm/drm_atomic.c' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_clear'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='238' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_atomic_state_default_clear' mangled-name='drm_atomic_state_default_clear' filepath='drivers/gpu/drm/drm_atomic.c' line='148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_atomic_state_default_clear'>
@@ -120242,15 +120065,15 @@
         <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_atomic.c' line='83' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_bridge_add' mangled-name='drm_bridge_add' filepath='include/drm/drm_bridge.h' line='771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_add'>
-        <parameter type-id='8582e5ec'/>
+      <function-decl name='drm_bridge_add' mangled-name='drm_bridge_add' filepath='drivers/gpu/drm/drm_bridge.c' line='102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_add'>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_bridge.c' line='102' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_bridge_attach' mangled-name='drm_bridge_attach' filepath='include/drm/drm_bridge.h' line='774' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_attach'>
-        <parameter type-id='74d89ebd'/>
-        <parameter type-id='8582e5ec'/>
-        <parameter type-id='8582e5ec'/>
-        <parameter type-id='6a662de1'/>
+      <function-decl name='drm_bridge_attach' mangled-name='drm_bridge_attach' filepath='drivers/gpu/drm/drm_bridge.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_attach'>
+        <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_bridge.c' line='175' column='1'/>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_bridge.c' line='175' column='1'/>
+        <parameter type-id='8582e5ec' name='previous' filepath='drivers/gpu/drm/drm_bridge.c' line='176' column='1'/>
+        <parameter type-id='6a662de1' name='flags' filepath='drivers/gpu/drm/drm_bridge.c' line='177' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_bridge_chain_disable' mangled-name='drm_bridge_chain_disable' filepath='drivers/gpu/drm/drm_bridge.c' line='428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_chain_disable'>
@@ -120261,10 +120084,10 @@
         <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_bridge.c' line='542' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_bridge_chain_mode_set' mangled-name='drm_bridge_chain_mode_set' filepath='include/drm/drm_bridge.h' line='845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_chain_mode_set'>
-        <parameter type-id='8582e5ec'/>
-        <parameter type-id='745b39e8'/>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_bridge_chain_mode_set' mangled-name='drm_bridge_chain_mode_set' filepath='drivers/gpu/drm/drm_bridge.c' line='485' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_chain_mode_set'>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_bridge.c' line='485' column='1'/>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_bridge.c' line='486' column='1'/>
+        <parameter type-id='745b39e8' name='adjusted_mode' filepath='drivers/gpu/drm/drm_bridge.c' line='487' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_bridge_chain_post_disable' mangled-name='drm_bridge_chain_post_disable' filepath='drivers/gpu/drm/drm_bridge.c' line='458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_chain_post_disable'>
@@ -120293,8 +120116,8 @@
         <parameter type-id='f7b0e1b4' name='status' filepath='drivers/gpu/drm/drm_bridge.c' line='1190' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_bridge_remove' mangled-name='drm_bridge_remove' filepath='include/drm/drm_bridge.h' line='772' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_remove'>
-        <parameter type-id='8582e5ec'/>
+      <function-decl name='drm_bridge_remove' mangled-name='drm_bridge_remove' filepath='drivers/gpu/drm/drm_bridge.c' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bridge_remove'>
+        <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/drm_bridge.c' line='117' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_bus_flags_from_videomode' mangled-name='drm_bus_flags_from_videomode' filepath='drivers/gpu/drm/drm_modes.c' line='673' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_bus_flags_from_videomode'>
@@ -120302,9 +120125,9 @@
         <parameter type-id='f9409001' name='bus_flags' filepath='drivers/gpu/drm/drm_modes.c' line='673' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_calc_timestamping_constants' mangled-name='drm_calc_timestamping_constants' filepath='include/drm/drm_vblank.h' line='253' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_calc_timestamping_constants'>
-        <parameter type-id='b64ad7cb'/>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_calc_timestamping_constants' mangled-name='drm_calc_timestamping_constants' filepath='drivers/gpu/drm/drm_vblank.c' line='602' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_calc_timestamping_constants'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='602' column='1'/>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_vblank.c' line='603' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_client_init' mangled-name='drm_client_init' filepath='drivers/gpu/drm/drm_client.c' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_client_init'>
@@ -120341,9 +120164,9 @@
         <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='367' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_connector_attach_encoder' mangled-name='drm_connector_attach_encoder' filepath='include/drm/drm_connector.h' line='1525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_attach_encoder'>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='74d89ebd'/>
+      <function-decl name='drm_connector_attach_encoder' mangled-name='drm_connector_attach_encoder' filepath='drivers/gpu/drm/drm_connector.c' line='389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_attach_encoder'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='389' column='1'/>
+        <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_connector.c' line='390' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_connector_attach_max_bpc_property' mangled-name='drm_connector_attach_max_bpc_property' filepath='drivers/gpu/drm/drm_connector.c' line='2123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_attach_max_bpc_property'>
@@ -120352,8 +120175,8 @@
         <parameter type-id='95e97e5e' name='max' filepath='drivers/gpu/drm/drm_connector.c' line='2124' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_connector_cleanup' mangled-name='drm_connector_cleanup' filepath='include/drm/drm_connector.h' line='1528' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_cleanup'>
-        <parameter type-id='4db02c58'/>
+      <function-decl name='drm_connector_cleanup' mangled-name='drm_connector_cleanup' filepath='drivers/gpu/drm/drm_connector.c' line='441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_cleanup'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='441' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_connector_has_possible_encoder' mangled-name='drm_connector_has_possible_encoder' filepath='drivers/gpu/drm/drm_connector.c' line='421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_has_possible_encoder'>
@@ -120361,19 +120184,19 @@
         <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_connector.c' line='422' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_connector_init' mangled-name='drm_connector_init' filepath='include/drm/drm_connector.h' line='1513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_init'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='3fb29739'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_connector_init' mangled-name='drm_connector_init' filepath='drivers/gpu/drm/drm_connector.c' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_init'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_connector.c' line='217' column='1'/>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='218' column='1'/>
+        <parameter type-id='3fb29739' name='funcs' filepath='drivers/gpu/drm/drm_connector.c' line='219' column='1'/>
+        <parameter type-id='95e97e5e' name='connector_type' filepath='drivers/gpu/drm/drm_connector.c' line='220' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_connector_init_with_ddc' mangled-name='drm_connector_init_with_ddc' filepath='include/drm/drm_connector.h' line='1517' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_init_with_ddc'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='3fb29739'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='b9af02c3'/>
+      <function-decl name='drm_connector_init_with_ddc' mangled-name='drm_connector_init_with_ddc' filepath='drivers/gpu/drm/drm_connector.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_init_with_ddc'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_connector.c' line='340' column='1'/>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='341' column='1'/>
+        <parameter type-id='3fb29739' name='funcs' filepath='drivers/gpu/drm/drm_connector.c' line='342' column='1'/>
+        <parameter type-id='95e97e5e' name='connector_type' filepath='drivers/gpu/drm/drm_connector.c' line='343' column='1'/>
+        <parameter type-id='b9af02c3' name='ddc' filepath='drivers/gpu/drm/drm_connector.c' line='344' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_connector_list_iter_begin' mangled-name='drm_connector_list_iter_begin' filepath='drivers/gpu/drm/drm_connector.c' line='657' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_list_iter_begin'>
@@ -120381,16 +120204,16 @@
         <parameter type-id='40a902ec' name='iter' filepath='drivers/gpu/drm/drm_connector.c' line='658' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_connector_list_iter_end' mangled-name='drm_connector_list_iter_end' filepath='include/drm/drm_connector.h' line='1696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_list_iter_end'>
-        <parameter type-id='40a902ec'/>
+      <function-decl name='drm_connector_list_iter_end' mangled-name='drm_connector_list_iter_end' filepath='drivers/gpu/drm/drm_connector.c' line='732' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_list_iter_end'>
+        <parameter type-id='40a902ec' name='iter' filepath='drivers/gpu/drm/drm_connector.c' line='732' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_connector_list_iter_next' mangled-name='drm_connector_list_iter_next' filepath='include/drm/drm_connector.h' line='1695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_list_iter_next'>
-        <parameter type-id='40a902ec'/>
+      <function-decl name='drm_connector_list_iter_next' mangled-name='drm_connector_list_iter_next' filepath='drivers/gpu/drm/drm_connector.c' line='693' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_list_iter_next'>
+        <parameter type-id='40a902ec' name='iter' filepath='drivers/gpu/drm/drm_connector.c' line='693' column='1'/>
         <return type-id='4db02c58'/>
       </function-decl>
-      <function-decl name='drm_connector_register' mangled-name='drm_connector_register' filepath='include/drm/drm_connector.h' line='1523' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_register'>
-        <parameter type-id='4db02c58'/>
+      <function-decl name='drm_connector_register' mangled-name='drm_connector_register' filepath='drivers/gpu/drm/drm_connector.c' line='502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_register'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='502' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_connector_set_panel_orientation' mangled-name='drm_connector_set_panel_orientation' filepath='drivers/gpu/drm/drm_connector.c' line='2182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_set_panel_orientation'>
@@ -120403,17 +120226,17 @@
         <parameter type-id='80f4b756' name='path' filepath='drivers/gpu/drm/drm_connector.c' line='1948' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_connector_set_tile_property' mangled-name='drm_connector_set_tile_property' filepath='include/drm/drm_connector.h' line='1636' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_set_tile_property'>
-        <parameter type-id='4db02c58'/>
+      <function-decl name='drm_connector_set_tile_property' mangled-name='drm_connector_set_tile_property' filepath='drivers/gpu/drm/drm_connector.c' line='1976' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_set_tile_property'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='1976' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_connector_unregister' mangled-name='drm_connector_unregister' filepath='include/drm/drm_connector.h' line='1524' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_unregister'>
-        <parameter type-id='4db02c58'/>
+      <function-decl name='drm_connector_unregister' mangled-name='drm_connector_unregister' filepath='drivers/gpu/drm/drm_connector.c' line='552' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_unregister'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='552' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_connector_update_edid_property' mangled-name='drm_connector_update_edid_property' filepath='include/drm/drm_connector.h' line='1637' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_update_edid_property'>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='776adf76'/>
+      <function-decl name='drm_connector_update_edid_property' mangled-name='drm_connector_update_edid_property' filepath='drivers/gpu/drm/drm_connector.c' line='2022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_update_edid_property'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='2022' column='1'/>
+        <parameter type-id='776adf76' name='edid' filepath='drivers/gpu/drm/drm_connector.c' line='2023' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_crtc_arm_vblank_event' mangled-name='drm_crtc_arm_vblank_event' filepath='drivers/gpu/drm/drm_vblank.c' line='1051' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_arm_vblank_event'>
@@ -120460,19 +120283,19 @@
         <parameter type-id='7236c5c8' name='funcs' filepath='drivers/gpu/drm/drm_modeset_helper.c' line='170' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_crtc_init_with_planes' mangled-name='drm_crtc_init_with_planes' filepath='include/drm/drm_crtc.h' line='1205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_init_with_planes'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='b64ad7cb'/>
-        <parameter type-id='a6711537'/>
-        <parameter type-id='a6711537'/>
-        <parameter type-id='7236c5c8'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_crtc_init_with_planes' mangled-name='drm_crtc_init_with_planes' filepath='drivers/gpu/drm/drm_crtc.c' line='253' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_init_with_planes'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_crtc.c' line='253' column='1'/>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_crtc.c' line='253' column='1'/>
+        <parameter type-id='a6711537' name='primary' filepath='drivers/gpu/drm/drm_crtc.c' line='254' column='1'/>
+        <parameter type-id='a6711537' name='cursor' filepath='drivers/gpu/drm/drm_crtc.c' line='255' column='1'/>
+        <parameter type-id='7236c5c8' name='funcs' filepath='drivers/gpu/drm/drm_crtc.c' line='256' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_crtc.c' line='257' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_crtc_send_vblank_event' mangled-name='drm_crtc_send_vblank_event' filepath='include/drm/drm_vblank.h' line='233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_send_vblank_event'>
-        <parameter type-id='b64ad7cb'/>
-        <parameter type-id='6301fad2'/>
+      <function-decl name='drm_crtc_send_vblank_event' mangled-name='drm_crtc_send_vblank_event' filepath='drivers/gpu/drm/drm_vblank.c' line='1076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_send_vblank_event'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='1076' column='1'/>
+        <parameter type-id='6301fad2' name='e' filepath='drivers/gpu/drm/drm_vblank.c' line='1077' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_crtc_set_max_vblank_count' mangled-name='drm_crtc_set_max_vblank_count' filepath='drivers/gpu/drm/drm_vblank.c' line='1409' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_set_max_vblank_count'>
@@ -120480,17 +120303,17 @@
         <parameter type-id='19c2251e' name='max_vblank_count' filepath='drivers/gpu/drm/drm_vblank.c' line='1410' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_crtc_vblank_count' mangled-name='drm_crtc_vblank_count' filepath='include/drm/drm_vblank.h' line='230' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_count'>
-        <parameter type-id='b64ad7cb'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='drm_crtc_vblank_count' mangled-name='drm_crtc_vblank_count' filepath='drivers/gpu/drm/drm_vblank.c' line='909' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_count'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='909' column='1'/>
+        <return type-id='91ce1af9'/>
       </function-decl>
       <function-decl name='drm_crtc_vblank_count_and_time' mangled-name='drm_crtc_vblank_count_and_time' filepath='drivers/gpu/drm/drm_vblank.c' line='969' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_count_and_time'>
         <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='969' column='1'/>
         <parameter type-id='44372936' name='vblanktime' filepath='drivers/gpu/drm/drm_vblank.c' line='970' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='drm_crtc_vblank_get' mangled-name='drm_crtc_vblank_get' filepath='include/drm/drm_vblank.h' line='242' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_get'>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_crtc_vblank_get' mangled-name='drm_crtc_vblank_get' filepath='drivers/gpu/drm/drm_vblank.c' line='1188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_get'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='1188' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_crtc_vblank_helper_get_vblank_timestamp' mangled-name='drm_crtc_vblank_helper_get_vblank_timestamp' filepath='drivers/gpu/drm/drm_vblank.c' line='829' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_helper_get_vblank_timestamp'>
@@ -120508,20 +120331,20 @@
         <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='1433' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_crtc_vblank_put' mangled-name='drm_crtc_vblank_put' filepath='include/drm/drm_vblank.h' line='243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_put'>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_crtc_vblank_put' mangled-name='drm_crtc_vblank_put' filepath='drivers/gpu/drm/drm_vblank.c' line='1223' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_put'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='1223' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_crtc_vblank_reset' mangled-name='drm_crtc_vblank_reset' filepath='include/drm/drm_vblank.h' line='247' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_reset'>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_crtc_vblank_reset' mangled-name='drm_crtc_vblank_reset' filepath='drivers/gpu/drm/drm_vblank.c' line='1370' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_reset'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='1370' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_crtc_vblank_waitqueue' mangled-name='drm_crtc_vblank_waitqueue' filepath='drivers/gpu/drm/drm_vblank.c' line='584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_vblank_waitqueue'>
         <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='584' column='1'/>
         <return type-id='03d48e96'/>
       </function-decl>
-      <function-decl name='drm_crtc_wait_one_vblank' mangled-name='drm_crtc_wait_one_vblank' filepath='include/drm/drm_vblank.h' line='245' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_wait_one_vblank'>
-        <parameter type-id='b64ad7cb'/>
+      <function-decl name='drm_crtc_wait_one_vblank' mangled-name='drm_crtc_wait_one_vblank' filepath='drivers/gpu/drm/drm_vblank.c' line='1274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_crtc_wait_one_vblank'>
+        <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_vblank.c' line='1274' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_cvt_mode' mangled-name='drm_cvt_mode' filepath='drivers/gpu/drm/drm_modes.c' line='140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_cvt_mode'>
@@ -120534,11 +120357,11 @@
         <parameter type-id='b50a4934' name='margins' filepath='drivers/gpu/drm/drm_modes.c' line='142' column='1'/>
         <return type-id='11e02f83'/>
       </function-decl>
-      <function-decl name='drm_debugfs_create_files' mangled-name='drm_debugfs_create_files' filepath='include/drm/drm_debugfs.h' line='83' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_debugfs_create_files'>
-        <parameter type-id='09894807'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='27675065'/>
-        <parameter type-id='6c3b3f8e'/>
+      <function-decl name='drm_debugfs_create_files' mangled-name='drm_debugfs_create_files' filepath='drivers/gpu/drm/drm_debugfs.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_debugfs_create_files'>
+        <parameter type-id='09894807' name='files' filepath='drivers/gpu/drm/drm_debugfs.c' line='175' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='drivers/gpu/drm/drm_debugfs.c' line='175' column='1'/>
+        <parameter type-id='27675065' name='root' filepath='drivers/gpu/drm/drm_debugfs.c' line='176' column='1'/>
+        <parameter type-id='6c3b3f8e' name='minor' filepath='drivers/gpu/drm/drm_debugfs.c' line='176' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_default_rgb_quant_range' mangled-name='drm_default_rgb_quant_range' filepath='drivers/gpu/drm/drm_edid.c' line='4835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_default_rgb_quant_range'>
@@ -120549,33 +120372,33 @@
         <parameter type-id='c91d1bf1' name='edid' filepath='drivers/gpu/drm/drm_edid.c' line='4751' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_detect_monitor_audio' mangled-name='drm_detect_monitor_audio' filepath='include/drm/drm_edid.h' line='496' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_detect_monitor_audio'>
-        <parameter type-id='c91d1bf1'/>
-        <return type-id='c894953d'/>
+      <function-decl name='drm_detect_monitor_audio' mangled-name='drm_detect_monitor_audio' filepath='drivers/gpu/drm/drm_edid.c' line='4789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_detect_monitor_audio'>
+        <parameter type-id='c91d1bf1' name='edid' filepath='drivers/gpu/drm/drm_edid.c' line='4789' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='drm_dev_alloc' mangled-name='drm_dev_alloc' filepath='drivers/gpu/drm/drm_drv.c' line='716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_alloc'>
         <parameter type-id='1d52bc4d' name='driver' filepath='drivers/gpu/drm/drm_drv.c' line='716' column='1'/>
         <parameter type-id='fa0b179b' name='parent' filepath='drivers/gpu/drm/drm_drv.c' line='717' column='1'/>
         <return type-id='8898134d'/>
       </function-decl>
-      <function-decl name='drm_dev_dbg' mangled-name='drm_dev_dbg' filepath='include/drm/drm_print.h' line='337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_dbg'>
-        <parameter type-id='8df61054'/>
-        <parameter type-id='189697ba'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_dev_dbg' mangled-name='drm_dev_dbg' filepath='drivers/gpu/drm/drm_print.c' line='259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_dbg'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/gpu/drm/drm_print.c' line='259' column='1'/>
+        <parameter type-id='189697ba' name='category' filepath='drivers/gpu/drm/drm_print.c' line='259' column='1'/>
+        <parameter type-id='80f4b756' name='format' filepath='drivers/gpu/drm/drm_print.c' line='260' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dev_enter' mangled-name='drm_dev_enter' filepath='include/drm/drm_drv.h' line='642' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_enter'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='7292109c'/>
-        <return type-id='c894953d'/>
+      <function-decl name='drm_dev_enter' mangled-name='drm_dev_enter' filepath='drivers/gpu/drm/drm_drv.c' line='424' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_enter'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_drv.c' line='424' column='1'/>
+        <parameter type-id='7292109c' name='idx' filepath='drivers/gpu/drm/drm_drv.c' line='424' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_dev_exit' mangled-name='drm_dev_exit' filepath='include/drm/drm_drv.h' line='643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_exit'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_dev_exit' mangled-name='drm_dev_exit' filepath='drivers/gpu/drm/drm_drv.c' line='444' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_exit'>
+        <parameter type-id='95e97e5e' name='idx' filepath='drivers/gpu/drm/drm_drv.c' line='444' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dev_get' mangled-name='drm_dev_get' filepath='include/drm/drm_drv.h' line='639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_get'>
-        <parameter type-id='8898134d'/>
+      <function-decl name='drm_dev_get' mangled-name='drm_dev_get' filepath='drivers/gpu/drm/drm_drv.c' line='762' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_get'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_drv.c' line='762' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_dev_printk' mangled-name='drm_dev_printk' filepath='drivers/gpu/drm/drm_print.c' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dev_printk'>
@@ -120850,23 +120673,23 @@
         <parameter type-id='d8e6b335' name='edid_corrupt' filepath='drivers/gpu/drm/drm_edid.c' line='1662' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_edid_duplicate' mangled-name='drm_edid_duplicate' filepath='include/drm/drm_edid.h' line='490' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_duplicate'>
-        <parameter type-id='776adf76'/>
+      <function-decl name='drm_edid_duplicate' mangled-name='drm_edid_duplicate' filepath='drivers/gpu/drm/drm_edid.c' line='2095' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_duplicate'>
+        <parameter type-id='776adf76' name='edid' filepath='drivers/gpu/drm/drm_edid.c' line='2095' column='1'/>
         <return type-id='c91d1bf1'/>
       </function-decl>
-      <function-decl name='drm_edid_get_monitor_name' mangled-name='drm_edid_get_monitor_name' filepath='include/drm/drm_edid.h' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_get_monitor_name'>
-        <parameter type-id='c91d1bf1'/>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_edid_get_monitor_name' mangled-name='drm_edid_get_monitor_name' filepath='drivers/gpu/drm/drm_edid.c' line='4464' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_get_monitor_name'>
+        <parameter type-id='c91d1bf1' name='edid' filepath='drivers/gpu/drm/drm_edid.c' line='4464' column='1'/>
+        <parameter type-id='26a90f95' name='name' filepath='drivers/gpu/drm/drm_edid.c' line='4464' column='1'/>
+        <parameter type-id='95e97e5e' name='bufsize' filepath='drivers/gpu/drm/drm_edid.c' line='4464' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_edid_header_is_valid' mangled-name='drm_edid_header_is_valid' filepath='drivers/gpu/drm/drm_edid.c' line='1570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_header_is_valid'>
         <parameter type-id='bbaf3419' name='raw_edid' filepath='drivers/gpu/drm/drm_edid.c' line='1570' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_edid_is_valid' mangled-name='drm_edid_is_valid' filepath='include/drm/drm_edid.h' line='507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_is_valid'>
-        <parameter type-id='c91d1bf1'/>
-        <return type-id='c894953d'/>
+      <function-decl name='drm_edid_is_valid' mangled-name='drm_edid_is_valid' filepath='drivers/gpu/drm/drm_edid.c' line='1754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_is_valid'>
+        <parameter type-id='c91d1bf1' name='edid' filepath='drivers/gpu/drm/drm_edid.c' line='1754' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='drm_edid_to_sad' mangled-name='drm_edid_to_sad' filepath='drivers/gpu/drm/drm_edid.c' line='4594' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_edid_to_sad'>
         <parameter type-id='c91d1bf1' name='edid' filepath='drivers/gpu/drm/drm_edid.c' line='4594' column='1'/>
@@ -120882,12 +120705,12 @@
         <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_encoder.c' line='161' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_encoder_init' mangled-name='drm_encoder_init' filepath='include/drm/drm_encoder.h' line='193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_encoder_init'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='74d89ebd'/>
-        <parameter type-id='1701f1ac'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_encoder_init' mangled-name='drm_encoder_init' filepath='drivers/gpu/drm/drm_encoder.c' line='109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_encoder_init'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_encoder.c' line='109' column='1'/>
+        <parameter type-id='74d89ebd' name='encoder' filepath='drivers/gpu/drm/drm_encoder.c' line='110' column='1'/>
+        <parameter type-id='1701f1ac' name='funcs' filepath='drivers/gpu/drm/drm_encoder.c' line='111' column='1'/>
+        <parameter type-id='95e97e5e' name='encoder_type' filepath='drivers/gpu/drm/drm_encoder.c' line='112' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_encoder.c' line='112' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -120939,20 +120762,20 @@
         <parameter type-id='19c2251e' name='format' filepath='drivers/gpu/drm/drm_fourcc.c' line='312' column='1'/>
         <return type-id='f10b2208'/>
       </function-decl>
-      <function-decl name='drm_framebuffer_cleanup' mangled-name='drm_framebuffer_cleanup' filepath='include/drm/drm_framebuffer.h' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_framebuffer_cleanup'>
-        <parameter type-id='7b332e1c'/>
+      <function-decl name='drm_framebuffer_cleanup' mangled-name='drm_framebuffer_cleanup' filepath='drivers/gpu/drm/drm_framebuffer.c' line='942' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_framebuffer_cleanup'>
+        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_framebuffer.c' line='942' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_framebuffer_init' mangled-name='drm_framebuffer_init' filepath='include/drm/drm_framebuffer.h' line='218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_framebuffer_init'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='7b332e1c'/>
-        <parameter type-id='8e992c3d'/>
+      <function-decl name='drm_framebuffer_init' mangled-name='drm_framebuffer_init' filepath='drivers/gpu/drm/drm_framebuffer.c' line='844' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_framebuffer_init'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_framebuffer.c' line='844' column='1'/>
+        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_framebuffer.c' line='844' column='1'/>
+        <parameter type-id='8e992c3d' name='funcs' filepath='drivers/gpu/drm/drm_framebuffer.c' line='845' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_framebuffer_lookup' mangled-name='drm_framebuffer_lookup' filepath='include/drm/drm_framebuffer.h' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_framebuffer_lookup'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='9e99ecc1'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='drm_framebuffer_lookup' mangled-name='drm_framebuffer_lookup' filepath='drivers/gpu/drm/drm_framebuffer.c' line='883' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_framebuffer_lookup'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_framebuffer.c' line='883' column='1'/>
+        <parameter type-id='9e99ecc1' name='file_priv' filepath='drivers/gpu/drm/drm_framebuffer.c' line='884' column='1'/>
+        <parameter type-id='8f92235e' name='id' filepath='drivers/gpu/drm/drm_framebuffer.c' line='885' column='1'/>
         <return type-id='7b332e1c'/>
       </function-decl>
       <function-decl name='drm_framebuffer_remove' mangled-name='drm_framebuffer_remove' filepath='drivers/gpu/drm/drm_framebuffer.c' line='1083' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_framebuffer_remove'>
@@ -121076,10 +120899,10 @@
         <parameter type-id='abd62a96' name='obj' filepath='drivers/gpu/drm/drm_gem.c' line='556' column='1'/>
         <return type-id='9f93c9da'/>
       </function-decl>
-      <function-decl name='drm_gem_handle_create' mangled-name='drm_gem_handle_create' filepath='include/drm/drm_gem.h' line='388' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_handle_create'>
-        <parameter type-id='9e99ecc1'/>
-        <parameter type-id='abd62a96'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='drm_gem_handle_create' mangled-name='drm_gem_handle_create' filepath='drivers/gpu/drm/drm_gem.c' line='443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_handle_create'>
+        <parameter type-id='9e99ecc1' name='file_priv' filepath='drivers/gpu/drm/drm_gem.c' line='443' column='1'/>
+        <parameter type-id='abd62a96' name='obj' filepath='drivers/gpu/drm/drm_gem.c' line='444' column='1'/>
+        <parameter type-id='f9409001' name='handlep' filepath='drivers/gpu/drm/drm_gem.c' line='445' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_gem_lock_reservations' mangled-name='drm_gem_lock_reservations' filepath='drivers/gpu/drm/drm_gem.c' line='1265' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_lock_reservations'>
@@ -121124,9 +120947,9 @@
         <parameter type-id='b59d7dce' name='size' filepath='drivers/gpu/drm/drm_gem.c' line='124' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_gem_object_lookup' mangled-name='drm_gem_object_lookup' filepath='include/drm/drm_gem.h' line='404' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_object_lookup'>
-        <parameter type-id='9e99ecc1'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='drm_gem_object_lookup' mangled-name='drm_gem_object_lookup' filepath='drivers/gpu/drm/drm_gem.c' line='755' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_object_lookup'>
+        <parameter type-id='9e99ecc1' name='filp' filepath='drivers/gpu/drm/drm_gem.c' line='755' column='1'/>
+        <parameter type-id='19c2251e' name='handle' filepath='drivers/gpu/drm/drm_gem.c' line='755' column='1'/>
         <return type-id='abd62a96'/>
       </function-decl>
       <function-decl name='drm_gem_object_put_locked' mangled-name='drm_gem_object_put_locked' filepath='drivers/gpu/drm/drm_gem.c' line='1006' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_object_put_locked'>
@@ -121255,19 +121078,19 @@
         <parameter type-id='f0981eeb' name='type' filepath='drivers/gpu/drm/drm_connector.c' line='121' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='drm_get_edid' mangled-name='drm_get_edid' filepath='include/drm/drm_edid.h' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_get_edid'>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='b9af02c3'/>
+      <function-decl name='drm_get_edid' mangled-name='drm_get_edid' filepath='drivers/gpu/drm/drm_edid.c' line='2047' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_get_edid'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_edid.c' line='2047' column='1'/>
+        <parameter type-id='b9af02c3' name='adapter' filepath='drivers/gpu/drm/drm_edid.c' line='2048' column='1'/>
         <return type-id='c91d1bf1'/>
       </function-decl>
-      <function-decl name='drm_get_format_info' mangled-name='drm_get_format_info' filepath='include/drm/drm_fourcc.h' line='310' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_get_format_info'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='92ed24a5'/>
+      <function-decl name='drm_get_format_info' mangled-name='drm_get_format_info' filepath='drivers/gpu/drm/drm_fourcc.c' line='332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_get_format_info'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_fourcc.c' line='332' column='1'/>
+        <parameter type-id='92ed24a5' name='mode_cmd' filepath='drivers/gpu/drm/drm_fourcc.c' line='333' column='1'/>
         <return type-id='f10b2208'/>
       </function-decl>
-      <function-decl name='drm_get_format_name' mangled-name='drm_get_format_name' filepath='include/drm/drm_fourcc.h' line='321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_get_format_name'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='d00fb93a'/>
+      <function-decl name='drm_get_format_name' mangled-name='drm_get_format_name' filepath='drivers/gpu/drm/drm_fourcc.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_get_format_name'>
+        <parameter type-id='8f92235e' name='format' filepath='drivers/gpu/drm/drm_fourcc.c' line='138' column='1'/>
+        <parameter type-id='d00fb93a' name='buf' filepath='drivers/gpu/drm/drm_fourcc.c' line='138' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
       <function-decl name='drm_handle_vblank' mangled-name='drm_handle_vblank' filepath='drivers/gpu/drm/drm_vblank.c' line='1919' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_handle_vblank'>
@@ -121368,8 +121191,8 @@
         <parameter type-id='9e99ecc1' name='fpriv' filepath='drivers/gpu/drm/drm_auth.c' line='355' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_kms_helper_hotplug_event' mangled-name='drm_kms_helper_hotplug_event' filepath='include/drm/drm_probe_helper.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_kms_helper_hotplug_event'>
-        <parameter type-id='8898134d'/>
+      <function-decl name='drm_kms_helper_hotplug_event' mangled-name='drm_kms_helper_hotplug_event' filepath='drivers/gpu/drm/drm_probe_helper.c' line='607' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_kms_helper_hotplug_event'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_probe_helper.c' line='607' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_kms_helper_is_poll_worker' mangled-name='drm_kms_helper_is_poll_worker' filepath='drivers/gpu/drm/drm_probe_helper.c' line='725' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_kms_helper_is_poll_worker'>
@@ -121391,9 +121214,9 @@
         <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_probe_helper.c' line='774' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_match_cea_mode' mangled-name='drm_match_cea_mode' filepath='include/drm/drm_edid.h' line='494' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_match_cea_mode'>
-        <parameter type-id='745b39e8'/>
-        <return type-id='002ac4a6'/>
+      <function-decl name='drm_match_cea_mode' mangled-name='drm_match_cea_mode' filepath='drivers/gpu/drm/drm_edid.c' line='3447' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_match_cea_mode'>
+        <parameter type-id='745b39e8' name='to_match' filepath='drivers/gpu/drm/drm_edid.c' line='3447' column='1'/>
+        <return type-id='f9b06939'/>
       </function-decl>
       <function-decl name='drm_mm_init' mangled-name='drm_mm_init' filepath='drivers/gpu/drm/drm_mm.c' line='966' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mm_init'>
         <parameter type-id='0ee978f1' name='mm' filepath='drivers/gpu/drm/drm_mm.c' line='966' column='1'/>
@@ -121421,8 +121244,8 @@
         <parameter type-id='6368b074' name='node' filepath='drivers/gpu/drm/drm_mm.c' line='630' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mm_takedown' mangled-name='drm_mm_takedown' filepath='include/drm/drm_mm.h' line='466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mm_takedown'>
-        <parameter type-id='0ee978f1'/>
+      <function-decl name='drm_mm_takedown' mangled-name='drm_mm_takedown' filepath='drivers/gpu/drm/drm_mm.c' line='996' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mm_takedown'>
+        <parameter type-id='0ee978f1' name='mm' filepath='drivers/gpu/drm/drm_mm.c' line='996' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_mode_config_cleanup' mangled-name='drm_mode_config_cleanup' filepath='drivers/gpu/drm/drm_mode_config.c' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_config_cleanup'>
@@ -121437,24 +121260,24 @@
         <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modeset_helper.c' line='195' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_mode_config_reset' mangled-name='drm_mode_config_reset' filepath='include/drm/drm_mode_config.h' line='967' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_config_reset'>
-        <parameter type-id='8898134d'/>
+      <function-decl name='drm_mode_config_reset' mangled-name='drm_mode_config_reset' filepath='drivers/gpu/drm/drm_mode_config.c' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_config_reset'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_mode_config.c' line='181' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_convert_to_umode' mangled-name='drm_mode_convert_to_umode' filepath='include/drm/drm_modes.h' line='429' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_convert_to_umode'>
-        <parameter type-id='1bd40de0'/>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_mode_convert_to_umode' mangled-name='drm_mode_convert_to_umode' filepath='drivers/gpu/drm/drm_modes.c' line='1899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_convert_to_umode'>
+        <parameter type-id='1bd40de0' name='out' filepath='drivers/gpu/drm/drm_modes.c' line='1899' column='1'/>
+        <parameter type-id='745b39e8' name='in' filepath='drivers/gpu/drm/drm_modes.c' line='1900' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_convert_umode' mangled-name='drm_mode_convert_umode' filepath='include/drm/drm_modes.h' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_convert_umode'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='11e02f83'/>
-        <parameter type-id='4b939911'/>
+      <function-decl name='drm_mode_convert_umode' mangled-name='drm_mode_convert_umode' filepath='drivers/gpu/drm/drm_modes.c' line='1956' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_convert_umode'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modes.c' line='1956' column='1'/>
+        <parameter type-id='11e02f83' name='out' filepath='drivers/gpu/drm/drm_modes.c' line='1957' column='1'/>
+        <parameter type-id='4b939911' name='in' filepath='drivers/gpu/drm/drm_modes.c' line='1958' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_mode_copy' mangled-name='drm_mode_copy' filepath='include/drm/drm_modes.h' line='472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_copy'>
-        <parameter type-id='11e02f83'/>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_mode_copy' mangled-name='drm_mode_copy' filepath='drivers/gpu/drm/drm_modes.c' line='886' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_copy'>
+        <parameter type-id='11e02f83' name='dst' filepath='drivers/gpu/drm/drm_modes.c' line='886' column='1'/>
+        <parameter type-id='745b39e8' name='src' filepath='drivers/gpu/drm/drm_modes.c' line='886' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_mode_create' mangled-name='drm_mode_create' filepath='drivers/gpu/drm/drm_modes.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_create'>
@@ -121473,9 +121296,9 @@
         <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_connector.c' line='1599' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_mode_create_tile_group' mangled-name='drm_mode_create_tile_group' filepath='include/drm/drm_connector.h' line='1670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_create_tile_group'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_mode_create_tile_group' mangled-name='drm_mode_create_tile_group' filepath='drivers/gpu/drm/drm_connector.c' line='2538' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_create_tile_group'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_connector.c' line='2538' column='1'/>
+        <parameter type-id='80f4b756' name='topology' filepath='drivers/gpu/drm/drm_connector.c' line='2539' column='1'/>
         <return type-id='c6c44b9f'/>
       </function-decl>
       <function-decl name='drm_mode_crtc_set_gamma_size' mangled-name='drm_mode_crtc_set_gamma_size' filepath='drivers/gpu/drm/drm_color_mgmt.c' line='205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_crtc_set_gamma_size'>
@@ -121483,18 +121306,18 @@
         <parameter type-id='95e97e5e' name='gamma_size' filepath='drivers/gpu/drm/drm_color_mgmt.c' line='206' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_mode_debug_printmodeline' mangled-name='drm_mode_debug_printmodeline' filepath='include/drm/drm_modes.h' line='435' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_debug_printmodeline'>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_mode_debug_printmodeline' mangled-name='drm_mode_debug_printmodeline' filepath='drivers/gpu/drm/drm_modes.c' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_debug_printmodeline'>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='54' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_destroy' mangled-name='drm_mode_destroy' filepath='include/drm/drm_modes.h' line='428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_destroy'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='11e02f83'/>
+      <function-decl name='drm_mode_destroy' mangled-name='drm_mode_destroy' filepath='drivers/gpu/drm/drm_modes.c' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_destroy'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modes.c' line='89' column='1'/>
+        <parameter type-id='11e02f83' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='89' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_duplicate' mangled-name='drm_mode_duplicate' filepath='include/drm/drm_modes.h' line='474' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_duplicate'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_mode_duplicate' mangled-name='drm_mode_duplicate' filepath='drivers/gpu/drm/drm_modes.c' line='906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_duplicate'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modes.c' line='906' column='1'/>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='907' column='1'/>
         <return type-id='11e02f83'/>
       </function-decl>
       <function-decl name='drm_mode_equal' mangled-name='drm_mode_equal' filepath='drivers/gpu/drm/drm_modes.c' line='1024' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_equal'>
@@ -121515,9 +121338,9 @@
         <parameter type-id='b50a4934' name='rb' filepath='drivers/gpu/drm/drm_edid.c' line='2219' column='1'/>
         <return type-id='11e02f83'/>
       </function-decl>
-      <function-decl name='drm_mode_get_tile_group' mangled-name='drm_mode_get_tile_group' filepath='include/drm/drm_connector.h' line='1672' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_get_tile_group'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_mode_get_tile_group' mangled-name='drm_mode_get_tile_group' filepath='drivers/gpu/drm/drm_connector.c' line='2507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_get_tile_group'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_connector.c' line='2507' column='1'/>
+        <parameter type-id='80f4b756' name='topology' filepath='drivers/gpu/drm/drm_connector.c' line='2508' column='1'/>
         <return type-id='c6c44b9f'/>
       </function-decl>
       <function-decl name='drm_mode_is_420_also' mangled-name='drm_mode_is_420_also' filepath='drivers/gpu/drm/drm_modes.c' line='2052' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_is_420_also'>
@@ -121543,89 +121366,89 @@
         <parameter type-id='8f92235e' name='type' filepath='drivers/gpu/drm/drm_mode_object.c' line='175' column='1'/>
         <return type-id='c5417630'/>
       </function-decl>
-      <function-decl name='drm_mode_object_get' mangled-name='drm_mode_object_get' filepath='include/drm/drm_mode_object.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_object_get'>
-        <parameter type-id='c5417630'/>
+      <function-decl name='drm_mode_object_get' mangled-name='drm_mode_object_get' filepath='drivers/gpu/drm/drm_mode_object.c' line='209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_object_get'>
+        <parameter type-id='c5417630' name='obj' filepath='drivers/gpu/drm/drm_mode_object.c' line='209' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_object_put' mangled-name='drm_mode_object_put' filepath='include/drm/drm_mode_object.h' line='121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_object_put'>
-        <parameter type-id='c5417630'/>
+      <function-decl name='drm_mode_object_put' mangled-name='drm_mode_object_put' filepath='drivers/gpu/drm/drm_mode_object.c' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_object_put'>
+        <parameter type-id='c5417630' name='obj' filepath='drivers/gpu/drm/drm_mode_object.c' line='192' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_probed_add' mangled-name='drm_mode_probed_add' filepath='include/drm/drm_modes.h' line='434' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_probed_add'>
-        <parameter type-id='4db02c58'/>
-        <parameter type-id='11e02f83'/>
+      <function-decl name='drm_mode_probed_add' mangled-name='drm_mode_probed_add' filepath='drivers/gpu/drm/drm_modes.c' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_probed_add'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_modes.c' line='107' column='1'/>
+        <parameter type-id='11e02f83' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='108' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_set_crtcinfo' mangled-name='drm_mode_set_crtcinfo' filepath='include/drm/drm_modes.h' line='470' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_set_crtcinfo'>
-        <parameter type-id='11e02f83'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_mode_set_crtcinfo' mangled-name='drm_mode_set_crtcinfo' filepath='drivers/gpu/drm/drm_modes.c' line='814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_set_crtcinfo'>
+        <parameter type-id='11e02f83' name='p' filepath='drivers/gpu/drm/drm_modes.c' line='814' column='1'/>
+        <parameter type-id='95e97e5e' name='adjust_flags' filepath='drivers/gpu/drm/drm_modes.c' line='814' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_mode_set_name' mangled-name='drm_mode_set_name' filepath='drivers/gpu/drm/drm_modes.c' line='740' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_set_name'>
         <parameter type-id='11e02f83' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='740' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_mode_vrefresh' mangled-name='drm_mode_vrefresh' filepath='include/drm/drm_modes.h' line='466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_vrefresh'>
-        <parameter type-id='745b39e8'/>
+      <function-decl name='drm_mode_vrefresh' mangled-name='drm_mode_vrefresh' filepath='drivers/gpu/drm/drm_modes.c' line='758' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_vrefresh'>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='758' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_modeset_acquire_fini' mangled-name='drm_modeset_acquire_fini' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_acquire_fini'>
         <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='214' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_modeset_acquire_init' mangled-name='drm_modeset_acquire_init' filepath='include/drm/drm_modeset_lock.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_acquire_init'>
-        <parameter type-id='d1499e71'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='drm_modeset_acquire_init' mangled-name='drm_modeset_acquire_init' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='198' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_acquire_init'>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='198' column='1'/>
+        <parameter type-id='8f92235e' name='flags' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='199' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_modeset_backoff' mangled-name='drm_modeset_backoff' filepath='include/drm/drm_modeset_lock.h' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_backoff'>
-        <parameter type-id='d1499e71'/>
+      <function-decl name='drm_modeset_backoff' mangled-name='drm_modeset_backoff' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='294' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_backoff'>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='294' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_modeset_drop_locks' mangled-name='drm_modeset_drop_locks' filepath='include/drm/drm_modeset_lock.h' line='94' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_drop_locks'>
-        <parameter type-id='d1499e71'/>
+      <function-decl name='drm_modeset_drop_locks' mangled-name='drm_modeset_drop_locks' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_drop_locks'>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='226' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_modeset_lock' mangled-name='drm_modeset_lock' filepath='include/drm/drm_modeset_lock.h' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock'>
-        <parameter type-id='b4b06bb8'/>
-        <parameter type-id='d1499e71'/>
+      <function-decl name='drm_modeset_lock' mangled-name='drm_modeset_lock' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock'>
+        <parameter type-id='b4b06bb8' name='lock' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='338' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='339' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_modeset_lock_all' mangled-name='drm_modeset_lock_all' filepath='include/drm/drm_modeset_lock.h' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock_all'>
-        <parameter type-id='8898134d'/>
+      <function-decl name='drm_modeset_lock_all' mangled-name='drm_modeset_lock_all' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock_all'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='95' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_modeset_lock_all_ctx' mangled-name='drm_modeset_lock_all_ctx' filepath='include/drm/drm_modeset_lock.h' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock_all_ctx'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='d1499e71'/>
+      <function-decl name='drm_modeset_lock_all_ctx' mangled-name='drm_modeset_lock_all_ctx' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock_all_ctx'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='395' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='396' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_modeset_lock_init' mangled-name='drm_modeset_lock_init' filepath='include/drm/drm_modeset_lock.h' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock_init'>
-        <parameter type-id='b4b06bb8'/>
+      <function-decl name='drm_modeset_lock_init' mangled-name='drm_modeset_lock_init' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='313' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_lock_init'>
+        <parameter type-id='b4b06bb8' name='lock' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='313' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_modeset_unlock' mangled-name='drm_modeset_unlock' filepath='include/drm/drm_modeset_lock.h' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_unlock'>
-        <parameter type-id='b4b06bb8'/>
+      <function-decl name='drm_modeset_unlock' mangled-name='drm_modeset_unlock' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='368' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_unlock'>
+        <parameter type-id='b4b06bb8' name='lock' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='368' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_modeset_unlock_all' mangled-name='drm_modeset_unlock_all' filepath='include/drm/drm_modeset_lock.h' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_unlock_all'>
-        <parameter type-id='8898134d'/>
+      <function-decl name='drm_modeset_unlock_all' mangled-name='drm_modeset_unlock_all' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_modeset_unlock_all'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modeset_lock.c' line='149' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_need_swiotlb' mangled-name='drm_need_swiotlb' filepath='drivers/gpu/drm/drm_memory.c' line='160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_need_swiotlb'>
         <parameter type-id='95e97e5e' name='dma_bits' filepath='drivers/gpu/drm/drm_memory.c' line='160' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_object_attach_property' mangled-name='drm_object_attach_property' filepath='include/drm/drm_mode_object.h' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_object_attach_property'>
-        <parameter type-id='c5417630'/>
-        <parameter type-id='26ea5d4c'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='drm_object_attach_property' mangled-name='drm_object_attach_property' filepath='drivers/gpu/drm/drm_mode_object.c' line='231' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_object_attach_property'>
+        <parameter type-id='c5417630' name='obj' filepath='drivers/gpu/drm/drm_mode_object.c' line='231' column='1'/>
+        <parameter type-id='26ea5d4c' name='property' filepath='drivers/gpu/drm/drm_mode_object.c' line='232' column='1'/>
+        <parameter type-id='9c313c2d' name='init_val' filepath='drivers/gpu/drm/drm_mode_object.c' line='233' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_object_property_set_value' mangled-name='drm_object_property_set_value' filepath='include/drm/drm_mode_object.h' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_object_property_set_value'>
-        <parameter type-id='c5417630'/>
-        <parameter type-id='26ea5d4c'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='drm_object_property_set_value' mangled-name='drm_object_property_set_value' filepath='drivers/gpu/drm/drm_mode_object.c' line='281' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_object_property_set_value'>
+        <parameter type-id='c5417630' name='obj' filepath='drivers/gpu/drm/drm_mode_object.c' line='281' column='1'/>
+        <parameter type-id='26ea5d4c' name='property' filepath='drivers/gpu/drm/drm_mode_object.c' line='282' column='1'/>
+        <parameter type-id='9c313c2d' name='val' filepath='drivers/gpu/drm/drm_mode_object.c' line='282' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_of_component_match_add' mangled-name='drm_of_component_match_add' filepath='drivers/gpu/drm/drm_of.c' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_of_component_match_add'>
@@ -121677,17 +121500,17 @@
         <parameter type-id='8582e5ec' name='bridge' filepath='drivers/gpu/drm/bridge/panel.c' line='236' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_panel_disable' mangled-name='drm_panel_disable' filepath='include/drm/drm_panel.h' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_disable'>
-        <parameter type-id='c5491077'/>
+      <function-decl name='drm_panel_disable' mangled-name='drm_panel_disable' filepath='drivers/gpu/drm/drm_panel.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_disable'>
+        <parameter type-id='c5491077' name='panel' filepath='drivers/gpu/drm/drm_panel.c' line='183' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_panel_enable' mangled-name='drm_panel_enable' filepath='include/drm/drm_panel.h' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_enable'>
-        <parameter type-id='c5491077'/>
+      <function-decl name='drm_panel_enable' mangled-name='drm_panel_enable' filepath='drivers/gpu/drm/drm_panel.c' line='151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_enable'>
+        <parameter type-id='c5491077' name='panel' filepath='drivers/gpu/drm/drm_panel.c' line='151' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_panel_get_modes' mangled-name='drm_panel_get_modes' filepath='include/drm/drm_panel.h' line='189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_get_modes'>
-        <parameter type-id='c5491077'/>
-        <parameter type-id='4db02c58'/>
+      <function-decl name='drm_panel_get_modes' mangled-name='drm_panel_get_modes' filepath='drivers/gpu/drm/drm_panel.c' line='213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_get_modes'>
+        <parameter type-id='c5491077' name='panel' filepath='drivers/gpu/drm/drm_panel.c' line='213' column='1'/>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_panel.c' line='214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_panel_init' mangled-name='drm_panel_init' filepath='drivers/gpu/drm/drm_panel.c' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_init'>
@@ -121701,20 +121524,20 @@
         <parameter type-id='c5491077' name='panel' filepath='drivers/gpu/drm/drm_panel.c' line='329' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_panel_prepare' mangled-name='drm_panel_prepare' filepath='include/drm/drm_panel.h' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_prepare'>
-        <parameter type-id='c5491077'/>
+      <function-decl name='drm_panel_prepare' mangled-name='drm_panel_prepare' filepath='drivers/gpu/drm/drm_panel.c' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_prepare'>
+        <parameter type-id='c5491077' name='panel' filepath='drivers/gpu/drm/drm_panel.c' line='106' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_panel_remove' mangled-name='drm_panel_remove' filepath='drivers/gpu/drm/drm_panel.c' line='88' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_remove'>
         <parameter type-id='c5491077' name='panel' filepath='drivers/gpu/drm/drm_panel.c' line='88' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_panel_unprepare' mangled-name='drm_panel_unprepare' filepath='include/drm/drm_panel.h' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_unprepare'>
-        <parameter type-id='c5491077'/>
+      <function-decl name='drm_panel_unprepare' mangled-name='drm_panel_unprepare' filepath='drivers/gpu/drm/drm_panel.c' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_panel_unprepare'>
+        <parameter type-id='c5491077' name='panel' filepath='drivers/gpu/drm/drm_panel.c' line='129' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_plane_cleanup' mangled-name='drm_plane_cleanup' filepath='include/drm/drm_plane.h' line='747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_plane_cleanup'>
-        <parameter type-id='a6711537'/>
+      <function-decl name='drm_plane_cleanup' mangled-name='drm_plane_cleanup' filepath='drivers/gpu/drm/drm_plane.c' line='365' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_plane_cleanup'>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_plane.c' line='365' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_plane_create_alpha_property' mangled-name='drm_plane_create_alpha_property' filepath='drivers/gpu/drm/drm_blend.c' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_plane_create_alpha_property'>
@@ -121779,9 +121602,9 @@
         <parameter type-id='95e97e5e' name='max_entries' filepath='drivers/gpu/drm/drm_prime.c' line='1020' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_printf' mangled-name='drm_printf' filepath='include/drm/drm_print.h' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_printf'>
-        <parameter type-id='7ac48c21'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_printf' mangled-name='drm_printf' filepath='drivers/gpu/drm/drm_print.c' line='197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_printf'>
+        <parameter type-id='7ac48c21' name='p' filepath='drivers/gpu/drm/drm_print.c' line='197' column='1'/>
+        <parameter type-id='80f4b756' name='f' filepath='drivers/gpu/drm/drm_print.c' line='197' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
@@ -121789,52 +121612,52 @@
         <parameter type-id='c4126d52' name='blob' filepath='drivers/gpu/drm/drm_property.c' line='634' column='1'/>
         <return type-id='c4126d52'/>
       </function-decl>
-      <function-decl name='drm_property_blob_put' mangled-name='drm_property_blob_put' filepath='include/drm/drm_property.h' line='284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_blob_put'>
-        <parameter type-id='c4126d52'/>
+      <function-decl name='drm_property_blob_put' mangled-name='drm_property_blob_put' filepath='drivers/gpu/drm/drm_property.c' line='603' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_blob_put'>
+        <parameter type-id='c4126d52' name='blob' filepath='drivers/gpu/drm/drm_property.c' line='603' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_property_create' mangled-name='drm_property_create' filepath='include/drm/drm_property.h' line='243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_property_create' mangled-name='drm_property_create' filepath='drivers/gpu/drm/drm_property.c' line='96' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='96' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/gpu/drm/drm_property.c' line='97' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_property.c' line='97' column='1'/>
+        <parameter type-id='95e97e5e' name='num_values' filepath='drivers/gpu/drm/drm_property.c' line='98' column='1'/>
         <return type-id='26ea5d4c'/>
       </function-decl>
-      <function-decl name='drm_property_create_bitmask' mangled-name='drm_property_create_bitmask' filepath='include/drm/drm_property.h' line='250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_bitmask'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='b807105c'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='drm_property_create_bitmask' mangled-name='drm_property_create_bitmask' filepath='drivers/gpu/drm/drm_property.c' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_bitmask'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='210' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/gpu/drm/drm_property.c' line='211' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_property.c' line='211' column='1'/>
+        <parameter type-id='b807105c' name='props' filepath='drivers/gpu/drm/drm_property.c' line='212' column='1'/>
+        <parameter type-id='95e97e5e' name='num_props' filepath='drivers/gpu/drm/drm_property.c' line='213' column='1'/>
+        <parameter type-id='9c313c2d' name='supported_bits' filepath='drivers/gpu/drm/drm_property.c' line='214' column='1'/>
         <return type-id='26ea5d4c'/>
       </function-decl>
-      <function-decl name='drm_property_create_blob' mangled-name='drm_property_create_blob' filepath='include/drm/drm_property.h' line='270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_blob'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='drm_property_create_blob' mangled-name='drm_property_create_blob' filepath='drivers/gpu/drm/drm_property.c' line='558' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_blob'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='558' column='1'/>
+        <parameter type-id='b59d7dce' name='length' filepath='drivers/gpu/drm/drm_property.c' line='558' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/gpu/drm/drm_property.c' line='559' column='1'/>
         <return type-id='c4126d52'/>
       </function-decl>
-      <function-decl name='drm_property_create_bool' mangled-name='drm_property_create_bool' filepath='include/drm/drm_property.h' line='264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_bool'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_property_create_bool' mangled-name='drm_property_create_bool' filepath='drivers/gpu/drm/drm_property.c' line='369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_bool'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='369' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/gpu/drm/drm_property.c' line='370' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_property.c' line='370' column='1'/>
         <return type-id='26ea5d4c'/>
       </function-decl>
-      <function-decl name='drm_property_create_enum' mangled-name='drm_property_create_enum' filepath='include/drm/drm_property.h' line='246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_enum'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='b807105c'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_property_create_enum' mangled-name='drm_property_create_enum' filepath='drivers/gpu/drm/drm_property.c' line='162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_enum'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='162' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/gpu/drm/drm_property.c' line='163' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_property.c' line='163' column='1'/>
+        <parameter type-id='b807105c' name='props' filepath='drivers/gpu/drm/drm_property.c' line='164' column='1'/>
+        <parameter type-id='95e97e5e' name='num_values' filepath='drivers/gpu/drm/drm_property.c' line='165' column='1'/>
         <return type-id='26ea5d4c'/>
       </function-decl>
-      <function-decl name='drm_property_create_range' mangled-name='drm_property_create_range' filepath='include/drm/drm_property.h' line='255' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_range'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='drm_property_create_range' mangled-name='drm_property_create_range' filepath='drivers/gpu/drm/drm_property.c' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_range'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='277' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/gpu/drm/drm_property.c' line='278' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_property.c' line='278' column='1'/>
+        <parameter type-id='9c313c2d' name='min' filepath='drivers/gpu/drm/drm_property.c' line='279' column='1'/>
+        <parameter type-id='9c313c2d' name='max' filepath='drivers/gpu/drm/drm_property.c' line='279' column='1'/>
         <return type-id='26ea5d4c'/>
       </function-decl>
       <function-decl name='drm_property_create_signed_range' mangled-name='drm_property_create_signed_range' filepath='drivers/gpu/drm/drm_property.c' line='305' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_signed_range'>
@@ -121845,9 +121668,9 @@
         <parameter type-id='9da381c4' name='max' filepath='drivers/gpu/drm/drm_property.c' line='307' column='1'/>
         <return type-id='26ea5d4c'/>
       </function-decl>
-      <function-decl name='drm_property_destroy' mangled-name='drm_property_destroy' filepath='include/drm/drm_property.h' line='268' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_destroy'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='26ea5d4c'/>
+      <function-decl name='drm_property_destroy' mangled-name='drm_property_destroy' filepath='drivers/gpu/drm/drm_property.c' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_destroy'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='442' column='1'/>
+        <parameter type-id='26ea5d4c' name='property' filepath='drivers/gpu/drm/drm_property.c' line='442' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_property_lookup_blob' mangled-name='drm_property_lookup_blob' filepath='drivers/gpu/drm/drm_property.c' line='653' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_lookup_blob'>
@@ -121855,10 +121678,10 @@
         <parameter type-id='8f92235e' name='id' filepath='drivers/gpu/drm/drm_property.c' line='654' column='1'/>
         <return type-id='c4126d52'/>
       </function-decl>
-      <function-decl name='drm_property_replace_blob' mangled-name='drm_property_replace_blob' filepath='include/drm/drm_property.h' line='281' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_replace_blob'>
-        <parameter type-id='210253e8'/>
-        <parameter type-id='c4126d52'/>
-        <return type-id='c894953d'/>
+      <function-decl name='drm_property_replace_blob' mangled-name='drm_property_replace_blob' filepath='drivers/gpu/drm/drm_property.c' line='741' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_replace_blob'>
+        <parameter type-id='210253e8' name='blob' filepath='drivers/gpu/drm/drm_property.c' line='741' column='1'/>
+        <parameter type-id='c4126d52' name='new_blob' filepath='drivers/gpu/drm/drm_property.c' line='742' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='drm_puts' mangled-name='drm_puts' filepath='drivers/gpu/drm/drm_print.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_puts'>
         <parameter type-id='7ac48c21' name='p' filepath='drivers/gpu/drm/drm_print.c' line='183' column='1'/>
@@ -121872,30 +121695,30 @@
         <parameter type-id='b53e8dbb' name='offset' filepath='drivers/gpu/drm/drm_file.c' line='569' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='drm_rect_calc_hscale' mangled-name='drm_rect_calc_hscale' filepath='include/drm/drm_rect.h' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_calc_hscale'>
-        <parameter type-id='7d69a4de'/>
-        <parameter type-id='7d69a4de'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_rect_calc_hscale' mangled-name='drm_rect_calc_hscale' filepath='drivers/gpu/drm/drm_rect.c' line='169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_calc_hscale'>
+        <parameter type-id='7d69a4de' name='src' filepath='drivers/gpu/drm/drm_rect.c' line='169' column='1'/>
+        <parameter type-id='7d69a4de' name='dst' filepath='drivers/gpu/drm/drm_rect.c' line='170' column='1'/>
+        <parameter type-id='95e97e5e' name='min_hscale' filepath='drivers/gpu/drm/drm_rect.c' line='171' column='1'/>
+        <parameter type-id='95e97e5e' name='max_hscale' filepath='drivers/gpu/drm/drm_rect.c' line='171' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_rect_calc_vscale' mangled-name='drm_rect_calc_vscale' filepath='include/drm/drm_rect.h' line='215' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_calc_vscale'>
-        <parameter type-id='7d69a4de'/>
-        <parameter type-id='7d69a4de'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='drm_rect_calc_vscale' mangled-name='drm_rect_calc_vscale' filepath='drivers/gpu/drm/drm_rect.c' line='204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_calc_vscale'>
+        <parameter type-id='7d69a4de' name='src' filepath='drivers/gpu/drm/drm_rect.c' line='204' column='1'/>
+        <parameter type-id='7d69a4de' name='dst' filepath='drivers/gpu/drm/drm_rect.c' line='205' column='1'/>
+        <parameter type-id='95e97e5e' name='min_vscale' filepath='drivers/gpu/drm/drm_rect.c' line='206' column='1'/>
+        <parameter type-id='95e97e5e' name='max_vscale' filepath='drivers/gpu/drm/drm_rect.c' line='206' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_rect_clip_scaled' mangled-name='drm_rect_clip_scaled' filepath='include/drm/drm_rect.h' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_clip_scaled'>
-        <parameter type-id='c91d6c11'/>
-        <parameter type-id='c91d6c11'/>
-        <parameter type-id='7d69a4de'/>
-        <return type-id='c894953d'/>
+      <function-decl name='drm_rect_clip_scaled' mangled-name='drm_rect_clip_scaled' filepath='drivers/gpu/drm/drm_rect.c' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_clip_scaled'>
+        <parameter type-id='c91d6c11' name='src' filepath='drivers/gpu/drm/drm_rect.c' line='92' column='1'/>
+        <parameter type-id='c91d6c11' name='dst' filepath='drivers/gpu/drm/drm_rect.c' line='92' column='1'/>
+        <parameter type-id='7d69a4de' name='clip' filepath='drivers/gpu/drm/drm_rect.c' line='93' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_rect_intersect' mangled-name='drm_rect_intersect' filepath='include/drm/drm_rect.h' line='209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_intersect'>
-        <parameter type-id='c91d6c11'/>
-        <parameter type-id='7d69a4de'/>
-        <return type-id='c894953d'/>
+      <function-decl name='drm_rect_intersect' mangled-name='drm_rect_intersect' filepath='drivers/gpu/drm/drm_rect.c' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_rect_intersect'>
+        <parameter type-id='c91d6c11' name='r1' filepath='drivers/gpu/drm/drm_rect.c' line='44' column='1'/>
+        <parameter type-id='7d69a4de' name='r2' filepath='drivers/gpu/drm/drm_rect.c' line='44' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='drm_release' mangled-name='drm_release' filepath='drivers/gpu/drm/drm_file.c' line='483' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_release'>
         <parameter type-id='7e666abe' name='inode' filepath='drivers/gpu/drm/drm_file.c' line='483' column='1'/>
@@ -121931,8 +121754,8 @@
         <parameter type-id='b59d7dce' name='size' filepath='drivers/gpu/drm/drm_scdc_helper.c' line='94' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='drm_self_refresh_helper_alter_state' mangled-name='drm_self_refresh_helper_alter_state' filepath='include/drm/drm_self_refresh_helper.h' line='14' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_self_refresh_helper_alter_state'>
-        <parameter type-id='e3dd029e'/>
+      <function-decl name='drm_self_refresh_helper_alter_state' mangled-name='drm_self_refresh_helper_alter_state' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_self_refresh_helper_alter_state'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='187' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_send_event' mangled-name='drm_send_event' filepath='drivers/gpu/drm/drm_file.c' line='878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_send_event'>
@@ -122008,20 +121831,20 @@
         <parameter type-id='28271da3' name='fence' filepath='drivers/gpu/drm/drm_syncobj.c' line='322' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_sysfs_hotplug_event' mangled-name='drm_sysfs_hotplug_event' filepath='include/drm/drm_sysfs.h' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_sysfs_hotplug_event'>
-        <parameter type-id='8898134d'/>
+      <function-decl name='drm_sysfs_hotplug_event' mangled-name='drm_sysfs_hotplug_event' filepath='drivers/gpu/drm/drm_sysfs.c' line='336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_sysfs_hotplug_event'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_sysfs.c' line='336' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_universal_plane_init' mangled-name='drm_universal_plane_init' filepath='include/drm/drm_plane.h' line='732' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_universal_plane_init'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='a6711537'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cfd5d066'/>
-        <parameter type-id='5b2fd8e8'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='b6e600bc'/>
-        <parameter type-id='5eed3c85'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='drm_universal_plane_init' mangled-name='drm_universal_plane_init' filepath='drivers/gpu/drm/drm_plane.c' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_universal_plane_init'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_plane.c' line='173' column='1'/>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_plane.c' line='173' column='1'/>
+        <parameter type-id='8f92235e' name='possible_crtcs' filepath='drivers/gpu/drm/drm_plane.c' line='174' column='1'/>
+        <parameter type-id='cfd5d066' name='funcs' filepath='drivers/gpu/drm/drm_plane.c' line='175' column='1'/>
+        <parameter type-id='a6798dcc' name='formats' filepath='drivers/gpu/drm/drm_plane.c' line='176' column='1'/>
+        <parameter type-id='f0981eeb' name='format_count' filepath='drivers/gpu/drm/drm_plane.c' line='176' column='1'/>
+        <parameter type-id='713a56f5' name='format_modifiers' filepath='drivers/gpu/drm/drm_plane.c' line='177' column='1'/>
+        <parameter type-id='5eed3c85' name='type' filepath='drivers/gpu/drm/drm_plane.c' line='178' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_plane.c' line='179' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -122030,19 +121853,19 @@
         <parameter type-id='f0981eeb' name='num_crtcs' filepath='drivers/gpu/drm/drm_vblank.c' line='517' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_vma_node_allow' mangled-name='drm_vma_node_allow' filepath='include/drm/drm_vma_manager.h' line='76' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_vma_node_allow'>
-        <parameter type-id='e05b33b0'/>
-        <parameter type-id='9e99ecc1'/>
+      <function-decl name='drm_vma_node_allow' mangled-name='drm_vma_node_allow' filepath='drivers/gpu/drm/drm_vma_manager.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_vma_node_allow'>
+        <parameter type-id='e05b33b0' name='node' filepath='drivers/gpu/drm/drm_vma_manager.c' line='263' column='1'/>
+        <parameter type-id='9e99ecc1' name='tag' filepath='drivers/gpu/drm/drm_vma_manager.c' line='263' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_vma_node_is_allowed' mangled-name='drm_vma_node_is_allowed' filepath='include/drm/drm_vma_manager.h' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_vma_node_is_allowed'>
-        <parameter type-id='e05b33b0'/>
-        <parameter type-id='9e99ecc1'/>
-        <return type-id='c894953d'/>
+      <function-decl name='drm_vma_node_is_allowed' mangled-name='drm_vma_node_is_allowed' filepath='drivers/gpu/drm/drm_vma_manager.c' line='366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_vma_node_is_allowed'>
+        <parameter type-id='e05b33b0' name='node' filepath='drivers/gpu/drm/drm_vma_manager.c' line='366' column='1'/>
+        <parameter type-id='9e99ecc1' name='tag' filepath='drivers/gpu/drm/drm_vma_manager.c' line='367' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_vma_node_revoke' mangled-name='drm_vma_node_revoke' filepath='include/drm/drm_vma_manager.h' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_vma_node_revoke'>
-        <parameter type-id='e05b33b0'/>
-        <parameter type-id='9e99ecc1'/>
+      <function-decl name='drm_vma_node_revoke' mangled-name='drm_vma_node_revoke' filepath='drivers/gpu/drm/drm_vma_manager.c' line='325' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_vma_node_revoke'>
+        <parameter type-id='e05b33b0' name='node' filepath='drivers/gpu/drm/drm_vma_manager.c' line='325' column='1'/>
+        <parameter type-id='9e99ecc1' name='tag' filepath='drivers/gpu/drm/drm_vma_manager.c' line='326' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_wait_one_vblank' mangled-name='drm_wait_one_vblank' filepath='drivers/gpu/drm/drm_vblank.c' line='1240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_wait_one_vblank'>
@@ -122069,24 +121892,24 @@
         <parameter type-id='95e97e5e' name='status' filepath='drivers/gpu/drm/drm_writeback.c' line='367' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drmm_kmalloc' mangled-name='drmm_kmalloc' filepath='include/drm/drm_managed.h' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drmm_kmalloc'>
-        <parameter type-id='8898134d'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='drmm_kmalloc' mangled-name='drmm_kmalloc' filepath='drivers/gpu/drm/drm_managed.c' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drmm_kmalloc'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_managed.c' line='188' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='drivers/gpu/drm/drm_managed.c' line='188' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/gpu/drm/drm_managed.c' line='188' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='drmm_mode_config_init' mangled-name='drmm_mode_config_init' filepath='drivers/gpu/drm/drm_mode_config.c' line='399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drmm_mode_config_init'>
         <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_mode_config.c' line='399' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dst_release' mangled-name='dst_release' filepath='include/net/dst.h' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dst_release'>
-        <parameter type-id='141b6427'/>
+      <function-decl name='dst_release' mangled-name='dst_release' filepath='net/core/dst.c' line='169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dst_release'>
+        <parameter type-id='141b6427' name='dst' filepath='net/core/dst.c' line='169' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dump_backtrace' mangled-name='dump_backtrace' filepath='arch/arm64/include/asm/stacktrace.h' line='67' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dump_backtrace'>
-        <parameter type-id='4616a179'/>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='dump_backtrace' mangled-name='dump_backtrace' filepath='arch/arm64/kernel/stacktrace.c' line='140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dump_backtrace'>
+        <parameter type-id='4616a179' name='regs' filepath='arch/arm64/kernel/stacktrace.c' line='140' column='1'/>
+        <parameter type-id='f23e2572' name='tsk' filepath='arch/arm64/kernel/stacktrace.c' line='140' column='1'/>
+        <parameter type-id='80f4b756' name='loglvl' filepath='arch/arm64/kernel/stacktrace.c' line='141' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dump_stack' mangled-name='dump_stack' filepath='lib/dump_stack.c' line='133' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dump_stack'>
@@ -122325,8 +122148,8 @@
         <parameter type-id='4a89adae' name='e' filepath='block/elevator.c' line='558' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='em_cpu_get' mangled-name='em_cpu_get' filepath='include/linux/energy_model.h' line='98' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='em_cpu_get'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='em_cpu_get' mangled-name='em_cpu_get' filepath='kernel/power/energy_model.c' line='248' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='em_cpu_get'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/power/energy_model.c' line='248' column='1'/>
         <return type-id='ce714046'/>
       </function-decl>
       <function-decl name='em_dev_register_perf_domain' mangled-name='em_dev_register_perf_domain' filepath='kernel/power/energy_model.c' line='283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='em_dev_register_perf_domain'>
@@ -122340,13 +122163,13 @@
       <function-decl name='emergency_restart' mangled-name='emergency_restart' filepath='kernel/reboot.c' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='emergency_restart'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='enable_irq' mangled-name='enable_irq' filepath='include/linux/interrupt.h' line='239' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='enable_irq'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='enable_irq' mangled-name='enable_irq' filepath='kernel/irq/manage.c' line='709' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='enable_irq'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='709' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='enable_percpu_irq' mangled-name='enable_percpu_irq' filepath='include/linux/interrupt.h' line='240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='enable_percpu_irq'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='enable_percpu_irq' mangled-name='enable_percpu_irq' filepath='kernel/irq/manage.c' line='2229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='enable_percpu_irq'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2229' column='1'/>
+        <parameter type-id='f0981eeb' name='type' filepath='kernel/irq/manage.c' line='2229' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='end_buffer_read_sync' mangled-name='end_buffer_read_sync' filepath='fs/buffer.c' line='157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='end_buffer_read_sync'>
@@ -122385,14 +122208,14 @@
         <parameter type-id='cf536864' name='haddr' filepath='net/ethernet/eth.c' line='217' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='eth_mac_addr' mangled-name='eth_mac_addr' filepath='include/linux/etherdevice.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_mac_addr'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='eth_mac_addr' mangled-name='eth_mac_addr' filepath='net/ethernet/eth.c' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_mac_addr'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethernet/eth.c' line='326' column='1'/>
+        <parameter type-id='eaa32e2f' name='p' filepath='net/ethernet/eth.c' line='326' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='eth_platform_get_mac_address' mangled-name='eth_platform_get_mac_address' filepath='include/linux/etherdevice.h' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_platform_get_mac_address'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='eth_platform_get_mac_address' mangled-name='eth_platform_get_mac_address' filepath='net/ethernet/eth.c' line='507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_platform_get_mac_address'>
+        <parameter type-id='fa0b179b' name='dev' filepath='net/ethernet/eth.c' line='507' column='1'/>
+        <parameter type-id='8bff8096' name='mac_addr' filepath='net/ethernet/eth.c' line='507' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='eth_prepare_mac_addr_change' mangled-name='eth_prepare_mac_addr_change' filepath='net/ethernet/eth.c' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_prepare_mac_addr_change'>
@@ -122400,17 +122223,17 @@
         <parameter type-id='eaa32e2f' name='p' filepath='net/ethernet/eth.c' line='291' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='eth_type_trans' mangled-name='eth_type_trans' filepath='include/linux/etherdevice.h' line='33' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_type_trans'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='68a2d05b'/>
-        <return type-id='8efea9e5'/>
+      <function-decl name='eth_type_trans' mangled-name='eth_type_trans' filepath='net/ethernet/eth.c' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_type_trans'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ethernet/eth.c' line='155' column='1'/>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethernet/eth.c' line='155' column='1'/>
+        <return type-id='84a5c3d4'/>
       </function-decl>
       <function-decl name='eth_validate_addr' mangled-name='eth_validate_addr' filepath='net/ethernet/eth.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eth_validate_addr'>
         <parameter type-id='68a2d05b' name='dev' filepath='net/ethernet/eth.c' line='338' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ether_setup' mangled-name='ether_setup' filepath='include/linux/netdevice.h' line='4454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ether_setup'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='ether_setup' mangled-name='ether_setup' filepath='net/ethernet/eth.c' line='361' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ether_setup'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethernet/eth.c' line='361' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ethnl_cable_test_fault_length' mangled-name='ethnl_cable_test_fault_length' filepath='net/ethtool/cabletest.c' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethnl_cable_test_fault_length'>
@@ -122425,9 +122248,9 @@
         <parameter type-id='f9b06939' name='result' filepath='net/ethtool/cabletest.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ethtool_op_get_link' mangled-name='ethtool_op_get_link' filepath='include/linux/ethtool.h' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_op_get_link'>
-        <parameter type-id='68a2d05b'/>
-        <return type-id='f0981eeb'/>
+      <function-decl name='ethtool_op_get_link' mangled-name='ethtool_op_get_link' filepath='net/ethtool/ioctl.c' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_op_get_link'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='39' column='1'/>
+        <return type-id='19c2251e'/>
       </function-decl>
       <function-decl name='ethtool_op_get_ts_info' mangled-name='ethtool_op_get_ts_info' filepath='net/ethtool/ioctl.c' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_op_get_ts_info'>
         <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='45' column='1'/>
@@ -122441,50 +122264,50 @@
         <parameter type-id='8bff8096' name='dev_duplex' filepath='net/ethtool/ioctl.c' line='612' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='event_triggers_call' mangled-name='event_triggers_call' filepath='include/linux/trace_events.h' line='589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='event_triggers_call'>
-        <parameter type-id='3d4ca6d2'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='3275e929'/>
+      <function-decl name='event_triggers_call' mangled-name='event_triggers_call' filepath='kernel/trace/trace_events_trigger.c' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='event_triggers_call'>
+        <parameter type-id='3d4ca6d2' name='file' filepath='kernel/trace/trace_events_trigger.c' line='56' column='1'/>
+        <parameter type-id='eaa32e2f' name='rec' filepath='kernel/trace/trace_events_trigger.c' line='56' column='1'/>
+        <parameter type-id='3275e929' name='event' filepath='kernel/trace/trace_events_trigger.c' line='57' column='1'/>
         <return type-id='21b4096c'/>
       </function-decl>
-      <function-decl name='eventfd_ctx_fdget' mangled-name='eventfd_ctx_fdget' filepath='include/linux/eventfd.h' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fdget'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='eventfd_ctx_fdget' mangled-name='eventfd_ctx_fdget' filepath='fs/eventfd.c' line='370' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fdget'>
+        <parameter type-id='95e97e5e' name='fd' filepath='fs/eventfd.c' line='370' column='1'/>
         <return type-id='71f2e203'/>
       </function-decl>
-      <function-decl name='eventfd_ctx_fileget' mangled-name='eventfd_ctx_fileget' filepath='include/linux/eventfd.h' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fileget'>
-        <parameter type-id='77e79a4b'/>
+      <function-decl name='eventfd_ctx_fileget' mangled-name='eventfd_ctx_fileget' filepath='fs/eventfd.c' line='391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_fileget'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/eventfd.c' line='391' column='1'/>
         <return type-id='71f2e203'/>
       </function-decl>
-      <function-decl name='eventfd_ctx_put' mangled-name='eventfd_ctx_put' filepath='include/linux/eventfd.h' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_put'>
-        <parameter type-id='71f2e203'/>
+      <function-decl name='eventfd_ctx_put' mangled-name='eventfd_ctx_put' filepath='fs/eventfd.c' line='112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_put'>
+        <parameter type-id='71f2e203' name='ctx' filepath='fs/eventfd.c' line='112' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='eventfd_ctx_remove_wait_queue' mangled-name='eventfd_ctx_remove_wait_queue' filepath='include/linux/eventfd.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_remove_wait_queue'>
-        <parameter type-id='71f2e203'/>
-        <parameter type-id='db9d03e3'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='eventfd_ctx_remove_wait_queue' mangled-name='eventfd_ctx_remove_wait_queue' filepath='fs/eventfd.c' line='204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_ctx_remove_wait_queue'>
+        <parameter type-id='71f2e203' name='ctx' filepath='fs/eventfd.c' line='204' column='1'/>
+        <parameter type-id='ba9aa326' name='wait' filepath='fs/eventfd.c' line='204' column='1'/>
+        <parameter type-id='30dcd536' name='cnt' filepath='fs/eventfd.c' line='205' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='eventfd_signal' mangled-name='eventfd_signal' filepath='include/linux/eventfd.h' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_signal'>
-        <parameter type-id='71f2e203'/>
-        <parameter type-id='3a47d82b'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='eventfd_signal' mangled-name='eventfd_signal' filepath='fs/eventfd.c' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='eventfd_signal'>
+        <parameter type-id='71f2e203' name='ctx' filepath='fs/eventfd.c' line='62' column='1'/>
+        <parameter type-id='d3130597' name='n' filepath='fs/eventfd.c' line='62' column='1'/>
+        <return type-id='d3130597'/>
       </function-decl>
-      <function-decl name='extcon_find_edev_by_node' mangled-name='extcon_find_edev_by_node' filepath='include/linux/extcon.h' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_find_edev_by_node'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='extcon_find_edev_by_node' mangled-name='extcon_find_edev_by_node' filepath='drivers/extcon/extcon.c' line='1337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_find_edev_by_node'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/extcon/extcon.c' line='1337' column='1'/>
         <return type-id='c0d6fada'/>
       </function-decl>
-      <function-decl name='extcon_get_edev_by_phandle' mangled-name='extcon_get_edev_by_phandle' filepath='include/linux/extcon.h' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_edev_by_phandle'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='extcon_get_edev_by_phandle' mangled-name='extcon_get_edev_by_phandle' filepath='drivers/extcon/extcon.c' line='1359' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_edev_by_phandle'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/extcon/extcon.c' line='1359' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/extcon/extcon.c' line='1359' column='1'/>
         <return type-id='c0d6fada'/>
       </function-decl>
       <function-decl name='extcon_get_edev_name' mangled-name='extcon_get_edev_name' filepath='drivers/extcon/extcon.c' line='1406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_edev_name'>
         <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='1406' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='extcon_get_extcon_dev' mangled-name='extcon_get_extcon_dev' filepath='include/linux/extcon.h' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_extcon_dev'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='extcon_get_extcon_dev' mangled-name='extcon_get_extcon_dev' filepath='drivers/extcon/extcon.c' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_extcon_dev'>
+        <parameter type-id='80f4b756' name='extcon_name' filepath='drivers/extcon/extcon.c' line='867' column='1'/>
         <return type-id='c0d6fada'/>
       </function-decl>
       <function-decl name='extcon_get_property' mangled-name='extcon_get_property' filepath='drivers/extcon/extcon.c' line='615' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_property'>
@@ -122494,15 +122317,15 @@
         <parameter type-id='50842338' name='prop_val' filepath='drivers/extcon/extcon.c' line='617' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_get_state' mangled-name='extcon_get_state' filepath='include/linux/extcon.h' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_state'>
-        <parameter type-id='c0d6fada'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='extcon_get_state' mangled-name='extcon_get_state' filepath='drivers/extcon/extcon.c' line='489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_get_state'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='489' column='1'/>
+        <parameter type-id='20f5f452' name='id' filepath='drivers/extcon/extcon.c' line='489' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_register_notifier' mangled-name='extcon_register_notifier' filepath='include/linux/extcon.h' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_register_notifier'>
-        <parameter type-id='c0d6fada'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='extcon_register_notifier' mangled-name='extcon_register_notifier' filepath='drivers/extcon/extcon.c' line='899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_register_notifier'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='899' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='899' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/extcon/extcon.c' line='900' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='extcon_set_property' mangled-name='extcon_set_property' filepath='drivers/extcon/extcon.c' line='694' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_property'>
@@ -122524,27 +122347,27 @@
         <parameter type-id='b50a4934' name='state' filepath='drivers/extcon/extcon.c' line='577' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='extcon_unregister_notifier' mangled-name='extcon_unregister_notifier' filepath='include/linux/extcon.h' line='201' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_unregister_notifier'>
-        <parameter type-id='c0d6fada'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='extcon_unregister_notifier' mangled-name='extcon_unregister_notifier' filepath='drivers/extcon/extcon.c' line='928' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_unregister_notifier'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='928' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='928' column='1'/>
+        <parameter type-id='d504f73d' name='nb' filepath='drivers/extcon/extcon.c' line='929' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='failure_tracking' type-id='49a0ad34' mangled-name='failure_tracking' visibility='default' filepath='mm/page_pinner.c' line='61' column='1' elf-symbol-id='failure_tracking'/>
-      <function-decl name='fasync_helper' mangled-name='fasync_helper' filepath='include/linux/fs.h' line='1355' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fasync_helper'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='dc750055'/>
+      <function-decl name='fasync_helper' mangled-name='fasync_helper' filepath='fs/fcntl.c' line='982' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fasync_helper'>
+        <parameter type-id='95e97e5e' name='fd' filepath='fs/fcntl.c' line='982' column='1'/>
+        <parameter type-id='77e79a4b' name='filp' filepath='fs/fcntl.c' line='982' column='1'/>
+        <parameter type-id='95e97e5e' name='on' filepath='fs/fcntl.c' line='982' column='1'/>
+        <parameter type-id='dc750055' name='fapp' filepath='fs/fcntl.c' line='982' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='fd_install' mangled-name='fd_install' filepath='include/linux/file.h' line='93' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fd_install'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='77e79a4b'/>
+      <function-decl name='fd_install' mangled-name='fd_install' filepath='fs/file.c' line='633' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fd_install'>
+        <parameter type-id='f0981eeb' name='fd' filepath='fs/file.c' line='633' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/file.c' line='633' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='fget' mangled-name='fget' filepath='include/linux/file.h' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fget'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='fget' mangled-name='fget' filepath='fs/file.c' line='854' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fget'>
+        <parameter type-id='f0981eeb' name='fd' filepath='fs/file.c' line='854' column='1'/>
         <return type-id='77e79a4b'/>
       </function-decl>
       <function-decl name='file_path' mangled-name='file_path' filepath='fs/open.c' line='927' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='file_path'>
@@ -122558,9 +122381,9 @@
         <parameter type-id='f57039f0' name='mapping' filepath='mm/readahead.c' line='35' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='filp_close' mangled-name='filp_close' filepath='include/linux/fs.h' line='2595' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filp_close'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='filp_close' mangled-name='filp_close' filepath='fs/open.c' line='1309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filp_close'>
+        <parameter type-id='77e79a4b' name='filp' filepath='fs/open.c' line='1309' column='1'/>
+        <parameter type-id='bc5666d5' name='id' filepath='fs/open.c' line='1309' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='filp_open_block' mangled-name='filp_open_block' filepath='fs/open.c' line='1164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='filp_open_block'>
@@ -122569,30 +122392,30 @@
         <parameter type-id='2594b00f' name='mode' filepath='fs/open.c' line='1164' column='1'/>
         <return type-id='77e79a4b'/>
       </function-decl>
-      <function-decl name='find_extend_vma' mangled-name='find_extend_vma' filepath='include/linux/mm.h' line='2899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_extend_vma'>
-        <parameter type-id='df4b7819'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='find_extend_vma' mangled-name='find_extend_vma' filepath='mm/mmap.c' line='2717' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_extend_vma'>
+        <parameter type-id='df4b7819' name='mm' filepath='mm/mmap.c' line='2717' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='mm/mmap.c' line='2717' column='1'/>
         <return type-id='2ae08426'/>
       </function-decl>
-      <function-decl name='find_get_pid' mangled-name='find_get_pid' filepath='include/linux/pid.h' line='131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_get_pid'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='find_get_pid' mangled-name='find_get_pid' filepath='kernel/pid.c' line='461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_get_pid'>
+        <parameter type-id='587f89d2' name='nr' filepath='kernel/pid.c' line='461' column='1'/>
         <return type-id='b94e5398'/>
       </function-decl>
-      <function-decl name='find_last_bit' mangled-name='find_last_bit' filepath='include/linux/bitops.h' line='294' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_last_bit'>
-        <parameter type-id='f9b37274'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='find_last_bit' mangled-name='find_last_bit' filepath='lib/find_bit.c' line='140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_last_bit'>
+        <parameter type-id='f9b37274' name='addr' filepath='lib/find_bit.c' line='140' column='1'/>
+        <parameter type-id='7359adad' name='size' filepath='lib/find_bit.c' line='140' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='find_next_bit' mangled-name='find_next_bit' filepath='include/asm-generic/bitops/find.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_next_bit'>
-        <parameter type-id='f9b37274'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='find_next_bit' mangled-name='find_next_bit' filepath='lib/find_bit.c' line='76' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_next_bit'>
+        <parameter type-id='f9b37274' name='addr' filepath='lib/find_bit.c' line='76' column='1'/>
+        <parameter type-id='7359adad' name='size' filepath='lib/find_bit.c' line='76' column='1'/>
+        <parameter type-id='7359adad' name='offset' filepath='lib/find_bit.c' line='77' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='find_next_zero_bit' mangled-name='find_next_zero_bit' filepath='include/asm-generic/bitops/find.h' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_next_zero_bit'>
-        <parameter type-id='f9b37274'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='find_next_zero_bit' mangled-name='find_next_zero_bit' filepath='lib/find_bit.c' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_next_zero_bit'>
+        <parameter type-id='f9b37274' name='addr' filepath='lib/find_bit.c' line='85' column='1'/>
+        <parameter type-id='7359adad' name='size' filepath='lib/find_bit.c' line='85' column='1'/>
+        <parameter type-id='7359adad' name='offset' filepath='lib/find_bit.c' line='86' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='find_pid_ns' mangled-name='find_pid_ns' filepath='kernel/pid.c' line='309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_pid_ns'>
@@ -122608,26 +122431,26 @@
         <parameter type-id='9272847f' name='disconnect_cb' filepath='sound/usb/card.c' line='230' column='1'/>
         <return type-id='6b1642ae'/>
       </function-decl>
-      <function-decl name='find_task_by_vpid' mangled-name='find_task_by_vpid' filepath='include/linux/sched.h' line='1799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_task_by_vpid'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='find_task_by_vpid' mangled-name='find_task_by_vpid' filepath='kernel/pid.c' line='420' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_task_by_vpid'>
+        <parameter type-id='587f89d2' name='vnr' filepath='kernel/pid.c' line='420' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
       <function-decl name='find_user' mangled-name='find_user' filepath='kernel/user.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_user'>
         <parameter type-id='d80b72e6' name='uid' filepath='kernel/user.c' line='156' column='1'/>
         <return type-id='273a7d34'/>
       </function-decl>
-      <function-decl name='find_vma' mangled-name='find_vma' filepath='include/linux/mm.h' line='2818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_vma'>
-        <parameter type-id='df4b7819'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='find_vma' mangled-name='find_vma' filepath='mm/mmap.c' line='2406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_vma'>
+        <parameter type-id='df4b7819' name='mm' filepath='mm/mmap.c' line='2406' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='mm/mmap.c' line='2406' column='1'/>
         <return type-id='2ae08426'/>
       </function-decl>
-      <function-decl name='find_vpid' mangled-name='find_vpid' filepath='include/linux/pid.h' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_vpid'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='find_vpid' mangled-name='find_vpid' filepath='kernel/pid.c' line='315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='find_vpid'>
+        <parameter type-id='95e97e5e' name='nr' filepath='kernel/pid.c' line='315' column='1'/>
         <return type-id='b94e5398'/>
       </function-decl>
-      <function-decl name='finish_wait' mangled-name='finish_wait' filepath='include/linux/wait.h' line='1131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='finish_wait'>
-        <parameter type-id='3f8b2ed3'/>
-        <parameter type-id='db9d03e3'/>
+      <function-decl name='finish_wait' mangled-name='finish_wait' filepath='kernel/sched/wait.c' line='370' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='finish_wait'>
+        <parameter type-id='3f8b2ed3' name='wq_head' filepath='kernel/sched/wait.c' line='370' column='1'/>
+        <parameter type-id='db9d03e3' name='wq_entry' filepath='kernel/sched/wait.c' line='370' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='firmware_request_nowarn' mangled-name='firmware_request_nowarn' filepath='drivers/base/firmware_loader/main.c' line='895' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='firmware_request_nowarn'>
@@ -122644,8 +122467,8 @@
         <return type-id='69bf7bee'/>
       </function-decl>
       <var-decl name='flow_keys_basic_dissector' type-id='379be6ec' mangled-name='flow_keys_basic_dissector' visibility='default' filepath='net/core/flow_dissector.c' line='1792' column='1' elf-symbol-id='flow_keys_basic_dissector'/>
-      <function-decl name='flush_dcache_page' mangled-name='flush_dcache_page' filepath='arch/arm64/include/asm/cacheflush.h' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_dcache_page'>
-        <parameter type-id='02f11ed4'/>
+      <function-decl name='flush_dcache_page' mangled-name='flush_dcache_page' filepath='arch/arm64/mm/flush.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_dcache_page'>
+        <parameter type-id='02f11ed4' name='page' filepath='arch/arm64/mm/flush.c' line='70' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='flush_delayed_work' mangled-name='flush_delayed_work' filepath='kernel/workqueue.c' line='3205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_delayed_work'>
@@ -122660,8 +122483,8 @@
         <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='3085' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='flush_workqueue' mangled-name='flush_workqueue' filepath='include/linux/workqueue.h' line='460' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_workqueue'>
-        <parameter type-id='242e3d19'/>
+      <function-decl name='flush_workqueue' mangled-name='flush_workqueue' filepath='kernel/workqueue.c' line='2788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_workqueue'>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2788' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='follow_pfn' mangled-name='follow_pfn' filepath='mm/memory.c' line='5396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='follow_pfn'>
@@ -122709,18 +122532,18 @@
         <parameter type-id='bf4bdb64' name='ops' filepath='drivers/iommu/io-pgtable.c' line='59' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='free_irq' mangled-name='free_irq' filepath='include/linux/interrupt.h' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_irq'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='free_irq' mangled-name='free_irq' filepath='kernel/irq/manage.c' line='1887' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_irq'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='1887' column='1'/>
+        <parameter type-id='eaa32e2f' name='dev_id' filepath='kernel/irq/manage.c' line='1887' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='free_netdev' mangled-name='free_netdev' filepath='include/linux/netdevice.h' line='2919' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_netdev'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='free_netdev' mangled-name='free_netdev' filepath='net/core/dev.c' line='10666' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_netdev'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='10666' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='free_pages' mangled-name='free_pages' filepath='include/linux/gfp.h' line='600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_pages'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='free_pages' mangled-name='free_pages' filepath='mm/page_alloc.c' line='5180' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_pages'>
+        <parameter type-id='7359adad' name='addr' filepath='mm/page_alloc.c' line='5180' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='mm/page_alloc.c' line='5180' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='free_pages_exact' mangled-name='free_pages_exact' filepath='mm/page_alloc.c' line='5379' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_pages_exact'>
@@ -122728,13 +122551,13 @@
         <parameter type-id='b59d7dce' name='size' filepath='mm/page_alloc.c' line='5379' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='free_percpu' mangled-name='free_percpu' filepath='include/linux/percpu.h' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_percpu'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='free_percpu' mangled-name='free_percpu' filepath='mm/percpu.c' line='2080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_percpu'>
+        <parameter type-id='eaa32e2f' name='ptr' filepath='mm/percpu.c' line='2080' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='free_percpu_irq' mangled-name='free_percpu_irq' filepath='include/linux/interrupt.h' line='189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_percpu_irq'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='free_percpu_irq' mangled-name='free_percpu_irq' filepath='kernel/irq/manage.c' line='2385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_percpu_irq'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2385' column='1'/>
+        <parameter type-id='eaa32e2f' name='dev_id' filepath='kernel/irq/manage.c' line='2385' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='free_uid' mangled-name='free_uid' filepath='kernel/user.c' line='168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_uid'>
@@ -122742,9 +122565,9 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='freezer_cgrp_subsys' type-id='1d115fd5' mangled-name='freezer_cgrp_subsys' visibility='default' filepath='kernel/cgroup/legacy_freezer.c' line='473' column='1' elf-symbol-id='freezer_cgrp_subsys'/>
-      <function-decl name='freezing_slow_path' mangled-name='freezing_slow_path' filepath='include/linux/freezer.h' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='freezing_slow_path'>
-        <parameter type-id='f23e2572'/>
-        <return type-id='c894953d'/>
+      <function-decl name='freezing_slow_path' mangled-name='freezing_slow_path' filepath='kernel/freezer.c' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='freezing_slow_path'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/freezer.c' line='41' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='freq_qos_add_notifier' mangled-name='freq_qos_add_notifier' filepath='kernel/power/qos.c' line='621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='freq_qos_add_notifier'>
         <parameter type-id='1351457a' name='qos' filepath='kernel/power/qos.c' line='621' column='1'/>
@@ -122802,8 +122625,8 @@
         <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='548' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ftrace_dump' mangled-name='ftrace_dump' filepath='include/linux/kernel.h' line='812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ftrace_dump'>
-        <parameter type-id='9be0e7e4'/>
+      <function-decl name='ftrace_dump' mangled-name='ftrace_dump' filepath='kernel/trace/trace.c' line='9323' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ftrace_dump'>
+        <parameter type-id='9be0e7e4' name='oops_dump_mode' filepath='kernel/trace/trace.c' line='9323' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='full_name_hash' mangled-name='full_name_hash' filepath='fs/namei.c' line='2055' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='full_name_hash'>
@@ -122822,8 +122645,8 @@
         <parameter type-id='f0981eeb' name='index' filepath='drivers/base/property.c' line='500' column='1'/>
         <return type-id='4a935625'/>
       </function-decl>
-      <function-decl name='fwnode_get_name' mangled-name='fwnode_get_name' filepath='include/linux/property.h' line='83' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_get_name'>
-        <parameter type-id='7837cd88'/>
+      <function-decl name='fwnode_get_name' mangled-name='fwnode_get_name' filepath='drivers/base/property.c' line='565' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_get_name'>
+        <parameter type-id='7837cd88' name='fwnode' filepath='drivers/base/property.c' line='565' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
       <function-decl name='fwnode_get_named_child_node' mangled-name='fwnode_get_named_child_node' filepath='drivers/base/property.c' line='789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_get_named_child_node'>
@@ -122866,12 +122689,12 @@
         <parameter type-id='41b1c13c' name='endpoint' filepath='drivers/base/property.c' line='1226' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='fwnode_handle_get' mangled-name='fwnode_handle_get' filepath='include/linux/property.h' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_handle_get'>
-        <parameter type-id='4a935625'/>
+      <function-decl name='fwnode_handle_get' mangled-name='fwnode_handle_get' filepath='drivers/base/property.c' line='814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_handle_get'>
+        <parameter type-id='4a935625' name='fwnode' filepath='drivers/base/property.c' line='814' column='1'/>
         <return type-id='4a935625'/>
       </function-decl>
-      <function-decl name='fwnode_handle_put' mangled-name='fwnode_handle_put' filepath='include/linux/property.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_handle_put'>
-        <parameter type-id='4a935625'/>
+      <function-decl name='fwnode_handle_put' mangled-name='fwnode_handle_put' filepath='drivers/base/property.c' line='831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_handle_put'>
+        <parameter type-id='4a935625' name='fwnode' filepath='drivers/base/property.c' line='831' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='fwnode_property_get_reference_args' mangled-name='fwnode_property_get_reference_args' filepath='drivers/base/property.c' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_property_get_reference_args'>
@@ -122908,35 +122731,35 @@
         <parameter type-id='b59d7dce' name='nval' filepath='drivers/base/property.c' line='344' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='fwnode_usb_role_switch_get' mangled-name='fwnode_usb_role_switch_get' filepath='include/linux/usb/role.h' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_usb_role_switch_get'>
-        <parameter type-id='4a935625'/>
+      <function-decl name='fwnode_usb_role_switch_get' mangled-name='fwnode_usb_role_switch_get' filepath='drivers/usb/roles/class.c' line='146' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='fwnode_usb_role_switch_get'>
+        <parameter type-id='4a935625' name='fwnode' filepath='drivers/usb/roles/class.c' line='146' column='1'/>
         <return type-id='3e3cd44f'/>
       </function-decl>
-      <function-decl name='gcd' mangled-name='gcd' filepath='include/linux/gcd.h' line='7' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gcd'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='gcd' mangled-name='gcd' filepath='lib/math/gcd.c' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gcd'>
+        <parameter type-id='7359adad' name='a' filepath='lib/math/gcd.c' line='23' column='1'/>
+        <parameter type-id='7359adad' name='b' filepath='lib/math/gcd.c' line='23' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='gen_pool_add_owner' mangled-name='gen_pool_add_owner' filepath='include/linux/genalloc.h' line='98' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_add_owner'>
-        <parameter type-id='75b9415a'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='gen_pool_add_owner' mangled-name='gen_pool_add_owner' filepath='lib/genalloc.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_add_owner'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='183' column='1'/>
+        <parameter type-id='7359adad' name='virt' filepath='lib/genalloc.c' line='183' column='1'/>
+        <parameter type-id='2522883d' name='phys' filepath='lib/genalloc.c' line='183' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/genalloc.c' line='184' column='1'/>
+        <parameter type-id='95e97e5e' name='nid' filepath='lib/genalloc.c' line='184' column='1'/>
+        <parameter type-id='eaa32e2f' name='owner' filepath='lib/genalloc.c' line='184' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gen_pool_alloc_algo_owner' mangled-name='gen_pool_alloc_algo_owner' filepath='include/linux/genalloc.h' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_alloc_algo_owner'>
-        <parameter type-id='75b9415a'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f54ae583'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='63e171df'/>
+      <function-decl name='gen_pool_alloc_algo_owner' mangled-name='gen_pool_alloc_algo_owner' filepath='lib/genalloc.c' line='276' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_alloc_algo_owner'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='276' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/genalloc.c' line='276' column='1'/>
+        <parameter type-id='00278b91' name='algo' filepath='lib/genalloc.c' line='277' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='lib/genalloc.c' line='277' column='1'/>
+        <parameter type-id='63e171df' name='owner' filepath='lib/genalloc.c' line='277' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='gen_pool_avail' mangled-name='gen_pool_avail' filepath='include/linux/genalloc.h' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_avail'>
-        <parameter type-id='75b9415a'/>
-        <return type-id='7359adad'/>
+      <function-decl name='gen_pool_avail' mangled-name='gen_pool_avail' filepath='lib/genalloc.c' line='579' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_avail'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='579' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
       <function-decl name='gen_pool_best_fit' mangled-name='gen_pool_best_fit' filepath='lib/genalloc.c' line='748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_best_fit'>
         <parameter type-id='1d2c2b85' name='map' filepath='lib/genalloc.c' line='748' column='1'/>
@@ -122948,13 +122771,13 @@
         <parameter type-id='7359adad' name='start_addr' filepath='lib/genalloc.c' line='750' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='gen_pool_create' mangled-name='gen_pool_create' filepath='include/linux/genalloc.h' line='96' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_create'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='gen_pool_create' mangled-name='gen_pool_create' filepath='lib/genalloc.c' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_create'>
+        <parameter type-id='95e97e5e' name='min_alloc_order' filepath='lib/genalloc.c' line='152' column='1'/>
+        <parameter type-id='95e97e5e' name='nid' filepath='lib/genalloc.c' line='152' column='1'/>
         <return type-id='75b9415a'/>
       </function-decl>
-      <function-decl name='gen_pool_destroy' mangled-name='gen_pool_destroy' filepath='include/linux/genalloc.h' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_destroy'>
-        <parameter type-id='75b9415a'/>
+      <function-decl name='gen_pool_destroy' mangled-name='gen_pool_destroy' filepath='lib/genalloc.c' line='241' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_destroy'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='241' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='gen_pool_dma_alloc' mangled-name='gen_pool_dma_alloc' filepath='lib/genalloc.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_dma_alloc'>
@@ -122997,33 +122820,33 @@
         <parameter type-id='7359adad' name='start_addr' filepath='lib/genalloc.c' line='727' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='gen_pool_free_owner' mangled-name='gen_pool_free_owner' filepath='include/linux/genalloc.h' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_free_owner'>
-        <parameter type-id='75b9415a'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='63e171df'/>
+      <function-decl name='gen_pool_free_owner' mangled-name='gen_pool_free_owner' filepath='lib/genalloc.c' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_free_owner'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='486' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='lib/genalloc.c' line='486' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/genalloc.c' line='486' column='1'/>
+        <parameter type-id='63e171df' name='owner' filepath='lib/genalloc.c' line='487' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gen_pool_has_addr' mangled-name='gen_pool_has_addr' filepath='include/linux/genalloc.h' line='209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_has_addr'>
-        <parameter type-id='75b9415a'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='c894953d'/>
+      <function-decl name='gen_pool_has_addr' mangled-name='gen_pool_has_addr' filepath='lib/genalloc.c' line='552' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_has_addr'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='552' column='1'/>
+        <parameter type-id='7359adad' name='start' filepath='lib/genalloc.c' line='552' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/genalloc.c' line='553' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='gen_pool_set_algo' mangled-name='gen_pool_set_algo' filepath='include/linux/genalloc.h' line='180' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_set_algo'>
-        <parameter type-id='75b9415a'/>
-        <parameter type-id='f54ae583'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='gen_pool_set_algo' mangled-name='gen_pool_set_algo' filepath='lib/genalloc.c' line='621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_set_algo'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='621' column='1'/>
+        <parameter type-id='00278b91' name='algo' filepath='lib/genalloc.c' line='621' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='lib/genalloc.c' line='621' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gen_pool_size' mangled-name='gen_pool_size' filepath='include/linux/genalloc.h' line='178' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_size'>
-        <parameter type-id='75b9415a'/>
-        <return type-id='7359adad'/>
+      <function-decl name='gen_pool_size' mangled-name='gen_pool_size' filepath='lib/genalloc.c' line='598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_size'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='598' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
-      <function-decl name='gen_pool_virt_to_phys' mangled-name='gen_pool_virt_to_phys' filepath='include/linux/genalloc.h' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_virt_to_phys'>
-        <parameter type-id='75b9415a'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='gen_pool_virt_to_phys' mangled-name='gen_pool_virt_to_phys' filepath='lib/genalloc.c' line='216' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gen_pool_virt_to_phys'>
+        <parameter type-id='75b9415a' name='pool' filepath='lib/genalloc.c' line='216' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='lib/genalloc.c' line='216' column='1'/>
+        <return type-id='2522883d'/>
       </function-decl>
       <function-decl name='generic_delete_inode' mangled-name='generic_delete_inode' filepath='fs/inode.c' line='1600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_delete_inode'>
         <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1600' column='1'/>
@@ -123044,8 +122867,8 @@
         <parameter type-id='4fa10f9e' name='iter' filepath='mm/filemap.c' line='2515' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='generic_handle_irq' mangled-name='generic_handle_irq' filepath='include/linux/irqdesc.h' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_handle_irq'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='generic_handle_irq' mangled-name='generic_handle_irq' filepath='kernel/irq/irqdesc.c' line='638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_handle_irq'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/irqdesc.c' line='638' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='generic_iommu_put_resv_regions' mangled-name='generic_iommu_put_resv_regions' filepath='drivers/iommu/iommu.c' line='2811' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_iommu_put_resv_regions'>
@@ -123070,10 +122893,10 @@
         <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='442' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='generic_write_checks' mangled-name='generic_write_checks' filepath='include/linux/fs.h' line='3023' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_write_checks'>
-        <parameter type-id='80f25feb'/>
-        <parameter type-id='4fa10f9e'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='generic_write_checks' mangled-name='generic_write_checks' filepath='fs/read_write.c' line='1635' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_write_checks'>
+        <parameter type-id='80f25feb' name='iocb' filepath='fs/read_write.c' line='1635' column='1'/>
+        <parameter type-id='4fa10f9e' name='from' filepath='fs/read_write.c' line='1635' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='genl_notify' mangled-name='genl_notify' filepath='net/netlink/genetlink.c' line='1461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genl_notify'>
         <parameter type-id='63d7819b' name='family' filepath='net/netlink/genetlink.c' line='1461' column='1'/>
@@ -123083,12 +122906,12 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='net/netlink/genetlink.c' line='1462' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='genl_register_family' mangled-name='genl_register_family' filepath='include/net/genetlink.h' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genl_register_family'>
-        <parameter type-id='8f6b937a'/>
+      <function-decl name='genl_register_family' mangled-name='genl_register_family' filepath='net/netlink/genetlink.c' line='392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genl_register_family'>
+        <parameter type-id='8f6b937a' name='family' filepath='net/netlink/genetlink.c' line='392' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='genl_unregister_family' mangled-name='genl_unregister_family' filepath='include/net/genetlink.h' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genl_unregister_family'>
-        <parameter type-id='63d7819b'/>
+      <function-decl name='genl_unregister_family' mangled-name='genl_unregister_family' filepath='net/netlink/genetlink.c' line='461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genl_unregister_family'>
+        <parameter type-id='63d7819b' name='family' filepath='net/netlink/genetlink.c' line='461' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='genlmsg_multicast_allns' mangled-name='genlmsg_multicast_allns' filepath='net/netlink/genetlink.c' line='1450' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genlmsg_multicast_allns'>
@@ -123099,17 +122922,17 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='net/netlink/genetlink.c' line='1452' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='genlmsg_put' mangled-name='genlmsg_put' filepath='include/net/genetlink.h' line='191' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genlmsg_put'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='63d7819b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='002ac4a6'/>
+      <function-decl name='genlmsg_put' mangled-name='genlmsg_put' filepath='net/netlink/genetlink.c' line='496' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genlmsg_put'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/netlink/genetlink.c' line='496' column='1'/>
+        <parameter type-id='19c2251e' name='portid' filepath='net/netlink/genetlink.c' line='496' column='1'/>
+        <parameter type-id='19c2251e' name='seq' filepath='net/netlink/genetlink.c' line='496' column='1'/>
+        <parameter type-id='63d7819b' name='family' filepath='net/netlink/genetlink.c' line='497' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/netlink/genetlink.c' line='497' column='1'/>
+        <parameter type-id='f9b06939' name='cmd' filepath='net/netlink/genetlink.c' line='497' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='genphy_aneg_done' mangled-name='genphy_aneg_done' filepath='include/linux/phy.h' line='1485' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genphy_aneg_done'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='genphy_aneg_done' mangled-name='genphy_aneg_done' filepath='drivers/net/phy/phy_device.c' line='2173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genphy_aneg_done'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='2173' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='genphy_read_abilities' mangled-name='genphy_read_abilities' filepath='drivers/net/phy/phy_device.c' line='2463' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genphy_read_abilities'>
@@ -123126,8 +122949,8 @@
         <parameter type-id='1dc6a898' name='regnum' filepath='drivers/net/phy/phy_device.c' line='2508' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='genphy_read_status' mangled-name='genphy_read_status' filepath='include/linux/phy.h' line='1489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genphy_read_status'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='genphy_read_status' mangled-name='genphy_read_status' filepath='drivers/net/phy/phy_device.c' line='2320' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genphy_read_status'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='2320' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='genphy_resume' mangled-name='genphy_resume' filepath='drivers/net/phy/phy_device.c' line='2527' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='genphy_resume'>
@@ -123153,15 +122976,15 @@
         <parameter type-id='1dc6a898' name='val' filepath='drivers/net/phy/phy_device.c' line='2515' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_cpu_device' mangled-name='get_cpu_device' filepath='include/linux/cpu.h' line='38' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_device'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='get_cpu_device' mangled-name='get_cpu_device' filepath='drivers/base/cpu.c' line='391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_device'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/base/cpu.c' line='391' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='get_cpu_idle_time' mangled-name='get_cpu_idle_time' filepath='include/linux/cpufreq.h' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_idle_time'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c0190993'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='get_cpu_idle_time' mangled-name='get_cpu_idle_time' filepath='drivers/cpufreq/cpufreq.c' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_idle_time'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='152' column='1'/>
+        <parameter type-id='3df9fd28' name='wall' filepath='drivers/cpufreq/cpufreq.c' line='152' column='1'/>
+        <parameter type-id='95e97e5e' name='io_busy' filepath='drivers/cpufreq/cpufreq.c' line='152' column='1'/>
+        <return type-id='91ce1af9'/>
       </function-decl>
       <function-decl name='get_cpu_idle_time_us' mangled-name='get_cpu_idle_time_us' filepath='kernel/time/tick-sched.c' line='594' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_cpu_idle_time_us'>
         <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='594' column='1'/>
@@ -123173,8 +122996,8 @@
         <parameter type-id='3df9fd28' name='last_update_time' filepath='kernel/time/tick-sched.c' line='635' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='get_device' mangled-name='get_device' filepath='include/linux/device.h' line='925' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_device'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='get_device' mangled-name='get_device' filepath='drivers/base/core.c' line='3327' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='3327' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
       <function-decl name='get_device_system_crosststamp' mangled-name='get_device_system_crosststamp' filepath='kernel/time/timekeeping.c' line='1190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_device_system_crosststamp'>
@@ -123200,8 +123023,8 @@
       <function-decl name='get_freelist_nr_pages' mangled-name='get_freelist_nr_pages' filepath='drivers/dma-buf/heaps/deferred-free-helper.c' line='65' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_freelist_nr_pages'>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='get_governor_parent_kobj' mangled-name='get_governor_parent_kobj' filepath='include/linux/cpufreq.h' line='227' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_governor_parent_kobj'>
-        <parameter type-id='343c3ae4'/>
+      <function-decl name='get_governor_parent_kobj' mangled-name='get_governor_parent_kobj' filepath='drivers/cpufreq/cpufreq.c' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_governor_parent_kobj'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='118' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
       <function-decl name='get_kernel_pages' mangled-name='get_kernel_pages' filepath='mm/swap.c' line='169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_kernel_pages'>
@@ -123211,20 +123034,20 @@
         <parameter type-id='9f93c9da' name='pages' filepath='mm/swap.c' line='170' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_net_ns_by_fd' mangled-name='get_net_ns_by_fd' filepath='include/net/net_namespace.h' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_net_ns_by_fd'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='get_net_ns_by_fd' mangled-name='get_net_ns_by_fd' filepath='net/core/net_namespace.c' line='665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_net_ns_by_fd'>
+        <parameter type-id='95e97e5e' name='fd' filepath='net/core/net_namespace.c' line='665' column='1'/>
         <return type-id='a2bff676'/>
       </function-decl>
       <function-decl name='get_net_ns_by_pid' mangled-name='get_net_ns_by_pid' filepath='net/core/net_namespace.c' line='693' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_net_ns_by_pid'>
         <parameter type-id='587f89d2' name='pid' filepath='net/core/net_namespace.c' line='693' column='1'/>
         <return type-id='a2bff676'/>
       </function-decl>
-      <function-decl name='get_next_ino' mangled-name='get_next_ino' filepath='include/linux/fs.h' line='2975' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_next_ino'>
+      <function-decl name='get_next_ino' mangled-name='get_next_ino' filepath='fs/inode.c' line='894' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_next_ino'>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='get_option' mangled-name='get_option' filepath='include/linux/kernel.h' line='498' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_option'>
-        <parameter type-id='9b23c9ad'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='get_option' mangled-name='get_option' filepath='lib/cmdline.c' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_option'>
+        <parameter type-id='9b23c9ad' name='str' filepath='lib/cmdline.c' line='50' column='1'/>
+        <parameter type-id='7292109c' name='pint' filepath='lib/cmdline.c' line='50' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='get_options' mangled-name='get_options' filepath='lib/cmdline.c' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_options'>
@@ -123238,41 +123061,41 @@
         <parameter type-id='7359adad' name='pfn' filepath='mm/page_owner.c' line='108' column='1'/>
         <return type-id='613ae993'/>
       </function-decl>
-      <function-decl name='get_pfnblock_flags_mask' mangled-name='get_pfnblock_flags_mask' filepath='include/linux/pageblock-flags.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_pfnblock_flags_mask'>
-        <parameter type-id='02f11ed4'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='get_pfnblock_flags_mask' mangled-name='get_pfnblock_flags_mask' filepath='mm/page_alloc.c' line='531' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_pfnblock_flags_mask'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/page_alloc.c' line='531' column='1'/>
+        <parameter type-id='7359adad' name='pfn' filepath='mm/page_alloc.c' line='531' column='1'/>
+        <parameter type-id='7359adad' name='mask' filepath='mm/page_alloc.c' line='532' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='get_pid_task' mangled-name='get_pid_task' filepath='include/linux/pid.h' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_pid_task'>
-        <parameter type-id='b94e5398'/>
-        <parameter type-id='ce78cf46'/>
+      <function-decl name='get_pid_task' mangled-name='get_pid_task' filepath='kernel/pid.c' line='449' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_pid_task'>
+        <parameter type-id='b94e5398' name='pid' filepath='kernel/pid.c' line='449' column='1'/>
+        <parameter type-id='ce78cf46' name='type' filepath='kernel/pid.c' line='449' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
-      <function-decl name='get_random_bytes' mangled-name='get_random_bytes' filepath='include/linux/random.h' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_bytes'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='get_random_bytes' mangled-name='get_random_bytes' filepath='drivers/char/random.c' line='1570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_bytes'>
+        <parameter type-id='eaa32e2f' name='buf' filepath='drivers/char/random.c' line='1570' column='1'/>
+        <parameter type-id='95e97e5e' name='nbytes' filepath='drivers/char/random.c' line='1570' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='get_random_bytes_arch' mangled-name='get_random_bytes_arch' filepath='include/linux/random.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_bytes_arch'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='get_random_bytes_arch' mangled-name='get_random_bytes_arch' filepath='drivers/char/random.c' line='1742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_bytes_arch'>
+        <parameter type-id='eaa32e2f' name='buf' filepath='drivers/char/random.c' line='1742' column='1'/>
+        <parameter type-id='95e97e5e' name='nbytes' filepath='drivers/char/random.c' line='1742' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_random_u32' mangled-name='get_random_u32' filepath='include/linux/random.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_u32'>
-        <return type-id='f0981eeb'/>
+      <function-decl name='get_random_u32' mangled-name='get_random_u32' filepath='drivers/char/random.c' line='2214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_u32'>
+        <return type-id='19c2251e'/>
       </function-decl>
-      <function-decl name='get_random_u64' mangled-name='get_random_u64' filepath='include/linux/random.h' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_u64'>
-        <return type-id='3a47d82b'/>
+      <function-decl name='get_random_u64' mangled-name='get_random_u64' filepath='drivers/char/random.c' line='2190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_random_u64'>
+        <return type-id='91ce1af9'/>
       </function-decl>
       <function-decl name='get_sg_io_hdr' mangled-name='get_sg_io_hdr' filepath='block/scsi_ioctl.c' line='591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_sg_io_hdr'>
         <parameter type-id='75d4b09d' name='hdr' filepath='block/scsi_ioctl.c' line='591' column='1'/>
         <parameter type-id='eaa32e2f' name='argp' filepath='block/scsi_ioctl.c' line='591' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_slabinfo' mangled-name='get_slabinfo' filepath='mm/slab.h' line='213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_slabinfo'>
-        <parameter type-id='f3b4aca8'/>
-        <parameter type-id='d225de01'/>
+      <function-decl name='get_slabinfo' mangled-name='get_slabinfo' filepath='mm/slub.c' line='5872' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_slabinfo'>
+        <parameter type-id='f3b4aca8' name='s' filepath='mm/slub.c' line='5872' column='1'/>
+        <parameter type-id='d225de01' name='sinfo' filepath='mm/slub.c' line='5872' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='get_state_synchronize_rcu' mangled-name='get_state_synchronize_rcu' filepath='kernel/rcu/tree.c' line='3688' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_state_synchronize_rcu'>
@@ -123282,13 +123105,13 @@
         <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1225' column='1'/>
         <return type-id='77e79a4b'/>
       </function-decl>
-      <function-decl name='get_task_mm' mangled-name='get_task_mm' filepath='include/linux/sched/mm.h' line='88' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_mm'>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='get_task_mm' mangled-name='get_task_mm' filepath='kernel/fork.c' line='1250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_mm'>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1250' column='1'/>
         <return type-id='df4b7819'/>
       </function-decl>
-      <function-decl name='get_task_pid' mangled-name='get_task_pid' filepath='include/linux/pid.h' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_pid'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='ce78cf46'/>
+      <function-decl name='get_task_pid' mangled-name='get_task_pid' filepath='kernel/pid.c' line='439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_pid'>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/pid.c' line='439' column='1'/>
+        <parameter type-id='ce78cf46' name='type' filepath='kernel/pid.c' line='439' column='1'/>
         <return type-id='b94e5398'/>
       </function-decl>
       <function-decl name='get_thermal_instance' mangled-name='get_thermal_instance' filepath='drivers/thermal/thermal_helpers.c' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_thermal_instance'>
@@ -123302,41 +123125,41 @@
         <parameter type-id='30341fa1' name='fill_super' filepath='fs/super.c' line='1226' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_unmapped_area' mangled-name='get_unmapped_area' filepath='include/linux/mm.h' line='2739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_unmapped_area'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='get_unmapped_area' mangled-name='get_unmapped_area' filepath='mm/mmap.c' line='2337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_unmapped_area'>
+        <parameter type-id='77e79a4b' name='file' filepath='mm/mmap.c' line='2337' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='mm/mmap.c' line='2337' column='1'/>
+        <parameter type-id='7359adad' name='len' filepath='mm/mmap.c' line='2337' column='1'/>
+        <parameter type-id='7359adad' name='pgoff' filepath='mm/mmap.c' line='2338' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='mm/mmap.c' line='2338' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='get_unused_fd_flags' mangled-name='get_unused_fd_flags' filepath='include/linux/file.h' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_unused_fd_flags'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='get_unused_fd_flags' mangled-name='get_unused_fd_flags' filepath='fs/file.c' line='561' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_unused_fd_flags'>
+        <parameter type-id='f0981eeb' name='flags' filepath='fs/file.c' line='561' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_user_pages' mangled-name='get_user_pages' filepath='include/linux/mm.h' line='1884' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_user_pages'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='9f93c9da'/>
-        <parameter type-id='8b6fdee4'/>
+      <function-decl name='get_user_pages' mangled-name='get_user_pages' filepath='mm/gup.c' line='1947' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_user_pages'>
+        <parameter type-id='7359adad' name='start' filepath='mm/gup.c' line='1947' column='1'/>
+        <parameter type-id='7359adad' name='nr_pages' filepath='mm/gup.c' line='1947' column='1'/>
+        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/gup.c' line='1948' column='1'/>
+        <parameter type-id='9f93c9da' name='pages' filepath='mm/gup.c' line='1948' column='1'/>
+        <parameter type-id='8b6fdee4' name='vmas' filepath='mm/gup.c' line='1949' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='get_user_pages_fast' mangled-name='get_user_pages_fast' filepath='include/linux/mm.h' line='1899' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_user_pages_fast'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='9f93c9da'/>
+      <function-decl name='get_user_pages_fast' mangled-name='get_user_pages_fast' filepath='mm/gup.c' line='2842' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_user_pages_fast'>
+        <parameter type-id='7359adad' name='start' filepath='mm/gup.c' line='2842' column='1'/>
+        <parameter type-id='95e97e5e' name='nr_pages' filepath='mm/gup.c' line='2842' column='1'/>
+        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/gup.c' line='2843' column='1'/>
+        <parameter type-id='9f93c9da' name='pages' filepath='mm/gup.c' line='2843' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_user_pages_remote' mangled-name='get_user_pages_remote' filepath='include/linux/mm.h' line='1876' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_user_pages_remote'>
-        <parameter type-id='df4b7819'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='9f93c9da'/>
-        <parameter type-id='8b6fdee4'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='get_user_pages_remote' mangled-name='get_user_pages_remote' filepath='mm/gup.c' line='1900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_user_pages_remote'>
+        <parameter type-id='df4b7819' name='mm' filepath='mm/gup.c' line='1900' column='1'/>
+        <parameter type-id='7359adad' name='start' filepath='mm/gup.c' line='1901' column='1'/>
+        <parameter type-id='7359adad' name='nr_pages' filepath='mm/gup.c' line='1901' column='1'/>
+        <parameter type-id='f0981eeb' name='gup_flags' filepath='mm/gup.c' line='1902' column='1'/>
+        <parameter type-id='9f93c9da' name='pages' filepath='mm/gup.c' line='1902' column='1'/>
+        <parameter type-id='8b6fdee4' name='vmas' filepath='mm/gup.c' line='1903' column='1'/>
+        <parameter type-id='7292109c' name='locked' filepath='mm/gup.c' line='1903' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
       <function-decl name='get_vaddr_frames' mangled-name='get_vaddr_frames' filepath='mm/frame_vector.c' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_vaddr_frames'>
@@ -123346,8 +123169,8 @@
         <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='35' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='get_zeroed_page' mangled-name='get_zeroed_page' filepath='include/linux/gfp.h' line='587' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_zeroed_page'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='get_zeroed_page' mangled-name='get_zeroed_page' filepath='mm/page_alloc.c' line='5156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_zeroed_page'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='mm/page_alloc.c' line='5156' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='getboottime64' mangled-name='getboottime64' filepath='kernel/time/timekeeping.c' line='2224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='getboottime64'>
@@ -123359,18 +123182,18 @@
         <parameter type-id='2a82ed9c' name='b' filepath='crypto/gf128mul.c' line='170' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gfp_zone' mangled-name='gfp_zone' filepath='include/linux/gfp.h' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gfp_zone'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='gfp_zone' mangled-name='gfp_zone' filepath='mm/mmzone.c' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gfp_zone'>
+        <parameter type-id='3eb7c31c' name='flags' filepath='mm/mmzone.c' line='119' column='1'/>
         <return type-id='d278ff03'/>
       </function-decl>
       <var-decl name='gic_nonsecure_priorities' type-id='237c0d27' mangled-name='gic_nonsecure_priorities' visibility='default' filepath='drivers/irqchip/irq-gic-v3.c' line='92' column='1' elf-symbol-id='gic_nonsecure_priorities'/>
       <function-decl name='gic_resume' mangled-name='gic_resume' filepath='drivers/irqchip/irq-gic-v3.c' line='1311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gic_resume'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='glob_match' mangled-name='glob_match' filepath='include/linux/glob.h' line='8' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='glob_match'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <return type-id='c894953d'/>
+      <function-decl name='glob_match' mangled-name='glob_match' filepath='lib/glob.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='glob_match'>
+        <parameter type-id='80f4b756' name='pat' filepath='lib/glob.c' line='40' column='1'/>
+        <parameter type-id='80f4b756' name='str' filepath='lib/glob.c' line='40' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='gnss_allocate_device' mangled-name='gnss_allocate_device' filepath='drivers/gnss/core.c' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gnss_allocate_device'>
         <parameter type-id='fa0b179b' name='parent' filepath='drivers/gnss/core.c' line='224' column='1'/>
@@ -123394,19 +123217,19 @@
         <parameter type-id='94411a61' name='gdev' filepath='drivers/gnss/core.c' line='283' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gov_attr_set_get' mangled-name='gov_attr_set_get' filepath='include/linux/cpufreq.h' line='647' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gov_attr_set_get'>
-        <parameter type-id='902fed1a'/>
-        <parameter type-id='e84b031a'/>
+      <function-decl name='gov_attr_set_get' mangled-name='gov_attr_set_get' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gov_attr_set_get'>
+        <parameter type-id='902fed1a' name='attr_set' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='57' column='1'/>
+        <parameter type-id='e84b031a' name='list_node' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='57' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gov_attr_set_init' mangled-name='gov_attr_set_init' filepath='include/linux/cpufreq.h' line='646' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gov_attr_set_init'>
-        <parameter type-id='902fed1a'/>
-        <parameter type-id='e84b031a'/>
+      <function-decl name='gov_attr_set_init' mangled-name='gov_attr_set_init' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='48' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gov_attr_set_init'>
+        <parameter type-id='902fed1a' name='attr_set' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='48' column='1'/>
+        <parameter type-id='e84b031a' name='list_node' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='48' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gov_attr_set_put' mangled-name='gov_attr_set_put' filepath='include/linux/cpufreq.h' line='648' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gov_attr_set_put'>
-        <parameter type-id='902fed1a'/>
-        <parameter type-id='e84b031a'/>
+      <function-decl name='gov_attr_set_put' mangled-name='gov_attr_set_put' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gov_attr_set_put'>
+        <parameter type-id='902fed1a' name='attr_set' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='66' column='1'/>
+        <parameter type-id='e84b031a' name='list_node' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='66' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <var-decl name='governor_sysfs_ops' type-id='0f840455' mangled-name='governor_sysfs_ops' visibility='default' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='42' column='1' elf-symbol-id='governor_sysfs_ops'/>
@@ -123419,9 +123242,9 @@
         <parameter type-id='b59d7dce' name='num' filepath='drivers/gpio/gpiolib-legacy.c' line='108' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gpio_request' mangled-name='gpio_request' filepath='include/asm-generic/gpio.h' line='65' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_request'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='gpio_request' mangled-name='gpio_request' filepath='drivers/gpio/gpiolib-legacy.c' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_request'>
+        <parameter type-id='f0981eeb' name='gpio' filepath='drivers/gpio/gpiolib-legacy.c' line='68' column='1'/>
+        <parameter type-id='80f4b756' name='label' filepath='drivers/gpio/gpiolib-legacy.c' line='68' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='gpio_request_array' mangled-name='gpio_request_array' filepath='drivers/gpio/gpiolib-legacy.c' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_request_array'>
@@ -123429,29 +123252,29 @@
         <parameter type-id='b59d7dce' name='num' filepath='drivers/gpio/gpiolib-legacy.c' line='85' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gpio_request_one' mangled-name='gpio_request_one' filepath='include/asm-generic/gpio.h' line='115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_request_one'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='gpio_request_one' mangled-name='gpio_request_one' filepath='drivers/gpio/gpiolib-legacy.c' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_request_one'>
+        <parameter type-id='f0981eeb' name='gpio' filepath='drivers/gpio/gpiolib-legacy.c' line='21' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='drivers/gpio/gpiolib-legacy.c' line='21' column='1'/>
+        <parameter type-id='80f4b756' name='label' filepath='drivers/gpio/gpiolib-legacy.c' line='21' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gpio_to_desc' mangled-name='gpio_to_desc' filepath='include/linux/gpio/consumer.h' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_to_desc'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='gpio_to_desc' mangled-name='gpio_to_desc' filepath='drivers/gpio/gpiolib.c' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_to_desc'>
+        <parameter type-id='f0981eeb' name='gpio' filepath='drivers/gpio/gpiolib.c' line='108' column='1'/>
         <return type-id='26760480'/>
       </function-decl>
-      <function-decl name='gpiochip_add_data_with_key' mangled-name='gpiochip_add_data_with_key' filepath='include/linux/gpio/driver.h' line='501' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_add_data_with_key'>
-        <parameter type-id='e324928d'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='a57283f9'/>
-        <parameter type-id='a57283f9'/>
+      <function-decl name='gpiochip_add_data_with_key' mangled-name='gpiochip_add_data_with_key' filepath='drivers/gpio/gpiolib.c' line='571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_add_data_with_key'>
+        <parameter type-id='e324928d' name='gc' filepath='drivers/gpio/gpiolib.c' line='571' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/gpio/gpiolib.c' line='571' column='1'/>
+        <parameter type-id='a57283f9' name='lock_key' filepath='drivers/gpio/gpiolib.c' line='572' column='1'/>
+        <parameter type-id='a57283f9' name='request_key' filepath='drivers/gpio/gpiolib.c' line='573' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gpiochip_add_pin_range' mangled-name='gpiochip_add_pin_range' filepath='include/linux/gpio/driver.h' line='736' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_add_pin_range'>
-        <parameter type-id='e324928d'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='gpiochip_add_pin_range' mangled-name='gpiochip_add_pin_range' filepath='drivers/gpio/gpiolib.c' line='1918' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_add_pin_range'>
+        <parameter type-id='e324928d' name='gc' filepath='drivers/gpio/gpiolib.c' line='1918' column='1'/>
+        <parameter type-id='80f4b756' name='pinctl_name' filepath='drivers/gpio/gpiolib.c' line='1918' column='1'/>
+        <parameter type-id='f0981eeb' name='gpio_offset' filepath='drivers/gpio/gpiolib.c' line='1919' column='1'/>
+        <parameter type-id='f0981eeb' name='pin_offset' filepath='drivers/gpio/gpiolib.c' line='1919' column='1'/>
+        <parameter type-id='f0981eeb' name='npins' filepath='drivers/gpio/gpiolib.c' line='1920' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='gpiochip_find' mangled-name='gpiochip_find' filepath='drivers/gpio/gpiolib.c' line='870' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_find'>
@@ -123484,9 +123307,9 @@
         <parameter type-id='f0981eeb' name='offset' filepath='drivers/gpio/gpiolib.c' line='463' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='gpiochip_lock_as_irq' mangled-name='gpiochip_lock_as_irq' filepath='include/linux/gpio/driver.h' line='778' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_lock_as_irq'>
-        <parameter type-id='e324928d'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='gpiochip_lock_as_irq' mangled-name='gpiochip_lock_as_irq' filepath='drivers/gpio/gpiolib.c' line='3231' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_lock_as_irq'>
+        <parameter type-id='e324928d' name='gc' filepath='drivers/gpio/gpiolib.c' line='3231' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='drivers/gpio/gpiolib.c' line='3231' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='gpiochip_populate_parent_fwspec_fourcell' mangled-name='gpiochip_populate_parent_fwspec_fourcell' filepath='drivers/gpio/gpiolib.c' line='1266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_populate_parent_fwspec_fourcell'>
@@ -123495,13 +123318,13 @@
         <parameter type-id='f0981eeb' name='parent_type' filepath='drivers/gpio/gpiolib.c' line='1268' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='gpiochip_remove' mangled-name='gpiochip_remove' filepath='include/linux/gpio/driver.h' line='551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_remove'>
-        <parameter type-id='e324928d'/>
+      <function-decl name='gpiochip_remove' mangled-name='gpiochip_remove' filepath='drivers/gpio/gpiolib.c' line='815' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_remove'>
+        <parameter type-id='e324928d' name='gc' filepath='drivers/gpio/gpiolib.c' line='815' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gpiochip_unlock_as_irq' mangled-name='gpiochip_unlock_as_irq' filepath='include/linux/gpio/driver.h' line='779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_unlock_as_irq'>
-        <parameter type-id='e324928d'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='gpiochip_unlock_as_irq' mangled-name='gpiochip_unlock_as_irq' filepath='drivers/gpio/gpiolib.c' line='3285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiochip_unlock_as_irq'>
+        <parameter type-id='e324928d' name='gc' filepath='drivers/gpio/gpiolib.c' line='3285' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='drivers/gpio/gpiolib.c' line='3285' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='gpiod_cansleep' mangled-name='gpiod_cansleep' filepath='drivers/gpio/gpiolib.c' line='3160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiod_cansleep'>
@@ -123590,8 +123413,8 @@
         <parameter type-id='95e97e5e' name='value' filepath='drivers/gpio/gpiolib.c' line='3513' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='gpiod_to_chip' mangled-name='gpiod_to_chip' filepath='include/linux/gpio/driver.h' line='782' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiod_to_chip'>
-        <parameter type-id='5bed570d'/>
+      <function-decl name='gpiod_to_chip' mangled-name='gpiod_to_chip' filepath='drivers/gpio/gpiolib.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiod_to_chip'>
+        <parameter type-id='5bed570d' name='desc' filepath='drivers/gpio/gpiolib.c' line='175' column='1'/>
         <return type-id='e324928d'/>
       </function-decl>
       <function-decl name='gpiod_to_irq' mangled-name='gpiod_to_irq' filepath='drivers/gpio/gpiolib.c' line='3195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiod_to_irq'>
@@ -123616,13 +123439,13 @@
         <parameter type-id='cf536864' name='line_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1261' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gserial_connect' mangled-name='gserial_connect' filepath='drivers/usb/gadget/function/u_serial.h' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_connect'>
-        <parameter type-id='3921c1a0'/>
-        <parameter type-id='002ac4a6'/>
+      <function-decl name='gserial_connect' mangled-name='gserial_connect' filepath='drivers/usb/gadget/function/u_serial.c' line='1293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_connect'>
+        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1293' column='1'/>
+        <parameter type-id='f9b06939' name='port_num' filepath='drivers/usb/gadget/function/u_serial.c' line='1293' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='gserial_disconnect' mangled-name='gserial_disconnect' filepath='drivers/usb/gadget/function/u_serial.h' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_disconnect'>
-        <parameter type-id='3921c1a0'/>
+      <function-decl name='gserial_disconnect' mangled-name='gserial_disconnect' filepath='drivers/usb/gadget/function/u_serial.c' line='1369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gserial_disconnect'>
+        <parameter type-id='3921c1a0' name='gser' filepath='drivers/usb/gadget/function/u_serial.c' line='1369' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='guid_gen' mangled-name='guid_gen' filepath='lib/uuid.c' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='guid_gen'>
@@ -123667,27 +123490,27 @@
         <parameter type-id='80f4b756' name='name' filepath='fs/namei.c' line='2076' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='have_governor_per_policy' mangled-name='have_governor_per_policy' filepath='include/linux/cpufreq.h' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='have_governor_per_policy'>
-        <return type-id='c894953d'/>
+      <function-decl name='have_governor_per_policy' mangled-name='have_governor_per_policy' filepath='drivers/cpufreq/cpufreq.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='have_governor_per_policy'>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='hci_alloc_dev' mangled-name='hci_alloc_dev' filepath='include/net/bluetooth/hci_core.h' line='1203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_alloc_dev'>
+      <function-decl name='hci_alloc_dev' mangled-name='hci_alloc_dev' filepath='net/bluetooth/hci_core.c' line='3589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_alloc_dev'>
         <return type-id='9ad862e7'/>
       </function-decl>
-      <function-decl name='hci_free_dev' mangled-name='hci_free_dev' filepath='net/bluetooth/hci_core.c' line='3709' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_free_dev'>
-        <parameter type-id='9ad862e7' name='hdev' filepath='net/bluetooth/hci_core.c' line='3709' column='1'/>
+      <function-decl name='hci_free_dev' mangled-name='hci_free_dev' filepath='net/bluetooth/hci_core.c' line='3701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_free_dev'>
+        <parameter type-id='9ad862e7' name='hdev' filepath='net/bluetooth/hci_core.c' line='3701' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='hci_recv_frame' mangled-name='hci_recv_frame' filepath='include/net/bluetooth/hci_core.h' line='1211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_recv_frame'>
-        <parameter type-id='9ad862e7'/>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='hci_recv_frame' mangled-name='hci_recv_frame' filepath='net/bluetooth/hci_core.c' line='3933' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_recv_frame'>
+        <parameter type-id='9ad862e7' name='hdev' filepath='net/bluetooth/hci_core.c' line='3933' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/bluetooth/hci_core.c' line='3933' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hci_register_dev' mangled-name='hci_register_dev' filepath='include/net/bluetooth/hci_core.h' line='1205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_register_dev'>
-        <parameter type-id='9ad862e7'/>
+      <function-decl name='hci_register_dev' mangled-name='hci_register_dev' filepath='net/bluetooth/hci_core.c' line='3709' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_register_dev'>
+        <parameter type-id='9ad862e7' name='hdev' filepath='net/bluetooth/hci_core.c' line='3709' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hci_unregister_dev' mangled-name='hci_unregister_dev' filepath='include/net/bluetooth/hci_core.h' line='1206' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_unregister_dev'>
-        <parameter type-id='9ad862e7'/>
+      <function-decl name='hci_unregister_dev' mangled-name='hci_unregister_dev' filepath='net/bluetooth/hci_core.c' line='3823' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hci_unregister_dev'>
+        <parameter type-id='9ad862e7' name='hdev' filepath='net/bluetooth/hci_core.c' line='3823' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='hdmi_audio_infoframe_init' mangled-name='hdmi_audio_infoframe_init' filepath='drivers/video/hdmi.c' line='349' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hdmi_audio_infoframe_init'>
@@ -123738,38 +123561,38 @@
         <parameter type-id='b59d7dce' name='size' filepath='drivers/video/hdmi.c' line='627' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='hex2bin' mangled-name='hex2bin' filepath='include/linux/kernel.h' line='639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hex2bin'>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='hex2bin' mangled-name='hex2bin' filepath='lib/hexdump.c' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hex2bin'>
+        <parameter type-id='8bff8096' name='dst' filepath='lib/hexdump.c' line='45' column='1'/>
+        <parameter type-id='80f4b756' name='src' filepath='lib/hexdump.c' line='45' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/hexdump.c' line='45' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='hex_asc' type-id='8945ea40' mangled-name='hex_asc' visibility='default' filepath='lib/hexdump.c' line='14' column='1' elf-symbol-id='hex_asc'/>
       <var-decl name='hex_asc_upper' type-id='8945ea40' mangled-name='hex_asc_upper' visibility='default' filepath='lib/hexdump.c' line='16' column='1' elf-symbol-id='hex_asc_upper'/>
-      <function-decl name='hex_dump_to_buffer' mangled-name='hex_dump_to_buffer' filepath='include/linux/printk.h' line='577' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hex_dump_to_buffer'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='hex_dump_to_buffer' mangled-name='hex_dump_to_buffer' filepath='lib/hexdump.c' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hex_dump_to_buffer'>
+        <parameter type-id='eaa32e2f' name='buf' filepath='lib/hexdump.c' line='106' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='lib/hexdump.c' line='106' column='1'/>
+        <parameter type-id='95e97e5e' name='rowsize' filepath='lib/hexdump.c' line='106' column='1'/>
+        <parameter type-id='95e97e5e' name='groupsize' filepath='lib/hexdump.c' line='106' column='1'/>
+        <parameter type-id='26a90f95' name='linebuf' filepath='lib/hexdump.c' line='107' column='1'/>
+        <parameter type-id='b59d7dce' name='linebuflen' filepath='lib/hexdump.c' line='107' column='1'/>
+        <parameter type-id='b50a4934' name='ascii' filepath='lib/hexdump.c' line='107' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hex_to_bin' mangled-name='hex_to_bin' filepath='include/linux/kernel.h' line='638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hex_to_bin'>
-        <parameter type-id='a84c031d'/>
+      <function-decl name='hex_to_bin' mangled-name='hex_to_bin' filepath='lib/hexdump.c' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hex_to_bin'>
+        <parameter type-id='a84c031d' name='ch' filepath='lib/hexdump.c' line='26' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hid_add_device' mangled-name='hid_add_device' filepath='include/linux/hid.h' line='852' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_add_device'>
-        <parameter type-id='37175e4d'/>
+      <function-decl name='hid_add_device' mangled-name='hid_add_device' filepath='drivers/hid/hid-core.c' line='2388' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_add_device'>
+        <parameter type-id='37175e4d' name='hdev' filepath='drivers/hid/hid-core.c' line='2388' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hid_allocate_device' mangled-name='hid_allocate_device' filepath='include/linux/hid.h' line='892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_allocate_device'>
+      <function-decl name='hid_allocate_device' mangled-name='hid_allocate_device' filepath='drivers/hid/hid-core.c' line='2458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_allocate_device'>
         <return type-id='37175e4d'/>
       </function-decl>
       <var-decl name='hid_debug' type-id='95e97e5e' mangled-name='hid_debug' visibility='default' filepath='drivers/hid/hid-core.c' line='44' column='1' elf-symbol-id='hid_debug'/>
-      <function-decl name='hid_destroy_device' mangled-name='hid_destroy_device' filepath='include/linux/hid.h' line='853' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_destroy_device'>
-        <parameter type-id='37175e4d'/>
+      <function-decl name='hid_destroy_device' mangled-name='hid_destroy_device' filepath='drivers/hid/hid-core.c' line='2504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_destroy_device'>
+        <parameter type-id='37175e4d' name='hdev' filepath='drivers/hid/hid-core.c' line='2504' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='hid_input_report' mangled-name='hid_input_report' filepath='drivers/hid/hid-core.c' line='1810' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_input_report'>
@@ -123780,38 +123603,38 @@
         <parameter type-id='95e97e5e' name='interrupt' filepath='drivers/hid/hid-core.c' line='1810' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hid_parse_report' mangled-name='hid_parse_report' filepath='include/linux/hid.h' line='896' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_parse_report'>
-        <parameter type-id='37175e4d'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='hid_parse_report' mangled-name='hid_parse_report' filepath='drivers/hid/hid-core.c' line='937' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_parse_report'>
+        <parameter type-id='37175e4d' name='hid' filepath='drivers/hid/hid-core.c' line='937' column='1'/>
+        <parameter type-id='474e5dcc' name='start' filepath='drivers/hid/hid-core.c' line='937' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='drivers/hid/hid-core.c' line='937' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='hmm_range_fault' mangled-name='hmm_range_fault' filepath='mm/hmm.c' line='568' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hmm_range_fault'>
         <parameter type-id='f9d3500f' name='range' filepath='mm/hmm.c' line='568' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='housekeeping_cpumask' mangled-name='housekeeping_cpumask' filepath='include/linux/sched/isolation.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='housekeeping_cpumask'>
-        <parameter type-id='174b493d'/>
+      <function-decl name='housekeeping_cpumask' mangled-name='housekeeping_cpumask' filepath='kernel/sched/isolation.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='housekeeping_cpumask'>
+        <parameter type-id='174b493d' name='flags' filepath='kernel/sched/isolation.c' line='40' column='1'/>
         <return type-id='5f8a1ac4'/>
       </function-decl>
-      <function-decl name='hrtimer_active' mangled-name='hrtimer_active' filepath='include/linux/hrtimer.h' line='456' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_active'>
-        <parameter type-id='1ce53783'/>
-        <return type-id='c894953d'/>
+      <function-decl name='hrtimer_active' mangled-name='hrtimer_active' filepath='kernel/time/hrtimer.c' line='1502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_active'>
+        <parameter type-id='1ce53783' name='timer' filepath='kernel/time/hrtimer.c' line='1502' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='hrtimer_cancel' mangled-name='hrtimer_cancel' filepath='include/linux/hrtimer.h' line='423' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_cancel'>
-        <parameter type-id='08c8d0fa'/>
+      <function-decl name='hrtimer_cancel' mangled-name='hrtimer_cancel' filepath='kernel/time/hrtimer.c' line='1336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_cancel'>
+        <parameter type-id='08c8d0fa' name='timer' filepath='kernel/time/hrtimer.c' line='1336' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hrtimer_forward' mangled-name='hrtimer_forward' filepath='include/linux/hrtimer.h' line='483' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_forward'>
-        <parameter type-id='08c8d0fa'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='1eb56b1e'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='hrtimer_forward' mangled-name='hrtimer_forward' filepath='kernel/time/hrtimer.c' line='935' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_forward'>
+        <parameter type-id='08c8d0fa' name='timer' filepath='kernel/time/hrtimer.c' line='935' column='1'/>
+        <parameter type-id='fbc017ef' name='now' filepath='kernel/time/hrtimer.c' line='935' column='1'/>
+        <parameter type-id='fbc017ef' name='interval' filepath='kernel/time/hrtimer.c' line='935' column='1'/>
+        <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='hrtimer_init' mangled-name='hrtimer_init' filepath='include/linux/hrtimer.h' line='374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_init'>
-        <parameter type-id='08c8d0fa'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='88326653'/>
+      <function-decl name='hrtimer_init' mangled-name='hrtimer_init' filepath='kernel/time/hrtimer.c' line='1487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_init'>
+        <parameter type-id='08c8d0fa' name='timer' filepath='kernel/time/hrtimer.c' line='1487' column='1'/>
+        <parameter type-id='a1c3b834' name='clock_id' filepath='kernel/time/hrtimer.c' line='1487' column='1'/>
+        <parameter type-id='88326653' name='mode' filepath='kernel/time/hrtimer.c' line='1488' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='hrtimer_init_sleeper' mangled-name='hrtimer_init_sleeper' filepath='kernel/time/hrtimer.c' line='1905' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_init_sleeper'>
@@ -123826,28 +123649,28 @@
         <parameter type-id='88326653' name='mode' filepath='kernel/time/hrtimer.c' line='1851' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='hrtimer_start_range_ns' mangled-name='hrtimer_start_range_ns' filepath='include/linux/hrtimer.h' line='406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_start_range_ns'>
-        <parameter type-id='08c8d0fa'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='88326653'/>
+      <function-decl name='hrtimer_start_range_ns' mangled-name='hrtimer_start_range_ns' filepath='kernel/time/hrtimer.c' line='1178' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_start_range_ns'>
+        <parameter type-id='08c8d0fa' name='timer' filepath='kernel/time/hrtimer.c' line='1178' column='1'/>
+        <parameter type-id='fbc017ef' name='tim' filepath='kernel/time/hrtimer.c' line='1178' column='1'/>
+        <parameter type-id='91ce1af9' name='delta_ns' filepath='kernel/time/hrtimer.c' line='1179' column='1'/>
+        <parameter type-id='9bedc94f' name='mode' filepath='kernel/time/hrtimer.c' line='1179' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='hrtimer_try_to_cancel' mangled-name='hrtimer_try_to_cancel' filepath='include/linux/hrtimer.h' line='424' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_try_to_cancel'>
-        <parameter type-id='08c8d0fa'/>
+      <function-decl name='hrtimer_try_to_cancel' mangled-name='hrtimer_try_to_cancel' filepath='kernel/time/hrtimer.c' line='1214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hrtimer_try_to_cancel'>
+        <parameter type-id='08c8d0fa' name='timer' filepath='kernel/time/hrtimer.c' line='1214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hvc_alloc' mangled-name='hvc_alloc' filepath='drivers/tty/hvc/hvc_console.h' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hvc_alloc'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f319e2c5'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='hvc_alloc' mangled-name='hvc_alloc' filepath='drivers/tty/hvc/hvc_console.c' line='911' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hvc_alloc'>
+        <parameter type-id='8f92235e' name='vtermno' filepath='drivers/tty/hvc/hvc_console.c' line='911' column='1'/>
+        <parameter type-id='95e97e5e' name='data' filepath='drivers/tty/hvc/hvc_console.c' line='911' column='1'/>
+        <parameter type-id='f319e2c5' name='ops' filepath='drivers/tty/hvc/hvc_console.c' line='912' column='1'/>
+        <parameter type-id='95e97e5e' name='outbuf_size' filepath='drivers/tty/hvc/hvc_console.c' line='913' column='1'/>
         <return type-id='352b95f6'/>
       </function-decl>
-      <function-decl name='hvc_instantiate' mangled-name='hvc_instantiate' filepath='drivers/tty/hvc/hvc_console.h' line='73' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hvc_instantiate'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f319e2c5'/>
+      <function-decl name='hvc_instantiate' mangled-name='hvc_instantiate' filepath='drivers/tty/hvc/hvc_console.c' line='285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hvc_instantiate'>
+        <parameter type-id='8f92235e' name='vtermno' filepath='drivers/tty/hvc/hvc_console.c' line='285' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/tty/hvc/hvc_console.c' line='285' column='1'/>
+        <parameter type-id='f319e2c5' name='ops' filepath='drivers/tty/hvc/hvc_console.c' line='285' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='hvc_kick' mangled-name='hvc_kick' filepath='drivers/tty/hvc/hvc_console.c' line='313' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hvc_kick'>
@@ -123869,18 +123692,18 @@
         <parameter type-id='c1547255' name='rng' filepath='drivers/char/hw_random/core.c' line='535' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='hwspin_lock_free' mangled-name='hwspin_lock_free' filepath='include/linux/hwspinlock.h' line='63' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hwspin_lock_free'>
-        <parameter type-id='0cb0b26f'/>
+      <function-decl name='hwspin_lock_free' mangled-name='hwspin_lock_free' filepath='drivers/hwspinlock/hwspinlock_core.c' line='800' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hwspin_lock_free'>
+        <parameter type-id='0cb0b26f' name='hwlock' filepath='drivers/hwspinlock/hwspinlock_core.c' line='800' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hwspin_lock_request_specific' mangled-name='hwspin_lock_request_specific' filepath='include/linux/hwspinlock.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hwspin_lock_request_specific'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='hwspin_lock_request_specific' mangled-name='hwspin_lock_request_specific' filepath='drivers/hwspinlock/hwspinlock_core.c' line='752' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hwspin_lock_request_specific'>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/hwspinlock/hwspinlock_core.c' line='752' column='1'/>
         <return type-id='0cb0b26f'/>
       </function-decl>
       <var-decl name='hypervisor_kobj' type-id='d30bdc51' mangled-name='hypervisor_kobj' visibility='default' filepath='drivers/base/hypervisor.c' line='15' column='1' elf-symbol-id='hypervisor_kobj'/>
       <var-decl name='i2c_adapter_type' type-id='bdae35f4' mangled-name='i2c_adapter_type' visibility='default' filepath='drivers/i2c/i2c-core-base.c' line='1263' column='1' elf-symbol-id='i2c_adapter_type'/>
-      <function-decl name='i2c_add_adapter' mangled-name='i2c_add_adapter' filepath='include/linux/i2c.h' line='848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_add_adapter'>
-        <parameter type-id='b9af02c3'/>
+      <function-decl name='i2c_add_adapter' mangled-name='i2c_add_adapter' filepath='drivers/i2c/i2c-core-base.c' line='1529' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_add_adapter'>
+        <parameter type-id='b9af02c3' name='adapter' filepath='drivers/i2c/i2c-core-base.c' line='1529' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='i2c_add_numbered_adapter' mangled-name='i2c_add_numbered_adapter' filepath='drivers/i2c/i2c-core-base.c' line='1578' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_add_numbered_adapter'>
@@ -123903,12 +123726,12 @@
         <parameter type-id='eaa32e2f' name='arg' filepath='drivers/i2c/i2c-core-base.c' line='1861' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='i2c_del_adapter' mangled-name='i2c_del_adapter' filepath='include/linux/i2c.h' line='849' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_del_adapter'>
-        <parameter type-id='b9af02c3'/>
+      <function-decl name='i2c_del_adapter' mangled-name='i2c_del_adapter' filepath='drivers/i2c/i2c-core-base.c' line='1633' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_del_adapter'>
+        <parameter type-id='b9af02c3' name='adap' filepath='drivers/i2c/i2c-core-base.c' line='1633' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='i2c_del_driver' mangled-name='i2c_del_driver' filepath='include/linux/i2c.h' line='853' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_del_driver'>
-        <parameter type-id='29ffcb70'/>
+      <function-decl name='i2c_del_driver' mangled-name='i2c_del_driver' filepath='drivers/i2c/i2c-core-base.c' line='1830' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_del_driver'>
+        <parameter type-id='29ffcb70' name='driver' filepath='drivers/i2c/i2c-core-base.c' line='1830' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='i2c_for_each_dev' mangled-name='i2c_for_each_dev' filepath='drivers/i2c/i2c-core-base.c' line='1765' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_for_each_dev'>
@@ -123945,9 +123768,9 @@
         <parameter type-id='1dc6a898' name='default_addr' filepath='drivers/i2c/i2c-core-base.c' line='1089' column='1'/>
         <return type-id='3e31633b'/>
       </function-decl>
-      <function-decl name='i2c_new_client_device' mangled-name='i2c_new_client_device' filepath='include/linux/i2c.h' line='445' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_new_client_device'>
-        <parameter type-id='b9af02c3'/>
-        <parameter type-id='88139c0a'/>
+      <function-decl name='i2c_new_client_device' mangled-name='i2c_new_client_device' filepath='drivers/i2c/i2c-core-base.c' line='872' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_new_client_device'>
+        <parameter type-id='b9af02c3' name='adap' filepath='drivers/i2c/i2c-core-base.c' line='872' column='1'/>
+        <parameter type-id='88139c0a' name='info' filepath='drivers/i2c/i2c-core-base.c' line='872' column='1'/>
         <return type-id='3e31633b'/>
       </function-decl>
       <function-decl name='i2c_new_dummy_device' mangled-name='i2c_new_dummy_device' filepath='drivers/i2c/i2c-core-base.c' line='1011' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_new_dummy_device'>
@@ -123982,81 +123805,81 @@
         <parameter type-id='b9af02c3' name='adap' filepath='drivers/i2c/i2c-core-base.c' line='250' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i2c_register_driver' mangled-name='i2c_register_driver' filepath='include/linux/i2c.h' line='852' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_register_driver'>
-        <parameter type-id='2730d015'/>
-        <parameter type-id='29ffcb70'/>
+      <function-decl name='i2c_register_driver' mangled-name='i2c_register_driver' filepath='drivers/i2c/i2c-core-base.c' line='1789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_register_driver'>
+        <parameter type-id='2730d015' name='owner' filepath='drivers/i2c/i2c-core-base.c' line='1789' column='1'/>
+        <parameter type-id='29ffcb70' name='driver' filepath='drivers/i2c/i2c-core-base.c' line='1789' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i2c_smbus_read_byte' mangled-name='i2c_smbus_read_byte' filepath='include/linux/i2c.h' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_byte'>
-        <parameter type-id='7ea54338'/>
-        <return type-id='95e97e5e'/>
+      <function-decl name='i2c_smbus_read_byte' mangled-name='i2c_smbus_read_byte' filepath='drivers/i2c/i2c-core-smbus.c' line='93' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_byte'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='93' column='1'/>
+        <return type-id='a7832498'/>
       </function-decl>
-      <function-decl name='i2c_smbus_read_byte_data' mangled-name='i2c_smbus_read_byte_data' filepath='include/linux/i2c.h' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_byte_data'>
-        <parameter type-id='7ea54338'/>
-        <parameter type-id='002ac4a6'/>
-        <return type-id='95e97e5e'/>
+      <function-decl name='i2c_smbus_read_byte_data' mangled-name='i2c_smbus_read_byte_data' filepath='drivers/i2c/i2c-core-smbus.c' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_byte_data'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='128' column='1'/>
+        <parameter type-id='f9b06939' name='command' filepath='drivers/i2c/i2c-core-smbus.c' line='128' column='1'/>
+        <return type-id='a7832498'/>
       </function-decl>
-      <function-decl name='i2c_smbus_read_i2c_block_data' mangled-name='i2c_smbus_read_i2c_block_data' filepath='include/linux/i2c.h' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_i2c_block_data'>
-        <parameter type-id='7ea54338'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='cf536864'/>
-        <return type-id='95e97e5e'/>
+      <function-decl name='i2c_smbus_read_i2c_block_data' mangled-name='i2c_smbus_read_i2c_block_data' filepath='drivers/i2c/i2c-core-smbus.c' line='258' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_i2c_block_data'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='258' column='1'/>
+        <parameter type-id='f9b06939' name='command' filepath='drivers/i2c/i2c-core-smbus.c' line='258' column='1'/>
+        <parameter type-id='f9b06939' name='length' filepath='drivers/i2c/i2c-core-smbus.c' line='259' column='1'/>
+        <parameter type-id='8bff8096' name='values' filepath='drivers/i2c/i2c-core-smbus.c' line='259' column='1'/>
+        <return type-id='a7832498'/>
       </function-decl>
-      <function-decl name='i2c_smbus_read_word_data' mangled-name='i2c_smbus_read_word_data' filepath='include/linux/i2c.h' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_word_data'>
-        <parameter type-id='7ea54338'/>
-        <parameter type-id='002ac4a6'/>
-        <return type-id='95e97e5e'/>
+      <function-decl name='i2c_smbus_read_word_data' mangled-name='i2c_smbus_read_word_data' filepath='drivers/i2c/i2c-core-smbus.c' line='168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_read_word_data'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='168' column='1'/>
+        <parameter type-id='f9b06939' name='command' filepath='drivers/i2c/i2c-core-smbus.c' line='168' column='1'/>
+        <return type-id='a7832498'/>
       </function-decl>
       <function-decl name='i2c_smbus_write_byte' mangled-name='i2c_smbus_write_byte' filepath='drivers/i2c/i2c-core-smbus.c' line='113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_write_byte'>
         <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='113' column='1'/>
         <parameter type-id='f9b06939' name='value' filepath='drivers/i2c/i2c-core-smbus.c' line='113' column='1'/>
         <return type-id='a7832498'/>
       </function-decl>
-      <function-decl name='i2c_smbus_write_byte_data' mangled-name='i2c_smbus_write_byte_data' filepath='include/linux/i2c.h' line='150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_write_byte_data'>
-        <parameter type-id='7ea54338'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='002ac4a6'/>
+      <function-decl name='i2c_smbus_write_byte_data' mangled-name='i2c_smbus_write_byte_data' filepath='drivers/i2c/i2c-core-smbus.c' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_write_byte_data'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='149' column='1'/>
+        <parameter type-id='f9b06939' name='command' filepath='drivers/i2c/i2c-core-smbus.c' line='149' column='1'/>
+        <parameter type-id='f9b06939' name='value' filepath='drivers/i2c/i2c-core-smbus.c' line='150' column='1'/>
+        <return type-id='a7832498'/>
+      </function-decl>
+      <function-decl name='i2c_smbus_write_i2c_block_data' mangled-name='i2c_smbus_write_i2c_block_data' filepath='drivers/i2c/i2c-core-smbus.c' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_write_i2c_block_data'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='278' column='1'/>
+        <parameter type-id='f9b06939' name='command' filepath='drivers/i2c/i2c-core-smbus.c' line='278' column='1'/>
+        <parameter type-id='f9b06939' name='length' filepath='drivers/i2c/i2c-core-smbus.c' line='279' column='1'/>
+        <parameter type-id='bbaf3419' name='values' filepath='drivers/i2c/i2c-core-smbus.c' line='279' column='1'/>
+        <return type-id='a7832498'/>
+      </function-decl>
+      <function-decl name='i2c_smbus_write_word_data' mangled-name='i2c_smbus_write_word_data' filepath='drivers/i2c/i2c-core-smbus.c' line='189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_write_word_data'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-smbus.c' line='189' column='1'/>
+        <parameter type-id='f9b06939' name='command' filepath='drivers/i2c/i2c-core-smbus.c' line='189' column='1'/>
+        <parameter type-id='1dc6a898' name='value' filepath='drivers/i2c/i2c-core-smbus.c' line='190' column='1'/>
+        <return type-id='a7832498'/>
+      </function-decl>
+      <function-decl name='i2c_smbus_xfer' mangled-name='i2c_smbus_xfer' filepath='drivers/i2c/i2c-core-smbus.c' line='532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_xfer'>
+        <parameter type-id='b9af02c3' name='adapter' filepath='drivers/i2c/i2c-core-smbus.c' line='532' column='1'/>
+        <parameter type-id='1dc6a898' name='addr' filepath='drivers/i2c/i2c-core-smbus.c' line='532' column='1'/>
+        <parameter type-id='8efea9e5' name='flags' filepath='drivers/i2c/i2c-core-smbus.c' line='533' column='1'/>
+        <parameter type-id='a84c031d' name='read_write' filepath='drivers/i2c/i2c-core-smbus.c' line='533' column='1'/>
+        <parameter type-id='f9b06939' name='command' filepath='drivers/i2c/i2c-core-smbus.c' line='534' column='1'/>
+        <parameter type-id='95e97e5e' name='protocol' filepath='drivers/i2c/i2c-core-smbus.c' line='534' column='1'/>
+        <parameter type-id='a556dccb' name='data' filepath='drivers/i2c/i2c-core-smbus.c' line='534' column='1'/>
+        <return type-id='a7832498'/>
+      </function-decl>
+      <function-decl name='i2c_transfer' mangled-name='i2c_transfer' filepath='drivers/i2c/i2c-core-base.c' line='2085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_transfer'>
+        <parameter type-id='b9af02c3' name='adap' filepath='drivers/i2c/i2c-core-base.c' line='2085' column='1'/>
+        <parameter type-id='cd44bc95' name='msgs' filepath='drivers/i2c/i2c-core-base.c' line='2085' column='1'/>
+        <parameter type-id='95e97e5e' name='num' filepath='drivers/i2c/i2c-core-base.c' line='2085' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i2c_smbus_write_i2c_block_data' mangled-name='i2c_smbus_write_i2c_block_data' filepath='include/linux/i2c.h' line='179' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_write_i2c_block_data'>
-        <parameter type-id='7ea54338'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='354f7eb9'/>
+      <function-decl name='i2c_transfer_buffer_flags' mangled-name='i2c_transfer_buffer_flags' filepath='drivers/i2c/i2c-core-base.c' line='2131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_transfer_buffer_flags'>
+        <parameter type-id='7ea54338' name='client' filepath='drivers/i2c/i2c-core-base.c' line='2131' column='1'/>
+        <parameter type-id='26a90f95' name='buf' filepath='drivers/i2c/i2c-core-base.c' line='2131' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='drivers/i2c/i2c-core-base.c' line='2132' column='1'/>
+        <parameter type-id='1dc6a898' name='flags' filepath='drivers/i2c/i2c-core-base.c' line='2132' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='i2c_smbus_write_word_data' mangled-name='i2c_smbus_write_word_data' filepath='include/linux/i2c.h' line='153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_write_word_data'>
-        <parameter type-id='7ea54338'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='8efea9e5'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='i2c_smbus_xfer' mangled-name='i2c_smbus_xfer' filepath='include/linux/i2c.h' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_smbus_xfer'>
-        <parameter type-id='b9af02c3'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='a84c031d'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='a556dccb'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='i2c_transfer' mangled-name='i2c_transfer' filepath='include/linux/i2c.h' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_transfer'>
-        <parameter type-id='b9af02c3'/>
-        <parameter type-id='cd44bc95'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='i2c_transfer_buffer_flags' mangled-name='i2c_transfer_buffer_flags' filepath='include/linux/i2c.h' line='61' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_transfer_buffer_flags'>
-        <parameter type-id='7ea54338'/>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='8efea9e5'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='i2c_unregister_device' mangled-name='i2c_unregister_device' filepath='include/linux/i2c.h' line='473' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_unregister_device'>
-        <parameter type-id='3e31633b'/>
+      <function-decl name='i2c_unregister_device' mangled-name='i2c_unregister_device' filepath='drivers/i2c/i2c-core-base.c' line='953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_unregister_device'>
+        <parameter type-id='3e31633b' name='client' filepath='drivers/i2c/i2c-core-base.c' line='953' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='i2c_verify_adapter' mangled-name='i2c_verify_adapter' filepath='drivers/i2c/i2c-core-base.c' line='1278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='i2c_verify_adapter'>
@@ -124181,12 +124004,12 @@
         <parameter type-id='c062d7a5' name='i3cdev' filepath='drivers/i3c/device.c' line='185' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='icc_disable' mangled-name='icc_disable' filepath='include/linux/interconnect.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_disable'>
-        <parameter type-id='b5fdec5e'/>
+      <function-decl name='icc_disable' mangled-name='icc_disable' filepath='drivers/interconnect/core.c' line='702' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_disable'>
+        <parameter type-id='b5fdec5e' name='path' filepath='drivers/interconnect/core.c' line='702' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='icc_enable' mangled-name='icc_enable' filepath='include/linux/interconnect.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_enable'>
-        <parameter type-id='b5fdec5e'/>
+      <function-decl name='icc_enable' mangled-name='icc_enable' filepath='drivers/interconnect/core.c' line='696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_enable'>
+        <parameter type-id='b5fdec5e' name='path' filepath='drivers/interconnect/core.c' line='696' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='icc_get' mangled-name='icc_get' filepath='drivers/interconnect/core.c' line='724' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_get'>
@@ -124229,14 +124052,14 @@
         <parameter type-id='e68dc824' name='provider' filepath='drivers/interconnect/core.c' line='1060' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='icc_put' mangled-name='icc_put' filepath='include/linux/interconnect.h' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_put'>
-        <parameter type-id='b5fdec5e'/>
+      <function-decl name='icc_put' mangled-name='icc_put' filepath='drivers/interconnect/core.c' line='763' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_put'>
+        <parameter type-id='b5fdec5e' name='path' filepath='drivers/interconnect/core.c' line='763' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='icc_set_bw' mangled-name='icc_set_bw' filepath='include/linux/interconnect.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_set_bw'>
-        <parameter type-id='b5fdec5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='icc_set_bw' mangled-name='icc_set_bw' filepath='drivers/interconnect/core.c' line='622' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_set_bw'>
+        <parameter type-id='b5fdec5e' name='path' filepath='drivers/interconnect/core.c' line='622' column='1'/>
+        <parameter type-id='19c2251e' name='avg_bw' filepath='drivers/interconnect/core.c' line='622' column='1'/>
+        <parameter type-id='19c2251e' name='peak_bw' filepath='drivers/interconnect/core.c' line='622' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='icc_set_tag' mangled-name='icc_set_tag' filepath='drivers/interconnect/core.c' line='573' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='icc_set_tag'>
@@ -124257,36 +124080,36 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/interconnect/core.c' line='1097' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ida_alloc_range' mangled-name='ida_alloc_range' filepath='include/linux/idr.h' line='255' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ida_alloc_range'>
-        <parameter type-id='a9e764bb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='ida_alloc_range' mangled-name='ida_alloc_range' filepath='lib/idr.c' line='380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ida_alloc_range'>
+        <parameter type-id='a9e764bb' name='ida' filepath='lib/idr.c' line='380' column='1'/>
+        <parameter type-id='f0981eeb' name='min' filepath='lib/idr.c' line='380' column='1'/>
+        <parameter type-id='f0981eeb' name='max' filepath='lib/idr.c' line='380' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='lib/idr.c' line='381' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ida_destroy' mangled-name='ida_destroy' filepath='include/linux/idr.h' line='257' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ida_destroy'>
-        <parameter type-id='a9e764bb'/>
+      <function-decl name='ida_destroy' mangled-name='ida_destroy' filepath='lib/idr.c' line='540' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ida_destroy'>
+        <parameter type-id='a9e764bb' name='ida' filepath='lib/idr.c' line='540' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ida_free' mangled-name='ida_free' filepath='include/linux/idr.h' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ida_free'>
-        <parameter type-id='a9e764bb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='ida_free' mangled-name='ida_free' filepath='lib/idr.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ida_free'>
+        <parameter type-id='a9e764bb' name='ida' filepath='lib/idr.c' line='487' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='lib/idr.c' line='487' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='idr_alloc' mangled-name='idr_alloc' filepath='include/linux/idr.h' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_alloc'>
-        <parameter type-id='301185b4'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='idr_alloc' mangled-name='idr_alloc' filepath='lib/idr.c' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_alloc'>
+        <parameter type-id='301185b4' name='idr' filepath='lib/idr.c' line='79' column='1'/>
+        <parameter type-id='eaa32e2f' name='ptr' filepath='lib/idr.c' line='79' column='1'/>
+        <parameter type-id='95e97e5e' name='start' filepath='lib/idr.c' line='79' column='1'/>
+        <parameter type-id='95e97e5e' name='end' filepath='lib/idr.c' line='79' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='lib/idr.c' line='79' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='idr_alloc_cyclic' mangled-name='idr_alloc_cyclic' filepath='include/linux/idr.h' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_alloc_cyclic'>
-        <parameter type-id='301185b4'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='idr_alloc_cyclic' mangled-name='idr_alloc_cyclic' filepath='lib/idr.c' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_alloc_cyclic'>
+        <parameter type-id='301185b4' name='idr' filepath='lib/idr.c' line='117' column='1'/>
+        <parameter type-id='eaa32e2f' name='ptr' filepath='lib/idr.c' line='117' column='1'/>
+        <parameter type-id='95e97e5e' name='start' filepath='lib/idr.c' line='117' column='1'/>
+        <parameter type-id='95e97e5e' name='end' filepath='lib/idr.c' line='117' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='lib/idr.c' line='117' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='idr_alloc_u32' mangled-name='idr_alloc_u32' filepath='lib/idr.c' line='33' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_alloc_u32'>
@@ -124297,39 +124120,39 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='lib/idr.c' line='34' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='idr_destroy' mangled-name='idr_destroy' filepath='include/linux/idr.h' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_destroy'>
-        <parameter type-id='301185b4'/>
+      <function-decl name='idr_destroy' mangled-name='idr_destroy' filepath='lib/radix-tree.c' line='1557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_destroy'>
+        <parameter type-id='301185b4' name='idr' filepath='lib/radix-tree.c' line='1557' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='idr_find' mangled-name='idr_find' filepath='include/linux/idr.h' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_find'>
-        <parameter type-id='c79c8089'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='idr_find' mangled-name='idr_find' filepath='lib/idr.c' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_find'>
+        <parameter type-id='c79c8089' name='idr' filepath='lib/idr.c' line='172' column='1'/>
+        <parameter type-id='7359adad' name='id' filepath='lib/idr.c' line='172' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='idr_for_each' mangled-name='idr_for_each' filepath='include/linux/idr.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_for_each'>
-        <parameter type-id='c79c8089'/>
-        <parameter type-id='f4f5b664'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='idr_for_each' mangled-name='idr_for_each' filepath='lib/idr.c' line='195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_for_each'>
+        <parameter type-id='c79c8089' name='idr' filepath='lib/idr.c' line='195' column='1'/>
+        <parameter type-id='f4f5b664' name='fn' filepath='lib/idr.c' line='196' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='lib/idr.c' line='196' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='idr_get_next' mangled-name='idr_get_next' filepath='include/linux/idr.h' line='122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_get_next'>
-        <parameter type-id='301185b4'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='idr_get_next' mangled-name='idr_get_next' filepath='lib/idr.c' line='264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_get_next'>
+        <parameter type-id='301185b4' name='idr' filepath='lib/idr.c' line='264' column='1'/>
+        <parameter type-id='7292109c' name='nextid' filepath='lib/idr.c' line='264' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='idr_preload' mangled-name='idr_preload' filepath='include/linux/idr.h' line='112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_preload'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='idr_preload' mangled-name='idr_preload' filepath='lib/radix-tree.c' line='1467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_preload'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='lib/radix-tree.c' line='1467' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='idr_remove' mangled-name='idr_remove' filepath='include/linux/idr.h' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_remove'>
-        <parameter type-id='301185b4'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='idr_remove' mangled-name='idr_remove' filepath='lib/idr.c' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_remove'>
+        <parameter type-id='301185b4' name='idr' filepath='lib/idr.c' line='152' column='1'/>
+        <parameter type-id='7359adad' name='id' filepath='lib/idr.c' line='152' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='idr_replace' mangled-name='idr_replace' filepath='include/linux/idr.h' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_replace'>
-        <parameter type-id='301185b4'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='idr_replace' mangled-name='idr_replace' filepath='lib/idr.c' line='290' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='idr_replace'>
+        <parameter type-id='301185b4' name='idr' filepath='lib/idr.c' line='290' column='1'/>
+        <parameter type-id='eaa32e2f' name='ptr' filepath='lib/idr.c' line='290' column='1'/>
+        <parameter type-id='7359adad' name='id' filepath='lib/idr.c' line='290' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='ieee802154_alloc_hw' mangled-name='ieee802154_alloc_hw' filepath='net/mac802154/main.c' line='47' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ieee802154_alloc_hw'>
@@ -124355,14 +124178,14 @@
         <parameter type-id='c67366c7' name='hw' filepath='net/mac802154/main.c' line='207' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ieee802154_wake_queue' mangled-name='ieee802154_wake_queue' filepath='include/net/mac802154.h' line='469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ieee802154_wake_queue'>
-        <parameter type-id='c67366c7'/>
+      <function-decl name='ieee802154_wake_queue' mangled-name='ieee802154_wake_queue' filepath='net/mac802154/util.c' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ieee802154_wake_queue'>
+        <parameter type-id='c67366c7' name='hw' filepath='net/mac802154/util.c' line='16' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ieee802154_xmit_complete' mangled-name='ieee802154_xmit_complete' filepath='include/net/mac802154.h' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ieee802154_xmit_complete'>
-        <parameter type-id='c67366c7'/>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='ieee802154_xmit_complete' mangled-name='ieee802154_xmit_complete' filepath='net/mac802154/util.c' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ieee802154_xmit_complete'>
+        <parameter type-id='c67366c7' name='hw' filepath='net/mac802154/util.c' line='58' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/mac802154/util.c' line='58' column='1'/>
+        <parameter type-id='b50a4934' name='ifs_handling' filepath='net/mac802154/util.c' line='59' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='ignore_console_lock_warning' type-id='49178f86' mangled-name='ignore_console_lock_warning' visibility='default' filepath='kernel/printk/printk.c' line='74' column='1' elf-symbol-id='ignore_console_lock_warning'/>
@@ -124379,8 +124202,8 @@
         <parameter type-id='aa9ea333' name='buffer' filepath='drivers/iio/industrialio-buffer.c' line='202' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='iio_buffer_put' mangled-name='iio_buffer_put' filepath='include/linux/iio/buffer_impl.h' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iio_buffer_put'>
-        <parameter type-id='aa9ea333'/>
+      <function-decl name='iio_buffer_put' mangled-name='iio_buffer_put' filepath='drivers/iio/industrialio-buffer.c' line='1500' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iio_buffer_put'>
+        <parameter type-id='aa9ea333' name='buffer' filepath='drivers/iio/industrialio-buffer.c' line='1500' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='iio_channel_get' mangled-name='iio_channel_get' filepath='drivers/iio/inkern.c' line='330' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iio_channel_get'>
@@ -124460,14 +124283,14 @@
         <parameter type-id='54e54fbb' name='trig' filepath='drivers/iio/industrialio-trigger.c' line='203' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='import_iovec' mangled-name='import_iovec' filepath='include/linux/uio.h' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='import_iovec'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='2c556848'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='5d3cb3f9'/>
-        <parameter type-id='4fa10f9e'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='import_iovec' mangled-name='import_iovec' filepath='lib/iov_iter.c' line='1812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='import_iovec'>
+        <parameter type-id='95e97e5e' name='type' filepath='lib/iov_iter.c' line='1812' column='1'/>
+        <parameter type-id='2c556848' name='uvec' filepath='lib/iov_iter.c' line='1812' column='1'/>
+        <parameter type-id='f0981eeb' name='nr_segs' filepath='lib/iov_iter.c' line='1813' column='1'/>
+        <parameter type-id='f0981eeb' name='fast_segs' filepath='lib/iov_iter.c' line='1813' column='1'/>
+        <parameter type-id='5d3cb3f9' name='iovp' filepath='lib/iov_iter.c' line='1814' column='1'/>
+        <parameter type-id='4fa10f9e' name='i' filepath='lib/iov_iter.c' line='1814' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='in4_pton' mangled-name='in4_pton' filepath='net/core/utils.c' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='in4_pton'>
         <parameter type-id='80f4b756' name='src' filepath='net/core/utils.c' line='118' column='1'/>
@@ -124498,9 +124321,9 @@
         <parameter type-id='93f9c3d3' name='item' filepath='mm/vmstat.c' line='601' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='inc_zone_page_state' mangled-name='inc_zone_page_state' filepath='include/linux/vmstat.h' line='272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inc_zone_page_state'>
-        <parameter type-id='02f11ed4'/>
-        <parameter type-id='a1f2d9a1'/>
+      <function-decl name='inc_zone_page_state' mangled-name='inc_zone_page_state' filepath='mm/vmstat.c' line='534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inc_zone_page_state'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/vmstat.c' line='534' column='1'/>
+        <parameter type-id='a1f2d9a1' name='item' filepath='mm/vmstat.c' line='534' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='inet_csk_get_port' mangled-name='inet_csk_get_port' filepath='net/ipv4/inet_connection_sock.c' line='354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inet_csk_get_port'>
@@ -124520,18 +124343,18 @@
         <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='10176' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='init_iova_domain' mangled-name='init_iova_domain' filepath='include/linux/iova.h' line='157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_iova_domain'>
-        <parameter type-id='0c2c419d'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='init_iova_domain' mangled-name='init_iova_domain' filepath='drivers/iommu/iova.c' line='30' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_iova_domain'>
+        <parameter type-id='0c2c419d' name='iovad' filepath='drivers/iommu/iova.c' line='30' column='1'/>
+        <parameter type-id='7359adad' name='granule' filepath='drivers/iommu/iova.c' line='30' column='1'/>
+        <parameter type-id='7359adad' name='start_pfn' filepath='drivers/iommu/iova.c' line='31' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='init_net' type-id='bd965180' mangled-name='init_net' visibility='default' filepath='net/core/net_namespace.c' line='47' column='1' elf-symbol-id='init_net'/>
       <var-decl name='init_on_free' type-id='237c0d27' mangled-name='init_on_free' visibility='default' filepath='mm/page_alloc.c' line='184' column='1' elf-symbol-id='init_on_free'/>
       <var-decl name='init_pid_ns' type-id='0252e252' mangled-name='init_pid_ns' visibility='default' filepath='kernel/pid.c' line='75' column='1' elf-symbol-id='init_pid_ns'/>
-      <function-decl name='init_pseudo' mangled-name='init_pseudo' filepath='include/linux/pseudo_fs.h' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_pseudo'>
-        <parameter type-id='5760dcb0'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='init_pseudo' mangled-name='init_pseudo' filepath='fs/libfs.c' line='368' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_pseudo'>
+        <parameter type-id='5760dcb0' name='fc' filepath='fs/libfs.c' line='368' column='1'/>
+        <parameter type-id='7359adad' name='magic' filepath='fs/libfs.c' line='369' column='1'/>
         <return type-id='79f85ebf'/>
       </function-decl>
       <function-decl name='init_srcu_struct' mangled-name='init_srcu_struct' filepath='kernel/rcu/srcutree.c' line='213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_srcu_struct'>
@@ -124539,18 +124362,18 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='init_task' type-id='bc3f1924' mangled-name='init_task' visibility='default' filepath='init/init_task.c' line='64' column='1' elf-symbol-id='init_task'/>
-      <function-decl name='init_timer_key' mangled-name='init_timer_key' filepath='include/linux/timer.h' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_timer_key'>
-        <parameter type-id='9248e67f'/>
-        <parameter type-id='9582ad9a'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='a57283f9'/>
+      <function-decl name='init_timer_key' mangled-name='init_timer_key' filepath='kernel/time/timer.c' line='818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_timer_key'>
+        <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='818' column='1'/>
+        <parameter type-id='9582ad9a' name='func' filepath='kernel/time/timer.c' line='819' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='kernel/time/timer.c' line='819' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/time/timer.c' line='820' column='1'/>
+        <parameter type-id='a57283f9' name='key' filepath='kernel/time/timer.c' line='820' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='init_uts_ns' type-id='44f52e9d' mangled-name='init_uts_ns' visibility='default' filepath='init/version.c' line='27' column='1' elf-symbol-id='init_uts_ns'/>
-      <function-decl name='init_wait_entry' mangled-name='init_wait_entry' filepath='include/linux/wait.h' line='250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_wait_entry'>
-        <parameter type-id='db9d03e3'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='init_wait_entry' mangled-name='init_wait_entry' filepath='kernel/sched/wait.c' line='275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='init_wait_entry'>
+        <parameter type-id='db9d03e3' name='wq_entry' filepath='kernel/sched/wait.c' line='275' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='kernel/sched/wait.c' line='275' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='input_alloc_absinfo' mangled-name='input_alloc_absinfo' filepath='drivers/input/input.c' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_alloc_absinfo'>
@@ -124560,8 +124383,8 @@
       <function-decl name='input_allocate_device' mangled-name='input_allocate_device' filepath='drivers/input/input.c' line='1810' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_allocate_device'>
         <return type-id='74b427eb'/>
       </function-decl>
-      <function-decl name='input_close_device' mangled-name='input_close_device' filepath='include/linux/input.h' line='415' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_close_device'>
-        <parameter type-id='bef1b918'/>
+      <function-decl name='input_close_device' mangled-name='input_close_device' filepath='drivers/input/input.c' line='670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_close_device'>
+        <parameter type-id='bef1b918' name='handle' filepath='drivers/input/input.c' line='670' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='input_event' mangled-name='input_event' filepath='drivers/input/input.c' line='433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_event'>
@@ -124576,8 +124399,8 @@
         <parameter type-id='f0981eeb' name='max_effects' filepath='drivers/input/ff-core.c' line='305' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='input_ff_destroy' mangled-name='input_ff_destroy' filepath='include/linux/input.h' line='570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_ff_destroy'>
-        <parameter type-id='74b427eb'/>
+      <function-decl name='input_ff_destroy' mangled-name='input_ff_destroy' filepath='drivers/input/ff-core.c' line='365' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_ff_destroy'>
+        <parameter type-id='74b427eb' name='dev' filepath='drivers/input/ff-core.c' line='365' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='input_free_device' mangled-name='input_free_device' filepath='drivers/input/input.c' line='1915' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_free_device'>
@@ -124592,8 +124415,8 @@
         <parameter type-id='95e97e5e' name='dmax' filepath='drivers/input/input-mt.c' line='442' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='input_mt_destroy_slots' mangled-name='input_mt_destroy_slots' filepath='include/linux/input/mt.h' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_mt_destroy_slots'>
-        <parameter type-id='74b427eb'/>
+      <function-decl name='input_mt_destroy_slots' mangled-name='input_mt_destroy_slots' filepath='drivers/input/input-mt.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_mt_destroy_slots'>
+        <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input-mt.c' line='110' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='input_mt_drop_unused' mangled-name='input_mt_drop_unused' filepath='drivers/input/input-mt.c' line='276' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_mt_drop_unused'>
@@ -124626,20 +124449,20 @@
         <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input-mt.c' line='295' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='input_open_device' mangled-name='input_open_device' filepath='include/linux/input.h' line='414' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_open_device'>
-        <parameter type-id='bef1b918'/>
+      <function-decl name='input_open_device' mangled-name='input_open_device' filepath='drivers/input/input.c' line='599' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_open_device'>
+        <parameter type-id='bef1b918' name='handle' filepath='drivers/input/input.c' line='599' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='input_register_device' mangled-name='input_register_device' filepath='drivers/input/input.c' line='2153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_register_device'>
         <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input.c' line='2153' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='input_register_handle' mangled-name='input_register_handle' filepath='include/linux/input.h' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_register_handle'>
-        <parameter type-id='bef1b918'/>
+      <function-decl name='input_register_handle' mangled-name='input_register_handle' filepath='drivers/input/input.c' line='2378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_register_handle'>
+        <parameter type-id='bef1b918' name='handle' filepath='drivers/input/input.c' line='2378' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='input_register_handler' mangled-name='input_register_handler' filepath='include/linux/input.h' line='398' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_register_handler'>
-        <parameter type-id='4938abae'/>
+      <function-decl name='input_register_handler' mangled-name='input_register_handler' filepath='drivers/input/input.c' line='2287' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_register_handler'>
+        <parameter type-id='4938abae' name='handler' filepath='drivers/input/input.c' line='2287' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='input_set_abs_params' mangled-name='input_set_abs_params' filepath='drivers/input/input.c' line='504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_set_abs_params'>
@@ -124666,12 +124489,12 @@
         <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input.c' line='2260' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='input_unregister_handle' mangled-name='input_unregister_handle' filepath='include/linux/input.h' line='409' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_unregister_handle'>
-        <parameter type-id='bef1b918'/>
+      <function-decl name='input_unregister_handle' mangled-name='input_unregister_handle' filepath='drivers/input/input.c' line='2428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_unregister_handle'>
+        <parameter type-id='bef1b918' name='handle' filepath='drivers/input/input.c' line='2428' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='input_unregister_handler' mangled-name='input_unregister_handler' filepath='include/linux/input.h' line='399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_unregister_handler'>
-        <parameter type-id='4938abae'/>
+      <function-decl name='input_unregister_handler' mangled-name='input_unregister_handler' filepath='drivers/input/input.c' line='2317' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_unregister_handler'>
+        <parameter type-id='4938abae' name='handler' filepath='drivers/input/input.c' line='2317' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='int_pow' mangled-name='int_pow' filepath='lib/math/int_pow.c' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='int_pow'>
@@ -124679,34 +124502,34 @@
         <parameter type-id='f0981eeb' name='exp' filepath='lib/math/int_pow.c' line='19' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='int_sqrt' mangled-name='int_sqrt' filepath='include/linux/kernel.h' line='512' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='int_sqrt'>
-        <parameter type-id='7359adad'/>
+      <function-decl name='int_sqrt' mangled-name='int_sqrt' filepath='lib/math/int_sqrt.c' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='int_sqrt'>
+        <parameter type-id='7359adad' name='x' filepath='lib/math/int_sqrt.c' line='19' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='interval_tree_insert' mangled-name='interval_tree_insert' filepath='include/linux/interval_tree.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_insert'>
-        <parameter type-id='c7ea70e0'/>
-        <parameter type-id='9e8dca7d'/>
+      <function-decl name='interval_tree_insert' mangled-name='interval_tree_insert' filepath='lib/interval_tree.c' line='10' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_insert'>
+        <parameter type-id='c7ea70e0' name='node' filepath='lib/interval_tree.c' line='10' column='1'/>
+        <parameter type-id='9e8dca7d' name='root' filepath='lib/interval_tree.c' line='10' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='interval_tree_iter_first' mangled-name='interval_tree_iter_first' filepath='include/linux/interval_tree.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_iter_first'>
-        <parameter type-id='9e8dca7d'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='interval_tree_iter_first' mangled-name='interval_tree_iter_first' filepath='lib/interval_tree.c' line='10' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_iter_first'>
+        <parameter type-id='9e8dca7d' name='root' filepath='lib/interval_tree.c' line='10' column='1'/>
+        <parameter type-id='7359adad' name='start' filepath='lib/interval_tree.c' line='10' column='1'/>
+        <parameter type-id='7359adad' name='last' filepath='lib/interval_tree.c' line='10' column='1'/>
         <return type-id='c7ea70e0'/>
       </function-decl>
-      <function-decl name='interval_tree_iter_next' mangled-name='interval_tree_iter_next' filepath='include/linux/interval_tree.h' line='27' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_iter_next'>
-        <parameter type-id='c7ea70e0'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='interval_tree_iter_next' mangled-name='interval_tree_iter_next' filepath='lib/interval_tree.c' line='10' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_iter_next'>
+        <parameter type-id='c7ea70e0' name='node' filepath='lib/interval_tree.c' line='10' column='1'/>
+        <parameter type-id='7359adad' name='start' filepath='lib/interval_tree.c' line='10' column='1'/>
+        <parameter type-id='7359adad' name='last' filepath='lib/interval_tree.c' line='10' column='1'/>
         <return type-id='c7ea70e0'/>
       </function-decl>
-      <function-decl name='interval_tree_remove' mangled-name='interval_tree_remove' filepath='include/linux/interval_tree.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_remove'>
-        <parameter type-id='c7ea70e0'/>
-        <parameter type-id='9e8dca7d'/>
+      <function-decl name='interval_tree_remove' mangled-name='interval_tree_remove' filepath='lib/interval_tree.c' line='10' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='interval_tree_remove'>
+        <parameter type-id='c7ea70e0' name='node' filepath='lib/interval_tree.c' line='10' column='1'/>
+        <parameter type-id='9e8dca7d' name='root' filepath='lib/interval_tree.c' line='10' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='invalidate_bdev' mangled-name='invalidate_bdev' filepath='include/linux/blkdev.h' line='2035' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='invalidate_bdev'>
-        <parameter type-id='b88dd945'/>
+      <function-decl name='invalidate_bdev' mangled-name='invalidate_bdev' filepath='fs/block_dev.c' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='invalidate_bdev'>
+        <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='90' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='invalidate_mapping_pages' mangled-name='invalidate_mapping_pages' filepath='mm/truncate.c' line='629' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='invalidate_mapping_pages'>
@@ -124788,9 +124611,9 @@
         <parameter type-id='2f00283d' name='iommu' filepath='drivers/iommu/iommu-sysfs.c' line='92' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='iommu_device_unlink' mangled-name='iommu_device_unlink' filepath='include/linux/iommu.h' line='403' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iommu_device_unlink'>
-        <parameter type-id='2f00283d'/>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='iommu_device_unlink' mangled-name='iommu_device_unlink' filepath='drivers/iommu/iommu-sysfs.c' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iommu_device_unlink'>
+        <parameter type-id='2f00283d' name='iommu' filepath='drivers/iommu/iommu-sysfs.c' line='127' column='1'/>
+        <parameter type-id='fa0b179b' name='link' filepath='drivers/iommu/iommu-sysfs.c' line='127' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='iommu_device_unregister' mangled-name='iommu_device_unregister' filepath='drivers/iommu/iommu.c' line='163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iommu_device_unregister'>
@@ -124951,29 +124774,29 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/iommu/iommu.c' line='1107' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ioremap_cache' mangled-name='ioremap_cache' filepath='arch/arm64/include/asm/io.h' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ioremap_cache'>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='ioremap_cache' mangled-name='ioremap_cache' filepath='arch/arm64/mm/ioremap.c' line='84' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ioremap_cache'>
+        <parameter type-id='2522883d' name='phys_addr' filepath='arch/arm64/mm/ioremap.c' line='84' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='arch/arm64/mm/ioremap.c' line='84' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='iounmap' mangled-name='iounmap' filepath='arch/arm64/include/asm/io.h' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iounmap'>
-        <parameter type-id='fe09dd29'/>
+      <function-decl name='iounmap' mangled-name='iounmap' filepath='arch/arm64/mm/ioremap.c' line='71' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iounmap'>
+        <parameter type-id='fe09dd29' name='io_addr' filepath='arch/arm64/mm/ioremap.c' line='71' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='iov_iter_bvec' mangled-name='iov_iter_bvec' filepath='include/linux/uio.h' line='219' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iov_iter_bvec'>
-        <parameter type-id='4fa10f9e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='15c9a01b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='iov_iter_bvec' mangled-name='iov_iter_bvec' filepath='lib/iov_iter.c' line='1188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iov_iter_bvec'>
+        <parameter type-id='4fa10f9e' name='i' filepath='lib/iov_iter.c' line='1188' column='1'/>
+        <parameter type-id='f0981eeb' name='direction' filepath='lib/iov_iter.c' line='1188' column='1'/>
+        <parameter type-id='15c9a01b' name='bvec' filepath='lib/iov_iter.c' line='1189' column='1'/>
+        <parameter type-id='7359adad' name='nr_segs' filepath='lib/iov_iter.c' line='1189' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/iov_iter.c' line='1190' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='iov_iter_kvec' mangled-name='iov_iter_kvec' filepath='include/linux/uio.h' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iov_iter_kvec'>
-        <parameter type-id='4fa10f9e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='5199c30d'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='iov_iter_kvec' mangled-name='iov_iter_kvec' filepath='lib/iov_iter.c' line='1175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iov_iter_kvec'>
+        <parameter type-id='4fa10f9e' name='i' filepath='lib/iov_iter.c' line='1175' column='1'/>
+        <parameter type-id='f0981eeb' name='direction' filepath='lib/iov_iter.c' line='1175' column='1'/>
+        <parameter type-id='5199c30d' name='kvec' filepath='lib/iov_iter.c' line='1176' column='1'/>
+        <parameter type-id='7359adad' name='nr_segs' filepath='lib/iov_iter.c' line='1176' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/iov_iter.c' line='1177' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ip_compute_csum' mangled-name='ip_compute_csum' filepath='lib/checksum.c' line='142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_compute_csum'>
@@ -124981,47 +124804,47 @@
         <parameter type-id='95e97e5e' name='len' filepath='lib/checksum.c' line='142' column='1'/>
         <return type-id='7dac1e36'/>
       </function-decl>
-      <function-decl name='ip_route_me_harder' mangled-name='ip_route_me_harder' filepath='include/linux/netfilter_ipv4.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_route_me_harder'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='f772df6d'/>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='ip_route_me_harder' mangled-name='ip_route_me_harder' filepath='net/ipv4/netfilter.c' line='20' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_route_me_harder'>
+        <parameter type-id='a2bff676' name='net' filepath='net/ipv4/netfilter.c' line='20' column='1'/>
+        <parameter type-id='f772df6d' name='sk' filepath='net/ipv4/netfilter.c' line='20' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/ipv4/netfilter.c' line='20' column='1'/>
+        <parameter type-id='f0981eeb' name='addr_type' filepath='net/ipv4/netfilter.c' line='20' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ip_route_output_flow' mangled-name='ip_route_output_flow' filepath='include/net/route.h' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_route_output_flow'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='a198549e'/>
-        <parameter type-id='78e7cf52'/>
+      <function-decl name='ip_route_output_flow' mangled-name='ip_route_output_flow' filepath='net/ipv4/route.c' line='2771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_route_output_flow'>
+        <parameter type-id='a2bff676' name='net' filepath='net/ipv4/route.c' line='2771' column='1'/>
+        <parameter type-id='a198549e' name='flp4' filepath='net/ipv4/route.c' line='2771' column='1'/>
+        <parameter type-id='78e7cf52' name='sk' filepath='net/ipv4/route.c' line='2772' column='1'/>
         <return type-id='c8f5869f'/>
       </function-decl>
-      <function-decl name='ip_send_check' mangled-name='ip_send_check' filepath='include/net/ip.h' line='207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_send_check'>
-        <parameter type-id='53be694c'/>
+      <function-decl name='ip_send_check' mangled-name='ip_send_check' filepath='net/ipv4/ip_output.c' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ip_send_check'>
+        <parameter type-id='53be694c' name='iph' filepath='net/ipv4/ip_output.c' line='92' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ipi_desc_get' mangled-name='ipi_desc_get' filepath='arch/arm64/kernel/smp.c' line='1153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipi_desc_get'>
         <return type-id='9d9a0573'/>
       </function-decl>
-      <function-decl name='iput' mangled-name='iput' filepath='include/linux/fs.h' line='2383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iput'>
-        <parameter type-id='7e666abe'/>
+      <function-decl name='iput' mangled-name='iput' filepath='fs/inode.c' line='1668' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iput'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/inode.c' line='1668' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ipv6_ext_hdr' mangled-name='ipv6_ext_hdr' filepath='net/ipv6/exthdrs_core.c' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipv6_ext_hdr'>
         <parameter type-id='f9b06939' name='nexthdr' filepath='net/ipv6/exthdrs_core.c' line='13' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='ipv6_find_hdr' mangled-name='ipv6_find_hdr' filepath='include/net/ipv6.h' line='1074' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipv6_find_hdr'>
-        <parameter type-id='11f4a000'/>
-        <parameter type-id='807869d3'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='e9e550dd'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='ipv6_find_hdr' mangled-name='ipv6_find_hdr' filepath='net/ipv6/exthdrs_core.c' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipv6_find_hdr'>
+        <parameter type-id='11f4a000' name='skb' filepath='net/ipv6/exthdrs_core.c' line='186' column='1'/>
+        <parameter type-id='807869d3' name='offset' filepath='net/ipv6/exthdrs_core.c' line='186' column='1'/>
+        <parameter type-id='95e97e5e' name='target' filepath='net/ipv6/exthdrs_core.c' line='187' column='1'/>
+        <parameter type-id='e9e550dd' name='fragoff' filepath='net/ipv6/exthdrs_core.c' line='187' column='1'/>
+        <parameter type-id='7292109c' name='flags' filepath='net/ipv6/exthdrs_core.c' line='187' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ipv6_skip_exthdr' mangled-name='ipv6_skip_exthdr' filepath='include/net/ipv6.h' line='1062' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipv6_skip_exthdr'>
-        <parameter type-id='11f4a000'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='e9e550dd'/>
+      <function-decl name='ipv6_skip_exthdr' mangled-name='ipv6_skip_exthdr' filepath='net/ipv6/exthdrs_core.c' line='72' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ipv6_skip_exthdr'>
+        <parameter type-id='11f4a000' name='skb' filepath='net/ipv6/exthdrs_core.c' line='72' column='1'/>
+        <parameter type-id='95e97e5e' name='start' filepath='net/ipv6/exthdrs_core.c' line='72' column='1'/>
+        <parameter type-id='8bff8096' name='nexthdrp' filepath='net/ipv6/exthdrs_core.c' line='72' column='1'/>
+        <parameter type-id='769cf345' name='frag_offp' filepath='net/ipv6/exthdrs_core.c' line='73' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='ipv6_stub' type-id='ab989fa8' mangled-name='ipv6_stub' visibility='default' filepath='net/ipv6/addrconf_core.c' line='201' column='1' elf-symbol-id='ipv6_stub'/>
@@ -125056,8 +124879,8 @@
         <parameter type-id='1c475548' name='data' filepath='kernel/irq/chip.c' line='1429' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='irq_chip_retrigger_hierarchy' mangled-name='irq_chip_retrigger_hierarchy' filepath='include/linux/irq.h' line='682' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_chip_retrigger_hierarchy'>
-        <parameter type-id='1c475548'/>
+      <function-decl name='irq_chip_retrigger_hierarchy' mangled-name='irq_chip_retrigger_hierarchy' filepath='kernel/irq/chip.c' line='1513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_chip_retrigger_hierarchy'>
+        <parameter type-id='1c475548' name='data' filepath='kernel/irq/chip.c' line='1513' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='irq_chip_set_affinity_parent' mangled-name='irq_chip_set_affinity_parent' filepath='kernel/irq/chip.c' line='1477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_chip_set_affinity_parent'>
@@ -125157,13 +124980,13 @@
         <parameter type-id='f0981eeb' name='nr_irqs' filepath='kernel/irq/irqdomain.c' line='1706' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='irq_domain_get_irq_data' mangled-name='irq_domain_get_irq_data' filepath='include/linux/irqdomain.h' line='462' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_domain_get_irq_data'>
-        <parameter type-id='7544e824'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='irq_domain_get_irq_data' mangled-name='irq_domain_get_irq_data' filepath='kernel/irq/irqdomain.c' line='1275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_domain_get_irq_data'>
+        <parameter type-id='7544e824' name='domain' filepath='kernel/irq/irqdomain.c' line='1275' column='1'/>
+        <parameter type-id='f0981eeb' name='virq' filepath='kernel/irq/irqdomain.c' line='1276' column='1'/>
         <return type-id='1c475548'/>
       </function-decl>
-      <function-decl name='irq_domain_remove' mangled-name='irq_domain_remove' filepath='include/linux/irqdomain.h' line='383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_domain_remove'>
-        <parameter type-id='7544e824'/>
+      <function-decl name='irq_domain_remove' mangled-name='irq_domain_remove' filepath='kernel/irq/irqdomain.c' line='229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_domain_remove'>
+        <parameter type-id='7544e824' name='domain' filepath='kernel/irq/irqdomain.c' line='229' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='irq_domain_set_hwirq_and_chip' mangled-name='irq_domain_set_hwirq_and_chip' filepath='kernel/irq/irqdomain.c' line='1297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_domain_set_hwirq_and_chip'>
@@ -125174,15 +124997,15 @@
         <parameter type-id='eaa32e2f' name='chip_data' filepath='kernel/irq/irqdomain.c' line='1299' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='irq_domain_set_info' mangled-name='irq_domain_set_info' filepath='include/linux/irqdomain.h' line='464' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_domain_set_info'>
-        <parameter type-id='7544e824'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='8846a616'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='8937f3c2'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='irq_domain_set_info' mangled-name='irq_domain_set_info' filepath='kernel/irq/irqdomain.c' line='1325' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_domain_set_info'>
+        <parameter type-id='7544e824' name='domain' filepath='kernel/irq/irqdomain.c' line='1325' column='1'/>
+        <parameter type-id='f0981eeb' name='virq' filepath='kernel/irq/irqdomain.c' line='1325' column='1'/>
+        <parameter type-id='88370ce9' name='hwirq' filepath='kernel/irq/irqdomain.c' line='1326' column='1'/>
+        <parameter type-id='8846a616' name='chip' filepath='kernel/irq/irqdomain.c' line='1326' column='1'/>
+        <parameter type-id='eaa32e2f' name='chip_data' filepath='kernel/irq/irqdomain.c' line='1327' column='1'/>
+        <parameter type-id='cdb741d3' name='handler' filepath='kernel/irq/irqdomain.c' line='1327' column='1'/>
+        <parameter type-id='eaa32e2f' name='handler_data' filepath='kernel/irq/irqdomain.c' line='1328' column='1'/>
+        <parameter type-id='80f4b756' name='handler_name' filepath='kernel/irq/irqdomain.c' line='1328' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='irq_domain_simple_ops' type-id='a4974438' mangled-name='irq_domain_simple_ops' visibility='default' filepath='kernel/irq/irqdomain.c' line='975' column='1' elf-symbol-id='irq_domain_simple_ops'/>
@@ -125218,9 +125041,9 @@
         <parameter type-id='807869d3' name='out_type' filepath='kernel/irq/irqdomain.c' line='939' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='irq_find_mapping' mangled-name='irq_find_mapping' filepath='include/linux/irqdomain.h' line='421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_find_mapping'>
-        <parameter type-id='7544e824'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='irq_find_mapping' mangled-name='irq_find_mapping' filepath='kernel/irq/irqdomain.c' line='884' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_find_mapping'>
+        <parameter type-id='7544e824' name='domain' filepath='kernel/irq/irqdomain.c' line='884' column='1'/>
+        <parameter type-id='88370ce9' name='hwirq' filepath='kernel/irq/irqdomain.c' line='885' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='irq_find_matching_fwspec' mangled-name='irq_find_matching_fwspec' filepath='kernel/irq/irqdomain.c' line='372' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_find_matching_fwspec'>
@@ -125244,21 +125067,21 @@
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/chip.c' line='159' column='1'/>
         <return type-id='1c475548'/>
       </function-decl>
-      <function-decl name='irq_get_irqchip_state' mangled-name='irq_get_irqchip_state' filepath='include/linux/interrupt.h' line='485' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_get_irqchip_state'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='0187da1b'/>
-        <parameter type-id='d8e6b335'/>
+      <function-decl name='irq_get_irqchip_state' mangled-name='irq_get_irqchip_state' filepath='kernel/irq/manage.c' line='2689' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_get_irqchip_state'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2689' column='1'/>
+        <parameter type-id='0187da1b' name='which' filepath='kernel/irq/manage.c' line='2689' column='1'/>
+        <parameter type-id='d8e6b335' name='state' filepath='kernel/irq/manage.c' line='2690' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='irq_modify_status' mangled-name='irq_modify_status' filepath='include/linux/irq.h' line='761' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_modify_status'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='irq_modify_status' mangled-name='irq_modify_status' filepath='kernel/irq/chip.c' line='1169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_modify_status'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/chip.c' line='1169' column='1'/>
+        <parameter type-id='7359adad' name='clr' filepath='kernel/irq/chip.c' line='1169' column='1'/>
+        <parameter type-id='7359adad' name='set' filepath='kernel/irq/chip.c' line='1169' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='irq_of_parse_and_map' mangled-name='irq_of_parse_and_map' filepath='include/linux/of_irq.h' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_of_parse_and_map'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='irq_of_parse_and_map' mangled-name='irq_of_parse_and_map' filepath='drivers/of/irq.c' line='36' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_of_parse_and_map'>
+        <parameter type-id='9a537bbe' name='dev' filepath='drivers/of/irq.c' line='36' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/irq.c' line='36' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='irq_set_affinity_hint' mangled-name='irq_set_affinity_hint' filepath='kernel/irq/manage.c' line='390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_affinity_hint'>
@@ -125271,10 +125094,10 @@
         <parameter type-id='7ca8e198' name='notify' filepath='kernel/irq/manage.c' line='443' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='irq_set_chained_handler_and_data' mangled-name='irq_set_chained_handler_and_data' filepath='include/linux/irq.h' line='755' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_chained_handler_and_data'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='8937f3c2'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='irq_set_chained_handler_and_data' mangled-name='irq_set_chained_handler_and_data' filepath='kernel/irq/chip.c' line='1103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_chained_handler_and_data'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/chip.c' line='1103' column='1'/>
+        <parameter type-id='cdb741d3' name='handle' filepath='kernel/irq/chip.c' line='1103' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='kernel/irq/chip.c' line='1104' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='irq_set_chip' mangled-name='irq_set_chip' filepath='kernel/irq/chip.c' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_chip'>
@@ -125282,11 +125105,11 @@
         <parameter type-id='8846a616' name='chip' filepath='kernel/irq/chip.c' line='42' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='irq_set_chip_and_handler_name' mangled-name='irq_set_chip_and_handler_name' filepath='include/linux/irq.h' line='713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_chip_and_handler_name'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='8846a616'/>
-        <parameter type-id='8937f3c2'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='irq_set_chip_and_handler_name' mangled-name='irq_set_chip_and_handler_name' filepath='kernel/irq/chip.c' line='1120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_chip_and_handler_name'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/chip.c' line='1120' column='1'/>
+        <parameter type-id='8846a616' name='chip' filepath='kernel/irq/chip.c' line='1120' column='1'/>
+        <parameter type-id='cdb741d3' name='handle' filepath='kernel/irq/chip.c' line='1121' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/irq/chip.c' line='1121' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='irq_set_chip_data' mangled-name='irq_set_chip_data' filepath='kernel/irq/chip.c' line='146' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_chip_data'>
@@ -125309,10 +125132,10 @@
         <parameter type-id='f0981eeb' name='on' filepath='kernel/irq/manage.c' line='773' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='irq_set_irqchip_state' mangled-name='irq_set_irqchip_state' filepath='include/linux/interrupt.h' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_irqchip_state'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='0187da1b'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='irq_set_irqchip_state' mangled-name='irq_set_irqchip_state' filepath='kernel/irq/manage.c' line='2722' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_irqchip_state'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2722' column='1'/>
+        <parameter type-id='0187da1b' name='which' filepath='kernel/irq/manage.c' line='2722' column='1'/>
+        <parameter type-id='b50a4934' name='val' filepath='kernel/irq/manage.c' line='2723' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='irq_set_parent' mangled-name='irq_set_parent' filepath='kernel/irq/manage.c' line='896' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_set_parent'>
@@ -125325,20 +125148,20 @@
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/irqdesc.c' line='351' column='1'/>
         <return type-id='76c7d88b'/>
       </function-decl>
-      <function-decl name='irq_work_queue' mangled-name='irq_work_queue' filepath='include/linux/irq_work.h' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_queue'>
-        <parameter type-id='44bef697'/>
-        <return type-id='c894953d'/>
+      <function-decl name='irq_work_queue' mangled-name='irq_work_queue' filepath='kernel/irq_work.c' line='67' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_queue'>
+        <parameter type-id='44bef697' name='work' filepath='kernel/irq_work.c' line='67' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='irq_work_queue_on' mangled-name='irq_work_queue_on' filepath='include/linux/irq_work.h' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_queue_on'>
-        <parameter type-id='44bef697'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='c894953d'/>
+      <function-decl name='irq_work_queue_on' mangled-name='irq_work_queue_on' filepath='kernel/irq_work.c' line='88' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_queue_on'>
+        <parameter type-id='44bef697' name='work' filepath='kernel/irq_work.c' line='88' column='1'/>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/irq_work.c' line='88' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='irq_work_run' mangled-name='irq_work_run' filepath='include/linux/irq_work.h' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_run'>
+      <function-decl name='irq_work_run' mangled-name='irq_work_run' filepath='kernel/irq_work.c' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_run'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='irq_work_sync' mangled-name='irq_work_sync' filepath='include/linux/irq_work.h' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_sync'>
-        <parameter type-id='44bef697'/>
+      <function-decl name='irq_work_sync' mangled-name='irq_work_sync' filepath='kernel/irq_work.c' line='197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_work_sync'>
+        <parameter type-id='44bef697' name='work' filepath='kernel/irq_work.c' line='197' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='is_console_locked' mangled-name='is_console_locked' filepath='kernel/printk/printk.c' line='2385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_console_locked'>
@@ -125348,9 +125171,9 @@
         <parameter type-id='77e79a4b' name='file' filepath='drivers/dma-buf/dma-buf.c' line='465' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='is_vmalloc_addr' mangled-name='is_vmalloc_addr' filepath='include/linux/mm.h' line='806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_vmalloc_addr'>
-        <parameter type-id='eaa32e2f'/>
-        <return type-id='c894953d'/>
+      <function-decl name='is_vmalloc_addr' mangled-name='is_vmalloc_addr' filepath='mm/vmalloc.c' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_vmalloc_addr'>
+        <parameter type-id='eaa32e2f' name='x' filepath='mm/vmalloc.c' line='46' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='isolate_and_split_free_page' mangled-name='isolate_and_split_free_page' filepath='mm/compaction.c' line='767' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='isolate_and_split_free_page'>
         <parameter type-id='02f11ed4' name='page' filepath='mm/compaction.c' line='767' column='1'/>
@@ -125439,14 +125262,14 @@
         <return type-id='f0981eeb'/>
       </function-decl>
       <var-decl name='kasan_flag_enabled' type-id='237c0d27' mangled-name='kasan_flag_enabled' visibility='default' filepath='mm/kasan/hw_tags.c' line='52' column='1' elf-symbol-id='kasan_flag_enabled'/>
-      <function-decl name='kasprintf' mangled-name='kasprintf' filepath='include/linux/kernel.h' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kasprintf'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='kasprintf' mangled-name='kasprintf' filepath='lib/kasprintf.c' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kasprintf'>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='lib/kasprintf.c' line='53' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kasprintf.c' line='53' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='kern_mount' mangled-name='kern_mount' filepath='include/linux/fs.h' line='2360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kern_mount'>
-        <parameter type-id='21e53d44'/>
+      <function-decl name='kern_mount' mangled-name='kern_mount' filepath='fs/namespace.c' line='3881' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kern_mount'>
+        <parameter type-id='21e53d44' name='type' filepath='fs/namespace.c' line='3881' column='1'/>
         <return type-id='549da823'/>
       </function-decl>
       <function-decl name='kern_unmount' mangled-name='kern_unmount' filepath='fs/namespace.c' line='3896' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kern_unmount'>
@@ -125522,8 +125345,8 @@
         <parameter type-id='eaa32e2f' name='ns' filepath='fs/kernfs/dir.c' line='901' column='1'/>
         <return type-id='150efd3f'/>
       </function-decl>
-      <function-decl name='kernfs_notify' mangled-name='kernfs_notify' filepath='include/linux/kernfs.h' line='412' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_notify'>
-        <parameter type-id='150efd3f'/>
+      <function-decl name='kernfs_notify' mangled-name='kernfs_notify' filepath='fs/kernfs/file.c' line='913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_notify'>
+        <parameter type-id='150efd3f' name='kn' filepath='fs/kernfs/file.c' line='913' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kernfs_path_from_node' mangled-name='kernfs_path_from_node' filepath='fs/kernfs/dir.c' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_path_from_node'>
@@ -125533,66 +125356,66 @@
         <parameter type-id='b59d7dce' name='buflen' filepath='fs/kernfs/dir.c' line='211' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kernfs_put' mangled-name='kernfs_put' filepath='include/linux/kernfs.h' line='372' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_put'>
-        <parameter type-id='150efd3f'/>
+      <function-decl name='kernfs_put' mangled-name='kernfs_put' filepath='fs/kernfs/dir.c' line='506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernfs_put'>
+        <parameter type-id='150efd3f' name='kn' filepath='fs/kernfs/dir.c' line='506' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='key_create_or_update' mangled-name='key_create_or_update' filepath='include/linux/key.h' line='383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='key_create_or_update'>
-        <parameter type-id='446f28fb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='446f28fb'/>
+      <function-decl name='key_create_or_update' mangled-name='key_create_or_update' filepath='security/keys/key.c' line='815' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='key_create_or_update'>
+        <parameter type-id='28804ffa' name='keyring_ref' filepath='security/keys/key.c' line='815' column='1'/>
+        <parameter type-id='80f4b756' name='type' filepath='security/keys/key.c' line='816' column='1'/>
+        <parameter type-id='80f4b756' name='description' filepath='security/keys/key.c' line='817' column='1'/>
+        <parameter type-id='eaa32e2f' name='payload' filepath='security/keys/key.c' line='818' column='1'/>
+        <parameter type-id='b59d7dce' name='plen' filepath='security/keys/key.c' line='819' column='1'/>
+        <parameter type-id='296adac1' name='perm' filepath='security/keys/key.c' line='820' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='security/keys/key.c' line='821' column='1'/>
+        <return type-id='28804ffa'/>
       </function-decl>
-      <function-decl name='key_put' mangled-name='key_put' filepath='include/linux/key.h' line='296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='key_put'>
-        <parameter type-id='204a4632'/>
+      <function-decl name='key_put' mangled-name='key_put' filepath='security/keys/key.c' line='646' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='key_put'>
+        <parameter type-id='204a4632' name='key' filepath='security/keys/key.c' line='646' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='keyring_alloc' mangled-name='keyring_alloc' filepath='include/linux/key.h' line='406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='keyring_alloc'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='e8b29774'/>
-        <parameter type-id='bac1227a'/>
-        <parameter type-id='bc33861a'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='92daca01'/>
-        <parameter type-id='204a4632'/>
+      <function-decl name='keyring_alloc' mangled-name='keyring_alloc' filepath='security/keys/keyring.c' line='517' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='keyring_alloc'>
+        <parameter type-id='80f4b756' name='description' filepath='security/keys/keyring.c' line='517' column='1'/>
+        <parameter type-id='d80b72e6' name='uid' filepath='security/keys/keyring.c' line='517' column='1'/>
+        <parameter type-id='094d8048' name='gid' filepath='security/keys/keyring.c' line='517' column='1'/>
+        <parameter type-id='bc33861a' name='cred' filepath='security/keys/keyring.c' line='518' column='1'/>
+        <parameter type-id='296adac1' name='perm' filepath='security/keys/keyring.c' line='518' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='security/keys/keyring.c' line='519' column='1'/>
+        <parameter type-id='92daca01' name='restrict_link' filepath='security/keys/keyring.c' line='520' column='1'/>
+        <parameter type-id='204a4632' name='dest' filepath='security/keys/keyring.c' line='521' column='1'/>
         <return type-id='204a4632'/>
       </function-decl>
-      <function-decl name='kfree' mangled-name='kfree' filepath='include/linux/slab.h' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='kfree' mangled-name='kfree' filepath='mm/slub.c' line='4162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree'>
+        <parameter type-id='eaa32e2f' name='x' filepath='mm/slub.c' line='4162' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kfree_const' mangled-name='kfree_const' filepath='include/linux/string.h' line='174' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_const'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='kfree_const' mangled-name='kfree_const' filepath='mm/util.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_const'>
+        <parameter type-id='eaa32e2f' name='x' filepath='mm/util.c' line='40' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kfree_sensitive' mangled-name='kfree_sensitive' filepath='mm/slab_common.c' line='1153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_sensitive'>
         <parameter type-id='eaa32e2f' name='p' filepath='mm/slab_common.c' line='1153' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kfree_skb' mangled-name='kfree_skb' filepath='include/linux/skbuff.h' line='1062' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_skb'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='kfree_skb' mangled-name='kfree_skb' filepath='net/core/skbuff.c' line='706' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_skb'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='706' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kfree_skb_list' mangled-name='kfree_skb_list' filepath='include/linux/skbuff.h' line='1063' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_skb_list'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='kfree_skb_list' mangled-name='kfree_skb_list' filepath='net/core/skbuff.c' line='717' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_skb_list'>
+        <parameter type-id='0fbf3cfd' name='segs' filepath='net/core/skbuff.c' line='717' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kick_all_cpus_sync' mangled-name='kick_all_cpus_sync' filepath='include/linux/smp.h' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kick_all_cpus_sync'>
+      <function-decl name='kick_all_cpus_sync' mangled-name='kick_all_cpus_sync' filepath='kernel/smp.c' line='938' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kick_all_cpus_sync'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kill_anon_super' mangled-name='kill_anon_super' filepath='fs/super.c' line='1105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_anon_super'>
         <parameter type-id='42c8f564' name='sb' filepath='fs/super.c' line='1105' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kill_fasync' mangled-name='kill_fasync' filepath='include/linux/fs.h' line='1362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_fasync'>
-        <parameter type-id='dc750055'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='kill_fasync' mangled-name='kill_fasync' filepath='fs/fcntl.c' line='1019' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_fasync'>
+        <parameter type-id='dc750055' name='fp' filepath='fs/fcntl.c' line='1019' column='1'/>
+        <parameter type-id='95e97e5e' name='sig' filepath='fs/fcntl.c' line='1019' column='1'/>
+        <parameter type-id='95e97e5e' name='band' filepath='fs/fcntl.c' line='1019' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kill_litter_super' mangled-name='kill_litter_super' filepath='fs/super.c' line='1113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kill_litter_super'>
@@ -125612,21 +125435,21 @@
         <parameter type-id='f0981eeb' name='order' filepath='mm/slab_common.c' line='839' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kmalloc_order_trace' mangled-name='kmalloc_order_trace' filepath='include/linux/slab.h' line='469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmalloc_order_trace'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='kmalloc_order_trace' mangled-name='kmalloc_order_trace' filepath='mm/slab_common.c' line='862' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmalloc_order_trace'>
+        <parameter type-id='b59d7dce' name='size' filepath='mm/slab_common.c' line='862' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='862' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='mm/slab_common.c' line='862' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kmem_cache_alloc' mangled-name='kmem_cache_alloc' filepath='include/linux/slab.h' line='390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_alloc'>
-        <parameter type-id='f3b4aca8'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='kmem_cache_alloc' mangled-name='kmem_cache_alloc' filepath='mm/slub.c' line='2952' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_alloc'>
+        <parameter type-id='f3b4aca8' name='s' filepath='mm/slub.c' line='2952' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfpflags' filepath='mm/slub.c' line='2952' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kmem_cache_alloc_trace' mangled-name='kmem_cache_alloc_trace' filepath='include/linux/slab.h' line='428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_alloc_trace'>
-        <parameter type-id='f3b4aca8'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='kmem_cache_alloc_trace' mangled-name='kmem_cache_alloc_trace' filepath='mm/slub.c' line='2964' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_alloc_trace'>
+        <parameter type-id='f3b4aca8' name='s' filepath='mm/slub.c' line='2964' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfpflags' filepath='mm/slub.c' line='2964' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='mm/slub.c' line='2964' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='kmem_cache_create' mangled-name='kmem_cache_create' filepath='mm/slab_common.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_create'>
@@ -125637,23 +125460,23 @@
         <parameter type-id='b7f9d8e6' name='ctor' filepath='mm/slab_common.c' line='409' column='1'/>
         <return type-id='f3b4aca8'/>
       </function-decl>
-      <function-decl name='kmem_cache_create_usercopy' mangled-name='kmem_cache_create_usercopy' filepath='include/linux/slab.h' line='150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_create_usercopy'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='b7f9d8e6'/>
+      <function-decl name='kmem_cache_create_usercopy' mangled-name='kmem_cache_create_usercopy' filepath='mm/slab_common.c' line='303' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_create_usercopy'>
+        <parameter type-id='80f4b756' name='name' filepath='mm/slab_common.c' line='303' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='mm/slab_common.c' line='304' column='1'/>
+        <parameter type-id='f0981eeb' name='align' filepath='mm/slab_common.c' line='304' column='1'/>
+        <parameter type-id='f7fe96cb' name='flags' filepath='mm/slab_common.c' line='305' column='1'/>
+        <parameter type-id='f0981eeb' name='useroffset' filepath='mm/slab_common.c' line='306' column='1'/>
+        <parameter type-id='f0981eeb' name='usersize' filepath='mm/slab_common.c' line='306' column='1'/>
+        <parameter type-id='b7f9d8e6' name='ctor' filepath='mm/slab_common.c' line='307' column='1'/>
         <return type-id='f3b4aca8'/>
       </function-decl>
-      <function-decl name='kmem_cache_destroy' mangled-name='kmem_cache_destroy' filepath='include/linux/slab.h' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_destroy'>
-        <parameter type-id='f3b4aca8'/>
+      <function-decl name='kmem_cache_destroy' mangled-name='kmem_cache_destroy' filepath='mm/slab_common.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_destroy'>
+        <parameter type-id='f3b4aca8' name='s' filepath='mm/slab_common.c' line='487' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kmem_cache_free' mangled-name='kmem_cache_free' filepath='include/linux/slab.h' line='391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_free'>
-        <parameter type-id='f3b4aca8'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='kmem_cache_free' mangled-name='kmem_cache_free' filepath='mm/slub.c' line='3206' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_free'>
+        <parameter type-id='f3b4aca8' name='s' filepath='mm/slub.c' line='3206' column='1'/>
+        <parameter type-id='eaa32e2f' name='x' filepath='mm/slub.c' line='3206' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kmemdup' mangled-name='kmemdup' filepath='mm/util.c' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmemdup'>
@@ -125662,10 +125485,10 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='mm/util.c' line='127' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kmemdup_nul' mangled-name='kmemdup_nul' filepath='include/linux/string.h' line='180' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmemdup_nul'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='kmemdup_nul' mangled-name='kmemdup_nul' filepath='mm/util.c' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmemdup_nul'>
+        <parameter type-id='80f4b756' name='s' filepath='mm/util.c' line='147' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='mm/util.c' line='147' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/util.c' line='147' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='kmsg_dump_get_buffer' mangled-name='kmsg_dump_get_buffer' filepath='kernel/printk/printk.c' line='3384' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_get_buffer'>
@@ -125697,46 +125520,46 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kobj_sysfs_ops' type-id='0f840455' mangled-name='kobj_sysfs_ops' visibility='default' filepath='lib/kobject.c' line='860' column='1' elf-symbol-id='kobj_sysfs_ops'/>
-      <function-decl name='kobject_add' mangled-name='kobject_add' filepath='include/linux/kobject.h' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_add'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='kobject_add' mangled-name='kobject_add' filepath='lib/kobject.c' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_add'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='426' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='426' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='427' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kobject_create_and_add' mangled-name='kobject_create_and_add' filepath='include/linux/kobject.h' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_create_and_add'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='d30bdc51'/>
+      <function-decl name='kobject_create_and_add' mangled-name='kobject_create_and_add' filepath='lib/kobject.c' line='805' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_create_and_add'>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='805' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='805' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kobject_del' mangled-name='kobject_del' filepath='include/linux/kobject.h' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_del'>
-        <parameter type-id='d30bdc51'/>
+      <function-decl name='kobject_del' mangled-name='kobject_del' filepath='lib/kobject.c' line='635' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_del'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='635' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_get' mangled-name='kobject_get' filepath='include/linux/kobject.h' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_get'>
-        <parameter type-id='d30bdc51'/>
+      <function-decl name='kobject_get' mangled-name='kobject_get' filepath='lib/kobject.c' line='652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_get'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='652' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kobject_init' mangled-name='kobject_init' filepath='include/linux/kobject.h' line='99' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='c48b394e'/>
+      <function-decl name='kobject_init' mangled-name='kobject_init' filepath='lib/kobject.c' line='349' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='349' column='1'/>
+        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='349' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_init_and_add' mangled-name='kobject_init_and_add' filepath='include/linux/kobject.h' line='104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init_and_add'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='c48b394e'/>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='kobject_init_and_add' mangled-name='kobject_init_and_add' filepath='lib/kobject.c' line='464' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_init_and_add'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='464' column='1'/>
+        <parameter type-id='c48b394e' name='ktype' filepath='lib/kobject.c' line='464' column='1'/>
+        <parameter type-id='d30bdc51' name='parent' filepath='lib/kobject.c' line='465' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='465' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kobject_put' mangled-name='kobject_put' filepath='include/linux/kobject.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_put'>
-        <parameter type-id='d30bdc51'/>
+      <function-decl name='kobject_put' mangled-name='kobject_put' filepath='lib/kobject.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_put'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='746' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kobject_set_name' mangled-name='kobject_set_name' filepath='include/linux/kobject.h' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_set_name'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='kobject_set_name' mangled-name='kobject_set_name' filepath='lib/kobject.c' line='324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_set_name'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject.c' line='324' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kobject.c' line='324' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -125745,31 +125568,31 @@
         <parameter type-id='7d635811' name='action' filepath='lib/kobject_uevent.c' line='640' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kobject_uevent_env' mangled-name='kobject_uevent_env' filepath='include/linux/kobject.h' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_uevent_env'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='7d635811'/>
-        <parameter type-id='9b23c9ad'/>
+      <function-decl name='kobject_uevent_env' mangled-name='kobject_uevent_env' filepath='lib/kobject_uevent.c' line='457' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kobject_uevent_env'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='lib/kobject_uevent.c' line='457' column='1'/>
+        <parameter type-id='7d635811' name='action' filepath='lib/kobject_uevent.c' line='457' column='1'/>
+        <parameter type-id='9b23c9ad' name='envp_ext' filepath='lib/kobject_uevent.c' line='458' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='krealloc' mangled-name='krealloc' filepath='include/linux/slab.h' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='krealloc'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='krealloc' mangled-name='krealloc' filepath='mm/slab_common.c' line='1125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='krealloc'>
+        <parameter type-id='eaa32e2f' name='p' filepath='mm/slab_common.c' line='1125' column='1'/>
+        <parameter type-id='b59d7dce' name='new_size' filepath='mm/slab_common.c' line='1125' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='1125' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kset_create_and_add' mangled-name='kset_create_and_add' filepath='include/linux/kobject.h' line='218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_create_and_add'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='86462700'/>
-        <parameter type-id='d30bdc51'/>
+      <function-decl name='kset_create_and_add' mangled-name='kset_create_and_add' filepath='lib/kobject.c' line='1005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_create_and_add'>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='1005' column='1'/>
+        <parameter type-id='86462700' name='uevent_ops' filepath='lib/kobject.c' line='1006' column='1'/>
+        <parameter type-id='d30bdc51' name='parent_kobj' filepath='lib/kobject.c' line='1007' column='1'/>
         <return type-id='89b70200'/>
       </function-decl>
-      <function-decl name='kset_find_obj' mangled-name='kset_find_obj' filepath='include/linux/kobject.h' line='242' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_find_obj'>
-        <parameter type-id='89b70200'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='kset_find_obj' mangled-name='kset_find_obj' filepath='lib/kobject.c' line='908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_find_obj'>
+        <parameter type-id='89b70200' name='kset' filepath='lib/kobject.c' line='908' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='lib/kobject.c' line='908' column='1'/>
         <return type-id='d30bdc51'/>
       </function-decl>
-      <function-decl name='kset_unregister' mangled-name='kset_unregister' filepath='include/linux/kobject.h' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_unregister'>
-        <parameter type-id='89b70200'/>
+      <function-decl name='kset_unregister' mangled-name='kset_unregister' filepath='lib/kobject.c' line='890' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_unregister'>
+        <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='890' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ksize' mangled-name='ksize' filepath='mm/slab_common.c' line='1179' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ksize'>
@@ -125778,23 +125601,23 @@
       </function-decl>
       <var-decl name='ksoftirqd' type-id='f23e2572' mangled-name='ksoftirqd' visibility='default' filepath='kernel/softirq.c' line='60' column='1' elf-symbol-id='ksoftirqd'/>
       <var-decl name='kstat' type-id='153750ef' mangled-name='kstat' visibility='default' filepath='kernel/sched/core.c' line='4151' column='1' elf-symbol-id='kstat'/>
-      <function-decl name='kstat_irqs_cpu' mangled-name='kstat_irqs_cpu' filepath='include/linux/kernel_stat.h' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstat_irqs_cpu'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='kstat_irqs_cpu' mangled-name='kstat_irqs_cpu' filepath='kernel/irq/irqdesc.c' line='972' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstat_irqs_cpu'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/irqdesc.c' line='972' column='1'/>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/irq/irqdesc.c' line='972' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='kstat_irqs_usr' mangled-name='kstat_irqs_usr' filepath='kernel/irq/irqdesc.c' line='1021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstat_irqs_usr'>
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/irqdesc.c' line='1021' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='kstrdup' mangled-name='kstrdup' filepath='include/linux/string.h' line='176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrdup'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='kstrdup' mangled-name='kstrdup' filepath='mm/util.c' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrdup'>
+        <parameter type-id='80f4b756' name='s' filepath='mm/util.c' line='54' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/util.c' line='54' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='kstrdup_const' mangled-name='kstrdup_const' filepath='include/linux/string.h' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrdup_const'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='kstrdup_const' mangled-name='kstrdup_const' filepath='mm/util.c' line='81' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrdup_const'>
+        <parameter type-id='80f4b756' name='s' filepath='mm/util.c' line='81' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/util.c' line='81' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
       <function-decl name='kstrdup_quotable_cmdline' mangled-name='kstrdup_quotable_cmdline' filepath='lib/string_helpers.c' line='597' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrdup_quotable_cmdline'>
@@ -125802,34 +125625,34 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='lib/string_helpers.c' line='597' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='kstrndup' mangled-name='kstrndup' filepath='include/linux/string.h' line='178' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrndup'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='kstrndup' mangled-name='kstrndup' filepath='mm/util.c' line='100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrndup'>
+        <parameter type-id='80f4b756' name='s' filepath='mm/util.c' line='100' column='1'/>
+        <parameter type-id='b59d7dce' name='max' filepath='mm/util.c' line='100' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/util.c' line='100' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='kstrtobool' mangled-name='kstrtobool' filepath='include/linux/string.h' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtobool'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='d8e6b335'/>
+      <function-decl name='kstrtobool' mangled-name='kstrtobool' filepath='lib/kstrtox.c' line='335' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtobool'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='335' column='1'/>
+        <parameter type-id='d8e6b335' name='res' filepath='lib/kstrtox.c' line='335' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtobool_from_user' mangled-name='kstrtobool_from_user' filepath='include/linux/kernel.h' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtobool_from_user'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='d8e6b335'/>
+      <function-decl name='kstrtobool_from_user' mangled-name='kstrtobool_from_user' filepath='lib/kstrtox.c' line='377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtobool_from_user'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='377' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/kstrtox.c' line='377' column='1'/>
+        <parameter type-id='d8e6b335' name='res' filepath='lib/kstrtox.c' line='377' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtoint' mangled-name='kstrtoint' filepath='include/linux/kernel.h' line='393' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoint'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='kstrtoint' mangled-name='kstrtoint' filepath='lib/kstrtox.c' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoint'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='251' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='251' column='1'/>
+        <parameter type-id='7292109c' name='res' filepath='lib/kstrtox.c' line='251' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtoint_from_user' mangled-name='kstrtoint_from_user' filepath='include/linux/kernel.h' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoint_from_user'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='kstrtoint_from_user' mangled-name='kstrtoint_from_user' filepath='lib/kstrtox.c' line='409' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoint_from_user'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='409' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/kstrtox.c' line='409' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='409' column='1'/>
+        <parameter type-id='7292109c' name='res' filepath='lib/kstrtox.c' line='409' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='kstrtol_from_user' mangled-name='kstrtol_from_user' filepath='lib/kstrtox.c' line='407' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtol_from_user'>
@@ -125839,10 +125662,10 @@
         <parameter type-id='3ccc2590' name='res' filepath='lib/kstrtox.c' line='407' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtoll' mangled-name='kstrtoll' filepath='include/linux/kernel.h' line='334' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoll'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='8b97c2dc'/>
+      <function-decl name='kstrtoll' mangled-name='kstrtoll' filepath='lib/kstrtox.c' line='150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoll'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='150' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='150' column='1'/>
+        <parameter type-id='8b97c2dc' name='res' filepath='lib/kstrtox.c' line='150' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='kstrtos8' mangled-name='kstrtos8' filepath='lib/kstrtox.c' line='311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtos8'>
@@ -125858,10 +125681,10 @@
         <parameter type-id='01b75fec' name='res' filepath='lib/kstrtox.c' line='413' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtou16' mangled-name='kstrtou16' filepath='include/linux/kernel.h' line='415' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtou16'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='e9e550dd'/>
+      <function-decl name='kstrtou16' mangled-name='kstrtou16' filepath='lib/kstrtox.c' line='266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtou16'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='266' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='266' column='1'/>
+        <parameter type-id='26d4d46f' name='res' filepath='lib/kstrtox.c' line='266' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='kstrtou16_from_user' mangled-name='kstrtou16_from_user' filepath='lib/kstrtox.c' line='410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtou16_from_user'>
@@ -125871,10 +125694,10 @@
         <parameter type-id='26d4d46f' name='res' filepath='lib/kstrtox.c' line='410' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtou8' mangled-name='kstrtou8' filepath='include/linux/kernel.h' line='417' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtou8'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='kstrtou8' mangled-name='kstrtou8' filepath='lib/kstrtox.c' line='296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtou8'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='296' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='296' column='1'/>
+        <parameter type-id='8bff8096' name='res' filepath='lib/kstrtox.c' line='296' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='kstrtou8_from_user' mangled-name='kstrtou8_from_user' filepath='lib/kstrtox.c' line='412' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtou8_from_user'>
@@ -125884,37 +125707,37 @@
         <parameter type-id='8bff8096' name='res' filepath='lib/kstrtox.c' line='412' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtouint' mangled-name='kstrtouint' filepath='include/linux/kernel.h' line='392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtouint'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='kstrtouint' mangled-name='kstrtouint' filepath='lib/kstrtox.c' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtouint'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='221' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='221' column='1'/>
+        <parameter type-id='807869d3' name='res' filepath='lib/kstrtox.c' line='221' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtouint_from_user' mangled-name='kstrtouint_from_user' filepath='include/linux/kernel.h' line='425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtouint_from_user'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='kstrtouint_from_user' mangled-name='kstrtouint_from_user' filepath='lib/kstrtox.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtouint_from_user'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='408' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/kstrtox.c' line='408' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='408' column='1'/>
+        <parameter type-id='807869d3' name='res' filepath='lib/kstrtox.c' line='408' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtoul_from_user' mangled-name='kstrtoul_from_user' filepath='include/linux/kernel.h' line='423' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoul_from_user'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='1d2c2b85'/>
+      <function-decl name='kstrtoul_from_user' mangled-name='kstrtoul_from_user' filepath='lib/kstrtox.c' line='406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoul_from_user'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='406' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/kstrtox.c' line='406' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='406' column='1'/>
+        <parameter type-id='1d2c2b85' name='res' filepath='lib/kstrtox.c' line='406' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtoull' mangled-name='kstrtoull' filepath='include/linux/kernel.h' line='333' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoull'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='kstrtoull' mangled-name='kstrtoull' filepath='lib/kstrtox.c' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoull'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='127' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='127' column='1'/>
+        <parameter type-id='c0190993' name='res' filepath='lib/kstrtox.c' line='127' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kstrtoull_from_user' mangled-name='kstrtoull_from_user' filepath='include/linux/kernel.h' line='421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoull_from_user'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='kstrtoull_from_user' mangled-name='kstrtoull_from_user' filepath='lib/kstrtox.c' line='404' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kstrtoull_from_user'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='404' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/kstrtox.c' line='404' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='404' column='1'/>
+        <parameter type-id='c0190993' name='res' filepath='lib/kstrtox.c' line='404' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='ksys_sync_helper' mangled-name='ksys_sync_helper' filepath='kernel/power/main.c' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ksys_sync_helper'>
@@ -125925,9 +125748,9 @@
         <parameter type-id='f0981eeb' name='cpu' filepath='kernel/kthread.c' line='490' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kthread_bind_mask' mangled-name='kthread_bind_mask' filepath='include/linux/kthread.h' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_bind_mask'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='5f8a1ac4'/>
+      <function-decl name='kthread_bind_mask' mangled-name='kthread_bind_mask' filepath='kernel/kthread.c' line='475' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_bind_mask'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/kthread.c' line='475' column='1'/>
+        <parameter type-id='5f8a1ac4' name='mask' filepath='kernel/kthread.c' line='475' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kthread_cancel_delayed_work_sync' mangled-name='kthread_cancel_delayed_work_sync' filepath='kernel/kthread.c' line='1278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_cancel_delayed_work_sync'>
@@ -125938,11 +125761,11 @@
         <parameter type-id='401eb95c' name='work' filepath='kernel/kthread.c' line='1263' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='kthread_create_on_node' mangled-name='kthread_create_on_node' filepath='include/linux/kthread.h' line='11' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_create_on_node'>
-        <parameter type-id='b9b212f5'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='kthread_create_on_node' mangled-name='kthread_create_on_node' filepath='kernel/kthread.c' line='438' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_create_on_node'>
+        <parameter type-id='b9b212f5' name='threadfn' filepath='kernel/kthread.c' line='438' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='kernel/kthread.c' line='439' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='kernel/kthread.c' line='439' column='1'/>
+        <parameter type-id='80f4b756' name='namefmt' filepath='kernel/kthread.c' line='440' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='f23e2572'/>
       </function-decl>
@@ -125974,11 +125797,11 @@
         <parameter type-id='7359adad' name='delay' filepath='kernel/kthread.c' line='1153' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='kthread_park' mangled-name='kthread_park' filepath='include/linux/kthread.h' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_park'>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='kthread_park' mangled-name='kthread_park' filepath='kernel/kthread.c' line='587' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_park'>
+        <parameter type-id='f23e2572' name='k' filepath='kernel/kthread.c' line='587' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kthread_parkme' mangled-name='kthread_parkme' filepath='include/linux/kthread.h' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_parkme'>
+      <function-decl name='kthread_parkme' mangled-name='kthread_parkme' filepath='kernel/kthread.c' line='259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_parkme'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kthread_queue_delayed_work' mangled-name='kthread_queue_delayed_work' filepath='kernel/kthread.c' line='1004' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_queue_delayed_work'>
@@ -125995,15 +125818,15 @@
       <function-decl name='kthread_should_park' mangled-name='kthread_should_park' filepath='kernel/kthread.c' line='151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_should_park'>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='kthread_should_stop' mangled-name='kthread_should_stop' filepath='include/linux/kthread.h' line='61' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_should_stop'>
-        <return type-id='c894953d'/>
+      <function-decl name='kthread_should_stop' mangled-name='kthread_should_stop' filepath='kernel/kthread.c' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_should_stop'>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='kthread_stop' mangled-name='kthread_stop' filepath='include/linux/kthread.h' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_stop'>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='kthread_stop' mangled-name='kthread_stop' filepath='kernel/kthread.c' line='631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_stop'>
+        <parameter type-id='f23e2572' name='k' filepath='kernel/kthread.c' line='631' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kthread_unpark' mangled-name='kthread_unpark' filepath='include/linux/kthread.h' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_unpark'>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='kthread_unpark' mangled-name='kthread_unpark' filepath='kernel/kthread.c' line='556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_unpark'>
+        <parameter type-id='f23e2572' name='k' filepath='kernel/kthread.c' line='556' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kthread_unuse_mm' mangled-name='kthread_unuse_mm' filepath='kernel/kthread.c' line='1365' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kthread_unuse_mm'>
@@ -126023,8 +125846,8 @@
         <parameter type-id='ddb8523f' name='rhs' filepath='kernel/time/hrtimer.c' line='327' column='1'/>
         <return type-id='fbc017ef'/>
       </function-decl>
-      <function-decl name='ktime_get' mangled-name='ktime_get' filepath='include/linux/timekeeping.h' line='67' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get'>
-        <return type-id='1eb56b1e'/>
+      <function-decl name='ktime_get' mangled-name='ktime_get' filepath='kernel/time/timekeeping.c' line='821' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get'>
+        <return type-id='fbc017ef'/>
       </function-decl>
       <function-decl name='ktime_get_coarse_real_ts64' mangled-name='ktime_get_coarse_real_ts64' filepath='kernel/time/timekeeping.c' line='2233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_coarse_real_ts64'>
         <parameter type-id='4151733d' name='ts' filepath='kernel/time/timekeeping.c' line='2233' column='1'/>
@@ -126034,8 +125857,8 @@
         <parameter type-id='73bb584e' name='offs' filepath='kernel/time/timekeeping.c' line='885' column='1'/>
         <return type-id='fbc017ef'/>
       </function-decl>
-      <function-decl name='ktime_get_mono_fast_ns' mangled-name='ktime_get_mono_fast_ns' filepath='include/linux/timekeeping.h' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_mono_fast_ns'>
-        <return type-id='3a47d82b'/>
+      <function-decl name='ktime_get_mono_fast_ns' mangled-name='ktime_get_mono_fast_ns' filepath='kernel/time/timekeeping.c' line='492' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_mono_fast_ns'>
+        <return type-id='91ce1af9'/>
       </function-decl>
       <function-decl name='ktime_get_raw' mangled-name='ktime_get_raw' filepath='kernel/time/timekeeping.c' line='928' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_raw'>
         <return type-id='fbc017ef'/>
@@ -126047,8 +125870,8 @@
       <function-decl name='ktime_get_real_seconds' mangled-name='ktime_get_real_seconds' filepath='kernel/time/timekeeping.c' line='1006' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_real_seconds'>
         <return type-id='1afd27ac'/>
       </function-decl>
-      <function-decl name='ktime_get_real_ts64' mangled-name='ktime_get_real_ts64' filepath='include/linux/timekeeping.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_real_ts64'>
-        <parameter type-id='4151733d'/>
+      <function-decl name='ktime_get_real_ts64' mangled-name='ktime_get_real_ts64' filepath='kernel/time/timekeeping.c' line='800' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_real_ts64'>
+        <parameter type-id='4151733d' name='ts' filepath='kernel/time/timekeeping.c' line='800' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ktime_get_seconds' mangled-name='ktime_get_seconds' filepath='kernel/time/timekeeping.c' line='986' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_seconds'>
@@ -126062,18 +125885,18 @@
         <parameter type-id='4151733d' name='ts' filepath='kernel/time/timekeeping.c' line='954' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ktime_get_with_offset' mangled-name='ktime_get_with_offset' filepath='include/linux/timekeeping.h' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_with_offset'>
-        <parameter type-id='73bb584e'/>
-        <return type-id='1eb56b1e'/>
+      <function-decl name='ktime_get_with_offset' mangled-name='ktime_get_with_offset' filepath='kernel/time/timekeeping.c' line='864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ktime_get_with_offset'>
+        <parameter type-id='73bb584e' name='offs' filepath='kernel/time/timekeeping.c' line='864' column='1'/>
+        <return type-id='fbc017ef'/>
       </function-decl>
-      <function-decl name='kvasprintf' mangled-name='kvasprintf' filepath='include/linux/kernel.h' line='489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvasprintf'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='5f919c1f'/>
+      <function-decl name='kvasprintf' mangled-name='kvasprintf' filepath='lib/kasprintf.c' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvasprintf'>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='lib/kasprintf.c' line='15' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/kasprintf.c' line='15' column='1'/>
+        <parameter type-id='2aee9912' name='ap' filepath='lib/kasprintf.c' line='15' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='kvfree' mangled-name='kvfree' filepath='include/linux/mm.h' line='848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='kvfree' mangled-name='kvfree' filepath='mm/util.c' line='604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree'>
+        <parameter type-id='eaa32e2f' name='addr' filepath='mm/util.c' line='604' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kvfree_call_rcu' mangled-name='kvfree_call_rcu' filepath='kernel/rcu/tree.c' line='3465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree_call_rcu'>
@@ -126081,10 +125904,10 @@
         <parameter type-id='4edd56e3' name='func' filepath='kernel/rcu/tree.c' line='3465' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kvmalloc_node' mangled-name='kvmalloc_node' filepath='include/linux/mm.h' line='819' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvmalloc_node'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='kvmalloc_node' mangled-name='kvmalloc_node' filepath='mm/util.c' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvmalloc_node'>
+        <parameter type-id='b59d7dce' name='size' filepath='mm/util.c' line='554' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='mm/util.c' line='554' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='mm/util.c' line='554' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='led_classdev_flash_register_ext' mangled-name='led_classdev_flash_register_ext' filepath='drivers/leds/led-class-flash.c' line='285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_classdev_flash_register_ext'>
@@ -126097,14 +125920,14 @@
         <parameter type-id='26deddb9' name='fled_cdev' filepath='drivers/leds/led-class-flash.c' line='321' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='led_classdev_register_ext' mangled-name='led_classdev_register_ext' filepath='include/linux/leds.h' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_classdev_register_ext'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='bd1c8eb6'/>
-        <parameter type-id='eebb8ee8'/>
+      <function-decl name='led_classdev_register_ext' mangled-name='led_classdev_register_ext' filepath='drivers/leds/led-class.c' line='336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_classdev_register_ext'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/leds/led-class.c' line='336' column='1'/>
+        <parameter type-id='bd1c8eb6' name='led_cdev' filepath='drivers/leds/led-class.c' line='337' column='1'/>
+        <parameter type-id='eebb8ee8' name='init_data' filepath='drivers/leds/led-class.c' line='338' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='led_classdev_unregister' mangled-name='led_classdev_unregister' filepath='include/linux/leds.h' line='202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_classdev_unregister'>
-        <parameter type-id='bd1c8eb6'/>
+      <function-decl name='led_classdev_unregister' mangled-name='led_classdev_unregister' filepath='drivers/leds/led-class.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_classdev_unregister'>
+        <parameter type-id='bd1c8eb6' name='led_cdev' filepath='drivers/leds/led-class.c' line='431' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='led_get_flash_fault' mangled-name='led_get_flash_fault' filepath='drivers/leds/led-class-flash.c' line='406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_get_flash_fault'>
@@ -126140,18 +125963,18 @@
         <parameter type-id='bd1c8eb6' name='led_cdev' filepath='drivers/leds/led-core.c' line='362' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='led_trigger_event' mangled-name='led_trigger_event' filepath='include/linux/leds.h' line='386' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_event'>
-        <parameter type-id='db6d90a1'/>
-        <parameter type-id='fa598f35'/>
+      <function-decl name='led_trigger_event' mangled-name='led_trigger_event' filepath='drivers/leds/led-triggers.c' line='377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_event'>
+        <parameter type-id='db6d90a1' name='trig' filepath='drivers/leds/led-triggers.c' line='377' column='1'/>
+        <parameter type-id='fa598f35' name='brightness' filepath='drivers/leds/led-triggers.c' line='378' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='led_trigger_register' mangled-name='led_trigger_register' filepath='drivers/leds/led-triggers.c' line='283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_register'>
         <parameter type-id='db6d90a1' name='trig' filepath='drivers/leds/led-triggers.c' line='283' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='led_trigger_register_simple' mangled-name='led_trigger_register_simple' filepath='include/linux/leds.h' line='383' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_register_simple'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f87a8ad1'/>
+      <function-decl name='led_trigger_register_simple' mangled-name='led_trigger_register_simple' filepath='drivers/leds/led-triggers.c' line='433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_register_simple'>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/leds/led-triggers.c' line='433' column='1'/>
+        <parameter type-id='f87a8ad1' name='tp' filepath='drivers/leds/led-triggers.c' line='433' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='led_trigger_remove' mangled-name='led_trigger_remove' filepath='drivers/leds/led-triggers.c' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_remove'>
@@ -126162,8 +125985,8 @@
         <parameter type-id='db6d90a1' name='trig' filepath='drivers/leds/led-triggers.c' line='323' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='led_trigger_unregister_simple' mangled-name='led_trigger_unregister_simple' filepath='include/linux/leds.h' line='385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_unregister_simple'>
-        <parameter type-id='db6d90a1'/>
+      <function-decl name='led_trigger_unregister_simple' mangled-name='led_trigger_unregister_simple' filepath='drivers/leds/led-triggers.c' line='457' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_trigger_unregister_simple'>
+        <parameter type-id='db6d90a1' name='trig' filepath='drivers/leds/led-triggers.c' line='457' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='led_update_brightness' mangled-name='led_update_brightness' filepath='drivers/leds/led-core.c' line='311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='led_update_brightness'>
@@ -126174,29 +125997,29 @@
         <parameter type-id='26deddb9' name='fled_cdev' filepath='drivers/leds/led-class-flash.c' line='428' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='list_sort' mangled-name='list_sort' filepath='include/linux/list_sort.h' line='10' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='list_sort'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='e84b031a'/>
-        <parameter type-id='120d5729'/>
+      <function-decl name='list_sort' mangled-name='list_sort' filepath='lib/list_sort.c' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='list_sort'>
+        <parameter type-id='eaa32e2f' name='priv' filepath='lib/list_sort.c' line='188' column='1'/>
+        <parameter type-id='e84b031a' name='head' filepath='lib/list_sort.c' line='188' column='1'/>
+        <parameter type-id='120d5729' name='cmp' filepath='lib/list_sort.c' line='189' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='llist_add_batch' mangled-name='llist_add_batch' filepath='include/linux/llist.h' line='197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='llist_add_batch'>
-        <parameter type-id='023b769e'/>
-        <parameter type-id='023b769e'/>
-        <parameter type-id='b0222d74'/>
-        <return type-id='c894953d'/>
+      <function-decl name='llist_add_batch' mangled-name='llist_add_batch' filepath='lib/llist.c' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='llist_add_batch'>
+        <parameter type-id='023b769e' name='new_first' filepath='lib/llist.c' line='26' column='1'/>
+        <parameter type-id='023b769e' name='new_last' filepath='lib/llist.c' line='26' column='1'/>
+        <parameter type-id='b0222d74' name='head' filepath='lib/llist.c' line='27' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='llist_reverse_order' mangled-name='llist_reverse_order' filepath='include/linux/llist.h' line='227' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='llist_reverse_order'>
-        <parameter type-id='023b769e'/>
+      <function-decl name='llist_reverse_order' mangled-name='llist_reverse_order' filepath='lib/llist.c' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='llist_reverse_order'>
+        <parameter type-id='023b769e' name='head' filepath='lib/llist.c' line='79' column='1'/>
         <return type-id='023b769e'/>
       </function-decl>
-      <function-decl name='lock_sock_nested' mangled-name='lock_sock_nested' filepath='include/net/sock.h' line='1590' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lock_sock_nested'>
-        <parameter type-id='f772df6d'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='lock_sock_nested' mangled-name='lock_sock_nested' filepath='net/core/sock.c' line='3051' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lock_sock_nested'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3051' column='1'/>
+        <parameter type-id='95e97e5e' name='subclass' filepath='net/core/sock.c' line='3051' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='lockref_get' mangled-name='lockref_get' filepath='include/linux/lockref.h' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lockref_get'>
-        <parameter type-id='5bfdb453'/>
+      <function-decl name='lockref_get' mangled-name='lockref_get' filepath='lib/lockref.c' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lockref_get'>
+        <parameter type-id='5bfdb453' name='lockref' filepath='lib/lockref.c' line='44' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='log_abnormal_wakeup_reason' mangled-name='log_abnormal_wakeup_reason' filepath='kernel/power/wakeup_reason.c' line='249' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='log_abnormal_wakeup_reason'>
@@ -126215,11 +126038,11 @@
         <parameter type-id='95e97e5e' name='parent_irq' filepath='kernel/power/wakeup_reason.c' line='173' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='logfc' mangled-name='logfc' filepath='include/linux/fs_context.h' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='logfc'>
-        <parameter type-id='d1a78aeb'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='a84c031d'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='logfc' mangled-name='logfc' filepath='fs/fs_context.c' line='362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='logfc'>
+        <parameter type-id='d1a78aeb' name='log' filepath='fs/fs_context.c' line='362' column='1'/>
+        <parameter type-id='80f4b756' name='prefix' filepath='fs/fs_context.c' line='362' column='1'/>
+        <parameter type-id='a84c031d' name='level' filepath='fs/fs_context.c' line='362' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='fs/fs_context.c' line='362' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
@@ -126227,8 +126050,8 @@
         <parameter type-id='80f4b756' name='pathname' filepath='fs/block_dev.c' line='2088' column='1'/>
         <return type-id='b88dd945'/>
       </function-decl>
-      <function-decl name='lookup_page_ext' mangled-name='lookup_page_ext' filepath='include/linux/page_ext.h' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lookup_page_ext'>
-        <parameter type-id='b72f2447'/>
+      <function-decl name='lookup_page_ext' mangled-name='lookup_page_ext' filepath='mm/page_ext.c' line='194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lookup_page_ext'>
+        <parameter type-id='b72f2447' name='page' filepath='mm/page_ext.c' line='194' column='1'/>
         <return type-id='459ae684'/>
       </function-decl>
       <var-decl name='loops_per_jiffy' type-id='7359adad' mangled-name='loops_per_jiffy' visibility='default' filepath='init/main.c' line='231' column='1' elf-symbol-id='loops_per_jiffy'/>
@@ -126246,11 +126069,11 @@
         <parameter type-id='eaa32e2f' name='wrkmem' filepath='lib/lzo/lzo1x_compress.c' line='383' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='lzo1x_decompress_safe' mangled-name='lzo1x_decompress_safe' filepath='include/linux/lzo.h' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lzo1x_decompress_safe'>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='1d2c2b85'/>
+      <function-decl name='lzo1x_decompress_safe' mangled-name='lzo1x_decompress_safe' filepath='lib/lzo/lzo1x_decompress_safe.c' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lzo1x_decompress_safe'>
+        <parameter type-id='354f7eb9' name='in' filepath='lib/lzo/lzo1x_decompress_safe.c' line='39' column='1'/>
+        <parameter type-id='b59d7dce' name='in_len' filepath='lib/lzo/lzo1x_decompress_safe.c' line='39' column='1'/>
+        <parameter type-id='cf536864' name='out' filepath='lib/lzo/lzo1x_decompress_safe.c' line='40' column='1'/>
+        <parameter type-id='78c01427' name='out_len' filepath='lib/lzo/lzo1x_decompress_safe.c' line='40' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='lzorle1x_1_compress' mangled-name='lzorle1x_1_compress' filepath='lib/lzo/lzo1x_compress.c' line='388' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lzorle1x_1_compress'>
@@ -126278,21 +126101,21 @@
         <parameter type-id='7292109c' name='result' filepath='lib/parser.c' line='232' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='match_int' mangled-name='match_int' filepath='include/linux/parser.h' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='match_int'>
-        <parameter type-id='8567d8b1'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='match_int' mangled-name='match_int' filepath='lib/parser.c' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='match_int'>
+        <parameter type-id='4d03589b' name='s' filepath='lib/parser.c' line='185' column='1'/>
+        <parameter type-id='7292109c' name='result' filepath='lib/parser.c' line='185' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='match_string' mangled-name='match_string' filepath='include/linux/string.h' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='match_string'>
-        <parameter type-id='13956559'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='match_string' mangled-name='match_string' filepath='lib/string.c' line='737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='match_string'>
+        <parameter type-id='13956559' name='array' filepath='lib/string.c' line='737' column='1'/>
+        <parameter type-id='b59d7dce' name='n' filepath='lib/string.c' line='737' column='1'/>
+        <parameter type-id='80f4b756' name='string' filepath='lib/string.c' line='737' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='match_token' mangled-name='match_token' filepath='include/linux/parser.h' line='30' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='match_token'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='a58c17e3'/>
-        <parameter type-id='8567d8b1'/>
+      <function-decl name='match_token' mangled-name='match_token' filepath='lib/parser.c' line='105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='match_token'>
+        <parameter type-id='26a90f95' name='s' filepath='lib/parser.c' line='105' column='1'/>
+        <parameter type-id='a58c17e3' name='table' filepath='lib/parser.c' line='105' column='1'/>
+        <parameter type-id='4d03589b' name='args' filepath='lib/parser.c' line='105' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mbox_chan_received_data' mangled-name='mbox_chan_received_data' filepath='drivers/mailbox/mailbox.c' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_chan_received_data'>
@@ -126305,9 +126128,9 @@
         <parameter type-id='95e97e5e' name='r' filepath='drivers/mailbox/mailbox.c' line='170' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mbox_client_txdone' mangled-name='mbox_client_txdone' filepath='include/linux/mailbox_client.h' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_client_txdone'>
-        <parameter type-id='339c87e8'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='mbox_client_txdone' mangled-name='mbox_client_txdone' filepath='drivers/mailbox/mailbox.c' line='191' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_client_txdone'>
+        <parameter type-id='339c87e8' name='chan' filepath='drivers/mailbox/mailbox.c' line='191' column='1'/>
+        <parameter type-id='95e97e5e' name='r' filepath='drivers/mailbox/mailbox.c' line='191' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mbox_controller_register' mangled-name='mbox_controller_register' filepath='drivers/mailbox/mailbox.c' line='478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_controller_register'>
@@ -126318,13 +126141,13 @@
         <parameter type-id='fb648468' name='mbox' filepath='drivers/mailbox/mailbox.c' line='529' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mbox_free_channel' mangled-name='mbox_free_channel' filepath='include/linux/mailbox_client.h' line='47' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_free_channel'>
-        <parameter type-id='339c87e8'/>
+      <function-decl name='mbox_free_channel' mangled-name='mbox_free_channel' filepath='drivers/mailbox/mailbox.c' line='438' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_free_channel'>
+        <parameter type-id='339c87e8' name='chan' filepath='drivers/mailbox/mailbox.c' line='438' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mbox_request_channel' mangled-name='mbox_request_channel' filepath='include/linux/mailbox_client.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_request_channel'>
-        <parameter type-id='aeae13b9'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='mbox_request_channel' mangled-name='mbox_request_channel' filepath='drivers/mailbox/mailbox.c' line='331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_request_channel'>
+        <parameter type-id='aeae13b9' name='cl' filepath='drivers/mailbox/mailbox.c' line='331' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/mailbox/mailbox.c' line='331' column='1'/>
         <return type-id='339c87e8'/>
       </function-decl>
       <function-decl name='mbox_request_channel_byname' mangled-name='mbox_request_channel_byname' filepath='drivers/mailbox/mailbox.c' line='402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_request_channel_byname'>
@@ -126332,50 +126155,50 @@
         <parameter type-id='80f4b756' name='name' filepath='drivers/mailbox/mailbox.c' line='403' column='1'/>
         <return type-id='339c87e8'/>
       </function-decl>
-      <function-decl name='mbox_send_message' mangled-name='mbox_send_message' filepath='include/linux/mailbox_client.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_send_message'>
-        <parameter type-id='339c87e8'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='mbox_send_message' mangled-name='mbox_send_message' filepath='drivers/mailbox/mailbox.c' line='250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mbox_send_message'>
+        <parameter type-id='339c87e8' name='chan' filepath='drivers/mailbox/mailbox.c' line='250' column='1'/>
+        <parameter type-id='eaa32e2f' name='mssg' filepath='drivers/mailbox/mailbox.c' line='250' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mctrl_gpio_disable_ms' mangled-name='mctrl_gpio_disable_ms' filepath='drivers/tty/serial/8250/../serial_mctrl_gpio.h' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_disable_ms'>
-        <parameter type-id='967c9384'/>
+      <function-decl name='mctrl_gpio_disable_ms' mangled-name='mctrl_gpio_disable_ms' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='281' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_disable_ms'>
+        <parameter type-id='967c9384' name='gpios' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='281' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mctrl_gpio_enable_ms' mangled-name='mctrl_gpio_enable_ms' filepath='drivers/tty/serial/8250/../serial_mctrl_gpio.h' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_enable_ms'>
-        <parameter type-id='967c9384'/>
+      <function-decl name='mctrl_gpio_enable_ms' mangled-name='mctrl_gpio_enable_ms' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_enable_ms'>
+        <parameter type-id='967c9384' name='gpios' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='256' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mctrl_gpio_get' mangled-name='mctrl_gpio_get' filepath='drivers/tty/serial/8250/../serial_mctrl_gpio.h' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_get'>
-        <parameter type-id='967c9384'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='mctrl_gpio_get' mangled-name='mctrl_gpio_get' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='76' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_get'>
+        <parameter type-id='967c9384' name='gpios' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='76' column='1'/>
+        <parameter type-id='807869d3' name='mctrl' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='76' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='mctrl_gpio_init' mangled-name='mctrl_gpio_init' filepath='drivers/tty/serial/8250/../serial_mctrl_gpio.h' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_init'>
-        <parameter type-id='af051c69'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='mctrl_gpio_init' mangled-name='mctrl_gpio_init' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_init'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='192' column='1'/>
+        <parameter type-id='f0981eeb' name='idx' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='192' column='1'/>
         <return type-id='967c9384'/>
       </function-decl>
-      <function-decl name='mctrl_gpio_set' mangled-name='mctrl_gpio_set' filepath='drivers/tty/serial/8250/../serial_mctrl_gpio.h' line='38' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_set'>
-        <parameter type-id='967c9384'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='mctrl_gpio_set' mangled-name='mctrl_gpio_set' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mctrl_gpio_set'>
+        <parameter type-id='967c9384' name='gpios' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='45' column='1'/>
+        <parameter type-id='f0981eeb' name='mctrl' filepath='drivers/tty/serial/serial_mctrl_gpio.c' line='45' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mdio_device_reset' mangled-name='mdio_device_reset' filepath='include/linux/mdio.h' line='94' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdio_device_reset'>
-        <parameter type-id='efa21d3b'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='mdio_device_reset' mangled-name='mdio_device_reset' filepath='drivers/net/phy/mdio_device.c' line='116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdio_device_reset'>
+        <parameter type-id='efa21d3b' name='mdiodev' filepath='drivers/net/phy/mdio_device.c' line='116' column='1'/>
+        <parameter type-id='95e97e5e' name='value' filepath='drivers/net/phy/mdio_device.c' line='116' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mdiobus_alloc_size' mangled-name='mdiobus_alloc_size' filepath='include/linux/phy.h' line='374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_alloc_size'>
-        <parameter type-id='7359adad'/>
+      <function-decl name='mdiobus_alloc_size' mangled-name='mdiobus_alloc_size' filepath='drivers/net/phy/mdio_bus.c' line='137' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_alloc_size'>
+        <parameter type-id='b59d7dce' name='size' filepath='drivers/net/phy/mdio_bus.c' line='137' column='1'/>
         <return type-id='ff47b24b'/>
       </function-decl>
-      <function-decl name='mdiobus_free' mangled-name='mdiobus_free' filepath='include/linux/phy.h' line='395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_free'>
-        <parameter type-id='ff47b24b'/>
+      <function-decl name='mdiobus_free' mangled-name='mdiobus_free' filepath='drivers/net/phy/mdio_bus.c' line='643' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_free'>
+        <parameter type-id='ff47b24b' name='bus' filepath='drivers/net/phy/mdio_bus.c' line='643' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mdiobus_get_phy' mangled-name='mdiobus_get_phy' filepath='include/linux/mdio.h' line='370' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_get_phy'>
-        <parameter type-id='ff47b24b'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='mdiobus_get_phy' mangled-name='mdiobus_get_phy' filepath='drivers/net/phy/mdio_bus.c' line='109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_get_phy'>
+        <parameter type-id='ff47b24b' name='bus' filepath='drivers/net/phy/mdio_bus.c' line='109' column='1'/>
+        <parameter type-id='95e97e5e' name='addr' filepath='drivers/net/phy/mdio_bus.c' line='109' column='1'/>
         <return type-id='7efbcaaf'/>
       </function-decl>
       <function-decl name='mdiobus_is_registered_device' mangled-name='mdiobus_is_registered_device' filepath='drivers/net/phy/mdio_bus.c' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_is_registered_device'>
@@ -126389,8 +126212,8 @@
         <parameter type-id='19c2251e' name='regnum' filepath='drivers/net/phy/mdio_bus.c' line='847' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mdiobus_unregister' mangled-name='mdiobus_unregister' filepath='include/linux/phy.h' line='394' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_unregister'>
-        <parameter type-id='ff47b24b'/>
+      <function-decl name='mdiobus_unregister' mangled-name='mdiobus_unregister' filepath='drivers/net/phy/mdio_bus.c' line='606' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_unregister'>
+        <parameter type-id='ff47b24b' name='bus' filepath='drivers/net/phy/mdio_bus.c' line='606' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mdiobus_write' mangled-name='mdiobus_write' filepath='drivers/net/phy/mdio_bus.c' line='896' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mdiobus_write'>
@@ -126461,9 +126284,9 @@
         <parameter type-id='375e0126' name='graph' filepath='drivers/media/mc/mc-entity.c' line='288' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='media_graph_walk_init' mangled-name='media_graph_walk_init' filepath='include/media/media-entity.h' line='891' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='media_graph_walk_init'>
-        <parameter type-id='375e0126'/>
-        <parameter type-id='e2929c1c'/>
+      <function-decl name='media_graph_walk_init' mangled-name='media_graph_walk_init' filepath='drivers/media/mc/mc-entity.c' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='media_graph_walk_init'>
+        <parameter type-id='375e0126' name='graph' filepath='drivers/media/mc/mc-entity.c' line='278' column='1'/>
+        <parameter type-id='e2929c1c' name='mdev' filepath='drivers/media/mc/mc-entity.c' line='278' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='media_graph_walk_next' mangled-name='media_graph_walk_next' filepath='drivers/media/mc/mc-entity.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='media_graph_walk_next'>
@@ -126497,12 +126320,12 @@
         <parameter type-id='ac429605' name='req' filepath='drivers/media/mc/mc-request.c' line='79' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='memblock_end_of_DRAM' mangled-name='memblock_end_of_DRAM' filepath='include/linux/memblock.h' line='481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memblock_end_of_DRAM'>
-        <return type-id='3a47d82b'/>
+      <function-decl name='memblock_end_of_DRAM' mangled-name='memblock_end_of_DRAM' filepath='mm/memblock.c' line='1623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memblock_end_of_DRAM'>
+        <return type-id='2522883d'/>
       </function-decl>
-      <function-decl name='memblock_free' mangled-name='memblock_free' filepath='include/linux/memblock.h' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memblock_free'>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='memblock_free' mangled-name='memblock_free' filepath='mm/memblock.c' line='799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memblock_free'>
+        <parameter type-id='2522883d' name='base' filepath='mm/memblock.c' line='799' column='1'/>
+        <parameter type-id='2522883d' name='size' filepath='mm/memblock.c' line='799' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='memchr_inv' mangled-name='memchr_inv' filepath='lib/string.c' line='1087' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memchr_inv'>
@@ -126511,17 +126334,17 @@
         <parameter type-id='b59d7dce' name='bytes' filepath='lib/string.c' line='1087' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='memdup_user' mangled-name='memdup_user' filepath='include/linux/string.h' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memdup_user'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='memdup_user' mangled-name='memdup_user' filepath='mm/util.c' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memdup_user'>
+        <parameter type-id='eaa32e2f' name='src' filepath='mm/util.c' line='172' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='mm/util.c' line='172' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='memdup_user_nul' mangled-name='memdup_user_nul' filepath='include/linux/string.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memdup_user_nul'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='memdup_user_nul' mangled-name='memdup_user_nul' filepath='mm/util.c' line='254' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memdup_user_nul'>
+        <parameter type-id='eaa32e2f' name='src' filepath='mm/util.c' line='254' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='mm/util.c' line='254' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='memory_block_size_bytes' mangled-name='memory_block_size_bytes' filepath='include/linux/memory.h' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memory_block_size_bytes'>
+      <function-decl name='memory_block_size_bytes' mangled-name='memory_block_size_bytes' filepath='drivers/base/memory.c' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memory_block_size_bytes'>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='memory_read_from_buffer' mangled-name='memory_read_from_buffer' filepath='fs/libfs.c' line='787' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memory_read_from_buffer'>
@@ -126532,9 +126355,9 @@
         <parameter type-id='b59d7dce' name='available' filepath='fs/libfs.c' line='788' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='memparse' mangled-name='memparse' filepath='include/linux/kernel.h' line='500' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memparse'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='9b23c9ad'/>
+      <function-decl name='memparse' mangled-name='memparse' filepath='lib/cmdline.c' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memparse'>
+        <parameter type-id='80f4b756' name='ptr' filepath='lib/cmdline.c' line='125' column='1'/>
+        <parameter type-id='9b23c9ad' name='retptr' filepath='lib/cmdline.c' line='125' column='1'/>
         <return type-id='3a47d82b'/>
       </function-decl>
       <function-decl name='mempool_alloc' mangled-name='mempool_alloc' filepath='mm/mempool.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mempool_alloc'>
@@ -126599,10 +126422,10 @@
         <parameter type-id='eaa32e2f' name='pool_data' filepath='mm/mempool.c' line='528' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='memremap' mangled-name='memremap' filepath='include/linux/io.h' line='151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memremap'>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='memremap' mangled-name='memremap' filepath='kernel/iomem.c' line='71' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memremap'>
+        <parameter type-id='acc63fdf' name='offset' filepath='kernel/iomem.c' line='71' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='kernel/iomem.c' line='71' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='kernel/iomem.c' line='71' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='memset64' mangled-name='memset64' filepath='lib/string.c' line='863' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memset64'>
@@ -126630,13 +126453,13 @@
         <parameter type-id='fa0b179b' name='parent' filepath='drivers/mfd/mfd-core.c' line='387' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='migrate_pages' mangled-name='migrate_pages' filepath='include/linux/migrate.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='migrate_pages'>
-        <parameter type-id='e84b031a'/>
-        <parameter type-id='20d19810'/>
-        <parameter type-id='07e9eb27'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='157252dd'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='migrate_pages' mangled-name='migrate_pages' filepath='mm/migrate.c' line='1391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='migrate_pages'>
+        <parameter type-id='e84b031a' name='from' filepath='mm/migrate.c' line='1391' column='1'/>
+        <parameter type-id='355404d0' name='get_new_page' filepath='mm/migrate.c' line='1391' column='1'/>
+        <parameter type-id='7d2f2ada' name='put_new_page' filepath='mm/migrate.c' line='1392' column='1'/>
+        <parameter type-id='7359adad' name='private' filepath='mm/migrate.c' line='1392' column='1'/>
+        <parameter type-id='157252dd' name='mode' filepath='mm/migrate.c' line='1393' column='1'/>
+        <parameter type-id='95e97e5e' name='reason' filepath='mm/migrate.c' line='1393' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='migrate_swap' mangled-name='migrate_swap' filepath='kernel/sched/core.c' line='2283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='migrate_swap'>
@@ -126823,12 +126646,12 @@
         <parameter type-id='2b4a193c' name='pps' filepath='drivers/gpu/drm/drm_mipi_dsi.c' line='588' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='misc_deregister' mangled-name='misc_deregister' filepath='include/linux/miscdevice.h' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='misc_deregister'>
-        <parameter type-id='c63257f7'/>
+      <function-decl name='misc_deregister' mangled-name='misc_deregister' filepath='drivers/char/misc.c' line='239' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='misc_deregister'>
+        <parameter type-id='c63257f7' name='misc' filepath='drivers/char/misc.c' line='239' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='misc_register' mangled-name='misc_register' filepath='include/linux/miscdevice.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='misc_register'>
-        <parameter type-id='c63257f7'/>
+      <function-decl name='misc_register' mangled-name='misc_register' filepath='drivers/char/misc.c' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='misc_register'>
+        <parameter type-id='c63257f7' name='misc' filepath='drivers/char/misc.c' line='173' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mktime64' mangled-name='mktime64' filepath='kernel/time/time.c' line='431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mktime64'>
@@ -126840,11 +126663,11 @@
         <parameter type-id='20f5f452' name='sec' filepath='kernel/time/time.c' line='433' column='1'/>
         <return type-id='1afd27ac'/>
       </function-decl>
-      <function-decl name='mm_trace_rss_stat' mangled-name='mm_trace_rss_stat' filepath='include/linux/mm.h' line='2040' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mm_trace_rss_stat'>
-        <parameter type-id='df4b7819'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='bd54fe1a'/>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='mm_trace_rss_stat' mangled-name='mm_trace_rss_stat' filepath='mm/memory.c' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mm_trace_rss_stat'>
+        <parameter type-id='df4b7819' name='mm' filepath='mm/memory.c' line='182' column='1'/>
+        <parameter type-id='95e97e5e' name='member' filepath='mm/memory.c' line='182' column='1'/>
+        <parameter type-id='bd54fe1a' name='count' filepath='mm/memory.c' line='182' column='1'/>
+        <parameter type-id='bd54fe1a' name='value' filepath='mm/memory.c' line='183' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_add_host' mangled-name='mmc_add_host' filepath='drivers/mmc/core/host.c' line='516' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_add_host'>
@@ -126885,8 +126708,8 @@
         <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1026' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_cmdq_enable' mangled-name='mmc_cmdq_enable' filepath='drivers/mmc/core/mmc_ops.h' line='47' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cmdq_enable'>
-        <parameter type-id='13d38dcb'/>
+      <function-decl name='mmc_cmdq_enable' mangled-name='mmc_cmdq_enable' filepath='drivers/mmc/core/mmc_ops.c' line='1020' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cmdq_enable'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='1020' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_cqe_post_req' mangled-name='mmc_cqe_post_req' filepath='drivers/mmc/core/core.c' line='516' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_cqe_post_req'>
@@ -126939,8 +126762,8 @@
         <parameter type-id='f0981eeb' name='nr' filepath='drivers/mmc/core/core.c' line='1929' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_flush_cache' mangled-name='mmc_flush_cache' filepath='drivers/mmc/core/mmc_ops.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_flush_cache'>
-        <parameter type-id='13d38dcb'/>
+      <function-decl name='mmc_flush_cache' mangled-name='mmc_flush_cache' filepath='drivers/mmc/core/mmc_ops.c' line='987' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_flush_cache'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='987' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_free_host' mangled-name='mmc_free_host' filepath='drivers/mmc/core/host.c' line='568' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_free_host'>
@@ -126952,9 +126775,9 @@
         <parameter type-id='f1e196e0' name='ctx' filepath='drivers/mmc/core/core.c' line='857' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_get_ext_csd' mangled-name='mmc_get_ext_csd' filepath='drivers/mmc/core/mmc_ops.h' line='36' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_get_ext_csd'>
-        <parameter type-id='13d38dcb'/>
-        <parameter type-id='ae4d32ca'/>
+      <function-decl name='mmc_get_ext_csd' mangled-name='mmc_get_ext_csd' filepath='drivers/mmc/core/mmc_ops.c' line='358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_get_ext_csd'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='358' column='1'/>
+        <parameter type-id='1f37a7f4' name='new_ext_csd' filepath='drivers/mmc/core/mmc_ops.c' line='358' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_gpio_get_cd' mangled-name='mmc_gpio_get_cd' filepath='drivers/mmc/core/slot-gpio.c' line='80' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpio_get_cd'>
@@ -126965,28 +126788,28 @@
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/slot-gpio.c' line='69' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_gpio_set_cd_wake' mangled-name='mmc_gpio_set_cd_wake' filepath='include/linux/mmc/slot-gpio.h' line='25' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpio_set_cd_wake'>
-        <parameter type-id='dd575c43'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='mmc_gpio_set_cd_wake' mangled-name='mmc_gpio_set_cd_wake' filepath='drivers/mmc/core/slot-gpio.c' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpio_set_cd_wake'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/slot-gpio.c' line='129' column='1'/>
+        <parameter type-id='b50a4934' name='on' filepath='drivers/mmc/core/slot-gpio.c' line='129' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_gpiod_request_cd' mangled-name='mmc_gpiod_request_cd' filepath='include/linux/mmc/slot-gpio.h' line='18' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpiod_request_cd'>
-        <parameter type-id='dd575c43'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='mmc_gpiod_request_cd' mangled-name='mmc_gpiod_request_cd' filepath='drivers/mmc/core/slot-gpio.c' line='176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpiod_request_cd'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/slot-gpio.c' line='176' column='1'/>
+        <parameter type-id='80f4b756' name='con_id' filepath='drivers/mmc/core/slot-gpio.c' line='176' column='1'/>
+        <parameter type-id='f0981eeb' name='idx' filepath='drivers/mmc/core/slot-gpio.c' line='177' column='1'/>
+        <parameter type-id='b50a4934' name='override_active_level' filepath='drivers/mmc/core/slot-gpio.c' line='177' column='1'/>
+        <parameter type-id='f0981eeb' name='debounce' filepath='drivers/mmc/core/slot-gpio.c' line='178' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_gpiod_request_cd_irq' mangled-name='mmc_gpiod_request_cd_irq' filepath='include/linux/mmc/slot-gpio.h' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpiod_request_cd_irq'>
-        <parameter type-id='dd575c43'/>
+      <function-decl name='mmc_gpiod_request_cd_irq' mangled-name='mmc_gpiod_request_cd_irq' filepath='drivers/mmc/core/slot-gpio.c' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpiod_request_cd_irq'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/slot-gpio.c' line='95' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_gpiod_request_ro' mangled-name='mmc_gpiod_request_ro' filepath='include/linux/mmc/slot-gpio.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpiod_request_ro'>
-        <parameter type-id='dd575c43'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='mmc_gpiod_request_ro' mangled-name='mmc_gpiod_request_ro' filepath='drivers/mmc/core/slot-gpio.c' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_gpiod_request_ro'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/slot-gpio.c' line='225' column='1'/>
+        <parameter type-id='80f4b756' name='con_id' filepath='drivers/mmc/core/slot-gpio.c' line='225' column='1'/>
+        <parameter type-id='f0981eeb' name='idx' filepath='drivers/mmc/core/slot-gpio.c' line='226' column='1'/>
+        <parameter type-id='f0981eeb' name='debounce' filepath='drivers/mmc/core/slot-gpio.c' line='226' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_hs200_tuning' mangled-name='mmc_hs200_tuning' filepath='drivers/mmc/core/mmc.c' line='1543' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_hs200_tuning'>
@@ -126997,9 +126820,9 @@
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/core.c' line='2085' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_issue_type' mangled-name='mmc_issue_type' filepath='drivers/mmc/core/queue.h' line='109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_issue_type'>
-        <parameter type-id='49b40d32'/>
-        <parameter type-id='3dad1a48'/>
+      <function-decl name='mmc_issue_type' mangled-name='mmc_issue_type' filepath='drivers/mmc/core/queue.c' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_issue_type'>
+        <parameter type-id='49b40d32' name='mq' filepath='drivers/mmc/core/queue.c' line='62' column='1'/>
+        <parameter type-id='3dad1a48' name='req' filepath='drivers/mmc/core/queue.c' line='62' column='1'/>
         <return type-id='013ef24c'/>
       </function-decl>
       <function-decl name='mmc_of_parse' mangled-name='mmc_of_parse' filepath='drivers/mmc/core/host.c' line='214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_of_parse'>
@@ -127060,8 +126883,8 @@
         <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='111' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmc_retune_release' mangled-name='mmc_retune_release' filepath='drivers/mmc/core/host.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_retune_release'>
-        <parameter type-id='dd575c43'/>
+      <function-decl name='mmc_retune_release' mangled-name='mmc_retune_release' filepath='drivers/mmc/core/host.c' line='152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_retune_release'>
+        <parameter type-id='dd575c43' name='host' filepath='drivers/mmc/core/host.c' line='152' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmc_retune_timer_stop' mangled-name='mmc_retune_timer_stop' filepath='drivers/mmc/core/host.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_retune_timer_stop'>
@@ -127100,9 +126923,9 @@
         <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc.c' line='1512' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mmc_send_status' mangled-name='mmc_send_status' filepath='drivers/mmc/core/mmc_ops.h' line='30' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_send_status'>
-        <parameter type-id='13d38dcb'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='mmc_send_status' mangled-name='mmc_send_status' filepath='drivers/mmc/core/mmc_ops.c' line='80' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_send_status'>
+        <parameter type-id='13d38dcb' name='card' filepath='drivers/mmc/core/mmc_ops.c' line='80' column='1'/>
+        <parameter type-id='f9409001' name='status' filepath='drivers/mmc/core/mmc_ops.c' line='80' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mmc_send_tuning' mangled-name='mmc_send_tuning' filepath='drivers/mmc/core/mmc_ops.c' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmc_send_tuning'>
@@ -127158,8 +126981,8 @@
         <parameter type-id='47f117d4' name='mrq' filepath='drivers/mmc/core/core.c' line='603' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmput' mangled-name='mmput' filepath='include/linux/sched/mm.h' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmput'>
-        <parameter type-id='df4b7819'/>
+      <function-decl name='mmput' mangled-name='mmput' filepath='kernel/fork.c' line='1143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmput'>
+        <parameter type-id='df4b7819' name='mm' filepath='kernel/fork.c' line='1143' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmu_interval_notifier_insert' mangled-name='mmu_interval_notifier_insert' filepath='mm/mmu_notifier.c' line='1002' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmu_interval_notifier_insert'>
@@ -127212,51 +127035,51 @@
         <parameter type-id='e525e121' name='tp' filepath='kernel/module.c' line='4819' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='module_put' mangled-name='module_put' filepath='include/linux/module.h' line='646' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='module_put'>
-        <parameter type-id='2730d015'/>
+      <function-decl name='module_put' mangled-name='module_put' filepath='kernel/module.c' line='1158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='module_put'>
+        <parameter type-id='2730d015' name='module' filepath='kernel/module.c' line='1158' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='msleep' mangled-name='msleep' filepath='include/linux/delay.h' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='msleep'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='msleep' mangled-name='msleep' filepath='kernel/time/timer.c' line='2030' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='msleep'>
+        <parameter type-id='f0981eeb' name='msecs' filepath='kernel/time/timer.c' line='2030' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='msleep_interruptible' mangled-name='msleep_interruptible' filepath='kernel/time/timer.c' line='2044' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='msleep_interruptible'>
         <parameter type-id='f0981eeb' name='msecs' filepath='kernel/time/timer.c' line='2044' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='mutex_is_locked' mangled-name='mutex_is_locked' filepath='include/linux/mutex.h' line='153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_is_locked'>
-        <parameter type-id='e0ea832a'/>
-        <return type-id='c894953d'/>
+      <function-decl name='mutex_is_locked' mangled-name='mutex_is_locked' filepath='kernel/locking/mutex.c' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_is_locked'>
+        <parameter type-id='e0ea832a' name='lock' filepath='kernel/locking/mutex.c' line='85' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='mutex_lock' mangled-name='mutex_lock' filepath='include/linux/mutex.h' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_lock'>
-        <parameter type-id='e0ea832a'/>
+      <function-decl name='mutex_lock' mangled-name='mutex_lock' filepath='kernel/locking/mutex.c' line='294' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_lock'>
+        <parameter type-id='e0ea832a' name='lock' filepath='kernel/locking/mutex.c' line='294' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mutex_lock_interruptible' mangled-name='mutex_lock_interruptible' filepath='include/linux/mutex.h' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_lock_interruptible'>
-        <parameter type-id='e0ea832a'/>
+      <function-decl name='mutex_lock_interruptible' mangled-name='mutex_lock_interruptible' filepath='kernel/locking/mutex.c' line='1321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_lock_interruptible'>
+        <parameter type-id='e0ea832a' name='lock' filepath='kernel/locking/mutex.c' line='1321' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mutex_lock_killable' mangled-name='mutex_lock_killable' filepath='include/linux/mutex.h' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_lock_killable'>
-        <parameter type-id='e0ea832a'/>
+      <function-decl name='mutex_lock_killable' mangled-name='mutex_lock_killable' filepath='kernel/locking/mutex.c' line='1345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_lock_killable'>
+        <parameter type-id='e0ea832a' name='lock' filepath='kernel/locking/mutex.c' line='1345' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='mutex_trylock' mangled-name='mutex_trylock' filepath='include/linux/mutex.h' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_trylock'>
-        <parameter type-id='e0ea832a'/>
+      <function-decl name='mutex_trylock' mangled-name='mutex_trylock' filepath='kernel/locking/mutex.c' line='1425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_trylock'>
+        <parameter type-id='e0ea832a' name='lock' filepath='kernel/locking/mutex.c' line='1425' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='mutex_trylock_recursive' mangled-name='mutex_trylock_recursive' filepath='kernel/locking/mutex.c' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_trylock_recursive'>
         <parameter type-id='e0ea832a' name='lock' filepath='kernel/locking/mutex.c' line='92' column='1'/>
         <return type-id='9a6ea243'/>
       </function-decl>
-      <function-decl name='mutex_unlock' mangled-name='mutex_unlock' filepath='include/linux/mutex.h' line='200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_unlock'>
-        <parameter type-id='e0ea832a'/>
+      <function-decl name='mutex_unlock' mangled-name='mutex_unlock' filepath='kernel/locking/mutex.c' line='749' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mutex_unlock'>
+        <parameter type-id='e0ea832a' name='lock' filepath='kernel/locking/mutex.c' line='749' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='n_tty_ioctl_helper' mangled-name='n_tty_ioctl_helper' filepath='include/linux/tty.h' line='773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='n_tty_ioctl_helper'>
-        <parameter type-id='572fbdca'/>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='n_tty_ioctl_helper' mangled-name='n_tty_ioctl_helper' filepath='drivers/tty/tty_ioctl.c' line='837' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='n_tty_ioctl_helper'>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_ioctl.c' line='837' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='drivers/tty/tty_ioctl.c' line='837' column='1'/>
+        <parameter type-id='f0981eeb' name='cmd' filepath='drivers/tty/tty_ioctl.c' line='838' column='1'/>
+        <parameter type-id='7359adad' name='arg' filepath='drivers/tty/tty_ioctl.c' line='838' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='name_to_dev_t' mangled-name='name_to_dev_t' filepath='init/do_mounts.c' line='222' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='name_to_dev_t'>
@@ -127264,18 +127087,18 @@
         <return type-id='8504f260'/>
       </function-decl>
       <var-decl name='names_cachep' type-id='f3b4aca8' mangled-name='names_cachep' visibility='default' filepath='fs/dcache.c' line='3211' column='1' elf-symbol-id='names_cachep'/>
-      <function-decl name='napi_complete_done' mangled-name='napi_complete_done' filepath='include/linux/netdevice.h' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_complete_done'>
-        <parameter type-id='c50361c5'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='c894953d'/>
+      <function-decl name='napi_complete_done' mangled-name='napi_complete_done' filepath='net/core/dev.c' line='6472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_complete_done'>
+        <parameter type-id='c50361c5' name='n' filepath='net/core/dev.c' line='6472' column='1'/>
+        <parameter type-id='95e97e5e' name='work_done' filepath='net/core/dev.c' line='6472' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='napi_consume_skb' mangled-name='napi_consume_skb' filepath='net/core/skbuff.c' line='909' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_consume_skb'>
         <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='909' column='1'/>
         <parameter type-id='95e97e5e' name='budget' filepath='net/core/skbuff.c' line='909' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='napi_disable' mangled-name='napi_disable' filepath='include/linux/netdevice.h' line='507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_disable'>
-        <parameter type-id='c50361c5'/>
+      <function-decl name='napi_disable' mangled-name='napi_disable' filepath='net/core/dev.c' line='6759' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_disable'>
+        <parameter type-id='c50361c5' name='n' filepath='net/core/dev.c' line='6759' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='napi_gro_flush' mangled-name='napi_gro_flush' filepath='net/core/dev.c' line='5835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_gro_flush'>
@@ -127283,14 +127106,14 @@
         <parameter type-id='b50a4934' name='flush_old' filepath='net/core/dev.c' line='5835' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='napi_gro_receive' mangled-name='napi_gro_receive' filepath='include/linux/netdevice.h' line='3914' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_gro_receive'>
-        <parameter type-id='c50361c5'/>
-        <parameter type-id='0fbf3cfd'/>
-        <return type-id='3facc5aa'/>
+      <function-decl name='napi_gro_receive' mangled-name='napi_gro_receive' filepath='net/core/dev.c' line='6136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_gro_receive'>
+        <parameter type-id='c50361c5' name='napi' filepath='net/core/dev.c' line='6136' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/dev.c' line='6136' column='1'/>
+        <return type-id='dc1b1685'/>
       </function-decl>
-      <function-decl name='napi_schedule_prep' mangled-name='napi_schedule_prep' filepath='include/linux/netdevice.h' line='449' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_schedule_prep'>
-        <parameter type-id='c50361c5'/>
-        <return type-id='c894953d'/>
+      <function-decl name='napi_schedule_prep' mangled-name='napi_schedule_prep' filepath='net/core/dev.c' line='6429' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='napi_schedule_prep'>
+        <parameter type-id='c50361c5' name='n' filepath='net/core/dev.c' line='6429' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <var-decl name='nd_tbl' type-id='aebe1cff' mangled-name='nd_tbl' visibility='default' filepath='net/ipv6/ndisc.c' line='109' column='1' elf-symbol-id='nd_tbl'/>
       <function-decl name='neigh_destroy' mangled-name='neigh_destroy' filepath='net/core/neighbour.c' line='835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='neigh_destroy'>
@@ -127321,17 +127144,17 @@
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netdev_alloc_frag' mangled-name='netdev_alloc_frag' filepath='include/linux/skbuff.h' line='2812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_alloc_frag'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='netdev_alloc_frag' mangled-name='netdev_alloc_frag' filepath='net/core/skbuff.c' line='400' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_alloc_frag'>
+        <parameter type-id='f0981eeb' name='fragsz' filepath='net/core/skbuff.c' line='400' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='netdev_change_features' mangled-name='netdev_change_features' filepath='net/core/dev.c' line='9841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_change_features'>
         <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='9841' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netdev_err' mangled-name='netdev_err' filepath='include/linux/netdevice.h' line='5120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_err'>
-        <parameter type-id='2ce52478'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='netdev_err' mangled-name='netdev_err' filepath='net/core/dev.c' line='11128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_err'>
+        <parameter type-id='2ce52478' name='dev' filepath='net/core/dev.c' line='11128' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='net/core/dev.c' line='11128' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
@@ -127341,9 +127164,9 @@
         <parameter type-id='f9f4b16f' name='mask' filepath='net/core/dev.c' line='10993' column='1'/>
         <return type-id='f9f4b16f'/>
       </function-decl>
-      <function-decl name='netdev_info' mangled-name='netdev_info' filepath='include/linux/netdevice.h' line='5126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_info'>
-        <parameter type-id='2ce52478'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='netdev_info' mangled-name='netdev_info' filepath='net/core/dev.c' line='11131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_info'>
+        <parameter type-id='2ce52478' name='dev' filepath='net/core/dev.c' line='11131' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='net/core/dev.c' line='11131' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
@@ -127385,12 +127208,12 @@
         <parameter type-id='bdf901f8' name='ops' filepath='net/core/dev.c' line='10520' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netdev_state_change' mangled-name='netdev_state_change' filepath='include/linux/netdevice.h' line='4598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_state_change'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='netdev_state_change' mangled-name='netdev_state_change' filepath='net/core/dev.c' line='1477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_state_change'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='1477' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netdev_update_features' mangled-name='netdev_update_features' filepath='include/linux/netdevice.h' line='4887' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_update_features'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='netdev_update_features' mangled-name='netdev_update_features' filepath='net/core/dev.c' line='9824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_update_features'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='9824' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='netdev_upper_dev_link' mangled-name='netdev_upper_dev_link' filepath='net/core/dev.c' line='7893' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_upper_dev_link'>
@@ -127404,67 +127227,67 @@
         <parameter type-id='68a2d05b' name='upper_dev' filepath='net/core/dev.c' line='7977' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netdev_warn' mangled-name='netdev_warn' filepath='include/linux/netdevice.h' line='5122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_warn'>
-        <parameter type-id='2ce52478'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='netdev_warn' mangled-name='netdev_warn' filepath='net/core/dev.c' line='11129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netdev_warn'>
+        <parameter type-id='2ce52478' name='dev' filepath='net/core/dev.c' line='11129' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='net/core/dev.c' line='11129' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_carrier_off' mangled-name='netif_carrier_off' filepath='include/linux/netdevice.h' line='4073' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_carrier_off'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='netif_carrier_off' mangled-name='netif_carrier_off' filepath='net/sched/sch_generic.c' line='532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_carrier_off'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/sched/sch_generic.c' line='532' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_carrier_on' mangled-name='netif_carrier_on' filepath='include/linux/netdevice.h' line='4071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_carrier_on'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='netif_carrier_on' mangled-name='netif_carrier_on' filepath='net/sched/sch_generic.c' line='513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_carrier_on'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/sched/sch_generic.c' line='513' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_device_attach' mangled-name='netif_device_attach' filepath='include/linux/netdevice.h' line='4182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_device_attach'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='netif_device_attach' mangled-name='netif_device_attach' filepath='net/core/dev.c' line='3154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_device_attach'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='3154' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_device_detach' mangled-name='netif_device_detach' filepath='include/linux/netdevice.h' line='4180' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_device_detach'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='netif_device_detach' mangled-name='netif_device_detach' filepath='net/core/dev.c' line='3139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_device_detach'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='3139' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_napi_add' mangled-name='netif_napi_add' filepath='include/linux/netdevice.h' line='2427' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_napi_add'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='c50361c5'/>
-        <parameter type-id='f07d90b4'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='netif_napi_add' mangled-name='netif_napi_add' filepath='net/core/dev.c' line='6729' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_napi_add'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='6729' column='1'/>
+        <parameter type-id='c50361c5' name='napi' filepath='net/core/dev.c' line='6729' column='1'/>
+        <parameter type-id='f07d90b4' name='poll' filepath='net/core/dev.c' line='6730' column='1'/>
+        <parameter type-id='95e97e5e' name='weight' filepath='net/core/dev.c' line='6730' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_receive_skb' mangled-name='netif_receive_skb' filepath='include/linux/netdevice.h' line='3911' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_receive_skb'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='netif_receive_skb' mangled-name='netif_receive_skb' filepath='net/core/dev.c' line='5623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_receive_skb'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/dev.c' line='5623' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netif_receive_skb_core' mangled-name='netif_receive_skb_core' filepath='include/linux/netdevice.h' line='3912' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_receive_skb_core'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='netif_receive_skb_core' mangled-name='netif_receive_skb_core' filepath='net/core/dev.c' line='5371' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_receive_skb_core'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/dev.c' line='5371' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='netif_receive_skb_list' mangled-name='netif_receive_skb_list' filepath='net/core/dev.c' line='5646' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_receive_skb_list'>
         <parameter type-id='e84b031a' name='head' filepath='net/core/dev.c' line='5646' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_rx' mangled-name='netif_rx' filepath='include/linux/netdevice.h' line='3908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_rx'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='netif_rx' mangled-name='netif_rx' filepath='net/core/dev.c' line='4835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_rx'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/dev.c' line='4835' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netif_rx_ni' mangled-name='netif_rx_ni' filepath='include/linux/netdevice.h' line='3909' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_rx_ni'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='netif_rx_ni' mangled-name='netif_rx_ni' filepath='net/core/dev.c' line='4848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_rx_ni'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/dev.c' line='4848' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netif_schedule_queue' mangled-name='netif_schedule_queue' filepath='include/linux/netdevice.h' line='3343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_schedule_queue'>
-        <parameter type-id='35b28c4f'/>
+      <function-decl name='netif_schedule_queue' mangled-name='netif_schedule_queue' filepath='net/core/dev.c' line='3076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_schedule_queue'>
+        <parameter type-id='35b28c4f' name='txq' filepath='net/core/dev.c' line='3076' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_set_real_num_rx_queues' mangled-name='netif_set_real_num_rx_queues' filepath='include/linux/netdevice.h' line='3828' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_set_real_num_rx_queues'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='netif_set_real_num_rx_queues' mangled-name='netif_set_real_num_rx_queues' filepath='net/core/dev.c' line='3011' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_set_real_num_rx_queues'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='3011' column='1'/>
+        <parameter type-id='f0981eeb' name='rxq' filepath='net/core/dev.c' line='3011' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netif_set_real_num_tx_queues' mangled-name='netif_set_real_num_tx_queues' filepath='include/linux/netdevice.h' line='3825' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_set_real_num_tx_queues'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='netif_set_real_num_tx_queues' mangled-name='netif_set_real_num_tx_queues' filepath='net/core/dev.c' line='2961' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_set_real_num_tx_queues'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='2961' column='1'/>
+        <parameter type-id='f0981eeb' name='txq' filepath='net/core/dev.c' line='2961' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='netif_stacked_transfer_operstate' mangled-name='netif_stacked_transfer_operstate' filepath='net/core/dev.c' line='9857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_stacked_transfer_operstate'>
@@ -127472,19 +127295,19 @@
         <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='9858' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_tx_stop_all_queues' mangled-name='netif_tx_stop_all_queues' filepath='include/linux/netdevice.h' line='3420' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_tx_stop_all_queues'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='netif_tx_stop_all_queues' mangled-name='netif_tx_stop_all_queues' filepath='net/core/dev.c' line='9965' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_tx_stop_all_queues'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='9965' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netif_tx_wake_queue' mangled-name='netif_tx_wake_queue' filepath='include/linux/netdevice.h' line='3379' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_tx_wake_queue'>
-        <parameter type-id='35b28c4f'/>
+      <function-decl name='netif_tx_wake_queue' mangled-name='netif_tx_wake_queue' filepath='net/core/dev.c' line='3088' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netif_tx_wake_queue'>
+        <parameter type-id='35b28c4f' name='dev_queue' filepath='net/core/dev.c' line='3088' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netlink_ack' mangled-name='netlink_ack' filepath='include/linux/netlink.h' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_ack'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='c2074578'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f1dc7839'/>
+      <function-decl name='netlink_ack' mangled-name='netlink_ack' filepath='net/netlink/af_netlink.c' line='2398' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_ack'>
+        <parameter type-id='0fbf3cfd' name='in_skb' filepath='net/netlink/af_netlink.c' line='2398' column='1'/>
+        <parameter type-id='c2074578' name='nlh' filepath='net/netlink/af_netlink.c' line='2398' column='1'/>
+        <parameter type-id='95e97e5e' name='err' filepath='net/netlink/af_netlink.c' line='2398' column='1'/>
+        <parameter type-id='f1dc7839' name='extack' filepath='net/netlink/af_netlink.c' line='2399' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='netlink_broadcast' mangled-name='netlink_broadcast' filepath='net/netlink/af_netlink.c' line='1535' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_broadcast'>
@@ -127495,41 +127318,41 @@
         <parameter type-id='3eb7c31c' name='allocation' filepath='net/netlink/af_netlink.c' line='1536' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netlink_capable' mangled-name='netlink_capable' filepath='include/linux/netlink.h' line='272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_capable'>
-        <parameter type-id='11f4a000'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='c894953d'/>
+      <function-decl name='netlink_capable' mangled-name='netlink_capable' filepath='net/netlink/af_netlink.c' line='890' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_capable'>
+        <parameter type-id='11f4a000' name='skb' filepath='net/netlink/af_netlink.c' line='890' column='1'/>
+        <parameter type-id='95e97e5e' name='cap' filepath='net/netlink/af_netlink.c' line='890' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='netlink_has_listeners' mangled-name='netlink_has_listeners' filepath='include/linux/netlink.h' line='151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_has_listeners'>
-        <parameter type-id='f772df6d'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='netlink_has_listeners' mangled-name='netlink_has_listeners' filepath='net/netlink/af_netlink.c' line='1351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_has_listeners'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/netlink/af_netlink.c' line='1351' column='1'/>
+        <parameter type-id='f0981eeb' name='group' filepath='net/netlink/af_netlink.c' line='1351' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netlink_kernel_release' mangled-name='netlink_kernel_release' filepath='include/linux/netlink.h' line='145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_kernel_release'>
-        <parameter type-id='f772df6d'/>
+      <function-decl name='netlink_kernel_release' mangled-name='netlink_kernel_release' filepath='net/netlink/af_netlink.c' line='2104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_kernel_release'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/netlink/af_netlink.c' line='2104' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='netlink_register_notifier' mangled-name='netlink_register_notifier' filepath='net/netlink/af_netlink.c' line='2734' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_register_notifier'>
         <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2734' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netlink_unicast' mangled-name='netlink_unicast' filepath='include/linux/netlink.h' line='154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unicast'>
-        <parameter type-id='f772df6d'/>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='netlink_unicast' mangled-name='netlink_unicast' filepath='net/netlink/af_netlink.c' line='1315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unicast'>
+        <parameter type-id='f772df6d' name='ssk' filepath='net/netlink/af_netlink.c' line='1315' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/netlink/af_netlink.c' line='1315' column='1'/>
+        <parameter type-id='19c2251e' name='portid' filepath='net/netlink/af_netlink.c' line='1316' column='1'/>
+        <parameter type-id='95e97e5e' name='nonblock' filepath='net/netlink/af_netlink.c' line='1316' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='netlink_unregister_notifier' mangled-name='netlink_unregister_notifier' filepath='net/netlink/af_netlink.c' line='2740' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unregister_notifier'>
         <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2740' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='new_inode' mangled-name='new_inode' filepath='include/linux/fs.h' line='2998' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='new_inode'>
-        <parameter type-id='42c8f564'/>
+      <function-decl name='new_inode' mangled-name='new_inode' filepath='fs/inode.c' line='953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='new_inode'>
+        <parameter type-id='42c8f564' name='sb' filepath='fs/inode.c' line='953' column='1'/>
         <return type-id='7e666abe'/>
       </function-decl>
-      <function-decl name='nf_conntrack_destroy' mangled-name='nf_conntrack_destroy' filepath='include/linux/netfilter/nf_conntrack_common.h' line='30' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_conntrack_destroy'>
-        <parameter type-id='96b07343'/>
+      <function-decl name='nf_conntrack_destroy' mangled-name='nf_conntrack_destroy' filepath='net/netfilter/core.c' line='670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_conntrack_destroy'>
+        <parameter type-id='96b07343' name='nfct' filepath='net/netfilter/core.c' line='670' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='nf_ct_delete' mangled-name='nf_ct_delete' filepath='net/netfilter/nf_conntrack_core.c' line='652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_ct_delete'>
@@ -127538,16 +127361,16 @@
         <parameter type-id='95e97e5e' name='report' filepath='net/netfilter/nf_conntrack_core.c' line='652' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='nf_register_net_hooks' mangled-name='nf_register_net_hooks' filepath='include/linux/netfilter.h' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_register_net_hooks'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='27db53a1'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='nf_register_net_hooks' mangled-name='nf_register_net_hooks' filepath='net/netfilter/core.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_register_net_hooks'>
+        <parameter type-id='a2bff676' name='net' filepath='net/netfilter/core.c' line='550' column='1'/>
+        <parameter type-id='27db53a1' name='reg' filepath='net/netfilter/core.c' line='550' column='1'/>
+        <parameter type-id='f0981eeb' name='n' filepath='net/netfilter/core.c' line='551' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='nf_unregister_net_hooks' mangled-name='nf_unregister_net_hooks' filepath='include/linux/netfilter.h' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_unregister_net_hooks'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='27db53a1'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='nf_unregister_net_hooks' mangled-name='nf_unregister_net_hooks' filepath='net/netfilter/core.c' line='570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_unregister_net_hooks'>
+        <parameter type-id='a2bff676' name='net' filepath='net/netfilter/core.c' line='570' column='1'/>
+        <parameter type-id='27db53a1' name='reg' filepath='net/netfilter/core.c' line='570' column='1'/>
+        <parameter type-id='f0981eeb' name='hookcount' filepath='net/netfilter/core.c' line='571' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='nla_append' mangled-name='nla_append' filepath='lib/nlattr.c' line='1101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_append'>
@@ -127568,11 +127391,11 @@
         <parameter type-id='95e97e5e' name='count' filepath='lib/nlattr.c' line='777' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='nla_put' mangled-name='nla_put' filepath='include/net/netlink.h' line='527' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_put'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='nla_put' mangled-name='nla_put' filepath='lib/nlattr.c' line='1035' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_put'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='lib/nlattr.c' line='1035' column='1'/>
+        <parameter type-id='95e97e5e' name='attrtype' filepath='lib/nlattr.c' line='1035' column='1'/>
+        <parameter type-id='95e97e5e' name='attrlen' filepath='lib/nlattr.c' line='1035' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='lib/nlattr.c' line='1035' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='nla_put_64bit' mangled-name='nla_put_64bit' filepath='lib/nlattr.c' line='1056' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_put_64bit'>
@@ -127589,24 +127412,24 @@
         <parameter type-id='eaa32e2f' name='data' filepath='lib/nlattr.c' line='1082' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='nla_reserve' mangled-name='nla_reserve' filepath='include/net/netlink.h' line='518' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_reserve'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='nla_reserve' mangled-name='nla_reserve' filepath='lib/nlattr.c' line='908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_reserve'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='lib/nlattr.c' line='908' column='1'/>
+        <parameter type-id='95e97e5e' name='attrtype' filepath='lib/nlattr.c' line='908' column='1'/>
+        <parameter type-id='95e97e5e' name='attrlen' filepath='lib/nlattr.c' line='908' column='1'/>
         <return type-id='6fcaf91e'/>
       </function-decl>
-      <function-decl name='nla_reserve_64bit' mangled-name='nla_reserve_64bit' filepath='include/net/netlink.h' line='519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_reserve_64bit'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='nla_reserve_64bit' mangled-name='nla_reserve_64bit' filepath='lib/nlattr.c' line='931' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_reserve_64bit'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='lib/nlattr.c' line='931' column='1'/>
+        <parameter type-id='95e97e5e' name='attrtype' filepath='lib/nlattr.c' line='931' column='1'/>
+        <parameter type-id='95e97e5e' name='attrlen' filepath='lib/nlattr.c' line='931' column='1'/>
+        <parameter type-id='95e97e5e' name='padattr' filepath='lib/nlattr.c' line='932' column='1'/>
         <return type-id='6fcaf91e'/>
       </function-decl>
-      <function-decl name='nla_strlcpy' mangled-name='nla_strlcpy' filepath='include/net/netlink.h' line='509' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_strlcpy'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='0f2a7ce5'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='7359adad'/>
+      <function-decl name='nla_strlcpy' mangled-name='nla_strlcpy' filepath='lib/nlattr.c' line='723' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nla_strlcpy'>
+        <parameter type-id='26a90f95' name='dst' filepath='lib/nlattr.c' line='723' column='1'/>
+        <parameter type-id='0f2a7ce5' name='nla' filepath='lib/nlattr.c' line='723' column='1'/>
+        <parameter type-id='b59d7dce' name='dstsize' filepath='lib/nlattr.c' line='723' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
       <function-decl name='no_llseek' mangled-name='no_llseek' filepath='fs/read_write.c' line='230' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='no_llseek'>
         <parameter type-id='77e79a4b' name='file' filepath='fs/read_write.c' line='230' column='1'/>
@@ -127641,12 +127464,12 @@
         <parameter type-id='95e97e5e' name='cap' filepath='kernel/capability.c' line='394' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='ns_to_kernel_old_timeval' mangled-name='ns_to_kernel_old_timeval' filepath='include/linux/time32.h' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ns_to_kernel_old_timeval'>
-        <parameter type-id='1eb56b1e'/>
+      <function-decl name='ns_to_kernel_old_timeval' mangled-name='ns_to_kernel_old_timeval' filepath='kernel/time/time.c' line='452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ns_to_kernel_old_timeval'>
+        <parameter type-id='d238557f' name='nsec' filepath='kernel/time/time.c' line='452' column='1'/>
         <return type-id='4595b96b'/>
       </function-decl>
-      <function-decl name='ns_to_timespec64' mangled-name='ns_to_timespec64' filepath='include/linux/time64.h' line='145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ns_to_timespec64'>
-        <parameter type-id='1eb56b1e'/>
+      <function-decl name='ns_to_timespec64' mangled-name='ns_to_timespec64' filepath='kernel/time/time.c' line='506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ns_to_timespec64'>
+        <parameter type-id='d238557f' name='nsec' filepath='kernel/time/time.c' line='506' column='1'/>
         <return type-id='40a816ad'/>
       </function-decl>
       <function-decl name='nsec_to_clock_t' mangled-name='nsec_to_clock_t' filepath='kernel/time/time.c' line='674' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nsec_to_clock_t'>
@@ -127671,18 +127494,18 @@
         <parameter type-id='22ab35e2' name='ndr_desc' filepath='drivers/nvdimm/region_devs.c' line='1151' column='1'/>
         <return type-id='14dc741a'/>
       </function-decl>
-      <function-decl name='nvmem_cell_get' mangled-name='nvmem_cell_get' filepath='include/linux/nvmem-consumer.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_cell_get'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='nvmem_cell_get' mangled-name='nvmem_cell_get' filepath='drivers/nvmem/core.c' line='1109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_cell_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/nvmem/core.c' line='1109' column='1'/>
+        <parameter type-id='80f4b756' name='id' filepath='drivers/nvmem/core.c' line='1109' column='1'/>
         <return type-id='4a4ce85f'/>
       </function-decl>
-      <function-decl name='nvmem_cell_put' mangled-name='nvmem_cell_put' filepath='include/linux/nvmem-consumer.h' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_cell_put'>
-        <parameter type-id='4a4ce85f'/>
+      <function-decl name='nvmem_cell_put' mangled-name='nvmem_cell_put' filepath='drivers/nvmem/core.c' line='1195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_cell_put'>
+        <parameter type-id='4a4ce85f' name='cell' filepath='drivers/nvmem/core.c' line='1195' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='nvmem_cell_read' mangled-name='nvmem_cell_read' filepath='include/linux/nvmem-consumer.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_cell_read'>
-        <parameter type-id='4a4ce85f'/>
-        <parameter type-id='1d2c2b85'/>
+      <function-decl name='nvmem_cell_read' mangled-name='nvmem_cell_read' filepath='drivers/nvmem/core.c' line='1266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_cell_read'>
+        <parameter type-id='4a4ce85f' name='cell' filepath='drivers/nvmem/core.c' line='1266' column='1'/>
+        <parameter type-id='78c01427' name='len' filepath='drivers/nvmem/core.c' line='1266' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='nvmem_cell_read_u32' mangled-name='nvmem_cell_read_u32' filepath='drivers/nvmem/core.c' line='1446' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_cell_read_u32'>
@@ -127706,18 +127529,18 @@
         <parameter type-id='8179bc49' name='nvmem' filepath='drivers/nvmem/core.c' line='955' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='nvmem_device_read' mangled-name='nvmem_device_read' filepath='include/linux/nvmem-consumer.h' line='75' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_device_read'>
-        <parameter type-id='8179bc49'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='nvmem_device_read' mangled-name='nvmem_device_read' filepath='drivers/nvmem/core.c' line='1536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_device_read'>
+        <parameter type-id='8179bc49' name='nvmem' filepath='drivers/nvmem/core.c' line='1536' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='drivers/nvmem/core.c' line='1537' column='1'/>
+        <parameter type-id='b59d7dce' name='bytes' filepath='drivers/nvmem/core.c' line='1538' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='drivers/nvmem/core.c' line='1538' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='nvmem_device_write' mangled-name='nvmem_device_write' filepath='include/linux/nvmem-consumer.h' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_device_write'>
-        <parameter type-id='8179bc49'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='nvmem_device_write' mangled-name='nvmem_device_write' filepath='drivers/nvmem/core.c' line='1564' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_device_write'>
+        <parameter type-id='8179bc49' name='nvmem' filepath='drivers/nvmem/core.c' line='1564' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='drivers/nvmem/core.c' line='1565' column='1'/>
+        <parameter type-id='b59d7dce' name='bytes' filepath='drivers/nvmem/core.c' line='1566' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='drivers/nvmem/core.c' line='1566' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='nvmem_register' mangled-name='nvmem_register' filepath='drivers/nvmem/core.c' line='605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nvmem_register'>
@@ -127728,19 +127551,19 @@
         <parameter type-id='8179bc49' name='nvmem' filepath='drivers/nvmem/core.c' line='744' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='of_address_to_resource' mangled-name='of_address_to_resource' filepath='include/linux/of_address.h' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_address_to_resource'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='c9d64c0d'/>
+      <function-decl name='of_address_to_resource' mangled-name='of_address_to_resource' filepath='drivers/of/address.c' line='866' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_address_to_resource'>
+        <parameter type-id='9a537bbe' name='dev' filepath='drivers/of/address.c' line='866' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/address.c' line='866' column='1'/>
+        <parameter type-id='c9d64c0d' name='r' filepath='drivers/of/address.c' line='867' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_alias_get_highest_id' mangled-name='of_alias_get_highest_id' filepath='include/linux/of.h' line='395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_highest_id'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_alias_get_highest_id' mangled-name='of_alias_get_highest_id' filepath='drivers/of/base.c' line='2108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_highest_id'>
+        <parameter type-id='80f4b756' name='stem' filepath='drivers/of/base.c' line='2108' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_alias_get_id' mangled-name='of_alias_get_id' filepath='include/linux/of.h' line='394' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_id'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_alias_get_id' mangled-name='of_alias_get_id' filepath='drivers/of/base.c' line='2027' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_alias_get_id'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='2027' column='1'/>
+        <parameter type-id='80f4b756' name='stem' filepath='drivers/of/base.c' line='2027' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_clk_add_hw_provider' mangled-name='of_clk_add_hw_provider' filepath='drivers/clk/clk.c' line='4638' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_add_hw_provider'>
@@ -127759,14 +127582,14 @@
         <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4740' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='of_clk_get' mangled-name='of_clk_get' filepath='include/linux/clk.h' line='987' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_clk_get' mangled-name='of_clk_get' filepath='drivers/clk/clk.c' line='4940' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4940' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/clk/clk.c' line='4940' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_clk_get_by_name' mangled-name='of_clk_get_by_name' filepath='include/linux/clk.h' line='988' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_by_name'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_clk_get_by_name' mangled-name='of_clk_get_by_name' filepath='drivers/clk/clk.c' line='4955' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_by_name'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clk/clk.c' line='4955' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/clk/clk.c' line='4955' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
       <function-decl name='of_clk_get_from_provider' mangled-name='of_clk_get_from_provider' filepath='drivers/clk/clk.c' line='4906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_get_from_provider'>
@@ -127792,9 +127615,9 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4553' column='1'/>
         <return type-id='3aaeef89'/>
       </function-decl>
-      <function-decl name='of_clk_set_defaults' mangled-name='of_clk_set_defaults' filepath='include/linux/clk/clk-conf.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_set_defaults'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='of_clk_set_defaults' mangled-name='of_clk_set_defaults' filepath='drivers/clk/clk-conf.c' line='131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_set_defaults'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/clk/clk-conf.c' line='131' column='1'/>
+        <parameter type-id='b50a4934' name='clk_supplier' filepath='drivers/clk/clk-conf.c' line='131' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_clk_src_onecell_get' mangled-name='of_clk_src_onecell_get' filepath='drivers/clk/clk.c' line='4559' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_clk_src_onecell_get'>
@@ -127807,14 +127630,14 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/clk/clk.c' line='4547' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
-      <function-decl name='of_count_phandle_with_args' mangled-name='of_count_phandle_with_args' filepath='include/linux/of.h' line='378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_count_phandle_with_args'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_count_phandle_with_args' mangled-name='of_count_phandle_with_args' filepath='drivers/of/base.c' line='1738' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_count_phandle_with_args'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='1738' column='1'/>
+        <parameter type-id='80f4b756' name='list_name' filepath='drivers/of/base.c' line='1738' column='1'/>
+        <parameter type-id='80f4b756' name='cells_name' filepath='drivers/of/base.c' line='1739' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_cpu_node_to_id' mangled-name='of_cpu_node_to_id' filepath='include/linux/of.h' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_cpu_node_to_id'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_cpu_node_to_id' mangled-name='of_cpu_node_to_id' filepath='drivers/of/base.c' line='400' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_cpu_node_to_id'>
+        <parameter type-id='9a537bbe' name='cpu_node' filepath='drivers/of/base.c' line='400' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_cpufreq_cooling_register' mangled-name='of_cpufreq_cooling_register' filepath='drivers/thermal/cpufreq_cooling.c' line='626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_cpufreq_cooling_register'>
@@ -127832,39 +127655,39 @@
         <parameter type-id='0b660ebe' name='dfc_power' filepath='drivers/thermal/devfreq_cooling.c' line='461' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
-      <function-decl name='of_device_get_match_data' mangled-name='of_device_get_match_data' filepath='include/linux/of_device.h' line='36' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_get_match_data'>
-        <parameter type-id='8df61054'/>
+      <function-decl name='of_device_get_match_data' mangled-name='of_device_get_match_data' filepath='drivers/of/device.c' line='206' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_get_match_data'>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/of/device.c' line='206' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='of_device_is_available' mangled-name='of_device_is_available' filepath='include/linux/of.h' line='347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_is_available'>
-        <parameter type-id='0afa6ea3'/>
-        <return type-id='c894953d'/>
+      <function-decl name='of_device_is_available' mangled-name='of_device_is_available' filepath='drivers/of/base.c' line='617' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_is_available'>
+        <parameter type-id='0afa6ea3' name='device' filepath='drivers/of/base.c' line='617' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='of_device_is_compatible' mangled-name='of_device_is_compatible' filepath='drivers/of/base.c' line='525' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_is_compatible'>
         <parameter type-id='0afa6ea3' name='device' filepath='drivers/of/base.c' line='525' column='1'/>
         <parameter type-id='80f4b756' name='compat' filepath='drivers/of/base.c' line='526' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_device_modalias' mangled-name='of_device_modalias' filepath='include/linux/of_device.h' line='38' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_modalias'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='bd54fe1a'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='of_device_modalias' mangled-name='of_device_modalias' filepath='drivers/of/device.c' line='283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_modalias'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/of/device.c' line='283' column='1'/>
+        <parameter type-id='26a90f95' name='str' filepath='drivers/of/device.c' line='283' column='1'/>
+        <parameter type-id='79a0948f' name='len' filepath='drivers/of/device.c' line='283' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='of_device_request_module' mangled-name='of_device_request_module' filepath='drivers/of/device.c' line='257' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_request_module'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/of/device.c' line='257' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_device_uevent_modalias' mangled-name='of_device_uevent_modalias' filepath='include/linux/of_device.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_uevent_modalias'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='d9d65b21'/>
+      <function-decl name='of_device_uevent_modalias' mangled-name='of_device_uevent_modalias' filepath='drivers/of/device.c' line='337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_device_uevent_modalias'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/of/device.c' line='337' column='1'/>
+        <parameter type-id='d9d65b21' name='env' filepath='drivers/of/device.c' line='337' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_dma_configure_id' mangled-name='of_dma_configure_id' filepath='include/linux/of_device.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_dma_configure_id'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='5b2fd8e8'/>
+      <function-decl name='of_dma_configure_id' mangled-name='of_dma_configure_id' filepath='drivers/of/device.c' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_dma_configure_id'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/of/device.c' line='91' column='1'/>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/device.c' line='91' column='1'/>
+        <parameter type-id='b50a4934' name='force_dma' filepath='drivers/of/device.c' line='92' column='1'/>
+        <parameter type-id='aded214c' name='id' filepath='drivers/of/device.c' line='92' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_dma_controller_free' mangled-name='of_dma_controller_free' filepath='drivers/dma/of-dma.c' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_dma_controller_free'>
@@ -127877,9 +127700,9 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/dma/of-dma.c' line='111' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_dma_is_coherent' mangled-name='of_dma_is_coherent' filepath='include/linux/of_address.h' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_dma_is_coherent'>
-        <parameter type-id='9a537bbe'/>
-        <return type-id='c894953d'/>
+      <function-decl name='of_dma_is_coherent' mangled-name='of_dma_is_coherent' filepath='drivers/of/address.c' line='1077' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_dma_is_coherent'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/address.c' line='1077' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='of_dma_simple_xlate' mangled-name='of_dma_simple_xlate' filepath='drivers/dma/of-dma.c' line='311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_dma_simple_xlate'>
         <parameter type-id='51a94113' name='dma_spec' filepath='drivers/dma/of-dma.c' line='311' column='1'/>
@@ -127912,14 +127735,14 @@
         <parameter type-id='9a537bbe' name='node' filepath='drivers/video/backlight/backlight.c' line='665' column='1'/>
         <return type-id='7a76d041'/>
       </function-decl>
-      <function-decl name='of_find_compatible_node' mangled-name='of_find_compatible_node' filepath='include/linux/of.h' line='271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_compatible_node'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_find_compatible_node' mangled-name='of_find_compatible_node' filepath='drivers/of/base.c' line='1029' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_compatible_node'>
+        <parameter type-id='9a537bbe' name='from' filepath='drivers/of/base.c' line='1029' column='1'/>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/of/base.c' line='1030' column='1'/>
+        <parameter type-id='80f4b756' name='compatible' filepath='drivers/of/base.c' line='1030' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_find_device_by_node' mangled-name='of_find_device_by_node' filepath='include/linux/of_platform.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_device_by_node'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_find_device_by_node' mangled-name='of_find_device_by_node' filepath='drivers/of/platform.c' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_device_by_node'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/platform.c' line='49' column='1'/>
         <return type-id='db362995'/>
       </function-decl>
       <function-decl name='of_find_i2c_adapter_by_node' mangled-name='of_find_i2c_adapter_by_node' filepath='drivers/i2c/i2c-core-of.c' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_i2c_adapter_by_node'>
@@ -127930,44 +127753,44 @@
         <parameter type-id='9a537bbe' name='node' filepath='drivers/i2c/i2c-core-of.c' line='131' column='1'/>
         <return type-id='3e31633b'/>
       </function-decl>
-      <function-decl name='of_find_matching_node_and_match' mangled-name='of_find_matching_node_and_match' filepath='include/linux/of.h' line='273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_matching_node_and_match'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='e5ce629e'/>
-        <parameter type-id='77e5615c'/>
+      <function-decl name='of_find_matching_node_and_match' mangled-name='of_find_matching_node_and_match' filepath='drivers/of/base.c' line='1136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_matching_node_and_match'>
+        <parameter type-id='9a537bbe' name='from' filepath='drivers/of/base.c' line='1136' column='1'/>
+        <parameter type-id='e5ce629e' name='matches' filepath='drivers/of/base.c' line='1137' column='1'/>
+        <parameter type-id='77e5615c' name='match' filepath='drivers/of/base.c' line='1138' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
       <function-decl name='of_find_mipi_dsi_host_by_node' mangled-name='of_find_mipi_dsi_host_by_node' filepath='drivers/gpu/drm/drm_mipi_dsi.c' line='261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_mipi_dsi_host_by_node'>
         <parameter type-id='9a537bbe' name='node' filepath='drivers/gpu/drm/drm_mipi_dsi.c' line='261' column='1'/>
         <return type-id='c149fe34'/>
       </function-decl>
-      <function-decl name='of_find_node_by_name' mangled-name='of_find_node_by_name' filepath='include/linux/of.h' line='267' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_by_name'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_find_node_by_name' mangled-name='of_find_node_by_name' filepath='drivers/of/base.c' line='971' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_by_name'>
+        <parameter type-id='9a537bbe' name='from' filepath='drivers/of/base.c' line='971' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/of/base.c' line='972' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_find_node_by_phandle' mangled-name='of_find_node_by_phandle' filepath='include/linux/of.h' line='285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_by_phandle'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='of_find_node_by_phandle' mangled-name='of_find_node_by_phandle' filepath='drivers/of/base.c' line='1196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_by_phandle'>
+        <parameter type-id='6e394fba' name='handle' filepath='drivers/of/base.c' line='1196' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_find_node_by_type' mangled-name='of_find_node_by_type' filepath='include/linux/of.h' line='269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_by_type'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_find_node_by_type' mangled-name='of_find_node_by_type' filepath='drivers/of/base.c' line='999' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_by_type'>
+        <parameter type-id='9a537bbe' name='from' filepath='drivers/of/base.c' line='999' column='1'/>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/of/base.c' line='1000' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_find_node_opts_by_path' mangled-name='of_find_node_opts_by_path' filepath='include/linux/of.h' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_opts_by_path'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7d3cd834'/>
+      <function-decl name='of_find_node_opts_by_path' mangled-name='of_find_node_opts_by_path' filepath='drivers/of/base.c' line='913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_opts_by_path'>
+        <parameter type-id='80f4b756' name='path' filepath='drivers/of/base.c' line='913' column='1'/>
+        <parameter type-id='7d3cd834' name='opts' filepath='drivers/of/base.c' line='913' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_find_node_with_property' mangled-name='of_find_node_with_property' filepath='include/linux/of.h' line='301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_with_property'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_find_node_with_property' mangled-name='of_find_node_with_property' filepath='drivers/of/base.c' line='1058' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_node_with_property'>
+        <parameter type-id='9a537bbe' name='from' filepath='drivers/of/base.c' line='1058' column='1'/>
+        <parameter type-id='80f4b756' name='prop_name' filepath='drivers/of/base.c' line='1059' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_find_property' mangled-name='of_find_property' filepath='include/linux/of.h' line='304' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_property'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='of_find_property' mangled-name='of_find_property' filepath='drivers/of/base.c' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_find_property'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='210' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/of/base.c' line='211' column='1'/>
+        <parameter type-id='7292109c' name='lenp' filepath='drivers/of/base.c' line='212' column='1'/>
         <return type-id='ddcd89c6'/>
       </function-decl>
       <var-decl name='of_fwnode_ops' type-id='2eb8da02' mangled-name='of_fwnode_ops' visibility='default' filepath='drivers/of/property.c' line='1414' column='1' elf-symbol-id='of_fwnode_ops'/>
@@ -128001,16 +127824,16 @@
         <parameter type-id='9a537bbe' name='np' filepath='drivers/base/power/domain.c' line='2361' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='of_get_address' mangled-name='of_get_address' filepath='include/linux/of_address.h' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_address'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='c0190993'/>
-        <parameter type-id='807869d3'/>
-        <return type-id='5b2fd8e8'/>
+      <function-decl name='of_get_address' mangled-name='of_get_address' filepath='drivers/of/address.c' line='674' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_address'>
+        <parameter type-id='9a537bbe' name='dev' filepath='drivers/of/address.c' line='674' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/address.c' line='674' column='1'/>
+        <parameter type-id='3df9fd28' name='size' filepath='drivers/of/address.c' line='674' column='1'/>
+        <parameter type-id='807869d3' name='flags' filepath='drivers/of/address.c' line='675' column='1'/>
+        <return type-id='90144368'/>
       </function-decl>
-      <function-decl name='of_get_child_by_name' mangled-name='of_get_child_by_name' filepath='include/linux/of.h' line='295' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_child_by_name'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_get_child_by_name' mangled-name='of_get_child_by_name' filepath='drivers/of/base.c' line='847' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_child_by_name'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/base.c' line='847' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/of/base.c' line='848' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
       <function-decl name='of_get_compatible_child' mangled-name='of_get_compatible_child' filepath='drivers/of/base.c' line='822' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_compatible_child'>
@@ -128018,9 +127841,9 @@
         <parameter type-id='80f4b756' name='compatible' filepath='drivers/of/base.c' line='823' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_get_cpu_node' mangled-name='of_get_cpu_node' filepath='include/linux/of.h' line='352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_cpu_node'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='of_get_cpu_node' mangled-name='of_get_cpu_node' filepath='drivers/of/base.c' line='380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_cpu_node'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='drivers/of/base.c' line='380' column='1'/>
+        <parameter type-id='807869d3' name='thread' filepath='drivers/of/base.c' line='380' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
       <function-decl name='of_get_display_timing' mangled-name='of_get_display_timing' filepath='drivers/video/of_display_timing.c' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_display_timing'>
@@ -128057,33 +127880,33 @@
         <parameter type-id='38fe9344' name='flags' filepath='drivers/gpio/gpiolib-of.c' line='279' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_get_next_available_child' mangled-name='of_get_next_available_child' filepath='include/linux/of.h' line='290' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_next_available_child'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_get_next_available_child' mangled-name='of_get_next_available_child' filepath='drivers/of/base.c' line='751' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_next_available_child'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/base.c' line='751' column='1'/>
+        <parameter type-id='9a537bbe' name='prev' filepath='drivers/of/base.c' line='752' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_get_next_child' mangled-name='of_get_next_child' filepath='include/linux/of.h' line='288' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_next_child'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_get_next_child' mangled-name='of_get_next_child' filepath='drivers/of/base.c' line='730' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_next_child'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/base.c' line='730' column='1'/>
+        <parameter type-id='9a537bbe' name='prev' filepath='drivers/of/base.c' line='731' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_get_next_parent' mangled-name='of_get_next_parent' filepath='include/linux/of.h' line='287' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_next_parent'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_get_next_parent' mangled-name='of_get_next_parent' filepath='drivers/of/base.c' line='686' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_next_parent'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/of/base.c' line='686' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_get_parent' mangled-name='of_get_parent' filepath='include/linux/of.h' line='286' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_parent'>
-        <parameter type-id='0afa6ea3'/>
+      <function-decl name='of_get_parent' mangled-name='of_get_parent' filepath='drivers/of/base.c' line='660' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_parent'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/base.c' line='660' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_get_phy_mode' mangled-name='of_get_phy_mode' filepath='include/linux/of_net.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_phy_mode'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='84548db8'/>
+      <function-decl name='of_get_phy_mode' mangled-name='of_get_phy_mode' filepath='drivers/of/of_net.c' line='25' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_phy_mode'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/of_net.c' line='25' column='1'/>
+        <parameter type-id='14061e47' name='interface' filepath='drivers/of/of_net.c' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_get_property' mangled-name='of_get_property' filepath='include/linux/of.h' line='349' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_property'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='of_get_property' mangled-name='of_get_property' filepath='drivers/of/base.c' line='280' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_property'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='280' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/of/base.c' line='280' column='1'/>
+        <parameter type-id='7292109c' name='lenp' filepath='drivers/of/base.c' line='281' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='of_get_regulator_init_data' mangled-name='of_get_regulator_init_data' filepath='drivers/regulator/of_regulator.c' line='273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_regulator_init_data'>
@@ -128108,9 +127931,9 @@
         <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='792' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_graph_get_next_endpoint' mangled-name='of_graph_get_next_endpoint' filepath='include/linux/of_graph.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_next_endpoint'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_graph_get_next_endpoint' mangled-name='of_graph_get_next_endpoint' filepath='drivers/of/property.c' line='620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_next_endpoint'>
+        <parameter type-id='0afa6ea3' name='parent' filepath='drivers/of/property.c' line='620' column='1'/>
+        <parameter type-id='9a537bbe' name='prev' filepath='drivers/of/property.c' line='621' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
       <function-decl name='of_graph_get_port_by_id' mangled-name='of_graph_get_port_by_id' filepath='drivers/of/property.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_port_by_id'>
@@ -128126,32 +127949,32 @@
         <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='713' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_remote_node' mangled-name='of_graph_get_remote_node' filepath='include/linux/of_graph.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_node'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='of_graph_get_remote_node' mangled-name='of_graph_get_remote_node' filepath='drivers/of/property.c' line='813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_node'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='813' column='1'/>
+        <parameter type-id='19c2251e' name='port' filepath='drivers/of/property.c' line='814' column='1'/>
+        <parameter type-id='19c2251e' name='endpoint' filepath='drivers/of/property.c' line='814' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_remote_port' mangled-name='of_graph_get_remote_port' filepath='include/linux/of_graph.h' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port'>
-        <parameter type-id='0afa6ea3'/>
+      <function-decl name='of_graph_get_remote_port' mangled-name='of_graph_get_remote_port' filepath='drivers/of/property.c' line='780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='780' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_get_remote_port_parent' mangled-name='of_graph_get_remote_port_parent' filepath='include/linux/of_graph.h' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port_parent'>
-        <parameter type-id='0afa6ea3'/>
+      <function-decl name='of_graph_get_remote_port_parent' mangled-name='of_graph_get_remote_port_parent' filepath='drivers/of/property.c' line='757' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_get_remote_port_parent'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='758' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_graph_is_present' mangled-name='of_graph_is_present' filepath='include/linux/of_graph.h' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_is_present'>
-        <parameter type-id='0afa6ea3'/>
-        <return type-id='c894953d'/>
+      <function-decl name='of_graph_is_present' mangled-name='of_graph_is_present' filepath='drivers/of/property.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_is_present'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='40' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='of_graph_parse_endpoint' mangled-name='of_graph_parse_endpoint' filepath='include/linux/of_graph.h' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_parse_endpoint'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='a5eb3c12'/>
+      <function-decl name='of_graph_parse_endpoint' mangled-name='of_graph_parse_endpoint' filepath='drivers/of/property.c' line='556' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_graph_parse_endpoint'>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/property.c' line='556' column='1'/>
+        <parameter type-id='a5eb3c12' name='endpoint' filepath='drivers/of/property.c' line='557' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_hwspin_lock_get_id' mangled-name='of_hwspin_lock_get_id' filepath='include/linux/hwspinlock.h' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_hwspin_lock_get_id'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_hwspin_lock_get_id' mangled-name='of_hwspin_lock_get_id' filepath='drivers/hwspinlock/hwspinlock_core.c' line='339' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_hwspin_lock_get_id'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/hwspinlock/hwspinlock_core.c' line='339' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/hwspinlock/hwspinlock_core.c' line='339' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_i2c_get_board_info' mangled-name='of_i2c_get_board_info' filepath='drivers/i2c/i2c-core-of.c' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_i2c_get_board_info'>
@@ -128160,9 +127983,9 @@
         <parameter type-id='fae597a1' name='info' filepath='drivers/i2c/i2c-core-of.c' line='24' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_icc_get' mangled-name='of_icc_get' filepath='include/linux/interconnect.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_icc_get'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_icc_get' mangled-name='of_icc_get' filepath='drivers/interconnect/core.c' line='533' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_icc_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/interconnect/core.c' line='533' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/interconnect/core.c' line='533' column='1'/>
         <return type-id='b5fdec5e'/>
       </function-decl>
       <function-decl name='of_icc_xlate_onecell' mangled-name='of_icc_xlate_onecell' filepath='drivers/interconnect/core.c' line='331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_icc_xlate_onecell'>
@@ -128170,74 +127993,74 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/interconnect/core.c' line='332' column='1'/>
         <return type-id='18d76f87'/>
       </function-decl>
-      <function-decl name='of_iomap' mangled-name='of_iomap' filepath='include/linux/of_address.h' line='112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_iomap'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_iomap' mangled-name='of_iomap' filepath='drivers/of/address.c' line='892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_iomap'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/address.c' line='892' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/address.c' line='892' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='of_irq_find_parent' mangled-name='of_irq_find_parent' filepath='include/linux/of_irq.h' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_find_parent'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_irq_find_parent' mangled-name='of_irq_find_parent' filepath='drivers/of/irq.c' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_find_parent'>
+        <parameter type-id='9a537bbe' name='child' filepath='drivers/of/irq.c' line='54' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_irq_get' mangled-name='of_irq_get' filepath='include/linux/of_irq.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_get'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_irq_get' mangled-name='of_irq_get' filepath='drivers/of/irq.c' line='387' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_get'>
+        <parameter type-id='9a537bbe' name='dev' filepath='drivers/of/irq.c' line='387' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/irq.c' line='387' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_irq_get_byname' mangled-name='of_irq_get_byname' filepath='include/linux/of_irq.h' line='47' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_get_byname'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_irq_get_byname' mangled-name='of_irq_get_byname' filepath='drivers/of/irq.c' line='414' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_get_byname'>
+        <parameter type-id='9a537bbe' name='dev' filepath='drivers/of/irq.c' line='414' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/of/irq.c' line='414' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_irq_parse_one' mangled-name='of_irq_parse_one' filepath='include/linux/of_irq.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_parse_one'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='51a94113'/>
+      <function-decl name='of_irq_parse_one' mangled-name='of_irq_parse_one' filepath='drivers/of/irq.c' line='286' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_parse_one'>
+        <parameter type-id='9a537bbe' name='device' filepath='drivers/of/irq.c' line='286' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/irq.c' line='286' column='1'/>
+        <parameter type-id='51a94113' name='out_irq' filepath='drivers/of/irq.c' line='286' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_irq_to_resource_table' mangled-name='of_irq_to_resource_table' filepath='include/linux/of_irq.h' line='48' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_to_resource_table'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='c9d64c0d'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_irq_to_resource_table' mangled-name='of_irq_to_resource_table' filepath='drivers/of/irq.c' line='452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_irq_to_resource_table'>
+        <parameter type-id='9a537bbe' name='dev' filepath='drivers/of/irq.c' line='452' column='1'/>
+        <parameter type-id='c9d64c0d' name='res' filepath='drivers/of/irq.c' line='452' column='1'/>
+        <parameter type-id='95e97e5e' name='nr_irqs' filepath='drivers/of/irq.c' line='453' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_machine_is_compatible' mangled-name='of_machine_is_compatible' filepath='include/linux/of.h' line='400' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_machine_is_compatible'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_machine_is_compatible' mangled-name='of_machine_is_compatible' filepath='drivers/of/base.c' line='567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_machine_is_compatible'>
+        <parameter type-id='80f4b756' name='compat' filepath='drivers/of/base.c' line='567' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_match_device' mangled-name='of_match_device' filepath='include/linux/of_device.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_match_device'>
-        <parameter type-id='e5ce629e'/>
-        <parameter type-id='8df61054'/>
+      <function-decl name='of_match_device' mangled-name='of_match_device' filepath='drivers/of/device.c' line='27' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_match_device'>
+        <parameter type-id='e5ce629e' name='matches' filepath='drivers/of/device.c' line='27' column='1'/>
+        <parameter type-id='8df61054' name='dev' filepath='drivers/of/device.c' line='28' column='1'/>
         <return type-id='e5ce629e'/>
       </function-decl>
-      <function-decl name='of_match_node' mangled-name='of_match_node' filepath='include/linux/of.h' line='362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_match_node'>
-        <parameter type-id='e5ce629e'/>
-        <parameter type-id='0afa6ea3'/>
+      <function-decl name='of_match_node' mangled-name='of_match_node' filepath='drivers/of/base.c' line='1110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_match_node'>
+        <parameter type-id='e5ce629e' name='matches' filepath='drivers/of/base.c' line='1110' column='1'/>
+        <parameter type-id='0afa6ea3' name='node' filepath='drivers/of/base.c' line='1111' column='1'/>
         <return type-id='e5ce629e'/>
       </function-decl>
-      <function-decl name='of_mdiobus_register' mangled-name='of_mdiobus_register' filepath='include/linux/of_mdio.h' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_mdiobus_register'>
-        <parameter type-id='ff47b24b'/>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_mdiobus_register' mangled-name='of_mdiobus_register' filepath='drivers/net/mdio/of_mdio.c' line='248' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_mdiobus_register'>
+        <parameter type-id='ff47b24b' name='mdio' filepath='drivers/net/mdio/of_mdio.c' line='248' column='1'/>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/net/mdio/of_mdio.c' line='248' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_modalias_node' mangled-name='of_modalias_node' filepath='include/linux/of.h' line='364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_modalias_node'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_modalias_node' mangled-name='of_modalias_node' filepath='drivers/of/base.c' line='1175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_modalias_node'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/of/base.c' line='1175' column='1'/>
+        <parameter type-id='26a90f95' name='modalias' filepath='drivers/of/base.c' line='1175' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='drivers/of/base.c' line='1175' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_n_addr_cells' mangled-name='of_n_addr_cells' filepath='include/linux/of.h' line='360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_n_addr_cells'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_n_addr_cells' mangled-name='of_n_addr_cells' filepath='drivers/of/base.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_n_addr_cells'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='101' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_n_size_cells' mangled-name='of_n_size_cells' filepath='include/linux/of.h' line='361' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_n_size_cells'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_n_size_cells' mangled-name='of_n_size_cells' filepath='drivers/of/base.c' line='122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_n_size_cells'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='122' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_node_name_eq' mangled-name='of_node_name_eq' filepath='include/linux/of.h' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_node_name_eq'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <return type-id='c894953d'/>
+      <function-decl name='of_node_name_eq' mangled-name='of_node_name_eq' filepath='drivers/of/base.c' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_node_name_eq'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='58' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/of/base.c' line='58' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='of_nvmem_cell_get' mangled-name='of_nvmem_cell_get' filepath='drivers/nvmem/core.c' line='1062' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_nvmem_cell_get'>
         <parameter type-id='9a537bbe' name='np' filepath='drivers/nvmem/core.c' line='1062' column='1'/>
@@ -128249,38 +128072,38 @@
         <parameter type-id='80f4b756' name='id' filepath='drivers/nvmem/core.c' line='855' column='1'/>
         <return type-id='8179bc49'/>
       </function-decl>
-      <function-decl name='of_parse_phandle' mangled-name='of_parse_phandle' filepath='include/linux/of.h' line='366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_parse_phandle'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_parse_phandle' mangled-name='of_parse_phandle' filepath='drivers/of/base.c' line='1432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_parse_phandle'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='1432' column='1'/>
+        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/of/base.c' line='1433' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/base.c' line='1433' column='1'/>
         <return type-id='9a537bbe'/>
       </function-decl>
-      <function-decl name='of_parse_phandle_with_args' mangled-name='of_parse_phandle_with_args' filepath='include/linux/of.h' line='369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_parse_phandle_with_args'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='51a94113'/>
+      <function-decl name='of_parse_phandle_with_args' mangled-name='of_parse_phandle_with_args' filepath='drivers/of/base.c' line='1480' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_parse_phandle_with_args'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='1480' column='1'/>
+        <parameter type-id='80f4b756' name='list_name' filepath='drivers/of/base.c' line='1480' column='1'/>
+        <parameter type-id='80f4b756' name='cells_name' filepath='drivers/of/base.c' line='1481' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/base.c' line='1481' column='1'/>
+        <parameter type-id='51a94113' name='out_args' filepath='drivers/of/base.c' line='1482' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_parse_phandle_with_fixed_args' mangled-name='of_parse_phandle_with_fixed_args' filepath='include/linux/of.h' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_parse_phandle_with_fixed_args'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='51a94113'/>
+      <function-decl name='of_parse_phandle_with_fixed_args' mangled-name='of_parse_phandle_with_fixed_args' filepath='drivers/of/base.c' line='1712' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_parse_phandle_with_fixed_args'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='1712' column='1'/>
+        <parameter type-id='80f4b756' name='list_name' filepath='drivers/of/base.c' line='1713' column='1'/>
+        <parameter type-id='95e97e5e' name='cell_count' filepath='drivers/of/base.c' line='1713' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/of/base.c' line='1714' column='1'/>
+        <parameter type-id='51a94113' name='out_args' filepath='drivers/of/base.c' line='1714' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_phandle_iterator_init' mangled-name='of_phandle_iterator_init' filepath='include/linux/of.h' line='382' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phandle_iterator_init'>
-        <parameter type-id='58cfaa0e'/>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_phandle_iterator_init' mangled-name='of_phandle_iterator_init' filepath='drivers/of/base.c' line='1240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phandle_iterator_init'>
+        <parameter type-id='58cfaa0e' name='it' filepath='drivers/of/base.c' line='1240' column='1'/>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='1241' column='1'/>
+        <parameter type-id='80f4b756' name='list_name' filepath='drivers/of/base.c' line='1242' column='1'/>
+        <parameter type-id='80f4b756' name='cells_name' filepath='drivers/of/base.c' line='1243' column='1'/>
+        <parameter type-id='95e97e5e' name='cell_count' filepath='drivers/of/base.c' line='1244' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_phandle_iterator_next' mangled-name='of_phandle_iterator_next' filepath='include/linux/of.h' line='388' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phandle_iterator_next'>
-        <parameter type-id='58cfaa0e'/>
+      <function-decl name='of_phandle_iterator_next' mangled-name='of_phandle_iterator_next' filepath='drivers/of/base.c' line='1273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phandle_iterator_next'>
+        <parameter type-id='58cfaa0e' name='it' filepath='drivers/of/base.c' line='1273' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_phy_connect' mangled-name='of_phy_connect' filepath='drivers/net/mdio/of_mdio.c' line='399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phy_connect'>
@@ -128295,8 +128118,8 @@
         <parameter type-id='9a537bbe' name='np' filepath='drivers/net/mdio/of_mdio.c' line='579' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='of_phy_find_device' mangled-name='of_phy_find_device' filepath='include/linux/of_mdio.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phy_find_device'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_phy_find_device' mangled-name='of_phy_find_device' filepath='drivers/net/mdio/of_mdio.c' line='370' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phy_find_device'>
+        <parameter type-id='9a537bbe' name='phy_np' filepath='drivers/net/mdio/of_mdio.c' line='370' column='1'/>
         <return type-id='7efbcaaf'/>
       </function-decl>
       <function-decl name='of_phy_is_fixed_link' mangled-name='of_phy_is_fixed_link' filepath='drivers/net/mdio/of_mdio.c' line='503' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phy_is_fixed_link'>
@@ -128312,8 +128135,8 @@
         <parameter type-id='51a94113' name='args' filepath='drivers/phy/phy-core.c' line='634' column='1'/>
         <return type-id='503ff1ba'/>
       </function-decl>
-      <function-decl name='of_platform_depopulate' mangled-name='of_platform_depopulate' filepath='include/linux/of_platform.h' line='81' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_platform_depopulate'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='of_platform_depopulate' mangled-name='of_platform_depopulate' filepath='drivers/of/platform.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_platform_depopulate'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/of/platform.c' line='588' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='of_platform_device_create' mangled-name='of_platform_device_create' filepath='drivers/of/platform.c' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_platform_device_create'>
@@ -128327,61 +128150,61 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/of/platform.c' line='555' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_platform_populate' mangled-name='of_platform_populate' filepath='include/linux/of_platform.h' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_platform_populate'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='e5ce629e'/>
-        <parameter type-id='fcc1e09e'/>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='of_platform_populate' mangled-name='of_platform_populate' filepath='drivers/of/platform.c' line='468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_platform_populate'>
+        <parameter type-id='9a537bbe' name='root' filepath='drivers/of/platform.c' line='468' column='1'/>
+        <parameter type-id='e5ce629e' name='matches' filepath='drivers/of/platform.c' line='469' column='1'/>
+        <parameter type-id='fcc1e09e' name='lookup' filepath='drivers/of/platform.c' line='470' column='1'/>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/of/platform.c' line='471' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_prop_next_string' mangled-name='of_prop_next_string' filepath='include/linux/of.h' line='551' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_string'>
-        <parameter type-id='ddcd89c6'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_prop_next_string' mangled-name='of_prop_next_string' filepath='drivers/of/property.c' line='531' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_string'>
+        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/property.c' line='531' column='1'/>
+        <parameter type-id='80f4b756' name='cur' filepath='drivers/of/property.c' line='531' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='of_prop_next_u32' mangled-name='of_prop_next_u32' filepath='include/linux/of.h' line='542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_u32'>
-        <parameter type-id='ddcd89c6'/>
-        <parameter type-id='5b2fd8e8'/>
-        <parameter type-id='807869d3'/>
-        <return type-id='5b2fd8e8'/>
+      <function-decl name='of_prop_next_u32' mangled-name='of_prop_next_u32' filepath='drivers/of/property.c' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_prop_next_u32'>
+        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/property.c' line='508' column='1'/>
+        <parameter type-id='90144368' name='cur' filepath='drivers/of/property.c' line='508' column='1'/>
+        <parameter type-id='f9409001' name='pu' filepath='drivers/of/property.c' line='509' column='1'/>
+        <return type-id='90144368'/>
       </function-decl>
-      <function-decl name='of_property_count_elems_of_size' mangled-name='of_property_count_elems_of_size' filepath='include/linux/of.h' line='307' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_count_elems_of_size'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_property_count_elems_of_size' mangled-name='of_property_count_elems_of_size' filepath='drivers/of/property.c' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_count_elems_of_size'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='68' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='69' column='1'/>
+        <parameter type-id='95e97e5e' name='elem_size' filepath='drivers/of/property.c' line='69' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_match_string' mangled-name='of_property_match_string' filepath='include/linux/of.h' line='337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_match_string'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='of_property_match_string' mangled-name='of_property_match_string' filepath='drivers/of/property.c' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_match_string'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='442' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='442' column='1'/>
+        <parameter type-id='80f4b756' name='string' filepath='drivers/of/property.c' line='443' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_string' mangled-name='of_property_read_string' filepath='include/linux/of.h' line='334' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7d3cd834'/>
+      <function-decl name='of_property_read_string' mangled-name='of_property_read_string' filepath='drivers/of/property.c' line='418' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='418' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='418' column='1'/>
+        <parameter type-id='7d3cd834' name='out_string' filepath='drivers/of/property.c' line='419' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_string_helper' mangled-name='of_property_read_string_helper' filepath='include/linux/of.h' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string_helper'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7d3cd834'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='of_property_read_string_helper' mangled-name='of_property_read_string_helper' filepath='drivers/of/property.c' line='481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_string_helper'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='481' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='482' column='1'/>
+        <parameter type-id='7d3cd834' name='out_strs' filepath='drivers/of/property.c' line='482' column='1'/>
+        <parameter type-id='b59d7dce' name='sz' filepath='drivers/of/property.c' line='483' column='1'/>
+        <parameter type-id='95e97e5e' name='skip' filepath='drivers/of/property.c' line='483' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_u32_index' mangled-name='of_property_read_u32_index' filepath='include/linux/of.h' line='309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u32_index'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='of_property_read_u32_index' mangled-name='of_property_read_u32_index' filepath='drivers/of/property.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u32_index'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='138' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='139' column='1'/>
+        <parameter type-id='19c2251e' name='index' filepath='drivers/of/property.c' line='140' column='1'/>
+        <parameter type-id='f9409001' name='out_value' filepath='drivers/of/property.c' line='140' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_u64' mangled-name='of_property_read_u64' filepath='include/linux/of.h' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u64'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='of_property_read_u64' mangled-name='of_property_read_u64' filepath='drivers/of/property.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u64'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='340' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='340' column='1'/>
+        <parameter type-id='3df9fd28' name='out_value' filepath='drivers/of/property.c' line='341' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_property_read_u64_index' mangled-name='of_property_read_u64_index' filepath='drivers/of/property.c' line='170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_u64_index'>
@@ -128399,12 +128222,12 @@
         <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='258' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_variable_u32_array' mangled-name='of_property_read_variable_u32_array' filepath='include/linux/of.h' line='321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u32_array'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='807869d3'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='of_property_read_variable_u32_array' mangled-name='of_property_read_variable_u32_array' filepath='drivers/of/property.c' line='301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u32_array'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='301' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='302' column='1'/>
+        <parameter type-id='f9409001' name='out_values' filepath='drivers/of/property.c' line='302' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='303' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='303' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_property_read_variable_u64_array' mangled-name='of_property_read_variable_u64_array' filepath='drivers/of/property.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u64_array'>
@@ -128415,12 +128238,12 @@
         <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='377' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_property_read_variable_u8_array' mangled-name='of_property_read_variable_u8_array' filepath='include/linux/of.h' line='315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u8_array'>
-        <parameter type-id='0afa6ea3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='of_property_read_variable_u8_array' mangled-name='of_property_read_variable_u8_array' filepath='drivers/of/property.c' line='208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_property_read_variable_u8_array'>
+        <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/property.c' line='208' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='drivers/of/property.c' line='209' column='1'/>
+        <parameter type-id='8bff8096' name='out_values' filepath='drivers/of/property.c' line='209' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_min' filepath='drivers/of/property.c' line='210' column='1'/>
+        <parameter type-id='b59d7dce' name='sz_max' filepath='drivers/of/property.c' line='210' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_pwm_xlate_with_flags' mangled-name='of_pwm_xlate_with_flags' filepath='drivers/pwm/core.c' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_pwm_xlate_with_flags'>
@@ -128435,9 +128258,9 @@
         <parameter type-id='f0981eeb' name='num_matches' filepath='drivers/regulator/of_regulator.c' line='327' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='of_remove_property' mangled-name='of_remove_property' filepath='include/linux/of.h' line='403' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_remove_property'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='ddcd89c6'/>
+      <function-decl name='of_remove_property' mangled-name='of_remove_property' filepath='drivers/of/base.c' line='1849' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_remove_property'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/base.c' line='1849' column='1'/>
+        <parameter type-id='ddcd89c6' name='prop' filepath='drivers/of/base.c' line='1849' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='of_reserved_mem_device_init_by_idx' mangled-name='of_reserved_mem_device_init_by_idx' filepath='drivers/of/of_reserved_mem.c' line='321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_reserved_mem_device_init_by_idx'>
@@ -128450,15 +128273,15 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/of/of_reserved_mem.c' line='395' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='of_reserved_mem_lookup' mangled-name='of_reserved_mem_lookup' filepath='include/linux/of_reserved_mem.h' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_reserved_mem_lookup'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='of_reserved_mem_lookup' mangled-name='of_reserved_mem_lookup' filepath='drivers/of/of_reserved_mem.c' line='425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_reserved_mem_lookup'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/of/of_reserved_mem.c' line='425' column='1'/>
         <return type-id='f7f718cb'/>
       </function-decl>
-      <function-decl name='of_reset_control_array_get' mangled-name='of_reset_control_array_get' filepath='include/linux/reset.h' line='36' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_reset_control_array_get'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='of_reset_control_array_get' mangled-name='of_reset_control_array_get' filepath='drivers/reset/core.c' line='873' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_reset_control_array_get'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/reset/core.c' line='873' column='1'/>
+        <parameter type-id='b50a4934' name='shared' filepath='drivers/reset/core.c' line='873' column='1'/>
+        <parameter type-id='b50a4934' name='optional' filepath='drivers/reset/core.c' line='873' column='1'/>
+        <parameter type-id='b50a4934' name='acquired' filepath='drivers/reset/core.c' line='874' column='1'/>
         <return type-id='9f9b8114'/>
       </function-decl>
       <var-decl name='of_root' type-id='9a537bbe' mangled-name='of_root' visibility='default' filepath='drivers/of/base.c' line='36' column='1' elf-symbol-id='of_root'/>
@@ -128475,10 +128298,10 @@
         <parameter type-id='95e97e5e' name='trip' filepath='drivers/thermal/thermal_of.c' line='140' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='of_translate_address' mangled-name='of_translate_address' filepath='include/linux/of_address.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_translate_address'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='5b2fd8e8'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='of_translate_address' mangled-name='of_translate_address' filepath='drivers/of/address.c' line='613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_translate_address'>
+        <parameter type-id='9a537bbe' name='dev' filepath='drivers/of/address.c' line='613' column='1'/>
+        <parameter type-id='90144368' name='in_addr' filepath='drivers/of/address.c' line='613' column='1'/>
+        <return type-id='91ce1af9'/>
       </function-decl>
       <function-decl name='of_usb_get_phy_mode' mangled-name='of_usb_get_phy_mode' filepath='drivers/usb/phy/of.c' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_usb_get_phy_mode'>
         <parameter type-id='9a537bbe' name='np' filepath='drivers/usb/phy/of.c' line='28' column='1'/>
@@ -128493,10 +128316,10 @@
         <parameter type-id='451a0588' name='otg_caps' filepath='drivers/usb/common/common.c' line='323' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='on_each_cpu' mangled-name='on_each_cpu' filepath='include/linux/smp.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='on_each_cpu'>
-        <parameter type-id='b7f9d8e6'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='on_each_cpu' mangled-name='on_each_cpu' filepath='kernel/smp.c' line='832' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='on_each_cpu'>
+        <parameter type-id='89714567' name='func' filepath='kernel/smp.c' line='832' column='1'/>
+        <parameter type-id='eaa32e2f' name='info' filepath='kernel/smp.c' line='832' column='1'/>
+        <parameter type-id='95e97e5e' name='wait' filepath='kernel/smp.c' line='832' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='oops_in_progress' type-id='95e97e5e' mangled-name='oops_in_progress' visibility='default' filepath='kernel/printk/printk.c' line='81' column='1' elf-symbol-id='oops_in_progress'/>
@@ -128515,8 +128338,8 @@
         <parameter type-id='95e97e5e' name='err' filepath='mm/filemap.c' line='1516' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='page_mapping' mangled-name='page_mapping' filepath='include/linux/mm.h' line='1657' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_mapping'>
-        <parameter type-id='02f11ed4'/>
+      <function-decl name='page_mapping' mangled-name='page_mapping' filepath='mm/util.c' line='682' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_mapping'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/util.c' line='682' column='1'/>
         <return type-id='f57039f0'/>
       </function-decl>
       <function-decl name='page_reporting_register' mangled-name='page_reporting_register' filepath='mm/page_reporting.c' line='315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_reporting_register'>
@@ -128527,8 +128350,8 @@
         <parameter type-id='b99d5f36' name='prdev' filepath='mm/page_reporting.c' line='349' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='panic' mangled-name='panic' filepath='include/linux/kernel.h' line='321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='panic'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='panic' mangled-name='panic' filepath='kernel/panic.c' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='panic'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/panic.c' line='177' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
@@ -128635,25 +128458,25 @@
         <parameter type-id='74bccedd' name='cpus' filepath='kernel/cpu.c' line='1186' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_aer_clear_nonfatal_status' mangled-name='pci_aer_clear_nonfatal_status' filepath='include/linux/aer.h' line='47' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_aer_clear_nonfatal_status'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_aer_clear_nonfatal_status' mangled-name='pci_aer_clear_nonfatal_status' filepath='drivers/pci/pcie/aer.c' line='249' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_aer_clear_nonfatal_status'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pcie/aer.c' line='249' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_alloc_irq_vectors_affinity' mangled-name='pci_alloc_irq_vectors_affinity' filepath='include/linux/pci.h' line='1500' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_alloc_irq_vectors_affinity'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='8a876638'/>
+      <function-decl name='pci_alloc_irq_vectors_affinity' mangled-name='pci_alloc_irq_vectors_affinity' filepath='drivers/pci/msi.c' line='1218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_alloc_irq_vectors_affinity'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1218' column='1'/>
+        <parameter type-id='f0981eeb' name='min_vecs' filepath='drivers/pci/msi.c' line='1218' column='1'/>
+        <parameter type-id='f0981eeb' name='max_vecs' filepath='drivers/pci/msi.c' line='1219' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='drivers/pci/msi.c' line='1219' column='1'/>
+        <parameter type-id='8a876638' name='affd' filepath='drivers/pci/msi.c' line='1220' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_assign_resource' mangled-name='pci_assign_resource' filepath='include/linux/pci.h' line='1250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_assign_resource'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pci_assign_resource' mangled-name='pci_assign_resource' filepath='drivers/pci/setup-res.c' line='310' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_assign_resource'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/setup-res.c' line='310' column='1'/>
+        <parameter type-id='95e97e5e' name='resno' filepath='drivers/pci/setup-res.c' line='310' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_assign_unassigned_bus_resources' mangled-name='pci_assign_unassigned_bus_resources' filepath='include/linux/pci.h' line='1326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_assign_unassigned_bus_resources'>
-        <parameter type-id='d1feb554'/>
+      <function-decl name='pci_assign_unassigned_bus_resources' mangled-name='pci_assign_unassigned_bus_resources' filepath='drivers/pci/setup-bus.c' line='2228' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_assign_unassigned_bus_resources'>
+        <parameter type-id='d1feb554' name='bus' filepath='drivers/pci/setup-bus.c' line='2228' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_bus_resource_n' mangled-name='pci_bus_resource_n' filepath='drivers/pci/bus.c' line='63' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_bus_resource_n'>
@@ -128679,8 +128502,8 @@
         <parameter type-id='92fc8aa5' name='ids' filepath='drivers/pci/search.c' line='380' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_dev_put' mangled-name='pci_dev_put' filepath='include/linux/pci.h' line='1076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_dev_put'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_dev_put' mangled-name='pci_dev_put' filepath='drivers/pci/pci-driver.c' line='1491' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_dev_put'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci-driver.c' line='1491' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_device_group' mangled-name='pci_device_group' filepath='drivers/iommu/iommu.c' line='1389' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_device_group'>
@@ -128695,16 +128518,16 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='2149' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_disable_msi' mangled-name='pci_disable_msi' filepath='include/linux/pci.h' line='1484' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msi'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_disable_msi' mangled-name='pci_disable_msi' filepath='drivers/pci/msi.c' line='971' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msi'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='971' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_disable_msix' mangled-name='pci_disable_msix' filepath='include/linux/pci.h' line='1486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msix'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_disable_msix' mangled-name='pci_disable_msix' filepath='drivers/pci/msi.c' line='1058' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msix'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1058' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_disable_pcie_error_reporting' mangled-name='pci_disable_pcie_error_reporting' filepath='include/linux/aer.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_pcie_error_reporting'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_disable_pcie_error_reporting' mangled-name='pci_disable_pcie_error_reporting' filepath='drivers/pci/pcie/aer.c' line='237' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_pcie_error_reporting'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pcie/aer.c' line='237' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_disable_sriov' mangled-name='pci_disable_sriov' filepath='drivers/pci/iov.c' line='943' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_sriov'>
@@ -128789,19 +128612,19 @@
         <parameter type-id='2522883d' name='phys_addr' filepath='drivers/pci/endpoint/pci-epc-core.c' line='360' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_find_bus' mangled-name='pci_find_bus' filepath='include/linux/pci.h' line='1039' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_find_bus'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pci_find_bus' mangled-name='pci_find_bus' filepath='drivers/pci/search.c' line='141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_find_bus'>
+        <parameter type-id='95e97e5e' name='domain' filepath='drivers/pci/search.c' line='141' column='1'/>
+        <parameter type-id='95e97e5e' name='busnr' filepath='drivers/pci/search.c' line='141' column='1'/>
         <return type-id='d1feb554'/>
       </function-decl>
-      <function-decl name='pci_find_capability' mangled-name='pci_find_capability' filepath='include/linux/pci.h' line='1090' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_find_capability'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pci_find_capability' mangled-name='pci_find_capability' filepath='drivers/pci/pci.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_find_capability'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='487' column='1'/>
+        <parameter type-id='95e97e5e' name='cap' filepath='drivers/pci/pci.c' line='487' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_find_ext_capability' mangled-name='pci_find_ext_capability' filepath='include/linux/pci.h' line='1092' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_find_ext_capability'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pci_find_ext_capability' mangled-name='pci_find_ext_capability' filepath='drivers/pci/pci.c' line='593' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_find_ext_capability'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='593' column='1'/>
+        <parameter type-id='95e97e5e' name='cap' filepath='drivers/pci/pci.c' line='593' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_find_next_capability' mangled-name='pci_find_next_capability' filepath='drivers/pci/pci.c' line='441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_find_next_capability'>
@@ -128816,8 +128639,8 @@
         <parameter type-id='eaa32e2f' name='dev_id' filepath='drivers/pci/irq.c' line='70' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_free_irq_vectors' mangled-name='pci_free_irq_vectors' filepath='include/linux/pci.h' line='1504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_free_irq_vectors'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_free_irq_vectors' mangled-name='pci_free_irq_vectors' filepath='drivers/pci/msi.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_free_irq_vectors'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1271' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_generic_config_read' mangled-name='pci_generic_config_read' filepath='drivers/pci/access.c' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_generic_config_read'>
@@ -128848,9 +128671,9 @@
         <parameter type-id='f0981eeb' name='devfn' filepath='drivers/pci/search.c' line='231' column='1'/>
         <return type-id='85196e3f'/>
       </function-decl>
-      <function-decl name='pci_get_slot' mangled-name='pci_get_slot' filepath='include/linux/pci.h' line='1105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_get_slot'>
-        <parameter type-id='d1feb554'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='pci_get_slot' mangled-name='pci_get_slot' filepath='drivers/pci/search.c' line='195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_get_slot'>
+        <parameter type-id='d1feb554' name='bus' filepath='drivers/pci/search.c' line='195' column='1'/>
+        <parameter type-id='f0981eeb' name='devfn' filepath='drivers/pci/search.c' line='195' column='1'/>
         <return type-id='85196e3f'/>
       </function-decl>
       <function-decl name='pci_host_probe' mangled-name='pci_host_probe' filepath='drivers/pci/probe.c' line='3005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_host_probe'>
@@ -128880,14 +128703,14 @@
         <parameter type-id='95e97e5e' name='bar' filepath='drivers/pci/pci.c' line='216' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='pci_irq_get_affinity' mangled-name='pci_irq_get_affinity' filepath='include/linux/pci.h' line='1506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_get_affinity'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pci_irq_get_affinity' mangled-name='pci_irq_get_affinity' filepath='drivers/pci/msi.c' line='1317' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_get_affinity'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1317' column='1'/>
+        <parameter type-id='95e97e5e' name='nr' filepath='drivers/pci/msi.c' line='1317' column='1'/>
         <return type-id='5f8a1ac4'/>
       </function-decl>
-      <function-decl name='pci_irq_vector' mangled-name='pci_irq_vector' filepath='include/linux/pci.h' line='1505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_vector'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='pci_irq_vector' mangled-name='pci_irq_vector' filepath='drivers/pci/msi.c' line='1283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_vector'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1283' column='1'/>
+        <parameter type-id='f0981eeb' name='nr' filepath='drivers/pci/msi.c' line='1283' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_load_and_free_saved_state' mangled-name='pci_load_and_free_saved_state' filepath='drivers/pci/pci.c' line='1792' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_load_and_free_saved_state'>
@@ -128900,9 +128723,9 @@
         <parameter type-id='e4acc659' name='state' filepath='drivers/pci/pci.c' line='1756' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_map_rom' mangled-name='pci_map_rom' filepath='include/linux/pci.h' line='1268' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_map_rom'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='1d2c2b85'/>
+      <function-decl name='pci_map_rom' mangled-name='pci_map_rom' filepath='drivers/pci/rom.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_map_rom'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/rom.c' line='136' column='1'/>
+        <parameter type-id='78c01427' name='size' filepath='drivers/pci/rom.c' line='136' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='pci_match_id' mangled-name='pci_match_id' filepath='drivers/pci/pci-driver.c' line='223' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_match_id'>
@@ -128910,10 +128733,10 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci-driver.c' line='224' column='1'/>
         <return type-id='92fc8aa5'/>
       </function-decl>
-      <function-decl name='pci_msi_create_irq_domain' mangled-name='pci_msi_create_irq_domain' filepath='include/linux/msi.h' line='423' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_create_irq_domain'>
-        <parameter type-id='4a935625'/>
-        <parameter type-id='a9bcccf8'/>
-        <parameter type-id='7544e824'/>
+      <function-decl name='pci_msi_create_irq_domain' mangled-name='pci_msi_create_irq_domain' filepath='drivers/pci/msi.c' line='1486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_create_irq_domain'>
+        <parameter type-id='4a935625' name='fwnode' filepath='drivers/pci/msi.c' line='1486' column='1'/>
+        <parameter type-id='a9bcccf8' name='info' filepath='drivers/pci/msi.c' line='1487' column='1'/>
+        <parameter type-id='7544e824' name='parent' filepath='drivers/pci/msi.c' line='1488' column='1'/>
         <return type-id='7544e824'/>
       </function-decl>
       <function-decl name='pci_msi_enabled' mangled-name='pci_msi_enabled' filepath='drivers/pci/msi.c' line='1079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_enabled'>
@@ -128927,12 +128750,12 @@
         <parameter type-id='1c475548' name='data' filepath='drivers/pci/msi.c' line='263' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_msix_vec_count' mangled-name='pci_msix_vec_count' filepath='include/linux/pci.h' line='1485' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msix_vec_count'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_msix_vec_count' mangled-name='pci_msix_vec_count' filepath='drivers/pci/msi.c' line='989' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msix_vec_count'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='989' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_num_vf' mangled-name='pci_num_vf' filepath='include/linux/pci.h' line='2096' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_num_vf'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_num_vf' mangled-name='pci_num_vf' filepath='drivers/pci/iov.c' line='960' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_num_vf'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/iov.c' line='960' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_read_config_byte' mangled-name='pci_read_config_byte' filepath='drivers/pci/access.c' line='523' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_read_config_byte'>
@@ -128953,9 +128776,9 @@
         <parameter type-id='26d4d46f' name='val' filepath='drivers/pci/access.c' line='533' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_release_region' mangled-name='pci_release_region' filepath='include/linux/pci.h' line='1338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_region'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pci_release_region' mangled-name='pci_release_region' filepath='drivers/pci/pci.c' line='3799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_region'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3799' column='1'/>
+        <parameter type-id='95e97e5e' name='bar' filepath='drivers/pci/pci.c' line='3799' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_release_regions' mangled-name='pci_release_regions' filepath='drivers/pci/pci.c' line='3957' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_regions'>
@@ -128967,9 +128790,9 @@
         <parameter type-id='95e97e5e' name='resno' filepath='drivers/pci/setup-res.c' line='394' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_release_selected_regions' mangled-name='pci_release_selected_regions' filepath='include/linux/pci.h' line='1341' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_selected_regions'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pci_release_selected_regions' mangled-name='pci_release_selected_regions' filepath='drivers/pci/pci.c' line='3896' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_selected_regions'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3896' column='1'/>
+        <parameter type-id='95e97e5e' name='bars' filepath='drivers/pci/pci.c' line='3896' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_request_irq' mangled-name='pci_request_irq' filepath='drivers/pci/irq.c' line='33' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_irq'>
@@ -129013,8 +128836,8 @@
         <parameter type-id='95e97e5e' name='size' filepath='drivers/pci/setup-res.c' line='410' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_restore_msi_state' mangled-name='pci_restore_msi_state' filepath='include/linux/pci.h' line='1487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_restore_msi_state'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pci_restore_msi_state' mangled-name='pci_restore_msi_state' filepath='drivers/pci/msi.c' line='475' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_restore_msi_state'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='475' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_restore_state' mangled-name='pci_restore_state' filepath='drivers/pci/pci.c' line='1669' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_restore_state'>
@@ -129051,9 +128874,9 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4417' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_unmap_rom' mangled-name='pci_unmap_rom' filepath='include/linux/pci.h' line='1269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_unmap_rom'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='pci_unmap_rom' mangled-name='pci_unmap_rom' filepath='drivers/pci/rom.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_unmap_rom'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/rom.c' line='187' column='1'/>
+        <parameter type-id='eaa32e2f' name='rom' filepath='drivers/pci/rom.c' line='187' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_unregister_driver' mangled-name='pci_unregister_driver' filepath='drivers/pci/pci-driver.c' line='1406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_unregister_driver'>
@@ -129069,10 +128892,10 @@
         <parameter type-id='b50a4934' name='enable' filepath='drivers/pci/pci.c' line='2536' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_walk_bus' mangled-name='pci_walk_bus' filepath='include/linux/pci.h' line='1439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_walk_bus'>
-        <parameter type-id='d1feb554'/>
-        <parameter type-id='82fb5c77'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='pci_walk_bus' mangled-name='pci_walk_bus' filepath='drivers/pci/bus.c' line='374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_walk_bus'>
+        <parameter type-id='d1feb554' name='top' filepath='drivers/pci/bus.c' line='374' column='1'/>
+        <parameter type-id='82fb5c77' name='cb' filepath='drivers/pci/bus.c' line='374' column='1'/>
+        <parameter type-id='eaa32e2f' name='userdata' filepath='drivers/pci/bus.c' line='375' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_write_config_byte' mangled-name='pci_write_config_byte' filepath='drivers/pci/access.c' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_write_config_byte'>
@@ -129093,10 +128916,10 @@
         <parameter type-id='1dc6a898' name='val' filepath='drivers/pci/access.c' line='562' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pcibios_resource_to_bus' mangled-name='pcibios_resource_to_bus' filepath='include/linux/pci.h' line='1034' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcibios_resource_to_bus'>
-        <parameter type-id='d1feb554'/>
-        <parameter type-id='e045254b'/>
-        <parameter type-id='c9d64c0d'/>
+      <function-decl name='pcibios_resource_to_bus' mangled-name='pcibios_resource_to_bus' filepath='drivers/pci/host-bridge.c' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcibios_resource_to_bus'>
+        <parameter type-id='d1feb554' name='bus' filepath='drivers/pci/host-bridge.c' line='50' column='1'/>
+        <parameter type-id='e045254b' name='region' filepath='drivers/pci/host-bridge.c' line='50' column='1'/>
+        <parameter type-id='c9d64c0d' name='res' filepath='drivers/pci/host-bridge.c' line='51' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pcie_aspm_enabled' mangled-name='pcie_aspm_enabled' filepath='drivers/pci/pcie/aspm.c' line='1193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_aspm_enabled'>
@@ -129129,17 +128952,17 @@
         <parameter type-id='1dc6a898' name='val' filepath='drivers/pci/access.c' line='465' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pcie_get_mps' mangled-name='pcie_get_mps' filepath='include/linux/pci.h' line='1232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_get_mps'>
-        <parameter type-id='85196e3f'/>
+      <function-decl name='pcie_get_mps' mangled-name='pcie_get_mps' filepath='drivers/pci/pci.c' line='5771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_get_mps'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5771' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pcie_get_speed_cap' mangled-name='pcie_get_speed_cap' filepath='drivers/pci/pci.c' line='5874' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_get_speed_cap'>
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5874' column='1'/>
         <return type-id='f290f4ed'/>
       </function-decl>
-      <function-decl name='pcie_set_mps' mangled-name='pcie_set_mps' filepath='include/linux/pci.h' line='1233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_set_mps'>
-        <parameter type-id='85196e3f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pcie_set_mps' mangled-name='pcie_set_mps' filepath='drivers/pci/pci.c' line='5789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_set_mps'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5789' column='1'/>
+        <parameter type-id='95e97e5e' name='mps' filepath='drivers/pci/pci.c' line='5789' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pcim_enable_device' mangled-name='pcim_enable_device' filepath='drivers/pci/pci.c' line='2029' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcim_enable_device'>
@@ -129153,40 +128976,40 @@
         <parameter type-id='eaa32e2f' name='addr' filepath='mm/percpu.c' line='2191' column='1'/>
         <return type-id='2522883d'/>
       </function-decl>
-      <function-decl name='percpu_down_write' mangled-name='percpu_down_write' filepath='include/linux/percpu-rwsem.h' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_down_write'>
-        <parameter type-id='652d9ef9'/>
+      <function-decl name='percpu_down_write' mangled-name='percpu_down_write' filepath='kernel/locking/percpu-rwsem.c' line='214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_down_write'>
+        <parameter type-id='652d9ef9' name='sem' filepath='kernel/locking/percpu-rwsem.c' line='214' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='percpu_ref_exit' mangled-name='percpu_ref_exit' filepath='include/linux/percpu-refcount.h' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_exit'>
-        <parameter type-id='60219102'/>
+      <function-decl name='percpu_ref_exit' mangled-name='percpu_ref_exit' filepath='lib/percpu-refcount.c' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_exit'>
+        <parameter type-id='60219102' name='ref' filepath='lib/percpu-refcount.c' line='128' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='percpu_ref_init' mangled-name='percpu_ref_init' filepath='include/linux/percpu-refcount.h' line='121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_init'>
-        <parameter type-id='60219102'/>
-        <parameter type-id='08873c53'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='percpu_ref_init' mangled-name='percpu_ref_init' filepath='lib/percpu-refcount.c' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_init'>
+        <parameter type-id='60219102' name='ref' filepath='lib/percpu-refcount.c' line='62' column='1'/>
+        <parameter type-id='903b12fe' name='release' filepath='lib/percpu-refcount.c' line='62' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='lib/percpu-refcount.c' line='63' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='lib/percpu-refcount.c' line='63' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='percpu_ref_is_zero' mangled-name='percpu_ref_is_zero' filepath='include/linux/percpu-refcount.h' line='133' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_is_zero'>
-        <parameter type-id='60219102'/>
-        <return type-id='c894953d'/>
+      <function-decl name='percpu_ref_is_zero' mangled-name='percpu_ref_is_zero' filepath='lib/percpu-refcount.c' line='402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_is_zero'>
+        <parameter type-id='60219102' name='ref' filepath='lib/percpu-refcount.c' line='402' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='percpu_ref_kill_and_confirm' mangled-name='percpu_ref_kill_and_confirm' filepath='include/linux/percpu-refcount.h' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_kill_and_confirm'>
-        <parameter type-id='60219102'/>
-        <parameter type-id='08873c53'/>
+      <function-decl name='percpu_ref_kill_and_confirm' mangled-name='percpu_ref_kill_and_confirm' filepath='lib/percpu-refcount.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_kill_and_confirm'>
+        <parameter type-id='60219102' name='ref' filepath='lib/percpu-refcount.c' line='375' column='1'/>
+        <parameter type-id='903b12fe' name='confirm_kill' filepath='lib/percpu-refcount.c' line='376' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='percpu_ref_switch_to_atomic_sync' mangled-name='percpu_ref_switch_to_atomic_sync' filepath='include/linux/percpu-refcount.h' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_switch_to_atomic_sync'>
-        <parameter type-id='60219102'/>
+      <function-decl name='percpu_ref_switch_to_atomic_sync' mangled-name='percpu_ref_switch_to_atomic_sync' filepath='lib/percpu-refcount.c' line='320' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_switch_to_atomic_sync'>
+        <parameter type-id='60219102' name='ref' filepath='lib/percpu-refcount.c' line='320' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='percpu_ref_switch_to_percpu' mangled-name='percpu_ref_switch_to_percpu' filepath='include/linux/percpu-refcount.h' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_switch_to_percpu'>
-        <parameter type-id='60219102'/>
+      <function-decl name='percpu_ref_switch_to_percpu' mangled-name='percpu_ref_switch_to_percpu' filepath='lib/percpu-refcount.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_ref_switch_to_percpu'>
+        <parameter type-id='60219102' name='ref' filepath='lib/percpu-refcount.c' line='345' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='percpu_up_write' mangled-name='percpu_up_write' filepath='include/linux/percpu-rwsem.h' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_up_write'>
-        <parameter type-id='652d9ef9'/>
+      <function-decl name='percpu_up_write' mangled-name='percpu_up_write' filepath='kernel/locking/percpu-rwsem.c' line='242' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='percpu_up_write'>
+        <parameter type-id='652d9ef9' name='sem' filepath='kernel/locking/percpu-rwsem.c' line='242' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_aux_output_begin' mangled-name='perf_aux_output_begin' filepath='kernel/events/ring_buffer.c' line='361' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_aux_output_begin'>
@@ -129208,20 +129031,20 @@
         <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3143' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='include/linux/perf_event.h' line='982' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
-        <parameter type-id='20862e61'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='a8564695'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='perf_event_create_kernel_counter' mangled-name='perf_event_create_kernel_counter' filepath='kernel/events/core.c' line='12130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_create_kernel_counter'>
+        <parameter type-id='20862e61' name='attr' filepath='kernel/events/core.c' line='12130' column='1'/>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/events/core.c' line='12130' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='12131' column='1'/>
+        <parameter type-id='20a2e4e6' name='overflow_handler' filepath='kernel/events/core.c' line='12132' column='1'/>
+        <parameter type-id='eaa32e2f' name='context' filepath='kernel/events/core.c' line='12133' column='1'/>
         <return type-id='2bf16f59'/>
       </function-decl>
-      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='include/linux/perf_event.h' line='1423' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
-        <parameter type-id='2bf16f59'/>
+      <function-decl name='perf_event_disable' mangled-name='perf_event_disable' filepath='kernel/events/core.c' line='2472' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_disable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='2472' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='include/linux/perf_event.h' line='1422' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
-        <parameter type-id='2bf16f59'/>
+      <function-decl name='perf_event_enable' mangled-name='perf_event_enable' filepath='kernel/events/core.c' line='3043' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_enable'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='3043' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='perf_event_pause' mangled-name='perf_event_pause' filepath='kernel/events/core.c' line='5358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_pause'>
@@ -129229,21 +129052,21 @@
         <parameter type-id='b50a4934' name='reset' filepath='kernel/events/core.c' line='5358' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='include/linux/perf_event.h' line='989' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
-        <parameter type-id='2bf16f59'/>
-        <parameter type-id='c0190993'/>
-        <parameter type-id='c0190993'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='perf_event_read_local' mangled-name='perf_event_read_local' filepath='kernel/events/core.c' line='4331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_local'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4331' column='1'/>
+        <parameter type-id='3df9fd28' name='value' filepath='kernel/events/core.c' line='4331' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='4332' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='4332' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='include/linux/perf_event.h' line='991' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
-        <parameter type-id='2bf16f59'/>
-        <parameter type-id='c0190993'/>
-        <parameter type-id='c0190993'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='perf_event_read_value' mangled-name='perf_event_read_value' filepath='kernel/events/core.c' line='5140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_read_value'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='5140' column='1'/>
+        <parameter type-id='3df9fd28' name='enabled' filepath='kernel/events/core.c' line='5140' column='1'/>
+        <parameter type-id='3df9fd28' name='running' filepath='kernel/events/core.c' line='5140' column='1'/>
+        <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='include/linux/perf_event.h' line='980' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
-        <parameter type-id='2bf16f59'/>
+      <function-decl name='perf_event_release_kernel' mangled-name='perf_event_release_kernel' filepath='kernel/events/core.c' line='4990' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_release_kernel'>
+        <parameter type-id='2bf16f59' name='event' filepath='kernel/events/core.c' line='4990' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='perf_event_update_userpage' mangled-name='perf_event_update_userpage' filepath='kernel/events/core.c' line='5737' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_event_update_userpage'>
@@ -129254,7 +129077,7 @@
         <parameter type-id='d3b23a45' name='handle' filepath='kernel/events/ring_buffer.c' line='557' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='perf_num_counters' mangled-name='perf_num_counters' filepath='include/linux/perf_event.h' line='955' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_num_counters'>
+      <function-decl name='perf_num_counters' mangled-name='perf_num_counters' filepath='drivers/perf/arm_pmu.c' line='600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_num_counters'>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='perf_pmu_migrate_context' mangled-name='perf_pmu_migrate_context' filepath='kernel/events/core.c' line='12209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_pmu_migrate_context'>
@@ -129273,21 +129096,21 @@
         <parameter type-id='0906f5b9' name='pmu' filepath='kernel/events/core.c' line='10917' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='perf_trace_buf_alloc' mangled-name='perf_trace_buf_alloc' filepath='include/linux/trace_events.h' line='750' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_buf_alloc'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='a89ff5a9'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='perf_trace_buf_alloc' mangled-name='perf_trace_buf_alloc' filepath='kernel/trace/trace_event_perf.c' line='395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_buf_alloc'>
+        <parameter type-id='95e97e5e' name='size' filepath='kernel/trace/trace_event_perf.c' line='395' column='1'/>
+        <parameter type-id='a89ff5a9' name='regs' filepath='kernel/trace/trace_event_perf.c' line='395' column='1'/>
+        <parameter type-id='7292109c' name='rctxp' filepath='kernel/trace/trace_event_perf.c' line='395' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='include/linux/trace_events.h' line='779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='23d6768c'/>
-        <parameter type-id='3a47d82b'/>
-        <parameter type-id='4616a179'/>
-        <parameter type-id='030d0b18'/>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='perf_trace_run_bpf_submit' mangled-name='perf_trace_run_bpf_submit' filepath='kernel/events/core.c' line='9416' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='perf_trace_run_bpf_submit'>
+        <parameter type-id='eaa32e2f' name='raw_data' filepath='kernel/events/core.c' line='9416' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='kernel/events/core.c' line='9416' column='1'/>
+        <parameter type-id='95e97e5e' name='rctx' filepath='kernel/events/core.c' line='9416' column='1'/>
+        <parameter type-id='23d6768c' name='call' filepath='kernel/events/core.c' line='9417' column='1'/>
+        <parameter type-id='91ce1af9' name='count' filepath='kernel/events/core.c' line='9417' column='1'/>
+        <parameter type-id='4616a179' name='regs' filepath='kernel/events/core.c' line='9418' column='1'/>
+        <parameter type-id='030d0b18' name='head' filepath='kernel/events/core.c' line='9418' column='1'/>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/events/core.c' line='9419' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pfn_valid' mangled-name='pfn_valid' filepath='arch/arm64/mm/init.c' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pfn_valid'>
@@ -129314,8 +129137,8 @@
         <parameter type-id='d61bf978' name='interface' filepath='drivers/net/phy/phy_device.c' line='1015' column='1'/>
         <return type-id='7efbcaaf'/>
       </function-decl>
-      <function-decl name='phy_disconnect' mangled-name='phy_disconnect' filepath='include/linux/phy.h' line='1400' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_disconnect'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='phy_disconnect' mangled-name='phy_disconnect' filepath='drivers/net/phy/phy_device.c' line='1045' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_disconnect'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='1045' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='phy_do_ioctl_running' mangled-name='phy_do_ioctl_running' filepath='drivers/net/phy/phy.c' line='471' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_do_ioctl_running'>
@@ -129335,9 +129158,9 @@
         <parameter type-id='95e97e5e' name='n' filepath='drivers/net/phy/phy_device.c' line='3001' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phy_ethtool_get_eee' mangled-name='phy_ethtool_get_eee' filepath='include/linux/phy.h' line='1602' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_get_eee'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='eced47f6'/>
+      <function-decl name='phy_ethtool_get_eee' mangled-name='phy_ethtool_get_eee' filepath='drivers/net/phy/phy.c' line='1338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_get_eee'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1338' column='1'/>
+        <parameter type-id='eced47f6' name='data' filepath='drivers/net/phy/phy.c' line='1338' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_ethtool_get_link_ksettings' mangled-name='phy_ethtool_get_link_ksettings' filepath='drivers/net/phy/phy.c' line='1447' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_get_link_ksettings'>
@@ -129345,23 +129168,23 @@
         <parameter type-id='70de91e2' name='cmd' filepath='drivers/net/phy/phy.c' line='1448' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phy_ethtool_ksettings_get' mangled-name='phy_ethtool_ksettings_get' filepath='include/linux/phy.h' line='1559' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_ksettings_get'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='70de91e2'/>
+      <function-decl name='phy_ethtool_ksettings_get' mangled-name='phy_ethtool_ksettings_get' filepath='drivers/net/phy/phy.c' line='316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_ksettings_get'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='316' column='1'/>
+        <parameter type-id='70de91e2' name='cmd' filepath='drivers/net/phy/phy.c' line='317' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phy_ethtool_ksettings_set' mangled-name='phy_ethtool_ksettings_set' filepath='include/linux/phy.h' line='1561' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_ksettings_set'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='b2c34f11'/>
+      <function-decl name='phy_ethtool_ksettings_set' mangled-name='phy_ethtool_ksettings_set' filepath='drivers/net/phy/phy.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_ksettings_set'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='263' column='1'/>
+        <parameter type-id='b2c34f11' name='cmd' filepath='drivers/net/phy/phy.c' line='264' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_ethtool_nway_reset' mangled-name='phy_ethtool_nway_reset' filepath='drivers/net/phy/phy.c' line='1477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_nway_reset'>
         <parameter type-id='68a2d05b' name='ndev' filepath='drivers/net/phy/phy.c' line='1477' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phy_ethtool_set_eee' mangled-name='phy_ethtool_set_eee' filepath='include/linux/phy.h' line='1601' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_set_eee'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='eced47f6'/>
+      <function-decl name='phy_ethtool_set_eee' mangled-name='phy_ethtool_set_eee' filepath='drivers/net/phy/phy.c' line='1377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_set_eee'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1377' column='1'/>
+        <parameter type-id='eced47f6' name='data' filepath='drivers/net/phy/phy.c' line='1377' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_ethtool_set_link_ksettings' mangled-name='phy_ethtool_set_link_ksettings' filepath='drivers/net/phy/phy.c' line='1461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_ethtool_set_link_ksettings'>
@@ -129378,31 +129201,31 @@
         <parameter type-id='80f4b756' name='string' filepath='drivers/phy/phy-core.c' line='664' column='1'/>
         <return type-id='503ff1ba'/>
       </function-decl>
-      <function-decl name='phy_get_eee_err' mangled-name='phy_get_eee_err' filepath='include/linux/phy.h' line='1600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_get_eee_err'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='phy_get_eee_err' mangled-name='phy_get_eee_err' filepath='drivers/net/phy/phy.c' line='1321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_get_eee_err'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1321' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_init' mangled-name='phy_init' filepath='drivers/phy/phy-core.c' line='232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_init'>
         <parameter type-id='503ff1ba' name='phy' filepath='drivers/phy/phy-core.c' line='232' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phy_init_eee' mangled-name='phy_init_eee' filepath='include/linux/phy.h' line='1599' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_init_eee'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='phy_init_eee' mangled-name='phy_init_eee' filepath='drivers/net/phy/phy.c' line='1253' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_init_eee'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1253' column='1'/>
+        <parameter type-id='b50a4934' name='clk_stop_enable' filepath='drivers/net/phy/phy.c' line='1253' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phy_init_hw' mangled-name='phy_init_hw' filepath='include/linux/phy.h' line='1380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_init_hw'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='phy_init_hw' mangled-name='phy_init_hw' filepath='drivers/net/phy/phy_device.c' line='1093' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_init_hw'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='1093' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_mac_interrupt' mangled-name='phy_mac_interrupt' filepath='drivers/net/phy/phy.c' line='1212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_mac_interrupt'>
         <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1212' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phy_mii_ioctl' mangled-name='phy_mii_ioctl' filepath='include/linux/phy.h' line='1563' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_mii_ioctl'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='d494b97c'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='phy_mii_ioctl' mangled-name='phy_mii_ioctl' filepath='drivers/net/phy/phy.c' line='350' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_mii_ioctl'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='350' column='1'/>
+        <parameter type-id='d494b97c' name='ifr' filepath='drivers/net/phy/phy.c' line='350' column='1'/>
+        <parameter type-id='95e97e5e' name='cmd' filepath='drivers/net/phy/phy.c' line='350' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_mipi_dphy_get_default_config' mangled-name='phy_mipi_dphy_get_default_config' filepath='drivers/phy/phy-core-mipi-dphy.c' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_mipi_dphy_get_default_config'>
@@ -129412,11 +129235,11 @@
         <parameter type-id='37cfc122' name='cfg' filepath='drivers/phy/phy-core-mipi-dphy.c' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phy_modify' mangled-name='phy_modify' filepath='include/linux/phy.h' line='1088' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_modify'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='8efea9e5'/>
+      <function-decl name='phy_modify' mangled-name='phy_modify' filepath='drivers/net/phy/phy-core.c' line='630' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_modify'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy-core.c' line='630' column='1'/>
+        <parameter type-id='19c2251e' name='regnum' filepath='drivers/net/phy/phy-core.c' line='630' column='1'/>
+        <parameter type-id='1dc6a898' name='mask' filepath='drivers/net/phy/phy-core.c' line='630' column='1'/>
+        <parameter type-id='1dc6a898' name='set' filepath='drivers/net/phy/phy-core.c' line='630' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_modify_changed' mangled-name='phy_modify_changed' filepath='drivers/net/phy/phy-core.c' line='586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_modify_changed'>
@@ -129467,10 +129290,10 @@
         <parameter type-id='503ff1ba' name='phy' filepath='drivers/phy/phy-core.c' line='596' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phy_read_mmd' mangled-name='phy_read_mmd' filepath='include/linux/phy.h' line='1032' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_read_mmd'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='phy_read_mmd' mangled-name='phy_read_mmd' filepath='drivers/net/phy/phy-core.c' line='502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_read_mmd'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy-core.c' line='502' column='1'/>
+        <parameter type-id='95e97e5e' name='devad' filepath='drivers/net/phy/phy-core.c' line='502' column='1'/>
+        <parameter type-id='19c2251e' name='regnum' filepath='drivers/net/phy/phy-core.c' line='502' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_read_paged' mangled-name='phy_read_paged' filepath='drivers/net/phy/phy-core.c' line='856' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_read_paged'>
@@ -129529,24 +129352,24 @@
         <parameter type-id='b50a4934' name='autoneg' filepath='drivers/net/phy/phy_device.c' line='2619' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phy_start' mangled-name='phy_start' filepath='include/linux/phy.h' line='1402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_start'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='phy_start' mangled-name='phy_start' filepath='drivers/net/phy/phy.c' line='1092' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_start'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1092' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='phy_start_aneg' mangled-name='phy_start_aneg' filepath='drivers/net/phy/phy.c' line='778' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_start_aneg'>
         <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='778' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phy_stop' mangled-name='phy_stop' filepath='include/linux/phy.h' line='1403' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_stop'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='phy_stop' mangled-name='phy_stop' filepath='drivers/net/phy/phy.c' line='1048' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_stop'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1048' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='phy_support_sym_pause' mangled-name='phy_support_sym_pause' filepath='drivers/net/phy/phy_device.c' line='2588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_support_sym_pause'>
         <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='2588' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='phy_suspend' mangled-name='phy_suspend' filepath='include/linux/phy.h' line='1381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_suspend'>
-        <parameter type-id='7efbcaaf'/>
+      <function-decl name='phy_suspend' mangled-name='phy_suspend' filepath='drivers/net/phy/phy_device.c' line='1702' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_suspend'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='1702' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_validate' mangled-name='phy_validate' filepath='drivers/phy/phy-core.c' line='467' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_validate'>
@@ -129556,11 +129379,11 @@
         <parameter type-id='9d3cfa5c' name='opts' filepath='drivers/phy/phy-core.c' line='468' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='phy_write_mmd' mangled-name='phy_write_mmd' filepath='include/linux/phy.h' line='1075' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_write_mmd'>
-        <parameter type-id='7efbcaaf'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='8efea9e5'/>
+      <function-decl name='phy_write_mmd' mangled-name='phy_write_mmd' filepath='drivers/net/phy/phy-core.c' line='561' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_write_mmd'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy-core.c' line='561' column='1'/>
+        <parameter type-id='95e97e5e' name='devad' filepath='drivers/net/phy/phy-core.c' line='561' column='1'/>
+        <parameter type-id='19c2251e' name='regnum' filepath='drivers/net/phy/phy-core.c' line='561' column='1'/>
+        <parameter type-id='1dc6a898' name='val' filepath='drivers/net/phy/phy-core.c' line='561' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='phy_write_paged' mangled-name='phy_write_paged' filepath='drivers/net/phy/phy-core.c' line='877' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_write_paged'>
@@ -129605,14 +129428,14 @@
         <parameter type-id='95e97e5e' name='cpu' filepath='kernel/sched/rt.c' line='1758' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
-      <function-decl name='pid_nr_ns' mangled-name='pid_nr_ns' filepath='include/linux/pid.h' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pid_nr_ns'>
-        <parameter type-id='b94e5398'/>
-        <parameter type-id='b816e1d0'/>
-        <return type-id='95e97e5e'/>
+      <function-decl name='pid_nr_ns' mangled-name='pid_nr_ns' filepath='kernel/pid.c' line='473' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pid_nr_ns'>
+        <parameter type-id='b94e5398' name='pid' filepath='kernel/pid.c' line='473' column='1'/>
+        <parameter type-id='b816e1d0' name='ns' filepath='kernel/pid.c' line='473' column='1'/>
+        <return type-id='587f89d2'/>
       </function-decl>
-      <function-decl name='pid_task' mangled-name='pid_task' filepath='include/linux/pid.h' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pid_task'>
-        <parameter type-id='b94e5398'/>
-        <parameter type-id='ce78cf46'/>
+      <function-decl name='pid_task' mangled-name='pid_task' filepath='kernel/pid.c' line='396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pid_task'>
+        <parameter type-id='b94e5398' name='pid' filepath='kernel/pid.c' line='396' column='1'/>
+        <parameter type-id='ce78cf46' name='type' filepath='kernel/pid.c' line='396' column='1'/>
         <return type-id='f23e2572'/>
       </function-decl>
       <function-decl name='pin_get_name' mangled-name='pin_get_name' filepath='drivers/pinctrl/core.c' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pin_get_name'>
@@ -129839,8 +129662,8 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='platform_bus_type' type-id='b31bfc8a' mangled-name='platform_bus_type' visibility='default' filepath='drivers/base/platform.c' line='1360' column='1' elf-symbol-id='platform_bus_type'/>
-      <function-decl name='platform_device_add' mangled-name='platform_device_add' filepath='include/linux/platform_device.h' line='202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_add'>
-        <parameter type-id='db362995'/>
+      <function-decl name='platform_device_add' mangled-name='platform_device_add' filepath='drivers/base/platform.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_add'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='550' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='platform_device_add_data' mangled-name='platform_device_add_data' filepath='drivers/base/platform.c' line='510' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_add_data'>
@@ -129860,29 +129683,29 @@
         <parameter type-id='f0981eeb' name='num' filepath='drivers/base/platform.c' line='483' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='platform_device_alloc' mangled-name='platform_device_alloc' filepath='include/linux/platform_device.h' line='194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_alloc'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='platform_device_alloc' mangled-name='platform_device_alloc' filepath='drivers/base/platform.c' line='454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_alloc'>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/base/platform.c' line='454' column='1'/>
+        <parameter type-id='95e97e5e' name='id' filepath='drivers/base/platform.c' line='454' column='1'/>
         <return type-id='db362995'/>
       </function-decl>
-      <function-decl name='platform_device_del' mangled-name='platform_device_del' filepath='include/linux/platform_device.h' line='203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_del'>
-        <parameter type-id='db362995'/>
+      <function-decl name='platform_device_del' mangled-name='platform_device_del' filepath='drivers/base/platform.c' line='640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_del'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='640' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='platform_device_put' mangled-name='platform_device_put' filepath='include/linux/platform_device.h' line='204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_put'>
-        <parameter type-id='db362995'/>
+      <function-decl name='platform_device_put' mangled-name='platform_device_put' filepath='drivers/base/platform.c' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_put'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='426' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='platform_device_register' mangled-name='platform_device_register' filepath='include/linux/platform_device.h' line='51' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_register'>
-        <parameter type-id='db362995'/>
+      <function-decl name='platform_device_register' mangled-name='platform_device_register' filepath='drivers/base/platform.c' line='665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_register'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='665' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='platform_device_register_full' mangled-name='platform_device_register_full' filepath='include/linux/platform_device.h' line='104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_register_full'>
-        <parameter type-id='91d6c443'/>
+      <function-decl name='platform_device_register_full' mangled-name='platform_device_register_full' filepath='drivers/base/platform.c' line='696' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_register_full'>
+        <parameter type-id='91d6c443' name='pdevinfo' filepath='drivers/base/platform.c' line='697' column='1'/>
         <return type-id='db362995'/>
       </function-decl>
-      <function-decl name='platform_device_unregister' mangled-name='platform_device_unregister' filepath='include/linux/platform_device.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_unregister'>
-        <parameter type-id='db362995'/>
+      <function-decl name='platform_device_unregister' mangled-name='platform_device_unregister' filepath='drivers/base/platform.c' line='681' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_device_unregister'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/base/platform.c' line='681' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='platform_driver_unregister' mangled-name='platform_driver_unregister' filepath='drivers/base/platform.c' line='824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_driver_unregister'>
@@ -129894,14 +129717,14 @@
         <parameter type-id='d5ddffb9' name='drv' filepath='drivers/base/platform.c' line='1382' column='1'/>
         <return type-id='fa0b179b'/>
       </function-decl>
-      <function-decl name='platform_get_irq' mangled-name='platform_get_irq' filepath='include/linux/platform_device.h' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_irq'>
-        <parameter type-id='db362995'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='platform_get_irq' mangled-name='platform_get_irq' filepath='drivers/base/platform.c' line='260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_irq'>
+        <parameter type-id='db362995' name='dev' filepath='drivers/base/platform.c' line='260' column='1'/>
+        <parameter type-id='f0981eeb' name='num' filepath='drivers/base/platform.c' line='260' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='platform_get_irq_byname' mangled-name='platform_get_irq_byname' filepath='include/linux/platform_device.h' line='80' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_irq_byname'>
-        <parameter type-id='db362995'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='platform_get_irq_byname' mangled-name='platform_get_irq_byname' filepath='drivers/base/platform.c' line='347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_irq_byname'>
+        <parameter type-id='db362995' name='dev' filepath='drivers/base/platform.c' line='347' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/base/platform.c' line='347' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='platform_get_irq_byname_optional' mangled-name='platform_get_irq_byname_optional' filepath='drivers/base/platform.c' line='369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_irq_byname_optional'>
@@ -129914,16 +129737,16 @@
         <parameter type-id='f0981eeb' name='num' filepath='drivers/base/platform.c' line='172' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='platform_get_resource' mangled-name='platform_get_resource' filepath='include/linux/platform_device.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_resource'>
-        <parameter type-id='db362995'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='platform_get_resource' mangled-name='platform_get_resource' filepath='drivers/base/platform.c' line='51' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_resource'>
+        <parameter type-id='db362995' name='dev' filepath='drivers/base/platform.c' line='51' column='1'/>
+        <parameter type-id='f0981eeb' name='type' filepath='drivers/base/platform.c' line='52' column='1'/>
+        <parameter type-id='f0981eeb' name='num' filepath='drivers/base/platform.c' line='52' column='1'/>
         <return type-id='c9d64c0d'/>
       </function-decl>
-      <function-decl name='platform_get_resource_byname' mangled-name='platform_get_resource_byname' filepath='include/linux/platform_device.h' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_resource_byname'>
-        <parameter type-id='db362995'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='platform_get_resource_byname' mangled-name='platform_get_resource_byname' filepath='drivers/base/platform.c' line='298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_get_resource_byname'>
+        <parameter type-id='db362995' name='dev' filepath='drivers/base/platform.c' line='298' column='1'/>
+        <parameter type-id='f0981eeb' name='type' filepath='drivers/base/platform.c' line='299' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/base/platform.c' line='300' column='1'/>
         <return type-id='c9d64c0d'/>
       </function-decl>
       <function-decl name='platform_irq_count' mangled-name='platform_irq_count' filepath='drivers/base/platform.c' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_irq_count'>
@@ -129960,12 +129783,12 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/generic_ops.c' line='241' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pm_generic_runtime_resume' mangled-name='pm_generic_runtime_resume' filepath='include/linux/pm_runtime.h' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_generic_runtime_resume'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='pm_generic_runtime_resume' mangled-name='pm_generic_runtime_resume' filepath='drivers/base/power/generic_ops.c' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_generic_runtime_resume'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/generic_ops.c' line='39' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pm_generic_runtime_suspend' mangled-name='pm_generic_runtime_suspend' filepath='include/linux/pm_runtime.h' line='33' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_generic_runtime_suspend'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='pm_generic_runtime_suspend' mangled-name='pm_generic_runtime_suspend' filepath='drivers/base/power/generic_ops.c' line='20' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_generic_runtime_suspend'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/generic_ops.c' line='20' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pm_generic_suspend' mangled-name='pm_generic_suspend' filepath='drivers/base/power/generic_ops.c' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_generic_suspend'>
@@ -130007,24 +129830,24 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='776' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_allow' mangled-name='pm_runtime_allow' filepath='include/linux/pm_runtime.h' line='47' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_allow'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='pm_runtime_allow' mangled-name='pm_runtime_allow' filepath='drivers/base/power/runtime.c' line='1481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_allow'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1481' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pm_runtime_autosuspend_expiration' mangled-name='pm_runtime_autosuspend_expiration' filepath='drivers/base/power/runtime.c' line='163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_autosuspend_expiration'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='163' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='pm_runtime_barrier' mangled-name='pm_runtime_barrier' filepath='include/linux/pm_runtime.h' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_barrier'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='pm_runtime_barrier' mangled-name='pm_runtime_barrier' filepath='drivers/base/power/runtime.c' line='1347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_barrier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1347' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pm_runtime_enable' mangled-name='pm_runtime_enable' filepath='include/linux/pm_runtime.h' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_enable'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='pm_runtime_enable' mangled-name='pm_runtime_enable' filepath='drivers/base/power/runtime.c' line='1425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_enable'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1425' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_forbid' mangled-name='pm_runtime_forbid' filepath='include/linux/pm_runtime.h' line='48' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_forbid'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='pm_runtime_forbid' mangled-name='pm_runtime_forbid' filepath='drivers/base/power/runtime.c' line='1460' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_forbid'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1460' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pm_runtime_force_resume' mangled-name='pm_runtime_force_resume' filepath='drivers/base/power/runtime.c' line='1835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_force_resume'>
@@ -130044,13 +129867,13 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1527' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_no_callbacks' mangled-name='pm_runtime_no_callbacks' filepath='include/linux/pm_runtime.h' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_no_callbacks'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='pm_runtime_no_callbacks' mangled-name='pm_runtime_no_callbacks' filepath='drivers/base/power/runtime.c' line='1506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_no_callbacks'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1506' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_runtime_set_autosuspend_delay' mangled-name='pm_runtime_set_autosuspend_delay' filepath='include/linux/pm_runtime.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_set_autosuspend_delay'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='pm_runtime_set_autosuspend_delay' mangled-name='pm_runtime_set_autosuspend_delay' filepath='drivers/base/power/runtime.c' line='1585' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_runtime_set_autosuspend_delay'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/runtime.c' line='1585' column='1'/>
+        <parameter type-id='95e97e5e' name='delay' filepath='drivers/base/power/runtime.c' line='1585' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pm_stay_awake' mangled-name='pm_stay_awake' filepath='drivers/base/power/wakeup.c' line='667' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_stay_awake'>
@@ -130064,18 +129887,19 @@
       <function-decl name='pm_system_wakeup' mangled-name='pm_system_wakeup' filepath='drivers/base/power/wakeup.c' line='971' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_system_wakeup'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_wakeup_dev_event' mangled-name='pm_wakeup_dev_event' filepath='include/linux/pm_wakeup.h' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_wakeup_dev_event'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='pm_wakeup_dev_event' mangled-name='pm_wakeup_dev_event' filepath='drivers/base/power/wakeup.c' line='865' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_wakeup_dev_event'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='865' column='1'/>
+        <parameter type-id='f0981eeb' name='msec' filepath='drivers/base/power/wakeup.c' line='865' column='1'/>
+        <parameter type-id='b50a4934' name='hard' filepath='drivers/base/power/wakeup.c' line='865' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pm_wakeup_ws_event' mangled-name='pm_wakeup_ws_event' filepath='include/linux/pm_wakeup.h' line='113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_wakeup_ws_event'>
-        <parameter type-id='1ea237a6'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='pm_wakeup_ws_event' mangled-name='pm_wakeup_ws_event' filepath='drivers/base/power/wakeup.c' line='826' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_wakeup_ws_event'>
+        <parameter type-id='1ea237a6' name='ws' filepath='drivers/base/power/wakeup.c' line='826' column='1'/>
+        <parameter type-id='f0981eeb' name='msec' filepath='drivers/base/power/wakeup.c' line='826' column='1'/>
+        <parameter type-id='b50a4934' name='hard' filepath='drivers/base/power/wakeup.c' line='826' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <var-decl name='pm_wq' type-id='242e3d19' mangled-name='pm_wq' visibility='default' filepath='kernel/power/main.c' line='931' column='1' elf-symbol-id='pm_wq'/>
       <function-decl name='policy_has_boost_freq' mangled-name='policy_has_boost_freq' filepath='drivers/cpufreq/freq_table.c' line='18' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='policy_has_boost_freq'>
         <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/freq_table.c' line='18' column='1'/>
         <return type-id='b50a4934'/>
@@ -130089,8 +129913,8 @@
         <parameter type-id='11777d05' name='clk' filepath='kernel/time/posix-clock.c' line='182' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='power_supply_changed' mangled-name='power_supply_changed' filepath='include/linux/power_supply.h' line='439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_changed'>
-        <parameter type-id='c0c93c9e'/>
+      <function-decl name='power_supply_changed' mangled-name='power_supply_changed' filepath='drivers/power/supply/power_supply_core.c' line='121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_changed'>
+        <parameter type-id='c0c93c9e' name='psy' filepath='drivers/power/supply/power_supply_core.c' line='121' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='power_supply_find_ocv2cap_table' mangled-name='power_supply_find_ocv2cap_table' filepath='drivers/power/supply/power_supply_core.c' line='905' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_find_ocv2cap_table'>
@@ -130104,8 +129928,8 @@
         <parameter type-id='78ba63ff' name='info' filepath='drivers/power/supply/power_supply_core.c' line='644' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='power_supply_get_by_name' mangled-name='power_supply_get_by_name' filepath='include/linux/power_supply.h' line='399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_get_by_name'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='power_supply_get_by_name' mangled-name='power_supply_get_by_name' filepath='drivers/power/supply/power_supply_core.c' line='458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_get_by_name'>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/power/supply/power_supply_core.c' line='458' column='1'/>
         <return type-id='c0c93c9e'/>
       </function-decl>
       <function-decl name='power_supply_get_by_phandle' mangled-name='power_supply_get_by_phandle' filepath='drivers/power/supply/power_supply_core.c' line='507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_get_by_phandle'>
@@ -130139,8 +129963,8 @@
         <parameter type-id='95e97e5e' name='ocv' filepath='drivers/power/supply/power_supply_core.c' line='881' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='power_supply_put' mangled-name='power_supply_put' filepath='include/linux/power_supply.h' line='400' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_put'>
-        <parameter type-id='c0c93c9e'/>
+      <function-decl name='power_supply_put' mangled-name='power_supply_put' filepath='drivers/power/supply/power_supply_core.c' line='480' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_put'>
+        <parameter type-id='c0c93c9e' name='psy' filepath='drivers/power/supply/power_supply_core.c' line='480' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='power_supply_put_battery_info' mangled-name='power_supply_put_battery_info' filepath='drivers/power/supply/power_supply_core.c' line='813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_put_battery_info'>
@@ -130158,10 +129982,10 @@
         <parameter type-id='048b3ad6' name='cfg' filepath='drivers/power/supply/power_supply_core.c' line='1303' column='1'/>
         <return type-id='c0c93c9e'/>
       </function-decl>
-      <function-decl name='power_supply_set_property' mangled-name='power_supply_set_property' filepath='include/linux/power_supply.h' line='455' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_set_property'>
-        <parameter type-id='c0c93c9e'/>
-        <parameter type-id='5f78aa17'/>
-        <parameter type-id='f3abafd4'/>
+      <function-decl name='power_supply_set_property' mangled-name='power_supply_set_property' filepath='drivers/power/supply/power_supply_core.c' line='956' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_set_property'>
+        <parameter type-id='c0c93c9e' name='psy' filepath='drivers/power/supply/power_supply_core.c' line='956' column='1'/>
+        <parameter type-id='5f78aa17' name='psp' filepath='drivers/power/supply/power_supply_core.c' line='957' column='1'/>
+        <parameter type-id='f3abafd4' name='val' filepath='drivers/power/supply/power_supply_core.c' line='958' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='power_supply_temp2resist_simple' mangled-name='power_supply_temp2resist_simple' filepath='drivers/power/supply/power_supply_core.c' line='842' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_temp2resist_simple'>
@@ -130174,54 +129998,54 @@
         <parameter type-id='d504f73d' name='nb' filepath='drivers/power/supply/power_supply_core.c' line='1007' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='power_supply_unregister' mangled-name='power_supply_unregister' filepath='include/linux/power_supply.h' line='484' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_unregister'>
-        <parameter type-id='c0c93c9e'/>
+      <function-decl name='power_supply_unregister' mangled-name='power_supply_unregister' filepath='drivers/power/supply/power_supply_core.c' line='1418' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_unregister'>
+        <parameter type-id='c0c93c9e' name='psy' filepath='drivers/power/supply/power_supply_core.c' line='1418' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='prandom_bytes' mangled-name='prandom_bytes' filepath='include/linux/prandom.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prandom_bytes'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='prandom_bytes' mangled-name='prandom_bytes' filepath='lib/random32.c' line='400' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prandom_bytes'>
+        <parameter type-id='eaa32e2f' name='buf' filepath='lib/random32.c' line='400' column='1'/>
+        <parameter type-id='b59d7dce' name='bytes' filepath='lib/random32.c' line='400' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='prandom_u32' mangled-name='prandom_u32' filepath='include/linux/prandom.h' line='14' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prandom_u32'>
-        <return type-id='f0981eeb'/>
+      <function-decl name='prandom_u32' mangled-name='prandom_u32' filepath='lib/random32.c' line='384' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prandom_u32'>
+        <return type-id='19c2251e'/>
       </function-decl>
-      <function-decl name='preempt_schedule' mangled-name='preempt_schedule' filepath='arch/arm64/include/asm/preempt.h' line='83' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='preempt_schedule'>
+      <function-decl name='preempt_schedule' mangled-name='preempt_schedule' filepath='kernel/sched/core.c' line='4948' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='preempt_schedule'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='preempt_schedule_notrace' mangled-name='preempt_schedule_notrace' filepath='arch/arm64/include/asm/preempt.h' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='preempt_schedule_notrace'>
+      <function-decl name='preempt_schedule_notrace' mangled-name='preempt_schedule_notrace' filepath='kernel/sched/core.c' line='4976' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='preempt_schedule_notrace'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='prepare_to_wait' mangled-name='prepare_to_wait' filepath='include/linux/wait.h' line='1128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prepare_to_wait'>
-        <parameter type-id='3f8b2ed3'/>
-        <parameter type-id='db9d03e3'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='prepare_to_wait' mangled-name='prepare_to_wait' filepath='kernel/sched/wait.c' line='243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prepare_to_wait'>
+        <parameter type-id='3f8b2ed3' name='wq_head' filepath='kernel/sched/wait.c' line='243' column='1'/>
+        <parameter type-id='db9d03e3' name='wq_entry' filepath='kernel/sched/wait.c' line='243' column='1'/>
+        <parameter type-id='95e97e5e' name='state' filepath='kernel/sched/wait.c' line='243' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='prepare_to_wait_event' mangled-name='prepare_to_wait_event' filepath='include/linux/wait.h' line='1130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prepare_to_wait_event'>
-        <parameter type-id='3f8b2ed3'/>
-        <parameter type-id='db9d03e3'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='prepare_to_wait_event' mangled-name='prepare_to_wait_event' filepath='kernel/sched/wait.c' line='284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='prepare_to_wait_event'>
+        <parameter type-id='3f8b2ed3' name='wq_head' filepath='kernel/sched/wait.c' line='284' column='1'/>
+        <parameter type-id='db9d03e3' name='wq_entry' filepath='kernel/sched/wait.c' line='284' column='1'/>
+        <parameter type-id='95e97e5e' name='state' filepath='kernel/sched/wait.c' line='284' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='print_hex_dump' mangled-name='print_hex_dump' filepath='include/linux/printk.h' line='581' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='print_hex_dump'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='print_hex_dump' mangled-name='print_hex_dump' filepath='lib/hexdump.c' line='240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='print_hex_dump'>
+        <parameter type-id='80f4b756' name='level' filepath='lib/hexdump.c' line='240' column='1'/>
+        <parameter type-id='80f4b756' name='prefix_str' filepath='lib/hexdump.c' line='240' column='1'/>
+        <parameter type-id='95e97e5e' name='prefix_type' filepath='lib/hexdump.c' line='240' column='1'/>
+        <parameter type-id='95e97e5e' name='rowsize' filepath='lib/hexdump.c' line='241' column='1'/>
+        <parameter type-id='95e97e5e' name='groupsize' filepath='lib/hexdump.c' line='241' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='lib/hexdump.c' line='242' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='lib/hexdump.c' line='242' column='1'/>
+        <parameter type-id='b50a4934' name='ascii' filepath='lib/hexdump.c' line='242' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='printk' mangled-name='printk' filepath='include/linux/printk.h' line='176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='printk' mangled-name='printk' filepath='kernel/printk/printk.c' line='2103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/printk/printk.c' line='2103' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='printk_deferred' mangled-name='printk_deferred' filepath='include/linux/printk.h' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk_deferred'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='printk_deferred' mangled-name='printk_deferred' filepath='kernel/printk/printk.c' line='3106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk_deferred'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/printk/printk.c' line='3106' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -130230,36 +130054,36 @@
         <parameter type-id='f0981eeb' name='interval_msecs' filepath='kernel/printk/printk.c' line='3143' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='proc_create' mangled-name='proc_create' filepath='include/linux/proc_fs.h' line='109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='d077e928'/>
-        <parameter type-id='33d70f0f'/>
+      <function-decl name='proc_create' mangled-name='proc_create' filepath='fs/proc/generic.c' line='584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/proc/generic.c' line='584' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/proc/generic.c' line='584' column='1'/>
+        <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='585' column='1'/>
+        <parameter type-id='33d70f0f' name='proc_ops' filepath='fs/proc/generic.c' line='586' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
-      <function-decl name='proc_create_data' mangled-name='proc_create_data' filepath='include/linux/proc_fs.h' line='104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create_data'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='d077e928'/>
-        <parameter type-id='33d70f0f'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='proc_create_data' mangled-name='proc_create_data' filepath='fs/proc/generic.c' line='569' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create_data'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/proc/generic.c' line='569' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/proc/generic.c' line='569' column='1'/>
+        <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='570' column='1'/>
+        <parameter type-id='33d70f0f' name='proc_ops' filepath='fs/proc/generic.c' line='571' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/proc/generic.c' line='571' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
-      <function-decl name='proc_create_seq_private' mangled-name='proc_create_seq_private' filepath='include/linux/proc_fs.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create_seq_private'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='d077e928'/>
-        <parameter type-id='943a1b48'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='proc_create_seq_private' mangled-name='proc_create_seq_private' filepath='fs/proc/generic.c' line='618' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create_seq_private'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/proc/generic.c' line='618' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/proc/generic.c' line='618' column='1'/>
+        <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='619' column='1'/>
+        <parameter type-id='943a1b48' name='ops' filepath='fs/proc/generic.c' line='619' column='1'/>
+        <parameter type-id='f0981eeb' name='state_size' filepath='fs/proc/generic.c' line='620' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/proc/generic.c' line='620' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
-      <function-decl name='proc_create_single_data' mangled-name='proc_create_single_data' filepath='include/linux/proc_fs.h' line='98' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create_single_data'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='d077e928'/>
-        <parameter type-id='0131eb61'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='proc_create_single_data' mangled-name='proc_create_single_data' filepath='fs/proc/generic.c' line='649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create_single_data'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/proc/generic.c' line='649' column='1'/>
+        <parameter type-id='2594b00f' name='mode' filepath='fs/proc/generic.c' line='649' column='1'/>
+        <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='650' column='1'/>
+        <parameter type-id='0131eb61' name='show' filepath='fs/proc/generic.c' line='651' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/proc/generic.c' line='651' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
       <function-decl name='proc_dointvec' mangled-name='proc_dointvec' filepath='kernel/sysctl.c' line='803' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dointvec'>
@@ -130270,12 +130094,12 @@
         <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='804' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proc_dointvec_minmax' mangled-name='proc_dointvec_minmax' filepath='include/linux/sysctl.h' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dointvec_minmax'>
-        <parameter type-id='631dc3c1'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='8b97c2dc'/>
+      <function-decl name='proc_dointvec_minmax' mangled-name='proc_dointvec_minmax' filepath='kernel/sysctl.c' line='960' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dointvec_minmax'>
+        <parameter type-id='631dc3c1' name='table' filepath='kernel/sysctl.c' line='960' column='1'/>
+        <parameter type-id='95e97e5e' name='write' filepath='kernel/sysctl.c' line='960' column='1'/>
+        <parameter type-id='eaa32e2f' name='buffer' filepath='kernel/sysctl.c' line='961' column='1'/>
+        <parameter type-id='78c01427' name='lenp' filepath='kernel/sysctl.c' line='961' column='1'/>
+        <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='961' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='proc_dostring' mangled-name='proc_dostring' filepath='kernel/sysctl.c' line='360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_dostring'>
@@ -130294,9 +130118,9 @@
         <parameter type-id='b53e8dbb' name='ppos' filepath='kernel/sysctl.c' line='1030' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proc_mkdir' mangled-name='proc_mkdir' filepath='include/linux/proc_fs.h' line='84' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_mkdir'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='d077e928'/>
+      <function-decl name='proc_mkdir' mangled-name='proc_mkdir' filepath='fs/proc/generic.c' line='520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_mkdir'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/proc/generic.c' line='520' column='1'/>
+        <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='521' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
       <function-decl name='proc_mkdir_data' mangled-name='proc_mkdir_data' filepath='fs/proc/generic.c' line='506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_mkdir_data'>
@@ -130306,8 +130130,8 @@
         <parameter type-id='eaa32e2f' name='data' filepath='fs/proc/generic.c' line='507' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
-      <function-decl name='proc_remove' mangled-name='proc_remove' filepath='include/linux/proc_fs.h' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_remove'>
-        <parameter type-id='d077e928'/>
+      <function-decl name='proc_remove' mangled-name='proc_remove' filepath='fs/proc/generic.c' line='792' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_remove'>
+        <parameter type-id='d077e928' name='de' filepath='fs/proc/generic.c' line='792' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='proc_set_size' mangled-name='proc_set_size' filepath='fs/proc/generic.c' line='664' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_set_size'>
@@ -130321,19 +130145,19 @@
         <parameter type-id='094d8048' name='gid' filepath='fs/proc/generic.c' line='670' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='proc_symlink' mangled-name='proc_symlink' filepath='include/linux/proc_fs.h' line='81' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_symlink'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='d077e928'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='proc_symlink' mangled-name='proc_symlink' filepath='fs/proc/generic.c' line='461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_symlink'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/proc/generic.c' line='461' column='1'/>
+        <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='462' column='1'/>
+        <parameter type-id='80f4b756' name='dest' filepath='fs/proc/generic.c' line='462' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
-      <function-decl name='proto_register' mangled-name='proto_register' filepath='include/net/sock.h' line='1251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_register'>
-        <parameter type-id='d2524501'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='proto_register' mangled-name='proto_register' filepath='net/core/sock.c' line='3468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_register'>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3468' column='1'/>
+        <parameter type-id='95e97e5e' name='alloc_slab' filepath='net/core/sock.c' line='3468' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proto_unregister' mangled-name='proto_unregister' filepath='include/net/sock.h' line='1252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_unregister'>
-        <parameter type-id='d2524501'/>
+      <function-decl name='proto_unregister' mangled-name='proto_unregister' filepath='net/core/sock.c' line='3532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_unregister'>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3532' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ps2_begin_command' mangled-name='ps2_begin_command' filepath='drivers/input/serio/libps2.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ps2_begin_command'>
@@ -130386,11 +130210,11 @@
         <parameter type-id='f9b06939' name='command' filepath='drivers/input/serio/libps2.c' line='347' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pskb_expand_head' mangled-name='pskb_expand_head' filepath='include/linux/skbuff.h' line='1168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pskb_expand_head'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='pskb_expand_head' mangled-name='pskb_expand_head' filepath='net/core/skbuff.c' line='1623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pskb_expand_head'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1623' column='1'/>
+        <parameter type-id='95e97e5e' name='nhead' filepath='net/core/skbuff.c' line='1623' column='1'/>
+        <parameter type-id='95e97e5e' name='ntail' filepath='net/core/skbuff.c' line='1623' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='1624' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pstore_register' mangled-name='pstore_register' filepath='fs/pstore/platform.c' line='561' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pstore_register'>
@@ -130406,20 +130230,20 @@
         <parameter type-id='2a733fb2' name='sig' filepath='crypto/asymmetric_keys/public_key.c' line='310' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='put_device' mangled-name='put_device' filepath='include/linux/device.h' line='926' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_device'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='put_device' mangled-name='put_device' filepath='drivers/base/core.c' line='3337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_device'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/core.c' line='3337' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='put_disk' mangled-name='put_disk' filepath='block/genhd.c' line='1812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_disk'>
         <parameter type-id='33c599da' name='disk' filepath='block/genhd.c' line='1812' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='put_iova_domain' mangled-name='put_iova_domain' filepath='include/linux/iova.h' line='163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_iova_domain'>
-        <parameter type-id='0c2c419d'/>
+      <function-decl name='put_iova_domain' mangled-name='put_iova_domain' filepath='drivers/iommu/iova.c' line='693' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_iova_domain'>
+        <parameter type-id='0c2c419d' name='iovad' filepath='drivers/iommu/iova.c' line='693' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='put_pid' mangled-name='put_pid' filepath='include/linux/pid.h' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_pid'>
-        <parameter type-id='b94e5398'/>
+      <function-decl name='put_pid' mangled-name='put_pid' filepath='kernel/pid.c' line='105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_pid'>
+        <parameter type-id='b94e5398' name='pid' filepath='kernel/pid.c' line='105' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='put_sg_io_hdr' mangled-name='put_sg_io_hdr' filepath='block/scsi_ioctl.c' line='548' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_sg_io_hdr'>
@@ -130427,20 +130251,20 @@
         <parameter type-id='eaa32e2f' name='argp' filepath='block/scsi_ioctl.c' line='548' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='put_task_stack' mangled-name='put_task_stack' filepath='include/linux/sched/task_stack.h' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_task_stack'>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='put_task_stack' mangled-name='put_task_stack' filepath='kernel/fork.c' line='441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_task_stack'>
+        <parameter type-id='f23e2572' name='tsk' filepath='kernel/fork.c' line='441' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='put_unused_fd' mangled-name='put_unused_fd' filepath='include/linux/file.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_unused_fd'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='put_unused_fd' mangled-name='put_unused_fd' filepath='fs/file.c' line='575' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_unused_fd'>
+        <parameter type-id='f0981eeb' name='fd' filepath='fs/file.c' line='575' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='put_vaddr_frames' mangled-name='put_vaddr_frames' filepath='mm/frame_vector.c' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_vaddr_frames'>
         <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='123' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='putback_movable_pages' mangled-name='putback_movable_pages' filepath='include/linux/migrate.h' line='38' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='putback_movable_pages'>
-        <parameter type-id='e84b031a'/>
+      <function-decl name='putback_movable_pages' mangled-name='putback_movable_pages' filepath='mm/migrate.c' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='putback_movable_pages'>
+        <parameter type-id='e84b031a' name='l' filepath='mm/migrate.c' line='143' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pwm_apply_state' mangled-name='pwm_apply_state' filepath='drivers/pwm/core.c' line='574' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pwm_apply_state'>
@@ -130496,8 +130320,8 @@
         <parameter type-id='19c2251e' name='value' filepath='drivers/soc/qcom/smem_state.c' line='47' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='qdisc_reset' mangled-name='qdisc_reset' filepath='include/net/sch_generic.h' line='700' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='qdisc_reset'>
-        <parameter type-id='ee406209'/>
+      <function-decl name='qdisc_reset' mangled-name='qdisc_reset' filepath='net/sched/sch_generic.c' line='943' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='qdisc_reset'>
+        <parameter type-id='ee406209' name='qdisc' filepath='net/sched/sch_generic.c' line='943' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='queue_delayed_work_on' mangled-name='queue_delayed_work_on' filepath='kernel/workqueue.c' line='1685' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='queue_delayed_work_on'>
@@ -130507,21 +130331,21 @@
         <parameter type-id='7359adad' name='delay' filepath='kernel/workqueue.c' line='1686' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='queue_work_on' mangled-name='queue_work_on' filepath='include/linux/workqueue.h' line='450' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='queue_work_on'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='242e3d19'/>
-        <parameter type-id='83c1bde6'/>
-        <return type-id='c894953d'/>
+      <function-decl name='queue_work_on' mangled-name='queue_work_on' filepath='kernel/workqueue.c' line='1524' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='queue_work_on'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/workqueue.c' line='1524' column='1'/>
+        <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='1524' column='1'/>
+        <parameter type-id='83c1bde6' name='work' filepath='kernel/workqueue.c' line='1525' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='radix_tree_delete' mangled-name='radix_tree_delete' filepath='lib/radix-tree.c' line='1443' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_delete'>
         <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='1443' column='1'/>
         <parameter type-id='7359adad' name='index' filepath='lib/radix-tree.c' line='1443' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='radix_tree_insert' mangled-name='radix_tree_insert' filepath='include/linux/radix-tree.h' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_insert'>
-        <parameter type-id='60075f2a'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='radix_tree_insert' mangled-name='radix_tree_insert' filepath='lib/radix-tree.c' line='701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_insert'>
+        <parameter type-id='60075f2a' name='root' filepath='lib/radix-tree.c' line='701' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='lib/radix-tree.c' line='701' column='1'/>
+        <parameter type-id='eaa32e2f' name='item' filepath='lib/radix-tree.c' line='702' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='radix_tree_iter_delete' mangled-name='radix_tree_iter_delete' filepath='lib/radix-tree.c' line='1392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_iter_delete'>
@@ -130535,19 +130359,19 @@
         <parameter type-id='0cbbabe1' name='iter' filepath='lib/radix-tree.c' line='1134' column='1'/>
         <return type-id='63e171df'/>
       </function-decl>
-      <function-decl name='radix_tree_lookup' mangled-name='radix_tree_lookup' filepath='include/linux/radix-tree.h' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_lookup'>
-        <parameter type-id='bb0f13d1'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='radix_tree_lookup' mangled-name='radix_tree_lookup' filepath='lib/radix-tree.c' line='815' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_lookup'>
+        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='815' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='lib/radix-tree.c' line='815' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='radix_tree_maybe_preload' mangled-name='radix_tree_maybe_preload' filepath='include/linux/radix-tree.h' line='238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_maybe_preload'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='radix_tree_maybe_preload' mangled-name='radix_tree_maybe_preload' filepath='lib/radix-tree.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_maybe_preload'>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='lib/radix-tree.c' line='376' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='radix_tree_next_chunk' mangled-name='radix_tree_next_chunk' filepath='include/linux/radix-tree.h' line='307' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_next_chunk'>
-        <parameter type-id='bb0f13d1'/>
-        <parameter type-id='0cbbabe1'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='radix_tree_next_chunk' mangled-name='radix_tree_next_chunk' filepath='lib/radix-tree.c' line='1152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_next_chunk'>
+        <parameter type-id='bb0f13d1' name='root' filepath='lib/radix-tree.c' line='1152' column='1'/>
+        <parameter type-id='0cbbabe1' name='iter' filepath='lib/radix-tree.c' line='1153' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='lib/radix-tree.c' line='1153' column='1'/>
         <return type-id='63e171df'/>
       </function-decl>
       <function-decl name='radix_tree_tagged' mangled-name='radix_tree_tagged' filepath='lib/radix-tree.c' line='1454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='radix_tree_tagged'>
@@ -130570,48 +130394,48 @@
         <parameter type-id='eaa32e2f' name='v' filepath='kernel/notifier.c' line='408' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='raw_notifier_chain_register' mangled-name='raw_notifier_chain_register' filepath='include/linux/notifier.h' line='148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='raw_notifier_chain_register'>
-        <parameter type-id='dc20ab67'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='raw_notifier_chain_register' mangled-name='raw_notifier_chain_register' filepath='kernel/notifier.c' line='359' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='raw_notifier_chain_register'>
+        <parameter type-id='dc20ab67' name='nh' filepath='kernel/notifier.c' line='359' column='1'/>
+        <parameter type-id='d504f73d' name='n' filepath='kernel/notifier.c' line='360' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='raw_notifier_chain_unregister' mangled-name='raw_notifier_chain_unregister' filepath='include/linux/notifier.h' line='157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='raw_notifier_chain_unregister'>
-        <parameter type-id='dc20ab67'/>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='raw_notifier_chain_unregister' mangled-name='raw_notifier_chain_unregister' filepath='kernel/notifier.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='raw_notifier_chain_unregister'>
+        <parameter type-id='dc20ab67' name='nh' filepath='kernel/notifier.c' line='376' column='1'/>
+        <parameter type-id='d504f73d' name='n' filepath='kernel/notifier.c' line='377' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rb_erase' mangled-name='rb_erase' filepath='include/linux/rbtree.h' line='50' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_erase'>
-        <parameter type-id='e6532500'/>
-        <parameter type-id='c5bcc2c0'/>
+      <function-decl name='rb_erase' mangled-name='rb_erase' filepath='lib/rbtree.c' line='440' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_erase'>
+        <parameter type-id='e6532500' name='node' filepath='lib/rbtree.c' line='440' column='1'/>
+        <parameter type-id='c5bcc2c0' name='root' filepath='lib/rbtree.c' line='440' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rb_first' mangled-name='rb_first' filepath='include/linux/rbtree.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_first'>
-        <parameter type-id='c4139a7d'/>
+      <function-decl name='rb_first' mangled-name='rb_first' filepath='lib/rbtree.c' line='466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_first'>
+        <parameter type-id='c4139a7d' name='root' filepath='lib/rbtree.c' line='466' column='1'/>
         <return type-id='e6532500'/>
       </function-decl>
-      <function-decl name='rb_first_postorder' mangled-name='rb_first_postorder' filepath='include/linux/rbtree.h' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_first_postorder'>
-        <parameter type-id='c4139a7d'/>
+      <function-decl name='rb_first_postorder' mangled-name='rb_first_postorder' filepath='lib/rbtree.c' line='623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_first_postorder'>
+        <parameter type-id='c4139a7d' name='root' filepath='lib/rbtree.c' line='623' column='1'/>
         <return type-id='e6532500'/>
       </function-decl>
-      <function-decl name='rb_insert_color' mangled-name='rb_insert_color' filepath='include/linux/rbtree.h' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_insert_color'>
-        <parameter type-id='e6532500'/>
-        <parameter type-id='c5bcc2c0'/>
+      <function-decl name='rb_insert_color' mangled-name='rb_insert_color' filepath='lib/rbtree.c' line='434' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_insert_color'>
+        <parameter type-id='e6532500' name='node' filepath='lib/rbtree.c' line='434' column='1'/>
+        <parameter type-id='c5bcc2c0' name='root' filepath='lib/rbtree.c' line='434' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rb_last' mangled-name='rb_last' filepath='include/linux/rbtree.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_last'>
-        <parameter type-id='c4139a7d'/>
+      <function-decl name='rb_last' mangled-name='rb_last' filepath='lib/rbtree.c' line='479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_last'>
+        <parameter type-id='c4139a7d' name='root' filepath='lib/rbtree.c' line='479' column='1'/>
         <return type-id='e6532500'/>
       </function-decl>
-      <function-decl name='rb_next' mangled-name='rb_next' filepath='include/linux/rbtree.h' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_next'>
-        <parameter type-id='47b73425'/>
+      <function-decl name='rb_next' mangled-name='rb_next' filepath='lib/rbtree.c' line='492' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_next'>
+        <parameter type-id='47b73425' name='node' filepath='lib/rbtree.c' line='492' column='1'/>
         <return type-id='e6532500'/>
       </function-decl>
-      <function-decl name='rb_next_postorder' mangled-name='rb_next_postorder' filepath='include/linux/rbtree.h' line='61' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_next_postorder'>
-        <parameter type-id='47b73425'/>
+      <function-decl name='rb_next_postorder' mangled-name='rb_next_postorder' filepath='lib/rbtree.c' line='604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_next_postorder'>
+        <parameter type-id='47b73425' name='node' filepath='lib/rbtree.c' line='604' column='1'/>
         <return type-id='e6532500'/>
       </function-decl>
-      <function-decl name='rb_prev' mangled-name='rb_prev' filepath='include/linux/rbtree.h' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_prev'>
-        <parameter type-id='47b73425'/>
+      <function-decl name='rb_prev' mangled-name='rb_prev' filepath='lib/rbtree.c' line='524' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_prev'>
+        <parameter type-id='47b73425' name='node' filepath='lib/rbtree.c' line='524' column='1'/>
         <return type-id='e6532500'/>
       </function-decl>
       <function-decl name='rb_replace_node' mangled-name='rb_replace_node' filepath='lib/rbtree.c' line='553' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rb_replace_node'>
@@ -130620,7 +130444,7 @@
         <parameter type-id='c5bcc2c0' name='root' filepath='lib/rbtree.c' line='554' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_barrier' mangled-name='rcu_barrier' filepath='include/linux/rcutree.h' line='38' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier'>
+      <function-decl name='rcu_barrier' mangled-name='rcu_barrier' filepath='kernel/rcu/tree.c' line='3836' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rcu_barrier_tasks' mangled-name='rcu_barrier_tasks' filepath='kernel/rcu/tasks.h' line='553' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_barrier_tasks'>
@@ -130660,17 +130484,17 @@
         <parameter type-id='95e97e5e' name='duration' filepath='kernel/rcu/tree.c' line='1690' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_idle_enter' mangled-name='rcu_idle_enter' filepath='include/linux/rcutree.h' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_enter'>
+      <function-decl name='rcu_idle_enter' mangled-name='rcu_idle_enter' filepath='kernel/rcu/tree.c' line='664' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_enter'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcu_idle_exit' mangled-name='rcu_idle_exit' filepath='include/linux/rcutree.h' line='47' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_exit'>
+      <function-decl name='rcu_idle_exit' mangled-name='rcu_idle_exit' filepath='kernel/rcu/tree.c' line='882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_idle_exit'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rcu_inkernel_boot_has_ended' mangled-name='rcu_inkernel_boot_has_ended' filepath='kernel/rcu/update.c' line='204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_inkernel_boot_has_ended'>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='rcu_is_watching' mangled-name='rcu_is_watching' filepath='include/linux/rcutree.h' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_is_watching'>
-        <return type-id='c894953d'/>
+      <function-decl name='rcu_is_watching' mangled-name='rcu_is_watching' filepath='kernel/rcu/tree.c' line='1105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_is_watching'>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='rcu_jiffies_till_stall_check' mangled-name='rcu_jiffies_till_stall_check' filepath='kernel/rcu/tree_stall.h' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcu_jiffies_till_stall_check'>
         <return type-id='95e97e5e'/>
@@ -130689,8 +130513,8 @@
         <parameter type-id='1d2c2b85' name='gp_seq' filepath='kernel/rcu/tree.c' line='599' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rcuwait_wake_up' mangled-name='rcuwait_wake_up' filepath='include/linux/rcuwait.h' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcuwait_wake_up'>
-        <parameter type-id='9b25216e'/>
+      <function-decl name='rcuwait_wake_up' mangled-name='rcuwait_wake_up' filepath='kernel/exit.c' line='233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rcuwait_wake_up'>
+        <parameter type-id='9b25216e' name='w' filepath='kernel/exit.c' line='233' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rdev_get_dev' mangled-name='rdev_get_dev' filepath='drivers/regulator/core.c' line='5577' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rdev_get_dev'>
@@ -130717,31 +130541,31 @@
         <return type-id='02f11ed4'/>
       </function-decl>
       <var-decl name='reboot_mode' type-id='fdb20761' mangled-name='reboot_mode' visibility='default' filepath='kernel/reboot.c' line='34' column='1' elf-symbol-id='reboot_mode'/>
-      <function-decl name='reciprocal_value' mangled-name='reciprocal_value' filepath='include/linux/reciprocal_div.h' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reciprocal_value'>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='reciprocal_value' mangled-name='reciprocal_value' filepath='lib/math/reciprocal_div.c' line='14' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reciprocal_value'>
+        <parameter type-id='19c2251e' name='d' filepath='lib/math/reciprocal_div.c' line='14' column='1'/>
         <return type-id='80ebe7f7'/>
       </function-decl>
       <function-decl name='reclaim_shmem_address_space' mangled-name='reclaim_shmem_address_space' filepath='mm/shmem.c' line='4303' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reclaim_shmem_address_space'>
         <parameter type-id='f57039f0' name='mapping' filepath='mm/shmem.c' line='4303' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='refcount_dec_and_lock' mangled-name='refcount_dec_and_lock' filepath='include/linux/refcount.h' line='365' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refcount_dec_and_lock'>
-        <parameter type-id='74c91557'/>
-        <parameter type-id='34e69a54'/>
-        <return type-id='c894953d'/>
+      <function-decl name='refcount_dec_and_lock' mangled-name='refcount_dec_and_lock' filepath='lib/refcount.c' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refcount_dec_and_lock'>
+        <parameter type-id='35a0b4f8' name='r' filepath='lib/refcount.c' line='144' column='1'/>
+        <parameter type-id='cff2d845' name='lock' filepath='lib/refcount.c' line='144' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='refcount_dec_and_mutex_lock' mangled-name='refcount_dec_and_mutex_lock' filepath='lib/refcount.c' line='113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refcount_dec_and_mutex_lock'>
         <parameter type-id='35a0b4f8' name='r' filepath='lib/refcount.c' line='113' column='1'/>
         <parameter type-id='e0ea832a' name='lock' filepath='lib/refcount.c' line='113' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='refcount_dec_not_one' mangled-name='refcount_dec_not_one' filepath='include/linux/refcount.h' line='363' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refcount_dec_not_one'>
-        <parameter type-id='74c91557'/>
-        <return type-id='c894953d'/>
+      <function-decl name='refcount_dec_not_one' mangled-name='refcount_dec_not_one' filepath='lib/refcount.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refcount_dec_not_one'>
+        <parameter type-id='35a0b4f8' name='r' filepath='lib/refcount.c' line='74' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='refcount_warn_saturate' mangled-name='refcount_warn_saturate' filepath='include/linux/refcount.h' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refcount_warn_saturate'>
-        <parameter type-id='74c91557'/>
-        <parameter type-id='ff0618be'/>
+      <function-decl name='refcount_warn_saturate' mangled-name='refcount_warn_saturate' filepath='lib/refcount.c' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refcount_warn_saturate'>
+        <parameter type-id='35a0b4f8' name='r' filepath='lib/refcount.c' line='13' column='1'/>
+        <parameter type-id='ff0618be' name='t' filepath='lib/refcount.c' line='13' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='refresh_frequency_limits' mangled-name='refresh_frequency_limits' filepath='drivers/cpufreq/cpufreq.c' line='1144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='refresh_frequency_limits'>
@@ -130801,8 +130625,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='kernel/notifier.c' line='552' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_filesystem' mangled-name='register_filesystem' filepath='include/linux/fs.h' line='2358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_filesystem'>
-        <parameter type-id='21e53d44'/>
+      <function-decl name='register_filesystem' mangled-name='register_filesystem' filepath='fs/filesystems.c' line='72' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_filesystem'>
+        <parameter type-id='21e53d44' name='fs' filepath='fs/filesystems.c' line='72' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_ftrace_export' mangled-name='register_ftrace_export' filepath='kernel/trace/trace.c' line='377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_ftrace_export'>
@@ -130843,16 +130667,16 @@
         <parameter type-id='631dc3c1' name='table' filepath='net/sysctl_net.c' line='119' column='1'/>
         <return type-id='11b101bb'/>
       </function-decl>
-      <function-decl name='register_netdev' mangled-name='register_netdev' filepath='include/linux/netdevice.h' line='4468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_netdev'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='register_netdev' mangled-name='register_netdev' filepath='net/core/dev.c' line='10223' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_netdev'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='10223' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_netdevice' mangled-name='register_netdevice' filepath='include/linux/netdevice.h' line='2910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_netdevice'>
-        <parameter type-id='68a2d05b'/>
+      <function-decl name='register_netdevice' mangled-name='register_netdevice' filepath='net/core/dev.c' line='9994' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_netdevice'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='9994' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_netdevice_notifier' mangled-name='register_netdevice_notifier' filepath='include/linux/netdevice.h' line='2742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_netdevice_notifier'>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='register_netdevice_notifier' mangled-name='register_netdevice_notifier' filepath='net/core/dev.c' line='1829' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_netdevice_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='net/core/dev.c' line='1829' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_netevent_notifier' mangled-name='register_netevent_notifier' filepath='net/core/netevent.c' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_netevent_notifier'>
@@ -130863,8 +130687,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1074' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_pernet_device' mangled-name='register_pernet_device' filepath='include/net/net_namespace.h' line='421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_pernet_device'>
-        <parameter type-id='d6907f4c'/>
+      <function-decl name='register_pernet_device' mangled-name='register_pernet_device' filepath='net/core/net_namespace.c' line='1316' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_pernet_device'>
+        <parameter type-id='d6907f4c' name='ops' filepath='net/core/net_namespace.c' line='1316' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_pernet_subsys' mangled-name='register_pernet_subsys' filepath='net/core/net_namespace.c' line='1270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_pernet_subsys'>
@@ -130883,12 +130707,12 @@
         <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='183' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_shrinker' mangled-name='register_shrinker' filepath='include/linux/shrinker.h' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_shrinker'>
-        <parameter type-id='4be14597'/>
+      <function-decl name='register_shrinker' mangled-name='register_shrinker' filepath='mm/vmscan.c' line='410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_shrinker'>
+        <parameter type-id='4be14597' name='shrinker' filepath='mm/vmscan.c' line='410' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_syscore_ops' mangled-name='register_syscore_ops' filepath='include/linux/syscore_ops.h' line='20' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_syscore_ops'>
-        <parameter type-id='cbd24a98'/>
+      <function-decl name='register_syscore_ops' mangled-name='register_syscore_ops' filepath='drivers/base/syscore.c' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_syscore_ops'>
+        <parameter type-id='cbd24a98' name='ops' filepath='drivers/base/syscore.c' line='22' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='register_sysctl' mangled-name='register_sysctl' filepath='fs/proc/proc_sysctl.c' line='1376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_sysctl'>
@@ -130904,8 +130728,8 @@
         <parameter type-id='5dbfcbb1' name='dev' filepath='drivers/virtio/virtio.c' line='333' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_virtio_driver' mangled-name='register_virtio_driver' filepath='include/linux/virtio.h' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_virtio_driver'>
-        <parameter type-id='f350dc99'/>
+      <function-decl name='register_virtio_driver' mangled-name='register_virtio_driver' filepath='drivers/virtio/virtio.c' line='309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_virtio_driver'>
+        <parameter type-id='f350dc99' name='driver' filepath='drivers/virtio/virtio.c' line='309' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='register_vmap_purge_notifier' mangled-name='register_vmap_purge_notifier' filepath='mm/vmalloc.c' line='1268' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_vmap_purge_notifier'>
@@ -131024,10 +130848,10 @@
         <parameter type-id='b59d7dce' name='val_len' filepath='drivers/base/regmap/regmap.c' line='2589' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_read' mangled-name='regmap_read' filepath='include/linux/regmap.h' line='1064' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_read'>
-        <parameter type-id='29af9a71'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='regmap_read' mangled-name='regmap_read' filepath='drivers/base/regmap/regmap.c' line='2713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_read'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='2713' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='2713' column='1'/>
+        <parameter type-id='807869d3' name='val' filepath='drivers/base/regmap/regmap.c' line='2713' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regmap_register_patch' mangled-name='regmap_register_patch' filepath='drivers/base/regmap/regmap.c' line='3193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_register_patch'>
@@ -131036,20 +130860,20 @@
         <parameter type-id='95e97e5e' name='num_regs' filepath='drivers/base/regmap/regmap.c' line='3194' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_update_bits_base' mangled-name='regmap_update_bits_base' filepath='include/linux/regmap.h' line='1071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_update_bits_base'>
-        <parameter type-id='29af9a71'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='d8e6b335'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='regmap_update_bits_base' mangled-name='regmap_update_bits_base' filepath='drivers/base/regmap/regmap.c' line='3068' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_update_bits_base'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='3068' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='3068' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='drivers/base/regmap/regmap.c' line='3069' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='3069' column='1'/>
+        <parameter type-id='d8e6b335' name='change' filepath='drivers/base/regmap/regmap.c' line='3070' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='drivers/base/regmap/regmap.c' line='3070' column='1'/>
+        <parameter type-id='b50a4934' name='force' filepath='drivers/base/regmap/regmap.c' line='3070' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regmap_write' mangled-name='regmap_write' filepath='include/linux/regmap.h' line='1049' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_write'>
-        <parameter type-id='29af9a71'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='regmap_write' mangled-name='regmap_write' filepath='drivers/base/regmap/regmap.c' line='1945' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regmap_write'>
+        <parameter type-id='29af9a71' name='map' filepath='drivers/base/regmap/regmap.c' line='1945' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='drivers/base/regmap/regmap.c' line='1945' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='drivers/base/regmap/regmap.c' line='1945' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_allow_bypass' mangled-name='regulator_allow_bypass' filepath='drivers/regulator/core.c' line='4481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_allow_bypass'>
@@ -131057,14 +130881,14 @@
         <parameter type-id='b50a4934' name='enable' filepath='drivers/regulator/core.c' line='4481' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_bulk_disable' mangled-name='regulator_bulk_disable' filepath='include/linux/regulator/consumer.h' line='236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_disable'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='776946b4'/>
+      <function-decl name='regulator_bulk_disable' mangled-name='regulator_bulk_disable' filepath='drivers/regulator/core.c' line='4689' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_disable'>
+        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4689' column='1'/>
+        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4690' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_bulk_enable' mangled-name='regulator_bulk_enable' filepath='include/linux/regulator/consumer.h' line='234' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_enable'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='776946b4'/>
+      <function-decl name='regulator_bulk_enable' mangled-name='regulator_bulk_enable' filepath='drivers/regulator/core.c' line='4640' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_enable'>
+        <parameter type-id='95e97e5e' name='num_consumers' filepath='drivers/regulator/core.c' line='4640' column='1'/>
+        <parameter type-id='776946b4' name='consumers' filepath='drivers/regulator/core.c' line='4641' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_bulk_get' mangled-name='regulator_bulk_get' filepath='drivers/regulator/core.c' line='4585' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_bulk_get'>
@@ -131082,8 +130906,8 @@
         <parameter type-id='f0981eeb' name='selector' filepath='drivers/regulator/helpers.c' line='598' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_disable' mangled-name='regulator_disable' filepath='include/linux/regulator/consumer.h' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable'>
-        <parameter type-id='850c13f6'/>
+      <function-decl name='regulator_disable' mangled-name='regulator_disable' filepath='drivers/regulator/core.c' line='2816' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2816' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_disable_deferred' mangled-name='regulator_disable_deferred' filepath='drivers/regulator/core.c' line='2947' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_disable_deferred'>
@@ -131095,8 +130919,8 @@
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='85' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_enable' mangled-name='regulator_enable' filepath='include/linux/regulator/consumer.h' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_enable'>
-        <parameter type-id='850c13f6'/>
+      <function-decl name='regulator_enable' mangled-name='regulator_enable' filepath='drivers/regulator/core.c' line='2706' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_enable'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='2706' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_enable_regmap' mangled-name='regulator_enable_regmap' filepath='drivers/regulator/helpers.c' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_enable_regmap'>
@@ -131133,8 +130957,8 @@
         <parameter type-id='80f4b756' name='id' filepath='drivers/regulator/core.c' line='2109' column='1'/>
         <return type-id='850c13f6'/>
       </function-decl>
-      <function-decl name='regulator_get_voltage' mangled-name='regulator_get_voltage' filepath='include/linux/regulator/consumer.h' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage'>
-        <parameter type-id='850c13f6'/>
+      <function-decl name='regulator_get_voltage' mangled-name='regulator_get_voltage' filepath='drivers/regulator/core.c' line='4215' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage'>
+        <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='4215' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_get_voltage_rdev' mangled-name='regulator_get_voltage_rdev' filepath='drivers/regulator/core.c' line='4160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_get_voltage_rdev'>
@@ -131185,22 +131009,22 @@
         <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/helpers.c' line='331' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_map_voltage_iterate' mangled-name='regulator_map_voltage_iterate' filepath='include/linux/regulator/driver.h' line='519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_map_voltage_iterate'>
-        <parameter type-id='43c38462'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='regulator_map_voltage_iterate' mangled-name='regulator_map_voltage_iterate' filepath='drivers/regulator/helpers.c' line='292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_map_voltage_iterate'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='292' column='1'/>
+        <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/helpers.c' line='293' column='1'/>
+        <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/helpers.c' line='293' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_map_voltage_linear' mangled-name='regulator_map_voltage_linear' filepath='include/linux/regulator/driver.h' line='513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_map_voltage_linear'>
-        <parameter type-id='43c38462'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='regulator_map_voltage_linear' mangled-name='regulator_map_voltage_linear' filepath='drivers/regulator/helpers.c' line='361' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_map_voltage_linear'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='361' column='1'/>
+        <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/helpers.c' line='362' column='1'/>
+        <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/helpers.c' line='362' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='regulator_map_voltage_linear_range' mangled-name='regulator_map_voltage_linear_range' filepath='include/linux/regulator/driver.h' line='517' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_map_voltage_linear_range'>
-        <parameter type-id='43c38462'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='regulator_map_voltage_linear_range' mangled-name='regulator_map_voltage_linear_range' filepath='drivers/regulator/helpers.c' line='407' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_map_voltage_linear_range'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='407' column='1'/>
+        <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/helpers.c' line='408' column='1'/>
+        <parameter type-id='95e97e5e' name='max_uV' filepath='drivers/regulator/helpers.c' line='408' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='regulator_notifier_call_chain' mangled-name='regulator_notifier_call_chain' filepath='drivers/regulator/core.c' line='4779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_notifier_call_chain'>
@@ -131286,8 +131110,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='drivers/regulator/core.c' line='4554' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='release_firmware' mangled-name='release_firmware' filepath='include/linux/firmware.h' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_firmware'>
-        <parameter type-id='fce0537d'/>
+      <function-decl name='release_firmware' mangled-name='release_firmware' filepath='drivers/base/firmware_loader/main.c' line='1049' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_firmware'>
+        <parameter type-id='fce0537d' name='fw' filepath='drivers/base/firmware_loader/main.c' line='1049' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='release_pages' mangled-name='release_pages' filepath='mm/swap.c' line='986' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_pages'>
@@ -131295,22 +131119,22 @@
         <parameter type-id='95e97e5e' name='nr' filepath='mm/swap.c' line='986' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='release_sock' mangled-name='release_sock' filepath='include/net/sock.h' line='1598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_sock'>
-        <parameter type-id='f772df6d'/>
+      <function-decl name='release_sock' mangled-name='release_sock' filepath='net/core/sock.c' line='3067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_sock'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3067' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='remap_pfn_range' mangled-name='remap_pfn_range' filepath='include/linux/mm.h' line='2900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_pfn_range'>
-        <parameter type-id='2ae08426'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='051883a9'/>
+      <function-decl name='remap_pfn_range' mangled-name='remap_pfn_range' filepath='mm/memory.c' line='2323' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_pfn_range'>
+        <parameter type-id='2ae08426' name='vma' filepath='mm/memory.c' line='2323' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='mm/memory.c' line='2323' column='1'/>
+        <parameter type-id='7359adad' name='pfn' filepath='mm/memory.c' line='2324' column='1'/>
+        <parameter type-id='7359adad' name='size' filepath='mm/memory.c' line='2324' column='1'/>
+        <parameter type-id='2e2dcbd3' name='prot' filepath='mm/memory.c' line='2324' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='remap_vmalloc_range' mangled-name='remap_vmalloc_range' filepath='include/linux/vmalloc.h' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_vmalloc_range'>
-        <parameter type-id='2ae08426'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='remap_vmalloc_range' mangled-name='remap_vmalloc_range' filepath='mm/vmalloc.c' line='3080' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_vmalloc_range'>
+        <parameter type-id='2ae08426' name='vma' filepath='mm/vmalloc.c' line='3080' column='1'/>
+        <parameter type-id='eaa32e2f' name='addr' filepath='mm/vmalloc.c' line='3080' column='1'/>
+        <parameter type-id='7359adad' name='pgoff' filepath='mm/vmalloc.c' line='3081' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='remove_cpu' mangled-name='remove_cpu' filepath='kernel/cpu.c' line='1144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_cpu'>
@@ -131323,9 +131147,9 @@
         <parameter type-id='91ce1af9' name='size' filepath='mm/memory_hotplug.c' line='1838' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='remove_proc_entry' mangled-name='remove_proc_entry' filepath='include/linux/proc_fs.h' line='115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_proc_entry'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='d077e928'/>
+      <function-decl name='remove_proc_entry' mangled-name='remove_proc_entry' filepath='fs/proc/generic.c' line='688' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_proc_entry'>
+        <parameter type-id='80f4b756' name='name' filepath='fs/proc/generic.c' line='688' column='1'/>
+        <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='688' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='remove_proc_subtree' mangled-name='remove_proc_subtree' filepath='fs/proc/generic.c' line='727' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_proc_subtree'>
@@ -131333,9 +131157,9 @@
         <parameter type-id='d077e928' name='parent' filepath='fs/proc/generic.c' line='727' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='remove_wait_queue' mangled-name='remove_wait_queue' filepath='include/linux/wait.h' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_wait_queue'>
-        <parameter type-id='3f8b2ed3'/>
-        <parameter type-id='db9d03e3'/>
+      <function-decl name='remove_wait_queue' mangled-name='remove_wait_queue' filepath='kernel/sched/wait.c' line='41' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remove_wait_queue'>
+        <parameter type-id='3f8b2ed3' name='wq_head' filepath='kernel/sched/wait.c' line='41' column='1'/>
+        <parameter type-id='db9d03e3' name='wq_entry' filepath='kernel/sched/wait.c' line='41' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='report_iommu_fault' mangled-name='report_iommu_fault' filepath='drivers/iommu/iommu.c' line='2710' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='report_iommu_fault'>
@@ -131383,13 +131207,13 @@
         <parameter type-id='c8e4e392' name='cont' filepath='drivers/base/firmware_loader/main.c' line='1114' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='request_threaded_irq' mangled-name='request_threaded_irq' filepath='include/linux/interrupt.h' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='request_threaded_irq'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='ff9465c8'/>
-        <parameter type-id='ff9465c8'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='request_threaded_irq' mangled-name='request_threaded_irq' filepath='kernel/irq/manage.c' line='2007' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='request_threaded_irq'>
+        <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='2007' column='1'/>
+        <parameter type-id='29591c9a' name='handler' filepath='kernel/irq/manage.c' line='2007' column='1'/>
+        <parameter type-id='29591c9a' name='thread_fn' filepath='kernel/irq/manage.c' line='2008' column='1'/>
+        <parameter type-id='7359adad' name='irqflags' filepath='kernel/irq/manage.c' line='2008' column='1'/>
+        <parameter type-id='80f4b756' name='devname' filepath='kernel/irq/manage.c' line='2009' column='1'/>
+        <parameter type-id='eaa32e2f' name='dev_id' filepath='kernel/irq/manage.c' line='2009' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='resched_curr' mangled-name='resched_curr' filepath='kernel/sched/core.c' line='626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='resched_curr'>
@@ -131397,28 +131221,28 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='reservation_ww_class' type-id='f0dc3c34' mangled-name='reservation_ww_class' visibility='default' filepath='drivers/dma-buf/dma-resv.c' line='52' column='1' elf-symbol-id='reservation_ww_class'/>
-      <function-decl name='reset_control_assert' mangled-name='reset_control_assert' filepath='include/linux/reset.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_control_assert'>
-        <parameter type-id='9f9b8114'/>
+      <function-decl name='reset_control_assert' mangled-name='reset_control_assert' filepath='drivers/reset/core.c' line='344' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_control_assert'>
+        <parameter type-id='9f9b8114' name='rstc' filepath='drivers/reset/core.c' line='344' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='reset_control_deassert' mangled-name='reset_control_deassert' filepath='include/linux/reset.h' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_control_deassert'>
-        <parameter type-id='9f9b8114'/>
+      <function-decl name='reset_control_deassert' mangled-name='reset_control_deassert' filepath='drivers/reset/core.c' line='402' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_control_deassert'>
+        <parameter type-id='9f9b8114' name='rstc' filepath='drivers/reset/core.c' line='402' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='reset_control_put' mangled-name='reset_control_put' filepath='include/linux/reset.h' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_control_put'>
-        <parameter type-id='9f9b8114'/>
+      <function-decl name='reset_control_put' mangled-name='reset_control_put' filepath='drivers/reset/core.c' line='762' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_control_put'>
+        <parameter type-id='9f9b8114' name='rstc' filepath='drivers/reset/core.c' line='762' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='reset_control_reset' mangled-name='reset_control_reset' filepath='drivers/reset/core.c' line='293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_control_reset'>
         <parameter type-id='9f9b8114' name='rstc' filepath='drivers/reset/core.c' line='293' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='reset_controller_register' mangled-name='reset_controller_register' filepath='include/linux/reset-controller.h' line='82' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_controller_register'>
-        <parameter type-id='775147d9'/>
+      <function-decl name='reset_controller_register' mangled-name='reset_controller_register' filepath='drivers/reset/core.c' line='99' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_controller_register'>
+        <parameter type-id='775147d9' name='rcdev' filepath='drivers/reset/core.c' line='99' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='reset_controller_unregister' mangled-name='reset_controller_unregister' filepath='include/linux/reset-controller.h' line='83' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_controller_unregister'>
-        <parameter type-id='775147d9'/>
+      <function-decl name='reset_controller_unregister' mangled-name='reset_controller_unregister' filepath='drivers/reset/core.c' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='reset_controller_unregister'>
+        <parameter type-id='775147d9' name='rcdev' filepath='drivers/reset/core.c' line='120' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='resume_cpus' mangled-name='resume_cpus' filepath='kernel/cpu.c' line='1297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='resume_cpus'>
@@ -131434,20 +131258,20 @@
         <parameter type-id='b50a4934' name='verbose' filepath='fs/block_dev.c' line='1368' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rfkill_alloc' mangled-name='rfkill_alloc' filepath='include/linux/rfkill.h' line='79' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_alloc'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='6bac1cb5'/>
-        <parameter type-id='6a6a70e7'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='rfkill_alloc' mangled-name='rfkill_alloc' filepath='net/rfkill/core.c' line='922' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_alloc'>
+        <parameter type-id='80f4b756' name='name' filepath='net/rfkill/core.c' line='922' column='1'/>
+        <parameter type-id='fa0b179b' name='parent' filepath='net/rfkill/core.c' line='923' column='1'/>
+        <parameter type-id='c3f0f7d9' name='type' filepath='net/rfkill/core.c' line='924' column='1'/>
+        <parameter type-id='6a6a70e7' name='ops' filepath='net/rfkill/core.c' line='925' column='1'/>
+        <parameter type-id='eaa32e2f' name='ops_data' filepath='net/rfkill/core.c' line='926' column='1'/>
         <return type-id='c5b94c75'/>
       </function-decl>
-      <function-decl name='rfkill_blocked' mangled-name='rfkill_blocked' filepath='include/linux/rfkill.h' line='215' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_blocked'>
-        <parameter type-id='c5b94c75'/>
-        <return type-id='c894953d'/>
+      <function-decl name='rfkill_blocked' mangled-name='rfkill_blocked' filepath='net/rfkill/core.c' line='908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_blocked'>
+        <parameter type-id='c5b94c75' name='rfkill' filepath='net/rfkill/core.c' line='908' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='rfkill_destroy' mangled-name='rfkill_destroy' filepath='include/linux/rfkill.h' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_destroy'>
-        <parameter type-id='c5b94c75'/>
+      <function-decl name='rfkill_destroy' mangled-name='rfkill_destroy' filepath='net/rfkill/core.c' line='1099' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_destroy'>
+        <parameter type-id='c5b94c75' name='rfkill' filepath='net/rfkill/core.c' line='1099' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rfkill_find_type' mangled-name='rfkill_find_type' filepath='net/rfkill/core.c' line='653' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_find_type'>
@@ -131463,8 +131287,8 @@
         <parameter type-id='c5b94c75' name='rfkill' filepath='net/rfkill/core.c' line='832' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rfkill_register' mangled-name='rfkill_register' filepath='include/linux/rfkill.h' line='100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_register'>
-        <parameter type-id='c5b94c75'/>
+      <function-decl name='rfkill_register' mangled-name='rfkill_register' filepath='net/rfkill/core.c' line='1005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_register'>
+        <parameter type-id='c5b94c75' name='rfkill' filepath='net/rfkill/core.c' line='1005' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rfkill_resume_polling' mangled-name='rfkill_resume_polling' filepath='net/rfkill/core.c' line='844' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_resume_polling'>
@@ -131481,8 +131305,8 @@
         <parameter type-id='b50a4934' name='blocked' filepath='net/rfkill/core.c' line='565' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='rfkill_unregister' mangled-name='rfkill_unregister' filepath='include/linux/rfkill.h' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_unregister'>
-        <parameter type-id='c5b94c75'/>
+      <function-decl name='rfkill_unregister' mangled-name='rfkill_unregister' filepath='net/rfkill/core.c' line='1075' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rfkill_unregister'>
+        <parameter type-id='c5b94c75' name='rfkill' filepath='net/rfkill/core.c' line='1075' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rhashtable_destroy' mangled-name='rhashtable_destroy' filepath='lib/rhashtable.c' line='1168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rhashtable_destroy'>
@@ -131495,15 +131319,15 @@
         <parameter type-id='eaa32e2f' name='arg' filepath='lib/rhashtable.c' line='1132' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rhashtable_init' mangled-name='rhashtable_init' filepath='include/linux/rhashtable-types.h' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rhashtable_init'>
-        <parameter type-id='e6726ce3'/>
-        <parameter type-id='44dbf2cd'/>
+      <function-decl name='rhashtable_init' mangled-name='rhashtable_init' filepath='lib/rhashtable.c' line='1015' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rhashtable_init'>
+        <parameter type-id='e6726ce3' name='ht' filepath='lib/rhashtable.c' line='1015' column='1'/>
+        <parameter type-id='44dbf2cd' name='params' filepath='lib/rhashtable.c' line='1016' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rhashtable_insert_slow' mangled-name='rhashtable_insert_slow' filepath='include/linux/rhashtable.h' line='242' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rhashtable_insert_slow'>
-        <parameter type-id='e6726ce3'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='3cc8739a'/>
+      <function-decl name='rhashtable_insert_slow' mangled-name='rhashtable_insert_slow' filepath='lib/rhashtable.c' line='629' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rhashtable_insert_slow'>
+        <parameter type-id='e6726ce3' name='ht' filepath='lib/rhashtable.c' line='629' column='1'/>
+        <parameter type-id='eaa32e2f' name='key' filepath='lib/rhashtable.c' line='629' column='1'/>
+        <parameter type-id='3cc8739a' name='obj' filepath='lib/rhashtable.c' line='630' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='rhltable_init' mangled-name='rhltable_init' filepath='lib/rhashtable.c' line='1086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rhltable_init'>
@@ -131511,39 +131335,39 @@
         <parameter type-id='44dbf2cd' name='params' filepath='lib/rhashtable.c' line='1086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rht_bucket_nested' mangled-name='rht_bucket_nested' filepath='include/linux/rhashtable.h' line='264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rht_bucket_nested'>
-        <parameter type-id='6a4a6779'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='rht_bucket_nested' mangled-name='rht_bucket_nested' filepath='lib/rhashtable.c' line='1203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rht_bucket_nested'>
+        <parameter type-id='6a4a6779' name='tbl' filepath='lib/rhashtable.c' line='1204' column='1'/>
+        <parameter type-id='f0981eeb' name='hash' filepath='lib/rhashtable.c' line='1204' column='1'/>
         <return type-id='33f7eff4'/>
       </function-decl>
-      <function-decl name='rht_bucket_nested_insert' mangled-name='rht_bucket_nested_insert' filepath='include/linux/rhashtable.h' line='268' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rht_bucket_nested_insert'>
-        <parameter type-id='e6726ce3'/>
-        <parameter type-id='35e7a722'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='rht_bucket_nested_insert' mangled-name='rht_bucket_nested_insert' filepath='lib/rhashtable.c' line='1214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rht_bucket_nested_insert'>
+        <parameter type-id='e6726ce3' name='ht' filepath='lib/rhashtable.c' line='1215' column='1'/>
+        <parameter type-id='35e7a722' name='tbl' filepath='lib/rhashtable.c' line='1215' column='1'/>
+        <parameter type-id='f0981eeb' name='hash' filepath='lib/rhashtable.c' line='1215' column='1'/>
         <return type-id='33f7eff4'/>
       </function-decl>
-      <function-decl name='rndis_deregister' mangled-name='rndis_deregister' filepath='drivers/usb/gadget/function/rndis.h' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_deregister'>
-        <parameter type-id='7c184d88'/>
+      <function-decl name='rndis_deregister' mangled-name='rndis_deregister' filepath='drivers/usb/gadget/function/rndis.c' line='928' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_deregister'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='928' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rndis_free_response' mangled-name='rndis_free_response' filepath='drivers/usb/gadget/function/rndis.h' line='193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_free_response'>
-        <parameter type-id='7c184d88'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='rndis_free_response' mangled-name='rndis_free_response' filepath='drivers/usb/gadget/function/rndis.c' line='1011' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_free_response'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='1011' column='1'/>
+        <parameter type-id='8bff8096' name='buf' filepath='drivers/usb/gadget/function/rndis.c' line='1011' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rndis_get_next_response' mangled-name='rndis_get_next_response' filepath='drivers/usb/gadget/function/rndis.h' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_get_next_response'>
-        <parameter type-id='7c184d88'/>
-        <parameter type-id='807869d3'/>
-        <return type-id='cf536864'/>
+      <function-decl name='rndis_get_next_response' mangled-name='rndis_get_next_response' filepath='drivers/usb/gadget/function/rndis.c' line='1024' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_get_next_response'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='1024' column='1'/>
+        <parameter type-id='f9409001' name='length' filepath='drivers/usb/gadget/function/rndis.c' line='1024' column='1'/>
+        <return type-id='8bff8096'/>
       </function-decl>
-      <function-decl name='rndis_msg_parser' mangled-name='rndis_msg_parser' filepath='drivers/usb/gadget/function/rndis.h' line='180' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_msg_parser'>
-        <parameter type-id='7c184d88'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='rndis_msg_parser' mangled-name='rndis_msg_parser' filepath='drivers/usb/gadget/function/rndis.c' line='787' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_msg_parser'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='787' column='1'/>
+        <parameter type-id='8bff8096' name='buf' filepath='drivers/usb/gadget/function/rndis.c' line='787' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rndis_register' mangled-name='rndis_register' filepath='drivers/usb/gadget/function/rndis.h' line='181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_register'>
-        <parameter type-id='b7f9d8e6'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='rndis_register' mangled-name='rndis_register' filepath='drivers/usb/gadget/function/rndis.c' line='876' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_register'>
+        <parameter type-id='b7f9d8e6' name='resp_avail' filepath='drivers/usb/gadget/function/rndis.c' line='876' column='1'/>
+        <parameter type-id='eaa32e2f' name='v' filepath='drivers/usb/gadget/function/rndis.c' line='876' column='1'/>
         <return type-id='7c184d88'/>
       </function-decl>
       <function-decl name='rndis_set_host_mac' mangled-name='rndis_set_host_mac' filepath='drivers/usb/gadget/function/rndis.c' line='778' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_set_host_mac'>
@@ -131551,30 +131375,30 @@
         <parameter type-id='bbaf3419' name='addr' filepath='drivers/usb/gadget/function/rndis.c' line='778' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rndis_set_param_dev' mangled-name='rndis_set_param_dev' filepath='drivers/usb/gadget/function/rndis.h' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_set_param_dev'>
-        <parameter type-id='7c184d88'/>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='e9e550dd'/>
+      <function-decl name='rndis_set_param_dev' mangled-name='rndis_set_param_dev' filepath='drivers/usb/gadget/function/rndis.c' line='952' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_set_param_dev'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='952' column='1'/>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/usb/gadget/function/rndis.c' line='952' column='1'/>
+        <parameter type-id='26d4d46f' name='cdc_filter' filepath='drivers/usb/gadget/function/rndis.c' line='953' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rndis_set_param_medium' mangled-name='rndis_set_param_medium' filepath='drivers/usb/gadget/function/rndis.h' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_set_param_medium'>
-        <parameter type-id='7c184d88'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='rndis_set_param_medium' mangled-name='rndis_set_param_medium' filepath='drivers/usb/gadget/function/rndis.c' line='983' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_set_param_medium'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='983' column='1'/>
+        <parameter type-id='19c2251e' name='medium' filepath='drivers/usb/gadget/function/rndis.c' line='983' column='1'/>
+        <parameter type-id='19c2251e' name='speed' filepath='drivers/usb/gadget/function/rndis.c' line='983' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rndis_set_param_vendor' mangled-name='rndis_set_param_vendor' filepath='drivers/usb/gadget/function/rndis.h' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_set_param_vendor'>
-        <parameter type-id='7c184d88'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='rndis_set_param_vendor' mangled-name='rndis_set_param_vendor' filepath='drivers/usb/gadget/function/rndis.c' line='968' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_set_param_vendor'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='968' column='1'/>
+        <parameter type-id='19c2251e' name='vendorID' filepath='drivers/usb/gadget/function/rndis.c' line='968' column='1'/>
+        <parameter type-id='80f4b756' name='vendorDescr' filepath='drivers/usb/gadget/function/rndis.c' line='969' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rndis_signal_connect' mangled-name='rndis_signal_connect' filepath='drivers/usb/gadget/function/rndis.h' line='196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_signal_connect'>
-        <parameter type-id='7c184d88'/>
+      <function-decl name='rndis_signal_connect' mangled-name='rndis_signal_connect' filepath='drivers/usb/gadget/function/rndis.c' line='749' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_signal_connect'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='749' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rndis_uninit' mangled-name='rndis_uninit' filepath='drivers/usb/gadget/function/rndis.h' line='195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_uninit'>
-        <parameter type-id='7c184d88'/>
+      <function-decl name='rndis_uninit' mangled-name='rndis_uninit' filepath='drivers/usb/gadget/function/rndis.c' line='763' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rndis_uninit'>
+        <parameter type-id='7c184d88' name='params' filepath='drivers/usb/gadget/function/rndis.c' line='763' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='root_task_group' type-id='2d863538' mangled-name='root_task_group' visibility='default' filepath='kernel/sched/core.c' line='7413' column='1' elf-symbol-id='root_task_group'/>
@@ -131701,8 +131525,8 @@
         <parameter type-id='b59d7dce' name='size' filepath='drivers/remoteproc/remoteproc_coredump.c' line='48' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rproc_coredump_cleanup' mangled-name='rproc_coredump_cleanup' filepath='include/linux/remoteproc.h' line='663' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rproc_coredump_cleanup'>
-        <parameter type-id='5771c601'/>
+      <function-decl name='rproc_coredump_cleanup' mangled-name='rproc_coredump_cleanup' filepath='drivers/remoteproc/remoteproc_coredump.c' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rproc_coredump_cleanup'>
+        <parameter type-id='5771c601' name='rproc' filepath='drivers/remoteproc/remoteproc_coredump.c' line='26' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rproc_coredump_set_elf_info' mangled-name='rproc_coredump_set_elf_info' filepath='drivers/remoteproc/remoteproc_coredump.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rproc_coredump_set_elf_info'>
@@ -131821,12 +131645,12 @@
         <parameter type-id='3992a90f' name='lock' filepath='kernel/locking/rtmutex.c' line='1602' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rtc_class_close' mangled-name='rtc_class_close' filepath='include/linux/rtc.h' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_class_close'>
-        <parameter type-id='5992ae83'/>
+      <function-decl name='rtc_class_close' mangled-name='rtc_class_close' filepath='drivers/rtc/interface.c' line='717' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_class_close'>
+        <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/interface.c' line='717' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rtc_class_open' mangled-name='rtc_class_open' filepath='include/linux/rtc.h' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_class_open'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='rtc_class_open' mangled-name='rtc_class_open' filepath='drivers/rtc/interface.c' line='697' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_class_open'>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/rtc/interface.c' line='697' column='1'/>
         <return type-id='5992ae83'/>
       </function-decl>
       <function-decl name='rtc_ktime_to_tm' mangled-name='rtc_ktime_to_tm' filepath='drivers/rtc/lib.c' line='134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_ktime_to_tm'>
@@ -131838,14 +131662,14 @@
         <parameter type-id='d06e7441' name='nvmem_config' filepath='drivers/rtc/nvmem.c' line='81' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rtc_read_time' mangled-name='rtc_read_time' filepath='include/linux/rtc.h' line='171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_read_time'>
-        <parameter type-id='5992ae83'/>
-        <parameter type-id='2b8e7a42'/>
+      <function-decl name='rtc_read_time' mangled-name='rtc_read_time' filepath='drivers/rtc/interface.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_read_time'>
+        <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/interface.c' line='110' column='1'/>
+        <parameter type-id='2b8e7a42' name='tm' filepath='drivers/rtc/interface.c' line='110' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rtc_set_time' mangled-name='rtc_set_time' filepath='include/linux/rtc.h' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_set_time'>
-        <parameter type-id='5992ae83'/>
-        <parameter type-id='2b8e7a42'/>
+      <function-decl name='rtc_set_time' mangled-name='rtc_set_time' filepath='drivers/rtc/interface.c' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_set_time'>
+        <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/interface.c' line='126' column='1'/>
+        <parameter type-id='2b8e7a42' name='tm' filepath='drivers/rtc/interface.c' line='126' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rtc_time64_to_tm' mangled-name='rtc_time64_to_tm' filepath='drivers/rtc/lib.c' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_time64_to_tm'>
@@ -131853,9 +131677,9 @@
         <parameter type-id='2b8e7a42' name='tm' filepath='drivers/rtc/lib.c' line='49' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='rtc_tm_to_ktime' mangled-name='rtc_tm_to_ktime' filepath='include/linux/rtc.h' line='27' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_tm_to_ktime'>
-        <parameter type-id='fa8285d4'/>
-        <return type-id='1eb56b1e'/>
+      <function-decl name='rtc_tm_to_ktime' mangled-name='rtc_tm_to_ktime' filepath='drivers/rtc/lib.c' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_tm_to_ktime'>
+        <parameter type-id='fa8285d4' name='tm' filepath='drivers/rtc/lib.c' line='125' column='1'/>
+        <return type-id='fbc017ef'/>
       </function-decl>
       <function-decl name='rtc_tm_to_time64' mangled-name='rtc_tm_to_time64' filepath='drivers/rtc/lib.c' line='115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_tm_to_time64'>
         <parameter type-id='2b8e7a42' name='tm' filepath='drivers/rtc/lib.c' line='115' column='1'/>
@@ -131880,12 +131704,12 @@
       <function-decl name='rtnl_is_locked' mangled-name='rtnl_is_locked' filepath='net/core/rtnetlink.c' line='122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_is_locked'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rtnl_link_register' mangled-name='rtnl_link_register' filepath='include/net/rtnetlink.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_link_register'>
-        <parameter type-id='959ab461'/>
+      <function-decl name='rtnl_link_register' mangled-name='rtnl_link_register' filepath='net/core/rtnetlink.c' line='396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_link_register'>
+        <parameter type-id='959ab461' name='ops' filepath='net/core/rtnetlink.c' line='396' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rtnl_link_unregister' mangled-name='rtnl_link_unregister' filepath='include/net/rtnetlink.h' line='121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_link_unregister'>
-        <parameter type-id='959ab461'/>
+      <function-decl name='rtnl_link_unregister' mangled-name='rtnl_link_unregister' filepath='net/core/rtnetlink.c' line='478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_link_unregister'>
+        <parameter type-id='959ab461' name='ops' filepath='net/core/rtnetlink.c' line='478' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='rtnl_lock' mangled-name='rtnl_lock' filepath='net/core/rtnetlink.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_lock'>
@@ -131903,10 +131727,10 @@
       <function-decl name='rtnl_trylock' mangled-name='rtnl_trylock' filepath='net/core/rtnetlink.c' line='116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_trylock'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='rtnl_unicast' mangled-name='rtnl_unicast' filepath='include/linux/rtnetlink.h' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_unicast'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='rtnl_unicast' mangled-name='rtnl_unicast' filepath='net/core/rtnetlink.c' line='720' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_unicast'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/rtnetlink.c' line='720' column='1'/>
+        <parameter type-id='a2bff676' name='net' filepath='net/core/rtnetlink.c' line='720' column='1'/>
+        <parameter type-id='19c2251e' name='pid' filepath='net/core/rtnetlink.c' line='720' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='rtnl_unlock' mangled-name='rtnl_unlock' filepath='net/core/rtnetlink.c' line='109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtnl_unlock'>
@@ -131923,62 +131747,62 @@
         <parameter type-id='95e97e5e' name='on' filepath='drivers/usb/host/pci-quirks.c' line='194' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sbitmap_add_wait_queue' mangled-name='sbitmap_add_wait_queue' filepath='include/linux/sbitmap.h' line='574' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_add_wait_queue'>
-        <parameter type-id='75396bad'/>
-        <parameter type-id='cdff193b'/>
-        <parameter type-id='2c01b31d'/>
+      <function-decl name='sbitmap_add_wait_queue' mangled-name='sbitmap_add_wait_queue' filepath='lib/sbitmap.c' line='649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_add_wait_queue'>
+        <parameter type-id='75396bad' name='sbq' filepath='lib/sbitmap.c' line='649' column='1'/>
+        <parameter type-id='cdff193b' name='ws' filepath='lib/sbitmap.c' line='650' column='1'/>
+        <parameter type-id='2c01b31d' name='sbq_wait' filepath='lib/sbitmap.c' line='651' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sbitmap_any_bit_set' mangled-name='sbitmap_any_bit_set' filepath='include/linux/sbitmap.h' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_any_bit_set'>
-        <parameter type-id='24e47bfc'/>
-        <return type-id='c894953d'/>
+      <function-decl name='sbitmap_any_bit_set' mangled-name='sbitmap_any_bit_set' filepath='lib/sbitmap.c' line='227' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_any_bit_set'>
+        <parameter type-id='24e47bfc' name='sb' filepath='lib/sbitmap.c' line='227' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='sbitmap_del_wait_queue' mangled-name='sbitmap_del_wait_queue' filepath='include/linux/sbitmap.h' line='581' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_del_wait_queue'>
-        <parameter type-id='2c01b31d'/>
+      <function-decl name='sbitmap_del_wait_queue' mangled-name='sbitmap_del_wait_queue' filepath='lib/sbitmap.c' line='661' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_del_wait_queue'>
+        <parameter type-id='2c01b31d' name='sbq_wait' filepath='lib/sbitmap.c' line='661' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sbitmap_init_node' mangled-name='sbitmap_init_node' filepath='include/linux/sbitmap.h' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_init_node'>
-        <parameter type-id='56033689'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='sbitmap_init_node' mangled-name='sbitmap_init_node' filepath='lib/sbitmap.c' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_init_node'>
+        <parameter type-id='56033689' name='sb' filepath='lib/sbitmap.c' line='44' column='1'/>
+        <parameter type-id='f0981eeb' name='depth' filepath='lib/sbitmap.c' line='44' column='1'/>
+        <parameter type-id='95e97e5e' name='shift' filepath='lib/sbitmap.c' line='44' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='lib/sbitmap.c' line='45' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='lib/sbitmap.c' line='45' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sbitmap_queue_clear' mangled-name='sbitmap_queue_clear' filepath='include/linux/sbitmap.h' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_clear'>
-        <parameter type-id='75396bad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sbitmap_queue_clear' mangled-name='sbitmap_queue_clear' filepath='lib/sbitmap.c' line='562' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_clear'>
+        <parameter type-id='75396bad' name='sbq' filepath='lib/sbitmap.c' line='562' column='1'/>
+        <parameter type-id='f0981eeb' name='nr' filepath='lib/sbitmap.c' line='562' column='1'/>
+        <parameter type-id='f0981eeb' name='cpu' filepath='lib/sbitmap.c' line='563' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sbitmap_queue_init_node' mangled-name='sbitmap_queue_init_node' filepath='include/linux/sbitmap.h' line='366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_init_node'>
-        <parameter type-id='75396bad'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='sbitmap_queue_init_node' mangled-name='sbitmap_queue_init_node' filepath='lib/sbitmap.c' line='355' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_init_node'>
+        <parameter type-id='75396bad' name='sbq' filepath='lib/sbitmap.c' line='355' column='1'/>
+        <parameter type-id='f0981eeb' name='depth' filepath='lib/sbitmap.c' line='355' column='1'/>
+        <parameter type-id='95e97e5e' name='shift' filepath='lib/sbitmap.c' line='356' column='1'/>
+        <parameter type-id='b50a4934' name='round_robin' filepath='lib/sbitmap.c' line='356' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='lib/sbitmap.c' line='356' column='1'/>
+        <parameter type-id='95e97e5e' name='node' filepath='lib/sbitmap.c' line='356' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sbitmap_queue_min_shallow_depth' mangled-name='sbitmap_queue_min_shallow_depth' filepath='include/linux/sbitmap.h' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_min_shallow_depth'>
-        <parameter type-id='75396bad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sbitmap_queue_min_shallow_depth' mangled-name='sbitmap_queue_min_shallow_depth' filepath='lib/sbitmap.c' line='483' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_min_shallow_depth'>
+        <parameter type-id='75396bad' name='sbq' filepath='lib/sbitmap.c' line='483' column='1'/>
+        <parameter type-id='f0981eeb' name='min_shallow_depth' filepath='lib/sbitmap.c' line='484' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sbitmap_queue_resize' mangled-name='sbitmap_queue_resize' filepath='include/linux/sbitmap.h' line='390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_resize'>
-        <parameter type-id='75396bad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sbitmap_queue_resize' mangled-name='sbitmap_queue_resize' filepath='lib/sbitmap.c' line='417' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_resize'>
+        <parameter type-id='75396bad' name='sbq' filepath='lib/sbitmap.c' line='417' column='1'/>
+        <parameter type-id='f0981eeb' name='depth' filepath='lib/sbitmap.c' line='417' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sbitmap_queue_show' mangled-name='sbitmap_queue_show' filepath='include/linux/sbitmap.h' line='540' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_show'>
-        <parameter type-id='75396bad'/>
-        <parameter type-id='f8dc9def'/>
+      <function-decl name='sbitmap_queue_show' mangled-name='sbitmap_queue_show' filepath='lib/sbitmap.c' line='613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sbitmap_queue_show'>
+        <parameter type-id='75396bad' name='sbq' filepath='lib/sbitmap.c' line='613' column='1'/>
+        <parameter type-id='f8dc9def' name='m' filepath='lib/sbitmap.c' line='613' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='scatterwalk_ffwd' mangled-name='scatterwalk_ffwd' filepath='include/crypto/scatterwalk.h' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scatterwalk_ffwd'>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='scatterwalk_ffwd' mangled-name='scatterwalk_ffwd' filepath='crypto/scatterwalk.c' line='72' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scatterwalk_ffwd'>
+        <parameter type-id='bf3ef905' name='dst' filepath='crypto/scatterwalk.c' line='72' column='1'/>
+        <parameter type-id='bf3ef905' name='src' filepath='crypto/scatterwalk.c' line='73' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='crypto/scatterwalk.c' line='74' column='1'/>
         <return type-id='bf3ef905'/>
       </function-decl>
       <function-decl name='scatterwalk_map_and_copy' mangled-name='scatterwalk_map_and_copy' filepath='crypto/scatterwalk.c' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scatterwalk_map_and_copy'>
@@ -131989,7 +131813,7 @@
         <parameter type-id='95e97e5e' name='out' filepath='crypto/scatterwalk.c' line='56' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sched_clock' mangled-name='sched_clock' filepath='include/linux/sched/clock.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_clock'>
+      <function-decl name='sched_clock' mangled-name='sched_clock' filepath='kernel/time/sched_clock.c' line='83' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_clock'>
         <return type-id='3a47d82b'/>
       </function-decl>
       <var-decl name='sched_feat_keys' type-id='9cc39ce1' mangled-name='sched_feat_keys' visibility='default' filepath='kernel/sched/debug.c' line='80' column='1' elf-symbol-id='sched_feat_keys'/>
@@ -132023,10 +131847,10 @@
         <parameter type-id='36fca399' name='param' filepath='kernel/sched/core.c' line='5737' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sched_setscheduler_nocheck' mangled-name='sched_setscheduler_nocheck' filepath='include/linux/sched.h' line='1739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setscheduler_nocheck'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='36fca399'/>
+      <function-decl name='sched_setscheduler_nocheck' mangled-name='sched_setscheduler_nocheck' filepath='kernel/sched/core.c' line='5768' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_setscheduler_nocheck'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5768' column='1'/>
+        <parameter type-id='95e97e5e' name='policy' filepath='kernel/sched/core.c' line='5768' column='1'/>
+        <parameter type-id='36fca399' name='param' filepath='kernel/sched/core.c' line='5769' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sched_show_task' mangled-name='sched_show_task' filepath='kernel/sched/core.c' line='6667' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sched_show_task'>
@@ -132068,7 +131892,7 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='sched_uclamp_used' type-id='237c0d27' mangled-name='sched_uclamp_used' visibility='default' filepath='kernel/sched/core.c' line='966' column='1' elf-symbol-id='sched_uclamp_used'/>
-      <function-decl name='schedule' mangled-name='schedule' filepath='include/linux/sched.h' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule'>
+      <function-decl name='schedule' mangled-name='schedule' filepath='kernel/sched/core.c' line='4844' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='schedule_hrtimeout' mangled-name='schedule_hrtimeout' filepath='kernel/time/hrtimer.c' line='2279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule_hrtimeout'>
@@ -132076,34 +131900,34 @@
         <parameter type-id='9bedc94f' name='mode' filepath='kernel/time/hrtimer.c' line='2280' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='schedule_timeout' mangled-name='schedule_timeout' filepath='include/linux/sched.h' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule_timeout'>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='schedule_timeout' mangled-name='schedule_timeout' filepath='kernel/time/timer.c' line='1841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule_timeout'>
+        <parameter type-id='bd54fe1a' name='timeout' filepath='kernel/time/timer.c' line='1841' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='schedule_timeout_interruptible' mangled-name='schedule_timeout_interruptible' filepath='include/linux/sched.h' line='222' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule_timeout_interruptible'>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='schedule_timeout_interruptible' mangled-name='schedule_timeout_interruptible' filepath='kernel/time/timer.c' line='1897' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule_timeout_interruptible'>
+        <parameter type-id='bd54fe1a' name='timeout' filepath='kernel/time/timer.c' line='1897' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='schedule_timeout_uninterruptible' mangled-name='schedule_timeout_uninterruptible' filepath='include/linux/sched.h' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule_timeout_uninterruptible'>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='schedule_timeout_uninterruptible' mangled-name='schedule_timeout_uninterruptible' filepath='kernel/time/timer.c' line='1911' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedule_timeout_uninterruptible'>
+        <parameter type-id='bd54fe1a' name='timeout' filepath='kernel/time/timer.c' line='1911' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='schedutil_cpu_util' mangled-name='schedutil_cpu_util' filepath='kernel/sched/sched.h' line='2585' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedutil_cpu_util'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='8769acd0'/>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='schedutil_cpu_util' mangled-name='schedutil_cpu_util' filepath='kernel/sched/cpufreq_schedutil.c' line='202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='schedutil_cpu_util'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/sched/cpufreq_schedutil.c' line='202' column='1'/>
+        <parameter type-id='7359adad' name='util_cfs' filepath='kernel/sched/cpufreq_schedutil.c' line='202' column='1'/>
+        <parameter type-id='7359adad' name='max' filepath='kernel/sched/cpufreq_schedutil.c' line='203' column='1'/>
+        <parameter type-id='8769acd0' name='type' filepath='kernel/sched/cpufreq_schedutil.c' line='203' column='1'/>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/cpufreq_schedutil.c' line='204' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='scmi_driver_register' mangled-name='scmi_driver_register' filepath='include/linux/scmi_protocol.h' line='699' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scmi_driver_register'>
-        <parameter type-id='7f2f8862'/>
-        <parameter type-id='2730d015'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='scmi_driver_register' mangled-name='scmi_driver_register' filepath='drivers/firmware/arm_scmi/bus.c' line='137' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scmi_driver_register'>
+        <parameter type-id='7f2f8862' name='driver' filepath='drivers/firmware/arm_scmi/bus.c' line='137' column='1'/>
+        <parameter type-id='2730d015' name='owner' filepath='drivers/firmware/arm_scmi/bus.c' line='137' column='1'/>
+        <parameter type-id='80f4b756' name='mod_name' filepath='drivers/firmware/arm_scmi/bus.c' line='138' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='scmi_driver_unregister' mangled-name='scmi_driver_unregister' filepath='include/linux/scmi_protocol.h' line='701' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scmi_driver_unregister'>
-        <parameter type-id='7f2f8862'/>
+      <function-decl name='scmi_driver_unregister' mangled-name='scmi_driver_unregister' filepath='drivers/firmware/arm_scmi/bus.c' line='162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scmi_driver_unregister'>
+        <parameter type-id='7f2f8862' name='driver' filepath='drivers/firmware/arm_scmi/bus.c' line='162' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='scmi_protocol_register' mangled-name='scmi_protocol_register' filepath='drivers/firmware/arm_scmi/bus.c' line='231' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scmi_protocol_register'>
@@ -132114,10 +131938,10 @@
         <parameter type-id='fb7f0749' name='proto' filepath='drivers/firmware/arm_scmi/bus.c' line='261' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='scnprintf' mangled-name='scnprintf' filepath='include/linux/kernel.h' line='483' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scnprintf'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='scnprintf' mangled-name='scnprintf' filepath='lib/vsprintf.c' line='2827' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scnprintf'>
+        <parameter type-id='26a90f95' name='buf' filepath='lib/vsprintf.c' line='2827' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/vsprintf.c' line='2827' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/vsprintf.c' line='2827' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -132127,8 +131951,8 @@
         <parameter type-id='fa0b179b' name='dma_dev' filepath='drivers/scsi/hosts.c' line='209' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='scsi_autopm_get_device' mangled-name='scsi_autopm_get_device' filepath='include/scsi/scsi_device.h' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_autopm_get_device'>
-        <parameter type-id='eb572b74'/>
+      <function-decl name='scsi_autopm_get_device' mangled-name='scsi_autopm_get_device' filepath='drivers/scsi/scsi_pm.c' line='298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_autopm_get_device'>
+        <parameter type-id='eb572b74' name='sdev' filepath='drivers/scsi/scsi_pm.c' line='298' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='scsi_autopm_put_device' mangled-name='scsi_autopm_put_device' filepath='drivers/scsi/scsi_pm.c' line='311' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_autopm_put_device'>
@@ -132139,8 +131963,8 @@
         <parameter type-id='a970a64c' name='shost' filepath='drivers/scsi/scsi_lib.c' line='1957' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='scsi_block_when_processing_errors' mangled-name='scsi_block_when_processing_errors' filepath='include/scsi/scsi_eh.h' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_block_when_processing_errors'>
-        <parameter type-id='eb572b74'/>
+      <function-decl name='scsi_block_when_processing_errors' mangled-name='scsi_block_when_processing_errors' filepath='drivers/scsi/scsi_error.c' line='342' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_block_when_processing_errors'>
+        <parameter type-id='eb572b74' name='sdev' filepath='drivers/scsi/scsi_error.c' line='342' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='scsi_change_queue_depth' mangled-name='scsi_change_queue_depth' filepath='drivers/scsi/scsi.c' line='224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_change_queue_depth'>
@@ -132178,8 +132002,8 @@
         <parameter type-id='0b8718c0' name='cmd' filepath='drivers/scsi/scsi_lib_dma.c' line='23' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='scsi_dma_unmap' mangled-name='scsi_dma_unmap' filepath='include/scsi/scsi_cmnd.h' line='179' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_dma_unmap'>
-        <parameter type-id='0b8718c0'/>
+      <function-decl name='scsi_dma_unmap' mangled-name='scsi_dma_unmap' filepath='drivers/scsi/scsi_lib_dma.c' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_dma_unmap'>
+        <parameter type-id='0b8718c0' name='cmd' filepath='drivers/scsi/scsi_lib_dma.c' line='43' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='scsi_eh_ready_devs' mangled-name='scsi_eh_ready_devs' filepath='drivers/scsi/scsi_error.c' line='2083' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_eh_ready_devs'>
@@ -132217,14 +132041,14 @@
         <parameter type-id='8df61054' name='dev' filepath='drivers/scsi/hosts.c' line='617' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='scsi_normalize_sense' mangled-name='scsi_normalize_sense' filepath='include/scsi/scsi_common.h' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_normalize_sense'>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='991b8213'/>
-        <return type-id='c894953d'/>
+      <function-decl name='scsi_normalize_sense' mangled-name='scsi_normalize_sense' filepath='drivers/scsi/scsi_common.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_normalize_sense'>
+        <parameter type-id='bbaf3419' name='sense_buffer' filepath='drivers/scsi/scsi_common.c' line='138' column='1'/>
+        <parameter type-id='95e97e5e' name='sb_len' filepath='drivers/scsi/scsi_common.c' line='138' column='1'/>
+        <parameter type-id='991b8213' name='sshdr' filepath='drivers/scsi/scsi_common.c' line='139' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='scsi_print_command' mangled-name='scsi_print_command' filepath='include/scsi/scsi_dbg.h' line='9' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_print_command'>
-        <parameter type-id='0b8718c0'/>
+      <function-decl name='scsi_print_command' mangled-name='scsi_print_command' filepath='drivers/scsi/scsi_logging.c' line='177' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_print_command'>
+        <parameter type-id='0b8718c0' name='cmd' filepath='drivers/scsi/scsi_logging.c' line='177' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='scsi_print_sense_hdr' mangled-name='scsi_print_sense_hdr' filepath='drivers/scsi/scsi_logging.c' line='358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_print_sense_hdr'>
@@ -132258,11 +132082,11 @@
         <parameter type-id='a970a64c' name='shost' filepath='drivers/scsi/scsi_lib.c' line='1973' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sdev_prefix_printk' mangled-name='sdev_prefix_printk' filepath='include/scsi/scsi_device.h' line='265' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdev_prefix_printk'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='0f176ec1'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='sdev_prefix_printk' mangled-name='sdev_prefix_printk' filepath='drivers/scsi/scsi_logging.c' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdev_prefix_printk'>
+        <parameter type-id='80f4b756' name='level' filepath='drivers/scsi/scsi_logging.c' line='53' column='1'/>
+        <parameter type-id='0f176ec1' name='sdev' filepath='drivers/scsi/scsi_logging.c' line='53' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/scsi/scsi_logging.c' line='54' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='drivers/scsi/scsi_logging.c' line='54' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
@@ -132374,21 +132198,21 @@
         <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='3664' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sdio_claim_host' mangled-name='sdio_claim_host' filepath='include/linux/mmc/sdio_func.h' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_claim_host'>
-        <parameter type-id='c1880945'/>
+      <function-decl name='sdio_claim_host' mangled-name='sdio_claim_host' filepath='drivers/mmc/core/sdio_io.c' line='27' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_claim_host'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='27' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sdio_claim_irq' mangled-name='sdio_claim_irq' filepath='include/linux/mmc/sdio_func.h' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_claim_irq'>
-        <parameter type-id='c1880945'/>
-        <parameter type-id='11124634'/>
+      <function-decl name='sdio_claim_irq' mangled-name='sdio_claim_irq' filepath='drivers/mmc/core/sdio_irq.c' line='299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_claim_irq'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_irq.c' line='299' column='1'/>
+        <parameter type-id='1d186b8b' name='handler' filepath='drivers/mmc/core/sdio_irq.c' line='299' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sdio_disable_func' mangled-name='sdio_disable_func' filepath='include/linux/mmc/sdio_func.h' line='131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_disable_func'>
-        <parameter type-id='c1880945'/>
+      <function-decl name='sdio_disable_func' mangled-name='sdio_disable_func' filepath='drivers/mmc/core/sdio_io.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_disable_func'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='110' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sdio_enable_func' mangled-name='sdio_enable_func' filepath='include/linux/mmc/sdio_func.h' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_enable_func'>
-        <parameter type-id='c1880945'/>
+      <function-decl name='sdio_enable_func' mangled-name='sdio_enable_func' filepath='drivers/mmc/core/sdio_io.c' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_enable_func'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='59' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sdio_f0_readb' mangled-name='sdio_f0_readb' filepath='drivers/mmc/core/sdio_io.c' line='631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_f0_readb'>
@@ -132422,11 +132246,11 @@
         <parameter type-id='95e97e5e' name='count' filepath='drivers/mmc/core/sdio_io.c' line='486' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sdio_readb' mangled-name='sdio_readb' filepath='include/linux/mmc/sdio_func.h' line='140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_readb'>
-        <parameter type-id='c1880945'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7292109c'/>
-        <return type-id='002ac4a6'/>
+      <function-decl name='sdio_readb' mangled-name='sdio_readb' filepath='drivers/mmc/core/sdio_io.c' line='380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_readb'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='380' column='1'/>
+        <parameter type-id='f0981eeb' name='addr' filepath='drivers/mmc/core/sdio_io.c' line='380' column='1'/>
+        <parameter type-id='7292109c' name='err_ret' filepath='drivers/mmc/core/sdio_io.c' line='380' column='1'/>
+        <return type-id='f9b06939'/>
       </function-decl>
       <function-decl name='sdio_readl' mangled-name='sdio_readl' filepath='drivers/mmc/core/sdio_io.c' line='584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_readl'>
         <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='584' column='1'/>
@@ -132441,21 +132265,21 @@
         <parameter type-id='95e97e5e' name='count' filepath='drivers/mmc/core/sdio_io.c' line='503' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sdio_register_driver' mangled-name='sdio_register_driver' filepath='include/linux/mmc/sdio_func.h' line='109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_register_driver'>
-        <parameter type-id='710bea3d'/>
+      <function-decl name='sdio_register_driver' mangled-name='sdio_register_driver' filepath='drivers/mmc/core/sdio_bus.c' line='272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_register_driver'>
+        <parameter type-id='710bea3d' name='drv' filepath='drivers/mmc/core/sdio_bus.c' line='272' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sdio_release_host' mangled-name='sdio_release_host' filepath='include/linux/mmc/sdio_func.h' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_release_host'>
-        <parameter type-id='c1880945'/>
+      <function-decl name='sdio_release_host' mangled-name='sdio_release_host' filepath='drivers/mmc/core/sdio_io.c' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_release_host'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='43' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sdio_release_irq' mangled-name='sdio_release_irq' filepath='include/linux/mmc/sdio_func.h' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_release_irq'>
-        <parameter type-id='c1880945'/>
+      <function-decl name='sdio_release_irq' mangled-name='sdio_release_irq' filepath='drivers/mmc/core/sdio_irq.c' line='342' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_release_irq'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_irq.c' line='342' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sdio_set_block_size' mangled-name='sdio_set_block_size' filepath='include/linux/mmc/sdio_func.h' line='133' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_set_block_size'>
-        <parameter type-id='c1880945'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sdio_set_block_size' mangled-name='sdio_set_block_size' filepath='drivers/mmc/core/sdio_io.c' line='159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_set_block_size'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='159' column='1'/>
+        <parameter type-id='f0981eeb' name='blksz' filepath='drivers/mmc/core/sdio_io.c' line='159' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sdio_set_host_pm_flags' mangled-name='sdio_set_host_pm_flags' filepath='drivers/mmc/core/sdio_io.c' line='722' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_set_host_pm_flags'>
@@ -132471,11 +132295,11 @@
         <parameter type-id='710bea3d' name='drv' filepath='drivers/mmc/core/sdio_bus.c' line='284' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sdio_writeb' mangled-name='sdio_writeb' filepath='include/linux/mmc/sdio_func.h' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_writeb'>
-        <parameter type-id='c1880945'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='sdio_writeb' mangled-name='sdio_writeb' filepath='drivers/mmc/core/sdio_io.c' line='412' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_writeb'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='412' column='1'/>
+        <parameter type-id='f9b06939' name='b' filepath='drivers/mmc/core/sdio_io.c' line='412' column='1'/>
+        <parameter type-id='f0981eeb' name='addr' filepath='drivers/mmc/core/sdio_io.c' line='412' column='1'/>
+        <parameter type-id='7292109c' name='err_ret' filepath='drivers/mmc/core/sdio_io.c' line='412' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sdio_writel' mangled-name='sdio_writel' filepath='drivers/mmc/core/sdio_io.c' line='609' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_writel'>
@@ -132509,21 +132333,21 @@
         <parameter type-id='27675065' name='dentry' filepath='security/inode.c' line='295' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='send_sig' mangled-name='send_sig' filepath='include/linux/sched/signal.h' line='350' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='send_sig'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='send_sig' mangled-name='send_sig' filepath='kernel/signal.c' line='1626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='send_sig'>
+        <parameter type-id='95e97e5e' name='sig' filepath='kernel/signal.c' line='1626' column='1'/>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/signal.c' line='1626' column='1'/>
+        <parameter type-id='95e97e5e' name='priv' filepath='kernel/signal.c' line='1626' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='send_sig_info' mangled-name='send_sig_info' filepath='include/linux/sched/signal.h' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='send_sig_info'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='0effb5d0'/>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='send_sig_info' mangled-name='send_sig_info' filepath='kernel/signal.c' line='1609' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='send_sig_info'>
+        <parameter type-id='95e97e5e' name='sig' filepath='kernel/signal.c' line='1609' column='1'/>
+        <parameter type-id='0effb5d0' name='info' filepath='kernel/signal.c' line='1609' column='1'/>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/signal.c' line='1609' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='seq_buf_printf' mangled-name='seq_buf_printf' filepath='include/linux/seq_buf.h' line='116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_buf_printf'>
-        <parameter type-id='d898930c'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='seq_buf_printf' mangled-name='seq_buf_printf' filepath='lib/seq_buf.c' line='83' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_buf_printf'>
+        <parameter type-id='d898930c' name='s' filepath='lib/seq_buf.c' line='83' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/seq_buf.c' line='83' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -132544,26 +132368,26 @@
         <parameter type-id='b50a4934' name='ascii' filepath='fs/seq_file.c' line='854' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='seq_list_next' mangled-name='seq_list_next' filepath='include/linux/seq_file.h' line='249' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_list_next'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='e84b031a'/>
-        <parameter type-id='8b97c2dc'/>
+      <function-decl name='seq_list_next' mangled-name='seq_list_next' filepath='fs/seq_file.c' line='912' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_list_next'>
+        <parameter type-id='eaa32e2f' name='v' filepath='fs/seq_file.c' line='912' column='1'/>
+        <parameter type-id='e84b031a' name='head' filepath='fs/seq_file.c' line='912' column='1'/>
+        <parameter type-id='b53e8dbb' name='ppos' filepath='fs/seq_file.c' line='912' column='1'/>
         <return type-id='e84b031a'/>
       </function-decl>
-      <function-decl name='seq_list_start' mangled-name='seq_list_start' filepath='include/linux/seq_file.h' line='245' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_list_start'>
-        <parameter type-id='e84b031a'/>
-        <parameter type-id='1eb56b1e'/>
+      <function-decl name='seq_list_start' mangled-name='seq_list_start' filepath='fs/seq_file.c' line='891' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_list_start'>
+        <parameter type-id='e84b031a' name='head' filepath='fs/seq_file.c' line='891' column='1'/>
+        <parameter type-id='69bf7bee' name='pos' filepath='fs/seq_file.c' line='891' column='1'/>
         <return type-id='e84b031a'/>
       </function-decl>
-      <function-decl name='seq_lseek' mangled-name='seq_lseek' filepath='include/linux/seq_file.h' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_lseek'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='1eb56b1e'/>
+      <function-decl name='seq_lseek' mangled-name='seq_lseek' filepath='fs/seq_file.c' line='308' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_lseek'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='308' column='1'/>
+        <parameter type-id='69bf7bee' name='offset' filepath='fs/seq_file.c' line='308' column='1'/>
+        <parameter type-id='95e97e5e' name='whence' filepath='fs/seq_file.c' line='308' column='1'/>
+        <return type-id='69bf7bee'/>
       </function-decl>
-      <function-decl name='seq_open' mangled-name='seq_open' filepath='include/linux/seq_file.h' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_open'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='943a1b48'/>
+      <function-decl name='seq_open' mangled-name='seq_open' filepath='fs/seq_file.c' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_open'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='57' column='1'/>
+        <parameter type-id='943a1b48' name='op' filepath='fs/seq_file.c' line='57' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='seq_open_private' mangled-name='seq_open_private' filepath='fs/seq_file.c' line='645' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_open_private'>
@@ -132572,20 +132396,20 @@
         <parameter type-id='95e97e5e' name='psize' filepath='fs/seq_file.c' line='646' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='seq_printf' mangled-name='seq_printf' filepath='include/linux/seq_file.h' line='118' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_printf'>
-        <parameter type-id='f8dc9def'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='seq_printf' mangled-name='seq_printf' filepath='fs/seq_file.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_printf'>
+        <parameter type-id='f8dc9def' name='m' filepath='fs/seq_file.c' line='408' column='1'/>
+        <parameter type-id='80f4b756' name='f' filepath='fs/seq_file.c' line='408' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='seq_putc' mangled-name='seq_putc' filepath='include/linux/seq_file.h' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_putc'>
-        <parameter type-id='f8dc9def'/>
-        <parameter type-id='a84c031d'/>
+      <function-decl name='seq_putc' mangled-name='seq_putc' filepath='fs/seq_file.c' line='652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_putc'>
+        <parameter type-id='f8dc9def' name='m' filepath='fs/seq_file.c' line='652' column='1'/>
+        <parameter type-id='a84c031d' name='c' filepath='fs/seq_file.c' line='652' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='seq_puts' mangled-name='seq_puts' filepath='include/linux/seq_file.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_puts'>
-        <parameter type-id='f8dc9def'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='seq_puts' mangled-name='seq_puts' filepath='fs/seq_file.c' line='661' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_puts'>
+        <parameter type-id='f8dc9def' name='m' filepath='fs/seq_file.c' line='661' column='1'/>
+        <parameter type-id='80f4b756' name='s' filepath='fs/seq_file.c' line='661' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='seq_read' mangled-name='seq_read' filepath='fs/seq_file.c' line='151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_read'>
@@ -132595,26 +132419,26 @@
         <parameter type-id='b53e8dbb' name='ppos' filepath='fs/seq_file.c' line='151' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='seq_release' mangled-name='seq_release' filepath='include/linux/seq_file.h' line='112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_release'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='77e79a4b'/>
+      <function-decl name='seq_release' mangled-name='seq_release' filepath='fs/seq_file.c' line='352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_release'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/seq_file.c' line='352' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='352' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='seq_release_private' mangled-name='seq_release_private' filepath='include/linux/seq_file.h' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_release_private'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='77e79a4b'/>
+      <function-decl name='seq_release_private' mangled-name='seq_release_private' filepath='fs/seq_file.c' line='609' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_release_private'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/seq_file.c' line='609' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='609' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='seq_vprintf' mangled-name='seq_vprintf' filepath='include/linux/seq_file.h' line='116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_vprintf'>
-        <parameter type-id='f8dc9def'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='5f919c1f'/>
+      <function-decl name='seq_vprintf' mangled-name='seq_vprintf' filepath='fs/seq_file.c' line='393' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_vprintf'>
+        <parameter type-id='f8dc9def' name='m' filepath='fs/seq_file.c' line='393' column='1'/>
+        <parameter type-id='80f4b756' name='f' filepath='fs/seq_file.c' line='393' column='1'/>
+        <parameter type-id='2aee9912' name='args' filepath='fs/seq_file.c' line='393' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='seq_write' mangled-name='seq_write' filepath='include/linux/seq_file.h' line='113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_write'>
-        <parameter type-id='f8dc9def'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='seq_write' mangled-name='seq_write' filepath='fs/seq_file.c' line='818' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='seq_write'>
+        <parameter type-id='f8dc9def' name='seq' filepath='fs/seq_file.c' line='818' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/seq_file.c' line='818' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='fs/seq_file.c' line='818' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='serdev_device_close' mangled-name='serdev_device_close' filepath='drivers/tty/serdev/core.c' line='197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serdev_device_close'>
@@ -132728,9 +132552,9 @@
         <parameter type-id='95dc69d1' name='serio' filepath='drivers/input/serio/serio.c' line='705' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='set_blocksize' mangled-name='set_blocksize' filepath='include/linux/blkdev.h' line='2005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_blocksize'>
-        <parameter type-id='b88dd945'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='set_blocksize' mangled-name='set_blocksize' filepath='fs/block_dev.c' line='157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_blocksize'>
+        <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='157' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='fs/block_dev.c' line='157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='set_capacity_revalidate_and_notify' mangled-name='set_capacity_revalidate_and_notify' filepath='block/genhd.c' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_capacity_revalidate_and_notify'>
@@ -132739,9 +132563,9 @@
         <parameter type-id='b50a4934' name='update_bdev' filepath='block/genhd.c' line='53' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='set_cpus_allowed_ptr' mangled-name='set_cpus_allowed_ptr' filepath='include/linux/sched.h' line='1705' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_cpus_allowed_ptr'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='5f8a1ac4'/>
+      <function-decl name='set_cpus_allowed_ptr' mangled-name='set_cpus_allowed_ptr' filepath='kernel/sched/core.c' line='2076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_cpus_allowed_ptr'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='2076' column='1'/>
+        <parameter type-id='5f8a1ac4' name='new_mask' filepath='kernel/sched/core.c' line='2076' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='set_disk_ro' mangled-name='set_disk_ro' filepath='block/genhd.c' line='1857' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_disk_ro'>
@@ -132749,21 +132573,21 @@
         <parameter type-id='95e97e5e' name='flag' filepath='block/genhd.c' line='1857' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='set_freezable' mangled-name='set_freezable' filepath='include/linux/freezer.h' line='76' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_freezable'>
-        <return type-id='c894953d'/>
+      <function-decl name='set_freezable' mangled-name='set_freezable' filepath='kernel/freezer.c' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_freezable'>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='set_normalized_timespec64' mangled-name='set_normalized_timespec64' filepath='include/linux/time64.h' line='63' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_normalized_timespec64'>
-        <parameter type-id='4151733d'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='1eb56b1e'/>
+      <function-decl name='set_normalized_timespec64' mangled-name='set_normalized_timespec64' filepath='kernel/time/time.c' line='478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_normalized_timespec64'>
+        <parameter type-id='4151733d' name='ts' filepath='kernel/time/time.c' line='478' column='1'/>
+        <parameter type-id='1afd27ac' name='sec' filepath='kernel/time/time.c' line='478' column='1'/>
+        <parameter type-id='9b7c55ef' name='nsec' filepath='kernel/time/time.c' line='478' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='set_page_dirty' mangled-name='set_page_dirty' filepath='include/linux/mm.h' line='1968' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_page_dirty'>
-        <parameter type-id='02f11ed4'/>
+      <function-decl name='set_page_dirty' mangled-name='set_page_dirty' filepath='mm/page-writeback.c' line='2563' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_page_dirty'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/page-writeback.c' line='2563' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='set_page_dirty_lock' mangled-name='set_page_dirty_lock' filepath='include/linux/mm.h' line='1969' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_page_dirty_lock'>
-        <parameter type-id='02f11ed4'/>
+      <function-decl name='set_page_dirty_lock' mangled-name='set_page_dirty_lock' filepath='mm/page-writeback.c' line='2606' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_page_dirty_lock'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/page-writeback.c' line='2606' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='set_task_cpu' mangled-name='set_task_cpu' filepath='kernel/sched/core.c' line='2150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_task_cpu'>
@@ -132771,15 +132595,15 @@
         <parameter type-id='f0981eeb' name='new_cpu' filepath='kernel/sched/core.c' line='2150' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='set_user_nice' mangled-name='set_user_nice' filepath='include/linux/sched.h' line='1720' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_user_nice'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='set_user_nice' mangled-name='set_user_nice' filepath='kernel/sched/core.c' line='5213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='set_user_nice'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/core.c' line='5213' column='1'/>
+        <parameter type-id='bd54fe1a' name='nice' filepath='kernel/sched/core.c' line='5213' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sg_alloc_table' mangled-name='sg_alloc_table' filepath='include/linux/scatterlist.h' line='293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_alloc_table'>
-        <parameter type-id='4adb0e6a'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sg_alloc_table' mangled-name='sg_alloc_table' filepath='lib/scatterlist.c' line='355' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_alloc_table'>
+        <parameter type-id='4adb0e6a' name='table' filepath='lib/scatterlist.c' line='355' column='1'/>
+        <parameter type-id='f0981eeb' name='nents' filepath='lib/scatterlist.c' line='355' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='lib/scatterlist.c' line='355' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sg_alloc_table_from_pages' mangled-name='sg_alloc_table_from_pages' filepath='lib/scatterlist.c' line='545' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_alloc_table_from_pages'>
@@ -132791,33 +132615,33 @@
         <parameter type-id='3eb7c31c' name='gfp_mask' filepath='lib/scatterlist.c' line='547' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sg_copy_from_buffer' mangled-name='sg_copy_from_buffer' filepath='include/linux/scatterlist.h' line='317' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_copy_from_buffer'>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='7359adad'/>
+      <function-decl name='sg_copy_from_buffer' mangled-name='sg_copy_from_buffer' filepath='lib/scatterlist.c' line='967' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_copy_from_buffer'>
+        <parameter type-id='bf3ef905' name='sgl' filepath='lib/scatterlist.c' line='967' column='1'/>
+        <parameter type-id='f0981eeb' name='nents' filepath='lib/scatterlist.c' line='967' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='lib/scatterlist.c' line='968' column='1'/>
+        <parameter type-id='b59d7dce' name='buflen' filepath='lib/scatterlist.c' line='968' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
-      <function-decl name='sg_copy_to_buffer' mangled-name='sg_copy_to_buffer' filepath='include/linux/scatterlist.h' line='319' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_copy_to_buffer'>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='7359adad'/>
+      <function-decl name='sg_copy_to_buffer' mangled-name='sg_copy_to_buffer' filepath='lib/scatterlist.c' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_copy_to_buffer'>
+        <parameter type-id='bf3ef905' name='sgl' filepath='lib/scatterlist.c' line='984' column='1'/>
+        <parameter type-id='f0981eeb' name='nents' filepath='lib/scatterlist.c' line='984' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='lib/scatterlist.c' line='985' column='1'/>
+        <parameter type-id='b59d7dce' name='buflen' filepath='lib/scatterlist.c' line='985' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
       <function-decl name='sg_free_table' mangled-name='sg_free_table' filepath='lib/scatterlist.c' line='239' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_free_table'>
         <parameter type-id='4adb0e6a' name='table' filepath='lib/scatterlist.c' line='239' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sg_init_one' mangled-name='sg_init_one' filepath='include/linux/scatterlist.h' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_init_one'>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sg_init_one' mangled-name='sg_init_one' filepath='lib/scatterlist.c' line='138' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_init_one'>
+        <parameter type-id='bf3ef905' name='sg' filepath='lib/scatterlist.c' line='138' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='lib/scatterlist.c' line='138' column='1'/>
+        <parameter type-id='f0981eeb' name='buflen' filepath='lib/scatterlist.c' line='138' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sg_init_table' mangled-name='sg_init_table' filepath='include/linux/scatterlist.h' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_init_table'>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sg_init_table' mangled-name='sg_init_table' filepath='lib/scatterlist.c' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_init_table'>
+        <parameter type-id='bf3ef905' name='sgl' filepath='lib/scatterlist.c' line='124' column='1'/>
+        <parameter type-id='f0981eeb' name='nents' filepath='lib/scatterlist.c' line='124' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sg_last' mangled-name='sg_last' filepath='lib/scatterlist.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_last'>
@@ -132825,28 +132649,28 @@
         <parameter type-id='f0981eeb' name='nents' filepath='lib/scatterlist.c' line='101' column='1'/>
         <return type-id='bf3ef905'/>
       </function-decl>
-      <function-decl name='sg_miter_next' mangled-name='sg_miter_next' filepath='include/linux/scatterlist.h' line='514' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_miter_next'>
-        <parameter type-id='a462f2f9'/>
-        <return type-id='c894953d'/>
+      <function-decl name='sg_miter_next' mangled-name='sg_miter_next' filepath='lib/scatterlist.c' line='844' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_miter_next'>
+        <parameter type-id='a462f2f9' name='miter' filepath='lib/scatterlist.c' line='844' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='sg_miter_start' mangled-name='sg_miter_start' filepath='include/linux/scatterlist.h' line='511' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_miter_start'>
-        <parameter type-id='a462f2f9'/>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sg_miter_start' mangled-name='sg_miter_start' filepath='lib/scatterlist.c' line='755' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_miter_start'>
+        <parameter type-id='a462f2f9' name='miter' filepath='lib/scatterlist.c' line='755' column='1'/>
+        <parameter type-id='bf3ef905' name='sgl' filepath='lib/scatterlist.c' line='755' column='1'/>
+        <parameter type-id='f0981eeb' name='nents' filepath='lib/scatterlist.c' line='756' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='lib/scatterlist.c' line='756' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sg_miter_stop' mangled-name='sg_miter_stop' filepath='include/linux/scatterlist.h' line='515' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_miter_stop'>
-        <parameter type-id='a462f2f9'/>
+      <function-decl name='sg_miter_stop' mangled-name='sg_miter_stop' filepath='lib/scatterlist.c' line='881' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_miter_stop'>
+        <parameter type-id='a462f2f9' name='miter' filepath='lib/scatterlist.c' line='881' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sg_nents_for_len' mangled-name='sg_nents_for_len' filepath='include/linux/scatterlist.h' line='274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_nents_for_len'>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='sg_nents_for_len' mangled-name='sg_nents_for_len' filepath='lib/scatterlist.c' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_nents_for_len'>
+        <parameter type-id='bf3ef905' name='sg' filepath='lib/scatterlist.c' line='68' column='1'/>
+        <parameter type-id='91ce1af9' name='len' filepath='lib/scatterlist.c' line='68' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sg_next' mangled-name='sg_next' filepath='include/linux/scatterlist.h' line='275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_next'>
-        <parameter type-id='bf3ef905'/>
+      <function-decl name='sg_next' mangled-name='sg_next' filepath='lib/scatterlist.c' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_next'>
+        <parameter type-id='bf3ef905' name='sg' filepath='lib/scatterlist.c' line='23' column='1'/>
         <return type-id='bf3ef905'/>
       </function-decl>
       <function-decl name='sg_pcopy_from_buffer' mangled-name='sg_pcopy_from_buffer' filepath='lib/scatterlist.c' line='1002' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_pcopy_from_buffer'>
@@ -132857,13 +132681,13 @@
         <parameter type-id='ad707ada' name='skip' filepath='lib/scatterlist.c' line='1003' column='1'/>
         <return type-id='b59d7dce'/>
       </function-decl>
-      <function-decl name='sg_pcopy_to_buffer' mangled-name='sg_pcopy_to_buffer' filepath='include/linux/scatterlist.h' line='324' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_pcopy_to_buffer'>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='bd54fe1a'/>
-        <return type-id='7359adad'/>
+      <function-decl name='sg_pcopy_to_buffer' mangled-name='sg_pcopy_to_buffer' filepath='lib/scatterlist.c' line='1020' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_pcopy_to_buffer'>
+        <parameter type-id='bf3ef905' name='sgl' filepath='lib/scatterlist.c' line='1020' column='1'/>
+        <parameter type-id='f0981eeb' name='nents' filepath='lib/scatterlist.c' line='1020' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='lib/scatterlist.c' line='1021' column='1'/>
+        <parameter type-id='b59d7dce' name='buflen' filepath='lib/scatterlist.c' line='1021' column='1'/>
+        <parameter type-id='ad707ada' name='skip' filepath='lib/scatterlist.c' line='1021' column='1'/>
+        <return type-id='b59d7dce'/>
       </function-decl>
       <function-decl name='sg_scsi_ioctl' mangled-name='sg_scsi_ioctl' filepath='block/scsi_ioctl.c' line='407' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sg_scsi_ioctl'>
         <parameter type-id='e7d2a5fc' name='q' filepath='block/scsi_ioctl.c' line='407' column='1'/>
@@ -132895,10 +132719,10 @@
         <parameter type-id='bf3ef905' name='sgl' filepath='lib/scatterlist.c' line='673' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sha1_transform' mangled-name='sha1_transform' filepath='include/crypto/sha.h' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha1_transform'>
-        <parameter type-id='807869d3'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='807869d3'/>
+      <function-decl name='sha1_transform' mangled-name='sha1_transform' filepath='lib/sha1.c' line='84' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha1_transform'>
+        <parameter type-id='cd1b45ab' name='digest' filepath='lib/sha1.c' line='84' column='1'/>
+        <parameter type-id='80f4b756' name='data' filepath='lib/sha1.c' line='84' column='1'/>
+        <parameter type-id='cd1b45ab' name='array' filepath='lib/sha1.c' line='84' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sha224_final' mangled-name='sha224_final' filepath='lib/crypto/sha256.c' line='278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha224_final'>
@@ -132906,10 +132730,10 @@
         <parameter type-id='8bff8096' name='out' filepath='lib/crypto/sha256.c' line='278' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sha256' mangled-name='sha256' filepath='include/crypto/sha.h' line='150' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha256'>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='cf536864'/>
+      <function-decl name='sha256' mangled-name='sha256' filepath='lib/crypto/sha256.c' line='284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha256'>
+        <parameter type-id='bbaf3419' name='data' filepath='lib/crypto/sha256.c' line='284' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='lib/crypto/sha256.c' line='284' column='1'/>
+        <parameter type-id='8bff8096' name='out' filepath='lib/crypto/sha256.c' line='284' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sha256_final' mangled-name='sha256_final' filepath='lib/crypto/sha256.c' line='272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha256_final'>
@@ -132917,10 +132741,10 @@
         <parameter type-id='8bff8096' name='out' filepath='lib/crypto/sha256.c' line='272' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sha256_update' mangled-name='sha256_update' filepath='include/crypto/sha.h' line='148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha256_update'>
-        <parameter type-id='49e4c88e'/>
-        <parameter type-id='354f7eb9'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sha256_update' mangled-name='sha256_update' filepath='lib/crypto/sha256.c' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sha256_update'>
+        <parameter type-id='49e4c88e' name='sctx' filepath='lib/crypto/sha256.c' line='210' column='1'/>
+        <parameter type-id='bbaf3419' name='data' filepath='lib/crypto/sha256.c' line='210' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='lib/crypto/sha256.c' line='210' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='shash_free_singlespawn_instance' mangled-name='shash_free_singlespawn_instance' filepath='crypto/shash.c' line='619' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shash_free_singlespawn_instance'>
@@ -132943,10 +132767,10 @@
         <parameter type-id='b50a4934' name='tail' filepath='mm/shmem.c' line='4297' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='shmem_read_mapping_page_gfp' mangled-name='shmem_read_mapping_page_gfp' filepath='include/linux/shmem_fs.h' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_read_mapping_page_gfp'>
-        <parameter type-id='f57039f0'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='shmem_read_mapping_page_gfp' mangled-name='shmem_read_mapping_page_gfp' filepath='mm/shmem.c' line='4272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_read_mapping_page_gfp'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/shmem.c' line='4272' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='mm/shmem.c' line='4273' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='mm/shmem.c' line='4273' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
       <function-decl name='shmem_truncate_range' mangled-name='shmem_truncate_range' filepath='mm/shmem.c' line='1062' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='shmem_truncate_range'>
@@ -132962,29 +132786,29 @@
         <parameter type-id='4616a179' name='regs' filepath='arch/arm64/kernel/process.c' line='304' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='si_mem_available' mangled-name='si_mem_available' filepath='include/linux/mm.h' line='2605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='si_mem_available'>
+      <function-decl name='si_mem_available' mangled-name='si_mem_available' filepath='mm/page_alloc.c' line='5444' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='si_mem_available'>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='si_meminfo' mangled-name='si_meminfo' filepath='include/linux/mm.h' line='2606' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='si_meminfo'>
-        <parameter type-id='0f561784'/>
+      <function-decl name='si_meminfo' mangled-name='si_meminfo' filepath='mm/page_alloc.c' line='5490' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='si_meminfo'>
+        <parameter type-id='0f561784' name='val' filepath='mm/page_alloc.c' line='5490' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='si_swapinfo' mangled-name='si_swapinfo' filepath='include/linux/swap.h' line='469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='si_swapinfo'>
-        <parameter type-id='0f561784'/>
+      <function-decl name='si_swapinfo' mangled-name='si_swapinfo' filepath='mm/swapfile.c' line='3428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='si_swapinfo'>
+        <parameter type-id='0f561784' name='val' filepath='mm/swapfile.c' line='3428' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sigprocmask' mangled-name='sigprocmask' filepath='include/linux/signal.h' line='285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sigprocmask'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='8567d8b0'/>
-        <parameter type-id='8567d8b0'/>
+      <function-decl name='sigprocmask' mangled-name='sigprocmask' filepath='kernel/signal.c' line='2987' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sigprocmask'>
+        <parameter type-id='95e97e5e' name='how' filepath='kernel/signal.c' line='2987' column='1'/>
+        <parameter type-id='9e80f729' name='set' filepath='kernel/signal.c' line='2987' column='1'/>
+        <parameter type-id='9e80f729' name='oldset' filepath='kernel/signal.c' line='2987' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='simple_attr_open' mangled-name='simple_attr_open' filepath='include/linux/fs.h' line='3414' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_attr_open'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='498d7045'/>
-        <parameter type-id='a47ececb'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='simple_attr_open' mangled-name='simple_attr_open' filepath='fs/libfs.c' line='890' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_attr_open'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/libfs.c' line='890' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/libfs.c' line='890' column='1'/>
+        <parameter type-id='dffc7428' name='get' filepath='fs/libfs.c' line='891' column='1'/>
+        <parameter type-id='0fb09eeb' name='set' filepath='fs/libfs.c' line='891' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='fs/libfs.c' line='892' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='simple_attr_read' mangled-name='simple_attr_read' filepath='fs/libfs.c' line='920' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_attr_read'>
@@ -133013,13 +132837,13 @@
         <parameter type-id='77e79a4b' name='file' filepath='fs/libfs.c' line='385' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='simple_read_from_buffer' mangled-name='simple_read_from_buffer' filepath='include/linux/fs.h' line='3249' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_read_from_buffer'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='8b97c2dc'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='simple_read_from_buffer' mangled-name='simple_read_from_buffer' filepath='fs/libfs.c' line='717' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_read_from_buffer'>
+        <parameter type-id='eaa32e2f' name='to' filepath='fs/libfs.c' line='717' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='fs/libfs.c' line='717' column='1'/>
+        <parameter type-id='b53e8dbb' name='ppos' filepath='fs/libfs.c' line='717' column='1'/>
+        <parameter type-id='eaa32e2f' name='from' filepath='fs/libfs.c' line='718' column='1'/>
+        <parameter type-id='b59d7dce' name='available' filepath='fs/libfs.c' line='718' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='simple_statfs' mangled-name='simple_statfs' filepath='fs/libfs.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_statfs'>
         <parameter type-id='27675065' name='dentry' filepath='fs/libfs.c' line='40' column='1'/>
@@ -133038,10 +132862,10 @@
         <parameter type-id='f0981eeb' name='base' filepath='lib/vsprintf.c' line='149' column='1'/>
         <return type-id='1eb56b1e'/>
       </function-decl>
-      <function-decl name='simple_strtoul' mangled-name='simple_strtoul' filepath='include/linux/kernel.h' line='466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_strtoul'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='9b23c9ad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='simple_strtoul' mangled-name='simple_strtoul' filepath='lib/vsprintf.c' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_strtoul'>
+        <parameter type-id='80f4b756' name='cp' filepath='lib/vsprintf.c' line='103' column='1'/>
+        <parameter type-id='9b23c9ad' name='endp' filepath='lib/vsprintf.c' line='103' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/vsprintf.c' line='103' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='simple_strtoull' mangled-name='simple_strtoull' filepath='include/linux/kernel.h' line='468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='simple_strtoull'>
@@ -133058,10 +132882,10 @@
         <parameter type-id='b59d7dce' name='count' filepath='fs/libfs.c' line='753' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='single_open' mangled-name='single_open' filepath='include/linux/seq_file.h' line='142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='single_open'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='0131eb61'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='single_open' mangled-name='single_open' filepath='fs/seq_file.c' line='561' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='single_open'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='561' column='1'/>
+        <parameter type-id='0131eb61' name='show' filepath='fs/seq_file.c' line='561' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='fs/seq_file.c' line='562' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='single_open_size' mangled-name='single_open_size' filepath='fs/seq_file.c' line='582' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='single_open_size'>
@@ -133071,30 +132895,30 @@
         <parameter type-id='b59d7dce' name='size' filepath='fs/seq_file.c' line='583' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='single_release' mangled-name='single_release' filepath='include/linux/seq_file.h' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='single_release'>
-        <parameter type-id='7e666abe'/>
-        <parameter type-id='77e79a4b'/>
+      <function-decl name='single_release' mangled-name='single_release' filepath='fs/seq_file.c' line='600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='single_release'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/seq_file.c' line='600' column='1'/>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='600' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sk_alloc' mangled-name='sk_alloc' filepath='include/net/sock.h' line='1664' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_alloc'>
-        <parameter type-id='a2bff676'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='d2524501'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='sk_alloc' mangled-name='sk_alloc' filepath='net/core/sock.c' line='1729' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_alloc'>
+        <parameter type-id='a2bff676' name='net' filepath='net/core/sock.c' line='1729' column='1'/>
+        <parameter type-id='95e97e5e' name='family' filepath='net/core/sock.c' line='1729' column='1'/>
+        <parameter type-id='3eb7c31c' name='priority' filepath='net/core/sock.c' line='1729' column='1'/>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='1730' column='1'/>
+        <parameter type-id='95e97e5e' name='kern' filepath='net/core/sock.c' line='1730' column='1'/>
         <return type-id='f772df6d'/>
       </function-decl>
-      <function-decl name='sk_free' mangled-name='sk_free' filepath='include/net/sock.h' line='1666' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_free'>
-        <parameter type-id='f772df6d'/>
+      <function-decl name='sk_free' mangled-name='sk_free' filepath='net/core/sock.c' line='1831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_free'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='1831' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_add_rx_frag' mangled-name='skb_add_rx_frag' filepath='include/linux/skbuff.h' line='2189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_add_rx_frag'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='02f11ed4'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_add_rx_frag' mangled-name='skb_add_rx_frag' filepath='net/core/skbuff.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_add_rx_frag'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='557' column='1'/>
+        <parameter type-id='95e97e5e' name='i' filepath='net/core/skbuff.c' line='557' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='net/core/skbuff.c' line='557' column='1'/>
+        <parameter type-id='95e97e5e' name='off' filepath='net/core/skbuff.c' line='557' column='1'/>
+        <parameter type-id='95e97e5e' name='size' filepath='net/core/skbuff.c' line='558' column='1'/>
+        <parameter type-id='f0981eeb' name='truesize' filepath='net/core/skbuff.c' line='558' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_append_pagefrags' mangled-name='skb_append_pagefrags' filepath='net/core/skbuff.c' line='3621' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_append_pagefrags'>
@@ -133111,13 +132935,13 @@
         <parameter type-id='fbd88bba' name='csum' filepath='net/core/skbuff.c' line='2730' column='1'/>
         <return type-id='fbd88bba'/>
       </function-decl>
-      <function-decl name='skb_checksum_help' mangled-name='skb_checksum_help' filepath='include/linux/netdevice.h' line='4738' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_checksum_help'>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='skb_checksum_help' mangled-name='skb_checksum_help' filepath='net/core/dev.c' line='3220' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_checksum_help'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/dev.c' line='3220' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skb_clone' mangled-name='skb_clone' filepath='include/linux/skbuff.h' line='1157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_clone'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_clone' mangled-name='skb_clone' filepath='net/core/skbuff.c' line='1441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_clone'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1441' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='1441' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
       <function-decl name='skb_clone_sk' mangled-name='skb_clone_sk' filepath='net/core/skbuff.c' line='4641' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_clone_sk'>
@@ -133136,39 +132960,39 @@
         <parameter type-id='b50a4934' name='acked' filepath='net/core/skbuff.c' line='4786' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_copy' mangled-name='skb_copy' filepath='include/linux/skbuff.h' line='1159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy'>
-        <parameter type-id='11f4a000'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_copy' mangled-name='skb_copy' filepath='net/core/skbuff.c' line='1520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy'>
+        <parameter type-id='11f4a000' name='skb' filepath='net/core/skbuff.c' line='1520' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='1520' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='skb_copy_bits' mangled-name='skb_copy_bits' filepath='include/linux/skbuff.h' line='3557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_bits'>
-        <parameter type-id='11f4a000'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='skb_copy_bits' mangled-name='skb_copy_bits' filepath='net/core/skbuff.c' line='2205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_bits'>
+        <parameter type-id='11f4a000' name='skb' filepath='net/core/skbuff.c' line='2205' column='1'/>
+        <parameter type-id='95e97e5e' name='offset' filepath='net/core/skbuff.c' line='2205' column='1'/>
+        <parameter type-id='eaa32e2f' name='to' filepath='net/core/skbuff.c' line='2205' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='net/core/skbuff.c' line='2205' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skb_copy_datagram_iter' mangled-name='skb_copy_datagram_iter' filepath='include/linux/skbuff.h' line='3534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_datagram_iter'>
-        <parameter type-id='11f4a000'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='4fa10f9e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='skb_copy_datagram_iter' mangled-name='skb_copy_datagram_iter' filepath='net/core/datagram.c' line='529' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_datagram_iter'>
+        <parameter type-id='11f4a000' name='skb' filepath='net/core/datagram.c' line='529' column='1'/>
+        <parameter type-id='95e97e5e' name='offset' filepath='net/core/datagram.c' line='529' column='1'/>
+        <parameter type-id='4fa10f9e' name='to' filepath='net/core/datagram.c' line='530' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='net/core/datagram.c' line='530' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skb_copy_expand' mangled-name='skb_copy_expand' filepath='include/linux/skbuff.h' line='1171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_expand'>
-        <parameter type-id='11f4a000'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_copy_expand' mangled-name='skb_copy_expand' filepath='net/core/skbuff.c' line='1749' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_expand'>
+        <parameter type-id='11f4a000' name='skb' filepath='net/core/skbuff.c' line='1749' column='1'/>
+        <parameter type-id='95e97e5e' name='newheadroom' filepath='net/core/skbuff.c' line='1750' column='1'/>
+        <parameter type-id='95e97e5e' name='newtailroom' filepath='net/core/skbuff.c' line='1750' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='1751' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='skb_copy_ubufs' mangled-name='skb_copy_ubufs' filepath='include/linux/skbuff.h' line='1156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_ubufs'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_copy_ubufs' mangled-name='skb_copy_ubufs' filepath='net/core/skbuff.c' line='1353' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_copy_ubufs'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1353' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_mask' filepath='net/core/skbuff.c' line='1353' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skb_dequeue' mangled-name='skb_dequeue' filepath='include/linux/skbuff.h' line='2092' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_dequeue'>
-        <parameter type-id='03c386c6'/>
+      <function-decl name='skb_dequeue' mangled-name='skb_dequeue' filepath='net/core/skbuff.c' line='3055' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_dequeue'>
+        <parameter type-id='03c386c6' name='list' filepath='net/core/skbuff.c' line='3055' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
       <function-decl name='skb_dequeue_tail' mangled-name='skb_dequeue_tail' filepath='net/core/skbuff.c' line='3075' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_dequeue_tail'>
@@ -133185,55 +133009,55 @@
         <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/datagram.c' line='323' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_page_frag_refill' mangled-name='skb_page_frag_refill' filepath='include/linux/skbuff.h' line='3106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_page_frag_refill'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='a8d434b7'/>
-        <parameter type-id='f0981eeb'/>
-        <return type-id='c894953d'/>
+      <function-decl name='skb_page_frag_refill' mangled-name='skb_page_frag_refill' filepath='net/core/sock.c' line='2452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_page_frag_refill'>
+        <parameter type-id='f0981eeb' name='sz' filepath='net/core/sock.c' line='2452' column='1'/>
+        <parameter type-id='a8d434b7' name='pfrag' filepath='net/core/sock.c' line='2452' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='net/core/sock.c' line='2452' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='skb_partial_csum_set' mangled-name='skb_partial_csum_set' filepath='include/linux/skbuff.h' line='4546' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_partial_csum_set'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='8efea9e5'/>
-        <return type-id='c894953d'/>
+      <function-decl name='skb_partial_csum_set' mangled-name='skb_partial_csum_set' filepath='net/core/skbuff.c' line='4824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_partial_csum_set'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4824' column='1'/>
+        <parameter type-id='1dc6a898' name='start' filepath='net/core/skbuff.c' line='4824' column='1'/>
+        <parameter type-id='1dc6a898' name='off' filepath='net/core/skbuff.c' line='4824' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='skb_pull' mangled-name='skb_pull' filepath='include/linux/skbuff.h' line='2300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_pull'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_pull' mangled-name='skb_pull' filepath='net/core/skbuff.c' line='1911' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_pull'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1911' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='net/core/skbuff.c' line='1911' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='skb_pull_rcsum' mangled-name='skb_pull_rcsum' filepath='include/linux/skbuff.h' line='3396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_pull_rcsum'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_pull_rcsum' mangled-name='skb_pull_rcsum' filepath='net/core/skbuff.c' line='3650' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_pull_rcsum'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='3650' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='net/core/skbuff.c' line='3650' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='skb_push' mangled-name='skb_push' filepath='include/linux/skbuff.h' line='2292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_push'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_push' mangled-name='skb_push' filepath='net/core/skbuff.c' line='1891' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_push'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1891' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='net/core/skbuff.c' line='1891' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='skb_put' mangled-name='skb_put' filepath='include/linux/skbuff.h' line='2236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_put'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_put' mangled-name='skb_put' filepath='net/core/skbuff.c' line='1870' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_put'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1870' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='net/core/skbuff.c' line='1870' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='skb_queue_head' mangled-name='skb_queue_head' filepath='include/linux/skbuff.h' line='2041' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_queue_head'>
-        <parameter type-id='03c386c6'/>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='skb_queue_head' mangled-name='skb_queue_head' filepath='net/core/skbuff.c' line='3140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_queue_head'>
+        <parameter type-id='03c386c6' name='list' filepath='net/core/skbuff.c' line='3140' column='1'/>
+        <parameter type-id='0fbf3cfd' name='newsk' filepath='net/core/skbuff.c' line='3140' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_queue_purge' mangled-name='skb_queue_purge' filepath='include/linux/skbuff.h' line='2808' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_queue_purge'>
-        <parameter type-id='03c386c6'/>
+      <function-decl name='skb_queue_purge' mangled-name='skb_queue_purge' filepath='net/core/skbuff.c' line='3095' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_queue_purge'>
+        <parameter type-id='03c386c6' name='list' filepath='net/core/skbuff.c' line='3095' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_queue_tail' mangled-name='skb_queue_tail' filepath='include/linux/skbuff.h' line='2058' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_queue_tail'>
-        <parameter type-id='03c386c6'/>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='skb_queue_tail' mangled-name='skb_queue_tail' filepath='net/core/skbuff.c' line='3161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_queue_tail'>
+        <parameter type-id='03c386c6' name='list' filepath='net/core/skbuff.c' line='3161' column='1'/>
+        <parameter type-id='0fbf3cfd' name='newsk' filepath='net/core/skbuff.c' line='3161' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_realloc_headroom' mangled-name='skb_realloc_headroom' filepath='include/linux/skbuff.h' line='1169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_realloc_headroom'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_realloc_headroom' mangled-name='skb_realloc_headroom' filepath='net/core/skbuff.c' line='1712' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_realloc_headroom'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1712' column='1'/>
+        <parameter type-id='f0981eeb' name='headroom' filepath='net/core/skbuff.c' line='1712' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
       <function-decl name='skb_recv_datagram' mangled-name='skb_recv_datagram' filepath='net/core/datagram.c' line='312' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_recv_datagram'>
@@ -133243,9 +133067,9 @@
         <parameter type-id='7292109c' name='err' filepath='net/core/datagram.c' line='313' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='skb_set_owner_w' mangled-name='skb_set_owner_w' filepath='include/net/sock.h' line='2198' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_set_owner_w'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f772df6d'/>
+      <function-decl name='skb_set_owner_w' mangled-name='skb_set_owner_w' filepath='net/core/sock.c' line='2070' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_set_owner_w'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2070' column='1'/>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2070' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_store_bits' mangled-name='skb_store_bits' filepath='net/core/skbuff.c' line='2567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_store_bits'>
@@ -133255,16 +133079,16 @@
         <parameter type-id='95e97e5e' name='len' filepath='net/core/skbuff.c' line='2567' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skb_to_sgvec' mangled-name='skb_to_sgvec' filepath='include/linux/skbuff.h' line='1175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_to_sgvec'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='bf3ef905'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='skb_to_sgvec' mangled-name='skb_to_sgvec' filepath='net/core/skbuff.c' line='4404' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_to_sgvec'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='4404' column='1'/>
+        <parameter type-id='bf3ef905' name='sg' filepath='net/core/skbuff.c' line='4404' column='1'/>
+        <parameter type-id='95e97e5e' name='offset' filepath='net/core/skbuff.c' line='4404' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='net/core/skbuff.c' line='4404' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skb_trim' mangled-name='skb_trim' filepath='include/linux/skbuff.h' line='2704' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_trim'>
-        <parameter type-id='0fbf3cfd'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='skb_trim' mangled-name='skb_trim' filepath='net/core/skbuff.c' line='1926' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_trim'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/skbuff.c' line='1926' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='net/core/skbuff.c' line='1926' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_tstamp_tx' mangled-name='skb_tstamp_tx' filepath='net/core/skbuff.c' line='4778' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_tstamp_tx'>
@@ -133299,15 +133123,15 @@
         <parameter type-id='b50a4934' name='atomic' filepath='crypto/skcipher.c' line='554' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skcipher_walk_done' mangled-name='skcipher_walk_done' filepath='include/crypto/internal/skcipher.h' line='132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skcipher_walk_done'>
-        <parameter type-id='74439606'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='skcipher_walk_done' mangled-name='skcipher_walk_done' filepath='crypto/skcipher.c' line='105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skcipher_walk_done'>
+        <parameter type-id='74439606' name='walk' filepath='crypto/skcipher.c' line='105' column='1'/>
+        <parameter type-id='95e97e5e' name='err' filepath='crypto/skcipher.c' line='105' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='skcipher_walk_virt' mangled-name='skcipher_walk_virt' filepath='include/crypto/internal/skcipher.h' line='133' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skcipher_walk_virt'>
-        <parameter type-id='74439606'/>
-        <parameter type-id='c249b570'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='skcipher_walk_virt' mangled-name='skcipher_walk_virt' filepath='crypto/skcipher.c' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skcipher_walk_virt'>
+        <parameter type-id='74439606' name='walk' filepath='crypto/skcipher.c' line='477' column='1'/>
+        <parameter type-id='c249b570' name='req' filepath='crypto/skcipher.c' line='478' column='1'/>
+        <parameter type-id='b50a4934' name='atomic' filepath='crypto/skcipher.c' line='478' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='skip_spaces' mangled-name='skip_spaces' filepath='include/linux/string.h' line='72' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skip_spaces'>
@@ -133320,11 +133144,11 @@
         <parameter type-id='95e97e5e' name='wait' filepath='kernel/smp.c' line='735' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='smp_call_function_any' mangled-name='smp_call_function_any' filepath='include/linux/smp.h' line='125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_function_any'>
-        <parameter type-id='5f8a1ac4'/>
-        <parameter type-id='b7f9d8e6'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='smp_call_function_any' mangled-name='smp_call_function_any' filepath='kernel/smp.c' line='583' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_function_any'>
+        <parameter type-id='5f8a1ac4' name='mask' filepath='kernel/smp.c' line='583' column='1'/>
+        <parameter type-id='89714567' name='func' filepath='kernel/smp.c' line='584' column='1'/>
+        <parameter type-id='eaa32e2f' name='info' filepath='kernel/smp.c' line='584' column='1'/>
+        <parameter type-id='95e97e5e' name='wait' filepath='kernel/smp.c' line='584' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='smp_call_function_many' mangled-name='smp_call_function_many' filepath='kernel/smp.c' line='713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_function_many'>
@@ -133334,11 +133158,11 @@
         <parameter type-id='b50a4934' name='wait' filepath='kernel/smp.c' line='714' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='smp_call_function_single' mangled-name='smp_call_function_single' filepath='include/linux/smp.h' line='51' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_function_single'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='b7f9d8e6'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='smp_call_function_single' mangled-name='smp_call_function_single' filepath='kernel/smp.c' line='468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_function_single'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/smp.c' line='468' column='1'/>
+        <parameter type-id='89714567' name='func' filepath='kernel/smp.c' line='468' column='1'/>
+        <parameter type-id='eaa32e2f' name='info' filepath='kernel/smp.c' line='468' column='1'/>
+        <parameter type-id='95e97e5e' name='wait' filepath='kernel/smp.c' line='469' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='smp_call_on_cpu' mangled-name='smp_call_on_cpu' filepath='kernel/smp.c' line='1021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_on_cpu'>
@@ -133348,8 +133172,8 @@
         <parameter type-id='b50a4934' name='phys' filepath='kernel/smp.c' line='1021' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='smpboot_register_percpu_thread' mangled-name='smpboot_register_percpu_thread' filepath='include/linux/smpboot.h' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smpboot_register_percpu_thread'>
-        <parameter type-id='150fd0b2'/>
+      <function-decl name='smpboot_register_percpu_thread' mangled-name='smpboot_register_percpu_thread' filepath='kernel/smpboot.c' line='289' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smpboot_register_percpu_thread'>
+        <parameter type-id='150fd0b2' name='plug_thread' filepath='kernel/smpboot.c' line='289' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='smpboot_unregister_percpu_thread' mangled-name='smpboot_unregister_percpu_thread' filepath='kernel/smpboot.c' line='318' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smpboot_unregister_percpu_thread'>
@@ -133361,25 +133185,25 @@
         <parameter type-id='8ff9530e' name='group' filepath='sound/core/init.c' line='718' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_card_disconnect' mangled-name='snd_card_disconnect' filepath='include/sound/core.h' line='240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_disconnect'>
-        <parameter type-id='52704eb7'/>
+      <function-decl name='snd_card_disconnect' mangled-name='snd_card_disconnect' filepath='sound/core/init.c' line='380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_disconnect'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/init.c' line='380' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_card_free' mangled-name='snd_card_free' filepath='include/sound/core.h' line='242' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_free'>
-        <parameter type-id='52704eb7'/>
+      <function-decl name='snd_card_free' mangled-name='snd_card_free' filepath='sound/core/init.c' line='522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_free'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/init.c' line='522' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_card_new' mangled-name='snd_card_new' filepath='include/sound/core.h' line='236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_new'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='2730d015'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='63cbc127'/>
+      <function-decl name='snd_card_new' mangled-name='snd_card_new' filepath='sound/core/init.c' line='161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_new'>
+        <parameter type-id='fa0b179b' name='parent' filepath='sound/core/init.c' line='161' column='1'/>
+        <parameter type-id='95e97e5e' name='idx' filepath='sound/core/init.c' line='161' column='1'/>
+        <parameter type-id='80f4b756' name='xid' filepath='sound/core/init.c' line='161' column='1'/>
+        <parameter type-id='2730d015' name='module' filepath='sound/core/init.c' line='162' column='1'/>
+        <parameter type-id='95e97e5e' name='extra_size' filepath='sound/core/init.c' line='162' column='1'/>
+        <parameter type-id='63cbc127' name='card_ret' filepath='sound/core/init.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_card_register' mangled-name='snd_card_register' filepath='include/sound/core.h' line='245' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_register'>
-        <parameter type-id='52704eb7'/>
+      <function-decl name='snd_card_register' mangled-name='snd_card_register' filepath='sound/core/init.c' line='746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_register'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/init.c' line='746' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_card_rw_proc_new' mangled-name='snd_card_rw_proc_new' filepath='sound/core/info.c' line='873' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_card_rw_proc_new'>
@@ -133390,9 +133214,9 @@
         <parameter type-id='f695e0b6' name='write' filepath='sound/core/info.c' line='877' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_component_add' mangled-name='snd_component_add' filepath='include/sound/core.h' line='249' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_component_add'>
-        <parameter type-id='52704eb7'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='snd_component_add' mangled-name='snd_component_add' filepath='sound/core/init.c' line='892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_component_add'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/init.c' line='892' column='1'/>
+        <parameter type-id='80f4b756' name='component' filepath='sound/core/init.c' line='892' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_compr_stop_error' mangled-name='snd_compr_stop_error' filepath='sound/core/compress_offload.c' line='827' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_compr_stop_error'>
@@ -133444,9 +133268,9 @@
         <parameter type-id='5b2fd8e8' name='tlv' filepath='sound/core/vmaster.c' line='393' column='1'/>
         <return type-id='7a5054b7'/>
       </function-decl>
-      <function-decl name='snd_ctl_new1' mangled-name='snd_ctl_new1' filepath='include/sound/control.h' line='119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_ctl_new1'>
-        <parameter type-id='31e035f7'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='snd_ctl_new1' mangled-name='snd_ctl_new1' filepath='sound/core/control.c' line='229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_ctl_new1'>
+        <parameter type-id='31e035f7' name='ncontrol' filepath='sound/core/control.c' line='229' column='1'/>
+        <parameter type-id='eaa32e2f' name='private_data' filepath='sound/core/control.c' line='230' column='1'/>
         <return type-id='7a5054b7'/>
       </function-decl>
       <function-decl name='snd_ctl_notify' mangled-name='snd_ctl_notify' filepath='sound/core/control.c' line='142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_ctl_notify'>
@@ -133480,22 +133304,22 @@
         <parameter type-id='eaa32e2f' name='device_data' filepath='sound/core/device.c' line='130' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_device_new' mangled-name='snd_device_new' filepath='include/sound/core.h' line='271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_device_new'>
-        <parameter type-id='52704eb7'/>
-        <parameter type-id='43cb465b'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='c00b0b11'/>
+      <function-decl name='snd_device_new' mangled-name='snd_device_new' filepath='sound/core/device.c' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_device_new'>
+        <parameter type-id='52704eb7' name='card' filepath='sound/core/device.c' line='29' column='1'/>
+        <parameter type-id='43cb465b' name='type' filepath='sound/core/device.c' line='29' column='1'/>
+        <parameter type-id='eaa32e2f' name='device_data' filepath='sound/core/device.c' line='30' column='1'/>
+        <parameter type-id='c00b0b11' name='ops' filepath='sound/core/device.c' line='30' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_dma_alloc_pages' mangled-name='snd_dma_alloc_pages' filepath='include/sound/memalloc.h' line='140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_dma_alloc_pages'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='a02b8cd2'/>
+      <function-decl name='snd_dma_alloc_pages' mangled-name='snd_dma_alloc_pages' filepath='sound/core/memalloc.c' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_dma_alloc_pages'>
+        <parameter type-id='95e97e5e' name='type' filepath='sound/core/memalloc.c' line='126' column='1'/>
+        <parameter type-id='fa0b179b' name='device' filepath='sound/core/memalloc.c' line='126' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/memalloc.c' line='126' column='1'/>
+        <parameter type-id='a02b8cd2' name='dmab' filepath='sound/core/memalloc.c' line='127' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_dma_free_pages' mangled-name='snd_dma_free_pages' filepath='include/sound/memalloc.h' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_dma_free_pages'>
-        <parameter type-id='a02b8cd2'/>
+      <function-decl name='snd_dma_free_pages' mangled-name='snd_dma_free_pages' filepath='sound/core/memalloc.c' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_dma_free_pages'>
+        <parameter type-id='a02b8cd2' name='dmab' filepath='sound/core/memalloc.c' line='226' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_dmaengine_pcm_close_release_chan' mangled-name='snd_dmaengine_pcm_close_release_chan' filepath='sound/core/pcm_dmaengine.c' line='367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_dmaengine_pcm_close_release_chan'>
@@ -133574,13 +133398,13 @@
         <parameter type-id='b9608bfc' name='entry' filepath='sound/core/info.c' line='767' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_info_register' mangled-name='snd_info_register' filepath='include/sound/info.h' line='134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_register'>
-        <parameter type-id='b9608bfc'/>
+      <function-decl name='snd_info_register' mangled-name='snd_info_register' filepath='sound/core/info.c' line='841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_info_register'>
+        <parameter type-id='b9608bfc' name='entry' filepath='sound/core/info.c' line='841' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_interval_refine' mangled-name='snd_interval_refine' filepath='include/sound/pcm.h' line='968' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_interval_refine'>
-        <parameter type-id='732e15ce'/>
-        <parameter type-id='1d0ab711'/>
+      <function-decl name='snd_interval_refine' mangled-name='snd_interval_refine' filepath='sound/core/pcm_lib.c' line='580' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_interval_refine'>
+        <parameter type-id='732e15ce' name='i' filepath='sound/core/pcm_lib.c' line='580' column='1'/>
+        <parameter type-id='1d0ab711' name='v' filepath='sound/core/pcm_lib.c' line='580' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_jack_new' mangled-name='snd_jack_new' filepath='sound/core/jack.c' line='198' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_jack_new'>
@@ -133632,8 +133456,8 @@
         <parameter type-id='67fa9bd5' name='format' filepath='sound/core/pcm_misc.c' line='299' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_format_physical_width' mangled-name='snd_pcm_format_physical_width' filepath='include/sound/pcm.h' line='1059' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_format_physical_width'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='snd_pcm_format_physical_width' mangled-name='snd_pcm_format_physical_width' filepath='sound/core/pcm_misc.c' line='366' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_format_physical_width'>
+        <parameter type-id='67fa9bd5' name='format' filepath='sound/core/pcm_misc.c' line='366' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_pcm_format_unsigned' mangled-name='snd_pcm_format_unsigned' filepath='sound/core/pcm_misc.c' line='282' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_format_unsigned'>
@@ -133649,9 +133473,9 @@
         <parameter type-id='eaa32e2f' name='eld' filepath='sound/core/pcm_drm_eld.c' line='80' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_hw_constraint_integer' mangled-name='snd_pcm_hw_constraint_integer' filepath='include/sound/pcm.h' line='986' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_integer'>
-        <parameter type-id='17a05af6'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='snd_pcm_hw_constraint_integer' mangled-name='snd_pcm_hw_constraint_integer' filepath='sound/core/pcm_lib.c' line='1219' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_integer'>
+        <parameter type-id='17a05af6' name='runtime' filepath='sound/core/pcm_lib.c' line='1219' column='1'/>
+        <parameter type-id='6b55ba25' name='var' filepath='sound/core/pcm_lib.c' line='1219' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_pcm_hw_constraint_list' mangled-name='snd_pcm_hw_constraint_list' filepath='sound/core/pcm_lib.c' line='1270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_list'>
@@ -133661,17 +133485,17 @@
         <parameter type-id='a5cedbd3' name='l' filepath='sound/core/pcm_lib.c' line='1273' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_hw_constraint_mask64' mangled-name='snd_pcm_hw_constraint_mask64' filepath='include/sound/pcm.h' line='982' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_mask64'>
-        <parameter type-id='17a05af6'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='3a47d82b'/>
+      <function-decl name='snd_pcm_hw_constraint_mask64' mangled-name='snd_pcm_hw_constraint_mask64' filepath='sound/core/pcm_lib.c' line='1195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_mask64'>
+        <parameter type-id='17a05af6' name='runtime' filepath='sound/core/pcm_lib.c' line='1195' column='1'/>
+        <parameter type-id='6b55ba25' name='var' filepath='sound/core/pcm_lib.c' line='1195' column='1'/>
+        <parameter type-id='f1f7b9a4' name='mask' filepath='sound/core/pcm_lib.c' line='1196' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_hw_constraint_minmax' mangled-name='snd_pcm_hw_constraint_minmax' filepath='include/sound/pcm.h' line='984' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_minmax'>
-        <parameter type-id='17a05af6'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='snd_pcm_hw_constraint_minmax' mangled-name='snd_pcm_hw_constraint_minmax' filepath='sound/core/pcm_lib.c' line='1238' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_minmax'>
+        <parameter type-id='17a05af6' name='runtime' filepath='sound/core/pcm_lib.c' line='1238' column='1'/>
+        <parameter type-id='6b55ba25' name='var' filepath='sound/core/pcm_lib.c' line='1238' column='1'/>
+        <parameter type-id='f0981eeb' name='min' filepath='sound/core/pcm_lib.c' line='1239' column='1'/>
+        <parameter type-id='f0981eeb' name='max' filepath='sound/core/pcm_lib.c' line='1239' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_pcm_hw_constraint_msbits' mangled-name='snd_pcm_hw_constraint_msbits' filepath='sound/core/pcm_lib.c' line='1414' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_constraint_msbits'>
@@ -133688,17 +133512,17 @@
         <parameter type-id='7359adad' name='step' filepath='sound/core/pcm_lib.c' line='1446' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_hw_limit_rates' mangled-name='snd_pcm_hw_limit_rates' filepath='include/sound/pcm.h' line='1130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_limit_rates'>
-        <parameter type-id='17e4a02a'/>
+      <function-decl name='snd_pcm_hw_limit_rates' mangled-name='snd_pcm_hw_limit_rates' filepath='sound/core/pcm_misc.c' line='490' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_limit_rates'>
+        <parameter type-id='17e4a02a' name='hw' filepath='sound/core/pcm_misc.c' line='490' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_hw_rule_add' mangled-name='snd_pcm_hw_rule_add' filepath='include/sound/pcm.h' line='1016' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_rule_add'>
-        <parameter type-id='17a05af6'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='657a5cf1'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='snd_pcm_hw_rule_add' mangled-name='snd_pcm_hw_rule_add' filepath='sound/core/pcm_lib.c' line='1119' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_hw_rule_add'>
+        <parameter type-id='17a05af6' name='runtime' filepath='sound/core/pcm_lib.c' line='1119' column='1'/>
+        <parameter type-id='f0981eeb' name='cond' filepath='sound/core/pcm_lib.c' line='1119' column='1'/>
+        <parameter type-id='95e97e5e' name='var' filepath='sound/core/pcm_lib.c' line='1120' column='1'/>
+        <parameter type-id='58d3b2a5' name='func' filepath='sound/core/pcm_lib.c' line='1121' column='1'/>
+        <parameter type-id='eaa32e2f' name='private' filepath='sound/core/pcm_lib.c' line='1121' column='1'/>
+        <parameter type-id='95e97e5e' name='dep' filepath='sound/core/pcm_lib.c' line='1122' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -133707,23 +133531,23 @@
         <parameter type-id='2ae08426' name='area' filepath='sound/core/pcm_native.c' line='3731' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_free_pages' mangled-name='snd_pcm_lib_free_pages' filepath='include/sound/pcm.h' line='1204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_free_pages'>
-        <parameter type-id='06b2cd14'/>
+      <function-decl name='snd_pcm_lib_free_pages' mangled-name='snd_pcm_lib_free_pages' filepath='sound/core/pcm_memory.c' line='432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_free_pages'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='432' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_ioctl' mangled-name='snd_pcm_lib_ioctl' filepath='include/sound/pcm.h' line='1067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_ioctl'>
-        <parameter type-id='06b2cd14'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='snd_pcm_lib_ioctl' mangled-name='snd_pcm_lib_ioctl' filepath='sound/core/pcm_lib.c' line='1765' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_ioctl'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_lib.c' line='1765' column='1'/>
+        <parameter type-id='f0981eeb' name='cmd' filepath='sound/core/pcm_lib.c' line='1766' column='1'/>
+        <parameter type-id='eaa32e2f' name='arg' filepath='sound/core/pcm_lib.c' line='1766' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_malloc_pages' mangled-name='snd_pcm_lib_malloc_pages' filepath='include/sound/pcm.h' line='1203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_malloc_pages'>
-        <parameter type-id='06b2cd14'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='snd_pcm_lib_malloc_pages' mangled-name='snd_pcm_lib_malloc_pages' filepath='sound/core/pcm_memory.c' line='378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_malloc_pages'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_memory.c' line='378' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='378' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_preallocate_free_for_all' mangled-name='snd_pcm_lib_preallocate_free_for_all' filepath='include/sound/pcm.h' line='1196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_free_for_all'>
-        <parameter type-id='4c9f335b'/>
+      <function-decl name='snd_pcm_lib_preallocate_free_for_all' mangled-name='snd_pcm_lib_preallocate_free_for_all' filepath='sound/core/pcm_memory.c' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_free_for_all'>
+        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='117' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_pcm_lib_preallocate_pages' mangled-name='snd_pcm_lib_preallocate_pages' filepath='sound/core/pcm_memory.c' line='274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_pages'>
@@ -133734,12 +133558,12 @@
         <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='276' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_lib_preallocate_pages_for_all' mangled-name='snd_pcm_lib_preallocate_pages_for_all' filepath='include/sound/pcm.h' line='1200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_pages_for_all'>
-        <parameter type-id='4c9f335b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='snd_pcm_lib_preallocate_pages_for_all' mangled-name='snd_pcm_lib_preallocate_pages_for_all' filepath='sound/core/pcm_memory.c' line='293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_lib_preallocate_pages_for_all'>
+        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='293' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='294' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='sound/core/pcm_memory.c' line='294' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='295' column='1'/>
+        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='295' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_pcm_new' mangled-name='snd_pcm_new' filepath='sound/core/pcm.c' line='773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_new'>
@@ -133751,8 +133575,8 @@
         <parameter type-id='0f9dfae3' name='rpcm' filepath='sound/core/pcm.c' line='774' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_pcm_period_elapsed' mangled-name='snd_pcm_period_elapsed' filepath='include/sound/pcm.h' line='1069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_period_elapsed'>
-        <parameter type-id='06b2cd14'/>
+      <function-decl name='snd_pcm_period_elapsed' mangled-name='snd_pcm_period_elapsed' filepath='sound/core/pcm_lib.c' line='1791' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_period_elapsed'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_lib.c' line='1791' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_pcm_rate_range_to_bits' mangled-name='snd_pcm_rate_range_to_bits' filepath='sound/core/pcm_misc.c' line='595' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_rate_range_to_bits'>
@@ -133764,18 +133588,18 @@
         <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_native.c' line='2631' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_set_managed_buffer_all' mangled-name='snd_pcm_set_managed_buffer_all' filepath='include/sound/pcm.h' line='1208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_managed_buffer_all'>
-        <parameter type-id='4c9f335b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='snd_pcm_set_managed_buffer_all' mangled-name='snd_pcm_set_managed_buffer_all' filepath='sound/core/pcm_memory.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_managed_buffer_all'>
+        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_memory.c' line='338' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='sound/core/pcm_memory.c' line='338' column='1'/>
+        <parameter type-id='fa0b179b' name='data' filepath='sound/core/pcm_memory.c' line='339' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='sound/core/pcm_memory.c' line='340' column='1'/>
+        <parameter type-id='b59d7dce' name='max' filepath='sound/core/pcm_memory.c' line='340' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_set_ops' mangled-name='snd_pcm_set_ops' filepath='include/sound/pcm.h' line='1064' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_ops'>
-        <parameter type-id='4c9f335b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f63b1a17'/>
+      <function-decl name='snd_pcm_set_ops' mangled-name='snd_pcm_set_ops' filepath='sound/core/pcm_lib.c' line='481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_ops'>
+        <parameter type-id='4c9f335b' name='pcm' filepath='sound/core/pcm_lib.c' line='481' column='1'/>
+        <parameter type-id='95e97e5e' name='direction' filepath='sound/core/pcm_lib.c' line='481' column='1'/>
+        <parameter type-id='f63b1a17' name='ops' filepath='sound/core/pcm_lib.c' line='482' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_pcm_set_sync' mangled-name='snd_pcm_set_sync' filepath='sound/core/pcm_lib.c' line='498' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_set_sync'>
@@ -133783,12 +133607,12 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='snd_pcm_std_chmaps' type-id='93f82aba' mangled-name='snd_pcm_std_chmaps' visibility='default' filepath='sound/core/pcm_lib.c' line='2266' column='1' elf-symbol-id='snd_pcm_std_chmaps'/>
-      <function-decl name='snd_pcm_stream_lock' mangled-name='snd_pcm_stream_lock' filepath='include/sound/pcm.h' line='612' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_stream_lock'>
-        <parameter type-id='06b2cd14'/>
+      <function-decl name='snd_pcm_stream_lock' mangled-name='snd_pcm_stream_lock' filepath='sound/core/pcm_native.c' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_stream_lock'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_native.c' line='108' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_pcm_stream_unlock' mangled-name='snd_pcm_stream_unlock' filepath='include/sound/pcm.h' line='613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_stream_unlock'>
-        <parameter type-id='06b2cd14'/>
+      <function-decl name='snd_pcm_stream_unlock' mangled-name='snd_pcm_stream_unlock' filepath='sound/core/pcm_native.c' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_stream_unlock'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/core/pcm_native.c' line='120' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_pcm_stream_unlock_irqrestore' mangled-name='snd_pcm_stream_unlock_irqrestore' filepath='sound/core/pcm_native.c' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_pcm_stream_unlock_irqrestore'>
@@ -133826,9 +133650,9 @@
         <parameter type-id='807869d3' name='tlv' filepath='sound/soc/soc-ops.c' line='741' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_card_get_kcontrol' mangled-name='snd_soc_card_get_kcontrol' filepath='include/sound/soc-card.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_card_get_kcontrol'>
-        <parameter type-id='3059cd0b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='snd_soc_card_get_kcontrol' mangled-name='snd_soc_card_get_kcontrol' filepath='sound/soc/soc-card.c' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_card_get_kcontrol'>
+        <parameter type-id='3059cd0b' name='soc_card' filepath='sound/soc/soc-card.c' line='29' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='sound/soc/soc-card.c' line='30' column='1'/>
         <return type-id='7a5054b7'/>
       </function-decl>
       <function-decl name='snd_soc_card_jack_new' mangled-name='snd_soc_card_jack_new' filepath='sound/soc/soc-card.c' line='60' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_card_jack_new'>
@@ -133840,8 +133664,8 @@
         <parameter type-id='f0981eeb' name='num_pins' filepath='sound/soc/soc-card.c' line='62' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_component_async_complete' mangled-name='snd_soc_component_async_complete' filepath='include/sound/soc-component.h' line='350' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_async_complete'>
-        <parameter type-id='807b7702'/>
+      <function-decl name='snd_soc_component_async_complete' mangled-name='snd_soc_component_async_complete' filepath='sound/soc/soc-component.c' line='586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_async_complete'>
+        <parameter type-id='807b7702' name='component' filepath='sound/soc/soc-component.c' line='586' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_soc_component_disable_pin' mangled-name='snd_soc_component_disable_pin' filepath='sound/soc/soc-component.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_disable_pin'>
@@ -133873,45 +133697,45 @@
         <parameter type-id='29af9a71' name='regmap' filepath='sound/soc/soc-component.c' line='388' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_soc_component_read' mangled-name='snd_soc_component_read' filepath='include/sound/soc-component.h' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_read'>
-        <parameter type-id='807b7702'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='snd_soc_component_read' mangled-name='snd_soc_component_read' filepath='sound/soc/soc-component.c' line='444' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_read'>
+        <parameter type-id='807b7702' name='component' filepath='sound/soc/soc-component.c' line='444' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='sound/soc/soc-component.c' line='445' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='snd_soc_component_set_jack' mangled-name='snd_soc_component_set_jack' filepath='include/sound/soc-component.h' line='362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_set_jack'>
-        <parameter type-id='807b7702'/>
-        <parameter type-id='12a060a4'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='snd_soc_component_set_jack' mangled-name='snd_soc_component_set_jack' filepath='sound/soc/soc-component.c' line='228' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_set_jack'>
+        <parameter type-id='807b7702' name='component' filepath='sound/soc/soc-component.c' line='228' column='1'/>
+        <parameter type-id='12a060a4' name='jack' filepath='sound/soc/soc-component.c' line='229' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='sound/soc/soc-component.c' line='229' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_component_set_pll' mangled-name='snd_soc_component_set_pll' filepath='include/sound/soc-component.h' line='359' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_set_pll'>
-        <parameter type-id='807b7702'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='snd_soc_component_set_pll' mangled-name='snd_soc_component_set_pll' filepath='sound/soc/soc-component.c' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_set_pll'>
+        <parameter type-id='807b7702' name='component' filepath='sound/soc/soc-component.c' line='95' column='1'/>
+        <parameter type-id='95e97e5e' name='pll_id' filepath='sound/soc/soc-component.c' line='95' column='1'/>
+        <parameter type-id='95e97e5e' name='source' filepath='sound/soc/soc-component.c' line='96' column='1'/>
+        <parameter type-id='f0981eeb' name='freq_in' filepath='sound/soc/soc-component.c' line='96' column='1'/>
+        <parameter type-id='f0981eeb' name='freq_out' filepath='sound/soc/soc-component.c' line='97' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_component_set_sysclk' mangled-name='snd_soc_component_set_sysclk' filepath='include/sound/soc-component.h' line='356' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_set_sysclk'>
-        <parameter type-id='807b7702'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='snd_soc_component_set_sysclk' mangled-name='snd_soc_component_set_sysclk' filepath='sound/soc/soc-component.c' line='71' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_set_sysclk'>
+        <parameter type-id='807b7702' name='component' filepath='sound/soc/soc-component.c' line='71' column='1'/>
+        <parameter type-id='95e97e5e' name='clk_id' filepath='sound/soc/soc-component.c' line='72' column='1'/>
+        <parameter type-id='95e97e5e' name='source' filepath='sound/soc/soc-component.c' line='72' column='1'/>
+        <parameter type-id='f0981eeb' name='freq' filepath='sound/soc/soc-component.c' line='72' column='1'/>
+        <parameter type-id='95e97e5e' name='dir' filepath='sound/soc/soc-component.c' line='73' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_component_test_bits' mangled-name='snd_soc_component_test_bits' filepath='include/sound/soc-component.h' line='351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_test_bits'>
-        <parameter type-id='807b7702'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='snd_soc_component_test_bits' mangled-name='snd_soc_component_test_bits' filepath='sound/soc/soc-component.c' line='605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_test_bits'>
+        <parameter type-id='807b7702' name='component' filepath='sound/soc/soc-component.c' line='605' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='sound/soc/soc-component.c' line='606' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='sound/soc/soc-component.c' line='606' column='1'/>
+        <parameter type-id='f0981eeb' name='value' filepath='sound/soc/soc-component.c' line='606' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_component_update_bits' mangled-name='snd_soc_component_update_bits' filepath='include/sound/soc-component.h' line='344' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_update_bits'>
-        <parameter type-id='807b7702'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='snd_soc_component_update_bits' mangled-name='snd_soc_component_update_bits' filepath='sound/soc/soc-component.c' line='524' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_update_bits'>
+        <parameter type-id='807b7702' name='component' filepath='sound/soc/soc-component.c' line='524' column='1'/>
+        <parameter type-id='f0981eeb' name='reg' filepath='sound/soc/soc-component.c' line='525' column='1'/>
+        <parameter type-id='f0981eeb' name='mask' filepath='sound/soc/soc-component.c' line='525' column='1'/>
+        <parameter type-id='f0981eeb' name='val' filepath='sound/soc/soc-component.c' line='525' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_component_update_bits_async' mangled-name='snd_soc_component_update_bits_async' filepath='sound/soc/soc-component.c' line='560' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_component_update_bits_async'>
@@ -133956,9 +133780,9 @@
         <parameter type-id='807869d3' name='rx_slot' filepath='sound/soc/soc-dai.c' line='241' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dai_set_fmt' mangled-name='snd_soc_dai_set_fmt' filepath='include/sound/soc-dai.h' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dai_set_fmt'>
-        <parameter type-id='1c936db9'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='snd_soc_dai_set_fmt' mangled-name='snd_soc_dai_set_fmt' filepath='sound/soc/soc-dai.c' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dai_set_fmt'>
+        <parameter type-id='1c936db9' name='dai' filepath='sound/soc/soc-dai.c' line='144' column='1'/>
+        <parameter type-id='f0981eeb' name='fmt' filepath='sound/soc/soc-dai.c' line='144' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_dai_set_pll' mangled-name='snd_soc_dai_set_pll' filepath='sound/soc/soc-dai.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dai_set_pll'>
@@ -133989,10 +133813,10 @@
         <parameter type-id='95e97e5e' name='tristate' filepath='sound/soc/soc-dai.c' line='284' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_add_routes' mangled-name='snd_soc_dapm_add_routes' filepath='include/sound/soc-dapm.h' line='445' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_add_routes'>
-        <parameter type-id='70d004a5'/>
-        <parameter type-id='8f3d28b8'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='snd_soc_dapm_add_routes' mangled-name='snd_soc_dapm_add_routes' filepath='sound/soc/soc-dapm.c' line='3068' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_add_routes'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3068' column='1'/>
+        <parameter type-id='8f3d28b8' name='route' filepath='sound/soc/soc-dapm.c' line='3069' column='1'/>
+        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3069' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_dapm_del_routes' mangled-name='snd_soc_dapm_del_routes' filepath='sound/soc/soc-dapm.c' line='3099' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_del_routes'>
@@ -134084,14 +133908,14 @@
         <parameter type-id='dae78f89' name='widget' filepath='sound/soc/soc-dapm.c' line='3749' column='1'/>
         <return type-id='810606ec'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_new_controls' mangled-name='snd_soc_dapm_new_controls' filepath='include/sound/soc-dapm.h' line='421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_controls'>
-        <parameter type-id='70d004a5'/>
-        <parameter type-id='dae78f89'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='snd_soc_dapm_new_controls' mangled-name='snd_soc_dapm_new_controls' filepath='sound/soc/soc-dapm.c' line='3771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_controls'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3771' column='1'/>
+        <parameter type-id='dae78f89' name='widget' filepath='sound/soc/soc-dapm.c' line='3772' column='1'/>
+        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3773' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_new_widgets' mangled-name='snd_soc_dapm_new_widgets' filepath='include/sound/soc-dapm.h' line='440' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_widgets'>
-        <parameter type-id='3059cd0b'/>
+      <function-decl name='snd_soc_dapm_new_widgets' mangled-name='snd_soc_dapm_new_widgets' filepath='sound/soc/soc-dapm.c' line='3203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_widgets'>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-dapm.c' line='3203' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_dapm_put_enum_double' mangled-name='snd_soc_dapm_put_enum_double' filepath='sound/soc/soc-dapm.c' line='3465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_put_enum_double'>
@@ -134109,8 +133933,8 @@
         <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3337' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_sync' mangled-name='snd_soc_dapm_sync' filepath='include/sound/soc-dapm.h' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_sync'>
-        <parameter type-id='70d004a5'/>
+      <function-decl name='snd_soc_dapm_sync' mangled-name='snd_soc_dapm_sync' filepath='sound/soc/soc-dapm.c' line='2605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_sync'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='2605' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_dapm_sync_unlocked' mangled-name='snd_soc_dapm_sync_unlocked' filepath='sound/soc/soc-dapm.c' line='2583' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_sync_unlocked'>
@@ -134355,9 +134179,9 @@
         <parameter type-id='f0981eeb' name='dai_fmt' filepath='sound/soc/soc-core.c' line='1423' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_set_runtime_hwparams' mangled-name='snd_soc_set_runtime_hwparams' filepath='include/sound/soc.h' line='499' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_set_runtime_hwparams'>
-        <parameter type-id='06b2cd14'/>
-        <parameter type-id='d661a615'/>
+      <function-decl name='snd_soc_set_runtime_hwparams' mangled-name='snd_soc_set_runtime_hwparams' filepath='sound/soc/soc-pcm.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_set_runtime_hwparams'>
+        <parameter type-id='06b2cd14' name='substream' filepath='sound/soc/soc-pcm.c' line='263' column='1'/>
+        <parameter type-id='d661a615' name='hw' filepath='sound/soc/soc-pcm.c' line='264' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_tplg_component_load' mangled-name='snd_soc_tplg_component_load' filepath='sound/soc/soc-topology.c' line='2807' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_tplg_component_load'>
@@ -134446,9 +134270,9 @@
         <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2158' column='1'/>
         <return type-id='d80b72e6'/>
       </function-decl>
-      <function-decl name='sock_init_data' mangled-name='sock_init_data' filepath='include/net/sock.h' line='1761' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_init_data'>
-        <parameter type-id='13103032'/>
-        <parameter type-id='f772df6d'/>
+      <function-decl name='sock_init_data' mangled-name='sock_init_data' filepath='net/core/sock.c' line='2970' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_init_data'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2970' column='1'/>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2970' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sock_no_accept' mangled-name='sock_no_accept' filepath='net/core/sock.c' line='2754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_accept'>
@@ -134469,13 +134293,13 @@
         <parameter type-id='2ae08426' name='vma' filepath='net/core/sock.c' line='2805' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_sendpage' mangled-name='sock_no_sendpage' filepath='include/net/sock.h' line='1738' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_sendpage'>
-        <parameter type-id='13103032'/>
-        <parameter type-id='02f11ed4'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='sock_no_sendpage' mangled-name='sock_no_sendpage' filepath='net/core/sock.c' line='2833' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_sendpage'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2833' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='net/core/sock.c' line='2833' column='1'/>
+        <parameter type-id='95e97e5e' name='offset' filepath='net/core/sock.c' line='2833' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='net/core/sock.c' line='2833' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2833' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='sock_no_shutdown' mangled-name='sock_no_shutdown' filepath='net/core/sock.c' line='2780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_shutdown'>
         <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2780' column='1'/>
@@ -134487,29 +134311,29 @@
         <parameter type-id='13103032' name='sock2' filepath='net/core/sock.c' line='2748' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_queue_rcv_skb' mangled-name='sock_queue_rcv_skb' filepath='include/net/sock.h' line='2240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_queue_rcv_skb'>
-        <parameter type-id='f772df6d'/>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='sock_queue_rcv_skb' mangled-name='sock_queue_rcv_skb' filepath='net/core/sock.c' line='475' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_queue_rcv_skb'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='475' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='475' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_register' mangled-name='sock_register' filepath='include/linux/net.h' line='235' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_register'>
-        <parameter type-id='81a51edb'/>
+      <function-decl name='sock_register' mangled-name='sock_register' filepath='net/socket.c' line='2975' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_register'>
+        <parameter type-id='81a51edb' name='ops' filepath='net/socket.c' line='2975' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_release' mangled-name='sock_release' filepath='include/linux/net.h' line='244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_release'>
-        <parameter type-id='13103032'/>
+      <function-decl name='sock_release' mangled-name='sock_release' filepath='net/socket.c' line='623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_release'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='623' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_setsockopt' mangled-name='sock_setsockopt' filepath='include/net/sock.h' line='1687' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_setsockopt'>
-        <parameter type-id='13103032'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='8271351e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='sock_setsockopt' mangled-name='sock_setsockopt' filepath='net/core/sock.c' line='833' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_setsockopt'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='833' column='1'/>
+        <parameter type-id='95e97e5e' name='level' filepath='net/core/sock.c' line='833' column='1'/>
+        <parameter type-id='95e97e5e' name='optname' filepath='net/core/sock.c' line='833' column='1'/>
+        <parameter type-id='298d29fd' name='optval' filepath='net/core/sock.c' line='834' column='1'/>
+        <parameter type-id='f0981eeb' name='optlen' filepath='net/core/sock.c' line='834' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_unregister' mangled-name='sock_unregister' filepath='include/linux/net.h' line='236' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_unregister'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='sock_unregister' mangled-name='sock_unregister' filepath='net/socket.c' line='3012' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_unregister'>
+        <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='3012' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sock_wfree' mangled-name='sock_wfree' filepath='net/core/sock.c' line='2036' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_wfree'>
@@ -134567,9 +134391,9 @@
         <parameter type-id='e90f4666' name='spi' filepath='drivers/spi/spi.c' line='3344' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='spi_sync' mangled-name='spi_sync' filepath='include/linux/spi/spi.h' line='1256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='spi_sync'>
-        <parameter type-id='e90f4666'/>
-        <parameter type-id='bb7889ed'/>
+      <function-decl name='spi_sync' mangled-name='spi_sync' filepath='drivers/spi/spi.c' line='3885' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='spi_sync'>
+        <parameter type-id='e90f4666' name='spi' filepath='drivers/spi/spi.c' line='3885' column='1'/>
+        <parameter type-id='bb7889ed' name='message' filepath='drivers/spi/spi.c' line='3885' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='spi_sync_locked' mangled-name='spi_sync_locked' filepath='drivers/spi/spi.c' line='3913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='spi_sync_locked'>
@@ -134581,9 +134405,9 @@
         <parameter type-id='f22e4524' name='ctlr' filepath='drivers/spi/spi.c' line='2873' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='split_page' mangled-name='split_page' filepath='include/linux/mm.h' line='924' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='split_page'>
-        <parameter type-id='02f11ed4'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='split_page' mangled-name='split_page' filepath='mm/page_alloc.c' line='3395' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='split_page'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/page_alloc.c' line='3395' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='mm/page_alloc.c' line='3395' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='spmi_controller_add' mangled-name='spmi_controller_add' filepath='drivers/spmi/spmi.c' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='spmi_controller_add'>
@@ -134707,9 +134531,9 @@
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='stack_depot_fetch' mangled-name='stack_depot_fetch' filepath='include/linux/stackdepot.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stack_depot_fetch'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='9b88c47d'/>
+      <function-decl name='stack_depot_fetch' mangled-name='stack_depot_fetch' filepath='lib/stackdepot.c' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stack_depot_fetch'>
+        <parameter type-id='613ae993' name='handle' filepath='lib/stackdepot.c' line='226' column='1'/>
+        <parameter type-id='9b88c47d' name='entries' filepath='lib/stackdepot.c' line='227' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='stack_trace_print' mangled-name='stack_trace_print' filepath='kernel/stacktrace.c' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stack_trace_print'>
@@ -134735,30 +134559,30 @@
         <parameter type-id='f8840c23' name='key' filepath='kernel/jump_label.c' line='212' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='static_key_disable_cpuslocked' mangled-name='static_key_disable_cpuslocked' filepath='include/linux/jump_label.h' line='252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_disable_cpuslocked'>
-        <parameter type-id='f8840c23'/>
+      <function-decl name='static_key_disable_cpuslocked' mangled-name='static_key_disable_cpuslocked' filepath='kernel/jump_label.c' line='195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_disable_cpuslocked'>
+        <parameter type-id='f8840c23' name='key' filepath='kernel/jump_label.c' line='195' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='static_key_slow_dec' mangled-name='static_key_slow_dec' filepath='include/linux/jump_label.h' line='244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_slow_dec'>
-        <parameter type-id='f8840c23'/>
+      <function-decl name='static_key_slow_dec' mangled-name='static_key_slow_dec' filepath='kernel/jump_label.c' line='267' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_slow_dec'>
+        <parameter type-id='f8840c23' name='key' filepath='kernel/jump_label.c' line='267' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='static_key_slow_inc' mangled-name='static_key_slow_inc' filepath='include/linux/jump_label.h' line='243' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_slow_inc'>
-        <parameter type-id='f8840c23'/>
+      <function-decl name='static_key_slow_inc' mangled-name='static_key_slow_inc' filepath='kernel/jump_label.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='static_key_slow_inc'>
+        <parameter type-id='f8840c23' name='key' filepath='kernel/jump_label.c' line='156' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='stop_machine' mangled-name='stop_machine' filepath='include/linux/stop_machine.h' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stop_machine'>
-        <parameter type-id='b9b212f5'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='5f8a1ac4'/>
+      <function-decl name='stop_machine' mangled-name='stop_machine' filepath='kernel/stop_machine.c' line='642' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stop_machine'>
+        <parameter type-id='87dfefa3' name='fn' filepath='kernel/stop_machine.c' line='642' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='kernel/stop_machine.c' line='642' column='1'/>
+        <parameter type-id='5f8a1ac4' name='cpus' filepath='kernel/stop_machine.c' line='642' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='stop_one_cpu_nowait' mangled-name='stop_one_cpu_nowait' filepath='include/linux/stop_machine.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stop_one_cpu_nowait'>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='b9b212f5'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='cc8decc0'/>
-        <return type-id='c894953d'/>
+      <function-decl name='stop_one_cpu_nowait' mangled-name='stop_one_cpu_nowait' filepath='kernel/stop_machine.c' line='358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stop_one_cpu_nowait'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='kernel/stop_machine.c' line='358' column='1'/>
+        <parameter type-id='87dfefa3' name='fn' filepath='kernel/stop_machine.c' line='358' column='1'/>
+        <parameter type-id='eaa32e2f' name='arg' filepath='kernel/stop_machine.c' line='358' column='1'/>
+        <parameter type-id='cc8decc0' name='work_buf' filepath='kernel/stop_machine.c' line='359' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='stpcpy' mangled-name='stpcpy' filepath='lib/string.c' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stpcpy'>
         <parameter type-id='266fe297' name='dest' filepath='lib/string.c' line='291' column='1'/>
@@ -134775,9 +134599,9 @@
         <parameter type-id='80f4b756' name='src' filepath='lib/string.c' line='306' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='strchrnul' mangled-name='strchrnul' filepath='include/linux/string.h' line='63' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strchrnul'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='strchrnul' mangled-name='strchrnul' filepath='lib/string.c' line='452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strchrnul'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/string.c' line='452' column='1'/>
+        <parameter type-id='95e97e5e' name='c' filepath='lib/string.c' line='452' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='strcpy' mangled-name='strcpy' filepath='lib/string.c' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strcpy'>
@@ -134795,8 +134619,8 @@
         <parameter type-id='77e79a4b' name='filp' filepath='fs/open.c' line='1419' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='strim' mangled-name='strim' filepath='include/linux/string.h' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strim'>
-        <parameter type-id='26a90f95'/>
+      <function-decl name='strim' mangled-name='strim' filepath='lib/string.c' line='541' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strim'>
+        <parameter type-id='26a90f95' name='s' filepath='lib/string.c' line='541' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='string_get_size' mangled-name='string_get_size' filepath='lib/string_helpers.c' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='string_get_size'>
@@ -134831,10 +134655,10 @@
         <parameter type-id='b59d7dce' name='count' filepath='lib/string.c' line='329' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='strnchr' mangled-name='strnchr' filepath='include/linux/string.h' line='67' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strnchr'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='strnchr' mangled-name='strnchr' filepath='lib/string.c' line='506' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strnchr'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/string.c' line='506' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/string.c' line='506' column='1'/>
+        <parameter type-id='95e97e5e' name='c' filepath='lib/string.c' line='506' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='strncpy' mangled-name='strncpy' filepath='lib/string.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strncpy'>
@@ -134843,21 +134667,21 @@
         <parameter type-id='b59d7dce' name='count' filepath='lib/string.c' line='114' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='strncpy_from_user' mangled-name='strncpy_from_user' filepath='arch/arm64/include/asm/uaccess.h' line='509' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strncpy_from_user'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='strncpy_from_user' mangled-name='strncpy_from_user' filepath='lib/strncpy_from_user.c' line='113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strncpy_from_user'>
+        <parameter type-id='26a90f95' name='dst' filepath='lib/strncpy_from_user.c' line='113' column='1'/>
+        <parameter type-id='80f4b756' name='src' filepath='lib/strncpy_from_user.c' line='113' column='1'/>
+        <parameter type-id='bd54fe1a' name='count' filepath='lib/strncpy_from_user.c' line='113' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='strndup_user' mangled-name='strndup_user' filepath='include/linux/string.h' line='12' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strndup_user'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='bd54fe1a'/>
+      <function-decl name='strndup_user' mangled-name='strndup_user' filepath='mm/util.c' line='222' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strndup_user'>
+        <parameter type-id='80f4b756' name='s' filepath='mm/util.c' line='222' column='1'/>
+        <parameter type-id='bd54fe1a' name='n' filepath='mm/util.c' line='222' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='strnstr' mangled-name='strnstr' filepath='include/linux/string.h' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strnstr'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='strnstr' mangled-name='strnstr' filepath='lib/string.c' line='1026' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strnstr'>
+        <parameter type-id='80f4b756' name='s1' filepath='lib/string.c' line='1026' column='1'/>
+        <parameter type-id='80f4b756' name='s2' filepath='lib/string.c' line='1026' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='lib/string.c' line='1026' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='strpbrk' mangled-name='strpbrk' filepath='lib/string.c' line='649' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strpbrk'>
@@ -134865,21 +134689,21 @@
         <parameter type-id='80f4b756' name='ct' filepath='lib/string.c' line='649' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='strreplace' mangled-name='strreplace' filepath='include/linux/string.h' line='172' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strreplace'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='a84c031d'/>
-        <parameter type-id='a84c031d'/>
+      <function-decl name='strreplace' mangled-name='strreplace' filepath='lib/string.c' line='1141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strreplace'>
+        <parameter type-id='26a90f95' name='s' filepath='lib/string.c' line='1141' column='1'/>
+        <parameter type-id='a84c031d' name='old' filepath='lib/string.c' line='1141' column='1'/>
+        <parameter type-id='a84c031d' name='new' filepath='lib/string.c' line='1141' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='strscpy' mangled-name='strscpy' filepath='include/linux/string.h' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strscpy'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='bd54fe1a'/>
+      <function-decl name='strscpy' mangled-name='strscpy' filepath='lib/string.c' line='180' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strscpy'>
+        <parameter type-id='26a90f95' name='dest' filepath='lib/string.c' line='180' column='1'/>
+        <parameter type-id='80f4b756' name='src' filepath='lib/string.c' line='180' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='lib/string.c' line='180' column='1'/>
+        <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='strsep' mangled-name='strsep' filepath='include/linux/string.h' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strsep'>
-        <parameter type-id='9b23c9ad'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='strsep' mangled-name='strsep' filepath='lib/string.c' line='676' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strsep'>
+        <parameter type-id='9b23c9ad' name='s' filepath='lib/string.c' line='676' column='1'/>
+        <parameter type-id='80f4b756' name='ct' filepath='lib/string.c' line='676' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
       <function-decl name='strspn' mangled-name='strspn' filepath='lib/string.c' line='598' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='strspn'>
@@ -134898,12 +134722,12 @@
         <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3082' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='include/linux/bio.h' line='415' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
-        <parameter type-id='fb55efa1'/>
-        <return type-id='f0981eeb'/>
+      <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-core.c' line='1076' column='1'/>
+        <return type-id='041bc907'/>
       </function-decl>
-      <function-decl name='submit_bio_wait' mangled-name='submit_bio_wait' filepath='include/linux/bio.h' line='434' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_wait'>
-        <parameter type-id='fb55efa1'/>
+      <function-decl name='submit_bio_wait' mangled-name='submit_bio_wait' filepath='block/bio.c' line='1157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio_wait'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/bio.c' line='1157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='subsys_system_register' mangled-name='subsys_system_register' filepath='drivers/base/bus.c' line='1157' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='subsys_system_register'>
@@ -134918,26 +134742,26 @@
       <function-decl name='swiotlb_nr_tbl' mangled-name='swiotlb_nr_tbl' filepath='kernel/dma/swiotlb.c' line='132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='swiotlb_nr_tbl'>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='sync_blockdev' mangled-name='sync_blockdev' filepath='include/linux/blkdev.h' line='2038' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sync_blockdev'>
-        <parameter type-id='b88dd945'/>
+      <function-decl name='sync_blockdev' mangled-name='sync_blockdev' filepath='fs/block_dev.c' line='537' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sync_blockdev'>
+        <parameter type-id='b88dd945' name='bdev' filepath='fs/block_dev.c' line='537' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sync_file_create' mangled-name='sync_file_create' filepath='include/linux/sync_file.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sync_file_create'>
-        <parameter type-id='28271da3'/>
+      <function-decl name='sync_file_create' mangled-name='sync_file_create' filepath='drivers/dma-buf/sync_file.c' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sync_file_create'>
+        <parameter type-id='28271da3' name='fence' filepath='drivers/dma-buf/sync_file.c' line='64' column='1'/>
         <return type-id='6a6b0b01'/>
       </function-decl>
-      <function-decl name='sync_file_get_fence' mangled-name='sync_file_get_fence' filepath='include/linux/sync_file.h' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sync_file_get_fence'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='sync_file_get_fence' mangled-name='sync_file_get_fence' filepath='drivers/dma-buf/sync_file.c' line='102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sync_file_get_fence'>
+        <parameter type-id='95e97e5e' name='fd' filepath='drivers/dma-buf/sync_file.c' line='102' column='1'/>
         <return type-id='28271da3'/>
       </function-decl>
       <function-decl name='synchronize_irq' mangled-name='synchronize_irq' filepath='kernel/irq/manage.c' line='127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_irq'>
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/manage.c' line='127' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='synchronize_net' mangled-name='synchronize_net' filepath='include/linux/netdevice.h' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_net'>
+      <function-decl name='synchronize_net' mangled-name='synchronize_net' filepath='net/core/dev.c' line='10707' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_net'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='synchronize_rcu' mangled-name='synchronize_rcu' filepath='include/linux/rcupdate.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu'>
+      <function-decl name='synchronize_rcu' mangled-name='synchronize_rcu' filepath='kernel/rcu/tree.c' line='3666' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='synchronize_rcu_expedited' mangled-name='synchronize_rcu_expedited' filepath='kernel/rcu/tree_exp.h' line='813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_expedited'>
@@ -134949,12 +134773,12 @@
       <function-decl name='synchronize_rcu_tasks_trace' mangled-name='synchronize_rcu_tasks_trace' filepath='kernel/rcu/tasks.h' line='1163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_rcu_tasks_trace'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='synchronize_srcu' mangled-name='synchronize_srcu' filepath='include/linux/srcu.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_srcu'>
-        <parameter type-id='f7d7131a'/>
+      <function-decl name='synchronize_srcu' mangled-name='synchronize_srcu' filepath='kernel/rcu/srcutree.c' line='1009' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_srcu'>
+        <parameter type-id='f7d7131a' name='ssp' filepath='kernel/rcu/srcutree.c' line='1009' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='synchronize_srcu_expedited' mangled-name='synchronize_srcu_expedited' filepath='include/linux/srcutree.h' line='137' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_srcu_expedited'>
-        <parameter type-id='f7d7131a'/>
+      <function-decl name='synchronize_srcu_expedited' mangled-name='synchronize_srcu_expedited' filepath='kernel/rcu/srcutree.c' line='959' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synchronize_srcu_expedited'>
+        <parameter type-id='f7d7131a' name='ssp' filepath='kernel/rcu/srcutree.c' line='959' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='synth_event_create' mangled-name='synth_event_create' filepath='kernel/trace/trace_events_synth.c' line='1301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='synth_event_create'>
@@ -134969,23 +134793,23 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='sys_tz' type-id='6751193a' mangled-name='sys_tz' visibility='default' filepath='kernel/time/time.c' line='50' column='1' elf-symbol-id='sys_tz'/>
-      <function-decl name='syscon_node_to_regmap' mangled-name='syscon_node_to_regmap' filepath='include/linux/mfd/syscon.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscon_node_to_regmap'>
-        <parameter type-id='9a537bbe'/>
+      <function-decl name='syscon_node_to_regmap' mangled-name='syscon_node_to_regmap' filepath='drivers/mfd/syscon.c' line='183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscon_node_to_regmap'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/mfd/syscon.c' line='183' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
-      <function-decl name='syscon_regmap_lookup_by_compatible' mangled-name='syscon_regmap_lookup_by_compatible' filepath='include/linux/mfd/syscon.h' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscon_regmap_lookup_by_compatible'>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='syscon_regmap_lookup_by_compatible' mangled-name='syscon_regmap_lookup_by_compatible' filepath='drivers/mfd/syscon.c' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscon_regmap_lookup_by_compatible'>
+        <parameter type-id='80f4b756' name='s' filepath='drivers/mfd/syscon.c' line='192' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
-      <function-decl name='syscon_regmap_lookup_by_phandle' mangled-name='syscon_regmap_lookup_by_phandle' filepath='include/linux/mfd/syscon.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscon_regmap_lookup_by_phandle'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='syscon_regmap_lookup_by_phandle' mangled-name='syscon_regmap_lookup_by_phandle' filepath='drivers/mfd/syscon.c' line='208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscon_regmap_lookup_by_phandle'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/mfd/syscon.c' line='208' column='1'/>
+        <parameter type-id='80f4b756' name='property' filepath='drivers/mfd/syscon.c' line='209' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
-      <function-decl name='syscore_resume' mangled-name='syscore_resume' filepath='include/linux/syscore_ops.h' line='24' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscore_resume'>
+      <function-decl name='syscore_resume' mangled-name='syscore_resume' filepath='drivers/base/syscore.c' line='94' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscore_resume'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='syscore_suspend' mangled-name='syscore_suspend' filepath='include/linux/syscore_ops.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscore_suspend'>
+      <function-decl name='syscore_suspend' mangled-name='syscore_suspend' filepath='drivers/base/syscore.c' line='48' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='syscore_suspend'>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='sysctl_sched_features' type-id='f0981eeb' mangled-name='sysctl_sched_features' visibility='default' filepath='kernel/sched/core.c' line='69' column='1' elf-symbol-id='sysctl_sched_features'/>
@@ -135004,15 +134828,15 @@
         <parameter type-id='80f4b756' name='link_name' filepath='fs/sysfs/group.c' line='383' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sysfs_create_bin_file' mangled-name='sysfs_create_bin_file' filepath='include/linux/sysfs.h' line='264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_bin_file'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='559ac6f0'/>
+      <function-decl name='sysfs_create_bin_file' mangled-name='sysfs_create_bin_file' filepath='fs/sysfs/file.c' line='537' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_bin_file'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/file.c' line='537' column='1'/>
+        <parameter type-id='559ac6f0' name='attr' filepath='fs/sysfs/file.c' line='538' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sysfs_create_file_ns' mangled-name='sysfs_create_file_ns' filepath='include/linux/sysfs.h' line='249' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_file_ns'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='cfe4f8a2'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='sysfs_create_file_ns' mangled-name='sysfs_create_file_ns' filepath='fs/sysfs/file.c' line='322' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_file_ns'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/file.c' line='322' column='1'/>
+        <parameter type-id='cfe4f8a2' name='attr' filepath='fs/sysfs/file.c' line='322' column='1'/>
+        <parameter type-id='eaa32e2f' name='ns' filepath='fs/sysfs/file.c' line='323' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sysfs_create_files' mangled-name='sysfs_create_files' filepath='fs/sysfs/file.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_files'>
@@ -135025,20 +134849,20 @@
         <parameter type-id='8ff9530e' name='grp' filepath='fs/sysfs/group.c' line='173' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sysfs_create_groups' mangled-name='sysfs_create_groups' filepath='include/linux/sysfs.h' line='285' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_groups'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='c97de1ac'/>
+      <function-decl name='sysfs_create_groups' mangled-name='sysfs_create_groups' filepath='fs/sysfs/group.c' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_groups'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/group.c' line='212' column='1'/>
+        <parameter type-id='c97de1ac' name='groups' filepath='fs/sysfs/group.c' line='213' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sysfs_create_link' mangled-name='sysfs_create_link' filepath='include/linux/sysfs.h' line='269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_link'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='sysfs_create_link' mangled-name='sysfs_create_link' filepath='fs/sysfs/symlink.c' line='89' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_create_link'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/symlink.c' line='89' column='1'/>
+        <parameter type-id='d30bdc51' name='target' filepath='fs/sysfs/symlink.c' line='89' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='fs/sysfs/symlink.c' line='90' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sysfs_emit' mangled-name='sysfs_emit' filepath='include/linux/sysfs.h' line='333' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_emit'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='sysfs_emit' mangled-name='sysfs_emit' filepath='fs/sysfs/file.c' line='721' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_emit'>
+        <parameter type-id='26a90f95' name='buf' filepath='fs/sysfs/file.c' line='721' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='fs/sysfs/file.c' line='721' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
@@ -135060,9 +134884,9 @@
         <parameter type-id='80f4b756' name='attr' filepath='fs/sysfs/file.c' line='173' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sysfs_remove_bin_file' mangled-name='sysfs_remove_bin_file' filepath='include/linux/sysfs.h' line='266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_bin_file'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='559ac6f0'/>
+      <function-decl name='sysfs_remove_bin_file' mangled-name='sysfs_remove_bin_file' filepath='fs/sysfs/file.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_bin_file'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/file.c' line='557' column='1'/>
+        <parameter type-id='559ac6f0' name='attr' filepath='fs/sysfs/file.c' line='558' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sysfs_remove_file_from_group' mangled-name='sysfs_remove_file_from_group' filepath='fs/sysfs/file.c' line='513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_file_from_group'>
@@ -135071,10 +134895,10 @@
         <parameter type-id='80f4b756' name='group' filepath='fs/sysfs/file.c' line='514' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sysfs_remove_file_ns' mangled-name='sysfs_remove_file_ns' filepath='include/linux/sysfs.h' line='259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_file_ns'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='cfe4f8a2'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='sysfs_remove_file_ns' mangled-name='sysfs_remove_file_ns' filepath='fs/sysfs/file.c' line='465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_file_ns'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/file.c' line='465' column='1'/>
+        <parameter type-id='cfe4f8a2' name='attr' filepath='fs/sysfs/file.c' line='465' column='1'/>
+        <parameter type-id='eaa32e2f' name='ns' filepath='fs/sysfs/file.c' line='466' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sysfs_remove_files' mangled-name='sysfs_remove_files' filepath='fs/sysfs/file.c' line='498' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_files'>
@@ -135082,9 +134906,9 @@
         <parameter type-id='cb460785' name='ptr' filepath='fs/sysfs/file.c' line='498' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sysfs_remove_group' mangled-name='sysfs_remove_group' filepath='include/linux/sysfs.h' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_group'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='8ff9530e'/>
+      <function-decl name='sysfs_remove_group' mangled-name='sysfs_remove_group' filepath='fs/sysfs/group.c' line='270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_group'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/group.c' line='270' column='1'/>
+        <parameter type-id='8ff9530e' name='grp' filepath='fs/sysfs/group.c' line='271' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sysfs_remove_groups' mangled-name='sysfs_remove_groups' filepath='fs/sysfs/group.c' line='305' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_groups'>
@@ -135092,9 +134916,9 @@
         <parameter type-id='c97de1ac' name='groups' filepath='fs/sysfs/group.c' line='306' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sysfs_remove_link' mangled-name='sysfs_remove_link' filepath='include/linux/sysfs.h' line='274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_link'>
-        <parameter type-id='d30bdc51'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='sysfs_remove_link' mangled-name='sysfs_remove_link' filepath='fs/sysfs/symlink.c' line='143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_link'>
+        <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/symlink.c' line='143' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='fs/sysfs/symlink.c' line='143' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='sysfs_remove_link_from_group' mangled-name='sysfs_remove_link_from_group' filepath='fs/sysfs/group.c' line='405' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_remove_link_from_group'>
@@ -135103,17 +134927,17 @@
         <parameter type-id='80f4b756' name='link_name' filepath='fs/sysfs/group.c' line='406' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sysfs_streq' mangled-name='sysfs_streq' filepath='include/linux/string.h' line='185' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_streq'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <return type-id='c894953d'/>
+      <function-decl name='sysfs_streq' mangled-name='sysfs_streq' filepath='lib/string.c' line='703' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_streq'>
+        <parameter type-id='80f4b756' name='s1' filepath='lib/string.c' line='703' column='1'/>
+        <parameter type-id='80f4b756' name='s2' filepath='lib/string.c' line='703' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='sysfs_update_group' mangled-name='sysfs_update_group' filepath='fs/sysfs/group.c' line='255' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysfs_update_group'>
         <parameter type-id='d30bdc51' name='kobj' filepath='fs/sysfs/group.c' line='255' column='1'/>
         <parameter type-id='8ff9530e' name='grp' filepath='fs/sysfs/group.c' line='256' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sysrq_mask' mangled-name='sysrq_mask' filepath='include/linux/sysrq.h' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysrq_mask'>
+      <function-decl name='sysrq_mask' mangled-name='sysrq_mask' filepath='drivers/tty/sysrq.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sysrq_mask'>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='system_freezable_power_efficient_wq' type-id='242e3d19' mangled-name='system_freezable_power_efficient_wq' visibility='default' filepath='kernel/workqueue.c' line='360' column='1' elf-symbol-id='system_freezable_power_efficient_wq'/>
@@ -135125,8 +134949,8 @@
       <var-decl name='system_state' type-id='2ead22b4' mangled-name='system_state' visibility='default' filepath='init/main.c' line='129' column='1' elf-symbol-id='system_state'/>
       <var-decl name='system_unbound_wq' type-id='242e3d19' mangled-name='system_unbound_wq' visibility='default' filepath='kernel/workqueue.c' line='354' column='1' elf-symbol-id='system_unbound_wq'/>
       <var-decl name='system_wq' type-id='242e3d19' mangled-name='system_wq' visibility='default' filepath='kernel/workqueue.c' line='348' column='1' elf-symbol-id='system_wq'/>
-      <function-decl name='task_active_pid_ns' mangled-name='task_active_pid_ns' filepath='include/linux/pid_namespace.h' line='87' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='task_active_pid_ns'>
-        <parameter type-id='f23e2572'/>
+      <function-decl name='task_active_pid_ns' mangled-name='task_active_pid_ns' filepath='kernel/pid.c' line='508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='task_active_pid_ns'>
+        <parameter type-id='f23e2572' name='tsk' filepath='kernel/pid.c' line='508' column='1'/>
         <return type-id='b816e1d0'/>
       </function-decl>
       <var-decl name='task_groups' type-id='72f469ec' mangled-name='task_groups' visibility='default' filepath='kernel/sched/core.c' line='7415' column='1' elf-symbol-id='task_groups'/>
@@ -135226,8 +135050,8 @@
         <parameter type-id='426e425b' name='port' filepath='drivers/usb/typec/tcpm/tcpm.c' line='5464' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thermal_cdev_update' mangled-name='thermal_cdev_update' filepath='include/linux/thermal.h' line='414' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cdev_update'>
-        <parameter type-id='2feec21f'/>
+      <function-decl name='thermal_cdev_update' mangled-name='thermal_cdev_update' filepath='drivers/thermal/thermal_helpers.c' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cdev_update'>
+        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_helpers.c' line='188' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='thermal_cooling_device_register' mangled-name='thermal_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1166' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_register'>
@@ -135236,8 +135060,8 @@
         <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1167' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
-      <function-decl name='thermal_cooling_device_unregister' mangled-name='thermal_cooling_device_unregister' filepath='include/linux/thermal.h' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_unregister'>
-        <parameter type-id='2feec21f'/>
+      <function-decl name='thermal_cooling_device_unregister' mangled-name='thermal_cooling_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_unregister'>
+        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='1263' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='thermal_of_cooling_device_register' mangled-name='thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_of_cooling_device_register'>
@@ -135269,19 +135093,19 @@
         <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='534' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_register' mangled-name='thermal_zone_device_register' filepath='include/linux/thermal.h' line='384' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_register'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='1e6fe389'/>
-        <parameter type-id='e2cbf964'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='thermal_zone_device_register' mangled-name='thermal_zone_device_register' filepath='drivers/thermal/thermal_core.c' line='1377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_register'>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
+        <parameter type-id='95e97e5e' name='trips' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
+        <parameter type-id='95e97e5e' name='mask' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
+        <parameter type-id='1e6fe389' name='ops' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
+        <parameter type-id='e2cbf964' name='tzp' filepath='drivers/thermal/thermal_core.c' line='1379' column='1'/>
+        <parameter type-id='95e97e5e' name='passive_delay' filepath='drivers/thermal/thermal_core.c' line='1379' column='1'/>
+        <parameter type-id='95e97e5e' name='polling_delay' filepath='drivers/thermal/thermal_core.c' line='1380' column='1'/>
         <return type-id='404b1300'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_unregister' mangled-name='thermal_zone_device_unregister' filepath='include/linux/thermal.h' line='387' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_unregister'>
-        <parameter type-id='404b1300'/>
+      <function-decl name='thermal_zone_device_unregister' mangled-name='thermal_zone_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1518' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_unregister'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='1518' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='thermal_zone_device_update' mangled-name='thermal_zone_device_update' filepath='drivers/thermal/thermal_core.c' line='548' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_update'>
@@ -135293,9 +135117,9 @@
         <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_helpers.c' line='226' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_get_temp' mangled-name='thermal_zone_get_temp' filepath='include/linux/thermal.h' line='410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_temp'>
-        <parameter type-id='404b1300'/>
-        <parameter type-id='7292109c'/>
+      <function-decl name='thermal_zone_get_temp' mangled-name='thermal_zone_get_temp' filepath='drivers/thermal/thermal_helpers.c' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_temp'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_helpers.c' line='78' column='1'/>
+        <parameter type-id='7292109c' name='temp' filepath='drivers/thermal/thermal_helpers.c' line='78' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='thermal_zone_get_zone_by_name' mangled-name='thermal_zone_get_zone_by_name' filepath='drivers/thermal/thermal_core.c' line='1586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_zone_by_name'>
@@ -135314,14 +135138,14 @@
         <parameter type-id='404b1300' name='tzd' filepath='drivers/thermal/thermal_of.c' line='552' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thread_group_cputime_adjusted' mangled-name='thread_group_cputime_adjusted' filepath='include/linux/sched/cputime.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thread_group_cputime_adjusted'>
-        <parameter type-id='f23e2572'/>
-        <parameter type-id='c0190993'/>
-        <parameter type-id='c0190993'/>
+      <function-decl name='thread_group_cputime_adjusted' mangled-name='thread_group_cputime_adjusted' filepath='kernel/sched/cputime.c' line='639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thread_group_cputime_adjusted'>
+        <parameter type-id='f23e2572' name='p' filepath='kernel/sched/cputime.c' line='639' column='1'/>
+        <parameter type-id='3df9fd28' name='ut' filepath='kernel/sched/cputime.c' line='639' column='1'/>
+        <parameter type-id='3df9fd28' name='st' filepath='kernel/sched/cputime.c' line='639' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tick_nohz_get_idle_calls_cpu' mangled-name='tick_nohz_get_idle_calls_cpu' filepath='include/linux/tick.h' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tick_nohz_get_idle_calls_cpu'>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='tick_nohz_get_idle_calls_cpu' mangled-name='tick_nohz_get_idle_calls_cpu' filepath='kernel/time/tick-sched.c' line='1124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tick_nohz_get_idle_calls_cpu'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/time/tick-sched.c' line='1124' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='tick_nohz_get_sleep_length' mangled-name='tick_nohz_get_sleep_length' filepath='kernel/time/tick-sched.c' line='1084' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tick_nohz_get_sleep_length'>
@@ -135349,9 +135173,9 @@
         <parameter type-id='b548a676' name='tc' filepath='kernel/time/timecounter.c' line='52' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='timer_of_init' mangled-name='timer_of_init' filepath='drivers/clocksource/timer-of.h' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='timer_of_init'>
-        <parameter type-id='9a537bbe'/>
-        <parameter type-id='b2168730'/>
+      <function-decl name='timer_of_init' mangled-name='timer_of_init' filepath='drivers/clocksource/timer-of.c' line='168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='timer_of_init'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/clocksource/timer-of.c' line='168' column='1'/>
+        <parameter type-id='b2168730' name='to' filepath='drivers/clocksource/timer-of.c' line='168' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='timer_reduce' mangled-name='timer_reduce' filepath='kernel/time/timer.c' line='1127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='timer_reduce'>
@@ -135365,7 +135189,6 @@
         <parameter type-id='7359adad' name='th_pressure' filepath='drivers/base/arch_topology.c' line='75' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <var-decl name='topology_update_done' type-id='b50a4934' mangled-name='topology_update_done' visibility='default' filepath='drivers/base/arch_topology.c' line='118' column='1' elf-symbol-id='topology_update_done'/>
       <function-decl name='total_swapcache_pages' mangled-name='total_swapcache_pages' filepath='mm/swap_state.c' line='71' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='total_swapcache_pages'>
         <return type-id='7359adad'/>
       </function-decl>
@@ -135387,19 +135210,19 @@
       <function-decl name='trace_clock_local' mangled-name='trace_clock_local' filepath='kernel/trace/trace_clock.c' line='32' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_clock_local'>
         <return type-id='91ce1af9'/>
       </function-decl>
-      <function-decl name='trace_event_buffer_commit' mangled-name='trace_event_buffer_commit' filepath='include/linux/trace_events.h' line='244' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_commit'>
-        <parameter type-id='9f548f9a'/>
+      <function-decl name='trace_event_buffer_commit' mangled-name='trace_event_buffer_commit' filepath='kernel/trace/trace.c' line='2853' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_commit'>
+        <parameter type-id='9f548f9a' name='fbuffer' filepath='kernel/trace/trace.c' line='2853' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='trace_event_buffer_reserve' mangled-name='trace_event_buffer_reserve' filepath='include/linux/trace_events.h' line='240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_reserve'>
-        <parameter type-id='9f548f9a'/>
-        <parameter type-id='3d4ca6d2'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='trace_event_buffer_reserve' mangled-name='trace_event_buffer_reserve' filepath='kernel/trace/trace_events.c' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_buffer_reserve'>
+        <parameter type-id='9f548f9a' name='fbuffer' filepath='kernel/trace/trace_events.c' line='251' column='1'/>
+        <parameter type-id='3d4ca6d2' name='trace_file' filepath='kernel/trace/trace_events.c' line='252' column='1'/>
+        <parameter type-id='7359adad' name='len' filepath='kernel/trace/trace_events.c' line='253' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='trace_event_ignore_this_pid' mangled-name='trace_event_ignore_this_pid' filepath='include/linux/trace_events.h' line='595' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_ignore_this_pid'>
-        <parameter type-id='3d4ca6d2'/>
-        <return type-id='c894953d'/>
+      <function-decl name='trace_event_ignore_this_pid' mangled-name='trace_event_ignore_this_pid' filepath='kernel/trace/trace_events.c' line='232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_ignore_this_pid'>
+        <parameter type-id='3d4ca6d2' name='trace_file' filepath='kernel/trace/trace_events.c' line='232' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='trace_event_raw_init' mangled-name='trace_event_raw_init' filepath='kernel/trace/trace_events.c' line='220' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_event_raw_init'>
         <parameter type-id='23d6768c' name='call' filepath='kernel/trace/trace_events.c' line='220' column='1'/>
@@ -135417,8 +135240,8 @@
         <parameter type-id='80f4b756' name='event' filepath='kernel/trace/trace_events.c' line='2748' column='1'/>
         <return type-id='3d4ca6d2'/>
       </function-decl>
-      <function-decl name='trace_handle_return' mangled-name='trace_handle_return' filepath='include/linux/trace_events.h' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_handle_return'>
-        <parameter type-id='fc932690'/>
+      <function-decl name='trace_handle_return' mangled-name='trace_handle_return' filepath='kernel/trace/trace.c' line='2589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_handle_return'>
+        <parameter type-id='fc932690' name='s' filepath='kernel/trace/trace.c' line='2589' column='1'/>
         <return type-id='b1a0a119'/>
       </function-decl>
       <function-decl name='trace_output_call' mangled-name='trace_output_call' filepath='kernel/trace/trace_output.c' line='326' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_output_call'>
@@ -135428,24 +135251,24 @@
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='trace_print_array_seq' mangled-name='trace_print_array_seq' filepath='include/linux/trace_events.h' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_array_seq'>
-        <parameter type-id='fc932690'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='trace_print_array_seq' mangled-name='trace_print_array_seq' filepath='kernel/trace/trace_output.c' line='233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_array_seq'>
+        <parameter type-id='fc932690' name='p' filepath='kernel/trace/trace_output.c' line='233' column='1'/>
+        <parameter type-id='eaa32e2f' name='buf' filepath='kernel/trace/trace_output.c' line='233' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='kernel/trace/trace_output.c' line='233' column='1'/>
+        <parameter type-id='b59d7dce' name='el_size' filepath='kernel/trace/trace_output.c' line='234' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='trace_print_bitmask_seq' mangled-name='trace_print_bitmask_seq' filepath='include/linux/trace_events.h' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_bitmask_seq'>
-        <parameter type-id='fc932690'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='trace_print_bitmask_seq' mangled-name='trace_print_bitmask_seq' filepath='kernel/trace/trace_output.c' line='193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_bitmask_seq'>
+        <parameter type-id='fc932690' name='p' filepath='kernel/trace/trace_output.c' line='193' column='1'/>
+        <parameter type-id='eaa32e2f' name='bitmask_ptr' filepath='kernel/trace/trace_output.c' line='193' column='1'/>
+        <parameter type-id='f0981eeb' name='bitmask_size' filepath='kernel/trace/trace_output.c' line='194' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='trace_print_flags_seq' mangled-name='trace_print_flags_seq' filepath='include/linux/trace_events.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_flags_seq'>
-        <parameter type-id='fc932690'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='49526a0d'/>
+      <function-decl name='trace_print_flags_seq' mangled-name='trace_print_flags_seq' filepath='kernel/trace/trace_output.c' line='65' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_flags_seq'>
+        <parameter type-id='fc932690' name='p' filepath='kernel/trace/trace_output.c' line='65' column='1'/>
+        <parameter type-id='80f4b756' name='delim' filepath='kernel/trace/trace_output.c' line='65' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='kernel/trace/trace_output.c' line='66' column='1'/>
+        <parameter type-id='49526a0d' name='flag_array' filepath='kernel/trace/trace_output.c' line='67' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
       <function-decl name='trace_print_hex_seq' mangled-name='trace_print_hex_seq' filepath='kernel/trace/trace_output.c' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_hex_seq'>
@@ -135455,32 +135278,32 @@
         <parameter type-id='b50a4934' name='concatenate' filepath='kernel/trace/trace_output.c' line='218' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='trace_print_symbols_seq' mangled-name='trace_print_symbols_seq' filepath='include/linux/trace_events.h' line='23' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_symbols_seq'>
-        <parameter type-id='fc932690'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='49526a0d'/>
+      <function-decl name='trace_print_symbols_seq' mangled-name='trace_print_symbols_seq' filepath='kernel/trace/trace_output.c' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_print_symbols_seq'>
+        <parameter type-id='fc932690' name='p' filepath='kernel/trace/trace_output.c' line='103' column='1'/>
+        <parameter type-id='7359adad' name='val' filepath='kernel/trace/trace_output.c' line='103' column='1'/>
+        <parameter type-id='49526a0d' name='symbol_array' filepath='kernel/trace/trace_output.c' line='104' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
-      <function-decl name='trace_raw_output_prep' mangled-name='trace_raw_output_prep' filepath='include/linux/trace_events.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_raw_output_prep'>
-        <parameter type-id='18881289'/>
-        <parameter type-id='fb7d87a1'/>
+      <function-decl name='trace_raw_output_prep' mangled-name='trace_raw_output_prep' filepath='kernel/trace/trace_output.c' line='292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_raw_output_prep'>
+        <parameter type-id='18881289' name='iter' filepath='kernel/trace/trace_output.c' line='292' column='1'/>
+        <parameter type-id='fb7d87a1' name='trace_event' filepath='kernel/trace/trace_output.c' line='293' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='trace_seq_printf' mangled-name='trace_seq_printf' filepath='include/linux/trace_seq.h' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_seq_printf'>
-        <parameter type-id='fc932690'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='trace_seq_printf' mangled-name='trace_seq_printf' filepath='kernel/trace/trace_seq.c' line='81' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_seq_printf'>
+        <parameter type-id='fc932690' name='s' filepath='kernel/trace/trace_seq.c' line='81' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/trace/trace_seq.c' line='81' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='trace_seq_putc' mangled-name='trace_seq_putc' filepath='include/linux/trace_seq.h' line='86' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_seq_putc'>
-        <parameter type-id='fc932690'/>
-        <parameter type-id='002ac4a6'/>
+      <function-decl name='trace_seq_putc' mangled-name='trace_seq_putc' filepath='kernel/trace/trace_seq.c' line='233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='trace_seq_putc'>
+        <parameter type-id='fc932690' name='s' filepath='kernel/trace/trace_seq.c' line='233' column='1'/>
+        <parameter type-id='002ac4a6' name='c' filepath='kernel/trace/trace_seq.c' line='233' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tracepoint_probe_register' mangled-name='tracepoint_probe_register' filepath='include/linux/tracepoint.h' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tracepoint_probe_register'>
-        <parameter type-id='08e531de'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='tracepoint_probe_register' mangled-name='tracepoint_probe_register' filepath='kernel/tracepoint.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tracepoint_probe_register'>
+        <parameter type-id='08e531de' name='tp' filepath='kernel/tracepoint.c' line='550' column='1'/>
+        <parameter type-id='eaa32e2f' name='probe' filepath='kernel/tracepoint.c' line='550' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='kernel/tracepoint.c' line='550' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='tracepoint_probe_register_prio' mangled-name='tracepoint_probe_register_prio' filepath='kernel/tracepoint.c' line='522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tracepoint_probe_register_prio'>
@@ -135497,12 +135320,12 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='tracepoint_srcu' type-id='e4a7867c' mangled-name='tracepoint_srcu' visibility='default' filepath='kernel/tracepoint.c' line='28' column='1' elf-symbol-id='tracepoint_srcu'/>
-      <function-decl name='tracing_off' mangled-name='tracing_off' filepath='include/linux/kernel.h' line='672' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tracing_off'>
+      <function-decl name='tracing_off' mangled-name='tracing_off' filepath='kernel/trace/trace.c' line='1446' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tracing_off'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='try_module_get' mangled-name='try_module_get' filepath='include/linux/module.h' line='644' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_module_get'>
-        <parameter type-id='2730d015'/>
-        <return type-id='c894953d'/>
+      <function-decl name='try_module_get' mangled-name='try_module_get' filepath='kernel/module.c' line='1139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_module_get'>
+        <parameter type-id='2730d015' name='module' filepath='kernel/module.c' line='1139' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='try_to_del_timer_sync' mangled-name='try_to_del_timer_sync' filepath='kernel/time/timer.c' line='1229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='try_to_del_timer_sync'>
         <parameter type-id='9248e67f' name='timer' filepath='kernel/time/timer.c' line='1229' column='1'/>
@@ -135623,10 +135446,10 @@
         <parameter type-id='c0a9211d' name='new_mem' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='610' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ttm_bo_move_memcpy' mangled-name='ttm_bo_move_memcpy' filepath='include/drm/ttm/ttm_bo_driver.h' line='626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_bo_move_memcpy'>
-        <parameter type-id='9d57e433'/>
-        <parameter type-id='7c3e509a'/>
-        <parameter type-id='c0a9211d'/>
+      <function-decl name='ttm_bo_move_memcpy' mangled-name='ttm_bo_move_memcpy' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_bo_move_memcpy'>
+        <parameter type-id='9d57e433' name='bo' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='217' column='1'/>
+        <parameter type-id='7c3e509a' name='ctx' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='218' column='1'/>
+        <parameter type-id='c0a9211d' name='new_mem' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='219' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='ttm_bo_move_to_lru_tail' mangled-name='ttm_bo_move_to_lru_tail' filepath='drivers/gpu/drm/ttm/ttm_bo.c' line='160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_bo_move_to_lru_tail'>
@@ -135634,10 +135457,10 @@
         <parameter type-id='92bac3a5' name='bulk' filepath='drivers/gpu/drm/ttm/ttm_bo.c' line='161' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ttm_bo_move_ttm' mangled-name='ttm_bo_move_ttm' filepath='include/drm/ttm/ttm_bo_driver.h' line='604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_bo_move_ttm'>
-        <parameter type-id='9d57e433'/>
-        <parameter type-id='7c3e509a'/>
-        <parameter type-id='c0a9211d'/>
+      <function-decl name='ttm_bo_move_ttm' mangled-name='ttm_bo_move_ttm' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_bo_move_ttm'>
+        <parameter type-id='9d57e433' name='bo' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='53' column='1'/>
+        <parameter type-id='7c3e509a' name='ctx' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='54' column='1'/>
+        <parameter type-id='c0a9211d' name='new_mem' filepath='drivers/gpu/drm/ttm/ttm_bo_util.c' line='55' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='ttm_bo_put' mangled-name='ttm_bo_put' filepath='drivers/gpu/drm/ttm/ttm_bo.c' line='578' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_bo_put'>
@@ -135716,19 +135539,19 @@
         <parameter type-id='7359adad' name='p_size' filepath='drivers/gpu/drm/ttm/ttm_range_manager.c' line='117' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ttm_resource_free' mangled-name='ttm_resource_free' filepath='include/drm/ttm/ttm_resource.h' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_resource_free'>
-        <parameter type-id='9d57e433'/>
-        <parameter type-id='c0a9211d'/>
+      <function-decl name='ttm_resource_free' mangled-name='ttm_resource_free' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_resource_free'>
+        <parameter type-id='9d57e433' name='bo' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='42' column='1'/>
+        <parameter type-id='c0a9211d' name='res' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='42' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ttm_resource_manager_force_list_clean' mangled-name='ttm_resource_manager_force_list_clean' filepath='include/drm/ttm/ttm_resource.h' line='231' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_resource_manager_force_list_clean'>
-        <parameter type-id='723d4d79'/>
-        <parameter type-id='40735a95'/>
+      <function-decl name='ttm_resource_manager_force_list_clean' mangled-name='ttm_resource_manager_force_list_clean' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='86' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_resource_manager_force_list_clean'>
+        <parameter type-id='723d4d79' name='bdev' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='86' column='1'/>
+        <parameter type-id='40735a95' name='man' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='87' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ttm_resource_manager_init' mangled-name='ttm_resource_manager_init' filepath='include/drm/ttm/ttm_resource.h' line='228' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_resource_manager_init'>
-        <parameter type-id='40735a95'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='ttm_resource_manager_init' mangled-name='ttm_resource_manager_init' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='63' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_resource_manager_init'>
+        <parameter type-id='40735a95' name='man' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='63' column='1'/>
+        <parameter type-id='7359adad' name='p_size' filepath='drivers/gpu/drm/ttm/ttm_resource.c' line='64' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ttm_sg_tt_init' mangled-name='ttm_sg_tt_init' filepath='drivers/gpu/drm/ttm/ttm_tt.c' line='275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ttm_sg_tt_init'>
@@ -135758,8 +135581,8 @@
         <parameter type-id='6621f500' name='tt' filepath='drivers/gpu/drm/ttm/ttm_page_alloc.c' line='1140' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='tty_driver_flush_buffer' mangled-name='tty_driver_flush_buffer' filepath='include/linux/tty.h' line='509' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_driver_flush_buffer'>
-        <parameter type-id='572fbdca'/>
+      <function-decl name='tty_driver_flush_buffer' mangled-name='tty_driver_flush_buffer' filepath='drivers/tty/tty_ioctl.c' line='92' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_driver_flush_buffer'>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_ioctl.c' line='92' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='tty_flip_buffer_push' mangled-name='tty_flip_buffer_push' filepath='drivers/tty/tty_buffer.c' line='554' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_flip_buffer_push'>
@@ -135777,8 +135600,8 @@
         <parameter type-id='b59d7dce' name='size' filepath='drivers/tty/tty_buffer.c' line='312' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='tty_kref_put' mangled-name='tty_kref_put' filepath='include/linux/tty.h' line='421' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_kref_put'>
-        <parameter type-id='572fbdca'/>
+      <function-decl name='tty_kref_put' mangled-name='tty_kref_put' filepath='drivers/tty/tty_io.c' line='1570' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_kref_put'>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_io.c' line='1570' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='tty_mode_ioctl' mangled-name='tty_mode_ioctl' filepath='drivers/tty/tty_ioctl.c' line='663' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_mode_ioctl'>
@@ -135792,14 +135615,14 @@
         <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='283' column='1'/>
         <return type-id='572fbdca'/>
       </function-decl>
-      <function-decl name='tty_register_ldisc' mangled-name='tty_register_ldisc' filepath='include/linux/tty.h' line='726' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_register_ldisc'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='9d632ac5'/>
+      <function-decl name='tty_register_ldisc' mangled-name='tty_register_ldisc' filepath='drivers/tty/tty_ldisc.c' line='61' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_register_ldisc'>
+        <parameter type-id='95e97e5e' name='disc' filepath='drivers/tty/tty_ldisc.c' line='61' column='1'/>
+        <parameter type-id='9d632ac5' name='new_ldisc' filepath='drivers/tty/tty_ldisc.c' line='61' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='tty_termios_baud_rate' mangled-name='tty_termios_baud_rate' filepath='include/linux/tty.h' line='533' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_termios_baud_rate'>
-        <parameter type-id='e55856e5'/>
-        <return type-id='f0981eeb'/>
+      <function-decl name='tty_termios_baud_rate' mangled-name='tty_termios_baud_rate' filepath='drivers/tty/tty_baudrate.c' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_termios_baud_rate'>
+        <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/tty_baudrate.c' line='57' column='1'/>
+        <return type-id='6a8e8a14'/>
       </function-decl>
       <function-decl name='tty_termios_encode_baud_rate' mangled-name='tty_termios_encode_baud_rate' filepath='drivers/tty/tty_baudrate.c' line='141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_termios_encode_baud_rate'>
         <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/tty_baudrate.c' line='141' column='1'/>
@@ -135833,9 +135656,9 @@
         <parameter type-id='233fa2f2' name='desc' filepath='drivers/usb/typec/mux.c' line='314' column='1'/>
         <return type-id='374b228b'/>
       </function-decl>
-      <function-decl name='typec_mux_set' mangled-name='typec_mux_set' filepath='include/linux/usb/typec_mux.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_mux_set'>
-        <parameter type-id='374b228b'/>
-        <parameter type-id='d03b0979'/>
+      <function-decl name='typec_mux_set' mangled-name='typec_mux_set' filepath='drivers/usb/typec/mux.c' line='284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_mux_set'>
+        <parameter type-id='374b228b' name='mux' filepath='drivers/usb/typec/mux.c' line='284' column='1'/>
+        <parameter type-id='d03b0979' name='state' filepath='drivers/usb/typec/mux.c' line='284' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='typec_mux_unregister' mangled-name='typec_mux_unregister' filepath='drivers/usb/typec/mux.c' line='354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_mux_unregister'>
@@ -135926,11 +135749,11 @@
         <parameter type-id='7292109c' name='index' filepath='drivers/tty/serial/serial_core.c' line='2620' column='1'/>
         <return type-id='c2b4b27b'/>
       </function-decl>
-      <function-decl name='uart_console_write' mangled-name='uart_console_write' filepath='include/linux/serial_core.h' line='415' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uart_console_write'>
-        <parameter type-id='af051c69'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='c6b7d75f'/>
+      <function-decl name='uart_console_write' mangled-name='uart_console_write' filepath='drivers/tty/serial/serial_core.c' line='1939' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uart_console_write'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/serial_core.c' line='1939' column='1'/>
+        <parameter type-id='80f4b756' name='s' filepath='drivers/tty/serial/serial_core.c' line='1939' column='1'/>
+        <parameter type-id='f0981eeb' name='count' filepath='drivers/tty/serial/serial_core.c' line='1940' column='1'/>
+        <parameter type-id='c6b7d75f' name='putchar' filepath='drivers/tty/serial/serial_core.c' line='1941' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='uart_get_baud_rate' mangled-name='uart_get_baud_rate' filepath='drivers/tty/serial/serial_core.c' line='394' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uart_get_baud_rate'>
@@ -136158,9 +135981,9 @@
         <parameter type-id='7292109c' name='desc_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_pltfrm_init' mangled-name='ufshcd_pltfrm_init' filepath='drivers/scsi/ufs/ufshcd-pltfrm.h' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_pltfrm_init'>
-        <parameter type-id='db362995'/>
-        <parameter type-id='52ab0d0f'/>
+      <function-decl name='ufshcd_pltfrm_init' mangled-name='ufshcd_pltfrm_init' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_pltfrm_init'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='347' column='1'/>
+        <parameter type-id='52ab0d0f' name='vops' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='348' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='ufshcd_pltfrm_resume' mangled-name='ufshcd_pltfrm_resume' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_pltfrm_resume'>
@@ -136278,15 +136101,15 @@
         <parameter type-id='fb1092f1' name='info' filepath='drivers/uio/uio.c' line='1042' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unlock_page' mangled-name='unlock_page' filepath='include/linux/pagemap.h' line='591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unlock_page'>
-        <parameter type-id='02f11ed4'/>
+      <function-decl name='unlock_page' mangled-name='unlock_page' filepath='mm/filemap.c' line='1468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unlock_page'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/filemap.c' line='1468' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unmap_mapping_range' mangled-name='unmap_mapping_range' filepath='include/linux/mm.h' line='1838' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unmap_mapping_range'>
-        <parameter type-id='f57039f0'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='unmap_mapping_range' mangled-name='unmap_mapping_range' filepath='mm/memory.c' line='3548' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unmap_mapping_range'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/memory.c' line='3548' column='1'/>
+        <parameter type-id='bf352dfe' name='holebegin' filepath='mm/memory.c' line='3549' column='1'/>
+        <parameter type-id='bf352dfe' name='holelen' filepath='mm/memory.c' line='3549' column='1'/>
+        <parameter type-id='95e97e5e' name='even_cows' filepath='mm/memory.c' line='3549' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unpin_user_page' mangled-name='unpin_user_page' filepath='mm/gup.c' line='252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unpin_user_page'>
@@ -136320,8 +136143,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='kernel/notifier.c' line='558' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_filesystem' mangled-name='unregister_filesystem' filepath='include/linux/fs.h' line='2359' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_filesystem'>
-        <parameter type-id='21e53d44'/>
+      <function-decl name='unregister_filesystem' mangled-name='unregister_filesystem' filepath='fs/filesystems.c' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_filesystem'>
+        <parameter type-id='21e53d44' name='fs' filepath='fs/filesystems.c' line='108' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='unregister_ftrace_export' mangled-name='unregister_ftrace_export' filepath='kernel/trace/trace.c' line='392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_ftrace_export'>
@@ -136356,17 +136179,17 @@
         <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='10775' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_netdevice_many' mangled-name='unregister_netdevice_many' filepath='include/linux/netdevice.h' line='2912' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_netdevice_many'>
-        <parameter type-id='e84b031a'/>
+      <function-decl name='unregister_netdevice_many' mangled-name='unregister_netdevice_many' filepath='net/core/dev.c' line='10751' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_netdevice_many'>
+        <parameter type-id='e84b031a' name='head' filepath='net/core/dev.c' line='10751' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_netdevice_notifier' mangled-name='unregister_netdevice_notifier' filepath='include/linux/netdevice.h' line='2743' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_netdevice_notifier'>
-        <parameter type-id='d504f73d'/>
+      <function-decl name='unregister_netdevice_notifier' mangled-name='unregister_netdevice_notifier' filepath='net/core/dev.c' line='1876' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_netdevice_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='net/core/dev.c' line='1876' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_netdevice_queue' mangled-name='unregister_netdevice_queue' filepath='include/linux/netdevice.h' line='2911' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_netdevice_queue'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='e84b031a'/>
+      <function-decl name='unregister_netdevice_queue' mangled-name='unregister_netdevice_queue' filepath='net/core/dev.c' line='10730' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_netdevice_queue'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='10730' column='1'/>
+        <parameter type-id='e84b031a' name='head' filepath='net/core/dev.c' line='10730' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_netevent_notifier' mangled-name='unregister_netevent_notifier' filepath='net/core/netevent.c' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_netevent_notifier'>
@@ -136377,8 +136200,8 @@
         <parameter type-id='d504f73d' name='nb' filepath='mm/oom_kill.c' line='1080' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='unregister_pernet_device' mangled-name='unregister_pernet_device' filepath='include/net/net_namespace.h' line='422' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_pernet_device'>
-        <parameter type-id='d6907f4c'/>
+      <function-decl name='unregister_pernet_device' mangled-name='unregister_pernet_device' filepath='net/core/net_namespace.c' line='1337' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_pernet_device'>
+        <parameter type-id='d6907f4c' name='ops' filepath='net/core/net_namespace.c' line='1337' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_pernet_subsys' mangled-name='unregister_pernet_subsys' filepath='net/core/net_namespace.c' line='1289' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_pernet_subsys'>
@@ -136405,12 +136228,12 @@
         <parameter type-id='4be14597' name='shrinker' filepath='mm/vmscan.c' line='424' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_syscore_ops' mangled-name='unregister_syscore_ops' filepath='include/linux/syscore_ops.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_syscore_ops'>
-        <parameter type-id='cbd24a98'/>
+      <function-decl name='unregister_syscore_ops' mangled-name='unregister_syscore_ops' filepath='drivers/base/syscore.c' line='34' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_syscore_ops'>
+        <parameter type-id='cbd24a98' name='ops' filepath='drivers/base/syscore.c' line='34' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_sysctl_table' mangled-name='unregister_sysctl_table' filepath='include/linux/sysctl.h' line='195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_sysctl_table'>
-        <parameter type-id='11b101bb'/>
+      <function-decl name='unregister_sysctl_table' mangled-name='unregister_sysctl_table' filepath='fs/proc/proc_sysctl.c' line='1656' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_sysctl_table'>
+        <parameter type-id='11b101bb' name='header' filepath='fs/proc/proc_sysctl.c' line='1656' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='unregister_virtio_device' mangled-name='unregister_virtio_device' filepath='drivers/virtio/virtio.c' line='381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_virtio_device'>
@@ -136433,8 +136256,8 @@
         <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1607' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='up_write' mangled-name='up_write' filepath='include/linux/rwsem.h' line='169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='up_write'>
-        <parameter type-id='9b58df93'/>
+      <function-decl name='up_write' mangled-name='up_write' filepath='kernel/locking/rwsem.c' line='1617' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='up_write'>
+        <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1617' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='update_devfreq' mangled-name='update_devfreq' filepath='drivers/devfreq/devfreq.c' line='394' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='update_devfreq'>
@@ -136456,8 +136279,8 @@
         <parameter type-id='e5411c2c' name='function' filepath='drivers/usb/gadget/composite.c' line='302' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_add_gadget' mangled-name='usb_add_gadget' filepath='include/linux/usb/gadget.h' line='489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_gadget'>
-        <parameter type-id='49a58c0c'/>
+      <function-decl name='usb_add_gadget' mangled-name='usb_add_gadget' filepath='drivers/usb/gadget/udc/core.c' line='1293' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_gadget'>
+        <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='1293' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_add_gadget_udc' mangled-name='usb_add_gadget_udc' filepath='drivers/usb/gadget/udc/core.c' line='1419' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_gadget_udc'>
@@ -136488,9 +136311,9 @@
         <parameter type-id='f0981eeb' name='port1' filepath='drivers/usb/core/usb.c' line='575' column='1'/>
         <return type-id='25e60cb2'/>
       </function-decl>
-      <function-decl name='usb_alloc_urb' mangled-name='usb_alloc_urb' filepath='include/linux/usb.h' line='1751' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_alloc_urb'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='usb_alloc_urb' mangled-name='usb_alloc_urb' filepath='drivers/usb/core/urb.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_alloc_urb'>
+        <parameter type-id='95e97e5e' name='iso_packets' filepath='drivers/usb/core/urb.c' line='70' column='1'/>
+        <parameter type-id='3eb7c31c' name='mem_flags' filepath='drivers/usb/core/urb.c' line='70' column='1'/>
         <return type-id='ab85b8f2'/>
       </function-decl>
       <function-decl name='usb_amd_dev_put' mangled-name='usb_amd_dev_put' filepath='drivers/usb/host/pci-quirks.c' line='513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_amd_dev_put'>
@@ -136513,9 +136336,9 @@
       <function-decl name='usb_amd_quirk_pll_enable' mangled-name='usb_amd_quirk_pll_enable' filepath='drivers/usb/host/pci-quirks.c' line='507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_amd_quirk_pll_enable'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_anchor_urb' mangled-name='usb_anchor_urb' filepath='include/linux/usb.h' line='1767' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_anchor_urb'>
-        <parameter type-id='ab85b8f2'/>
-        <parameter type-id='bd300bf3'/>
+      <function-decl name='usb_anchor_urb' mangled-name='usb_anchor_urb' filepath='drivers/usb/core/urb.c' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_anchor_urb'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='126' column='1'/>
+        <parameter type-id='bd300bf3' name='anchor' filepath='drivers/usb/core/urb.c' line='126' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_asmedia_modifyflowcontrol' mangled-name='usb_asmedia_modifyflowcontrol' filepath='drivers/usb/host/pci-quirks.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_asmedia_modifyflowcontrol'>
@@ -136530,12 +136353,12 @@
         <parameter type-id='f363a725' name='ssp' filepath='drivers/usb/gadget/config.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_autopm_get_interface' mangled-name='usb_autopm_get_interface' filepath='include/linux/usb.h' line='788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_autopm_get_interface'>
-        <parameter type-id='8bf48c31'/>
+      <function-decl name='usb_autopm_get_interface' mangled-name='usb_autopm_get_interface' filepath='drivers/usb/core/driver.c' line='1825' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_autopm_get_interface'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/driver.c' line='1825' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_autopm_put_interface' mangled-name='usb_autopm_put_interface' filepath='include/linux/usb.h' line='789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_autopm_put_interface'>
-        <parameter type-id='8bf48c31'/>
+      <function-decl name='usb_autopm_put_interface' mangled-name='usb_autopm_put_interface' filepath='drivers/usb/core/driver.c' line='1747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_autopm_put_interface'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/driver.c' line='1747' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_bulk_msg' mangled-name='usb_bulk_msg' filepath='drivers/usb/core/message.c' line='367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_bulk_msg'>
@@ -136554,8 +136377,8 @@
         <parameter type-id='95e97e5e' name='bytecount' filepath='drivers/usb/core/hcd.c' line='1086' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='usb_choose_configuration' mangled-name='usb_choose_configuration' filepath='drivers/usb/core/usb.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_choose_configuration'>
-        <parameter type-id='25e60cb2'/>
+      <function-decl name='usb_choose_configuration' mangled-name='usb_choose_configuration' filepath='drivers/usb/core/generic.c' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_choose_configuration'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/generic.c' line='56' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_composite_probe' mangled-name='usb_composite_probe' filepath='drivers/usb/gadget/composite.c' line='2461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_composite_probe'>
@@ -136570,16 +136393,16 @@
         <parameter type-id='c64e62ba' name='driver' filepath='drivers/usb/gadget/composite.c' line='2489' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_control_msg' mangled-name='usb_control_msg' filepath='include/linux/usb.h' line='1829' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_control_msg'>
-        <parameter type-id='25e60cb2'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='002ac4a6'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='8efea9e5'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='usb_control_msg' mangled-name='usb_control_msg' filepath='drivers/usb/core/message.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_control_msg'>
+        <parameter type-id='25e60cb2' name='dev' filepath='drivers/usb/core/message.c' line='136' column='1'/>
+        <parameter type-id='f0981eeb' name='pipe' filepath='drivers/usb/core/message.c' line='136' column='1'/>
+        <parameter type-id='8f048e17' name='request' filepath='drivers/usb/core/message.c' line='136' column='1'/>
+        <parameter type-id='8f048e17' name='requesttype' filepath='drivers/usb/core/message.c' line='137' column='1'/>
+        <parameter type-id='d315442e' name='value' filepath='drivers/usb/core/message.c' line='137' column='1'/>
+        <parameter type-id='d315442e' name='index' filepath='drivers/usb/core/message.c' line='137' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/usb/core/message.c' line='137' column='1'/>
+        <parameter type-id='d315442e' name='size' filepath='drivers/usb/core/message.c' line='138' column='1'/>
+        <parameter type-id='95e97e5e' name='timeout' filepath='drivers/usb/core/message.c' line='138' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_copy_descriptors' mangled-name='usb_copy_descriptors' filepath='drivers/usb/gadget/config.c' line='122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_copy_descriptors'>
@@ -136613,8 +136436,8 @@
         <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='1485' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_deregister' mangled-name='usb_deregister' filepath='include/linux/usb.h' line='1320' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_deregister'>
-        <parameter type-id='46ae908a'/>
+      <function-decl name='usb_deregister' mangled-name='usb_deregister' filepath='drivers/usb/core/driver.c' line='1100' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_deregister'>
+        <parameter type-id='46ae908a' name='driver' filepath='drivers/usb/core/driver.c' line='1100' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_disable_xhci_ports' mangled-name='usb_disable_xhci_ports' filepath='drivers/usb/host/pci-quirks.c' line='1124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_disable_xhci_ports'>
@@ -136632,9 +136455,9 @@
         <parameter type-id='85196e3f' name='xhci_pdev' filepath='drivers/usb/host/pci-quirks.c' line='1039' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_ep_alloc_request' mangled-name='usb_ep_alloc_request' filepath='include/linux/usb/gadget.h' line='258' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_alloc_request'>
-        <parameter type-id='63a08bf7'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='usb_ep_alloc_request' mangled-name='usb_ep_alloc_request' filepath='drivers/usb/gadget/udc/core.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_alloc_request'>
+        <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='175' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_flags' filepath='drivers/usb/gadget/udc/core.c' line='176' column='1'/>
         <return type-id='1a494567'/>
       </function-decl>
       <function-decl name='usb_ep_autoconfig' mangled-name='usb_ep_autoconfig' filepath='drivers/usb/gadget/epautoconf.c' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_autoconfig'>
@@ -136646,9 +136469,9 @@
         <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='369' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_ep_dequeue' mangled-name='usb_ep_dequeue' filepath='include/linux/usb/gadget.h' line='261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_dequeue'>
-        <parameter type-id='63a08bf7'/>
-        <parameter type-id='1a494567'/>
+      <function-decl name='usb_ep_dequeue' mangled-name='usb_ep_dequeue' filepath='drivers/usb/gadget/udc/core.c' line='309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_dequeue'>
+        <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='309' column='1'/>
+        <parameter type-id='1a494567' name='req' filepath='drivers/usb/gadget/udc/core.c' line='309' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_ep_disable' mangled-name='usb_ep_disable' filepath='drivers/usb/gadget/udc/core.c' line='141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_disable'>
@@ -136667,24 +136490,24 @@
         <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='424' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_ep_free_request' mangled-name='usb_ep_free_request' filepath='include/linux/usb/gadget.h' line='259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_free_request'>
-        <parameter type-id='63a08bf7'/>
-        <parameter type-id='1a494567'/>
+      <function-decl name='usb_ep_free_request' mangled-name='usb_ep_free_request' filepath='drivers/usb/gadget/udc/core.c' line='197' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_free_request'>
+        <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='197' column='1'/>
+        <parameter type-id='1a494567' name='req' filepath='drivers/usb/gadget/udc/core.c' line='198' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_ep_queue' mangled-name='usb_ep_queue' filepath='include/linux/usb/gadget.h' line='260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_queue'>
-        <parameter type-id='63a08bf7'/>
-        <parameter type-id='1a494567'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='usb_ep_queue' mangled-name='usb_ep_queue' filepath='drivers/usb/gadget/udc/core.c' line='273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_queue'>
+        <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='273' column='1'/>
+        <parameter type-id='1a494567' name='req' filepath='drivers/usb/gadget/udc/core.c' line='274' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp_flags' filepath='drivers/usb/gadget/udc/core.c' line='274' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_ep_set_halt' mangled-name='usb_ep_set_halt' filepath='drivers/usb/gadget/udc/core.c' line='343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_set_halt'>
         <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='343' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_ep_set_maxpacket_limit' mangled-name='usb_ep_set_maxpacket_limit' filepath='include/linux/usb/gadget.h' line='255' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_set_maxpacket_limit'>
-        <parameter type-id='63a08bf7'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='usb_ep_set_maxpacket_limit' mangled-name='usb_ep_set_maxpacket_limit' filepath='drivers/usb/gadget/udc/core.c' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ep_set_maxpacket_limit'>
+        <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='64' column='1'/>
+        <parameter type-id='f0981eeb' name='maxpacket_limit' filepath='drivers/usb/gadget/udc/core.c' line='65' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_find_common_endpoints' mangled-name='usb_find_common_endpoints' filepath='drivers/usb/core/usb.c' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_find_common_endpoints'>
@@ -136706,8 +136529,8 @@
         <parameter type-id='cf29c9b3' name='dma' filepath='drivers/usb/core/usb.c' line='945' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_free_urb' mangled-name='usb_free_urb' filepath='include/linux/usb.h' line='1752' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_free_urb'>
-        <parameter type-id='ab85b8f2'/>
+      <function-decl name='usb_free_urb' mangled-name='usb_free_urb' filepath='drivers/usb/core/urb.c' line='93' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_free_urb'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='93' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_function_register' mangled-name='usb_function_register' filepath='drivers/usb/gadget/functions.c' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_function_register'>
@@ -136726,9 +136549,9 @@
         <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='711' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_gadget_giveback_request' mangled-name='usb_gadget_giveback_request' filepath='include/linux/usb/gadget.h' line='913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_giveback_request'>
-        <parameter type-id='63a08bf7'/>
-        <parameter type-id='1a494567'/>
+      <function-decl name='usb_gadget_giveback_request' mangled-name='usb_gadget_giveback_request' filepath='drivers/usb/gadget/udc/core.c' line='907' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_giveback_request'>
+        <parameter type-id='63a08bf7' name='ep' filepath='drivers/usb/gadget/udc/core.c' line='907' column='1'/>
+        <parameter type-id='1a494567' name='req' filepath='drivers/usb/gadget/udc/core.c' line='908' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_gadget_map_request' mangled-name='usb_gadget_map_request' filepath='drivers/usb/gadget/udc/core.c' line='860' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_map_request'>
@@ -136737,28 +136560,28 @@
         <parameter type-id='95e97e5e' name='is_in' filepath='drivers/usb/gadget/udc/core.c' line='861' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_gadget_map_request_by_dev' mangled-name='usb_gadget_map_request_by_dev' filepath='include/linux/usb/gadget.h' line='875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_map_request_by_dev'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='1a494567'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='usb_gadget_map_request_by_dev' mangled-name='usb_gadget_map_request_by_dev' filepath='drivers/usb/gadget/udc/core.c' line='819' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_map_request_by_dev'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/gadget/udc/core.c' line='819' column='1'/>
+        <parameter type-id='1a494567' name='req' filepath='drivers/usb/gadget/udc/core.c' line='820' column='1'/>
+        <parameter type-id='95e97e5e' name='is_in' filepath='drivers/usb/gadget/udc/core.c' line='820' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_gadget_probe_driver' mangled-name='usb_gadget_probe_driver' filepath='include/linux/usb/gadget.h' line='775' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_probe_driver'>
-        <parameter type-id='9762ede1'/>
+      <function-decl name='usb_gadget_probe_driver' mangled-name='usb_gadget_probe_driver' filepath='drivers/usb/gadget/udc/core.c' line='1530' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_probe_driver'>
+        <parameter type-id='9762ede1' name='driver' filepath='drivers/usb/gadget/udc/core.c' line='1530' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_gadget_set_selfpowered' mangled-name='usb_gadget_set_selfpowered' filepath='include/linux/usb/gadget.h' line='620' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_set_selfpowered'>
-        <parameter type-id='49a58c0c'/>
+      <function-decl name='usb_gadget_set_selfpowered' mangled-name='usb_gadget_set_selfpowered' filepath='drivers/usb/gadget/udc/core.c' line='520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_set_selfpowered'>
+        <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='520' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_gadget_set_state' mangled-name='usb_gadget_set_state' filepath='include/linux/usb/gadget.h' line='900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_set_state'>
-        <parameter type-id='49a58c0c'/>
-        <parameter type-id='901a91cb'/>
+      <function-decl name='usb_gadget_set_state' mangled-name='usb_gadget_set_state' filepath='drivers/usb/gadget/udc/core.c' line='1039' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_set_state'>
+        <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='1039' column='1'/>
+        <parameter type-id='901a91cb' name='state' filepath='drivers/usb/gadget/udc/core.c' line='1040' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_gadget_udc_reset' mangled-name='usb_gadget_udc_reset' filepath='include/linux/usb/gadget.h' line='906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_udc_reset'>
-        <parameter type-id='49a58c0c'/>
-        <parameter type-id='9762ede1'/>
+      <function-decl name='usb_gadget_udc_reset' mangled-name='usb_gadget_udc_reset' filepath='drivers/usb/gadget/udc/core.c' line='1086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_udc_reset'>
+        <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='1086' column='1'/>
+        <parameter type-id='9762ede1' name='driver' filepath='drivers/usb/gadget/udc/core.c' line='1087' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_gadget_unmap_request' mangled-name='usb_gadget_unmap_request' filepath='drivers/usb/gadget/udc/core.c' line='886' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_unmap_request'>
@@ -136767,14 +136590,14 @@
         <parameter type-id='95e97e5e' name='is_in' filepath='drivers/usb/gadget/udc/core.c' line='887' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_gadget_unmap_request_by_dev' mangled-name='usb_gadget_unmap_request_by_dev' filepath='include/linux/usb/gadget.h' line='880' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_unmap_request_by_dev'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='1a494567'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='usb_gadget_unmap_request_by_dev' mangled-name='usb_gadget_unmap_request_by_dev' filepath='drivers/usb/gadget/udc/core.c' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_unmap_request_by_dev'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/gadget/udc/core.c' line='867' column='1'/>
+        <parameter type-id='1a494567' name='req' filepath='drivers/usb/gadget/udc/core.c' line='868' column='1'/>
+        <parameter type-id='95e97e5e' name='is_in' filepath='drivers/usb/gadget/udc/core.c' line='868' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_gadget_unregister_driver' mangled-name='usb_gadget_unregister_driver' filepath='include/linux/usb/gadget.h' line='790' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_unregister_driver'>
-        <parameter type-id='9762ede1'/>
+      <function-decl name='usb_gadget_unregister_driver' mangled-name='usb_gadget_unregister_driver' filepath='drivers/usb/gadget/udc/core.c' line='1577' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_unregister_driver'>
+        <parameter type-id='9762ede1' name='driver' filepath='drivers/usb/gadget/udc/core.c' line='1577' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_gadget_vbus_connect' mangled-name='usb_gadget_vbus_connect' filepath='drivers/usb/gadget/udc/core.c' line='579' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_vbus_connect'>
@@ -136785,9 +136608,9 @@
         <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='640' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_gadget_vbus_draw' mangled-name='usb_gadget_vbus_draw' filepath='include/linux/usb/gadget.h' line='623' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_vbus_draw'>
-        <parameter type-id='49a58c0c'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='usb_gadget_vbus_draw' mangled-name='usb_gadget_vbus_draw' filepath='drivers/usb/gadget/udc/core.c' line='609' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_vbus_draw'>
+        <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='609' column='1'/>
+        <parameter type-id='f0981eeb' name='mA' filepath='drivers/usb/gadget/udc/core.c' line='609' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_gadget_wakeup' mangled-name='usb_gadget_wakeup' filepath='drivers/usb/gadget/udc/core.c' line='493' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gadget_wakeup'>
@@ -136813,8 +136636,8 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/common/common.c' line='107' column='1'/>
         <return type-id='4e532009'/>
       </function-decl>
-      <function-decl name='usb_get_urb' mangled-name='usb_get_urb' filepath='include/linux/usb.h' line='1754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_get_urb'>
-        <parameter type-id='ab85b8f2'/>
+      <function-decl name='usb_get_urb' mangled-name='usb_get_urb' filepath='drivers/usb/core/urb.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_get_urb'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='110' column='1'/>
         <return type-id='ab85b8f2'/>
       </function-decl>
       <function-decl name='usb_gstrings_attach' mangled-name='usb_gstrings_attach' filepath='drivers/usb/gadget/composite.c' line='1388' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_gstrings_attach'>
@@ -136911,15 +136734,15 @@
         <parameter type-id='95e97e5e' name='port1' filepath='drivers/usb/core/hub.c' line='6106' column='1'/>
         <return type-id='25e60cb2'/>
       </function-decl>
-      <function-decl name='usb_ifnum_to_if' mangled-name='usb_ifnum_to_if' filepath='include/linux/usb.h' line='895' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ifnum_to_if'>
-        <parameter type-id='ca2b80c9'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='usb_ifnum_to_if' mangled-name='usb_ifnum_to_if' filepath='drivers/usb/core/usb.c' line='272' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_ifnum_to_if'>
+        <parameter type-id='ca2b80c9' name='dev' filepath='drivers/usb/core/usb.c' line='272' column='1'/>
+        <parameter type-id='f0981eeb' name='ifnum' filepath='drivers/usb/core/usb.c' line='273' column='1'/>
         <return type-id='8bf48c31'/>
       </function-decl>
-      <function-decl name='usb_initialize_gadget' mangled-name='usb_initialize_gadget' filepath='include/linux/usb/gadget.h' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_initialize_gadget'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='49a58c0c'/>
-        <parameter type-id='dd787f72'/>
+      <function-decl name='usb_initialize_gadget' mangled-name='usb_initialize_gadget' filepath='drivers/usb/gadget/udc/core.c' line='1270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_initialize_gadget'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/usb/gadget/udc/core.c' line='1270' column='1'/>
+        <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='1270' column='1'/>
+        <parameter type-id='dd787f72' name='release' filepath='drivers/usb/gadget/udc/core.c' line='1271' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_interface_id' mangled-name='usb_interface_id' filepath='drivers/usb/gadget/composite.c' line='466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_interface_id'>
@@ -136931,8 +136754,8 @@
         <parameter type-id='bd300bf3' name='anchor' filepath='drivers/usb/core/urb.c' line='800' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_kill_urb' mangled-name='usb_kill_urb' filepath='include/linux/usb.h' line='1757' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_kill_urb'>
-        <parameter type-id='ab85b8f2'/>
+      <function-decl name='usb_kill_urb' mangled-name='usb_kill_urb' filepath='drivers/usb/core/urb.c' line='703' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_kill_urb'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='703' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_otg_state_string' mangled-name='usb_otg_state_string' filepath='drivers/usb/common/common.c' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_otg_state_string'>
@@ -136976,14 +136799,14 @@
         <parameter type-id='6614aa5e' name='fi' filepath='drivers/usb/gadget/functions.c' line='69' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_put_hcd' mangled-name='usb_put_hcd' filepath='include/linux/usb/hcd.h' line='476' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_put_hcd'>
-        <parameter type-id='fc4f83c1'/>
+      <function-decl name='usb_put_hcd' mangled-name='usb_put_hcd' filepath='drivers/usb/core/hcd.c' line='2557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_put_hcd'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2557' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_register_driver' mangled-name='usb_register_driver' filepath='include/linux/usb.h' line='1313' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_register_driver'>
-        <parameter type-id='46ae908a'/>
-        <parameter type-id='2730d015'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='usb_register_driver' mangled-name='usb_register_driver' filepath='drivers/usb/core/driver.c' line='1047' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_register_driver'>
+        <parameter type-id='46ae908a' name='new_driver' filepath='drivers/usb/core/driver.c' line='1047' column='1'/>
+        <parameter type-id='2730d015' name='owner' filepath='drivers/usb/core/driver.c' line='1047' column='1'/>
+        <parameter type-id='80f4b756' name='mod_name' filepath='drivers/usb/core/driver.c' line='1048' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_register_notify' mangled-name='usb_register_notify' filepath='drivers/usb/core/notify.c' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_register_notify'>
@@ -137007,30 +136830,30 @@
         <parameter type-id='7837cd88' name='fwnode' filepath='drivers/usb/roles/class.c' line='184' column='1'/>
         <return type-id='3e3cd44f'/>
       </function-decl>
-      <function-decl name='usb_role_switch_get' mangled-name='usb_role_switch_get' filepath='include/linux/usb/role.h' line='54' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_get'>
-        <parameter type-id='fa0b179b'/>
+      <function-decl name='usb_role_switch_get' mangled-name='usb_role_switch_get' filepath='drivers/usb/roles/class.c' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_get'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/roles/class.c' line='123' column='1'/>
         <return type-id='3e3cd44f'/>
       </function-decl>
       <function-decl name='usb_role_switch_get_drvdata' mangled-name='usb_role_switch_get_drvdata' filepath='drivers/usb/roles/class.c' line='376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_get_drvdata'>
         <parameter type-id='3e3cd44f' name='sw' filepath='drivers/usb/roles/class.c' line='376' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='usb_role_switch_put' mangled-name='usb_role_switch_put' filepath='include/linux/usb/role.h' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_put'>
-        <parameter type-id='3e3cd44f'/>
+      <function-decl name='usb_role_switch_put' mangled-name='usb_role_switch_put' filepath='drivers/usb/roles/class.c' line='167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_put'>
+        <parameter type-id='3e3cd44f' name='sw' filepath='drivers/usb/roles/class.c' line='167' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_role_switch_register' mangled-name='usb_role_switch_register' filepath='include/linux/usb/role.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_register'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='143d32b2'/>
+      <function-decl name='usb_role_switch_register' mangled-name='usb_role_switch_register' filepath='drivers/usb/roles/class.c' line='306' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_register'>
+        <parameter type-id='fa0b179b' name='parent' filepath='drivers/usb/roles/class.c' line='306' column='1'/>
+        <parameter type-id='143d32b2' name='desc' filepath='drivers/usb/roles/class.c' line='307' column='1'/>
         <return type-id='3e3cd44f'/>
       </function-decl>
-      <function-decl name='usb_role_switch_set_role' mangled-name='usb_role_switch_set_role' filepath='include/linux/usb/role.h' line='52' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_set_role'>
-        <parameter type-id='3e3cd44f'/>
-        <parameter type-id='c675b073'/>
+      <function-decl name='usb_role_switch_set_role' mangled-name='usb_role_switch_set_role' filepath='drivers/usb/roles/class.c' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_set_role'>
+        <parameter type-id='3e3cd44f' name='sw' filepath='drivers/usb/roles/class.c' line='42' column='1'/>
+        <parameter type-id='c675b073' name='role' filepath='drivers/usb/roles/class.c' line='42' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_role_switch_unregister' mangled-name='usb_role_switch_unregister' filepath='include/linux/usb/role.h' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_unregister'>
-        <parameter type-id='3e3cd44f'/>
+      <function-decl name='usb_role_switch_unregister' mangled-name='usb_role_switch_unregister' filepath='drivers/usb/roles/class.c' line='354' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_role_switch_unregister'>
+        <parameter type-id='3e3cd44f' name='sw' filepath='drivers/usb/roles/class.c' line='354' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_root_hub_lost_power' mangled-name='usb_root_hub_lost_power' filepath='drivers/usb/core/hub.c' line='3845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_root_hub_lost_power'>
@@ -137050,9 +136873,9 @@
         <parameter type-id='2a895c01' name='cdev' filepath='drivers/usb/gadget/composite.c' line='1275' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usb_submit_urb' mangled-name='usb_submit_urb' filepath='include/linux/usb.h' line='1755' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_submit_urb'>
-        <parameter type-id='ab85b8f2'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='usb_submit_urb' mangled-name='usb_submit_urb' filepath='drivers/usb/core/urb.c' line='367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_submit_urb'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='367' column='1'/>
+        <parameter type-id='3eb7c31c' name='mem_flags' filepath='drivers/usb/core/urb.c' line='367' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usb_udc_vbus_handler' mangled-name='usb_udc_vbus_handler' filepath='drivers/usb/gadget/udc/core.c' line='1066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_udc_vbus_handler'>
@@ -137060,8 +136883,8 @@
         <parameter type-id='b50a4934' name='status' filepath='drivers/usb/gadget/udc/core.c' line='1066' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_unanchor_urb' mangled-name='usb_unanchor_urb' filepath='include/linux/usb.h' line='1768' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_unanchor_urb'>
-        <parameter type-id='ab85b8f2'/>
+      <function-decl name='usb_unanchor_urb' mangled-name='usb_unanchor_urb' filepath='drivers/usb/core/urb.c' line='164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_unanchor_urb'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='164' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_unregister_notify' mangled-name='usb_unregister_notify' filepath='drivers/usb/core/notify.c' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_unregister_notify'>
@@ -137087,9 +136910,9 @@
         <parameter type-id='8c4c4029' name='info' filepath='drivers/net/usb/usbnet.c' line='1020' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usbnet_get_endpoints' mangled-name='usbnet_get_endpoints' filepath='include/linux/usb/usbnet.h' line='270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_get_endpoints'>
-        <parameter type-id='12884b9a'/>
-        <parameter type-id='8bf48c31'/>
+      <function-decl name='usbnet_get_endpoints' mangled-name='usbnet_get_endpoints' filepath='drivers/net/usb/usbnet.c' line='78' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_get_endpoints'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='78' column='1'/>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/usbnet.c' line='78' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='usbnet_get_link' mangled-name='usbnet_get_link' filepath='drivers/net/usb/usbnet.c' line='992' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_get_link'>
@@ -137110,10 +136933,10 @@
         <parameter type-id='bd3860fe' name='stats' filepath='drivers/net/usb/usbnet.c' line='983' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usbnet_link_change' mangled-name='usbnet_link_change' filepath='include/linux/usb/usbnet.h' line='292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_link_change'>
-        <parameter type-id='12884b9a'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='usbnet_link_change' mangled-name='usbnet_link_change' filepath='drivers/net/usb/usbnet.c' line='1940' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_link_change'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='1940' column='1'/>
+        <parameter type-id='b50a4934' name='link' filepath='drivers/net/usb/usbnet.c' line='1940' column='1'/>
+        <parameter type-id='b50a4934' name='need_reset' filepath='drivers/net/usb/usbnet.c' line='1940' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usbnet_nway_reset' mangled-name='usbnet_nway_reset' filepath='drivers/net/usb/usbnet.c' line='1009' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_nway_reset'>
@@ -137163,9 +136986,9 @@
         <parameter type-id='19c2251e' name='level' filepath='drivers/net/usb/usbnet.c' line='1039' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usbnet_skb_return' mangled-name='usbnet_skb_return' filepath='include/linux/usb/usbnet.h' line='273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_skb_return'>
-        <parameter type-id='12884b9a'/>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='usbnet_skb_return' mangled-name='usbnet_skb_return' filepath='drivers/net/usb/usbnet.c' line='305' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_skb_return'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='305' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='drivers/net/usb/usbnet.c' line='305' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usbnet_start_xmit' mangled-name='usbnet_start_xmit' filepath='drivers/net/usb/usbnet.c' line='1321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_start_xmit'>
@@ -137225,21 +137048,21 @@
         <parameter type-id='1dc6a898' name='size' filepath='drivers/net/usb/usbnet.c' line='2073' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='usleep_range' mangled-name='usleep_range' filepath='include/linux/delay.h' line='61' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usleep_range'>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='usleep_range' mangled-name='usleep_range' filepath='kernel/time/timer.c' line='2066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usleep_range'>
+        <parameter type-id='7359adad' name='min' filepath='kernel/time/timer.c' line='2066' column='1'/>
+        <parameter type-id='7359adad' name='max' filepath='kernel/time/timer.c' line='2066' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='utf16s_to_utf8s' mangled-name='utf16s_to_utf8s' filepath='include/linux/nls.h' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='utf16s_to_utf8s'>
-        <parameter type-id='31347b7a'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='11d12470'/>
-        <parameter type-id='cf536864'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='utf16s_to_utf8s' mangled-name='utf16s_to_utf8s' filepath='fs/nls/nls_base.c' line='186' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='utf16s_to_utf8s'>
+        <parameter type-id='f077d3f8' name='pwcs' filepath='fs/nls/nls_base.c' line='186' column='1'/>
+        <parameter type-id='95e97e5e' name='inlen' filepath='fs/nls/nls_base.c' line='186' column='1'/>
+        <parameter type-id='11d12470' name='endian' filepath='fs/nls/nls_base.c' line='186' column='1'/>
+        <parameter type-id='8bff8096' name='s' filepath='fs/nls/nls_base.c' line='187' column='1'/>
+        <parameter type-id='95e97e5e' name='maxout' filepath='fs/nls/nls_base.c' line='187' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='uuid_gen' mangled-name='uuid_gen' filepath='include/linux/uuid.h' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uuid_gen'>
-        <parameter type-id='8567d8b4'/>
+      <function-decl name='uuid_gen' mangled-name='uuid_gen' filepath='lib/uuid.c' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uuid_gen'>
+        <parameter type-id='f1397309' name='bu' filepath='lib/uuid.c' line='68' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='uuid_null' type-id='21109a44' mangled-name='uuid_null' visibility='default' filepath='lib/uuid.c' line='18' column='1' elf-symbol-id='uuid_null'/>
@@ -137430,10 +137253,10 @@
         <parameter type-id='f5438ac7' name='sd' filepath='drivers/media/v4l2-core/v4l2-device.c' line='260' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='v4l2_event_dequeue' mangled-name='v4l2_event_dequeue' filepath='include/media/v4l2-event.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_event_dequeue'>
-        <parameter type-id='b7db9582'/>
-        <parameter type-id='a5c94ccc'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='v4l2_event_dequeue' mangled-name='v4l2_event_dequeue' filepath='drivers/media/v4l2-core/v4l2-event.c' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_event_dequeue'>
+        <parameter type-id='b7db9582' name='fh' filepath='drivers/media/v4l2-core/v4l2-event.c' line='59' column='1'/>
+        <parameter type-id='a5c94ccc' name='event' filepath='drivers/media/v4l2-core/v4l2-event.c' line='59' column='1'/>
+        <parameter type-id='95e97e5e' name='nonblocking' filepath='drivers/media/v4l2-core/v4l2-event.c' line='60' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='v4l2_event_pending' mangled-name='v4l2_event_pending' filepath='drivers/media/v4l2-core/v4l2-event.c' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_event_pending'>
@@ -137720,10 +137543,10 @@
         <parameter type-id='f0981eeb' name='notification' filepath='drivers/media/v4l2-core/v4l2-mc.c' line='557' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='v4l2_s_ctrl' mangled-name='v4l2_s_ctrl' filepath='include/media/v4l2-ctrls.h' line='1386' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_s_ctrl'>
-        <parameter type-id='b7db9582'/>
-        <parameter type-id='2b59fa5e'/>
-        <parameter type-id='bcd28457'/>
+      <function-decl name='v4l2_s_ctrl' mangled-name='v4l2_s_ctrl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4413' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_s_ctrl'>
+        <parameter type-id='b7db9582' name='fh' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4413' column='1'/>
+        <parameter type-id='2b59fa5e' name='hdl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4413' column='1'/>
+        <parameter type-id='bcd28457' name='control' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4414' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='v4l2_s_parm_cap' mangled-name='v4l2_s_parm_cap' filepath='drivers/media/v4l2-core/v4l2-common.c' line='207' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_s_parm_cap'>
@@ -137773,9 +137596,9 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='vabits_actual' type-id='91ce1af9' mangled-name='vabits_actual' visibility='default' filepath='arch/arm64/mm/mmu.c' line='46' column='1' elf-symbol-id='vabits_actual'/>
-      <function-decl name='vb2_buffer_done' mangled-name='vb2_buffer_done' filepath='include/media/videobuf2-core.h' line='698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_buffer_done'>
-        <parameter type-id='85535682'/>
-        <parameter type-id='550876cf'/>
+      <function-decl name='vb2_buffer_done' mangled-name='vb2_buffer_done' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='992' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_buffer_done'>
+        <parameter type-id='85535682' name='vb' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='992' column='1'/>
+        <parameter type-id='550876cf' name='state' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='992' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='vb2_common_vm_ops' type-id='92e9b57c' mangled-name='vb2_common_vm_ops' visibility='default' filepath='drivers/media/common/videobuf2/videobuf2-memops.c' line='122' column='1' elf-symbol-id='vb2_common_vm_ops'/>
@@ -137789,15 +137612,15 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='vb2_dma_contig_memops' type-id='23cb2797' mangled-name='vb2_dma_contig_memops' visibility='default' filepath='drivers/media/common/videobuf2/videobuf2-dma-contig.c' line='692' column='1' elf-symbol-id='vb2_dma_contig_memops'/>
-      <function-decl name='vb2_dqbuf' mangled-name='vb2_dqbuf' filepath='include/media/videobuf2-v4l2.h' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_dqbuf'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='a90d9002'/>
-        <parameter type-id='c894953d'/>
+      <function-decl name='vb2_dqbuf' mangled-name='vb2_dqbuf' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='832' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_dqbuf'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='832' column='1'/>
+        <parameter type-id='a90d9002' name='b' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='832' column='1'/>
+        <parameter type-id='b50a4934' name='nonblocking' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='832' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vb2_expbuf' mangled-name='vb2_expbuf' filepath='include/media/videobuf2-v4l2.h' line='166' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_expbuf'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='5606e640'/>
+      <function-decl name='vb2_expbuf' mangled-name='vb2_expbuf' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='883' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_expbuf'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='883' column='1'/>
+        <parameter type-id='5606e640' name='eb' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='883' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vb2_fop_mmap' mangled-name='vb2_fop_mmap' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='1101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_fop_mmap'>
@@ -137875,9 +137698,9 @@
         <parameter type-id='1abf108f' name='i' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='1069' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vb2_mmap' mangled-name='vb2_mmap' filepath='include/media/videobuf2-core.h' line='989' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_mmap'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='2ae08426'/>
+      <function-decl name='vb2_mmap' mangled-name='vb2_mmap' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='2214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_mmap'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='2214' column='1'/>
+        <parameter type-id='2ae08426' name='vma' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='2214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vb2_ops_wait_finish' mangled-name='vb2_ops_wait_finish' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='1269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_ops_wait_finish'>
@@ -137904,21 +137727,21 @@
         <parameter type-id='a54c778f' name='wait' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='947' column='1'/>
         <return type-id='8f254b08'/>
       </function-decl>
-      <function-decl name='vb2_prepare_buf' mangled-name='vb2_prepare_buf' filepath='include/media/videobuf2-v4l2.h' line='128' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_prepare_buf'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='e2929c1c'/>
-        <parameter type-id='a90d9002'/>
+      <function-decl name='vb2_prepare_buf' mangled-name='vb2_prepare_buf' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='734' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_prepare_buf'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='734' column='1'/>
+        <parameter type-id='e2929c1c' name='mdev' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='734' column='1'/>
+        <parameter type-id='a90d9002' name='b' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='735' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vb2_qbuf' mangled-name='vb2_qbuf' filepath='include/media/videobuf2-v4l2.h' line='154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_qbuf'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='e2929c1c'/>
-        <parameter type-id='a90d9002'/>
+      <function-decl name='vb2_qbuf' mangled-name='vb2_qbuf' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='811' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_qbuf'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='811' column='1'/>
+        <parameter type-id='e2929c1c' name='mdev' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='811' column='1'/>
+        <parameter type-id='a90d9002' name='b' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='812' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vb2_querybuf' mangled-name='vb2_querybuf' filepath='include/media/videobuf2-v4l2.h' line='84' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_querybuf'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='a90d9002'/>
+      <function-decl name='vb2_querybuf' mangled-name='vb2_querybuf' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='684' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_querybuf'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='684' column='1'/>
+        <parameter type-id='a90d9002' name='b' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='684' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vb2_queue_init' mangled-name='vb2_queue_init' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='935' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_queue_init'>
@@ -137937,9 +137760,9 @@
         <parameter type-id='95e97e5e' name='nonblocking' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='2827' column='1'/>
         <return type-id='b59d7dce'/>
       </function-decl>
-      <function-decl name='vb2_reqbufs' mangled-name='vb2_reqbufs' filepath='include/media/videobuf2-v4l2.h' line='94' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_reqbufs'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='e4330308'/>
+      <function-decl name='vb2_reqbufs' mangled-name='vb2_reqbufs' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='725' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_reqbufs'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='725' column='1'/>
+        <parameter type-id='e4330308' name='req' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='725' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vb2_request_object_is_buffer' mangled-name='vb2_request_object_is_buffer' filepath='drivers/media/common/videobuf2/videobuf2-core.c' line='1458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_request_object_is_buffer'>
@@ -137954,14 +137777,14 @@
         <parameter type-id='ac429605' name='req' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='1281' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vb2_streamoff' mangled-name='vb2_streamoff' filepath='include/media/videobuf2-v4l2.h' line='229' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_streamoff'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='1abf108f'/>
+      <function-decl name='vb2_streamoff' mangled-name='vb2_streamoff' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='873' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_streamoff'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='873' column='1'/>
+        <parameter type-id='1abf108f' name='type' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='873' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vb2_streamon' mangled-name='vb2_streamon' filepath='include/media/videobuf2-v4l2.h' line='210' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_streamon'>
-        <parameter type-id='a05f1ecd'/>
-        <parameter type-id='1abf108f'/>
+      <function-decl name='vb2_streamon' mangled-name='vb2_streamon' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='863' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vb2_streamon'>
+        <parameter type-id='a05f1ecd' name='q' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='863' column='1'/>
+        <parameter type-id='1abf108f' name='type' filepath='drivers/media/common/videobuf2/videobuf2-v4l2.c' line='863' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='vb2_vmalloc_memops' type-id='23cb2797' mangled-name='vb2_vmalloc_memops' visibility='default' filepath='drivers/media/common/videobuf2/videobuf2-vmalloc.c' line='417' column='1' elf-symbol-id='vb2_vmalloc_memops'/>
@@ -138003,15 +137826,15 @@
         <parameter type-id='eaa32e2f' name='ctx' filepath='certs/system_keyring.c' line='252' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vfree' mangled-name='vfree' filepath='include/linux/vmalloc.h' line='117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfree'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='vfree' mangled-name='vfree' filepath='mm/vmalloc.c' line='2343' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfree'>
+        <parameter type-id='eaa32e2f' name='addr' filepath='mm/vmalloc.c' line='2343' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='vfs_fallocate' mangled-name='vfs_fallocate' filepath='include/linux/fs.h' line='2579' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_fallocate'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='1eb56b1e'/>
+      <function-decl name='vfs_fallocate' mangled-name='vfs_fallocate' filepath='fs/open.c' line='230' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_fallocate'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/open.c' line='230' column='1'/>
+        <parameter type-id='95e97e5e' name='mode' filepath='fs/open.c' line='230' column='1'/>
+        <parameter type-id='69bf7bee' name='offset' filepath='fs/open.c' line='230' column='1'/>
+        <parameter type-id='69bf7bee' name='len' filepath='fs/open.c' line='230' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vfs_fsync' mangled-name='vfs_fsync' filepath='fs/sync.c' line='212' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_fsync'>
@@ -138019,11 +137842,11 @@
         <parameter type-id='95e97e5e' name='datasync' filepath='fs/sync.c' line='212' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vfs_fsync_range' mangled-name='vfs_fsync_range' filepath='include/linux/fs.h' line='2779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_fsync_range'>
-        <parameter type-id='77e79a4b'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='1eb56b1e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='vfs_fsync_range' mangled-name='vfs_fsync_range' filepath='fs/sync.c' line='192' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_fsync_range'>
+        <parameter type-id='77e79a4b' name='file' filepath='fs/sync.c' line='192' column='1'/>
+        <parameter type-id='69bf7bee' name='start' filepath='fs/sync.c' line='192' column='1'/>
+        <parameter type-id='69bf7bee' name='end' filepath='fs/sync.c' line='192' column='1'/>
+        <parameter type-id='95e97e5e' name='datasync' filepath='fs/sync.c' line='192' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vfs_getattr' mangled-name='vfs_getattr' filepath='fs/stat.c' line='124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vfs_getattr'>
@@ -138104,8 +137927,8 @@
         <parameter type-id='ecb0ce18' name='vsk' filepath='net/vmw_vsock/virtio_transport_common.c' line='627' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='virtio_transport_deliver_tap_pkt' mangled-name='virtio_transport_deliver_tap_pkt' filepath='include/linux/virtio_vsock.h' line='148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_deliver_tap_pkt'>
-        <parameter type-id='ac22ee2f'/>
+      <function-decl name='virtio_transport_deliver_tap_pkt' mangled-name='virtio_transport_deliver_tap_pkt' filepath='net/vmw_vsock/virtio_transport_common.c' line='162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_deliver_tap_pkt'>
+        <parameter type-id='ac22ee2f' name='pkt' filepath='net/vmw_vsock/virtio_transport_common.c' line='162' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='virtio_transport_destruct' mangled-name='virtio_transport_destruct' filepath='net/vmw_vsock/virtio_transport_common.c' line='682' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_destruct'>
@@ -138141,8 +137964,8 @@
         <parameter type-id='ecb0ce18' name='psk' filepath='net/vmw_vsock/virtio_transport_common.c' line='464' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='virtio_transport_free_pkt' mangled-name='virtio_transport_free_pkt' filepath='include/linux/virtio_vsock.h' line='144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_free_pkt'>
-        <parameter type-id='ac22ee2f'/>
+      <function-decl name='virtio_transport_free_pkt' mangled-name='virtio_transport_free_pkt' filepath='net/vmw_vsock/virtio_transport_common.c' line='1200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_free_pkt'>
+        <parameter type-id='ac22ee2f' name='pkt' filepath='net/vmw_vsock/virtio_transport_common.c' line='1200' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='virtio_transport_notify_buffer_size' mangled-name='virtio_transport_notify_buffer_size' filepath='net/vmw_vsock/virtio_transport_common.c' line='494' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_notify_buffer_size'>
@@ -138209,9 +138032,9 @@
         <parameter type-id='6f074813' name='data' filepath='net/vmw_vsock/virtio_transport_common.c' line='583' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='virtio_transport_recv_pkt' mangled-name='virtio_transport_recv_pkt' filepath='include/linux/virtio_vsock.h' line='142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_recv_pkt'>
-        <parameter type-id='2bfa174e'/>
-        <parameter type-id='ac22ee2f'/>
+      <function-decl name='virtio_transport_recv_pkt' mangled-name='virtio_transport_recv_pkt' filepath='net/vmw_vsock/virtio_transport_common.c' line='1106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_recv_pkt'>
+        <parameter type-id='2bfa174e' name='t' filepath='net/vmw_vsock/virtio_transport_common.c' line='1106' column='1'/>
+        <parameter type-id='ac22ee2f' name='pkt' filepath='net/vmw_vsock/virtio_transport_common.c' line='1107' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='virtio_transport_release' mangled-name='virtio_transport_release' filepath='net/vmw_vsock/virtio_transport_common.c' line='850' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtio_transport_release'>
@@ -138282,26 +138105,26 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/virtio/virtio_ring.c' line='1761' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='virtqueue_add_sgs' mangled-name='virtqueue_add_sgs' filepath='include/linux/virtio.h' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_add_sgs'>
-        <parameter type-id='91d0de51'/>
-        <parameter type-id='3f2244fd'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='virtqueue_add_sgs' mangled-name='virtqueue_add_sgs' filepath='drivers/virtio/virtio_ring.c' line='1724' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_add_sgs'>
+        <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='1724' column='1'/>
+        <parameter type-id='3f2244fd' name='sgs' filepath='drivers/virtio/virtio_ring.c' line='1725' column='1'/>
+        <parameter type-id='f0981eeb' name='out_sgs' filepath='drivers/virtio/virtio_ring.c' line='1726' column='1'/>
+        <parameter type-id='f0981eeb' name='in_sgs' filepath='drivers/virtio/virtio_ring.c' line='1727' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/virtio/virtio_ring.c' line='1728' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='drivers/virtio/virtio_ring.c' line='1729' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='virtqueue_detach_unused_buf' mangled-name='virtqueue_detach_unused_buf' filepath='drivers/virtio/virtio_ring.c' line='2021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_detach_unused_buf'>
         <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='2021' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='virtqueue_disable_cb' mangled-name='virtqueue_disable_cb' filepath='include/linux/virtio.h' line='71' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_disable_cb'>
-        <parameter type-id='91d0de51'/>
+      <function-decl name='virtqueue_disable_cb' mangled-name='virtqueue_disable_cb' filepath='drivers/virtio/virtio_ring.c' line='1918' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_disable_cb'>
+        <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='1918' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='virtqueue_enable_cb' mangled-name='virtqueue_enable_cb' filepath='include/linux/virtio.h' line='73' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_enable_cb'>
-        <parameter type-id='91d0de51'/>
-        <return type-id='c894953d'/>
+      <function-decl name='virtqueue_enable_cb' mangled-name='virtqueue_enable_cb' filepath='drivers/virtio/virtio_ring.c' line='1983' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_enable_cb'>
+        <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='1983' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='virtqueue_enable_cb_delayed' mangled-name='virtqueue_enable_cb_delayed' filepath='drivers/virtio/virtio_ring.c' line='2004' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_enable_cb_delayed'>
         <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='2004' column='1'/>
@@ -138338,21 +138161,21 @@
         <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='2252' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='virtqueue_is_broken' mangled-name='virtqueue_is_broken' filepath='include/linux/virtio.h' line='85' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_is_broken'>
-        <parameter type-id='91d0de51'/>
-        <return type-id='c894953d'/>
+      <function-decl name='virtqueue_is_broken' mangled-name='virtqueue_is_broken' filepath='drivers/virtio/virtio_ring.c' line='2261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_is_broken'>
+        <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='2261' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='virtqueue_kick' mangled-name='virtqueue_kick' filepath='drivers/virtio/virtio_ring.c' line='1869' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_kick'>
         <parameter type-id='91d0de51' name='vq' filepath='drivers/virtio/virtio_ring.c' line='1869' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='virtqueue_kick_prepare' mangled-name='virtqueue_kick_prepare' filepath='include/linux/virtio.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_kick_prepare'>
-        <parameter type-id='91d0de51'/>
-        <return type-id='c894953d'/>
+      <function-decl name='virtqueue_kick_prepare' mangled-name='virtqueue_kick_prepare' filepath='drivers/virtio/virtio_ring.c' line='1824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_kick_prepare'>
+        <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='1824' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='virtqueue_notify' mangled-name='virtqueue_notify' filepath='include/linux/virtio.h' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_notify'>
-        <parameter type-id='91d0de51'/>
-        <return type-id='c894953d'/>
+      <function-decl name='virtqueue_notify' mangled-name='virtqueue_notify' filepath='drivers/virtio/virtio_ring.c' line='1841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_notify'>
+        <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='1841' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='virtqueue_poll' mangled-name='virtqueue_poll' filepath='drivers/virtio/virtio_ring.c' line='1959' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='virtqueue_poll'>
         <parameter type-id='91d0de51' name='_vq' filepath='drivers/virtio/virtio_ring.c' line='1959' column='1'/>
@@ -138416,15 +138239,15 @@
         <return type-id='7359adad'/>
       </function-decl>
       <var-decl name='vm_zone_stat' type-id='84ab35b9' mangled-name='vm_zone_stat' visibility='default' filepath='mm/vmstat.c' line='163' column='1' elf-symbol-id='vm_zone_stat'/>
-      <function-decl name='vmalloc' mangled-name='vmalloc' filepath='include/linux/vmalloc.h' line='102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc'>
-        <parameter type-id='7359adad'/>
+      <function-decl name='vmalloc' mangled-name='vmalloc' filepath='mm/vmalloc.c' line='2639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc'>
+        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2639' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='vmalloc_nr_pages' mangled-name='vmalloc_nr_pages' filepath='mm/vmalloc.c' line='490' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc_nr_pages'>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='vmalloc_to_page' mangled-name='vmalloc_to_page' filepath='include/linux/mm.h' line='791' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc_to_page'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='vmalloc_to_page' mangled-name='vmalloc_to_page' filepath='mm/vmalloc.c' line='350' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc_to_page'>
+        <parameter type-id='eaa32e2f' name='vmalloc_addr' filepath='mm/vmalloc.c' line='350' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
       <function-decl name='vmalloc_to_pfn' mangled-name='vmalloc_to_pfn' filepath='mm/vmalloc.c' line='401' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmalloc_to_pfn'>
@@ -138435,16 +138258,16 @@
         <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2675' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='vmap' mangled-name='vmap' filepath='include/linux/vmalloc.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmap'>
-        <parameter type-id='9f93c9da'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='051883a9'/>
+      <function-decl name='vmap' mangled-name='vmap' filepath='mm/vmalloc.c' line='2391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmap'>
+        <parameter type-id='9f93c9da' name='pages' filepath='mm/vmalloc.c' line='2391' column='1'/>
+        <parameter type-id='f0981eeb' name='count' filepath='mm/vmalloc.c' line='2391' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='mm/vmalloc.c' line='2392' column='1'/>
+        <parameter type-id='2e2dcbd3' name='prot' filepath='mm/vmalloc.c' line='2392' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='vmemdup_user' mangled-name='vmemdup_user' filepath='include/linux/string.h' line='14' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmemdup_user'>
-        <parameter type-id='eaa32e2f'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='vmemdup_user' mangled-name='vmemdup_user' filepath='mm/util.c' line='198' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmemdup_user'>
+        <parameter type-id='eaa32e2f' name='src' filepath='mm/util.c' line='198' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='mm/util.c' line='198' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='vmf_insert_mixed' mangled-name='vmf_insert_mixed' filepath='mm/memory.c' line='2194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmf_insert_mixed'>
@@ -138453,11 +138276,11 @@
         <parameter type-id='abe59ef3' name='pfn' filepath='mm/memory.c' line='2195' column='1'/>
         <return type-id='e9265215'/>
       </function-decl>
-      <function-decl name='vmf_insert_pfn' mangled-name='vmf_insert_pfn' filepath='include/linux/mm.h' line='2909' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmf_insert_pfn'>
-        <parameter type-id='2ae08426'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='7359adad'/>
-        <return type-id='f0981eeb'/>
+      <function-decl name='vmf_insert_pfn' mangled-name='vmf_insert_pfn' filepath='mm/memory.c' line='2094' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmf_insert_pfn'>
+        <parameter type-id='2ae08426' name='vma' filepath='mm/memory.c' line='2094' column='1'/>
+        <parameter type-id='7359adad' name='addr' filepath='mm/memory.c' line='2094' column='1'/>
+        <parameter type-id='7359adad' name='pfn' filepath='mm/memory.c' line='2095' column='1'/>
+        <return type-id='e9265215'/>
       </function-decl>
       <function-decl name='vmf_insert_pfn_prot' mangled-name='vmf_insert_pfn_prot' filepath='mm/memory.c' line='2046' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vmf_insert_pfn_prot'>
         <parameter type-id='2ae08426' name='vma' filepath='mm/memory.c' line='2046' column='1'/>
@@ -138466,9 +138289,9 @@
         <parameter type-id='2e2dcbd3' name='pgprot' filepath='mm/memory.c' line='2047' column='1'/>
         <return type-id='e9265215'/>
       </function-decl>
-      <function-decl name='vprintk' mangled-name='vprintk' filepath='include/linux/printk.h' line='173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vprintk'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='5f919c1f'/>
+      <function-decl name='vprintk' mangled-name='vprintk' filepath='kernel/printk/printk.c' line='2070' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vprintk'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/printk/printk.c' line='2070' column='1'/>
+        <parameter type-id='2aee9912' name='args' filepath='kernel/printk/printk.c' line='2070' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vprintk_emit' mangled-name='vprintk_emit' filepath='kernel/printk/printk.c' line='2022' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vprintk_emit'>
@@ -138518,11 +138341,11 @@
         <parameter type-id='5dbfcbb1' name='vdev' filepath='drivers/virtio/virtio_ring.c' line='2219' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='vscnprintf' mangled-name='vscnprintf' filepath='include/linux/kernel.h' line='485' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vscnprintf'>
-        <parameter type-id='26a90f95'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='5f919c1f'/>
+      <function-decl name='vscnprintf' mangled-name='vscnprintf' filepath='lib/vsprintf.c' line='2775' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vscnprintf'>
+        <parameter type-id='26a90f95' name='buf' filepath='lib/vsprintf.c' line='2775' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='lib/vsprintf.c' line='2775' column='1'/>
+        <parameter type-id='80f4b756' name='fmt' filepath='lib/vsprintf.c' line='2775' column='1'/>
+        <parameter type-id='2aee9912' name='args' filepath='lib/vsprintf.c' line='2775' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='vsnprintf' mangled-name='vsnprintf' filepath='include/linux/kernel.h' line='481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsnprintf'>
@@ -138532,17 +138355,17 @@
         <parameter type-id='5f919c1f'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vsock_core_register' mangled-name='vsock_core_register' filepath='include/net/af_vsock.h' line='169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_core_register'>
-        <parameter type-id='c6c5bd96'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='vsock_core_register' mangled-name='vsock_core_register' filepath='net/vmw_vsock/af_vsock.c' line='2167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_core_register'>
+        <parameter type-id='c6c5bd96' name='t' filepath='net/vmw_vsock/af_vsock.c' line='2167' column='1'/>
+        <parameter type-id='95e97e5e' name='features' filepath='net/vmw_vsock/af_vsock.c' line='2167' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vsock_core_unregister' mangled-name='vsock_core_unregister' filepath='include/net/af_vsock.h' line='170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_core_unregister'>
-        <parameter type-id='c6c5bd96'/>
+      <function-decl name='vsock_core_unregister' mangled-name='vsock_core_unregister' filepath='net/vmw_vsock/af_vsock.c' line='2223' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_core_unregister'>
+        <parameter type-id='c6c5bd96' name='t' filepath='net/vmw_vsock/af_vsock.c' line='2223' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='vsock_for_each_connected_socket' mangled-name='vsock_for_each_connected_socket' filepath='include/net/af_vsock.h' line='200' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_for_each_connected_socket'>
-        <parameter type-id='841969d0'/>
+      <function-decl name='vsock_for_each_connected_socket' mangled-name='vsock_for_each_connected_socket' filepath='net/vmw_vsock/af_vsock.c' line='336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_for_each_connected_socket'>
+        <parameter type-id='841969d0' name='fn' filepath='net/vmw_vsock/af_vsock.c' line='336' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='vsprintf' mangled-name='vsprintf' filepath='lib/vsprintf.c' line='2854' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsprintf'>
@@ -138551,12 +138374,12 @@
         <parameter type-id='2aee9912' name='args' filepath='lib/vsprintf.c' line='2854' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='vunmap' mangled-name='vunmap' filepath='include/linux/vmalloc.h' line='123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vunmap'>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='vunmap' mangled-name='vunmap' filepath='mm/vmalloc.c' line='2367' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vunmap'>
+        <parameter type-id='eaa32e2f' name='addr' filepath='mm/vmalloc.c' line='2367' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='vzalloc' mangled-name='vzalloc' filepath='include/linux/vmalloc.h' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vzalloc'>
-        <parameter type-id='7359adad'/>
+      <function-decl name='vzalloc' mangled-name='vzalloc' filepath='mm/vmalloc.c' line='2659' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vzalloc'>
+        <parameter type-id='7359adad' name='size' filepath='mm/vmalloc.c' line='2659' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='vzalloc_node' mangled-name='vzalloc_node' filepath='mm/vmalloc.c' line='2715' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vzalloc_node'>
@@ -138564,8 +138387,8 @@
         <parameter type-id='95e97e5e' name='node' filepath='mm/vmalloc.c' line='2715' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='wait_for_completion' mangled-name='wait_for_completion' filepath='include/linux/completion.h' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion'>
-        <parameter type-id='389faaf7'/>
+      <function-decl name='wait_for_completion' mangled-name='wait_for_completion' filepath='kernel/sched/completion.c' line='136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion'>
+        <parameter type-id='389faaf7' name='x' filepath='kernel/sched/completion.c' line='136' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='wait_for_completion_interruptible' mangled-name='wait_for_completion_interruptible' filepath='kernel/sched/completion.c' line='204' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion_interruptible'>
@@ -138582,8 +138405,8 @@
         <parameter type-id='7359adad' name='timeout' filepath='kernel/sched/completion.c' line='189' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='wait_for_completion_killable' mangled-name='wait_for_completion_killable' filepath='include/linux/completion.h' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion_killable'>
-        <parameter type-id='389faaf7'/>
+      <function-decl name='wait_for_completion_killable' mangled-name='wait_for_completion_killable' filepath='kernel/sched/completion.c' line='241' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion_killable'>
+        <parameter type-id='389faaf7' name='x' filepath='kernel/sched/completion.c' line='241' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='wait_for_completion_killable_timeout' mangled-name='wait_for_completion_killable_timeout' filepath='kernel/sched/completion.c' line='263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion_killable_timeout'>
@@ -138591,12 +138414,12 @@
         <parameter type-id='7359adad' name='timeout' filepath='kernel/sched/completion.c' line='264' column='1'/>
         <return type-id='bd54fe1a'/>
       </function-decl>
-      <function-decl name='wait_for_completion_timeout' mangled-name='wait_for_completion_timeout' filepath='include/linux/completion.h' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion_timeout'>
-        <parameter type-id='389faaf7'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='wait_for_completion_timeout' mangled-name='wait_for_completion_timeout' filepath='kernel/sched/completion.c' line='155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_completion_timeout'>
+        <parameter type-id='389faaf7' name='x' filepath='kernel/sched/completion.c' line='155' column='1'/>
+        <parameter type-id='7359adad' name='timeout' filepath='kernel/sched/completion.c' line='155' column='1'/>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='wait_for_device_probe' mangled-name='wait_for_device_probe' filepath='include/linux/device/driver.h' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_device_probe'>
+      <function-decl name='wait_for_device_probe' mangled-name='wait_for_device_probe' filepath='drivers/base/dd.c' line='704' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_for_device_probe'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='wait_woken' mangled-name='wait_woken' filepath='kernel/sched/wait.c' line='433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wait_woken'>
@@ -138625,17 +138448,17 @@
         <parameter type-id='1ea237a6' name='ws' filepath='drivers/base/power/wakeup.c' line='159' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='wakeup_source_register' mangled-name='wakeup_source_register' filepath='include/linux/pm_wakeup.h' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wakeup_source_register'>
-        <parameter type-id='fa0b179b'/>
-        <parameter type-id='80f4b756'/>
+      <function-decl name='wakeup_source_register' mangled-name='wakeup_source_register' filepath='drivers/base/power/wakeup.c' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wakeup_source_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/wakeup.c' line='221' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/base/power/wakeup.c' line='222' column='1'/>
         <return type-id='1ea237a6'/>
       </function-decl>
       <function-decl name='wakeup_source_remove' mangled-name='wakeup_source_remove' filepath='drivers/base/power/wakeup.c' line='195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wakeup_source_remove'>
         <parameter type-id='1ea237a6' name='ws' filepath='drivers/base/power/wakeup.c' line='195' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='wakeup_source_unregister' mangled-name='wakeup_source_unregister' filepath='include/linux/pm_wakeup.h' line='99' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wakeup_source_unregister'>
-        <parameter type-id='1ea237a6'/>
+      <function-decl name='wakeup_source_unregister' mangled-name='wakeup_source_unregister' filepath='drivers/base/power/wakeup.c' line='246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='wakeup_source_unregister'>
+        <parameter type-id='1ea237a6' name='ws' filepath='drivers/base/power/wakeup.c' line='246' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='watchdog_init_timeout' mangled-name='watchdog_init_timeout' filepath='drivers/watchdog/watchdog_core.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='watchdog_init_timeout'>
@@ -138702,28 +138525,28 @@
         <parameter type-id='60075f2a' name='xa' filepath='lib/xarray.c' line='2199' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xa_erase' mangled-name='xa_erase' filepath='include/linux/xarray.h' line='349' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_erase'>
-        <parameter type-id='60075f2a'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='xa_erase' mangled-name='xa_erase' filepath='lib/xarray.c' line='1505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_erase'>
+        <parameter type-id='60075f2a' name='xa' filepath='lib/xarray.c' line='1505' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='lib/xarray.c' line='1505' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='xa_find' mangled-name='xa_find' filepath='include/linux/xarray.h' line='355' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_find'>
-        <parameter type-id='60075f2a'/>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='xa_find' mangled-name='xa_find' filepath='lib/xarray.c' line='2005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_find'>
+        <parameter type-id='60075f2a' name='xa' filepath='lib/xarray.c' line='2005' column='1'/>
+        <parameter type-id='1d2c2b85' name='indexp' filepath='lib/xarray.c' line='2005' column='1'/>
+        <parameter type-id='7359adad' name='max' filepath='lib/xarray.c' line='2006' column='1'/>
+        <parameter type-id='933bf462' name='filter' filepath='lib/xarray.c' line='2006' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='xa_find_after' mangled-name='xa_find_after' filepath='include/linux/xarray.h' line='357' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_find_after'>
-        <parameter type-id='60075f2a'/>
-        <parameter type-id='1d2c2b85'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='xa_find_after' mangled-name='xa_find_after' filepath='lib/xarray.c' line='2055' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_find_after'>
+        <parameter type-id='60075f2a' name='xa' filepath='lib/xarray.c' line='2055' column='1'/>
+        <parameter type-id='1d2c2b85' name='indexp' filepath='lib/xarray.c' line='2055' column='1'/>
+        <parameter type-id='7359adad' name='max' filepath='lib/xarray.c' line='2056' column='1'/>
+        <parameter type-id='933bf462' name='filter' filepath='lib/xarray.c' line='2056' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='xa_load' mangled-name='xa_load' filepath='include/linux/xarray.h' line='347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_load'>
-        <parameter type-id='60075f2a'/>
-        <parameter type-id='7359adad'/>
+      <function-decl name='xa_load' mangled-name='xa_load' filepath='lib/xarray.c' line='1448' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_load'>
+        <parameter type-id='60075f2a' name='xa' filepath='lib/xarray.c' line='1448' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='lib/xarray.c' line='1448' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='xa_store' mangled-name='xa_store' filepath='lib/xarray.c' line='1569' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xa_store'>
@@ -138733,17 +138556,17 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='lib/xarray.c' line='1569' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='xdp_convert_zc_to_xdp_frame' mangled-name='xdp_convert_zc_to_xdp_frame' filepath='include/net/xdp.h' line='134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_convert_zc_to_xdp_frame'>
-        <parameter type-id='38ed603d'/>
+      <function-decl name='xdp_convert_zc_to_xdp_frame' mangled-name='xdp_convert_zc_to_xdp_frame' filepath='net/core/xdp.c' line='417' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_convert_zc_to_xdp_frame'>
+        <parameter type-id='38ed603d' name='xdp' filepath='net/core/xdp.c' line='417' column='1'/>
         <return type-id='cb1c5129'/>
       </function-decl>
       <function-decl name='xdp_do_flush' mangled-name='xdp_do_flush' filepath='net/core/filter.c' line='3918' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_do_flush'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xdp_do_redirect' mangled-name='xdp_do_redirect' filepath='include/linux/filter.h' line='969' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_do_redirect'>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='38ed603d'/>
-        <parameter type-id='bdcee7ae'/>
+      <function-decl name='xdp_do_redirect' mangled-name='xdp_do_redirect' filepath='net/core/filter.c' line='3959' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_do_redirect'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/filter.c' line='3959' column='1'/>
+        <parameter type-id='38ed603d' name='xdp' filepath='net/core/filter.c' line='3959' column='1'/>
+        <parameter type-id='bdcee7ae' name='xdp_prog' filepath='net/core/filter.c' line='3960' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xdp_return_frame' mangled-name='xdp_return_frame' filepath='net/core/xdp.c' line='375' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_return_frame'>
@@ -138754,26 +138577,26 @@
         <parameter type-id='cb1c5129' name='xdpf' filepath='net/core/xdp.c' line='381' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xdp_rxq_info_reg' mangled-name='xdp_rxq_info_reg' filepath='include/net/xdp.h' line='213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_rxq_info_reg'>
-        <parameter type-id='8e35a44c'/>
-        <parameter type-id='68a2d05b'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='xdp_rxq_info_reg' mangled-name='xdp_rxq_info_reg' filepath='net/core/xdp.c' line='160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_rxq_info_reg'>
+        <parameter type-id='8e35a44c' name='xdp_rxq' filepath='net/core/xdp.c' line='160' column='1'/>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/xdp.c' line='161' column='1'/>
+        <parameter type-id='19c2251e' name='queue_index' filepath='net/core/xdp.c' line='161' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xdp_rxq_info_reg_mem_model' mangled-name='xdp_rxq_info_reg_mem_model' filepath='include/net/xdp.h' line='218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_rxq_info_reg_mem_model'>
-        <parameter type-id='8e35a44c'/>
-        <parameter type-id='8abc4a7f'/>
-        <parameter type-id='eaa32e2f'/>
+      <function-decl name='xdp_rxq_info_reg_mem_model' mangled-name='xdp_rxq_info_reg_mem_model' filepath='net/core/xdp.c' line='262' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_rxq_info_reg_mem_model'>
+        <parameter type-id='8e35a44c' name='xdp_rxq' filepath='net/core/xdp.c' line='262' column='1'/>
+        <parameter type-id='8abc4a7f' name='type' filepath='net/core/xdp.c' line='263' column='1'/>
+        <parameter type-id='eaa32e2f' name='allocator' filepath='net/core/xdp.c' line='263' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xdp_rxq_info_unreg' mangled-name='xdp_rxq_info_unreg' filepath='include/net/xdp.h' line='215' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_rxq_info_unreg'>
-        <parameter type-id='8e35a44c'/>
+      <function-decl name='xdp_rxq_info_unreg' mangled-name='xdp_rxq_info_unreg' filepath='net/core/xdp.c' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_rxq_info_unreg'>
+        <parameter type-id='8e35a44c' name='xdp_rxq' filepath='net/core/xdp.c' line='135' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xdp_warn' mangled-name='xdp_warn' filepath='include/net/xdp.h' line='131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_warn'>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='80f4b756'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='xdp_warn' mangled-name='xdp_warn' filepath='net/core/xdp.c' line='457' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xdp_warn'>
+        <parameter type-id='80f4b756' name='msg' filepath='net/core/xdp.c' line='457' column='1'/>
+        <parameter type-id='80f4b756' name='func' filepath='net/core/xdp.c' line='457' column='1'/>
+        <parameter type-id='2448a865' name='line' filepath='net/core/xdp.c' line='457' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='xfrm_lookup' mangled-name='xfrm_lookup' filepath='net/xfrm/xfrm_policy.c' line='3183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xfrm_lookup'>
@@ -138784,9 +138607,9 @@
         <parameter type-id='95e97e5e' name='flags' filepath='net/xfrm/xfrm_policy.c' line='3185' column='1'/>
         <return type-id='141b6427'/>
       </function-decl>
-      <function-decl name='xfrm_output' mangled-name='xfrm_output' filepath='include/net/xfrm.h' line='1562' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xfrm_output'>
-        <parameter type-id='f772df6d'/>
-        <parameter type-id='0fbf3cfd'/>
+      <function-decl name='xfrm_output' mangled-name='xfrm_output' filepath='net/xfrm/xfrm_output.c' line='566' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xfrm_output'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/xfrm/xfrm_output.c' line='566' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/xfrm/xfrm_output.c' line='566' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xfrm_state_lookup_byspi' mangled-name='xfrm_state_lookup_byspi' filepath='net/xfrm/xfrm_state.c' line='1221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xfrm_state_lookup_byspi'>
@@ -138818,10 +138641,10 @@
         <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='4221' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_alloc_command' mangled-name='xhci_alloc_command' filepath='drivers/usb/host/xhci.h' line='2085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_alloc_command'>
-        <parameter type-id='0c65b409'/>
-        <parameter type-id='c894953d'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='xhci_alloc_command' mangled-name='xhci_alloc_command' filepath='drivers/usb/host/xhci-mem.c' line='1814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_alloc_command'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-mem.c' line='1814' column='1'/>
+        <parameter type-id='b50a4934' name='allocate_completion' filepath='drivers/usb/host/xhci-mem.c' line='1815' column='1'/>
+        <parameter type-id='3eb7c31c' name='mem_flags' filepath='drivers/usb/host/xhci-mem.c' line='1815' column='1'/>
         <return type-id='5a32bd4b'/>
       </function-decl>
       <function-decl name='xhci_alloc_erst' mangled-name='xhci_alloc_erst' filepath='drivers/usb/host/xhci-mem.c' line='1875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_alloc_erst'>
@@ -138854,9 +138677,9 @@
         <parameter type-id='15adb516' name='ep' filepath='drivers/usb/host/xhci.c' line='1750' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_free_command' mangled-name='xhci_free_command' filepath='drivers/usb/host/xhci.h' line='2090' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_free_command'>
-        <parameter type-id='0c65b409'/>
-        <parameter type-id='5a32bd4b'/>
+      <function-decl name='xhci_free_command' mangled-name='xhci_free_command' filepath='drivers/usb/host/xhci-mem.c' line='1865' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_free_command'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-mem.c' line='1865' column='1'/>
+        <parameter type-id='5a32bd4b' name='command' filepath='drivers/usb/host/xhci-mem.c' line='1866' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='xhci_free_erst' mangled-name='xhci_free_erst' filepath='drivers/usb/host/xhci-mem.c' line='1906' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_free_erst'>
@@ -138873,15 +138696,15 @@
         <parameter type-id='a07d0491' name='desc' filepath='drivers/usb/host/xhci.c' line='1298' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='xhci_get_ep_ctx' mangled-name='xhci_get_ep_ctx' filepath='drivers/usb/host/xhci.h' line='2209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_get_ep_ctx'>
-        <parameter type-id='0c65b409'/>
-        <parameter type-id='971e404f'/>
-        <parameter type-id='f0981eeb'/>
+      <function-decl name='xhci_get_ep_ctx' mangled-name='xhci_get_ep_ctx' filepath='drivers/usb/host/xhci-mem.c' line='594' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_get_ep_ctx'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-mem.c' line='594' column='1'/>
+        <parameter type-id='971e404f' name='ctx' filepath='drivers/usb/host/xhci-mem.c' line='595' column='1'/>
+        <parameter type-id='f0981eeb' name='ep_index' filepath='drivers/usb/host/xhci-mem.c' line='596' column='1'/>
         <return type-id='216753a5'/>
       </function-decl>
-      <function-decl name='xhci_get_slot_ctx' mangled-name='xhci_get_slot_ctx' filepath='drivers/usb/host/xhci.h' line='2208' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_get_slot_ctx'>
-        <parameter type-id='0c65b409'/>
-        <parameter type-id='971e404f'/>
+      <function-decl name='xhci_get_slot_ctx' mangled-name='xhci_get_slot_ctx' filepath='drivers/usb/host/xhci-mem.c' line='583' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_get_slot_ctx'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-mem.c' line='583' column='1'/>
+        <parameter type-id='971e404f' name='ctx' filepath='drivers/usb/host/xhci-mem.c' line='584' column='1'/>
         <return type-id='e42579ca'/>
       </function-decl>
       <function-decl name='xhci_handle_event' mangled-name='xhci_handle_event' filepath='drivers/usb/host/xhci-ring.c' line='2905' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_handle_event'>
@@ -138905,12 +138728,12 @@
         <parameter type-id='b50a4934' name='chain_links' filepath='drivers/usb/host/xhci-mem.c' line='102' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xhci_queue_stop_endpoint' mangled-name='xhci_queue_stop_endpoint' filepath='drivers/usb/host/xhci.h' line='2143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_queue_stop_endpoint'>
-        <parameter type-id='0c65b409'/>
-        <parameter type-id='5a32bd4b'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='xhci_queue_stop_endpoint' mangled-name='xhci_queue_stop_endpoint' filepath='drivers/usb/host/xhci-ring.c' line='4359' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_queue_stop_endpoint'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-ring.c' line='4359' column='1'/>
+        <parameter type-id='5a32bd4b' name='cmd' filepath='drivers/usb/host/xhci-ring.c' line='4359' column='1'/>
+        <parameter type-id='95e97e5e' name='slot_id' filepath='drivers/usb/host/xhci-ring.c' line='4360' column='1'/>
+        <parameter type-id='f0981eeb' name='ep_index' filepath='drivers/usb/host/xhci-ring.c' line='4360' column='1'/>
+        <parameter type-id='95e97e5e' name='suspend' filepath='drivers/usb/host/xhci-ring.c' line='4360' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xhci_reset_bandwidth' mangled-name='xhci_reset_bandwidth' filepath='drivers/usb/host/xhci.c' line='2975' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_reset_bandwidth'>
@@ -138932,13 +138755,13 @@
         <parameter type-id='3eb7c31c' name='flags' filepath='drivers/usb/host/xhci-mem.c' line='425' column='1'/>
         <return type-id='52a50596'/>
       </function-decl>
-      <function-decl name='xhci_ring_cmd_db' mangled-name='xhci_ring_cmd_db' filepath='drivers/usb/host/xhci.h' line='2136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_ring_cmd_db'>
-        <parameter type-id='0c65b409'/>
+      <function-decl name='xhci_ring_cmd_db' mangled-name='xhci_ring_cmd_db' filepath='drivers/usb/host/xhci-ring.c' line='302' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_ring_cmd_db'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-ring.c' line='302' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xhci_ring_free' mangled-name='xhci_ring_free' filepath='drivers/usb/host/xhci.h' line='2056' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_ring_free'>
-        <parameter type-id='0c65b409'/>
-        <parameter type-id='52a50596'/>
+      <function-decl name='xhci_ring_free' mangled-name='xhci_ring_free' filepath='drivers/usb/host/xhci-mem.c' line='282' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_ring_free'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-mem.c' line='282' column='1'/>
+        <parameter type-id='52a50596' name='ring' filepath='drivers/usb/host/xhci-mem.c' line='282' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='xhci_run' mangled-name='xhci_run' filepath='drivers/usb/host/xhci.c' line='637' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_run'>
@@ -138955,10 +138778,10 @@
         <parameter type-id='b50a4934' name='do_wakeup' filepath='drivers/usb/host/xhci.c' line='971' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_trb_virt_to_dma' mangled-name='xhci_trb_virt_to_dma' filepath='drivers/usb/host/xhci.h' line='2131' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_trb_virt_to_dma'>
-        <parameter type-id='9689f21b'/>
-        <parameter type-id='2e0bb6d4'/>
-        <return type-id='3a47d82b'/>
+      <function-decl name='xhci_trb_virt_to_dma' mangled-name='xhci_trb_virt_to_dma' filepath='drivers/usb/host/xhci-ring.c' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_trb_virt_to_dma'>
+        <parameter type-id='9689f21b' name='seg' filepath='drivers/usb/host/xhci-ring.c' line='69' column='1'/>
+        <parameter type-id='2e0bb6d4' name='trb' filepath='drivers/usb/host/xhci-ring.c' line='70' column='1'/>
+        <return type-id='cf29c9b3'/>
       </function-decl>
       <function-decl name='xhci_update_erst_dequeue' mangled-name='xhci_update_erst_dequeue' filepath='drivers/usb/host/xhci-ring.c' line='2981' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_update_erst_dequeue'>
         <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-ring.c' line='2981' column='1'/>
@@ -138969,47 +138792,47 @@
         <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='4317' column='1'/>
         <return type-id='1e9ca7e3'/>
       </function-decl>
-      <function-decl name='zlib_deflate' mangled-name='zlib_deflate' filepath='include/linux/zlib.h' line='223' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflate'>
-        <parameter type-id='24a339f6'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='zlib_deflate' mangled-name='zlib_deflate' filepath='lib/zlib_deflate/deflate.c' line='329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflate'>
+        <parameter type-id='fb4f8c25' name='strm' filepath='lib/zlib_deflate/deflate.c' line='330' column='1'/>
+        <parameter type-id='95e97e5e' name='flush' filepath='lib/zlib_deflate/deflate.c' line='331' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='zlib_deflateEnd' mangled-name='zlib_deflateEnd' filepath='include/linux/zlib.h' line='301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflateEnd'>
-        <parameter type-id='24a339f6'/>
+      <function-decl name='zlib_deflateEnd' mangled-name='zlib_deflateEnd' filepath='lib/zlib_deflate/deflate.c' line='468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflateEnd'>
+        <parameter type-id='fb4f8c25' name='strm' filepath='lib/zlib_deflate/deflate.c' line='469' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='zlib_deflateInit2' mangled-name='zlib_deflateInit2' filepath='include/linux/zlib.h' line='586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflateInit2'>
-        <parameter type-id='24a339f6'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='zlib_deflateInit2' mangled-name='zlib_deflateInit2' filepath='lib/zlib_deflate/deflate.c' line='188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflateInit2'>
+        <parameter type-id='fb4f8c25' name='strm' filepath='lib/zlib_deflate/deflate.c' line='189' column='1'/>
+        <parameter type-id='95e97e5e' name='level' filepath='lib/zlib_deflate/deflate.c' line='190' column='1'/>
+        <parameter type-id='95e97e5e' name='method' filepath='lib/zlib_deflate/deflate.c' line='191' column='1'/>
+        <parameter type-id='95e97e5e' name='windowBits' filepath='lib/zlib_deflate/deflate.c' line='192' column='1'/>
+        <parameter type-id='95e97e5e' name='memLevel' filepath='lib/zlib_deflate/deflate.c' line='193' column='1'/>
+        <parameter type-id='95e97e5e' name='strategy' filepath='lib/zlib_deflate/deflate.c' line='194' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='zlib_deflateReset' mangled-name='zlib_deflateReset' filepath='include/linux/zlib.h' line='503' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflateReset'>
-        <parameter type-id='24a339f6'/>
+      <function-decl name='zlib_deflateReset' mangled-name='zlib_deflateReset' filepath='lib/zlib_deflate/deflate.c' line='282' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflateReset'>
+        <parameter type-id='fb4f8c25' name='strm' filepath='lib/zlib_deflate/deflate.c' line='283' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='zlib_deflate_workspacesize' mangled-name='zlib_deflate_workspacesize' filepath='include/linux/zlib.h' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflate_workspacesize'>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='95e97e5e'/>
+      <function-decl name='zlib_deflate_workspacesize' mangled-name='zlib_deflate_workspacesize' filepath='lib/zlib_deflate/deflate.c' line='1127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflate_workspacesize'>
+        <parameter type-id='95e97e5e' name='windowBits' filepath='lib/zlib_deflate/deflate.c' line='1127' column='1'/>
+        <parameter type-id='95e97e5e' name='memLevel' filepath='lib/zlib_deflate/deflate.c' line='1127' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='zone_watermark_ok' mangled-name='zone_watermark_ok' filepath='include/linux/mmzone.h' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zone_watermark_ok'>
-        <parameter type-id='0a0aff97'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <parameter type-id='f0981eeb'/>
-        <return type-id='c894953d'/>
+      <function-decl name='zone_watermark_ok' mangled-name='zone_watermark_ok' filepath='mm/page_alloc.c' line='3813' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zone_watermark_ok'>
+        <parameter type-id='0a0aff97' name='z' filepath='mm/page_alloc.c' line='3813' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='mm/page_alloc.c' line='3813' column='1'/>
+        <parameter type-id='7359adad' name='mark' filepath='mm/page_alloc.c' line='3813' column='1'/>
+        <parameter type-id='95e97e5e' name='highest_zoneidx' filepath='mm/page_alloc.c' line='3814' column='1'/>
+        <parameter type-id='f0981eeb' name='alloc_flags' filepath='mm/page_alloc.c' line='3814' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='zone_watermark_ok_safe' mangled-name='zone_watermark_ok_safe' filepath='include/linux/mmzone.h' line='870' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zone_watermark_ok_safe'>
-        <parameter type-id='0a0aff97'/>
-        <parameter type-id='f0981eeb'/>
-        <parameter type-id='7359adad'/>
-        <parameter type-id='95e97e5e'/>
-        <return type-id='c894953d'/>
+      <function-decl name='zone_watermark_ok_safe' mangled-name='zone_watermark_ok_safe' filepath='mm/page_alloc.c' line='3861' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zone_watermark_ok_safe'>
+        <parameter type-id='0a0aff97' name='z' filepath='mm/page_alloc.c' line='3861' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='mm/page_alloc.c' line='3861' column='1'/>
+        <parameter type-id='7359adad' name='mark' filepath='mm/page_alloc.c' line='3862' column='1'/>
+        <parameter type-id='95e97e5e' name='highest_zoneidx' filepath='mm/page_alloc.c' line='3862' column='1'/>
+        <return type-id='b50a4934'/>
       </function-decl>
     </abi-instr>
   </abi-corpus>

From 119f5131234fbeaf9043d7f03f71ee04b8f65d81 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Tue, 28 Sep 2021 14:38:19 +0200
Subject: [PATCH 0500/1750] ANDROID: GKI: rework the ANDROID_KABI_USE() macro
 to not use __UNIQUE()

The __UNIQUE_ID() macro causes problems as it turns out to not be
deterministic across different compiler runs as it relies on the
__COUNTER__ macro which could have been used on other .h files previous
to this .h file being included.

This shows up specifically when building with "LTO=thin" vs. "LTO=full"
as different build paths seem to be triggered.

As the structure name isn't really needed at all here, we were just
including it for older compilers that could not handle anonymous
structures in a union, just drop the whole thing which resolves the abi
naming issue.

Bug: 210255585
Reported-by: Giuliano Procida <gprocida@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6b9449fa9d26ffc5d66b2f0f3b41e2d5f3003f68
---
 include/linux/android_kabi.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/android_kabi.h b/include/linux/android_kabi.h
index efa52953fe35..9c7b6c035ad3 100644
--- a/include/linux/android_kabi.h
+++ b/include/linux/android_kabi.h
@@ -63,7 +63,7 @@
 		_new;						\
 		struct {					\
 			_orig;					\
-		} __UNIQUE_ID(android_kabi_hide);		\
+		};						\
 		__ANDROID_KABI_CHECK_SIZE_ALIGN(_orig, _new);	\
 	}
 

From 0f8a659a2453a9baf89a414fa235cddea23428d7 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 29 Sep 2021 14:27:29 +0200
Subject: [PATCH 0501/1750] ANDROID: GKI: update the .xml file after modifying
 the ANDROID_KABI_USE() macro

Nothing changes, just one named structure is now unnamed.

Functions changes summary: 0 Removed, 1 Changed (17 filtered out), 0 Added functions
Variables changes summary: 0 Removed, 0 Changed, 0 Added variable

1 function with some indirect sub-type change:

  [C] 'function xhci_command* xhci_alloc_command(xhci_hcd*, bool, gfp_t)' at xhci-mem.c:1814:1 has some indirect sub-type changes:
    parameter 1 of type 'xhci_hcd*' has sub-type changes:
      in pointed to type 'struct xhci_hcd' at xhci.h:1756:1:
        type size hasn't changed
        1 data member deletion:
          'union {xhci_vendor_ops* vendor_ops; struct {u64 android_kabi_reserved1;} __UNIQUE_ID_android_kabi_hide322; union {};}', at offset 59392 (in bits) at xhci.h:1935:1
        no data member changes (2 filtered);

Bug: 210255585
Reported-by: Giuliano Procida <gprocida@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6796a494804ddb5d56a3dcaa3afbb72cdc8bb74f
---
 android/abi_gki_aarch64.xml | 259 ++----------------------------------
 1 file changed, 12 insertions(+), 247 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 3688e997b2cc..0a6ffdb612b7 100755
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -7395,17 +7395,6 @@
       <pointer-type-def type-id='96bf0a3b' size-in-bits='64' id='05a372cf'/>
       <typedef-decl name='kprobe_pre_handler_t' type-id='86856550' filepath='include/linux/kprobes.h' line='52' column='1' id='05a47603'/>
       <pointer-type-def type-id='add29d6f' size-in-bits='64' id='05b00b8b'/>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1' id='05ba9c14'>
-        <data-member access='public'>
-          <var-decl name='vendor_ops' type-id='1e9ca7e3' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
-        </data-member>
-        <data-member access='public'>
-          <var-decl name='__UNIQUE_ID_android_kabi_hide316' type-id='156952c4' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
-        </data-member>
-        <data-member access='public'>
-          <var-decl name='' type-id='2a125a28' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
-        </data-member>
-      </union-decl>
       <class-decl name='drm_mode_fb_cmd2' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/uapi/drm/drm_mode.h' line='494' column='1' id='05bdad78'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='fb_id' type-id='3f1a6b60' visibility='default' filepath='include/uapi/drm/drm_mode.h' line='495' column='1'/>
@@ -28816,17 +28805,6 @@
           <var-decl name='dyn_power_coeff' type-id='7359adad' visibility='default' filepath='include/linux/devfreq_cooling.h' line='56' column='1'/>
         </data-member>
       </class-decl>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1' id='3f6df4ff'>
-        <data-member access='public'>
-          <var-decl name='vendor_ops' type-id='1e9ca7e3' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
-        </data-member>
-        <data-member access='public'>
-          <var-decl name='__UNIQUE_ID_android_kabi_hide322' type-id='156952c4' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
-        </data-member>
-        <data-member access='public'>
-          <var-decl name='' type-id='2a125a28' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
-        </data-member>
-      </union-decl>
       <array-type-def dimensions='1' type-id='03a4a074' size-in-bits='512' id='3f6e320a'>
         <subrange length='4' type-id='7ff19f0f' id='16fe7105'/>
       </array-type-def>
@@ -68083,6 +68061,17 @@
         <enumerator name='GRPQUOTA' value='1'/>
         <enumerator name='PRJQUOTA' value='2'/>
       </enum-decl>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1' id='9ff2562c'>
+        <data-member access='public'>
+          <var-decl name='vendor_ops' type-id='1e9ca7e3' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='' type-id='156952c4' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='' type-id='2a125a28' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
+        </data-member>
+      </union-decl>
       <pointer-type-def type-id='2bf16f59' size-in-bits='64' id='a0127209'/>
       <function-type size-in-bits='64' id='a017baf8'>
         <parameter type-id='ab59ee31'/>
@@ -78944,231 +78933,7 @@
           <var-decl name='dbc' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/host/xhci.h' line='1932' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59392'>
-          <var-decl name='' type-id='05ba9c14' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59456'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1937' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59520'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1938' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59584'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1939' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59648'>
-          <var-decl name='priv' type-id='c99b5ecd' visibility='default' filepath='drivers/usb/host/xhci.h' line='1942' column='1'/>
-        </data-member>
-      </class-decl>
-      <class-decl name='xhci_hcd' size-in-bits='59648' is-struct='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1756' column='1' id='b8f49971'>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='main_hcd' type-id='fc4f83c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1757' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='shared_hcd' type-id='fc4f83c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1758' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='cap_regs' type-id='8ed5fea6' visibility='default' filepath='drivers/usb/host/xhci.h' line='1760' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='op_regs' type-id='aba583a5' visibility='default' filepath='drivers/usb/host/xhci.h' line='1761' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='run_regs' type-id='aaa546af' visibility='default' filepath='drivers/usb/host/xhci.h' line='1762' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='dba' type-id='2966de59' visibility='default' filepath='drivers/usb/host/xhci.h' line='1763' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='ir_set' type-id='098bff2c' visibility='default' filepath='drivers/usb/host/xhci.h' line='1765' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='hcs_params1' type-id='3f1a6b60' visibility='default' filepath='drivers/usb/host/xhci.h' line='1768' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='480'>
-          <var-decl name='hcs_params2' type-id='3f1a6b60' visibility='default' filepath='drivers/usb/host/xhci.h' line='1769' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='hcs_params3' type-id='3f1a6b60' visibility='default' filepath='drivers/usb/host/xhci.h' line='1770' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='544'>
-          <var-decl name='hcc_params' type-id='3f1a6b60' visibility='default' filepath='drivers/usb/host/xhci.h' line='1771' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='hcc_params2' type-id='3f1a6b60' visibility='default' filepath='drivers/usb/host/xhci.h' line='1772' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='608'>
-          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/usb/host/xhci.h' line='1774' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='sbrn' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/xhci.h' line='1777' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='656'>
-          <var-decl name='hci_version' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/xhci.h' line='1778' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='672'>
-          <var-decl name='max_slots' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/xhci.h' line='1779' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='680'>
-          <var-decl name='max_interrupters' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/xhci.h' line='1780' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='688'>
-          <var-decl name='max_ports' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/xhci.h' line='1781' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='696'>
-          <var-decl name='isoc_threshold' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/xhci.h' line='1782' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='imod_interval' type-id='19c2251e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1784' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='736'>
-          <var-decl name='event_ring_max' type-id='95e97e5e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1785' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='page_size' type-id='95e97e5e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1787' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='800'>
-          <var-decl name='page_shift' type-id='95e97e5e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1789' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='msix_count' type-id='95e97e5e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1791' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='clk' type-id='7d0bc0eb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1793' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='reg_clk' type-id='7d0bc0eb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1794' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='reset' type-id='9f9b8114' visibility='default' filepath='drivers/usb/host/xhci.h' line='1796' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='dcbaa' type-id='8fea74f4' visibility='default' filepath='drivers/usb/host/xhci.h' line='1798' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='cmd_ring' type-id='52a50596' visibility='default' filepath='drivers/usb/host/xhci.h' line='1799' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='cmd_ring_state' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1800' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='cmd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/xhci.h' line='1804' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='cmd_ring_reserved_trbs' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1805' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='cmd_timer' type-id='5ad6e0ef' visibility='default' filepath='drivers/usb/host/xhci.h' line='1806' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='2560'>
-          <var-decl name='cmd_ring_stop_completion' type-id='f9fef04f' visibility='default' filepath='drivers/usb/host/xhci.h' line='1807' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='current_cmd' type-id='5a32bd4b' visibility='default' filepath='drivers/usb/host/xhci.h' line='1808' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='2880'>
-          <var-decl name='event_ring' type-id='52a50596' visibility='default' filepath='drivers/usb/host/xhci.h' line='1809' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='2944'>
-          <var-decl name='erst' type-id='c86369aa' visibility='default' filepath='drivers/usb/host/xhci.h' line='1810' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='scratchpad' type-id='33e2a135' visibility='default' filepath='drivers/usb/host/xhci.h' line='1812' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='3328'>
-          <var-decl name='lpm_failed_devs' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/xhci.h' line='1814' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='3456'>
-          <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='drivers/usb/host/xhci.h' line='1818' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='3840'>
-          <var-decl name='lpm_command' type-id='5a32bd4b' visibility='default' filepath='drivers/usb/host/xhci.h' line='1820' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='3904'>
-          <var-decl name='devs' type-id='5b466593' visibility='default' filepath='drivers/usb/host/xhci.h' line='1822' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20288'>
-          <var-decl name='rh_bw' type-id='69f4bad3' visibility='default' filepath='drivers/usb/host/xhci.h' line='1824' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20352'>
-          <var-decl name='device_pool' type-id='ab33c616' visibility='default' filepath='drivers/usb/host/xhci.h' line='1827' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20416'>
-          <var-decl name='segment_pool' type-id='ab33c616' visibility='default' filepath='drivers/usb/host/xhci.h' line='1828' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20480'>
-          <var-decl name='small_streams_pool' type-id='ab33c616' visibility='default' filepath='drivers/usb/host/xhci.h' line='1829' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20544'>
-          <var-decl name='medium_streams_pool' type-id='ab33c616' visibility='default' filepath='drivers/usb/host/xhci.h' line='1830' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20608'>
-          <var-decl name='xhc_state' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1833' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20640'>
-          <var-decl name='command' type-id='19c2251e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1835' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='20672'>
-          <var-decl name='s3' type-id='369534b9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1836' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='21056'>
-          <var-decl name='quirks' type-id='3a47d82b' visibility='default' filepath='drivers/usb/host/xhci.h' line='1852' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='21120'>
-          <var-decl name='num_active_eps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1906' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='21152'>
-          <var-decl name='limit_active_eps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1907' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='21184'>
-          <var-decl name='hw_ports' type-id='4add39c5' visibility='default' filepath='drivers/usb/host/xhci.h' line='1908' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='21248'>
-          <var-decl name='usb2_rhub' type-id='d2c7a2c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1909' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='39744'>
-          <var-decl name='usb3_rhub' type-id='d2c7a2c1' visibility='default' filepath='drivers/usb/host/xhci.h' line='1910' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw_lpm_support' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1912' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='broken_suspend' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1914' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='58304'>
-          <var-decl name='ext_caps' type-id='f9409001' visibility='default' filepath='drivers/usb/host/xhci.h' line='1916' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='58368'>
-          <var-decl name='num_ext_caps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1917' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='58432'>
-          <var-decl name='port_caps' type-id='aae3718c' visibility='default' filepath='drivers/usb/host/xhci.h' line='1919' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='58496'>
-          <var-decl name='num_port_caps' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/xhci.h' line='1920' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='58560'>
-          <var-decl name='comp_mode_recovery_timer' type-id='abe41e67' visibility='default' filepath='drivers/usb/host/xhci.h' line='1922' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59008'>
-          <var-decl name='port_status_u0' type-id='19c2251e' visibility='default' filepath='drivers/usb/host/xhci.h' line='1923' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59040'>
-          <var-decl name='test_mode' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/xhci.h' line='1924' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59072'>
-          <var-decl name='debugfs_root' type-id='27675065' visibility='default' filepath='drivers/usb/host/xhci.h' line='1928' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59136'>
-          <var-decl name='debugfs_slots' type-id='27675065' visibility='default' filepath='drivers/usb/host/xhci.h' line='1929' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59200'>
-          <var-decl name='regset_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/xhci.h' line='1930' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59328'>
-          <var-decl name='dbc' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/host/xhci.h' line='1932' column='1'/>
-        </data-member>
-        <data-member access='public' layout-offset-in-bits='59392'>
-          <var-decl name='' type-id='3f6df4ff' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
+          <var-decl name='' type-id='9ff2562c' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='59456'>
           <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1937' column='1'/>

From 31bd6cd06a18315c9a1b4c6035d027f086c59942 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 22 Jul 2021 16:40:39 +0200
Subject: [PATCH 0502/1750] PCI: aardvark: Increase polling delay to 1.5s while
 waiting for PIO response
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2b58db229eb617d97d5746113b77045f1f884bcb upstream.

Measurements in different conditions showed that aardvark hardware PIO
response can take up to 1.44s. Increase wait timeout from 1ms to 1.5s to
ensure that we do not miss responses from hardware. After 1.44s hardware
returns errors (e.g. Completer abort).

The previous two patches fixed checking for PIO status, so now we can use
it to also catch errors which are reported by hardware after 1.44s.

After applying this patch, kernel can detect and print PIO errors to dmesg:

    [    6.879999] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100004
    [    6.896436] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004
    [    6.913049] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100010
    [    6.929663] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100010
    [    6.953558] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100014
    [    6.970170] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100014
    [    6.994328] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004

Without this patch kernel prints only a generic error to dmesg:

    [    5.246847] advk-pcie d0070000.pcie: config read/write timed out

Link: https://lore.kernel.org/r/20210722144041.12661-3-pali@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org # 7fbcb5da811b ("PCI: aardvark: Don't rely on jiffies while holding spinlock")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index f175cff39b46..4f1a29ede576 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -214,7 +214,7 @@
 	(PCIE_CONF_BUS(bus) | PCIE_CONF_DEV(PCI_SLOT(devfn))	| \
 	 PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where))
 
-#define PIO_RETRY_CNT			500
+#define PIO_RETRY_CNT			750000 /* 1.5 s */
 #define PIO_RETRY_DELAY			2 /* 2 us*/
 
 #define LINK_WAIT_MAX_RETRIES		10

From 437be4d6faed97a45fd67519c551a78d30b1c6d1 Mon Sep 17 00:00:00 2001
From: Wengang Wang <wen.gang.wang@oracle.com>
Date: Fri, 24 Sep 2021 15:43:35 -0700
Subject: [PATCH 0503/1750] ocfs2: drop acl cache for directories too

commit 9c0f0a03e386f4e1df33db676401547e1b7800c6 upstream.

ocfs2_data_convert_worker() is currently dropping any cached acl info
for FILE before down-converting meta lock.  It should also drop for
DIRECTORY.  Otherwise the second acl lookup returns the cached one (from
VFS layer) which could be already stale.

The problem we are seeing is that the acl changes on one node doesn't
get refreshed on other nodes in the following case:

  Node 1                    Node 2
  --------------            ----------------
  getfacl dir1

                            getfacl dir1    <-- this is OK

  setfacl -m u:user1:rwX dir1
  getfacl dir1   <-- see the change for user1

                            getfacl dir1    <-- can't see change for user1

Link: https://lkml.kernel.org/r/20210903012631.6099-1-wen.gang.wang@oracle.com
Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/dlmglue.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 8e3a369086db..3e06e9a8cf59 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3933,7 +3933,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
 		oi = OCFS2_I(inode);
 		oi->ip_dir_lock_gen++;
 		mlog(0, "generation: %u\n", oi->ip_dir_lock_gen);
-		goto out;
+		goto out_forget;
 	}
 
 	if (!S_ISREG(inode->i_mode))
@@ -3964,6 +3964,7 @@ static int ocfs2_data_convert_worker(struct ocfs2_lock_res *lockres,
 		filemap_fdatawait(mapping);
 	}
 
+out_forget:
 	forget_all_cached_acls(inode);
 
 out:

From 838297222b2b76833d144f6e5229136835856bd1 Mon Sep 17 00:00:00 2001
From: Chen Jun <chenjun102@huawei.com>
Date: Fri, 24 Sep 2021 15:44:06 -0700
Subject: [PATCH 0504/1750] mm: fix uninitialized use in
 overcommit_policy_handler

commit bcbda81020c3ee77e2c098cadf3e84f99ca3de17 upstream.

We get an unexpected value of /proc/sys/vm/overcommit_memory after
running the following program:

  int main()
  {
      int fd = open("/proc/sys/vm/overcommit_memory", O_RDWR);
      write(fd, "1", 1);
      write(fd, "2", 1);
      close(fd);
  }

write(fd, "2", 1) will pass *ppos = 1 to proc_dointvec_minmax.
proc_dointvec_minmax will return 0 without setting new_policy.

  t.data = &new_policy;
  ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos)
      -->do_proc_dointvec
         -->__do_proc_dointvec
              if (write) {
                if (proc_first_pos_non_zero_ignore(ppos, table))
                  goto out;

  sysctl_overcommit_memory = new_policy;

so sysctl_overcommit_memory will be set to an uninitialized value.

Check whether new_policy has been changed by proc_dointvec_minmax.

Link: https://lkml.kernel.org/r/20210923020524.13289-1-chenjun102@huawei.com
Fixes: 56f3547bfa4d ("mm: adjust vm_committed_as_batch according to vm overcommit policy")
Signed-off-by: Chen Jun <chenjun102@huawei.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Feng Tang <feng.tang@intel.com>
Reviewed-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Rui Xiang <rui.xiang@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/util.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/util.c b/mm/util.c
index 4ddb6e186dd5..d5be67771850 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -756,7 +756,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
 		size_t *lenp, loff_t *ppos)
 {
 	struct ctl_table t;
-	int new_policy;
+	int new_policy = -1;
 	int ret;
 
 	/*
@@ -774,7 +774,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
 		t = *table;
 		t.data = &new_policy;
 		ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
-		if (ret)
+		if (ret || new_policy == -1)
 			return ret;
 
 		mm_compute_batch(new_policy);

From 1fbd7eb385c3ecdacb292e32f355e116341e23a8 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 6 Sep 2021 12:42:21 +0300
Subject: [PATCH 0505/1750] usb: gadget: r8a66597: fix a loop in set_feature()

commit 17956b53ebff6a490baf580a836cbd3eae94892b upstream.

This loop is supposed to loop until if reads something other than
CS_IDST or until it times out after 30,000 attempts.  But because of
the || vs && bug, it will never time out and instead it will loop a
minimum of 30,000 times.

This bug is quite old but the code is only used in USB_DEVICE_TEST_MODE
so it probably doesn't affect regular usage.

Fixes: 96fe53ef5498 ("usb: gadget: r8a66597-udc: add support for TEST_MODE")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210906094221.GA10957@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/r8a66597-udc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c
index 65cae4883454..38e4d6b505a0 100644
--- a/drivers/usb/gadget/udc/r8a66597-udc.c
+++ b/drivers/usb/gadget/udc/r8a66597-udc.c
@@ -1250,7 +1250,7 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl)
 			do {
 				tmp = r8a66597_read(r8a66597, INTSTS0) & CTSQ;
 				udelay(1);
-			} while (tmp != CS_IDST || timeout-- > 0);
+			} while (tmp != CS_IDST && timeout-- > 0);
 
 			if (tmp == CS_IDST)
 				r8a66597_bset(r8a66597,

From 5f4bfac26173e06b49d95042f766ab429ebdb0aa Mon Sep 17 00:00:00 2001
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Date: Thu, 9 Sep 2021 14:45:15 +0400
Subject: [PATCH 0506/1750] usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave

commit 91bb163e1e4f88092f50dfaa5a816b658753e4b2 upstream.

According USB spec each ISOC transaction should be performed in a
designated for that transaction interval. On bus errors or delays
in operating system scheduling of client software can result in no
packet being transferred for a (micro)frame. An error indication
should be returned as status to the client software in such a case.

Current implementation in case of missed/dropped interval send same
data in next possible interval instead of reporting missed isoc.

This fix complete requests with -ENODATA if interval elapsed.

HSOTG core in BDMA and Slave modes haven't HW support for
(micro)frames tracking, this is why SW should care about tracking
of (micro)frames. Because of that method and consider operating
system scheduling delays, added few additional checking's of elapsed
target (micro)frame:
1. Immediately before enabling EP to start transfer.
2. With any transfer completion interrupt.
3. With incomplete isoc in/out interrupt.
4. With EP disabled interrupt because of incomplete transfer.
5. With OUT token received while EP disabled interrupt (for OUT
transfers).
6. With NAK replied to IN token interrupt (for IN transfers).

As part of ISOC flow, additionally fixed 'current' and 'target' frame
calculation functions. In HS mode SOF limits provided by DSTS register
is 0x3fff, but in non HS mode this limit is 0x7ff.

Tested by internal tool which also using for dwc3 testing.

Signed-off-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/95d1423adf4b0f68187c9894820c4b7e964a3f7f.1631175721.git.Minas.Harutyunyan@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/gadget.c | 191 +++++++++++++++++++++-----------------
 1 file changed, 107 insertions(+), 84 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index b06286f132c6..025e8e867742 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -115,10 +115,16 @@ static inline bool using_desc_dma(struct dwc2_hsotg *hsotg)
  */
 static inline void dwc2_gadget_incr_frame_num(struct dwc2_hsotg_ep *hs_ep)
 {
+	struct dwc2_hsotg *hsotg = hs_ep->parent;
+	u16 limit = DSTS_SOFFN_LIMIT;
+
+	if (hsotg->gadget.speed != USB_SPEED_HIGH)
+		limit >>= 3;
+
 	hs_ep->target_frame += hs_ep->interval;
-	if (hs_ep->target_frame > DSTS_SOFFN_LIMIT) {
+	if (hs_ep->target_frame > limit) {
 		hs_ep->frame_overrun = true;
-		hs_ep->target_frame &= DSTS_SOFFN_LIMIT;
+		hs_ep->target_frame &= limit;
 	} else {
 		hs_ep->frame_overrun = false;
 	}
@@ -136,10 +142,16 @@ static inline void dwc2_gadget_incr_frame_num(struct dwc2_hsotg_ep *hs_ep)
  */
 static inline void dwc2_gadget_dec_frame_num_by_one(struct dwc2_hsotg_ep *hs_ep)
 {
+	struct dwc2_hsotg *hsotg = hs_ep->parent;
+	u16 limit = DSTS_SOFFN_LIMIT;
+
+	if (hsotg->gadget.speed != USB_SPEED_HIGH)
+		limit >>= 3;
+
 	if (hs_ep->target_frame)
 		hs_ep->target_frame -= 1;
 	else
-		hs_ep->target_frame = DSTS_SOFFN_LIMIT;
+		hs_ep->target_frame = limit;
 }
 
 /**
@@ -1018,6 +1030,12 @@ static void dwc2_gadget_start_isoc_ddma(struct dwc2_hsotg_ep *hs_ep)
 	dwc2_writel(hsotg, ctrl, depctl);
 }
 
+static bool dwc2_gadget_target_frame_elapsed(struct dwc2_hsotg_ep *hs_ep);
+static void dwc2_hsotg_complete_request(struct dwc2_hsotg *hsotg,
+					struct dwc2_hsotg_ep *hs_ep,
+				       struct dwc2_hsotg_req *hs_req,
+				       int result);
+
 /**
  * dwc2_hsotg_start_req - start a USB request from an endpoint's queue
  * @hsotg: The controller state.
@@ -1170,14 +1188,19 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg,
 		}
 	}
 
-	if (hs_ep->isochronous && hs_ep->interval == 1) {
-		hs_ep->target_frame = dwc2_hsotg_read_frameno(hsotg);
-		dwc2_gadget_incr_frame_num(hs_ep);
-
-		if (hs_ep->target_frame & 0x1)
-			ctrl |= DXEPCTL_SETODDFR;
-		else
-			ctrl |= DXEPCTL_SETEVENFR;
+	if (hs_ep->isochronous) {
+		if (!dwc2_gadget_target_frame_elapsed(hs_ep)) {
+			if (hs_ep->interval == 1) {
+				if (hs_ep->target_frame & 0x1)
+					ctrl |= DXEPCTL_SETODDFR;
+				else
+					ctrl |= DXEPCTL_SETEVENFR;
+			}
+			ctrl |= DXEPCTL_CNAK;
+		} else {
+			dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA);
+			return;
+		}
 	}
 
 	ctrl |= DXEPCTL_EPENA;	/* ensure ep enabled */
@@ -1325,12 +1348,16 @@ static bool dwc2_gadget_target_frame_elapsed(struct dwc2_hsotg_ep *hs_ep)
 	u32 target_frame = hs_ep->target_frame;
 	u32 current_frame = hsotg->frame_number;
 	bool frame_overrun = hs_ep->frame_overrun;
+	u16 limit = DSTS_SOFFN_LIMIT;
+
+	if (hsotg->gadget.speed != USB_SPEED_HIGH)
+		limit >>= 3;
 
 	if (!frame_overrun && current_frame >= target_frame)
 		return true;
 
 	if (frame_overrun && current_frame >= target_frame &&
-	    ((current_frame - target_frame) < DSTS_SOFFN_LIMIT / 2))
+	    ((current_frame - target_frame) < limit / 2))
 		return true;
 
 	return false;
@@ -1713,11 +1740,9 @@ static struct dwc2_hsotg_req *get_ep_head(struct dwc2_hsotg_ep *hs_ep)
  */
 static void dwc2_gadget_start_next_request(struct dwc2_hsotg_ep *hs_ep)
 {
-	u32 mask;
 	struct dwc2_hsotg *hsotg = hs_ep->parent;
 	int dir_in = hs_ep->dir_in;
 	struct dwc2_hsotg_req *hs_req;
-	u32 epmsk_reg = dir_in ? DIEPMSK : DOEPMSK;
 
 	if (!list_empty(&hs_ep->queue)) {
 		hs_req = get_ep_head(hs_ep);
@@ -1733,9 +1758,6 @@ static void dwc2_gadget_start_next_request(struct dwc2_hsotg_ep *hs_ep)
 	} else {
 		dev_dbg(hsotg->dev, "%s: No more ISOC-OUT requests\n",
 			__func__);
-		mask = dwc2_readl(hsotg, epmsk_reg);
-		mask |= DOEPMSK_OUTTKNEPDISMSK;
-		dwc2_writel(hsotg, mask, epmsk_reg);
 	}
 }
 
@@ -2305,19 +2327,6 @@ static void dwc2_hsotg_ep0_zlp(struct dwc2_hsotg *hsotg, bool dir_in)
 	dwc2_hsotg_program_zlp(hsotg, hsotg->eps_out[0]);
 }
 
-static void dwc2_hsotg_change_ep_iso_parity(struct dwc2_hsotg *hsotg,
-					    u32 epctl_reg)
-{
-	u32 ctrl;
-
-	ctrl = dwc2_readl(hsotg, epctl_reg);
-	if (ctrl & DXEPCTL_EOFRNUM)
-		ctrl |= DXEPCTL_SETEVENFR;
-	else
-		ctrl |= DXEPCTL_SETODDFR;
-	dwc2_writel(hsotg, ctrl, epctl_reg);
-}
-
 /*
  * dwc2_gadget_get_xfersize_ddma - get transferred bytes amount from desc
  * @hs_ep - The endpoint on which transfer went
@@ -2438,20 +2447,11 @@ static void dwc2_hsotg_handle_outdone(struct dwc2_hsotg *hsotg, int epnum)
 			dwc2_hsotg_ep0_zlp(hsotg, true);
 	}
 
-	/*
-	 * Slave mode OUT transfers do not go through XferComplete so
-	 * adjust the ISOC parity here.
-	 */
-	if (!using_dma(hsotg)) {
-		if (hs_ep->isochronous && hs_ep->interval == 1)
-			dwc2_hsotg_change_ep_iso_parity(hsotg, DOEPCTL(epnum));
-		else if (hs_ep->isochronous && hs_ep->interval > 1)
-			dwc2_gadget_incr_frame_num(hs_ep);
-	}
-
 	/* Set actual frame number for completed transfers */
-	if (!using_desc_dma(hsotg) && hs_ep->isochronous)
-		req->frame_number = hsotg->frame_number;
+	if (!using_desc_dma(hsotg) && hs_ep->isochronous) {
+		req->frame_number = hs_ep->target_frame;
+		dwc2_gadget_incr_frame_num(hs_ep);
+	}
 
 	dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, result);
 }
@@ -2765,6 +2765,12 @@ static void dwc2_hsotg_complete_in(struct dwc2_hsotg *hsotg,
 		return;
 	}
 
+	/* Set actual frame number for completed transfers */
+	if (!using_desc_dma(hsotg) && hs_ep->isochronous) {
+		hs_req->req.frame_number = hs_ep->target_frame;
+		dwc2_gadget_incr_frame_num(hs_ep);
+	}
+
 	dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, 0);
 }
 
@@ -2825,23 +2831,18 @@ static void dwc2_gadget_handle_ep_disabled(struct dwc2_hsotg_ep *hs_ep)
 
 		dwc2_hsotg_txfifo_flush(hsotg, hs_ep->fifo_index);
 
-		if (hs_ep->isochronous) {
-			dwc2_hsotg_complete_in(hsotg, hs_ep);
-			return;
-		}
-
 		if ((epctl & DXEPCTL_STALL) && (epctl & DXEPCTL_EPTYPE_BULK)) {
 			int dctl = dwc2_readl(hsotg, DCTL);
 
 			dctl |= DCTL_CGNPINNAK;
 			dwc2_writel(hsotg, dctl, DCTL);
 		}
-		return;
-	}
+	} else {
 
-	if (dctl & DCTL_GOUTNAKSTS) {
-		dctl |= DCTL_CGOUTNAK;
-		dwc2_writel(hsotg, dctl, DCTL);
+		if (dctl & DCTL_GOUTNAKSTS) {
+			dctl |= DCTL_CGOUTNAK;
+			dwc2_writel(hsotg, dctl, DCTL);
+		}
 	}
 
 	if (!hs_ep->isochronous)
@@ -2862,8 +2863,6 @@ static void dwc2_gadget_handle_ep_disabled(struct dwc2_hsotg_ep *hs_ep)
 		/* Update current frame number value. */
 		hsotg->frame_number = dwc2_hsotg_read_frameno(hsotg);
 	} while (dwc2_gadget_target_frame_elapsed(hs_ep));
-
-	dwc2_gadget_start_next_request(hs_ep);
 }
 
 /**
@@ -2880,8 +2879,8 @@ static void dwc2_gadget_handle_ep_disabled(struct dwc2_hsotg_ep *hs_ep)
 static void dwc2_gadget_handle_out_token_ep_disabled(struct dwc2_hsotg_ep *ep)
 {
 	struct dwc2_hsotg *hsotg = ep->parent;
+	struct dwc2_hsotg_req *hs_req;
 	int dir_in = ep->dir_in;
-	u32 doepmsk;
 
 	if (dir_in || !ep->isochronous)
 		return;
@@ -2895,28 +2894,39 @@ static void dwc2_gadget_handle_out_token_ep_disabled(struct dwc2_hsotg_ep *ep)
 		return;
 	}
 
-	if (ep->interval > 1 &&
-	    ep->target_frame == TARGET_FRAME_INITIAL) {
+	if (ep->target_frame == TARGET_FRAME_INITIAL) {
 		u32 ctrl;
 
 		ep->target_frame = hsotg->frame_number;
-		dwc2_gadget_incr_frame_num(ep);
+		if (ep->interval > 1) {
+			ctrl = dwc2_readl(hsotg, DOEPCTL(ep->index));
+			if (ep->target_frame & 0x1)
+				ctrl |= DXEPCTL_SETODDFR;
+			else
+				ctrl |= DXEPCTL_SETEVENFR;
 
-		ctrl = dwc2_readl(hsotg, DOEPCTL(ep->index));
-		if (ep->target_frame & 0x1)
-			ctrl |= DXEPCTL_SETODDFR;
-		else
-			ctrl |= DXEPCTL_SETEVENFR;
-
-		dwc2_writel(hsotg, ctrl, DOEPCTL(ep->index));
+			dwc2_writel(hsotg, ctrl, DOEPCTL(ep->index));
+		}
 	}
 
-	dwc2_gadget_start_next_request(ep);
-	doepmsk = dwc2_readl(hsotg, DOEPMSK);
-	doepmsk &= ~DOEPMSK_OUTTKNEPDISMSK;
-	dwc2_writel(hsotg, doepmsk, DOEPMSK);
+	while (dwc2_gadget_target_frame_elapsed(ep)) {
+		hs_req = get_ep_head(ep);
+		if (hs_req)
+			dwc2_hsotg_complete_request(hsotg, ep, hs_req, -ENODATA);
+
+		dwc2_gadget_incr_frame_num(ep);
+		/* Update current frame number value. */
+		hsotg->frame_number = dwc2_hsotg_read_frameno(hsotg);
+	}
+
+	if (!ep->req)
+		dwc2_gadget_start_next_request(ep);
+
 }
 
+static void dwc2_hsotg_ep_stop_xfr(struct dwc2_hsotg *hsotg,
+				   struct dwc2_hsotg_ep *hs_ep);
+
 /**
  * dwc2_gadget_handle_nak - handle NAK interrupt
  * @hs_ep: The endpoint on which interrupt is asserted.
@@ -2934,7 +2944,9 @@ static void dwc2_gadget_handle_out_token_ep_disabled(struct dwc2_hsotg_ep *ep)
 static void dwc2_gadget_handle_nak(struct dwc2_hsotg_ep *hs_ep)
 {
 	struct dwc2_hsotg *hsotg = hs_ep->parent;
+	struct dwc2_hsotg_req *hs_req;
 	int dir_in = hs_ep->dir_in;
+	u32 ctrl;
 
 	if (!dir_in || !hs_ep->isochronous)
 		return;
@@ -2976,13 +2988,29 @@ static void dwc2_gadget_handle_nak(struct dwc2_hsotg_ep *hs_ep)
 
 			dwc2_writel(hsotg, ctrl, DIEPCTL(hs_ep->index));
 		}
-
-		dwc2_hsotg_complete_request(hsotg, hs_ep,
-					    get_ep_head(hs_ep), 0);
 	}
 
-	if (!using_desc_dma(hsotg))
+	if (using_desc_dma(hsotg))
+		return;
+
+	ctrl = dwc2_readl(hsotg, DIEPCTL(hs_ep->index));
+	if (ctrl & DXEPCTL_EPENA)
+		dwc2_hsotg_ep_stop_xfr(hsotg, hs_ep);
+	else
+		dwc2_hsotg_txfifo_flush(hsotg, hs_ep->fifo_index);
+
+	while (dwc2_gadget_target_frame_elapsed(hs_ep)) {
+		hs_req = get_ep_head(hs_ep);
+		if (hs_req)
+			dwc2_hsotg_complete_request(hsotg, hs_ep, hs_req, -ENODATA);
+
 		dwc2_gadget_incr_frame_num(hs_ep);
+		/* Update current frame number value. */
+		hsotg->frame_number = dwc2_hsotg_read_frameno(hsotg);
+	}
+
+	if (!hs_ep->req)
+		dwc2_gadget_start_next_request(hs_ep);
 }
 
 /**
@@ -3047,12 +3075,8 @@ static void dwc2_hsotg_epint(struct dwc2_hsotg *hsotg, unsigned int idx,
 			 * need to look at completing IN requests here
 			 * if operating slave mode
 			 */
-			if (hs_ep->isochronous && hs_ep->interval > 1)
-				dwc2_gadget_incr_frame_num(hs_ep);
-
-			dwc2_hsotg_complete_in(hsotg, hs_ep);
-			if (ints & DXEPINT_NAKINTRPT)
-				ints &= ~DXEPINT_NAKINTRPT;
+			if (!hs_ep->isochronous || !(ints & DXEPINT_NAKINTRPT))
+				dwc2_hsotg_complete_in(hsotg, hs_ep);
 
 			if (idx == 0 && !hs_ep->req)
 				dwc2_hsotg_enqueue_setup(hsotg);
@@ -3061,10 +3085,8 @@ static void dwc2_hsotg_epint(struct dwc2_hsotg *hsotg, unsigned int idx,
 			 * We're using DMA, we need to fire an OutDone here
 			 * as we ignore the RXFIFO.
 			 */
-			if (hs_ep->isochronous && hs_ep->interval > 1)
-				dwc2_gadget_incr_frame_num(hs_ep);
-
-			dwc2_hsotg_handle_outdone(hsotg, idx);
+			if (!hs_ep->isochronous || !(ints & DXEPINT_OUTTKNEPDIS))
+				dwc2_hsotg_handle_outdone(hsotg, idx);
 		}
 	}
 
@@ -4083,6 +4105,7 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
 			mask |= DIEPMSK_NAKMSK;
 			dwc2_writel(hsotg, mask, DIEPMSK);
 		} else {
+			epctrl |= DXEPCTL_SNAK;
 			mask = dwc2_readl(hsotg, DOEPMSK);
 			mask |= DOEPMSK_OUTTKNEPDISMSK;
 			dwc2_writel(hsotg, mask, DOEPMSK);

From d071c7fd45dcde9fc051e5f4de2f2fb24792279e Mon Sep 17 00:00:00 2001
From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Date: Sat, 11 Sep 2021 22:58:30 +0400
Subject: [PATCH 0507/1750] usb: dwc2: gadget: Fix ISOC transfer complete
 handling for DDMA

commit dbe2518b2d8eabffa74dbf7d9fdd7dacddab7fc0 upstream.

When last descriptor in a descriptor list completed with XferComplete
interrupt, core switching to handle next descriptor and assert BNA
interrupt. Both these interrupts are set while dwc2_hsotg_epint()
handler called. Each interrupt should be handled separately: first
XferComplete interrupt then BNA interrupt, otherwise last completed
transfer will not be giveback to function driver as completed
request.

Fixes: 729cac693eec ("usb: dwc2: Change ISOC DDMA flow")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Link: https://lore.kernel.org/r/a36981accc26cd674c5d8f8da6164344b94ec1fe.1631386531.git.Minas.Harutyunyan@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc2/gadget.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 025e8e867742..7207a36c6e26 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3066,9 +3066,7 @@ static void dwc2_hsotg_epint(struct dwc2_hsotg *hsotg, unsigned int idx,
 
 		/* In DDMA handle isochronous requests separately */
 		if (using_desc_dma(hsotg) && hs_ep->isochronous) {
-			/* XferCompl set along with BNA */
-			if (!(ints & DXEPINT_BNAINTR))
-				dwc2_gadget_complete_isoc_request_ddma(hs_ep);
+			dwc2_gadget_complete_isoc_request_ddma(hs_ep);
 		} else if (dir_in) {
 			/*
 			 * We get OutDone from the FIFO, so we only

From 5940e22528df689d4b835f4daceafca4b58beaa7 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 16 Sep 2021 16:57:37 +0300
Subject: [PATCH 0508/1750] usb: musb: tusb6010: uninitialized data in
 tusb_fifo_write_unaligned()

commit 517c7bf99bad3d6b9360558414aae634b7472d80 upstream.

This is writing to the first 1 - 3 bytes of "val" and then writing all
four bytes to musb_writel().  The last byte is always going to be
garbage.  Zero out the last bytes instead.

Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210916135737.GI25094@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/musb/tusb6010.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index c26683a2702b..0c2afed4131b 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -190,6 +190,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len)
 	}
 	if (len > 0) {
 		/* Write the rest 1 - 3 bytes to FIFO */
+		val = 0;
 		memcpy(&val, buf, len);
 		musb_writel(fifo, 0, val);
 	}

From 93028da5e92dd3d80b8cbb539b23137865cbcc81 Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Thu, 23 Sep 2021 19:18:37 -0500
Subject: [PATCH 0509/1750] cifs: fix incorrect check for null pointer in
 header_assemble

commit 9ed38fd4a15417cac83967360cf20b853bfab9b6 upstream.

Although very unlikely that the tlink pointer would be null in this case,
get_next_mid function can in theory return null (but not an error)
so need to check for null (not for IS_ERR, which can not be returned
here).

Address warning:

        fs/smbfs_client/connect.c:2392 cifs_match_super()
        warn: 'tlink' isn't an ERR_PTR

Pointed out by Dan Carpenter via smatch code analysis tool

CC: stable@vger.kernel.org
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/connect.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 8ffe8063e42c..7f5d173760cf 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3504,9 +3504,10 @@ cifs_match_super(struct super_block *sb, void *data)
 	spin_lock(&cifs_tcp_ses_lock);
 	cifs_sb = CIFS_SB(sb);
 	tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb));
-	if (IS_ERR(tlink)) {
+	if (tlink == NULL) {
+		/* can not match superblock if tlink were ever null */
 		spin_unlock(&cifs_tcp_ses_lock);
-		return rc;
+		return 0;
 	}
 	tcon = tlink_tcon(tlink);
 	ses = tcon->ses;

From f79282849187604697b6c5944121c817a0d640e5 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Mon, 20 Sep 2021 18:15:11 +0200
Subject: [PATCH 0510/1750] xen/x86: fix PV trap handling on secondary
 processors

commit 0594c58161b6e0f3da8efa9c6e3d4ba52b652717 upstream.

The initial observation was that in PV mode under Xen 32-bit user space
didn't work anymore. Attempts of system calls ended in #GP(0x402). All
of the sudden the vector 0x80 handler was not in place anymore. As it
turns out up to 5.13 redundant initialization did occur: Once from
cpu_initialize_context() (through its VCPUOP_initialise hypercall) and a
2nd time while each CPU was brought fully up. This 2nd initialization is
now gone, uncovering that the 1st one was flawed: Unlike for the
set_trap_table hypercall, a full virtual IDT needs to be specified here;
the "vector" fields of the individual entries are of no interest. With
many (kernel) IDT entries still(?) (i.e. at that point at least) empty,
the syscall vector 0x80 ended up in slot 0x20 of the virtual IDT, thus
becoming the domain's handler for vector 0x20.

Make xen_convert_trap_info() fit for either purpose, leveraging the fact
that on the xen_copy_trap_info() path the table starts out zero-filled.
This includes moving out the writing of the sentinel, which would also
have lead to a buffer overrun in the xen_copy_trap_info() case if all
(kernel) IDT entries were populated. Convert the writing of the sentinel
to clearing of the entire table entry rather than just the address
field.

(I didn't bother trying to identify the commit which uncovered the issue
in 5.14; the commit named below is the one which actually introduced the
bad code.)

Fixes: f87e4cac4f4e ("xen: SMP guest support")
Cc: stable@vger.kernel.org
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/7a266932-092e-b68f-f2bb-1473b61adc6e@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/xen/enlighten_pv.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index c758fd913ced..5af0421ef74b 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -736,8 +736,8 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g)
 	preempt_enable();
 }
 
-static void xen_convert_trap_info(const struct desc_ptr *desc,
-				  struct trap_info *traps)
+static unsigned xen_convert_trap_info(const struct desc_ptr *desc,
+				      struct trap_info *traps, bool full)
 {
 	unsigned in, out, count;
 
@@ -747,17 +747,18 @@ static void xen_convert_trap_info(const struct desc_ptr *desc,
 	for (in = out = 0; in < count; in++) {
 		gate_desc *entry = (gate_desc *)(desc->address) + in;
 
-		if (cvt_gate_to_trap(in, entry, &traps[out]))
+		if (cvt_gate_to_trap(in, entry, &traps[out]) || full)
 			out++;
 	}
-	traps[out].address = 0;
+
+	return out;
 }
 
 void xen_copy_trap_info(struct trap_info *traps)
 {
 	const struct desc_ptr *desc = this_cpu_ptr(&idt_desc);
 
-	xen_convert_trap_info(desc, traps);
+	xen_convert_trap_info(desc, traps, true);
 }
 
 /* Load a new IDT into Xen.  In principle this can be per-CPU, so we
@@ -767,6 +768,7 @@ static void xen_load_idt(const struct desc_ptr *desc)
 {
 	static DEFINE_SPINLOCK(lock);
 	static struct trap_info traps[257];
+	unsigned out;
 
 	trace_xen_cpu_load_idt(desc);
 
@@ -774,7 +776,8 @@ static void xen_load_idt(const struct desc_ptr *desc)
 
 	memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc));
 
-	xen_convert_trap_info(desc, traps);
+	out = xen_convert_trap_info(desc, traps, false);
+	memset(&traps[out], 0, sizeof(traps[0]));
 
 	xen_mc_flush();
 	if (HYPERVISOR_set_trap_table(traps))

From a34d6ef0c71a15fed610fd34493a46cf54dac4e3 Mon Sep 17 00:00:00 2001
From: Ondrej Zary <linux@zary.sk>
Date: Mon, 13 Sep 2021 23:01:06 +0200
Subject: [PATCH 0511/1750] usb-storage: Add quirk for ScanLogic SL11R-IDE
 older than 2.6c

commit b55d37ef6b7db3eda9b4495a8d9b0a944ee8c67d upstream.

ScanLogic SL11R-IDE with firmware older than 2.6c (the latest one) has
broken tag handling, preventing the device from working at all:
usb 1-1: new full-speed USB device number 2 using uhci_hcd
usb 1-1: New USB device found, idVendor=04ce, idProduct=0002, bcdDevice= 2.60
usb 1-1: New USB device strings: Mfr=1, Product=1, SerialNumber=0
usb 1-1: Product: USB Device
usb 1-1: Manufacturer: USB Device
usb-storage 1-1:1.0: USB Mass Storage device detected
scsi host2: usb-storage 1-1:1.0
usbcore: registered new interface driver usb-storage
usb 1-1: reset full-speed USB device number 2 using uhci_hcd
usb 1-1: reset full-speed USB device number 2 using uhci_hcd
usb 1-1: reset full-speed USB device number 2 using uhci_hcd
usb 1-1: reset full-speed USB device number 2 using uhci_hcd

Add US_FL_BULK_IGNORE_TAG to fix it. Also update my e-mail address.

2.6c is the only firmware that claims Linux compatibility.
The firmware can be upgraded using ezotgdbg utility:
https://github.com/asciilifeform/ezotgdbg

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Ondrej Zary <linux@zary.sk>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210913210106.12717-1-linux@zary.sk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_devs.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index efa972be2ee3..c6b3fcf90180 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -416,9 +416,16 @@ UNUSUAL_DEV(  0x04cb, 0x0100, 0x0000, 0x2210,
 		USB_SC_UFI, USB_PR_DEVICE, NULL, US_FL_FIX_INQUIRY | US_FL_SINGLE_LUN),
 
 /*
- * Reported by Ondrej Zary <linux@rainbow-software.org>
+ * Reported by Ondrej Zary <linux@zary.sk>
  * The device reports one sector more and breaks when that sector is accessed
+ * Firmwares older than 2.6c (the latest one and the only that claims Linux
+ * support) have also broken tag handling
  */
+UNUSUAL_DEV(  0x04ce, 0x0002, 0x0000, 0x026b,
+		"ScanLogic",
+		"SL11R-IDE",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_FIX_CAPACITY | US_FL_BULK_IGNORE_TAG),
 UNUSUAL_DEV(  0x04ce, 0x0002, 0x026c, 0x026c,
 		"ScanLogic",
 		"SL11R-IDE",

From 0809b8576fa860b0f168305f46aa08382eab8ec9 Mon Sep 17 00:00:00 2001
From: Uwe Brandt <uwe.brandt@gmail.com>
Date: Tue, 21 Sep 2021 19:54:46 +0200
Subject: [PATCH 0512/1750] USB: serial: cp210x: add ID for GW Instek GDM-834x
 Digital Multimeter

commit 3bd18ba7d859eb1fbef3beb1e80c24f6f7d7596c upstream.

Add the USB serial device ID for the GW Instek GDM-834x Digital Multimeter.

Signed-off-by: Uwe Brandt <uwe.brandt@gmail.com>
Link: https://lore.kernel.org/r/YUxFl3YUCPGJZd8Y@hovoldconsulting.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 329fc25f78a4..9489adbc4a2f 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -237,6 +237,7 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
 	{ USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
 	{ USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
+	{ USB_DEVICE(0x2184, 0x0030) }, /* GW Instek GDM-834x Digital Multimeter */
 	{ USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
 	{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
 	{ USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */

From b33b3db476e69a6e09e8e6d9197013337a282352 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 7 Sep 2021 10:23:18 +0200
Subject: [PATCH 0513/1750] USB: cdc-acm: fix minor-number release

commit 91fac0741d4817945c6ee0a17591421e7f5ecb86 upstream.

If the driver runs out of minor numbers it would release minor 0 and
allow another device to claim the minor while still in use.

Fortunately, registering the tty class device of the second device would
fail (with a stack dump) due to the sysfs name collision so no memory is
leaked.

Fixes: cae2bc768d17 ("usb: cdc-acm: Decrement tty port's refcount if probe() fail")
Cc: stable@vger.kernel.org      # 4.19
Cc: Jaejoong Kim <climbbb.kim@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210907082318.7757-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 7 +++++--
 drivers/usb/class/cdc-acm.h | 2 ++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index df5b2d1e214f..7748b1335558 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -726,7 +726,8 @@ static void acm_port_destruct(struct tty_port *port)
 {
 	struct acm *acm = container_of(port, struct acm, port);
 
-	acm_release_minor(acm);
+	if (acm->minor != ACM_MINOR_INVALID)
+		acm_release_minor(acm);
 	usb_put_intf(acm->control);
 	kfree(acm->country_codes);
 	kfree(acm);
@@ -1343,8 +1344,10 @@ static int acm_probe(struct usb_interface *intf,
 	usb_get_intf(acm->control); /* undone in destruct() */
 
 	minor = acm_alloc_minor(acm);
-	if (minor < 0)
+	if (minor < 0) {
+		acm->minor = ACM_MINOR_INVALID;
 		goto alloc_fail1;
+	}
 
 	acm->minor = minor;
 	acm->dev = usb_dev;
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 8aef5eb769a0..3aa7f0a3ad71 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -22,6 +22,8 @@
 #define ACM_TTY_MAJOR		166
 #define ACM_TTY_MINORS		256
 
+#define ACM_MINOR_INVALID	ACM_TTY_MINORS
+
 /*
  * Requests.
  */

From 302e60e26ad5b1998f71bfaf622e80d9e407eea3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Tue, 31 Aug 2021 08:54:19 +0200
Subject: [PATCH 0514/1750] Revert "USB: bcma: Add a check for devm_gpiod_get"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit d91adc5322ab53df4b6d1989242bfb6c63163eb2 upstream.

This reverts commit f3de5d857bb2362b00e2a8d4bc886cd49dcb66db.

That commit broke USB on all routers that have USB always powered on and
don't require toggling any GPIO. It's a majority of devices actually.

The original code worked and seemed safe: vcc GPIO is optional and
bcma_hci_platform_power_gpio() takes care of checking the pointer before
using it.

This revert fixes:
[   10.801127] bcma_hcd: probe of bcma0:11 failed with error -2

Fixes: f3de5d857bb2 ("USB: bcma: Add a check for devm_gpiod_get")
Cc: stable <stable@vger.kernel.org>
Cc: Chuhong Yuan <hslester96@gmail.com>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20210831065419.18371-1-zajec5@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/bcma-hcd.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/usb/host/bcma-hcd.c b/drivers/usb/host/bcma-hcd.c
index 337b425dd4b0..2df52f75f6b3 100644
--- a/drivers/usb/host/bcma-hcd.c
+++ b/drivers/usb/host/bcma-hcd.c
@@ -406,12 +406,9 @@ static int bcma_hcd_probe(struct bcma_device *core)
 		return -ENOMEM;
 	usb_dev->core = core;
 
-	if (core->dev.of_node) {
+	if (core->dev.of_node)
 		usb_dev->gpio_desc = devm_gpiod_get(&core->dev, "vcc",
 						    GPIOD_OUT_HIGH);
-		if (IS_ERR(usb_dev->gpio_desc))
-			return PTR_ERR(usb_dev->gpio_desc);
-	}
 
 	switch (core->id.id) {
 	case BCMA_CORE_USB20_HOST:

From d5b0473707fa53b03a5db0256ce62b2874bddbc7 Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos@google.com>
Date: Mon, 30 Aug 2021 12:51:46 -0700
Subject: [PATCH 0515/1750] binder: make sure fd closes complete

commit 5fdb55c1ac9585eb23bb2541d5819224429e103d upstream.

During BC_FREE_BUFFER processing, the BINDER_TYPE_FDA object
cleanup may close 1 or more fds. The close operations are
completed using the task work mechanism -- which means the thread
needs to return to userspace or the file object may never be
dereferenced -- which can lead to hung processes.

Force the binder thread back to userspace if an fd is closed during
BC_FREE_BUFFER handling.

Fixes: 80cd795630d6 ("binder: fix use-after-free due to ksys_close() during fdget()")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20210830195146.587206-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 2a3952925855..65b22b5af51a 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2236,6 +2236,7 @@ static void binder_deferred_fd_close(int fd)
 }
 
 static void binder_transaction_buffer_release(struct binder_proc *proc,
+					      struct binder_thread *thread,
 					      struct binder_buffer *buffer,
 					      binder_size_t failed_at,
 					      bool is_failure)
@@ -2395,8 +2396,16 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
 						&proc->alloc, &fd, buffer,
 						offset, sizeof(fd));
 				WARN_ON(err);
-				if (!err)
+				if (!err) {
 					binder_deferred_fd_close(fd);
+					/*
+					 * Need to make sure the thread goes
+					 * back to userspace to complete the
+					 * deferred close
+					 */
+					if (thread)
+						thread->looper_need_return = true;
+				}
 			}
 		} break;
 		default:
@@ -3465,7 +3474,7 @@ static void binder_transaction(struct binder_proc *proc,
 err_copy_data_failed:
 	binder_free_txn_fixups(t);
 	trace_binder_transaction_failed_buffer_release(t->buffer);
-	binder_transaction_buffer_release(target_proc, t->buffer,
+	binder_transaction_buffer_release(target_proc, NULL, t->buffer,
 					  buffer_offset, true);
 	if (target_node)
 		binder_dec_node_tmpref(target_node);
@@ -3542,7 +3551,9 @@ static void binder_transaction(struct binder_proc *proc,
  * Cleanup buffer and free it.
  */
 static void
-binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer)
+binder_free_buf(struct binder_proc *proc,
+		struct binder_thread *thread,
+		struct binder_buffer *buffer)
 {
 	binder_inner_proc_lock(proc);
 	if (buffer->transaction) {
@@ -3570,7 +3581,7 @@ binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer)
 		binder_node_inner_unlock(buf_node);
 	}
 	trace_binder_transaction_buffer_release(buffer);
-	binder_transaction_buffer_release(proc, buffer, 0, false);
+	binder_transaction_buffer_release(proc, thread, buffer, 0, false);
 	binder_alloc_free_buf(&proc->alloc, buffer);
 }
 
@@ -3771,7 +3782,7 @@ static int binder_thread_write(struct binder_proc *proc,
 				     proc->pid, thread->pid, (u64)data_ptr,
 				     buffer->debug_id,
 				     buffer->transaction ? "active" : "finished");
-			binder_free_buf(proc, buffer);
+			binder_free_buf(proc, thread, buffer);
 			break;
 		}
 
@@ -4459,7 +4470,7 @@ static int binder_thread_read(struct binder_proc *proc,
 			buffer->transaction = NULL;
 			binder_cleanup_transaction(t, "fd fixups failed",
 						   BR_FAILED_REPLY);
-			binder_free_buf(proc, buffer);
+			binder_free_buf(proc, thread, buffer);
 			binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
 				     "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
 				     proc->pid, thread->pid,

From b9e697e60ce9890e9258a73eb061288e7d68e5e6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 6 Sep 2021 14:45:38 +0200
Subject: [PATCH 0516/1750] staging: greybus: uart: fix tty use after free

commit 92dc0b1f46e12cfabd28d709bb34f7a39431b44f upstream.

User space can hold a tty open indefinitely and tty drivers must not
release the underlying structures until the last user is gone.

Switch to using the tty-port reference counter to manage the life time
of the greybus tty state to avoid use after free after a disconnect.

Fixes: a18e15175708 ("greybus: more uart work")
Cc: stable@vger.kernel.org      # 4.9
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210906124538.22358-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/greybus/uart.c | 62 ++++++++++++++++++----------------
 1 file changed, 32 insertions(+), 30 deletions(-)

diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c
index a520f7f213db..edaa83a693d2 100644
--- a/drivers/staging/greybus/uart.c
+++ b/drivers/staging/greybus/uart.c
@@ -778,6 +778,17 @@ static void gb_tty_port_shutdown(struct tty_port *port)
 	gbphy_runtime_put_autosuspend(gb_tty->gbphy_dev);
 }
 
+static void gb_tty_port_destruct(struct tty_port *port)
+{
+	struct gb_tty *gb_tty = container_of(port, struct gb_tty, port);
+
+	if (gb_tty->minor != GB_NUM_MINORS)
+		release_minor(gb_tty);
+	kfifo_free(&gb_tty->write_fifo);
+	kfree(gb_tty->buffer);
+	kfree(gb_tty);
+}
+
 static const struct tty_operations gb_ops = {
 	.install =		gb_tty_install,
 	.open =			gb_tty_open,
@@ -803,6 +814,7 @@ static const struct tty_port_operations gb_port_ops = {
 	.dtr_rts =		gb_tty_dtr_rts,
 	.activate =		gb_tty_port_activate,
 	.shutdown =		gb_tty_port_shutdown,
+	.destruct =		gb_tty_port_destruct,
 };
 
 static int gb_uart_probe(struct gbphy_device *gbphy_dev,
@@ -815,17 +827,11 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
 	int retval;
 	int minor;
 
-	gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL);
-	if (!gb_tty)
-		return -ENOMEM;
-
 	connection = gb_connection_create(gbphy_dev->bundle,
 					  le16_to_cpu(gbphy_dev->cport_desc->id),
 					  gb_uart_request_handler);
-	if (IS_ERR(connection)) {
-		retval = PTR_ERR(connection);
-		goto exit_tty_free;
-	}
+	if (IS_ERR(connection))
+		return PTR_ERR(connection);
 
 	max_payload = gb_operation_get_payload_size_max(connection);
 	if (max_payload < sizeof(struct gb_uart_send_data_request)) {
@@ -833,13 +839,23 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
 		goto exit_connection_destroy;
 	}
 
+	gb_tty = kzalloc(sizeof(*gb_tty), GFP_KERNEL);
+	if (!gb_tty) {
+		retval = -ENOMEM;
+		goto exit_connection_destroy;
+	}
+
+	tty_port_init(&gb_tty->port);
+	gb_tty->port.ops = &gb_port_ops;
+	gb_tty->minor = GB_NUM_MINORS;
+
 	gb_tty->buffer_payload_max = max_payload -
 			sizeof(struct gb_uart_send_data_request);
 
 	gb_tty->buffer = kzalloc(gb_tty->buffer_payload_max, GFP_KERNEL);
 	if (!gb_tty->buffer) {
 		retval = -ENOMEM;
-		goto exit_connection_destroy;
+		goto exit_put_port;
 	}
 
 	INIT_WORK(&gb_tty->tx_work, gb_uart_tx_write_work);
@@ -847,7 +863,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
 	retval = kfifo_alloc(&gb_tty->write_fifo, GB_UART_WRITE_FIFO_SIZE,
 			     GFP_KERNEL);
 	if (retval)
-		goto exit_buf_free;
+		goto exit_put_port;
 
 	gb_tty->credits = GB_UART_FIRMWARE_CREDITS;
 	init_completion(&gb_tty->credits_complete);
@@ -861,7 +877,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
 		} else {
 			retval = minor;
 		}
-		goto exit_kfifo_free;
+		goto exit_put_port;
 	}
 
 	gb_tty->minor = minor;
@@ -870,9 +886,6 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
 	init_waitqueue_head(&gb_tty->wioctl);
 	mutex_init(&gb_tty->mutex);
 
-	tty_port_init(&gb_tty->port);
-	gb_tty->port.ops = &gb_port_ops;
-
 	gb_tty->connection = connection;
 	gb_tty->gbphy_dev = gbphy_dev;
 	gb_connection_set_data(connection, gb_tty);
@@ -880,7 +893,7 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
 
 	retval = gb_connection_enable_tx(connection);
 	if (retval)
-		goto exit_release_minor;
+		goto exit_put_port;
 
 	send_control(gb_tty, gb_tty->ctrlout);
 
@@ -907,16 +920,10 @@ static int gb_uart_probe(struct gbphy_device *gbphy_dev,
 
 exit_connection_disable:
 	gb_connection_disable(connection);
-exit_release_minor:
-	release_minor(gb_tty);
-exit_kfifo_free:
-	kfifo_free(&gb_tty->write_fifo);
-exit_buf_free:
-	kfree(gb_tty->buffer);
+exit_put_port:
+	tty_port_put(&gb_tty->port);
 exit_connection_destroy:
 	gb_connection_destroy(connection);
-exit_tty_free:
-	kfree(gb_tty);
 
 	return retval;
 }
@@ -947,15 +954,10 @@ static void gb_uart_remove(struct gbphy_device *gbphy_dev)
 	gb_connection_disable_rx(connection);
 	tty_unregister_device(gb_tty_driver, gb_tty->minor);
 
-	/* FIXME - free transmit / receive buffers */
-
 	gb_connection_disable(connection);
-	tty_port_destroy(&gb_tty->port);
 	gb_connection_destroy(connection);
-	release_minor(gb_tty);
-	kfifo_free(&gb_tty->write_fifo);
-	kfree(gb_tty->buffer);
-	kfree(gb_tty);
+
+	tty_port_put(&gb_tty->port);
 }
 
 static int gb_tty_init(void)

From a05ff800013eed8f8bb12ccc7231875821b36197 Mon Sep 17 00:00:00 2001
From: Julian Sikorski <belegdol@gmail.com>
Date: Mon, 13 Sep 2021 20:14:55 +0200
Subject: [PATCH 0517/1750] Re-enable UAS for LaCie Rugged USB3-FW with fk
 quirk

commit ce1c42b4dacfe7d71c852d8bf3371067ccba865c upstream.

Further testing has revealed that LaCie Rugged USB3-FW does work with
uas as long as US_FL_NO_REPORT_OPCODES and US_FL_NO_SAME are enabled.

Link: https://lore.kernel.org/linux-usb/2167ea48-e273-a336-a4e0-10a4e883e75e@redhat.com/
Cc: stable <stable@vger.kernel.org>
Suggested-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Julian Sikorski <belegdol+github@gmail.com>
Link: https://lore.kernel.org/r/20210913181454.7365-1-belegdol+github@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_uas.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index c35a6db993f1..4051c8cd0cd8 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -50,7 +50,7 @@ UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999,
 		"LaCie",
 		"Rugged USB3-FW",
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-		US_FL_IGNORE_UAS),
+		US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME),
 
 /*
  * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI

From 996f7c4a1fcf512af3502507f69e4c4760d5f9c8 Mon Sep 17 00:00:00 2001
From: Li Jun <jun.li@nxp.com>
Date: Wed, 8 Sep 2021 10:28:19 +0800
Subject: [PATCH 0518/1750] usb: dwc3: core: balance phy init and exit

commit 8cfac9a6744fcb143cb3e94ce002f09fd17fadbb upstream.

After we start to do core soft reset while usb role switch,
the phy init is invoked at every switch to device mode, but
its counter part de-init is missing, this causes the actual
phy init can not be done when we really want to re-init phy
like system resume, because the counter maintained by phy
core is not 0. considering phy init is actually redundant for
role switch, so move out the phy init from core soft reset to
dwc3 core init where is the only place required.

Fixes: f88359e1588b ("usb: dwc3: core: Do core softreset when switch mode")
Cc: <stable@vger.kernel.org>
Tested-by: faqiang.zhu <faqiang.zhu@nxp.com>
Tested-by: John Stultz <john.stultz@linaro.org> #HiKey960
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Li Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/1631068099-13559-1-git-send-email-jun.li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/dwc3/core.c | 30 +++++++++++++-----------------
 1 file changed, 13 insertions(+), 17 deletions(-)

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index bfb72902f3a6..1580d51aea4f 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -264,19 +264,6 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc)
 {
 	u32		reg;
 	int		retries = 1000;
-	int		ret;
-
-	usb_phy_init(dwc->usb2_phy);
-	usb_phy_init(dwc->usb3_phy);
-	ret = phy_init(dwc->usb2_generic_phy);
-	if (ret < 0)
-		return ret;
-
-	ret = phy_init(dwc->usb3_generic_phy);
-	if (ret < 0) {
-		phy_exit(dwc->usb2_generic_phy);
-		return ret;
-	}
 
 	/*
 	 * We're resetting only the device side because, if we're in host mode,
@@ -310,9 +297,6 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc)
 			udelay(1);
 	} while (--retries);
 
-	phy_exit(dwc->usb3_generic_phy);
-	phy_exit(dwc->usb2_generic_phy);
-
 	return -ETIMEDOUT;
 
 done:
@@ -979,9 +963,21 @@ static int dwc3_core_init(struct dwc3 *dwc)
 		dwc->phys_ready = true;
 	}
 
+	usb_phy_init(dwc->usb2_phy);
+	usb_phy_init(dwc->usb3_phy);
+	ret = phy_init(dwc->usb2_generic_phy);
+	if (ret < 0)
+		goto err0a;
+
+	ret = phy_init(dwc->usb3_generic_phy);
+	if (ret < 0) {
+		phy_exit(dwc->usb2_generic_phy);
+		goto err0a;
+	}
+
 	ret = dwc3_core_soft_reset(dwc);
 	if (ret)
-		goto err0a;
+		goto err1;
 
 	if (hw_mode == DWC3_GHWPARAMS0_MODE_DRD &&
 	    !DWC3_VER_IS_WITHIN(DWC3, ANY, 194A)) {

From d58fc9e9c15825e3a8fc1ef3b52495c93c41e71c Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Thu, 9 Sep 2021 12:11:58 +0530
Subject: [PATCH 0519/1750] usb: core: hcd: Add support for deferring roothub
 registration

commit 58877b0824da15698bd85a0a9dbfa8c354e6ecb7 upstream.

It has been observed with certain PCIe USB cards (like Inateck connected
to AM64 EVM or J7200 EVM) that as soon as the primary roothub is
registered, port status change is handled even before xHC is running
leading to cold plug USB devices not detected. For such cases, registering
both the root hubs along with the second HCD is required. Add support for
deferring roothub registration in usb_add_hcd(), so that both primary and
secondary roothubs are registered along with the second HCD.

CC: stable@vger.kernel.org # 5.4+
Suggested-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Tested-by: Chris Chiu <chris.chiu@canonical.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Link: https://lore.kernel.org/r/20210909064200.16216-2-kishon@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hcd.c  | 31 ++++++++++++++++++++++++-------
 include/linux/usb/hcd.h |  2 ++
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 99908d8d2dd3..4bbf3316a9a5 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2640,6 +2640,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
 {
 	int retval;
 	struct usb_device *rhdev;
+	struct usb_hcd *shared_hcd;
 
 	if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
 		hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);
@@ -2796,13 +2797,26 @@ int usb_add_hcd(struct usb_hcd *hcd,
 		goto err_hcd_driver_start;
 	}
 
-	/* starting here, usbcore will pay attention to this root hub */
-	retval = register_root_hub(hcd);
-	if (retval != 0)
-		goto err_register_root_hub;
+	/* starting here, usbcore will pay attention to the shared HCD roothub */
+	shared_hcd = hcd->shared_hcd;
+	if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) {
+		retval = register_root_hub(shared_hcd);
+		if (retval != 0)
+			goto err_register_root_hub;
 
-	if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
-		usb_hcd_poll_rh_status(hcd);
+		if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd))
+			usb_hcd_poll_rh_status(shared_hcd);
+	}
+
+	/* starting here, usbcore will pay attention to this root hub */
+	if (!HCD_DEFER_RH_REGISTER(hcd)) {
+		retval = register_root_hub(hcd);
+		if (retval != 0)
+			goto err_register_root_hub;
+
+		if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
+			usb_hcd_poll_rh_status(hcd);
+	}
 
 	return retval;
 
@@ -2845,6 +2859,7 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);
 void usb_remove_hcd(struct usb_hcd *hcd)
 {
 	struct usb_device *rhdev = hcd->self.root_hub;
+	bool rh_registered;
 
 	dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
 
@@ -2855,6 +2870,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 
 	dev_dbg(hcd->self.controller, "roothub graceful disconnect\n");
 	spin_lock_irq (&hcd_root_hub_lock);
+	rh_registered = hcd->rh_registered;
 	hcd->rh_registered = 0;
 	spin_unlock_irq (&hcd_root_hub_lock);
 
@@ -2864,7 +2880,8 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	cancel_work_sync(&hcd->died_work);
 
 	mutex_lock(&usb_bus_idr_lock);
-	usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
+	if (rh_registered)
+		usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
 	mutex_unlock(&usb_bus_idr_lock);
 
 	/*
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 3dbb42c637c1..9f05016d823f 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -124,6 +124,7 @@ struct usb_hcd {
 #define HCD_FLAG_RH_RUNNING		5	/* root hub is running? */
 #define HCD_FLAG_DEAD			6	/* controller has died? */
 #define HCD_FLAG_INTF_AUTHORIZED	7	/* authorize interfaces? */
+#define HCD_FLAG_DEFER_RH_REGISTER	8	/* Defer roothub registration */
 
 	/* The flags can be tested using these macros; they are likely to
 	 * be slightly faster than test_bit().
@@ -134,6 +135,7 @@ struct usb_hcd {
 #define HCD_WAKEUP_PENDING(hcd)	((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING))
 #define HCD_RH_RUNNING(hcd)	((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING))
 #define HCD_DEAD(hcd)		((hcd)->flags & (1U << HCD_FLAG_DEAD))
+#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER))
 
 	/*
 	 * Specifies if interfaces are authorized by default

From dc131d3f133510e56b8b73f7038fb9b091b71d25 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Fri, 17 Sep 2021 11:18:47 +0200
Subject: [PATCH 0520/1750] USB: serial: mos7840: remove duplicated 0xac24
 device ID

commit 211f323768a25b30c106fd38f15a0f62c7c2b5f4 upstream.

0xac24 device ID is already defined and used via
BANDB_DEVICE_ID_USO9ML2_4.  Remove the duplicate from the list.

Fixes: 27f1281d5f72 ("USB: serial: Extra device/vendor ID for mos7840 driver")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/mos7840.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 30c25ef0dacd..48a9a0476a45 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -107,7 +107,6 @@
 #define BANDB_DEVICE_ID_USOPTL4_2P       0xBC02
 #define BANDB_DEVICE_ID_USOPTL4_4        0xAC44
 #define BANDB_DEVICE_ID_USOPTL4_4P       0xBC03
-#define BANDB_DEVICE_ID_USOPTL2_4        0xAC24
 
 /* Interrupt Routine Defines    */
 
@@ -186,7 +185,6 @@ static const struct usb_device_id id_table[] = {
 	{ USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2P) },
 	{ USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4) },
 	{ USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4P) },
-	{ USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4) },
 	{}			/* terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, id_table);

From 0daf57973ff0a1232197bca0487997774a376216 Mon Sep 17 00:00:00 2001
From: Carlo Lobrano <c.lobrano@gmail.com>
Date: Fri, 3 Sep 2021 14:39:13 +0200
Subject: [PATCH 0521/1750] USB: serial: option: add Telit LN920 compositions

commit 7bb057134d609b9c038a00b6876cf0d37d0118ce upstream.

This patch adds the following Telit LN920 compositions:

0x1060: tty, adb, rmnet, tty, tty, tty, tty
0x1061: tty, adb, mbim, tty, tty, tty, tty
0x1062: rndis, tty, adb, tty, tty, tty, tty
0x1063: tty, adb, ecm, tty, tty, tty, tty

Signed-off-by: Carlo Lobrano <c.lobrano@gmail.com>
Link: https://lore.kernel.org/r/20210903123913.1086513-1-c.lobrano@gmail.com
Reviewed-by: Daniele Palmas <dnlplm@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index acb8eec14f68..e6f89dd4e676 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1205,6 +1205,14 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff),	/* Telit FD980 */
 	  .driver_info = NCTRL(2) | RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff),	/* Telit LN920 (rmnet) */
+	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff),	/* Telit LN920 (MBIM) */
+	  .driver_info = NCTRL(0) | RSVD(1) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1062, 0xff),	/* Telit LN920 (RNDIS) */
+	  .driver_info = NCTRL(2) | RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff),	/* Telit LN920 (ECM) */
+	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),

From 600b19610ad4b68de457e4c55ca709cc7b6afc8a Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Fri, 17 Sep 2021 11:18:48 +0200
Subject: [PATCH 0522/1750] USB: serial: option: remove duplicate USB device ID

commit 1ca200a8c6f079950a04ea3c3380fe8cf78e95a2 upstream.

The device ZTE 0x0094 is already on the list.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Fixes: b9e44fe5ecda ("USB: option: cleanup zte 3g-dongle's pid in option.c")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index e6f89dd4e676..965d694ab036 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1658,7 +1658,6 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff),
 	  .driver_info = RSVD(1) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff),

From 2c28bb016bed842de16a8730bf96a7fe92e2a18f Mon Sep 17 00:00:00 2001
From: Slark Xiao <slark_xiao@163.com>
Date: Fri, 17 Sep 2021 19:01:06 +0800
Subject: [PATCH 0523/1750] USB: serial: option: add device id for Foxconn
 T99W265

commit 9e3eed534f8235a4a596a9dae5b8a6425d81ea1a upstream.

Adding support for Foxconn device T99W265 for enumeration with
PID 0xe0db.

usb-devices output for 0xe0db
T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 19 Spd=5000 MxCh= 0
D:  Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs=  1
P:  Vendor=0489 ProdID=e0db Rev=05.04
S:  Manufacturer=Microsoft
S:  Product=Generic Mobile Broadband Adapter
S:  SerialNumber=6c50f452
C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I:  If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option

if0/1: MBIM, if2:Diag, if3:GNSS, if4: Modem

Signed-off-by: Slark Xiao <slark_xiao@163.com>
Link: https://lore.kernel.org/r/20210917110106.9852-1-slark_xiao@163.com
[ johan: use USB_DEVICE_INTERFACE_CLASS(), amend comment ]
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 965d694ab036..1e990a8264a5 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2075,6 +2075,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
 	{ USB_DEVICE(0x0489, 0xe0b5),						/* Foxconn T77W968 ESIM */
 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff),			/* Foxconn T99W265 MBIM */
+	  .driver_info = RSVD(3) },
 	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
 	{ USB_DEVICE(0x2cb7, 0x0104),						/* Fibocom NL678 series */

From 91e4ad05bf18322b5921d1a6c9b603f6eb1694f0 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 6 Sep 2021 21:35:48 +0900
Subject: [PATCH 0524/1750] mcb: fix error handling in mcb_alloc_bus()

commit 25a1433216489de4abc889910f744e952cb6dbae upstream.

There are two bugs:
1) If ida_simple_get() fails then this code calls put_device(carrier)
   but we haven't yet called get_device(carrier) and probably that
   leads to a use after free.
2) After device_initialize() then we need to use put_device() to
   release the bus.  This will free the internal resources tied to the
   device and call mcb_free_bus() which will free the rest.

Fixes: 5d9e2ab9fea4 ("mcb: Implement bus->dev.release callback")
Fixes: 18d288198099 ("mcb: Correctly initialize the bus's device")
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johannes Thumshirn <jth@kernel.org>
Link: https://lore.kernel.org/r/32e160cf6864ce77f9d62948338e24db9fd8ead9.1630931319.git.johannes.thumshirn@wdc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mcb/mcb-core.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c
index 38fbb3b59873..38cc8340e817 100644
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -277,8 +277,8 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
 
 	bus_nr = ida_simple_get(&mcb_ida, 0, 0, GFP_KERNEL);
 	if (bus_nr < 0) {
-		rc = bus_nr;
-		goto err_free;
+		kfree(bus);
+		return ERR_PTR(bus_nr);
 	}
 
 	bus->bus_nr = bus_nr;
@@ -293,12 +293,12 @@ struct mcb_bus *mcb_alloc_bus(struct device *carrier)
 	dev_set_name(&bus->dev, "mcb:%d", bus_nr);
 	rc = device_add(&bus->dev);
 	if (rc)
-		goto err_free;
+		goto err_put;
 
 	return bus;
-err_free:
-	put_device(carrier);
-	kfree(bus);
+
+err_put:
+	put_device(&bus->dev);
 	return ERR_PTR(rc);
 }
 EXPORT_SYMBOL_NS_GPL(mcb_alloc_bus, MCB);

From 8326be9e51218d23ebe52c8d4c2d7c23302f6e44 Mon Sep 17 00:00:00 2001
From: Gao Xiang <hsiangkao@linux.alibaba.com>
Date: Tue, 21 Sep 2021 22:35:30 +0800
Subject: [PATCH 0525/1750] erofs: fix up erofs_lookup tracepoint

commit 93368aab0efc87288cac65e99c9ed2e0ffc9e7d0 upstream.

Fix up a misuse that the filename pointer isn't always valid in
the ring buffer, and we should copy the content instead.

Link: https://lore.kernel.org/r/20210921143531.81356-1-hsiangkao@linux.alibaba.com
Fixes: 13f06f48f7bf ("staging: erofs: support tracepoint")
Cc: stable@vger.kernel.org # 4.19+
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/trace/events/erofs.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/trace/events/erofs.h b/include/trace/events/erofs.h
index bf9806fd1306..db4f2cec8360 100644
--- a/include/trace/events/erofs.h
+++ b/include/trace/events/erofs.h
@@ -35,20 +35,20 @@ TRACE_EVENT(erofs_lookup,
 	TP_STRUCT__entry(
 		__field(dev_t,		dev	)
 		__field(erofs_nid_t,	nid	)
-		__field(const char *,	name	)
+		__string(name,		dentry->d_name.name	)
 		__field(unsigned int,	flags	)
 	),
 
 	TP_fast_assign(
 		__entry->dev	= dir->i_sb->s_dev;
 		__entry->nid	= EROFS_I(dir)->nid;
-		__entry->name	= dentry->d_name.name;
+		__assign_str(name, dentry->d_name.name);
 		__entry->flags	= flags;
 	),
 
 	TP_printk("dev = (%d,%d), pnid = %llu, name:%s, flags:%x",
 		show_dev_nid(__entry),
-		__entry->name,
+		__get_str(name),
 		__entry->flags)
 );
 

From 80af86c12290e8c567b352f01320b29161b0beaf Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Thu, 16 Sep 2021 20:43:29 +0800
Subject: [PATCH 0526/1750] btrfs: prevent __btrfs_dump_space_info() to
 underflow its free space

commit 0619b7901473c380abc05d45cf9c70bee0707db3 upstream.

It's not uncommon where __btrfs_dump_space_info() gets called
under over-commit situations.

In that case free space would underflow as total allocated space is not
enough to handle all the over-committed space.

Such underflow values can sometimes cause confusion for users enabled
enospc_debug mount option, and takes some seconds for developers to
convert the underflow value to signed result.

Just output the free space as s64 to avoid such problem.

Reported-by: Eli V <eliventer@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/CAJtFHUSy4zgyhf-4d9T+KdJp9w=UgzC2A0V=VtmaeEpcGgm1-Q@mail.gmail.com/
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/space-info.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c
index e8347461c8dd..69ab10c9237f 100644
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -417,9 +417,10 @@ static void __btrfs_dump_space_info(struct btrfs_fs_info *fs_info,
 {
 	lockdep_assert_held(&info->lock);
 
-	btrfs_info(fs_info, "space_info %llu has %llu free, is %sfull",
+	/* The free space could be negative in case of overcommit */
+	btrfs_info(fs_info, "space_info %llu has %lld free, is %sfull",
 		   info->flags,
-		   info->total_bytes - btrfs_space_info_used(info, true),
+		   (s64)(info->total_bytes - btrfs_space_info_used(info, true)),
 		   info->full ? "" : "not ");
 	btrfs_info(fs_info,
 		"space_info total=%llu, used=%llu, pinned=%llu, reserved=%llu, may_use=%llu, readonly=%llu",

From 0ea9ac731a315cd10bd6d6b33817b68ca9111ecf Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Thu, 9 Sep 2021 12:11:59 +0530
Subject: [PATCH 0527/1750] xhci: Set HCD flag to defer primary roothub
 registration

commit b7a0a792f864583207c593b50fd1b752ed89f4c1 upstream.

Set "HCD_FLAG_DEFER_RH_REGISTER" to hcd->flags in xhci_run() to defer
registering primary roothub in usb_add_hcd(). This will make sure both
primary roothub and secondary roothub will be registered along with the
second HCD. This is required for cold plugged USB devices to be detected
in certain PCIe USB cards (like Inateck USB card connected to AM64 EVM
or J7200 EVM).

CC: stable@vger.kernel.org # 5.4+
Suggested-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Tested-by: Chris Chiu <chris.chiu@canonical.com>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Link: https://lore.kernel.org/r/20210909064200.16216-3-kishon@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index c51391b45207..6389dc99bc9a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -693,6 +693,7 @@ int xhci_run(struct usb_hcd *hcd)
 		if (ret)
 			xhci_free_command(xhci, command);
 	}
+	set_bit(HCD_FLAG_DEFER_RH_REGISTER, &hcd->flags);
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
 			"Finished xhci_run for USB2 roothub");
 

From 640946fc56b85c6095295fc8686f8ba18e805dc8 Mon Sep 17 00:00:00 2001
From: Nishanth Menon <nm@ti.com>
Date: Fri, 3 Sep 2021 00:05:50 -0500
Subject: [PATCH 0528/1750] serial: 8250: 8250_omap: Fix RX_LVL register offset

commit 79e9e30a9292a62d25ab75488d3886108db1eaad upstream.

Commit b67e830d38fa ("serial: 8250: 8250_omap: Fix possible interrupt
storm on K3 SoCs") introduced fixup including a register read to
RX_LVL, however, we should be using word offset than byte offset
since our registers are on 4 byte boundary (port.regshift = 2) for
8250_omap.

Fixes: b67e830d38fa ("serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs")
Cc: stable <stable@vger.kernel.org>
Cc: Jan Kiszka <jan.kiszka@siemens.com>
Cc: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Link: https://lore.kernel.org/r/20210903050550.29050-1-nm@ti.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_omap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index efe4cf32add2..537bee8d2258 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -106,7 +106,7 @@
 #define UART_OMAP_EFR2_TIMEOUT_BEHAVE	BIT(6)
 
 /* RX FIFO occupancy indicator */
-#define UART_OMAP_RX_LVL		0x64
+#define UART_OMAP_RX_LVL		0x19
 
 struct omap8250_priv {
 	int line;

From 3dfffcd2602937e569a90539347219fe7a7b3d45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Sat, 11 Sep 2021 15:20:17 +0200
Subject: [PATCH 0529/1750] serial: mvebu-uart: fix driver's tx_empty callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 74e1eb3b4a1ef2e564b4bdeb6e92afe844e900de upstream.

Driver's tx_empty callback should signal when the transmit shift register
is empty. So when the last character has been sent.

STAT_TX_FIFO_EMP bit signals only that HW transmit FIFO is empty, which
happens when the last byte is loaded into transmit shift register.

STAT_TX_EMP bit signals when the both HW transmit FIFO and transmit shift
register are empty.

So replace STAT_TX_FIFO_EMP check by STAT_TX_EMP in mvebu_uart_tx_empty()
callback function.

Fixes: 30530791a7a0 ("serial: mvebu-uart: initial support for Armada-3700 serial port")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/20210911132017.25505-1-pali@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/mvebu-uart.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c
index 1e26220c7852..34ff2181afd1 100644
--- a/drivers/tty/serial/mvebu-uart.c
+++ b/drivers/tty/serial/mvebu-uart.c
@@ -164,7 +164,7 @@ static unsigned int mvebu_uart_tx_empty(struct uart_port *port)
 	st = readl(port->membase + UART_STAT);
 	spin_unlock_irqrestore(&port->lock, flags);
 
-	return (st & STAT_TX_FIFO_EMP) ? TIOCSER_TEMT : 0;
+	return (st & STAT_TX_EMP) ? TIOCSER_TEMT : 0;
 }
 
 static unsigned int mvebu_uart_get_mctrl(struct uart_port *port)

From 7dc9225fcde003a4289ecd4314e3907e877e8c67 Mon Sep 17 00:00:00 2001
From: Naohiro Aota <naohiro.aota@wdc.com>
Date: Mon, 6 Sep 2021 23:06:42 +0900
Subject: [PATCH 0530/1750] scsi: sd_zbc: Ensure buffer size is aligned to
 SECTOR_SIZE

commit 7215e909814fed7cda33c954943a4050d8348204 upstream.

Reporting zones on a SCSI device sometimes fail with the following error:

[76248.516390] ata16.00: invalid transfer count 131328
[76248.523618] sd 15:0:0:0: [sda] REPORT ZONES start lba 536870912 failed

The error (from drivers/ata/libata-scsi.c:ata_scsi_zbc_in_xlat()) indicates
that buffer size is not aligned to SECTOR_SIZE.

This happens when the __vmalloc() failed. Consider we are reporting 4096
zones, then we will have "bufsize = roundup((4096 + 1) * 64,
SECTOR_SIZE)" = (513 * 512) = 262656. Then, __vmalloc() failure halves
the bufsize to 131328, which is no longer aligned to SECTOR_SIZE.

Use rounddown() to ensure the size is always aligned to SECTOR_SIZE and fix
the comment as well.

Link: https://lore.kernel.org/r/20210906140642.2267569-1-naohiro.aota@wdc.com
Fixes: 23a50861adda ("scsi: sd_zbc: Cleanup sd_zbc_alloc_report_buffer()")
Cc: stable@vger.kernel.org # 5.5+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/sd_zbc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c
index 87a7274e4632..01088f333dbc 100644
--- a/drivers/scsi/sd_zbc.c
+++ b/drivers/scsi/sd_zbc.c
@@ -155,8 +155,8 @@ static void *sd_zbc_alloc_report_buffer(struct scsi_disk *sdkp,
 
 	/*
 	 * Report zone buffer size should be at most 64B times the number of
-	 * zones requested plus the 64B reply header, but should be at least
-	 * SECTOR_SIZE for ATA devices.
+	 * zones requested plus the 64B reply header, but should be aligned
+	 * to SECTOR_SIZE for ATA devices.
 	 * Make sure that this size does not exceed the hardware capabilities.
 	 * Furthermore, since the report zone command cannot be split, make
 	 * sure that the allocated buffer can always be mapped by limiting the
@@ -175,7 +175,7 @@ static void *sd_zbc_alloc_report_buffer(struct scsi_disk *sdkp,
 			*buflen = bufsize;
 			return buf;
 		}
-		bufsize >>= 1;
+		bufsize = rounddown(bufsize >> 1, SECTOR_SIZE);
 	}
 
 	return NULL;

From 68d4fbe6220cd1f3d07cab0a4901e62f8c12cc68 Mon Sep 17 00:00:00 2001
From: Lijo Lazar <lijo.lazar@amd.com>
Date: Thu, 23 Sep 2021 11:58:43 +0800
Subject: [PATCH 0531/1750] drm/amd/pm: Update intermediate power state for SI

commit ab39d3cef526ba09c4c6923b4cd7e6ec1c5d4faa upstream.

Update the current state as boot state during dpm initialization.
During the subsequent initialization, set_power_state gets called to
transition to the final power state. set_power_state refers to values
from the current state and without current state populated, it could
result in NULL pointer dereference.

For ex: on platforms where PCI speed change is supported through ACPI
ATCS method, the link speed of current state needs to be queried before
deciding on changing to final power state's link speed. The logic to query
ATCS-support was broken on certain platforms. The issue became visible
when broken ATCS-support logic got fixed with commit
f9b7f3703ff9 ("drm/amdgpu/acpi: make ATPX/ATCS structures global (v2)").

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1698

Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
index b5986d19dc08..a1e7ba5995c5 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
@@ -6870,6 +6870,8 @@ static int si_dpm_enable(struct amdgpu_device *adev)
 	si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true);
 	si_thermal_start_thermal_controller(adev);
 
+	ni_update_current_ps(adev, boot_ps);
+
 	return 0;
 }
 

From 43241a6c6e6c7426fdb92454f9bbc66390d292d7 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 17 Sep 2021 12:12:04 +0200
Subject: [PATCH 0532/1750] net: hso: fix muxed tty registration

commit e8f69b16ee776da88589b5271e3f46020efc8f6c upstream.

If resource allocation and registration fail for a muxed tty device
(e.g. if there are no more minor numbers) the driver should not try to
deregister the never-registered (or already-deregistered) tty.

Fix up the error handling to avoid dereferencing a NULL pointer when
attempting to remove the character device.

Fixes: 72dc1c096c70 ("HSO: add option hso driver")
Cc: stable@vger.kernel.org	# 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/hso.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index f269337c82c5..df8d4c1e5be7 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2721,14 +2721,14 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
 
 	serial = kzalloc(sizeof(*serial), GFP_KERNEL);
 	if (!serial)
-		goto exit;
+		goto err_free_dev;
 
 	hso_dev->port_data.dev_serial = serial;
 	serial->parent = hso_dev;
 
 	if (hso_serial_common_create
 	    (serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE))
-		goto exit;
+		goto err_free_serial;
 
 	serial->tx_data_length--;
 	serial->write_data = hso_mux_serial_write_data;
@@ -2744,11 +2744,9 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface,
 	/* done, return it */
 	return hso_dev;
 
-exit:
-	if (serial) {
-		tty_unregister_device(tty_drv, serial->minor);
-		kfree(serial);
-	}
+err_free_serial:
+	kfree(serial);
+err_free_dev:
 	kfree(hso_dev);
 	return NULL;
 

From 8d6a21e4cd6a319b0662cbe4ad6199e276ac776a Mon Sep 17 00:00:00 2001
From: Ian Abbott <abbotti@mev.co.uk>
Date: Thu, 16 Sep 2021 15:50:23 +0100
Subject: [PATCH 0533/1750] comedi: Fix memory leak in compat_insnlist()

commit bb509a6ffed2c8b0950f637ab5779aa818ed1596 upstream.

`compat_insnlist()` handles the 32-bit version of the `COMEDI_INSNLIST`
ioctl (whenwhen `CONFIG_COMPAT` is enabled).  It allocates memory to
temporarily hold an array of `struct comedi_insn` converted from the
32-bit version in user space.  This memory is only being freed if there
is a fault while filling the array, otherwise it is leaked.

Add a call to `kfree()` to fix the leak.

Fixes: b8d47d881305 ("comedi: get rid of compat_alloc_user_space() mess in COMEDI_INSNLIST compat")
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-staging@lists.linux.dev
Cc: <stable@vger.kernel.org> # 5.13+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20210916145023.157479-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/comedi_fops.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index 80d74cce2a01..9858fae816f7 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -3090,6 +3090,7 @@ static int compat_insnlist(struct file *file, unsigned long arg)
 	mutex_lock(&dev->mutex);
 	rc = do_insnlist_ioctl(dev, insns, insnlist32.n_insns, file);
 	mutex_unlock(&dev->mutex);
+	kfree(insns);
 	return rc;
 }
 

From 55352944b497ba567e4e5ed5c9bd0927c3f3542d Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Wed, 1 Sep 2021 18:11:33 +0100
Subject: [PATCH 0534/1750] afs: Fix incorrect triggering of sillyrename on
 3rd-party invalidation

[ Upstream commit 63d49d843ef5fffeea069e0ffdfbd2bf40ba01c6 ]

The AFS filesystem is currently triggering the silly-rename cleanup from
afs_d_revalidate() when it sees that a dentry has been changed by a third
party[1].  It should not be doing this as the cleanup includes deleting the
silly-rename target file on iput.

Fix this by removing the places in the d_revalidate handling that validate
anything other than the directory and the dirent.  It probably should not
be looking to validate the target inode of the dentry also.

This includes removing the point in afs_d_revalidate() where the inode that
a dentry used to point to was marked as being deleted (AFS_VNODE_DELETED).
We don't know it got deleted.  It could have been renamed or it could have
hard links remaining.

This was reproduced by cloning a git repo onto an afs volume on one
machine, switching to another machine and doing "git status", then
switching back to the first and doing "git status".  The second status
would show weird output due to ".git/index" getting deleted by the above
mentioned mechanism.

A simpler way to do it is to do:

	machine 1: touch a
	machine 2: touch b; mv -f b a
	machine 1: stat a

on an afs volume.  The bug shows up as the stat failing with ENOENT and the
file server log showing that machine 1 deleted "a".

Fixes: 79ddbfa500b3 ("afs: Implement sillyrename for unlink and rename")
Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
cc: linux-afs@lists.infradead.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=214217#c4 [1]
Link: https://lore.kernel.org/r/163111668100.283156.3851669884664475428.stgit@warthog.procyon.org.uk/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/dir.c | 46 +++++++---------------------------------------
 1 file changed, 7 insertions(+), 39 deletions(-)

diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 92d7fd7436cb..262c0ae505af 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -997,9 +997,9 @@ static struct dentry *afs_lookup(struct inode *dir, struct dentry *dentry,
  */
 static int afs_d_revalidate_rcu(struct dentry *dentry)
 {
-	struct afs_vnode *dvnode, *vnode;
+	struct afs_vnode *dvnode;
 	struct dentry *parent;
-	struct inode *dir, *inode;
+	struct inode *dir;
 	long dir_version, de_version;
 
 	_enter("%p", dentry);
@@ -1029,18 +1029,6 @@ static int afs_d_revalidate_rcu(struct dentry *dentry)
 			return -ECHILD;
 	}
 
-	/* Check to see if the vnode referred to by the dentry still
-	 * has a callback.
-	 */
-	if (d_really_is_positive(dentry)) {
-		inode = d_inode_rcu(dentry);
-		if (inode) {
-			vnode = AFS_FS_I(inode);
-			if (!afs_check_validity(vnode))
-				return -ECHILD;
-		}
-	}
-
 	return 1; /* Still valid */
 }
 
@@ -1076,17 +1064,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 	if (IS_ERR(key))
 		key = NULL;
 
-	if (d_really_is_positive(dentry)) {
-		inode = d_inode(dentry);
-		if (inode) {
-			vnode = AFS_FS_I(inode);
-			afs_validate(vnode, key);
-			if (test_bit(AFS_VNODE_DELETED, &vnode->flags))
-				goto out_bad;
-		}
-	}
-
-	/* lock down the parent dentry so we can peer at it */
+	/* Hold the parent dentry so we can peer at it */
 	parent = dget_parent(dentry);
 	dir = AFS_FS_I(d_inode(parent));
 
@@ -1095,7 +1073,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 
 	if (test_bit(AFS_VNODE_DELETED, &dir->flags)) {
 		_debug("%pd: parent dir deleted", dentry);
-		goto out_bad_parent;
+		goto not_found;
 	}
 
 	/* We only need to invalidate a dentry if the server's copy changed
@@ -1121,12 +1099,12 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 	case 0:
 		/* the filename maps to something */
 		if (d_really_is_negative(dentry))
-			goto out_bad_parent;
+			goto not_found;
 		inode = d_inode(dentry);
 		if (is_bad_inode(inode)) {
 			printk("kAFS: afs_d_revalidate: %pd2 has bad inode\n",
 			       dentry);
-			goto out_bad_parent;
+			goto not_found;
 		}
 
 		vnode = AFS_FS_I(inode);
@@ -1148,9 +1126,6 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 			       dentry, fid.unique,
 			       vnode->fid.unique,
 			       vnode->vfs_inode.i_generation);
-			write_seqlock(&vnode->cb_lock);
-			set_bit(AFS_VNODE_DELETED, &vnode->flags);
-			write_sequnlock(&vnode->cb_lock);
 			goto not_found;
 		}
 		goto out_valid;
@@ -1165,7 +1140,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 	default:
 		_debug("failed to iterate dir %pd: %d",
 		       parent, ret);
-		goto out_bad_parent;
+		goto not_found;
 	}
 
 out_valid:
@@ -1176,16 +1151,9 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags)
 	_leave(" = 1 [valid]");
 	return 1;
 
-	/* the dirent, if it exists, now points to a different vnode */
 not_found:
-	spin_lock(&dentry->d_lock);
-	dentry->d_flags |= DCACHE_NFSFS_RENAMED;
-	spin_unlock(&dentry->d_lock);
-
-out_bad_parent:
 	_debug("dropping dentry %pd2", dentry);
 	dput(parent);
-out_bad:
 	key_put(key);
 
 	_leave(" = 0 [bad]");

From 22538c1bde2793ffeac21c8bc5c22832ed838d29 Mon Sep 17 00:00:00 2001
From: David Howells <dhowells@redhat.com>
Date: Wed, 8 Sep 2021 21:55:19 +0100
Subject: [PATCH 0535/1750] afs: Fix updating of i_blocks on file/dir extension

[ Upstream commit 9d37e1cab2a9d2cee2737973fa455e6f89eee46a ]

When an afs file or directory is modified locally such that the total file
size is extended, i_blocks needs to be recalculated too.

Fix this by making afs_write_end() and afs_edit_dir_add() call
afs_set_i_size() rather than setting inode->i_size directly as that also
recalculates inode->i_blocks.

This can be tested by creating and writing into directories and files and
then examining them with du.  Without this change, directories show a 4
blocks (they start out at 2048 bytes) and files show 0 blocks; with this
change, they should show a number of blocks proportional to the file size
rounded up to 1024.

Fixes: 31143d5d515e ("AFS: implement basic file write support")
Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...")
Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/r/163113612442.352844.11162345591911691150.stgit@warthog.procyon.org.uk/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/afs/dir_edit.c |  4 ++--
 fs/afs/inode.c    | 10 ----------
 fs/afs/internal.h | 10 ++++++++++
 fs/afs/write.c    |  2 +-
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c
index 2ffe09abae7f..3a9cffc081b9 100644
--- a/fs/afs/dir_edit.c
+++ b/fs/afs/dir_edit.c
@@ -264,7 +264,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode,
 		if (b == nr_blocks) {
 			_debug("init %u", b);
 			afs_edit_init_block(meta, block, b);
-			i_size_write(&vnode->vfs_inode, (b + 1) * AFS_DIR_BLOCK_SIZE);
+			afs_set_i_size(vnode, (b + 1) * AFS_DIR_BLOCK_SIZE);
 		}
 
 		/* Only lower dir pages have a counter in the header. */
@@ -297,7 +297,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode,
 new_directory:
 	afs_edit_init_block(meta, meta, 0);
 	i_size = AFS_DIR_BLOCK_SIZE;
-	i_size_write(&vnode->vfs_inode, i_size);
+	afs_set_i_size(vnode, i_size);
 	slot = AFS_DIR_RESV_BLOCKS0;
 	page = page0;
 	block = meta;
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index ae3016a9fb23..f81a972bdd29 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -53,16 +53,6 @@ static noinline void dump_vnode(struct afs_vnode *vnode, struct afs_vnode *paren
 		dump_stack();
 }
 
-/*
- * Set the file size and block count.  Estimate the number of 512 bytes blocks
- * used, rounded up to nearest 1K for consistency with other AFS clients.
- */
-static void afs_set_i_size(struct afs_vnode *vnode, u64 size)
-{
-	i_size_write(&vnode->vfs_inode, size);
-	vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1;
-}
-
 /*
  * Initialise an inode from the vnode status.
  */
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index ffe318ad2e02..dc08a3d9b3a8 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -1573,6 +1573,16 @@ static inline void afs_update_dentry_version(struct afs_operation *op,
 			(void *)(unsigned long)dir_vp->scb.status.data_version;
 }
 
+/*
+ * Set the file size and block count.  Estimate the number of 512 bytes blocks
+ * used, rounded up to nearest 1K for consistency with other AFS clients.
+ */
+static inline void afs_set_i_size(struct afs_vnode *vnode, u64 size)
+{
+	i_size_write(&vnode->vfs_inode, size);
+	vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1;
+}
+
 /*
  * Check for a conflicting operation on a directory that we just unlinked from.
  * If someone managed to sneak a link or an unlink in on the file we just
diff --git a/fs/afs/write.c b/fs/afs/write.c
index d37b5cfcf28f..be60cf110382 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -184,7 +184,7 @@ int afs_write_end(struct file *file, struct address_space *mapping,
 		write_seqlock(&vnode->cb_lock);
 		i_size = i_size_read(&vnode->vfs_inode);
 		if (maybe_i_size > i_size)
-			i_size_write(&vnode->vfs_inode, maybe_i_size);
+			afs_set_i_size(vnode, maybe_i_size);
 		write_sequnlock(&vnode->cb_lock);
 	}
 

From 117661cb9d3aea3cbd6a36b77e3427fcf484e215 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Fri, 27 Aug 2021 17:53:10 +0300
Subject: [PATCH 0536/1750] platform/x86/intel: punit_ipc: Drop wrong use of
 ACPI_PTR()

[ Upstream commit 349bff48ae0f5f8aa2075d0bdc2091a30bd634f6 ]

ACPI_PTR() is more harmful than helpful. For example, in this case
if CONFIG_ACPI=n, the ID table left unused which is not what we want.

Instead of adding ifdeffery here and there, drop ACPI_PTR()
and unused acpi.h.

Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210827145310.76239-1-andriy.shevchenko@linux.intel.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel_punit_ipc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
index f58b8543f6ac..66bb39fd0ef9 100644
--- a/drivers/platform/x86/intel_punit_ipc.c
+++ b/drivers/platform/x86/intel_punit_ipc.c
@@ -8,7 +8,6 @@
  * which provide mailbox interface for power management usage.
  */
 
-#include <linux/acpi.h>
 #include <linux/bitops.h>
 #include <linux/delay.h>
 #include <linux/device.h>
@@ -319,7 +318,7 @@ static struct platform_driver intel_punit_ipc_driver = {
 	.remove = intel_punit_ipc_remove,
 	.driver = {
 		.name = "intel_punit_ipc",
-		.acpi_match_table = ACPI_PTR(punit_ipc_acpi_ids),
+		.acpi_match_table = punit_ipc_acpi_ids,
 	},
 };
 

From 6c3f1b741c6c2914ea120e3a5790d3e900152f7b Mon Sep 17 00:00:00 2001
From: Claudiu Manoil <claudiu.manoil@nxp.com>
Date: Fri, 17 Sep 2021 13:22:05 +0300
Subject: [PATCH 0537/1750] enetc: Fix illegal access when reading
 affinity_hint

[ Upstream commit 7237a494decfa17d0b9d0076e6cee3235719de90 ]

irq_set_affinity_hit() stores a reference to the cpumask_t
parameter in the irq descriptor, and that reference can be
accessed later from irq_affinity_hint_proc_show(). Since
the cpu_mask parameter passed to irq_set_affinity_hit() has
only temporary storage (it's on the stack memory), later
accesses to it are illegal. Thus reads from the corresponding
procfs affinity_hint file can result in paging request oops.

The issue is fixed by the get_cpu_mask() helper, which provides
a permanent storage for the cpumask_t parameter.

Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/enetc/enetc.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
index df4a858c8001..6877f8e2047b 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -1320,7 +1320,6 @@ static void enetc_clear_bdrs(struct enetc_ndev_priv *priv)
 static int enetc_setup_irqs(struct enetc_ndev_priv *priv)
 {
 	struct pci_dev *pdev = priv->si->pdev;
-	cpumask_t cpu_mask;
 	int i, j, err;
 
 	for (i = 0; i < priv->bdr_int_num; i++) {
@@ -1349,9 +1348,7 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv)
 
 			enetc_wr(hw, ENETC_SIMSITRV(idx), entry);
 		}
-		cpumask_clear(&cpu_mask);
-		cpumask_set_cpu(i % num_online_cpus(), &cpu_mask);
-		irq_set_affinity_hint(irq, &cpu_mask);
+		irq_set_affinity_hint(irq, get_cpu_mask(i % num_online_cpus()));
 	}
 
 	return 0;

From d5afe3cf52e5e18cee85e316e30f9c6621f5fbd5 Mon Sep 17 00:00:00 2001
From: Claudiu Manoil <claudiu.manoil@nxp.com>
Date: Fri, 17 Sep 2021 13:22:06 +0300
Subject: [PATCH 0538/1750] enetc: Fix uninitialized struct dim_sample field
 usage

[ Upstream commit 9f7afa05c9522b086327929ae622facab0f0f72b ]

The only struct dim_sample member that does not get
initialized by dim_update_sample() is comp_ctr. (There
is special API to initialize comp_ctr:
dim_update_sample_with_comps(), and it is currently used
only for RDMA.) comp_ctr is used to compute curr_stats->cmps
and curr_stats->cpe_ratio (see dim_calc_stats()) which in
turn are consumed by the rdma_dim_*() API.  Therefore,
functionally, the net_dim*() API consumers are not affected.
Nevertheless, fix the computation of statistics based
on an uninitialized variable, even if the mentioned statistics
are not used at the moment.

Fixes: ae0e6a5d1627 ("enetc: Add adaptive interrupt coalescing")
Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/enetc/enetc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c
index 6877f8e2047b..15aa3b3c0089 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc.c
@@ -299,7 +299,7 @@ static void enetc_rx_dim_work(struct work_struct *w)
 
 static void enetc_rx_net_dim(struct enetc_int_vector *v)
 {
-	struct dim_sample dim_sample;
+	struct dim_sample dim_sample = {};
 
 	v->comp_cnt++;
 

From 1365a0dc55962f87855dfee2c18abfd6f33bb927 Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Mon, 20 Sep 2021 02:51:52 -0400
Subject: [PATCH 0539/1750] bnxt_en: Fix TX timeout when TX ring size is set to
 the smallest

[ Upstream commit 5bed8b0704c9ecccc8f4a2c377d7c8e21090a82e ]

The smallest TX ring size we support must fit a TX SKB with MAX_SKB_FRAGS
+ 1.  Because the first TX BD for a packet is always a long TX BD, we
need an extra TX BD to fit this packet.  Define BNXT_MIN_TX_DESC_CNT with
this value to make this more clear.  The current code uses a minimum
that is off by 1.  Fix it using this constant.

The tx_wake_thresh to determine when to wake up the TX queue is half the
ring size but we must have at least BNXT_MIN_TX_DESC_CNT for the next
packet which may have maximum fragments.  So the comparison of the
available TX BDs with tx_wake_thresh should be >= instead of > in the
current code.  Otherwise, at the smallest ring size, we will never wake
up the TX queue and will cause TX timeout.

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadocm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c         | 8 ++++----
 drivers/net/ethernet/broadcom/bnxt/bnxt.h         | 5 +++++
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 26179e437bbf..cb0c270418a4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -381,7 +381,7 @@ static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp,
 	 * netif_tx_queue_stopped().
 	 */
 	smp_mb();
-	if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) {
+	if (bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh) {
 		netif_tx_wake_queue(txq);
 		return false;
 	}
@@ -717,7 +717,7 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)
 	smp_mb();
 
 	if (unlikely(netif_tx_queue_stopped(txq)) &&
-	    bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh &&
+	    bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh &&
 	    READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING)
 		netif_tx_wake_queue(txq);
 }
@@ -2300,7 +2300,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr,
 		if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) {
 			tx_pkts++;
 			/* return full budget so NAPI will complete. */
-			if (unlikely(tx_pkts > bp->tx_wake_thresh)) {
+			if (unlikely(tx_pkts >= bp->tx_wake_thresh)) {
 				rx_pkts = budget;
 				raw_cons = NEXT_RAW_CMP(raw_cons);
 				if (budget)
@@ -3431,7 +3431,7 @@ static int bnxt_init_tx_rings(struct bnxt *bp)
 	u16 i;
 
 	bp->tx_wake_thresh = max_t(int, bp->tx_ring_size / 2,
-				   MAX_SKB_FRAGS + 1);
+				   BNXT_MIN_TX_DESC_CNT);
 
 	for (i = 0; i < bp->tx_nr_rings; i++) {
 		struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
index 95d10e7bbb04..92f9f7f5240b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
@@ -611,6 +611,11 @@ struct nqe_cn {
 #define BNXT_MAX_RX_JUM_DESC_CNT	(RX_DESC_CNT * MAX_RX_AGG_PAGES - 1)
 #define BNXT_MAX_TX_DESC_CNT		(TX_DESC_CNT * MAX_TX_PAGES - 1)
 
+/* Minimum TX BDs for a TX packet with MAX_SKB_FRAGS + 1.  We need one extra
+ * BD because the first TX BD is always a long BD.
+ */
+#define BNXT_MIN_TX_DESC_CNT		(MAX_SKB_FRAGS + 2)
+
 #define RX_RING(x)	(((x) & ~(RX_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4))
 #define RX_IDX(x)	((x) & (RX_DESC_CNT - 1))
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
index 1471c9a36238..6f9196ff2ac4 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -780,7 +780,7 @@ static int bnxt_set_ringparam(struct net_device *dev,
 
 	if ((ering->rx_pending > BNXT_MAX_RX_DESC_CNT) ||
 	    (ering->tx_pending > BNXT_MAX_TX_DESC_CNT) ||
-	    (ering->tx_pending <= MAX_SKB_FRAGS))
+	    (ering->tx_pending < BNXT_MIN_TX_DESC_CNT))
 		return -EINVAL;
 
 	if (netif_running(dev))

From ca435999bcaf572a85b369a13982928c7ca2e335 Mon Sep 17 00:00:00 2001
From: Jian Shen <shenjian15@huawei.com>
Date: Wed, 15 Sep 2021 21:52:06 +0800
Subject: [PATCH 0540/1750] net: hns3: fix change RSS 'hfunc' ineffective issue

[ Upstream commit e184cec5e29d8eb3c3435b12a9074b75e2d69e4a ]

When user change rss 'hfunc' without set rss 'hkey' by ethtool
-X command, the driver will ignore the 'hfunc' for the hkey is
NULL. It's unreasonable. So fix it.

Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support")
Fixes: 374ad291762a ("net: hns3: Add RSS general configuration support for VF")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../hisilicon/hns3/hns3pf/hclge_main.c        | 45 ++++++++++------
 .../hisilicon/hns3/hns3vf/hclgevf_main.c      | 52 ++++++++++++-------
 2 files changed, 64 insertions(+), 33 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 59ec538eba1f..24357e907155 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -4377,6 +4377,24 @@ static int hclge_get_rss(struct hnae3_handle *handle, u32 *indir,
 	return 0;
 }
 
+static int hclge_parse_rss_hfunc(struct hclge_vport *vport, const u8 hfunc,
+				 u8 *hash_algo)
+{
+	switch (hfunc) {
+	case ETH_RSS_HASH_TOP:
+		*hash_algo = HCLGE_RSS_HASH_ALGO_TOEPLITZ;
+		return 0;
+	case ETH_RSS_HASH_XOR:
+		*hash_algo = HCLGE_RSS_HASH_ALGO_SIMPLE;
+		return 0;
+	case ETH_RSS_HASH_NO_CHANGE:
+		*hash_algo = vport->rss_algo;
+		return 0;
+	default:
+		return -EINVAL;
+	}
+}
+
 static int hclge_set_rss(struct hnae3_handle *handle, const u32 *indir,
 			 const  u8 *key, const  u8 hfunc)
 {
@@ -4385,30 +4403,27 @@ static int hclge_set_rss(struct hnae3_handle *handle, const u32 *indir,
 	u8 hash_algo;
 	int ret, i;
 
+	ret = hclge_parse_rss_hfunc(vport, hfunc, &hash_algo);
+	if (ret) {
+		dev_err(&hdev->pdev->dev, "invalid hfunc type %u\n", hfunc);
+		return ret;
+	}
+
 	/* Set the RSS Hash Key if specififed by the user */
 	if (key) {
-		switch (hfunc) {
-		case ETH_RSS_HASH_TOP:
-			hash_algo = HCLGE_RSS_HASH_ALGO_TOEPLITZ;
-			break;
-		case ETH_RSS_HASH_XOR:
-			hash_algo = HCLGE_RSS_HASH_ALGO_SIMPLE;
-			break;
-		case ETH_RSS_HASH_NO_CHANGE:
-			hash_algo = vport->rss_algo;
-			break;
-		default:
-			return -EINVAL;
-		}
-
 		ret = hclge_set_rss_algo_key(hdev, hash_algo, key);
 		if (ret)
 			return ret;
 
 		/* Update the shadow RSS key with user specified qids */
 		memcpy(vport->rss_hash_key, key, HCLGE_RSS_KEY_SIZE);
-		vport->rss_algo = hash_algo;
+	} else {
+		ret = hclge_set_rss_algo_key(hdev, hash_algo,
+					     vport->rss_hash_key);
+		if (ret)
+			return ret;
 	}
+	vport->rss_algo = hash_algo;
 
 	/* Update the shadow RSS table with user specified qids */
 	for (i = 0; i < HCLGE_RSS_IND_TBL_SIZE; i++)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index 447457cacf97..3641d7c31451 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -785,40 +785,56 @@ static int hclgevf_get_rss(struct hnae3_handle *handle, u32 *indir, u8 *key,
 	return 0;
 }
 
+static int hclgevf_parse_rss_hfunc(struct hclgevf_dev *hdev, const u8 hfunc,
+				   u8 *hash_algo)
+{
+	switch (hfunc) {
+	case ETH_RSS_HASH_TOP:
+		*hash_algo = HCLGEVF_RSS_HASH_ALGO_TOEPLITZ;
+		return 0;
+	case ETH_RSS_HASH_XOR:
+		*hash_algo = HCLGEVF_RSS_HASH_ALGO_SIMPLE;
+		return 0;
+	case ETH_RSS_HASH_NO_CHANGE:
+		*hash_algo = hdev->rss_cfg.hash_algo;
+		return 0;
+	default:
+		return -EINVAL;
+	}
+}
+
 static int hclgevf_set_rss(struct hnae3_handle *handle, const u32 *indir,
 			   const u8 *key, const u8 hfunc)
 {
 	struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
 	struct hclgevf_rss_cfg *rss_cfg = &hdev->rss_cfg;
+	u8 hash_algo;
 	int ret, i;
 
 	if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) {
+		ret = hclgevf_parse_rss_hfunc(hdev, hfunc, &hash_algo);
+		if (ret)
+			return ret;
+
 		/* Set the RSS Hash Key if specififed by the user */
 		if (key) {
-			switch (hfunc) {
-			case ETH_RSS_HASH_TOP:
-				rss_cfg->hash_algo =
-					HCLGEVF_RSS_HASH_ALGO_TOEPLITZ;
-				break;
-			case ETH_RSS_HASH_XOR:
-				rss_cfg->hash_algo =
-					HCLGEVF_RSS_HASH_ALGO_SIMPLE;
-				break;
-			case ETH_RSS_HASH_NO_CHANGE:
-				break;
-			default:
-				return -EINVAL;
-			}
-
-			ret = hclgevf_set_rss_algo_key(hdev, rss_cfg->hash_algo,
-						       key);
-			if (ret)
+			ret = hclgevf_set_rss_algo_key(hdev, hash_algo, key);
+			if (ret) {
+				dev_err(&hdev->pdev->dev,
+					"invalid hfunc type %u\n", hfunc);
 				return ret;
+			}
 
 			/* Update the shadow RSS key with user specified qids */
 			memcpy(rss_cfg->rss_hash_key, key,
 			       HCLGEVF_RSS_KEY_SIZE);
+		} else {
+			ret = hclgevf_set_rss_algo_key(hdev, hash_algo,
+						       rss_cfg->rss_hash_key);
+			if (ret)
+				return ret;
 		}
+		rss_cfg->hash_algo = hash_algo;
 	}
 
 	/* update the shadow RSS table with user specified qids */

From 4e0fd1d79534f830e247f85db0f0531fcd9d3f82 Mon Sep 17 00:00:00 2001
From: Yufeng Mo <moyufeng@huawei.com>
Date: Wed, 15 Sep 2021 21:52:09 +0800
Subject: [PATCH 0541/1750] net: hns3: check queue id range before using

[ Upstream commit 63b1279d9905100a14da9e043de7b28e99dba3f8 ]

The input parameters may not be reliable. Before using the
queue id, we should check this parameter. Otherwise, memory
overwriting may occur.

Fixes: d34100184685 ("net: hns3: refactor the mailbox message between PF and VF")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index ff9d84a7147f..5d3996767256 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -581,9 +581,17 @@ static void hclge_get_queue_id_in_pf(struct hclge_vport *vport,
 				     struct hclge_mbx_vf_to_pf_cmd *mbx_req,
 				     struct hclge_respond_to_vf_msg *resp_msg)
 {
+	struct hnae3_handle *handle = &vport->nic;
+	struct hclge_dev *hdev = vport->back;
 	u16 queue_id, qid_in_pf;
 
 	memcpy(&queue_id, mbx_req->msg.data, sizeof(queue_id));
+	if (queue_id >= handle->kinfo.num_tqps) {
+		dev_err(&hdev->pdev->dev, "Invalid queue id(%u) from VF %u\n",
+			queue_id, mbx_req->mbx_src_vfid);
+		return;
+	}
+
 	qid_in_pf = hclge_covert_handle_qid_global(&vport->nic, queue_id);
 	memcpy(resp_msg->data, &qid_in_pf, sizeof(qid_in_pf));
 	resp_msg->len = sizeof(qid_in_pf);

From 8a00c832ef88651a876546be1da7bf3a6334e860 Mon Sep 17 00:00:00 2001
From: Karsten Graul <kgraul@linux.ibm.com>
Date: Mon, 20 Sep 2021 21:18:14 +0200
Subject: [PATCH 0542/1750] net/smc: add missing error check in
 smc_clc_prfx_set()

[ Upstream commit 6c90731980655280ea07ce4b21eb97457bf86286 ]

Coverity stumbled over a missing error check in smc_clc_prfx_set():

*** CID 1475954:  Error handling issues  (CHECKED_RETURN)
/net/smc/smc_clc.c: 233 in smc_clc_prfx_set()
>>>     CID 1475954:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "kernel_getsockname" without checking return value (as is done elsewhere 8 out of 10 times).
233     	kernel_getsockname(clcsock, (struct sockaddr *)&addrs);

Add the return code check in smc_clc_prfx_set().

Fixes: c246d942eabc ("net/smc: restructure netinfo for CLC proposal msgs")
Reported-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_clc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 696d89c2dce4..5ee5b2ce29a6 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -230,7 +230,8 @@ static int smc_clc_prfx_set(struct socket *clcsock,
 		goto out_rel;
 	}
 	/* get address to which the internal TCP socket is bound */
-	kernel_getsockname(clcsock, (struct sockaddr *)&addrs);
+	if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0)
+		goto out_rel;
 	/* analyze IP specific data of net_device belonging to TCP socket */
 	addr6 = (struct sockaddr_in6 *)&addrs;
 	rcu_read_lock();

From b4561bd29e62b24b245a53391e64b6880f0792cc Mon Sep 17 00:00:00 2001
From: Karsten Graul <kgraul@linux.ibm.com>
Date: Mon, 20 Sep 2021 21:18:15 +0200
Subject: [PATCH 0543/1750] net/smc: fix 'workqueue leaked lock' in
 smc_conn_abort_work

[ Upstream commit a18cee4791b1123d0a6579a7c89f4b87e48abe03 ]

The abort_work is scheduled when a connection was detected to be
out-of-sync after a link failure. The work calls smc_conn_kill(),
which calls smc_close_active_abort() and that might end up calling
smc_close_cancel_work().
smc_close_cancel_work() cancels any pending close_work and tx_work but
needs to release the sock_lock before and acquires the sock_lock again
afterwards. So when the sock_lock was NOT acquired before then it may
be held after the abort_work completes. Thats why the sock_lock is
acquired before the call to smc_conn_kill() in __smc_lgr_terminate(),
but this is missing in smc_conn_abort_work().

Fix that by acquiring the sock_lock first and release it after the
call to smc_conn_kill().

Fixes: b286a0651e44 ("net/smc: handle incoming CDC validation message")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index af96f813c075..c491dd8e67cd 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1089,7 +1089,9 @@ static void smc_conn_abort_work(struct work_struct *work)
 						   abort_work);
 	struct smc_sock *smc = container_of(conn, struct smc_sock, conn);
 
+	lock_sock(&smc->sk);
 	smc_conn_kill(conn, true);
+	release_sock(&smc->sk);
 	sock_put(&smc->sk); /* sock_hold done by schedulers of abort_work */
 }
 

From 43c880b860c7a7dbc8361e2e4a124cd5337d4c5f Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Tue, 21 Sep 2021 00:42:08 +0300
Subject: [PATCH 0544/1750] net: dsa: don't allocate the slave_mii_bus using
 devres

[ Upstream commit 5135e96a3dd2f4555ae6981c3155a62bcf3227f6 ]

The Linux device model permits both the ->shutdown and ->remove driver
methods to get called during a shutdown procedure. Example: a DSA switch
which sits on an SPI bus, and the SPI bus driver calls this on its
->shutdown method:

spi_unregister_controller
-> device_for_each_child(&ctlr->dev, NULL, __unregister);
   -> spi_unregister_device(to_spi_device(dev));
      -> device_del(&spi->dev);

So this is a simple pattern which can theoretically appear on any bus,
although the only other buses on which I've been able to find it are
I2C:

i2c_del_adapter
-> device_for_each_child(&adap->dev, NULL, __unregister_client);
   -> i2c_unregister_device(client);
      -> device_unregister(&client->dev);

The implication of this pattern is that devices on these buses can be
unregistered after having been shut down. The drivers for these devices
might choose to return early either from ->remove or ->shutdown if the
other callback has already run once, and they might choose that the
->shutdown method should only perform a subset of the teardown done by
->remove (to avoid unnecessary delays when rebooting).

So in other words, the device driver may choose on ->remove to not
do anything (therefore to not unregister an MDIO bus it has registered
on ->probe), because this ->remove is actually triggered by the
device_shutdown path, and its ->shutdown method has already run and done
the minimally required cleanup.

This used to be fine until the blamed commit, but now, the following
BUG_ON triggers:

void mdiobus_free(struct mii_bus *bus)
{
	/* For compatibility with error handling in drivers. */
	if (bus->state == MDIOBUS_ALLOCATED) {
		kfree(bus);
		return;
	}

	BUG_ON(bus->state != MDIOBUS_UNREGISTERED);
	bus->state = MDIOBUS_RELEASED;

	put_device(&bus->dev);
}

In other words, there is an attempt to free an MDIO bus which was not
unregistered. The attempt to free it comes from the devres release
callbacks of the SPI device, which are executed after the device is
unregistered.

I'm not saying that the fact that MDIO buses allocated using devres
would automatically get unregistered wasn't strange. I'm just saying
that the commit didn't care about auditing existing call paths in the
kernel, and now, the following code sequences are potentially buggy:

(a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device
    located on a bus that unregisters its children on shutdown. After
    the blamed patch, either both the alloc and the register should use
    devres, or none should.

(b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no
    mdiobus_unregister at all in the remove path. After the blamed
    patch, nobody unregisters the MDIO bus anymore, so this is even more
    buggy than the previous case which needs a specific bus
    configuration to be seen, this one is an unconditional bug.

In this case, DSA falls into category (a), it tries to be helpful and
registers an MDIO bus on behalf of the switch, which might be on such a
bus. I've no idea why it does it under devres.

It does this on probe:

	if (!ds->slave_mii_bus && ds->ops->phy_read)
		alloc and register mdio bus

and this on remove:

	if (ds->slave_mii_bus && ds->ops->phy_read)
		unregister mdio bus

I _could_ imagine using devres because the condition used on remove is
different than the condition used on probe. So strictly speaking, DSA
cannot determine whether the ds->slave_mii_bus it sees on remove is the
ds->slave_mii_bus that _it_ has allocated on probe. Using devres would
have solved that problem. But nonetheless, the existing code already
proceeds to unregister the MDIO bus, even though it might be
unregistering an MDIO bus it has never registered. So I can only guess
that no driver that implements ds->ops->phy_read also allocates and
registers ds->slave_mii_bus itself.

So in that case, if unregistering is fine, freeing must be fine too.

Stop using devres and free the MDIO bus manually. This will make devres
stop attempting to free a still registered MDIO bus on ->shutdown.

Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()")
Reported-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dsa/dsa2.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 3ada338d7e08..71c8ef7d4087 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -459,7 +459,7 @@ static int dsa_switch_setup(struct dsa_switch *ds)
 	devlink_params_publish(ds->devlink);
 
 	if (!ds->slave_mii_bus && ds->ops->phy_read) {
-		ds->slave_mii_bus = devm_mdiobus_alloc(ds->dev);
+		ds->slave_mii_bus = mdiobus_alloc();
 		if (!ds->slave_mii_bus) {
 			err = -ENOMEM;
 			goto teardown;
@@ -469,13 +469,16 @@ static int dsa_switch_setup(struct dsa_switch *ds)
 
 		err = mdiobus_register(ds->slave_mii_bus);
 		if (err < 0)
-			goto teardown;
+			goto free_slave_mii_bus;
 	}
 
 	ds->setup = true;
 
 	return 0;
 
+free_slave_mii_bus:
+	if (ds->slave_mii_bus && ds->ops->phy_read)
+		mdiobus_free(ds->slave_mii_bus);
 teardown:
 	if (ds->ops->teardown)
 		ds->ops->teardown(ds);
@@ -500,8 +503,11 @@ static void dsa_switch_teardown(struct dsa_switch *ds)
 	if (!ds->setup)
 		return;
 
-	if (ds->slave_mii_bus && ds->ops->phy_read)
+	if (ds->slave_mii_bus && ds->ops->phy_read) {
 		mdiobus_unregister(ds->slave_mii_bus);
+		mdiobus_free(ds->slave_mii_bus);
+		ds->slave_mii_bus = NULL;
+	}
 
 	dsa_switch_unregister_notifier(ds);
 

From 2eaa39d83e30fdaaa8f5046c32f15ca0ba480176 Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Tue, 21 Sep 2021 00:42:09 +0300
Subject: [PATCH 0545/1750] net: dsa: realtek: register the MDIO bus under
 devres
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 74b6d7d13307b016f4b5bba8198297824c0ee6df ]

The Linux device model permits both the ->shutdown and ->remove driver
methods to get called during a shutdown procedure. Example: a DSA switch
which sits on an SPI bus, and the SPI bus driver calls this on its
->shutdown method:

spi_unregister_controller
-> device_for_each_child(&ctlr->dev, NULL, __unregister);
   -> spi_unregister_device(to_spi_device(dev));
      -> device_del(&spi->dev);

So this is a simple pattern which can theoretically appear on any bus,
although the only other buses on which I've been able to find it are
I2C:

i2c_del_adapter
-> device_for_each_child(&adap->dev, NULL, __unregister_client);
   -> i2c_unregister_device(client);
      -> device_unregister(&client->dev);

The implication of this pattern is that devices on these buses can be
unregistered after having been shut down. The drivers for these devices
might choose to return early either from ->remove or ->shutdown if the
other callback has already run once, and they might choose that the
->shutdown method should only perform a subset of the teardown done by
->remove (to avoid unnecessary delays when rebooting).

So in other words, the device driver may choose on ->remove to not
do anything (therefore to not unregister an MDIO bus it has registered
on ->probe), because this ->remove is actually triggered by the
device_shutdown path, and its ->shutdown method has already run and done
the minimally required cleanup.

This used to be fine until the blamed commit, but now, the following
BUG_ON triggers:

void mdiobus_free(struct mii_bus *bus)
{
	/* For compatibility with error handling in drivers. */
	if (bus->state == MDIOBUS_ALLOCATED) {
		kfree(bus);
		return;
	}

	BUG_ON(bus->state != MDIOBUS_UNREGISTERED);
	bus->state = MDIOBUS_RELEASED;

	put_device(&bus->dev);
}

In other words, there is an attempt to free an MDIO bus which was not
unregistered. The attempt to free it comes from the devres release
callbacks of the SPI device, which are executed after the device is
unregistered.

I'm not saying that the fact that MDIO buses allocated using devres
would automatically get unregistered wasn't strange. I'm just saying
that the commit didn't care about auditing existing call paths in the
kernel, and now, the following code sequences are potentially buggy:

(a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device
    located on a bus that unregisters its children on shutdown. After
    the blamed patch, either both the alloc and the register should use
    devres, or none should.

(b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no
    mdiobus_unregister at all in the remove path. After the blamed
    patch, nobody unregisters the MDIO bus anymore, so this is even more
    buggy than the previous case which needs a specific bus
    configuration to be seen, this one is an unconditional bug.

In this case, the Realtek drivers fall under category (b). To solve it,
we can register the MDIO bus under devres too, which restores the
previous behavior.

Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()")
Reported-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Reported-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/realtek-smi-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dsa/realtek-smi-core.c b/drivers/net/dsa/realtek-smi-core.c
index 8e49d4f85d48..6bf46d76c028 100644
--- a/drivers/net/dsa/realtek-smi-core.c
+++ b/drivers/net/dsa/realtek-smi-core.c
@@ -368,7 +368,7 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi)
 	smi->slave_mii_bus->parent = smi->dev;
 	smi->ds->slave_mii_bus = smi->slave_mii_bus;
 
-	ret = of_mdiobus_register(smi->slave_mii_bus, mdio_np);
+	ret = devm_of_mdiobus_register(smi->dev, smi->slave_mii_bus, mdio_np);
 	if (ret) {
 		dev_err(smi->dev, "unable to register MDIO bus %s\n",
 			smi->slave_mii_bus->id);

From 91d4da33c3675b23aa47bbc421af07f18058dc5a Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Thu, 19 Aug 2021 14:42:40 +0100
Subject: [PATCH 0546/1750] kselftest/arm64: signal: Add SVE to the set of
 features we can check for

[ Upstream commit d4e4dc4fab686c5f3f185272a19b83930664bef5 ]

Allow testcases for SVE signal handling to flag the dependency and be
skipped on systems without SVE support.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20210819134245.13935-2-broonie@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/arm64/signal/test_signals.h       | 2 ++
 tools/testing/selftests/arm64/signal/test_signals_utils.c | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/tools/testing/selftests/arm64/signal/test_signals.h b/tools/testing/selftests/arm64/signal/test_signals.h
index f96baf1cef1a..ebe8694dbef0 100644
--- a/tools/testing/selftests/arm64/signal/test_signals.h
+++ b/tools/testing/selftests/arm64/signal/test_signals.h
@@ -33,10 +33,12 @@
  */
 enum {
 	FSSBS_BIT,
+	FSVE_BIT,
 	FMAX_END
 };
 
 #define FEAT_SSBS		(1UL << FSSBS_BIT)
+#define FEAT_SVE		(1UL << FSVE_BIT)
 
 /*
  * A descriptor used to describe and configure a test case.
diff --git a/tools/testing/selftests/arm64/signal/test_signals_utils.c b/tools/testing/selftests/arm64/signal/test_signals_utils.c
index 2de6e5ed5e25..6836510a522f 100644
--- a/tools/testing/selftests/arm64/signal/test_signals_utils.c
+++ b/tools/testing/selftests/arm64/signal/test_signals_utils.c
@@ -26,6 +26,7 @@ static int sig_copyctx = SIGTRAP;
 
 static char const *const feats_names[FMAX_END] = {
 	" SSBS ",
+	" SVE ",
 };
 
 #define MAX_FEATS_SZ	128
@@ -263,6 +264,8 @@ int test_init(struct tdescr *td)
 		 */
 		if (getauxval(AT_HWCAP) & HWCAP_SSBS)
 			td->feats_supported |= FEAT_SSBS;
+		if (getauxval(AT_HWCAP) & HWCAP_SVE)
+			td->feats_supported |= FEAT_SVE;
 		if (feats_ok(td))
 			fprintf(stderr,
 				"Required Features: [%s] supported\n",

From 3aa50241e1eda27013e92d0db4f1b179e5cc33a6 Mon Sep 17 00:00:00 2001
From: Cristian Marussi <cristian.marussi@arm.com>
Date: Mon, 20 Sep 2021 13:12:28 +0100
Subject: [PATCH 0547/1750] kselftest/arm64: signal: Skip tests if required
 features are missing

[ Upstream commit 0e3dbf765fe22060acbcb8eb8c4d256e655a1247 ]

During initialization of a signal testcase, features declared as required
are properly checked against the running system but no action is then taken
to effectively skip such a testcase.

Fix core signals test logic to abort initialization and report such a
testcase as skipped to the KSelfTest framework.

Fixes: f96bf4340316 ("kselftest: arm64: mangle_pstate_invalid_compat_toggle and common utils")
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20210920121228.35368-1-cristian.marussi@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/arm64/signal/test_signals_utils.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/arm64/signal/test_signals_utils.c b/tools/testing/selftests/arm64/signal/test_signals_utils.c
index 6836510a522f..22722abc9dfa 100644
--- a/tools/testing/selftests/arm64/signal/test_signals_utils.c
+++ b/tools/testing/selftests/arm64/signal/test_signals_utils.c
@@ -266,16 +266,19 @@ int test_init(struct tdescr *td)
 			td->feats_supported |= FEAT_SSBS;
 		if (getauxval(AT_HWCAP) & HWCAP_SVE)
 			td->feats_supported |= FEAT_SVE;
-		if (feats_ok(td))
+		if (feats_ok(td)) {
 			fprintf(stderr,
 				"Required Features: [%s] supported\n",
 				feats_to_string(td->feats_required &
 						td->feats_supported));
-		else
+		} else {
 			fprintf(stderr,
 				"Required Features: [%s] NOT supported\n",
 				feats_to_string(td->feats_required &
 						~td->feats_supported));
+			td->result = KSFT_SKIP;
+			return 0;
+		}
 	}
 
 	/* Perform test specific additional initialization */

From db94f89e1dadf693c15c2d60de0c34777cea5779 Mon Sep 17 00:00:00 2001
From: Julian Wiedmann <jwi@linux.ibm.com>
Date: Tue, 21 Sep 2021 16:52:15 +0200
Subject: [PATCH 0548/1750] s390/qeth: fix NULL deref in
 qeth_clear_working_pool_list()

[ Upstream commit 248f064af222a1f97ee02c84a98013dfbccad386 ]

When qeth_set_online() calls qeth_clear_working_pool_list() to roll
back after an error exit from qeth_hardsetup_card(), we are at risk of
accessing card->qdio.in_q before it was allocated by
qeth_alloc_qdio_queues() via qeth_mpc_initialize().

qeth_clear_working_pool_list() then dereferences NULL, and by writing to
queue->bufs[i].pool_entry scribbles all over the CPU's lowcore.
Resulting in a crash when those lowcore areas are used next (eg. on
the next machine-check interrupt).

Such a scenario would typically happen when the device is first set
online and its queues aren't allocated yet. An early IO error or certain
misconfigs (eg. mismatched transport mode, bad portno) then cause us to
error out from qeth_hardsetup_card() with card->qdio.in_q still being
NULL.

Fix it by checking the pointer for NULL before accessing it.

Note that we also have (rare) paths inside qeth_mpc_initialize() where
a configuration change can cause us to free the existing queues,
expecting that subsequent code will allocate them again. If we then
error out before that re-allocation happens, the same bug occurs.

Fixes: eff73e16ee11 ("s390/qeth: tolerate pre-filled RX buffer")
Reported-by: Stefan Raspl <raspl@linux.ibm.com>
Root-caused-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/net/qeth_core_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 4d51c4ace8ea..7b0155b0e99e 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -210,6 +210,9 @@ static void qeth_clear_working_pool_list(struct qeth_card *card)
 				 &card->qdio.in_buf_pool.entry_list, list)
 		list_del(&pool_entry->list);
 
+	if (!queue)
+		return;
+
 	for (i = 0; i < ARRAY_SIZE(queue->bufs); i++)
 		queue->bufs[i].pool_entry = NULL;
 }

From 1bba406c07b3cb008ba0456ec589b6aa46d8a830 Mon Sep 17 00:00:00 2001
From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Date: Thu, 16 Sep 2021 20:19:35 +0900
Subject: [PATCH 0549/1750] gpio: uniphier: Fix void functions to remove return
 value

[ Upstream commit 2dd824cca3407bc9a2bd11b00f6e117b66fcfcf1 ]

The return type of irq_chip.irq_mask() and irq_chip.irq_unmask() should
be void.

Fixes: dbe776c2ca54 ("gpio: uniphier: add UniPhier GPIO controller driver")
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-uniphier.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c
index f99f3c10bed0..39dca147d587 100644
--- a/drivers/gpio/gpio-uniphier.c
+++ b/drivers/gpio/gpio-uniphier.c
@@ -184,7 +184,7 @@ static void uniphier_gpio_irq_mask(struct irq_data *data)
 
 	uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, 0);
 
-	return irq_chip_mask_parent(data);
+	irq_chip_mask_parent(data);
 }
 
 static void uniphier_gpio_irq_unmask(struct irq_data *data)
@@ -194,7 +194,7 @@ static void uniphier_gpio_irq_unmask(struct irq_data *data)
 
 	uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, mask);
 
-	return irq_chip_unmask_parent(data);
+	irq_chip_unmask_parent(data);
 }
 
 static int uniphier_gpio_irq_set_type(struct irq_data *data, unsigned int type)

From b4e54f5f4288e444fb90df36659f1280c77af7ac Mon Sep 17 00:00:00 2001
From: Shai Malin <smalin@marvell.com>
Date: Wed, 22 Sep 2021 13:53:26 +0300
Subject: [PATCH 0550/1750] qed: rdma - don't wait for resources under hw error
 recovery flow

[ Upstream commit 1ea7812326004afd2803cc968a4776ae5120a597 ]

If the HW device is during recovery, the HW resources will never return,
hence we shouldn't wait for the CID (HW context ID) bitmaps to clear.
This fix speeds up the error recovery flow.

Fixes: 64515dc899df ("qed: Add infrastructure for error detection and recovery")
Signed-off-by: Michal Kalderon <mkalderon@marvell.com>
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Shai Malin <smalin@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 8 ++++++++
 drivers/net/ethernet/qlogic/qed/qed_roce.c  | 8 ++++++++
 2 files changed, 16 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
index a99861124630..68fbe536a1f3 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -1297,6 +1297,14 @@ qed_iwarp_wait_cid_map_cleared(struct qed_hwfn *p_hwfn, struct qed_bmap *bmap)
 	prev_weight = weight;
 
 	while (weight) {
+		/* If the HW device is during recovery, all resources are
+		 * immediately reset without receiving a per-cid indication
+		 * from HW. In this case we don't expect the cid_map to be
+		 * cleared.
+		 */
+		if (p_hwfn->cdev->recov_in_prog)
+			return 0;
+
 		msleep(QED_IWARP_MAX_CID_CLEAN_TIME);
 
 		weight = bitmap_weight(bmap->bitmap, bmap->max_count);
diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c
index f16a157bb95a..cf5baa5e59bc 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c
@@ -77,6 +77,14 @@ void qed_roce_stop(struct qed_hwfn *p_hwfn)
 	 * Beyond the added delay we clear the bitmap anyway.
 	 */
 	while (bitmap_weight(rcid_map->bitmap, rcid_map->max_count)) {
+		/* If the HW device is during recovery, all resources are
+		 * immediately reset without receiving a per-cid indication
+		 * from HW. In this case we don't expect the cid bitmap to be
+		 * cleared.
+		 */
+		if (p_hwfn->cdev->recov_in_prog)
+			return;
+
 		msleep(100);
 		if (wait_count++ > 20) {
 			DP_NOTICE(p_hwfn, "cid bitmap wait timed out\n");

From c2598bce4152516c329934e1bfc192ce0df01a75 Mon Sep 17 00:00:00 2001
From: Aya Levin <ayal@nvidia.com>
Date: Thu, 23 Sep 2021 09:51:45 +0300
Subject: [PATCH 0551/1750] net/mlx4_en: Don't allow aRFS for encapsulated
 packets

[ Upstream commit fdbccea419dc782079ce5881d2705cc9e3881480 ]

Driver doesn't support aRFS for encapsulated packets, return early error
in such a case.

Fixes: 1eb8c695bda9 ("net/mlx4_en: Add accelerated RFS support")
Signed-off-by: Aya Levin <ayal@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index d8a20e83d904..8999e9ce4f08 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -372,6 +372,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb,
 	int nhoff = skb_network_offset(skb);
 	int ret = 0;
 
+	if (skb->encapsulation)
+		return -EPROTONOSUPPORT;
+
 	if (skb->protocol != htons(ETH_P_IP))
 		return -EPROTONOSUPPORT;
 

From 0032f8b3cf2a740ded49efbd649c8c2b956beed7 Mon Sep 17 00:00:00 2001
From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
Date: Thu, 23 Sep 2021 03:16:05 -0700
Subject: [PATCH 0552/1750] atlantic: Fix issue in the pm resume flow.

[ Upstream commit 4d88c339c423eefe2fd48215016cb0c75fcb4c4d ]

After fixing hibernation resume flow, another usecase was found which
should be explicitly handled - resume when device is in "down" state.
Invoke aq_nic_init jointly with aq_nic_start only if ndev was already
up during suspend/hibernate. We still need to perform nic_deinit() if
caller requests for it, to handle the freeze/resume scenarios.

Fixes: 57f780f1c433 ("atlantic: Fix driver resume flow.")
Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index f26d03735619..5b996330f228 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -419,13 +419,13 @@ static int atl_resume_common(struct device *dev, bool deep)
 	if (deep) {
 		/* Reinitialize Nic/Vecs objects */
 		aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol);
-
-		ret = aq_nic_init(nic);
-		if (ret)
-			goto err_exit;
 	}
 
 	if (netif_running(nic->ndev)) {
+		ret = aq_nic_init(nic);
+		if (ret)
+			goto err_exit;
+
 		ret = aq_nic_start(nic);
 		if (ret)
 			goto err_exit;

From 2d03054251791d238afccb65def48bab61e7f035 Mon Sep 17 00:00:00 2001
From: Baokun Li <libaokun1@huawei.com>
Date: Wed, 1 Sep 2021 16:53:36 +0800
Subject: [PATCH 0553/1750] scsi: iscsi: Adjust iface sysfs attr detection

[ Upstream commit 4e28550829258f7dab97383acaa477bd724c0ff4 ]

ISCSI_NET_PARAM_IFACE_ENABLE belongs to enum iscsi_net_param instead of
iscsi_iface_param so move it to ISCSI_NET_PARAM. Otherwise, when we call
into the driver, we might not match and return that we don't want attr
visible in sysfs. Found in code review.

Link: https://lore.kernel.org/r/20210901085336.2264295-1-libaokun1@huawei.com
Fixes: e746f3451ec7 ("scsi: iscsi: Fix iface sysfs attr detection")
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index ac07a9ef3578..41772b88610a 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -442,9 +442,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
 	struct iscsi_transport *t = iface->transport;
 	int param = -1;
 
-	if (attr == &dev_attr_iface_enabled.attr)
-		param = ISCSI_NET_PARAM_IFACE_ENABLE;
-	else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
+	if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr)
 		param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO;
 	else if (attr == &dev_attr_iface_header_digest.attr)
 		param = ISCSI_IFACE_PARAM_HDRDGST_EN;
@@ -484,7 +482,9 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj,
 	if (param != -1)
 		return t->attr_is_visible(ISCSI_IFACE_PARAM, param);
 
-	if (attr == &dev_attr_iface_vlan_id.attr)
+	if (attr == &dev_attr_iface_enabled.attr)
+		param = ISCSI_NET_PARAM_IFACE_ENABLE;
+	else if (attr == &dev_attr_iface_vlan_id.attr)
 		param = ISCSI_NET_PARAM_VLAN_ID;
 	else if (attr == &dev_attr_iface_vlan_priority.attr)
 		param = ISCSI_NET_PARAM_VLAN_PRIORITY;

From c64e6c307a7666b852cedf2848f9506926eb791d Mon Sep 17 00:00:00 2001
From: Maurizio Lombardi <mlombard@redhat.com>
Date: Mon, 6 Sep 2021 17:18:09 +0200
Subject: [PATCH 0554/1750] scsi: target: Fix the pgr/alua_support_store
 functions

[ Upstream commit ef7ae7f746e95c6fa4ec2bcfacb949c36263da78 ]

Commit 356ba2a8bc8d ("scsi: target: tcmu: Make pgr_support and alua_support
attributes writable") introduced support for changeable alua_support and
pgr_support target attributes. These can only be changed if the backstore
is user-backed, otherwise the kernel returns -EINVAL.

This triggers a warning in the targetcli/rtslib code when performing a
target restore that includes non-userbacked backstores:

  # targetctl restore
  Storage Object block/storage1: Cannot set attribute alua_support:
  [Errno 22] Invalid argument, skipped
  Storage Object block/storage1: Cannot set attribute pgr_support:
  [Errno 22] Invalid argument, skipped

Fix this warning by returning an error code only if we are really going to
flip the PGR/ALUA bit in the transport_flags field, otherwise we will do
nothing and return success.

Return ENOSYS instead of EINVAL if the pgr/alua attributes can not be
changed, this way it will be possible for userspace to understand if the
operation failed because an invalid value has been passed to strtobool() or
because the attributes are fixed.

Fixes: 356ba2a8bc8d ("scsi: target: tcmu: Make pgr_support and alua_support attributes writable")
Link: https://lore.kernel.org/r/20210906151809.52811-1-mlombard@redhat.com
Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/target/target_core_configfs.c | 32 +++++++++++++++++----------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index f04352285155..56ae882fb7b3 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -1110,20 +1110,24 @@ static ssize_t alua_support_store(struct config_item *item,
 {
 	struct se_dev_attrib *da = to_attrib(item);
 	struct se_device *dev = da->da_dev;
-	bool flag;
+	bool flag, oldflag;
 	int ret;
 
+	ret = strtobool(page, &flag);
+	if (ret < 0)
+		return ret;
+
+	oldflag = !(dev->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_ALUA);
+	if (flag == oldflag)
+		return count;
+
 	if (!(dev->transport->transport_flags_changeable &
 	      TRANSPORT_FLAG_PASSTHROUGH_ALUA)) {
 		pr_err("dev[%p]: Unable to change SE Device alua_support:"
 			" alua_support has fixed value\n", dev);
-		return -EINVAL;
+		return -ENOSYS;
 	}
 
-	ret = strtobool(page, &flag);
-	if (ret < 0)
-		return ret;
-
 	if (flag)
 		dev->transport_flags &= ~TRANSPORT_FLAG_PASSTHROUGH_ALUA;
 	else
@@ -1145,20 +1149,24 @@ static ssize_t pgr_support_store(struct config_item *item,
 {
 	struct se_dev_attrib *da = to_attrib(item);
 	struct se_device *dev = da->da_dev;
-	bool flag;
+	bool flag, oldflag;
 	int ret;
 
+	ret = strtobool(page, &flag);
+	if (ret < 0)
+		return ret;
+
+	oldflag = !(dev->transport_flags & TRANSPORT_FLAG_PASSTHROUGH_PGR);
+	if (flag == oldflag)
+		return count;
+
 	if (!(dev->transport->transport_flags_changeable &
 	      TRANSPORT_FLAG_PASSTHROUGH_PGR)) {
 		pr_err("dev[%p]: Unable to change SE Device pgr_support:"
 			" pgr_support has fixed value\n", dev);
-		return -EINVAL;
+		return -ENOSYS;
 	}
 
-	ret = strtobool(page, &flag);
-	if (ret < 0)
-		return ret;
-
 	if (flag)
 		dev->transport_flags &= ~TRANSPORT_FLAG_PASSTHROUGH_PGR;
 	else

From 56a8f0b18f46fe505f5175f71135192f67561f05 Mon Sep 17 00:00:00 2001
From: Jiri Slaby <jslaby@suse.cz>
Date: Tue, 2 Mar 2021 07:22:09 +0100
Subject: [PATCH 0555/1750] tty: synclink_gt, drop unneeded forward
 declarations

[ Upstream commit b9b90fe655c0bd816847ac1bcbf179cfa2981ecb ]

Forward declarations make the code larger and rewrites harder. Harder as
they are often omitted from global changes. Remove forward declarations
which are not really needed, i.e. the definition of the function is
before its first use.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20210302062214.29627-39-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/synclink_gt.c | 57 +--------------------------------------
 1 file changed, 1 insertion(+), 56 deletions(-)

diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index afa4cc52e48d..d728876b43c4 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -137,37 +137,14 @@ MODULE_PARM_DESC(maxframe, "Maximum frame size used by device (4096 to 65535)");
  */
 static struct tty_driver *serial_driver;
 
-static int  open(struct tty_struct *tty, struct file * filp);
-static void close(struct tty_struct *tty, struct file * filp);
-static void hangup(struct tty_struct *tty);
-static void set_termios(struct tty_struct *tty, struct ktermios *old_termios);
-
-static int  write(struct tty_struct *tty, const unsigned char *buf, int count);
-static int put_char(struct tty_struct *tty, unsigned char ch);
-static void send_xchar(struct tty_struct *tty, char ch);
 static void wait_until_sent(struct tty_struct *tty, int timeout);
-static int  write_room(struct tty_struct *tty);
-static void flush_chars(struct tty_struct *tty);
 static void flush_buffer(struct tty_struct *tty);
-static void tx_hold(struct tty_struct *tty);
 static void tx_release(struct tty_struct *tty);
 
-static int  ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg);
-static int  chars_in_buffer(struct tty_struct *tty);
-static void throttle(struct tty_struct * tty);
-static void unthrottle(struct tty_struct * tty);
-static int set_break(struct tty_struct *tty, int break_state);
-
 /*
- * generic HDLC support and callbacks
+ * generic HDLC support
  */
-#if SYNCLINK_GENERIC_HDLC
 #define dev_to_port(D) (dev_to_hdlc(D)->priv)
-static void hdlcdev_tx_done(struct slgt_info *info);
-static void hdlcdev_rx(struct slgt_info *info, char *buf, int size);
-static int  hdlcdev_init(struct slgt_info *info);
-static void hdlcdev_exit(struct slgt_info *info);
-#endif
 
 
 /*
@@ -186,9 +163,6 @@ struct cond_wait {
 	wait_queue_entry_t wait;
 	unsigned int data;
 };
-static void init_cond_wait(struct cond_wait *w, unsigned int data);
-static void add_cond_wait(struct cond_wait **head, struct cond_wait *w);
-static void remove_cond_wait(struct cond_wait **head, struct cond_wait *w);
 static void flush_cond_wait(struct cond_wait **head);
 
 /*
@@ -443,12 +417,8 @@ static void shutdown(struct slgt_info *info);
 static void program_hw(struct slgt_info *info);
 static void change_params(struct slgt_info *info);
 
-static int  register_test(struct slgt_info *info);
-static int  irq_test(struct slgt_info *info);
-static int  loopback_test(struct slgt_info *info);
 static int  adapter_test(struct slgt_info *info);
 
-static void reset_adapter(struct slgt_info *info);
 static void reset_port(struct slgt_info *info);
 static void async_mode(struct slgt_info *info);
 static void sync_mode(struct slgt_info *info);
@@ -457,14 +427,12 @@ static void rx_stop(struct slgt_info *info);
 static void rx_start(struct slgt_info *info);
 static void reset_rbufs(struct slgt_info *info);
 static void free_rbufs(struct slgt_info *info, unsigned int first, unsigned int last);
-static void rdma_reset(struct slgt_info *info);
 static bool rx_get_frame(struct slgt_info *info);
 static bool rx_get_buf(struct slgt_info *info);
 
 static void tx_start(struct slgt_info *info);
 static void tx_stop(struct slgt_info *info);
 static void tx_set_idle(struct slgt_info *info);
-static unsigned int free_tbuf_count(struct slgt_info *info);
 static unsigned int tbuf_bytes(struct slgt_info *info);
 static void reset_tbufs(struct slgt_info *info);
 static void tdma_reset(struct slgt_info *info);
@@ -472,26 +440,10 @@ static bool tx_load(struct slgt_info *info, const char *buf, unsigned int count)
 
 static void get_signals(struct slgt_info *info);
 static void set_signals(struct slgt_info *info);
-static void enable_loopback(struct slgt_info *info);
 static void set_rate(struct slgt_info *info, u32 data_rate);
 
-static int  bh_action(struct slgt_info *info);
-static void bh_handler(struct work_struct *work);
 static void bh_transmit(struct slgt_info *info);
-static void isr_serial(struct slgt_info *info);
-static void isr_rdma(struct slgt_info *info);
 static void isr_txeom(struct slgt_info *info, unsigned short status);
-static void isr_tdma(struct slgt_info *info);
-
-static int  alloc_dma_bufs(struct slgt_info *info);
-static void free_dma_bufs(struct slgt_info *info);
-static int  alloc_desc(struct slgt_info *info);
-static void free_desc(struct slgt_info *info);
-static int  alloc_bufs(struct slgt_info *info, struct slgt_desc *bufs, int count);
-static void free_bufs(struct slgt_info *info, struct slgt_desc *bufs, int count);
-
-static int  alloc_tmp_rbuf(struct slgt_info *info);
-static void free_tmp_rbuf(struct slgt_info *info);
 
 static void tx_timeout(struct timer_list *t);
 static void rx_timeout(struct timer_list *t);
@@ -509,10 +461,6 @@ static int  tx_abort(struct slgt_info *info);
 static int  rx_enable(struct slgt_info *info, int enable);
 static int  modem_input_wait(struct slgt_info *info,int arg);
 static int  wait_mgsl_event(struct slgt_info *info, int __user *mask_ptr);
-static int  tiocmget(struct tty_struct *tty);
-static int  tiocmset(struct tty_struct *tty,
-				unsigned int set, unsigned int clear);
-static int set_break(struct tty_struct *tty, int break_state);
 static int  get_interface(struct slgt_info *info, int __user *if_mode);
 static int  set_interface(struct slgt_info *info, int if_mode);
 static int  set_gpio(struct slgt_info *info, struct gpio_desc __user *gpio);
@@ -526,9 +474,6 @@ static int  set_xctrl(struct slgt_info *info, int if_mode);
 /*
  * driver functions
  */
-static void add_device(struct slgt_info *info);
-static void device_init(int adapter_num, struct pci_dev *pdev);
-static int  claim_resources(struct slgt_info *info);
 static void release_resources(struct slgt_info *info);
 
 /*

From 4ea4925c70fd55511e39cda5f3e9b47628435dfc Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Wed, 1 Sep 2021 17:38:06 -0700
Subject: [PATCH 0556/1750] tty: synclink_gt: rename a conflicting function
 name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 06e49073dfba24df4b1073a068631b13a0039c34 ]

'set_signals()' in synclink_gt.c conflicts with an exported symbol
in arch/um/, so change set_signals() to set_gtsignals(). Keep
the function names similar by also changing get_signals() to
get_gtsignals().

../drivers/tty/synclink_gt.c:442:13: error: conflicting types for ‘set_signals’
 static void set_signals(struct slgt_info *info);
             ^~~~~~~~~~~
In file included from ../include/linux/irqflags.h:16:0,
                 from ../include/linux/spinlock.h:58,
                 from ../include/linux/mm_types.h:9,
                 from ../include/linux/buildid.h:5,
                 from ../include/linux/module.h:14,
                 from ../drivers/tty/synclink_gt.c:46:
../arch/um/include/asm/irqflags.h:6:5: note: previous declaration of ‘set_signals’ was here
 int set_signals(int enable);
     ^~~~~~~~~~~

Fixes: 705b6c7b34f2 ("[PATCH] new driver synclink_gt")
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jirislaby@kernel.org>
Cc: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20210902003806.17054-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/synclink_gt.c | 44 +++++++++++++++++++--------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
index d728876b43c4..1a0c7beec101 100644
--- a/drivers/tty/synclink_gt.c
+++ b/drivers/tty/synclink_gt.c
@@ -438,8 +438,8 @@ static void reset_tbufs(struct slgt_info *info);
 static void tdma_reset(struct slgt_info *info);
 static bool tx_load(struct slgt_info *info, const char *buf, unsigned int count);
 
-static void get_signals(struct slgt_info *info);
-static void set_signals(struct slgt_info *info);
+static void get_gtsignals(struct slgt_info *info);
+static void set_gtsignals(struct slgt_info *info);
 static void set_rate(struct slgt_info *info, u32 data_rate);
 
 static void bh_transmit(struct slgt_info *info);
@@ -721,7 +721,7 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios)
 	if ((old_termios->c_cflag & CBAUD) && !C_BAUD(tty)) {
 		info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
 		spin_lock_irqsave(&info->lock,flags);
-		set_signals(info);
+		set_gtsignals(info);
 		spin_unlock_irqrestore(&info->lock,flags);
 	}
 
@@ -731,7 +731,7 @@ static void set_termios(struct tty_struct *tty, struct ktermios *old_termios)
 		if (!C_CRTSCTS(tty) || !tty_throttled(tty))
 			info->signals |= SerialSignal_RTS;
 		spin_lock_irqsave(&info->lock,flags);
-	 	set_signals(info);
+	 	set_gtsignals(info);
 		spin_unlock_irqrestore(&info->lock,flags);
 	}
 
@@ -1182,7 +1182,7 @@ static inline void line_info(struct seq_file *m, struct slgt_info *info)
 
 	/* output current serial signal states */
 	spin_lock_irqsave(&info->lock,flags);
-	get_signals(info);
+	get_gtsignals(info);
 	spin_unlock_irqrestore(&info->lock,flags);
 
 	stat_buf[0] = 0;
@@ -1282,7 +1282,7 @@ static void throttle(struct tty_struct * tty)
 	if (C_CRTSCTS(tty)) {
 		spin_lock_irqsave(&info->lock,flags);
 		info->signals &= ~SerialSignal_RTS;
-		set_signals(info);
+		set_gtsignals(info);
 		spin_unlock_irqrestore(&info->lock,flags);
 	}
 }
@@ -1307,7 +1307,7 @@ static void unthrottle(struct tty_struct * tty)
 	if (C_CRTSCTS(tty)) {
 		spin_lock_irqsave(&info->lock,flags);
 		info->signals |= SerialSignal_RTS;
-		set_signals(info);
+		set_gtsignals(info);
 		spin_unlock_irqrestore(&info->lock,flags);
 	}
 }
@@ -1478,7 +1478,7 @@ static int hdlcdev_open(struct net_device *dev)
 
 	/* inform generic HDLC layer of current DCD status */
 	spin_lock_irqsave(&info->lock, flags);
-	get_signals(info);
+	get_gtsignals(info);
 	spin_unlock_irqrestore(&info->lock, flags);
 	if (info->signals & SerialSignal_DCD)
 		netif_carrier_on(dev);
@@ -2232,7 +2232,7 @@ static void isr_txeom(struct slgt_info *info, unsigned short status)
 		if (info->params.mode != MGSL_MODE_ASYNC && info->drop_rts_on_tx_done) {
 			info->signals &= ~SerialSignal_RTS;
 			info->drop_rts_on_tx_done = false;
-			set_signals(info);
+			set_gtsignals(info);
 		}
 
 #if SYNCLINK_GENERIC_HDLC
@@ -2397,7 +2397,7 @@ static void shutdown(struct slgt_info *info)
 
  	if (!info->port.tty || info->port.tty->termios.c_cflag & HUPCL) {
 		info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
-		set_signals(info);
+		set_gtsignals(info);
 	}
 
 	flush_cond_wait(&info->gpio_wait_q);
@@ -2425,7 +2425,7 @@ static void program_hw(struct slgt_info *info)
 	else
 		async_mode(info);
 
-	set_signals(info);
+	set_gtsignals(info);
 
 	info->dcd_chkcount = 0;
 	info->cts_chkcount = 0;
@@ -2433,7 +2433,7 @@ static void program_hw(struct slgt_info *info)
 	info->dsr_chkcount = 0;
 
 	slgt_irq_on(info, IRQ_DCD | IRQ_CTS | IRQ_DSR | IRQ_RI);
-	get_signals(info);
+	get_gtsignals(info);
 
 	if (info->netcount ||
 	    (info->port.tty && info->port.tty->termios.c_cflag & CREAD))
@@ -2677,7 +2677,7 @@ static int wait_mgsl_event(struct slgt_info *info, int __user *mask_ptr)
 	spin_lock_irqsave(&info->lock,flags);
 
 	/* return immediately if state matches requested events */
-	get_signals(info);
+	get_gtsignals(info);
 	s = info->signals;
 
 	events = mask &
@@ -3095,7 +3095,7 @@ static int tiocmget(struct tty_struct *tty)
  	unsigned long flags;
 
 	spin_lock_irqsave(&info->lock,flags);
- 	get_signals(info);
+ 	get_gtsignals(info);
 	spin_unlock_irqrestore(&info->lock,flags);
 
 	result = ((info->signals & SerialSignal_RTS) ? TIOCM_RTS:0) +
@@ -3134,7 +3134,7 @@ static int tiocmset(struct tty_struct *tty,
 		info->signals &= ~SerialSignal_DTR;
 
 	spin_lock_irqsave(&info->lock,flags);
-	set_signals(info);
+	set_gtsignals(info);
 	spin_unlock_irqrestore(&info->lock,flags);
 	return 0;
 }
@@ -3145,7 +3145,7 @@ static int carrier_raised(struct tty_port *port)
 	struct slgt_info *info = container_of(port, struct slgt_info, port);
 
 	spin_lock_irqsave(&info->lock,flags);
-	get_signals(info);
+	get_gtsignals(info);
 	spin_unlock_irqrestore(&info->lock,flags);
 	return (info->signals & SerialSignal_DCD) ? 1 : 0;
 }
@@ -3160,7 +3160,7 @@ static void dtr_rts(struct tty_port *port, int on)
 		info->signals |= SerialSignal_RTS | SerialSignal_DTR;
 	else
 		info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
-	set_signals(info);
+	set_gtsignals(info);
 	spin_unlock_irqrestore(&info->lock,flags);
 }
 
@@ -3963,10 +3963,10 @@ static void tx_start(struct slgt_info *info)
 
 		if (info->params.mode != MGSL_MODE_ASYNC) {
 			if (info->params.flags & HDLC_FLAG_AUTO_RTS) {
-				get_signals(info);
+				get_gtsignals(info);
 				if (!(info->signals & SerialSignal_RTS)) {
 					info->signals |= SerialSignal_RTS;
-					set_signals(info);
+					set_gtsignals(info);
 					info->drop_rts_on_tx_done = true;
 				}
 			}
@@ -4020,7 +4020,7 @@ static void reset_port(struct slgt_info *info)
 	rx_stop(info);
 
 	info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
-	set_signals(info);
+	set_gtsignals(info);
 
 	slgt_irq_off(info, IRQ_ALL | IRQ_MASTER);
 }
@@ -4442,7 +4442,7 @@ static void tx_set_idle(struct slgt_info *info)
 /*
  * get state of V24 status (input) signals
  */
-static void get_signals(struct slgt_info *info)
+static void get_gtsignals(struct slgt_info *info)
 {
 	unsigned short status = rd_reg16(info, SSR);
 
@@ -4504,7 +4504,7 @@ static void msc_set_vcr(struct slgt_info *info)
 /*
  * set state of V24 control (output) signals
  */
-static void set_signals(struct slgt_info *info)
+static void set_gtsignals(struct slgt_info *info)
 {
 	unsigned char val = rd_reg8(info, VCR);
 	if (info->signals & SerialSignal_DTR)

From 5c6bfde245d82a5ccd27d7f4a720d8222ba943ee Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Tue, 10 Aug 2021 09:40:36 -0700
Subject: [PATCH 0557/1750] fpga: machxo2-spi: Return an error on failure

[ Upstream commit 34331739e19fd6a293d488add28832ad49c9fc54 ]

Earlier successes leave 'ret' in a non error state, so these errors are
not reported. Set ret to -EINVAL before going to the error handler.

This addresses two issues reported by smatch:
drivers/fpga/machxo2-spi.c:229 machxo2_write_init()
  warn: missing error code 'ret'

drivers/fpga/machxo2-spi.c:316 machxo2_write_complete()
  warn: missing error code 'ret'

[mdf@kernel.org: Reworded commit message]
Fixes: 88fb3a002330 ("fpga: lattice machxo2: Add Lattice MachXO2 support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fpga/machxo2-spi.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/fpga/machxo2-spi.c b/drivers/fpga/machxo2-spi.c
index b316369156fe..7688ff3b31e4 100644
--- a/drivers/fpga/machxo2-spi.c
+++ b/drivers/fpga/machxo2-spi.c
@@ -225,8 +225,10 @@ static int machxo2_write_init(struct fpga_manager *mgr,
 		goto fail;
 
 	get_status(spi, &status);
-	if (test_bit(FAIL, &status))
+	if (test_bit(FAIL, &status)) {
+		ret = -EINVAL;
 		goto fail;
+	}
 	dump_status_reg(&status);
 
 	spi_message_init(&msg);
@@ -313,6 +315,7 @@ static int machxo2_write_complete(struct fpga_manager *mgr,
 	dump_status_reg(&status);
 	if (!test_bit(DONE, &status)) {
 		machxo2_cleanup(mgr);
+		ret = -EINVAL;
 		goto fail;
 	}
 

From c6ecdcba9da3416030cfc9376dce83ec0d21cef0 Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Fri, 13 Aug 2021 14:40:42 +0800
Subject: [PATCH 0558/1750] fpga: machxo2-spi: Fix missing error code in
 machxo2_write_complete()

[ Upstream commit a1e4470823d99e75b596748086e120dea169ed3c ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'ret'.

Eliminate the follow smatch warning:

drivers/fpga/machxo2-spi.c:341 machxo2_write_complete()
  warn: missing error code 'ret'.

[mdf@kernel.org: Reworded commit message]
Fixes: 88fb3a002330 ("fpga: lattice machxo2: Add Lattice MachXO2 support")
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Moritz Fischer <mdf@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/fpga/machxo2-spi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/fpga/machxo2-spi.c b/drivers/fpga/machxo2-spi.c
index 7688ff3b31e4..9eef18349eee 100644
--- a/drivers/fpga/machxo2-spi.c
+++ b/drivers/fpga/machxo2-spi.c
@@ -338,6 +338,7 @@ static int machxo2_write_complete(struct fpga_manager *mgr,
 			break;
 		if (++refreshloop == MACHXO2_MAX_REFRESH_LOOP) {
 			machxo2_cleanup(mgr);
+			ret = -EINVAL;
 			goto fail;
 		}
 	} while (1);

From 419fab1cb0861c0220e31aa09ca6f9297704a492 Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@grimberg.me>
Date: Tue, 14 Sep 2021 18:38:55 +0300
Subject: [PATCH 0559/1750] nvme-tcp: fix incorrect h2cdata pdu offset
 accounting

[ Upstream commit e371af033c560b9dd1e861f8f0b503142bf0a06c ]

When the controller sends us multiple r2t PDUs in a single
request we need to account for it correctly as our send/recv
context run concurrently (i.e. we get a new r2t with r2t_offset
before we updated our iterator and req->data_sent marker). This
can cause wrong offsets to be sent to the controller.

To fix that, we will first know that this may happen only in
the send sequence of the last page, hence we will take
the r2t_offset to the h2c PDU data_offset, and in
nvme_tcp_try_send_data loop, we make sure to increment
the request markers also when we completed a PDU but
we are expecting more r2t PDUs as we still did not send
the entire data of the request.

Fixes: 825619b09ad3 ("nvme-tcp: fix possible use-after-completion")
Reported-by: Nowak, Lukasz <Lukasz.Nowak@Dell.com>
Tested-by: Nowak, Lukasz <Lukasz.Nowak@Dell.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/tcp.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index a6b3b0762763..05ad6bee085c 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -611,7 +611,7 @@ static int nvme_tcp_setup_h2c_data_pdu(struct nvme_tcp_request *req,
 		cpu_to_le32(data->hdr.hlen + hdgst + req->pdu_len + ddgst);
 	data->ttag = pdu->ttag;
 	data->command_id = nvme_cid(rq);
-	data->data_offset = cpu_to_le32(req->data_sent);
+	data->data_offset = pdu->r2t_offset;
 	data->data_length = cpu_to_le32(req->pdu_len);
 	return 0;
 }
@@ -937,7 +937,15 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req)
 			nvme_tcp_ddgst_update(queue->snd_hash, page,
 					offset, ret);
 
-		/* fully successful last write*/
+		/*
+		 * update the request iterator except for the last payload send
+		 * in the request where we don't want to modify it as we may
+		 * compete with the RX path completing the request.
+		 */
+		if (req->data_sent + ret < req->data_len)
+			nvme_tcp_advance_req(req, ret);
+
+		/* fully successful last send in current PDU */
 		if (last && ret == len) {
 			if (queue->data_digest) {
 				nvme_tcp_ddgst_final(queue->snd_hash,
@@ -949,7 +957,6 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req)
 			}
 			return 1;
 		}
-		nvme_tcp_advance_req(req, ret);
 	}
 	return -EAGAIN;
 }

From 55e6f8b3c0f5cc600df12ddd0371d2703b910fd7 Mon Sep 17 00:00:00 2001
From: Sami Tolvanen <samitolvanen@google.com>
Date: Thu, 8 Apr 2021 11:28:34 -0700
Subject: [PATCH 0560/1750] treewide: Change list_sort to use const pointers

[ Upstream commit 4f0f586bf0c898233d8f316f471a21db2abd522d ]

list_sort() internally casts the comparison function passed to it
to a different type with constant struct list_head pointers, and
uses this pointer to call the functions, which trips indirect call
Control-Flow Integrity (CFI) checking.

Instead of removing the consts, this change defines the
list_cmp_func_t type and changes the comparison function types of
all list_sort() callers to use const pointers, thus avoiding type
mismatches.

Suggested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210408182843.1754385-10-samitolvanen@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kvm/vgic/vgic-its.c                  |  8 ++++----
 arch/arm64/kvm/vgic/vgic.c                      |  3 ++-
 block/blk-mq-sched.c                            |  3 ++-
 block/blk-mq.c                                  |  3 ++-
 drivers/acpi/nfit/core.c                        |  3 ++-
 drivers/acpi/numa/hmat.c                        |  3 ++-
 drivers/clk/keystone/sci-clk.c                  |  4 ++--
 drivers/gpu/drm/drm_modes.c                     |  3 ++-
 drivers/gpu/drm/i915/gt/intel_engine_user.c     |  3 ++-
 drivers/gpu/drm/i915/gvt/debugfs.c              |  2 +-
 drivers/gpu/drm/i915/selftests/i915_gem_gtt.c   |  3 ++-
 drivers/gpu/drm/radeon/radeon_cs.c              |  4 ++--
 .../hw/usnic/usnic_uiom_interval_tree.c         |  3 ++-
 drivers/interconnect/qcom/bcm-voter.c           |  2 +-
 drivers/md/raid5.c                              |  3 ++-
 drivers/misc/sram.c                             |  4 ++--
 drivers/nvme/host/core.c                        |  3 ++-
 .../pci/controller/cadence/pcie-cadence-host.c  |  3 ++-
 drivers/spi/spi-loopback-test.c                 |  3 ++-
 fs/btrfs/raid56.c                               |  3 ++-
 fs/btrfs/tree-log.c                             |  3 ++-
 fs/btrfs/volumes.c                              |  3 ++-
 fs/ext4/fsmap.c                                 |  4 ++--
 fs/gfs2/glock.c                                 |  3 ++-
 fs/gfs2/log.c                                   |  2 +-
 fs/gfs2/lops.c                                  |  3 ++-
 fs/iomap/buffered-io.c                          |  3 ++-
 fs/ubifs/gc.c                                   |  7 ++++---
 fs/ubifs/replay.c                               |  4 ++--
 fs/xfs/scrub/bitmap.c                           |  4 ++--
 fs/xfs/xfs_bmap_item.c                          |  4 ++--
 fs/xfs/xfs_buf.c                                |  6 +++---
 fs/xfs/xfs_extent_busy.c                        |  4 ++--
 fs/xfs/xfs_extent_busy.h                        |  3 ++-
 fs/xfs/xfs_extfree_item.c                       |  4 ++--
 fs/xfs/xfs_refcount_item.c                      |  4 ++--
 fs/xfs/xfs_rmap_item.c                          |  4 ++--
 include/linux/list_sort.h                       |  7 ++++---
 lib/list_sort.c                                 | 17 ++++++-----------
 lib/test_list_sort.c                            |  3 ++-
 net/tipc/name_table.c                           |  4 ++--
 41 files changed, 90 insertions(+), 72 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
index 40cbaca81333..b9518f94bd43 100644
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -2190,8 +2190,8 @@ static int vgic_its_restore_ite(struct vgic_its *its, u32 event_id,
 	return offset;
 }
 
-static int vgic_its_ite_cmp(void *priv, struct list_head *a,
-			    struct list_head *b)
+static int vgic_its_ite_cmp(void *priv, const struct list_head *a,
+			    const struct list_head *b)
 {
 	struct its_ite *itea = container_of(a, struct its_ite, ite_list);
 	struct its_ite *iteb = container_of(b, struct its_ite, ite_list);
@@ -2329,8 +2329,8 @@ static int vgic_its_restore_dte(struct vgic_its *its, u32 id,
 	return offset;
 }
 
-static int vgic_its_device_cmp(void *priv, struct list_head *a,
-			       struct list_head *b)
+static int vgic_its_device_cmp(void *priv, const struct list_head *a,
+			       const struct list_head *b)
 {
 	struct its_device *deva = container_of(a, struct its_device, dev_list);
 	struct its_device *devb = container_of(b, struct its_device, dev_list);
diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index c3643b7f101b..4abf7a867b65 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -255,7 +255,8 @@ static struct kvm_vcpu *vgic_target_oracle(struct vgic_irq *irq)
  * Return negative if "a" sorts before "b", 0 to preserve order, and positive
  * to sort "b" before "a".
  */
-static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int vgic_irq_cmp(void *priv, const struct list_head *a,
+			const struct list_head *b)
 {
 	struct vgic_irq *irqa = container_of(a, struct vgic_irq, ap_list);
 	struct vgic_irq *irqb = container_of(b, struct vgic_irq, ap_list);
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 581be65a53c1..24c08963890e 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -75,7 +75,8 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
 	blk_mq_run_hw_queue(hctx, true);
 }
 
-static int sched_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int sched_rq_cmp(void *priv, const struct list_head *a,
+			const struct list_head *b)
 {
 	struct request *rqa = container_of(a, struct request, queuelist);
 	struct request *rqb = container_of(b, struct request, queuelist);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 6dcb86c1c985..eed9a4c1519d 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1866,7 +1866,8 @@ void blk_mq_insert_requests(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx,
 	spin_unlock(&ctx->lock);
 }
 
-static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int plug_rq_cmp(void *priv, const struct list_head *a,
+		       const struct list_head *b)
 {
 	struct request *rqa = container_of(a, struct request, queuelist);
 	struct request *rqb = container_of(b, struct request, queuelist);
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index cb18cb5c51b1..d061bff5cc96 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1194,7 +1194,8 @@ static int __nfit_mem_init(struct acpi_nfit_desc *acpi_desc,
 	return 0;
 }
 
-static int nfit_mem_cmp(void *priv, struct list_head *_a, struct list_head *_b)
+static int nfit_mem_cmp(void *priv, const struct list_head *_a,
+		const struct list_head *_b)
 {
 	struct nfit_mem *a = container_of(_a, typeof(*a), list);
 	struct nfit_mem *b = container_of(_b, typeof(*b), list);
diff --git a/drivers/acpi/numa/hmat.c b/drivers/acpi/numa/hmat.c
index cb73a5d6ea76..137a5dd880c2 100644
--- a/drivers/acpi/numa/hmat.c
+++ b/drivers/acpi/numa/hmat.c
@@ -558,7 +558,8 @@ static bool hmat_update_best(u8 type, u32 value, u32 *best)
 	return updated;
 }
 
-static int initiator_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int initiator_cmp(void *priv, const struct list_head *a,
+			 const struct list_head *b)
 {
 	struct memory_initiator *ia;
 	struct memory_initiator *ib;
diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c
index aaf31abe1c8f..7e1b136e71ae 100644
--- a/drivers/clk/keystone/sci-clk.c
+++ b/drivers/clk/keystone/sci-clk.c
@@ -503,8 +503,8 @@ static int ti_sci_scan_clocks_from_fw(struct sci_clk_provider *provider)
 
 #else
 
-static int _cmp_sci_clk_list(void *priv, struct list_head *a,
-			     struct list_head *b)
+static int _cmp_sci_clk_list(void *priv, const struct list_head *a,
+			     const struct list_head *b)
 {
 	struct sci_clk *ca = container_of(a, struct sci_clk, node);
 	struct sci_clk *cb = container_of(b, struct sci_clk, node);
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 511cde5c7fa6..0f99e5453f15 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1290,7 +1290,8 @@ EXPORT_SYMBOL(drm_mode_prune_invalid);
  * Negative if @lh_a is better than @lh_b, zero if they're equivalent, or
  * positive if @lh_b is better than @lh_a.
  */
-static int drm_mode_compare(void *priv, struct list_head *lh_a, struct list_head *lh_b)
+static int drm_mode_compare(void *priv, const struct list_head *lh_a,
+			    const struct list_head *lh_b)
 {
 	struct drm_display_mode *a = list_entry(lh_a, struct drm_display_mode, head);
 	struct drm_display_mode *b = list_entry(lh_b, struct drm_display_mode, head);
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_user.c b/drivers/gpu/drm/i915/gt/intel_engine_user.c
index 34e6096f196e..da21d2a10cc9 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_user.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_user.c
@@ -49,7 +49,8 @@ static const u8 uabi_classes[] = {
 	[VIDEO_ENHANCEMENT_CLASS] = I915_ENGINE_CLASS_VIDEO_ENHANCE,
 };
 
-static int engine_cmp(void *priv, struct list_head *A, struct list_head *B)
+static int engine_cmp(void *priv, const struct list_head *A,
+		      const struct list_head *B)
 {
 	const struct intel_engine_cs *a =
 		container_of((struct rb_node *)A, typeof(*a), uabi_node);
diff --git a/drivers/gpu/drm/i915/gvt/debugfs.c b/drivers/gpu/drm/i915/gvt/debugfs.c
index 62e6a14ad58e..9f1c209d9251 100644
--- a/drivers/gpu/drm/i915/gvt/debugfs.c
+++ b/drivers/gpu/drm/i915/gvt/debugfs.c
@@ -41,7 +41,7 @@ struct diff_mmio {
 
 /* Compare two diff_mmio items. */
 static int mmio_offset_compare(void *priv,
-	struct list_head *a, struct list_head *b)
+	const struct list_head *a, const struct list_head *b)
 {
 	struct diff_mmio *ma;
 	struct diff_mmio *mb;
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
index 713770fb2b92..65e28c4cd4ce 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
@@ -1075,7 +1075,8 @@ static int igt_ppgtt_shrink_boom(void *arg)
 	return exercise_ppgtt(arg, shrink_boom);
 }
 
-static int sort_holes(void *priv, struct list_head *A, struct list_head *B)
+static int sort_holes(void *priv, const struct list_head *A,
+		      const struct list_head *B)
 {
 	struct drm_mm_node *a = list_entry(A, typeof(*a), hole_stack);
 	struct drm_mm_node *b = list_entry(B, typeof(*b), hole_stack);
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 21ce2f9502c0..a78b60b62caf 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -394,8 +394,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
 	return 0;
 }
 
-static int cmp_size_smaller_first(void *priv, struct list_head *a,
-				  struct list_head *b)
+static int cmp_size_smaller_first(void *priv, const struct list_head *a,
+				  const struct list_head *b)
 {
 	struct radeon_bo_list *la = list_entry(a, struct radeon_bo_list, tv.head);
 	struct radeon_bo_list *lb = list_entry(b, struct radeon_bo_list, tv.head);
diff --git a/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c b/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c
index d399523206c7..29d71267af78 100644
--- a/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c
+++ b/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c
@@ -83,7 +83,8 @@ usnic_uiom_interval_node_alloc(long int start, long int last, int ref_cnt,
 	return interval;
 }
 
-static int interval_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int interval_cmp(void *priv, const struct list_head *a,
+			const struct list_head *b)
 {
 	struct usnic_uiom_interval_node *node_a, *node_b;
 
diff --git a/drivers/interconnect/qcom/bcm-voter.c b/drivers/interconnect/qcom/bcm-voter.c
index dd0e3bd50b94..3c0809095a31 100644
--- a/drivers/interconnect/qcom/bcm-voter.c
+++ b/drivers/interconnect/qcom/bcm-voter.c
@@ -39,7 +39,7 @@ struct bcm_voter {
 	u32 tcs_wait;
 };
 
-static int cmp_vcd(void *priv, struct list_head *a, struct list_head *b)
+static int cmp_vcd(void *priv, const struct list_head *a, const struct list_head *b)
 {
 	const struct qcom_icc_bcm *bcm_a =
 			list_entry(a, struct qcom_icc_bcm, list);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 39343479ac2a..c82953a3299e 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -953,7 +953,8 @@ static void dispatch_bio_list(struct bio_list *tmp)
 		submit_bio_noacct(bio);
 }
 
-static int cmp_stripe(void *priv, struct list_head *a, struct list_head *b)
+static int cmp_stripe(void *priv, const struct list_head *a,
+		      const struct list_head *b)
 {
 	const struct r5pending_data *da = list_entry(a,
 				struct r5pending_data, sibling);
diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index 6c1a23cb3e8c..202bf951e909 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -144,8 +144,8 @@ static void sram_free_partitions(struct sram_dev *sram)
 	}
 }
 
-static int sram_reserve_cmp(void *priv, struct list_head *a,
-					struct list_head *b)
+static int sram_reserve_cmp(void *priv, const struct list_head *a,
+					const struct list_head *b)
 {
 	struct sram_reserve *ra = list_entry(a, struct sram_reserve, list);
 	struct sram_reserve *rb = list_entry(b, struct sram_reserve, list);
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 5a9b2f1b1418..9c97628519e0 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3801,7 +3801,8 @@ static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid,
 	return ret;
 }
 
-static int ns_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int ns_cmp(void *priv, const struct list_head *a,
+		const struct list_head *b)
 {
 	struct nvme_ns *nsa = container_of(a, struct nvme_ns, list);
 	struct nvme_ns *nsb = container_of(b, struct nvme_ns, list);
diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index a40ed9e12b4b..fb96d37a135c 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -345,7 +345,8 @@ static int cdns_pcie_host_bar_config(struct cdns_pcie_rc *rc,
 	return 0;
 }
 
-static int cdns_pcie_host_dma_ranges_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int cdns_pcie_host_dma_ranges_cmp(void *priv, const struct list_head *a,
+					 const struct list_head *b)
 {
 	struct resource_entry *entry1, *entry2;
 
diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
index 89b91cdfb2a5..4d4f77a186a9 100644
--- a/drivers/spi/spi-loopback-test.c
+++ b/drivers/spi/spi-loopback-test.c
@@ -454,7 +454,8 @@ struct rx_ranges {
 	u8 *end;
 };
 
-static int rx_ranges_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int rx_ranges_cmp(void *priv, const struct list_head *a,
+			 const struct list_head *b)
 {
 	struct rx_ranges *rx_a = list_entry(a, struct rx_ranges, list);
 	struct rx_ranges *rx_b = list_entry(b, struct rx_ranges, list);
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index 9d33bf0154ab..e65d0fabb83e 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1646,7 +1646,8 @@ struct btrfs_plug_cb {
 /*
  * rbios on the plug list are sorted for easier merging.
  */
-static int plug_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int plug_cmp(void *priv, const struct list_head *a,
+		    const struct list_head *b)
 {
 	struct btrfs_raid_bio *ra = container_of(a, struct btrfs_raid_bio,
 						 plug_list);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index ec25e5eab349..7bf3936aceda 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4070,7 +4070,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
 	return ret;
 }
 
-static int extent_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int extent_cmp(void *priv, const struct list_head *a,
+		      const struct list_head *b)
 {
 	struct extent_map *em1, *em2;
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 509811aabb3f..d8b8764f5bd1 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1226,7 +1226,8 @@ static int open_fs_devices(struct btrfs_fs_devices *fs_devices,
 	return 0;
 }
 
-static int devid_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int devid_cmp(void *priv, const struct list_head *a,
+		     const struct list_head *b)
 {
 	struct btrfs_device *dev1, *dev2;
 
diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
index 4c2a9fe30067..4493ef0c715e 100644
--- a/fs/ext4/fsmap.c
+++ b/fs/ext4/fsmap.c
@@ -354,8 +354,8 @@ static unsigned int ext4_getfsmap_find_sb(struct super_block *sb,
 
 /* Compare two fsmap items. */
 static int ext4_getfsmap_compare(void *priv,
-				 struct list_head *a,
-				 struct list_head *b)
+				 const struct list_head *a,
+				 const struct list_head *b)
 {
 	struct ext4_fsmap *fa;
 	struct ext4_fsmap *fb;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index cd43c481df4b..03c3407c8e26 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1744,7 +1744,8 @@ void gfs2_glock_complete(struct gfs2_glock *gl, int ret)
 	spin_unlock(&gl->gl_lockref.lock);
 }
 
-static int glock_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int glock_cmp(void *priv, const struct list_head *a,
+		     const struct list_head *b)
 {
 	struct gfs2_glock *gla, *glb;
 
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 1955dea999f7..7473b894e3c6 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -605,7 +605,7 @@ void log_flush_wait(struct gfs2_sbd *sdp)
 	}
 }
 
-static int ip_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int ip_cmp(void *priv, const struct list_head *a, const struct list_head *b)
 {
 	struct gfs2_inode *ipa, *ipb;
 
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 3922b26264f5..383ac2190ded 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -627,7 +627,8 @@ static void gfs2_check_magic(struct buffer_head *bh)
 	kunmap_atomic(kaddr);
 }
 
-static int blocknr_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int blocknr_cmp(void *priv, const struct list_head *a,
+		       const struct list_head *b)
 {
 	struct gfs2_bufdata *bda, *bdb;
 
diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index caed9d98c64a..cd9f7baa5bb7 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -1155,7 +1155,8 @@ iomap_ioend_try_merge(struct iomap_ioend *ioend, struct list_head *more_ioends,
 EXPORT_SYMBOL_GPL(iomap_ioend_try_merge);
 
 static int
-iomap_ioend_compare(void *priv, struct list_head *a, struct list_head *b)
+iomap_ioend_compare(void *priv, const struct list_head *a,
+		const struct list_head *b)
 {
 	struct iomap_ioend *ia = container_of(a, struct iomap_ioend, io_list);
 	struct iomap_ioend *ib = container_of(b, struct iomap_ioend, io_list);
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index a4aaeea63893..dc3e26e9ed7b 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -102,7 +102,8 @@ static int switch_gc_head(struct ubifs_info *c)
  * This function compares data nodes @a and @b. Returns %1 if @a has greater
  * inode or block number, and %-1 otherwise.
  */
-static int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int data_nodes_cmp(void *priv, const struct list_head *a,
+			  const struct list_head *b)
 {
 	ino_t inuma, inumb;
 	struct ubifs_info *c = priv;
@@ -145,8 +146,8 @@ static int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
  * first and sorted by length in descending order. Directory entry nodes go
  * after inode nodes and are sorted in ascending hash valuer order.
  */
-static int nondata_nodes_cmp(void *priv, struct list_head *a,
-			     struct list_head *b)
+static int nondata_nodes_cmp(void *priv, const struct list_head *a,
+			     const struct list_head *b)
 {
 	ino_t inuma, inumb;
 	struct ubifs_info *c = priv;
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index 1c6fc99fca30..b2f5563d1489 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -299,8 +299,8 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
  * entries @a and @b by comparing their sequence numer.  Returns %1 if @a has
  * greater sequence number and %-1 otherwise.
  */
-static int replay_entries_cmp(void *priv, struct list_head *a,
-			      struct list_head *b)
+static int replay_entries_cmp(void *priv, const struct list_head *a,
+			      const struct list_head *b)
 {
 	struct ubifs_info *c = priv;
 	struct replay_entry *ra, *rb;
diff --git a/fs/xfs/scrub/bitmap.c b/fs/xfs/scrub/bitmap.c
index f88694f22d05..813b5f219113 100644
--- a/fs/xfs/scrub/bitmap.c
+++ b/fs/xfs/scrub/bitmap.c
@@ -63,8 +63,8 @@ xbitmap_init(
 static int
 xbitmap_range_cmp(
 	void			*priv,
-	struct list_head	*a,
-	struct list_head	*b)
+	const struct list_head	*a,
+	const struct list_head	*b)
 {
 	struct xbitmap_range	*ap;
 	struct xbitmap_range	*bp;
diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index 9e16a4d0f97c..984bb480f177 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -265,8 +265,8 @@ xfs_trans_log_finish_bmap_update(
 static int
 xfs_bmap_update_diff_items(
 	void				*priv,
-	struct list_head		*a,
-	struct list_head		*b)
+	const struct list_head		*a,
+	const struct list_head		*b)
 {
 	struct xfs_bmap_intent		*ba;
 	struct xfs_bmap_intent		*bb;
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 4e4cf91f4f9f..118819030dbb 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -2114,9 +2114,9 @@ xfs_buf_delwri_queue(
  */
 static int
 xfs_buf_cmp(
-	void		*priv,
-	struct list_head *a,
-	struct list_head *b)
+	void			*priv,
+	const struct list_head	*a,
+	const struct list_head	*b)
 {
 	struct xfs_buf	*ap = container_of(a, struct xfs_buf, b_list);
 	struct xfs_buf	*bp = container_of(b, struct xfs_buf, b_list);
diff --git a/fs/xfs/xfs_extent_busy.c b/fs/xfs/xfs_extent_busy.c
index 3991e59cfd18..5c2695a42de1 100644
--- a/fs/xfs/xfs_extent_busy.c
+++ b/fs/xfs/xfs_extent_busy.c
@@ -643,8 +643,8 @@ xfs_extent_busy_wait_all(
 int
 xfs_extent_busy_ag_cmp(
 	void			*priv,
-	struct list_head	*l1,
-	struct list_head	*l2)
+	const struct list_head	*l1,
+	const struct list_head	*l2)
 {
 	struct xfs_extent_busy	*b1 =
 		container_of(l1, struct xfs_extent_busy, list);
diff --git a/fs/xfs/xfs_extent_busy.h b/fs/xfs/xfs_extent_busy.h
index 990ab3891971..8aea07100092 100644
--- a/fs/xfs/xfs_extent_busy.h
+++ b/fs/xfs/xfs_extent_busy.h
@@ -58,7 +58,8 @@ void
 xfs_extent_busy_wait_all(struct xfs_mount *mp);
 
 int
-xfs_extent_busy_ag_cmp(void *priv, struct list_head *a, struct list_head *b);
+xfs_extent_busy_ag_cmp(void *priv, const struct list_head *a,
+	const struct list_head *b);
 
 static inline void xfs_extent_busy_sort(struct list_head *list)
 {
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 6c11bfc3d452..5c0395256bd1 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -397,8 +397,8 @@ xfs_trans_free_extent(
 static int
 xfs_extent_free_diff_items(
 	void				*priv,
-	struct list_head		*a,
-	struct list_head		*b)
+	const struct list_head		*a,
+	const struct list_head		*b)
 {
 	struct xfs_mount		*mp = priv;
 	struct xfs_extent_free_item	*ra;
diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index 7529eb63ce94..0dee316283a9 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -269,8 +269,8 @@ xfs_trans_log_finish_refcount_update(
 static int
 xfs_refcount_update_diff_items(
 	void				*priv,
-	struct list_head		*a,
-	struct list_head		*b)
+	const struct list_head		*a,
+	const struct list_head		*b)
 {
 	struct xfs_mount		*mp = priv;
 	struct xfs_refcount_intent	*ra;
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 7adc996ca6e3..20905953fe76 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -337,8 +337,8 @@ xfs_trans_log_finish_rmap_update(
 static int
 xfs_rmap_update_diff_items(
 	void				*priv,
-	struct list_head		*a,
-	struct list_head		*b)
+	const struct list_head		*a,
+	const struct list_head		*b)
 {
 	struct xfs_mount		*mp = priv;
 	struct xfs_rmap_intent		*ra;
diff --git a/include/linux/list_sort.h b/include/linux/list_sort.h
index 20f178c24e9d..453105f74e05 100644
--- a/include/linux/list_sort.h
+++ b/include/linux/list_sort.h
@@ -6,8 +6,9 @@
 
 struct list_head;
 
+typedef int __attribute__((nonnull(2,3))) (*list_cmp_func_t)(void *,
+		const struct list_head *, const struct list_head *);
+
 __attribute__((nonnull(2,3)))
-void list_sort(void *priv, struct list_head *head,
-	       int (*cmp)(void *priv, struct list_head *a,
-			  struct list_head *b));
+void list_sort(void *priv, struct list_head *head, list_cmp_func_t cmp);
 #endif
diff --git a/lib/list_sort.c b/lib/list_sort.c
index 52f0c258c895..a926d96ffd44 100644
--- a/lib/list_sort.c
+++ b/lib/list_sort.c
@@ -7,16 +7,13 @@
 #include <linux/list_sort.h>
 #include <linux/list.h>
 
-typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
-		struct list_head const *, struct list_head const *);
-
 /*
  * Returns a list organized in an intermediate format suited
  * to chaining of merge() calls: null-terminated, no reserved or
  * sentinel head node, "prev" links not maintained.
  */
 __attribute__((nonnull(2,3,4)))
-static struct list_head *merge(void *priv, cmp_func cmp,
+static struct list_head *merge(void *priv, list_cmp_func_t cmp,
 				struct list_head *a, struct list_head *b)
 {
 	struct list_head *head, **tail = &head;
@@ -52,7 +49,7 @@ static struct list_head *merge(void *priv, cmp_func cmp,
  * throughout.
  */
 __attribute__((nonnull(2,3,4,5)))
-static void merge_final(void *priv, cmp_func cmp, struct list_head *head,
+static void merge_final(void *priv, list_cmp_func_t cmp, struct list_head *head,
 			struct list_head *a, struct list_head *b)
 {
 	struct list_head *tail = head;
@@ -185,9 +182,7 @@ static void merge_final(void *priv, cmp_func cmp, struct list_head *head,
  * 2^(k+1) - 1 (second merge of case 5 when x == 2^(k-1) - 1).
  */
 __attribute__((nonnull(2,3)))
-void list_sort(void *priv, struct list_head *head,
-		int (*cmp)(void *priv, struct list_head *a,
-			struct list_head *b))
+void list_sort(void *priv, struct list_head *head, list_cmp_func_t cmp)
 {
 	struct list_head *list = head->next, *pending = NULL;
 	size_t count = 0;	/* Count of pending */
@@ -227,7 +222,7 @@ void list_sort(void *priv, struct list_head *head,
 		if (likely(bits)) {
 			struct list_head *a = *tail, *b = a->prev;
 
-			a = merge(priv, (cmp_func)cmp, b, a);
+			a = merge(priv, cmp, b, a);
 			/* Install the merged result in place of the inputs */
 			a->prev = b->prev;
 			*tail = a;
@@ -249,10 +244,10 @@ void list_sort(void *priv, struct list_head *head,
 
 		if (!next)
 			break;
-		list = merge(priv, (cmp_func)cmp, pending, list);
+		list = merge(priv, cmp, pending, list);
 		pending = next;
 	}
 	/* The final merge, rebuilding prev links */
-	merge_final(priv, (cmp_func)cmp, head, pending, list);
+	merge_final(priv, cmp, head, pending, list);
 }
 EXPORT_SYMBOL(list_sort);
diff --git a/lib/test_list_sort.c b/lib/test_list_sort.c
index 1f017d3b610e..00daaf23316f 100644
--- a/lib/test_list_sort.c
+++ b/lib/test_list_sort.c
@@ -56,7 +56,8 @@ static int __init check(struct debug_el *ela, struct debug_el *elb)
 	return 0;
 }
 
-static int __init cmp(void *priv, struct list_head *a, struct list_head *b)
+static int __init cmp(void *priv, const struct list_head *a,
+		      const struct list_head *b)
 {
 	struct debug_el *ela, *elb;
 
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index 2ac33d32edc2..f6a6acef4223 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -381,8 +381,8 @@ static struct publication *tipc_service_remove_publ(struct service_range *sr,
  * Code reused: time_after32() for the same purpose
  */
 #define publication_after(pa, pb) time_after32((pa)->id, (pb)->id)
-static int tipc_publ_sort(void *priv, struct list_head *a,
-			  struct list_head *b)
+static int tipc_publ_sort(void *priv, const struct list_head *a,
+			  const struct list_head *b)
 {
 	struct publication *pa, *pb;
 

From 215df4349916a62a03b1899ded08e7a9d2d40480 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Tue, 14 Sep 2021 08:38:20 +0200
Subject: [PATCH 0561/1750] nvme: keep ctrl->namespaces ordered

[ Upstream commit 298ba0e3d4af539cc37f982d4c011a0f07fca48c ]

Various places in the nvme code that rely on ctrl->namespace to be
ordered.  Ensure that the namespae is inserted into the list at the
right position from the start instead of sorting it after the fact.

Fixes: 540c801c65eb ("NVMe: Implement namespace list scanning")
Reported-by: Anton Eidelman <anton.eidelman@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/core.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 9c97628519e0..bbc3efef5027 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -13,7 +13,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/backing-dev.h>
-#include <linux/list_sort.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/pr.h>
@@ -3801,15 +3800,6 @@ static int nvme_init_ns_head(struct nvme_ns *ns, unsigned nsid,
 	return ret;
 }
 
-static int ns_cmp(void *priv, const struct list_head *a,
-		const struct list_head *b)
-{
-	struct nvme_ns *nsa = container_of(a, struct nvme_ns, list);
-	struct nvme_ns *nsb = container_of(b, struct nvme_ns, list);
-
-	return nsa->head->ns_id - nsb->head->ns_id;
-}
-
 struct nvme_ns *nvme_find_get_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 {
 	struct nvme_ns *ns, *ret = NULL;
@@ -3830,6 +3820,22 @@ struct nvme_ns *nvme_find_get_ns(struct nvme_ctrl *ctrl, unsigned nsid)
 }
 EXPORT_SYMBOL_NS_GPL(nvme_find_get_ns, NVME_TARGET_PASSTHRU);
 
+/*
+ * Add the namespace to the controller list while keeping the list ordered.
+ */
+static void nvme_ns_add_to_ctrl_list(struct nvme_ns *ns)
+{
+	struct nvme_ns *tmp;
+
+	list_for_each_entry_reverse(tmp, &ns->ctrl->namespaces, list) {
+		if (tmp->head->ns_id < ns->head->ns_id) {
+			list_add(&ns->list, &tmp->list);
+			return;
+		}
+	}
+	list_add(&ns->list, &ns->ctrl->namespaces);
+}
+
 static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid,
 		struct nvme_ns_ids *ids)
 {
@@ -3889,9 +3895,8 @@ static void nvme_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid,
 	}
 
 	down_write(&ctrl->namespaces_rwsem);
-	list_add_tail(&ns->list, &ctrl->namespaces);
+	nvme_ns_add_to_ctrl_list(ns);
 	up_write(&ctrl->namespaces_rwsem);
-
 	nvme_get_ctrl(ctrl);
 
 	device_add_disk(ctrl->device, ns->disk, nvme_ns_id_attr_groups);
@@ -4160,10 +4165,6 @@ static void nvme_scan_work(struct work_struct *work)
 	if (nvme_scan_ns_list(ctrl) != 0)
 		nvme_scan_ns_sequential(ctrl);
 	mutex_unlock(&ctrl->scan_lock);
-
-	down_write(&ctrl->namespaces_rwsem);
-	list_sort(NULL, &ctrl->namespaces, ns_cmp);
-	up_write(&ctrl->namespaces_rwsem);
 }
 
 /*

From 8cba4c2698e282aa03948b74ebc259925c873402 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 16 Sep 2021 16:13:42 +0300
Subject: [PATCH 0562/1750] thermal/core: Potential buffer overflow in
 thermal_build_list_of_policies()

[ Upstream commit 1bb30b20b49773369c299d4d6c65227201328663 ]

After printing the list of thermal governors, then this function prints
a newline character.  The problem is that "size" has not been updated
after printing the last governor.  This means that it can write one
character (the NUL terminator) beyond the end of the buffer.

Get rid of the "size" variable and just use "PAGE_SIZE - count" directly.

Fixes: 1b4f48494eb2 ("thermal: core: group functions related to governor handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210916131342.GB25094@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/thermal_core.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index e669f83faa3c..17de8a9b991e 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -224,15 +224,14 @@ int thermal_build_list_of_policies(char *buf)
 {
 	struct thermal_governor *pos;
 	ssize_t count = 0;
-	ssize_t size = PAGE_SIZE;
 
 	mutex_lock(&thermal_governor_lock);
 
 	list_for_each_entry(pos, &thermal_governor_list, governor_list) {
-		size = PAGE_SIZE - count;
-		count += scnprintf(buf + count, size, "%s ", pos->name);
+		count += scnprintf(buf + count, PAGE_SIZE - count, "%s ",
+				   pos->name);
 	}
-	count += scnprintf(buf + count, size, "\n");
+	count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
 
 	mutex_unlock(&thermal_governor_lock);
 

From 3d42ed6b790555c02483545865696d7443eca9b7 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 21 Sep 2021 23:33:35 +0300
Subject: [PATCH 0563/1750] cifs: fix a sign extension bug

[ Upstream commit e946d3c887a9dc33aa82a349c6284f4a084163f4 ]

The problem is the mismatched types between "ctx->total_len" which is
an unsigned int, "rc" which is an int, and "ctx->rc" which is a
ssize_t.  The code does:

	ctx->rc = (rc == 0) ? ctx->total_len : rc;

We want "ctx->rc" to store the negative "rc" error code.  But what
happens is that "rc" is type promoted to a high unsigned int and
'ctx->rc" will store the high positive value instead of a negative
value.

The fix is to change "rc" from an int to a ssize_t.

Fixes: c610c4b619e5 ("CIFS: Add asynchronous write support through kernel AIO")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index f46904a4ead3..67139f9d583f 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -3039,7 +3039,7 @@ static void collect_uncached_write_data(struct cifs_aio_ctx *ctx)
 	struct cifs_tcon *tcon;
 	struct cifs_sb_info *cifs_sb;
 	struct dentry *dentry = ctx->cfile->dentry;
-	int rc;
+	ssize_t rc;
 
 	tcon = tlink_tcon(ctx->cfile->tlink);
 	cifs_sb = CIFS_SB(dentry->d_sb);

From cb948b158a868a5c46b40e95ffafecf1eb82b589 Mon Sep 17 00:00:00 2001
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
Date: Wed, 15 Sep 2021 18:32:39 +0300
Subject: [PATCH 0564/1750] scsi: qla2xxx: Restore initiator in dual mode

[ Upstream commit 5f8579038842d77e6ce05e1df6bf9dd493b0e3ef ]

In dual mode in case of disabling the target, the whole port goes offline
and initiator is turned off too.

Fix restoring initiator mode after disabling target in dual mode.

Link: https://lore.kernel.org/r/20210915153239.8035-1-d.bogdanov@yadro.com
Fixes: 0645cb8350cd ("scsi: qla2xxx: Add mode control for each physical port")
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 6faf34fa6220..b7aac3116f2d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -6934,7 +6934,8 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
 				return 0;
 			break;
 		case QLA2XXX_INI_MODE_DUAL:
-			if (!qla_dual_mode_enabled(vha))
+			if (!qla_dual_mode_enabled(vha) &&
+			    !qla_ini_mode_enabled(vha))
 				return 0;
 			break;
 		case QLA2XXX_INI_MODE_ENABLED:

From 0595fc4794c3b0ac9c88d7c609d66c71ba9811b5 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 16 Sep 2021 16:23:31 +0300
Subject: [PATCH 0565/1750] scsi: lpfc: Use correct scnprintf() limit

[ Upstream commit 6dacc371b77f473770ec646e220303a84fe96c11 ]

The limit should be "PAGE_SIZE - len" instead of "PAGE_SIZE".  We're not
going to hit the limit so this fix will not affect runtime.

Link: https://lore.kernel.org/r/20210916132331.GE25094@kili
Fixes: 5b9e70b22cc5 ("scsi: lpfc: raise sg count for nvme to use available sg resources")
Reviewed-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/lpfc/lpfc_attr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index bdea2867516c..2c59a5bf3539 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -6005,7 +6005,8 @@ lpfc_sg_seg_cnt_show(struct device *dev, struct device_attribute *attr,
 	len = scnprintf(buf, PAGE_SIZE, "SGL sz: %d  total SGEs: %d\n",
 		       phba->cfg_sg_dma_buf_size, phba->cfg_total_seg_cnt);
 
-	len += scnprintf(buf + len, PAGE_SIZE, "Cfg: %d  SCSI: %d  NVME: %d\n",
+	len += scnprintf(buf + len, PAGE_SIZE - len,
+			"Cfg: %d  SCSI: %d  NVME: %d\n",
 			phba->cfg_sg_seg_cnt, phba->cfg_scsi_seg_cnt,
 			phba->cfg_nvme_seg_cnt);
 	return len;

From af7c9ffe2beefa1e1674836be38fd83585114d73 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 5 Sep 2021 09:25:19 -0700
Subject: [PATCH 0566/1750] irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to
 fix build

[ Upstream commit 969ac78db78c723a24e9410666b457cc1b0cb3c3 ]

irq-goldfish-pic uses GENERIC_IRQ_CHIP interfaces so select that symbol
to fix build errors.

Fixes these build errors:

mips-linux-ld: drivers/irqchip/irq-goldfish-pic.o: in function `goldfish_pic_of_init':
irq-goldfish-pic.c:(.init.text+0xc0): undefined reference to `irq_alloc_generic_chip'
mips-linux-ld: irq-goldfish-pic.c:(.init.text+0xf4): undefined reference to `irq_gc_unmask_enable_reg'
mips-linux-ld: irq-goldfish-pic.c:(.init.text+0xf8): undefined reference to `irq_gc_unmask_enable_reg'
mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x100): undefined reference to `irq_gc_mask_disable_reg'
mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x104): undefined reference to `irq_gc_mask_disable_reg'
mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x11c): undefined reference to `irq_setup_generic_chip'
mips-linux-ld: irq-goldfish-pic.c:(.init.text+0x168): undefined reference to `irq_remove_generic_chip'

Fixes: 4235ff50cf98 ("irqchip/irq-goldfish-pic: Add Goldfish PIC driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Miodrag Dinic <miodrag.dinic@mips.com>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Goran Ferenc <goran.ferenc@mips.com>
Cc: Aleksandar Markovic <aleksandar.markovic@mips.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210905162519.21507-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig
index 6156a065681b..dc062e8c2caf 100644
--- a/drivers/irqchip/Kconfig
+++ b/drivers/irqchip/Kconfig
@@ -425,6 +425,7 @@ config MESON_IRQ_GPIO
 config GOLDFISH_PIC
        bool "Goldfish programmable interrupt controller"
        depends on MIPS && (GOLDFISH || COMPILE_TEST)
+       select GENERIC_IRQ_CHIP
        select IRQ_DOMAIN
        help
          Say yes here to enable Goldfish interrupt controller driver used

From 568662e37f927e3dc3e475f3ff7cf4ab7719c5e7 Mon Sep 17 00:00:00 2001
From: Kaige Fu <kaige.fu@linux.alibaba.com>
Date: Wed, 15 Sep 2021 10:20:55 +0800
Subject: [PATCH 0567/1750] irqchip/gic-v3-its: Fix potential VPE leak on error

[ Upstream commit 280bef512933b2dda01d681d8cbe499b98fc5bdd ]

In its_vpe_irq_domain_alloc, when its_vpe_init() returns an error,
there is an off-by-one in the number of VPEs to be freed.

Fix it by simply passing the number of VPEs allocated, which is the
index of the loop iterating over the VPEs.

Fixes: 7d75bbb4bc1a ("irqchip/gic-v3-its: Add VPE irq domain allocation/teardown")
Signed-off-by: Kaige Fu <kaige.fu@linux.alibaba.com>
[maz: fixed commit message]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/d9e36dee512e63670287ed9eff884a5d8d6d27f2.1631672311.git.kaige.fu@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic-v3-its.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 4069c215328b..95e0b82b6c66 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -4489,7 +4489,7 @@ static int its_vpe_irq_domain_alloc(struct irq_domain *domain, unsigned int virq
 
 	if (err) {
 		if (i > 0)
-			its_vpe_irq_domain_free(domain, virq, i - 1);
+			its_vpe_irq_domain_free(domain, virq, i);
 
 		its_lpi_free(bitmap, base, nr_ids);
 		its_free_prop_table(vprop_page);

From b18ba3f477a2fdd12d2ca2e01d2bd874968714e2 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Wed, 1 Sep 2021 13:38:29 +0200
Subject: [PATCH 0568/1750] md: fix a lock order reversal in md_alloc

[ Upstream commit 7df835a32a8bedf7ce88efcfa7c9b245b52ff139 ]

Commit b0140891a8cea3 ("md: Fix race when creating a new md device.")
not only moved assigning mddev->gendisk before calling add_disk, which
fixes the races described in the commit log, but also added a
mddev->open_mutex critical section over add_disk and creation of the
md kobj.  Adding a kobject after add_disk is racy vs deleting the gendisk
right after adding it, but md already prevents against that by holding
a mddev->active reference.

On the other hand taking this lock added a lock order reversal with what
is not disk->open_mutex (used to be bdev->bd_mutex when the commit was
added) for partition devices, which need that lock for the internal open
for the partition scan, and a recent commit also takes it for
non-partitioned devices, leading to further lockdep splatter.

Fixes: b0140891a8ce ("md: Fix race when creating a new md device.")
Fixes: d62633873590 ("block: support delayed holder registration")
Reported-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com
Reviewed-by: NeilBrown <neilb@suse.de>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/md.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 288d26013de2..f16f190546ef 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5759,10 +5759,6 @@ static int md_alloc(dev_t dev, char *name)
 	disk->flags |= GENHD_FL_EXT_DEVT;
 	disk->events |= DISK_EVENT_MEDIA_CHANGE;
 	mddev->gendisk = disk;
-	/* As soon as we call add_disk(), another thread could get
-	 * through to md_open, so make sure it doesn't get too far
-	 */
-	mutex_lock(&mddev->open_mutex);
 	add_disk(disk);
 
 	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
@@ -5777,7 +5773,6 @@ static int md_alloc(dev_t dev, char *name)
 	if (mddev->kobj.sd &&
 	    sysfs_create_group(&mddev->kobj, &md_bitmap_group))
 		pr_debug("pointless warning\n");
-	mutex_unlock(&mddev->open_mutex);
  abort:
 	mutex_unlock(&disks_mutex);
 	if (!error && mddev->kobj.sd) {

From 54e85b6c287c1d4862c8b5a22646ad16eabcdb2e Mon Sep 17 00:00:00 2001
From: Dave Jiang <dave.jiang@intel.com>
Date: Thu, 7 Jan 2021 09:45:21 -0700
Subject: [PATCH 0569/1750] x86/asm: Add a missing __iomem annotation in
 enqcmds()

[ Upstream commit 5c99720b28381bb400d4f546734c34ddaf608761 ]

Add a missing __iomem annotation to address a sparse warning. The caller
is expected to pass an __iomem annotated pointer to this function. The
current usages send a 64-bytes command descriptor to an MMIO location
(portal) on a device for consumption.

Also, from the comment in movdir64b(), which also applies to enqcmds(),
@__dst must be supplied as an lvalue because this tells the compiler
what the object is (its size) the instruction accesses. I.e., not the
pointers but what they point to, thus the deref'ing '*'."

The actual sparse warning is:

  drivers/dma/idxd/submit.c: note: in included file (through arch/x86/include/asm/processor.h, \
	arch/x86/include/asm/timex.h, include/linux/timex.h, include/linux/time32.h, \
	include/linux/time.h, include/linux/stat.h, ...):
  ./arch/x86/include/asm/special_insns.h:289:41: warning: incorrect type in initializer (different address spaces)
  ./arch/x86/include/asm/special_insns.h:289:41:    expected struct <noident> *__dst
  ./arch/x86/include/asm/special_insns.h:289:41:    got void [noderef] __iomem *dst

 [ bp: Massage commit message. ]

Fixes: 7f5933f81bd8 ("x86/asm: Add an enqcmds() wrapper for the ENQCMDS instruction")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Ben Widawsky <ben.widawsky@intel.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Link: https://lkml.kernel.org/r/161003789741.4062451.14362269365703761223.stgit@djiang5-desk3.ch.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/special_insns.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h
index cc177b4431ae..0cf19684dd20 100644
--- a/arch/x86/include/asm/special_insns.h
+++ b/arch/x86/include/asm/special_insns.h
@@ -286,7 +286,7 @@ static inline void movdir64b(void *dst, const void *src)
 static inline int enqcmds(void __iomem *dst, const void *src)
 {
 	const struct { char _[64]; } *__src = src;
-	struct { char _[64]; } *__dst = dst;
+	struct { char _[64]; } __iomem *__dst = dst;
 	int zf;
 
 	/*

From 7040b37a96302be1df77d1ab62bbb978dfacb0d7 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Fri, 10 Sep 2021 15:33:32 -0700
Subject: [PATCH 0570/1750] x86/asm: Fix SETZ size enqcmds() build failure

[ Upstream commit d81ff5fe14a950f53e2833cfa196e7bb3fd5d4e3 ]

When building under GCC 4.9 and 5.5:

  arch/x86/include/asm/special_insns.h: Assembler messages:
  arch/x86/include/asm/special_insns.h:286: Error: operand size mismatch for `setz'

Change the type to "bool" for condition code arguments, as documented.

Fixes: 7f5933f81bd8 ("x86/asm: Add an enqcmds() wrapper for the ENQCMDS instruction")
Co-developed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210910223332.3224851-1-keescook@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/special_insns.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h
index 0cf19684dd20..415693f5d909 100644
--- a/arch/x86/include/asm/special_insns.h
+++ b/arch/x86/include/asm/special_insns.h
@@ -287,7 +287,7 @@ static inline int enqcmds(void __iomem *dst, const void *src)
 {
 	const struct { char _[64]; } *__src = src;
 	struct { char _[64]; } __iomem *__dst = dst;
-	int zf;
+	bool zf;
 
 	/*
 	 * ENQCMDS %(rdx), rax

From ce092350b452f256bff4b39d74c80c221bf8b0cf Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Fri, 24 Sep 2021 07:39:08 -0600
Subject: [PATCH 0571/1750] io_uring: put provided buffer meta data under memcg
 accounting

[ Upstream commit 9990da93d2bf9892c2c14c958bef050d4e461a1a ]

For each provided buffer, we allocate a struct io_buffer to hold the
data associated with it. As a large number of buffers can be provided,
account that data with memcg.

Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index a8d07273ddc0..26753d0cb431 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4041,7 +4041,7 @@ static int io_add_buffers(struct io_provide_buf *pbuf, struct io_buffer **head)
 	int i, bid = pbuf->bid;
 
 	for (i = 0; i < pbuf->nbufs; i++) {
-		buf = kmalloc(sizeof(*buf), GFP_KERNEL);
+		buf = kmalloc(sizeof(*buf), GFP_KERNEL_ACCOUNT);
 		if (!buf)
 			break;
 

From 3815fe7371d2411ce164281cef40d9fc7b323dee Mon Sep 17 00:00:00 2001
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: Thu, 23 Sep 2021 21:49:21 +0800
Subject: [PATCH 0572/1750] blktrace: Fix uaf in blk_trace access after
 removing by sysfs

[ Upstream commit 5afedf670caf30a2b5a52da96eb7eac7dee6a9c9 ]

There is an use-after-free problem triggered by following process:

      P1(sda)				P2(sdb)
			echo 0 > /sys/block/sdb/trace/enable
			  blk_trace_remove_queue
			    synchronize_rcu
			    blk_trace_free
			      relay_close
rcu_read_lock
__blk_add_trace
  trace_note_tsk
  (Iterate running_trace_list)
			        relay_close_buf
				  relay_destroy_buf
				    kfree(buf)
    trace_note(sdb's bt)
      relay_reserve
        buf->offset <- nullptr deference (use-after-free) !!!
rcu_read_unlock

[  502.714379] BUG: kernel NULL pointer dereference, address:
0000000000000010
[  502.715260] #PF: supervisor read access in kernel mode
[  502.715903] #PF: error_code(0x0000) - not-present page
[  502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0
[  502.717252] Oops: 0000 [#1] SMP
[  502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360
[  502.732872] Call Trace:
[  502.733193]  __blk_add_trace.cold+0x137/0x1a3
[  502.733734]  blk_add_trace_rq+0x7b/0xd0
[  502.734207]  blk_add_trace_rq_issue+0x54/0xa0
[  502.734755]  blk_mq_start_request+0xde/0x1b0
[  502.735287]  scsi_queue_rq+0x528/0x1140
...
[  502.742704]  sg_new_write.isra.0+0x16e/0x3e0
[  502.747501]  sg_ioctl+0x466/0x1100

Reproduce method:
  ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])
  ioctl(/dev/sda, BLKTRACESTART)
  ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127])
  ioctl(/dev/sdb, BLKTRACESTART)

  echo 0 > /sys/block/sdb/trace/enable &
  // Add delay(mdelay/msleep) before kernel enters blk_trace_free()

  ioctl$SG_IO(/dev/sda, SG_IO, ...)
  // Enters trace_note_tsk() after blk_trace_free() returned
  // Use mdelay in rcu region rather than msleep(which may schedule out)

Remove blk_trace from running_list before calling blk_trace_free() by
sysfs if blk_trace is at Blktrace_running state.

Fixes: c71a896154119f ("blktrace: add ftrace plugin")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Link: https://lore.kernel.org/r/20210923134921.109194-1-chengzhihao1@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/blktrace.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index f1022945e346..b89ff188a618 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -1670,6 +1670,14 @@ static int blk_trace_remove_queue(struct request_queue *q)
 	if (bt == NULL)
 		return -EINVAL;
 
+	if (bt->trace_state == Blktrace_running) {
+		bt->trace_state = Blktrace_stopped;
+		spin_lock_irq(&running_trace_lock);
+		list_del_init(&bt->running_list);
+		spin_unlock_irq(&running_trace_lock);
+		relay_flush(bt->rchan);
+	}
+
 	put_probe_ref();
 	synchronize_rcu();
 	blk_trace_free(bt);

From a632288053b7a00e08f12ea69507bc07922331c8 Mon Sep 17 00:00:00 2001
From: Nathan Rossi <nathan.rossi@digi.com>
Date: Thu, 2 Sep 2021 05:14:49 +0000
Subject: [PATCH 0573/1750] net: phylink: Update SFP selected interface on
 advertising changes

[ Upstream commit ea269a6f720782ed94171fb962b14ce07c372138 ]

Currently changes to the advertising state via ethtool do not cause any
reselection of the configured interface mode after the SFP is already
inserted and initially configured.

While it is not typical to change the advertised link modes for an
interface using an SFP in certain use cases it is desirable. In the case
of a SFP port that is capable of handling both SFP and SFP+ modules it
will automatically select between 1G and 10G modes depending on the
supported mode of the SFP. However if the SFP module is capable of
working in multiple modes (e.g. a SFP+ DAC that can operate at 1G or
10G), one end of the cable may be attached to a SFP 1000base-x port thus
the SFP+ end must be manually configured to the 1000base-x mode in order
for the link to be established.

This change causes the ethtool setting of advertised mode changes to
reselect the interface mode so that the link can be established.
Additionally when a module is inserted the advertising mode is reset to
match the supported modes of the module.

Signed-off-by: Nathan Rossi <nathan.rossi@digi.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phylink.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 6072e87ed6c3..025c3246f339 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -1493,6 +1493,32 @@ int phylink_ethtool_ksettings_set(struct phylink *pl,
 	if (config.an_enabled && phylink_is_empty_linkmode(config.advertising))
 		return -EINVAL;
 
+	/* If this link is with an SFP, ensure that changes to advertised modes
+	 * also cause the associated interface to be selected such that the
+	 * link can be configured correctly.
+	 */
+	if (pl->sfp_port && pl->sfp_bus) {
+		config.interface = sfp_select_interface(pl->sfp_bus,
+							config.advertising);
+		if (config.interface == PHY_INTERFACE_MODE_NA) {
+			phylink_err(pl,
+				    "selection of interface failed, advertisement %*pb\n",
+				    __ETHTOOL_LINK_MODE_MASK_NBITS,
+				    config.advertising);
+			return -EINVAL;
+		}
+
+		/* Revalidate with the selected interface */
+		linkmode_copy(support, pl->supported);
+		if (phylink_validate(pl, support, &config)) {
+			phylink_err(pl, "validation of %s/%s with support %*pb failed\n",
+				    phylink_an_mode_str(pl->cur_link_an_mode),
+				    phy_modes(config.interface),
+				    __ETHTOOL_LINK_MODE_MASK_NBITS, support);
+			return -EINVAL;
+		}
+	}
+
 	mutex_lock(&pl->state_mutex);
 	pl->link_config.speed = config.speed;
 	pl->link_config.duplex = config.duplex;
@@ -2072,7 +2098,9 @@ static int phylink_sfp_config(struct phylink *pl, u8 mode,
 	if (phy_interface_mode_is_8023z(iface) && pl->phydev)
 		return -EINVAL;
 
-	changed = !linkmode_equal(pl->supported, support);
+	changed = !linkmode_equal(pl->supported, support) ||
+		  !linkmode_equal(pl->link_config.advertising,
+				  config.advertising);
 	if (changed) {
 		linkmode_copy(pl->supported, support);
 		linkmode_copy(pl->link_config.advertising, config.advertising);

From 7721221e87d25c9840d9ca6b986dbdc410d5ce2b Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Wed, 8 Sep 2021 12:02:32 -0700
Subject: [PATCH 0574/1750] net: macb: fix use after free on rmmod

[ Upstream commit d82d5303c4c539db86588ffb5dc5b26c3f1513e8 ]

plat_dev->dev->platform_data is released by platform_device_unregister(),
use of pclk and hclk is a use-after-free. Since device unregister won't
need a clk device we adjust the function call sequence to fix this issue.

[   31.261225] BUG: KASAN: use-after-free in macb_remove+0x77/0xc6 [macb_pci]
[   31.275563] Freed by task 306:
[   30.276782]  platform_device_release+0x25/0x80

Suggested-by: Nicolas Ferre <Nicolas.Ferre@microchip.com>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cadence/macb_pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/cadence/macb_pci.c b/drivers/net/ethernet/cadence/macb_pci.c
index 353393dea639..3593b310c325 100644
--- a/drivers/net/ethernet/cadence/macb_pci.c
+++ b/drivers/net/ethernet/cadence/macb_pci.c
@@ -111,9 +111,9 @@ static void macb_remove(struct pci_dev *pdev)
 	struct platform_device *plat_dev = pci_get_drvdata(pdev);
 	struct macb_platform_data *plat_data = dev_get_platdata(&plat_dev->dev);
 
-	platform_device_unregister(plat_dev);
 	clk_unregister(plat_data->pclk);
 	clk_unregister(plat_data->hclk);
+	platform_device_unregister(plat_dev);
 }
 
 static const struct pci_device_id dev_id_table[] = {

From de7e03003367958623fe1394571f29226b06eee3 Mon Sep 17 00:00:00 2001
From: Jesper Nilsson <jesper.nilsson@axis.com>
Date: Fri, 10 Sep 2021 21:55:34 +0200
Subject: [PATCH 0575/1750] net: stmmac: allow CSR clock of 300MHz

[ Upstream commit 08dad2f4d541fcfe5e7bfda72cc6314bbfd2802f ]

The Synopsys Ethernet IP uses the CSR clock as a base clock for MDC.
The divisor used is set in the MAC_MDIO_Address register field CR
(Clock Rate)

The divisor is there to change the CSR clock into a clock that falls
below the IEEE 802.3 specified max frequency of 2.5MHz.

If the CSR clock is 300MHz, the code falls back to using the reset
value in the MAC_MDIO_Address register, as described in the comment
above this code.

However, 300MHz is actually an allowed value and the proper divider
can be estimated quite easily (it's just 1Hz difference!)

A CSR frequency of 300MHz with the maximum clock rate value of 0x5
(STMMAC_CSR_250_300M, a divisor of 124) gives somewhere around
~2.42MHz which is below the IEEE 802.3 specified maximum.

For the ARTPEC-8 SoC, the CSR clock is this problematic 300MHz,
and unfortunately, the reset-value of the MAC_MDIO_Address CR field
is 0x0.

This leads to a clock rate of zero and a divisor of 42, and gives an
MDC frequency of ~7.14MHz.

Allow CSR clock of 300MHz by making the comparison inclusive.

Signed-off-by: Jesper Nilsson <jesper.nilsson@axis.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 3134f7e669f8..6133b2fe8a78 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -226,7 +226,7 @@ static void stmmac_clk_csr_set(struct stmmac_priv *priv)
 			priv->clk_csr = STMMAC_CSR_100_150M;
 		else if ((clk_rate >= CSR_F_150M) && (clk_rate < CSR_F_250M))
 			priv->clk_csr = STMMAC_CSR_150_250M;
-		else if ((clk_rate >= CSR_F_250M) && (clk_rate < CSR_F_300M))
+		else if ((clk_rate >= CSR_F_250M) && (clk_rate <= CSR_F_300M))
 			priv->clk_csr = STMMAC_CSR_250_300M;
 	}
 

From cc3dd119d3cf3435878b24a4a0ed21be6950573c Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Mon, 6 Sep 2021 14:50:03 +0800
Subject: [PATCH 0576/1750] blk-mq: avoid to iterate over stale request

[ Upstream commit 67f3b2f822b7e71cfc9b42dbd9f3144fa2933e0b ]

blk-mq can't run allocating driver tag and updating ->rqs[tag]
atomically, meantime blk-mq doesn't clear ->rqs[tag] after the driver
tag is released.

So there is chance to iterating over one stale request just after the
tag is allocated and before updating ->rqs[tag].

scsi_host_busy_iter() calls scsi_host_check_in_flight() to count scsi
in-flight requests after scsi host is blocked, so no new scsi command can
be marked as SCMD_STATE_INFLIGHT. However, driver tag allocation still can
be run by blk-mq core. One request is marked as SCMD_STATE_INFLIGHT,
but this request may have been kept in another slot of ->rqs[], meantime
the slot can be allocated out but ->rqs[] isn't updated yet. Then this
in-flight request is counted twice as SCMD_STATE_INFLIGHT. This way causes
trouble in handling scsi error.

Fixes the issue by not iterating over stale request.

Cc: linux-scsi@vger.kernel.org
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Reported-by: luojiaxing <luojiaxing@huawei.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20210906065003.439019-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq-tag.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index c4f2f6c123ae..16ad9e656610 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -207,7 +207,7 @@ static struct request *blk_mq_find_and_get_req(struct blk_mq_tags *tags,
 
 	spin_lock_irqsave(&tags->lock, flags);
 	rq = tags->rqs[bitnr];
-	if (!rq || !refcount_inc_not_zero(&rq->ref))
+	if (!rq || rq->tag != bitnr || !refcount_inc_not_zero(&rq->ref))
 		rq = NULL;
 	spin_unlock_irqrestore(&tags->lock, flags);
 	return rq;

From 31df1d037cfd5b259d7901a0fbbbbc897ddb64c4 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Mon, 6 Sep 2021 23:07:29 -0700
Subject: [PATCH 0577/1750] m68k: Double cast io functions to unsigned long

[ Upstream commit b1a89856fbf63fffde6a4771d8f1ac21df549e50 ]

m68k builds fail widely with errors such as

arch/m68k/include/asm/raw_io.h:20:19: error:
	cast to pointer from integer of different size
arch/m68k/include/asm/raw_io.h:30:32: error:
	cast to pointer from integer of different size [-Werror=int-to-p

On m68k, io functions are defined as macros. The problem is seen if the
macro parameter variable size differs from the size of a pointer. Cast
the parameter of all io macros to unsigned long before casting it to
a pointer to fix the problem.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210907060729.2391992-1-linux@roeck-us.net
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/include/asm/raw_io.h | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/arch/m68k/include/asm/raw_io.h b/arch/m68k/include/asm/raw_io.h
index 911826ea83ce..80eb2396d01e 100644
--- a/arch/m68k/include/asm/raw_io.h
+++ b/arch/m68k/include/asm/raw_io.h
@@ -17,21 +17,21 @@
  * two accesses to memory, which may be undesirable for some devices.
  */
 #define in_8(addr) \
-    ({ u8 __v = (*(__force volatile u8 *) (addr)); __v; })
+    ({ u8 __v = (*(__force volatile u8 *) (unsigned long)(addr)); __v; })
 #define in_be16(addr) \
-    ({ u16 __v = (*(__force volatile u16 *) (addr)); __v; })
+    ({ u16 __v = (*(__force volatile u16 *) (unsigned long)(addr)); __v; })
 #define in_be32(addr) \
-    ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; })
+    ({ u32 __v = (*(__force volatile u32 *) (unsigned long)(addr)); __v; })
 #define in_le16(addr) \
-    ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (addr)); __v; })
+    ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (unsigned long)(addr)); __v; })
 #define in_le32(addr) \
-    ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (addr)); __v; })
+    ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (unsigned long)(addr)); __v; })
 
-#define out_8(addr,b) (void)((*(__force volatile u8 *) (addr)) = (b))
-#define out_be16(addr,w) (void)((*(__force volatile u16 *) (addr)) = (w))
-#define out_be32(addr,l) (void)((*(__force volatile u32 *) (addr)) = (l))
-#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (addr)) = cpu_to_le16(w))
-#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (addr)) = cpu_to_le32(l))
+#define out_8(addr,b) (void)((*(__force volatile u8 *) (unsigned long)(addr)) = (b))
+#define out_be16(addr,w) (void)((*(__force volatile u16 *) (unsigned long)(addr)) = (w))
+#define out_be32(addr,l) (void)((*(__force volatile u32 *) (unsigned long)(addr)) = (l))
+#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (unsigned long)(addr)) = cpu_to_le16(w))
+#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (unsigned long)(addr)) = cpu_to_le32(l))
 
 #define raw_inb in_8
 #define raw_inw in_be16

From 9561bb98879e45c49c18b6b54ca9f6e36393edc8 Mon Sep 17 00:00:00 2001
From: zhang kai <zhangkaiheb@126.com>
Date: Thu, 9 Sep 2021 16:39:18 +0800
Subject: [PATCH 0578/1750] ipv6: delay fib6_sernum increase in fib6_add

[ Upstream commit e87b5052271e39d62337ade531992b7e5d8c2cfa ]

only increase fib6_sernum in net namespace after add fib6_info
successfully.

Signed-off-by: zhang kai <zhangkaiheb@126.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/ip6_fib.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 1fb79dbde0cb..e43f1fbac28b 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1376,7 +1376,6 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt,
 	int err = -ENOMEM;
 	int allow_create = 1;
 	int replace_required = 0;
-	int sernum = fib6_new_sernum(info->nl_net);
 
 	if (info->nlh) {
 		if (!(info->nlh->nlmsg_flags & NLM_F_CREATE))
@@ -1476,7 +1475,7 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt,
 	if (!err) {
 		if (rt->nh)
 			list_add(&rt->nh_list, &rt->nh->f6i_list);
-		__fib6_update_sernum_upto_root(rt, sernum);
+		__fib6_update_sernum_upto_root(rt, fib6_new_sernum(info->nl_net));
 		fib6_start_gc(info->nl_net, rt);
 	}
 

From e567d33508a9cf36b4a15fb08d697f181b8e416a Mon Sep 17 00:00:00 2001
From: Doug Smythies <doug.smythies@gmail.com>
Date: Sun, 12 Sep 2021 11:50:29 -0700
Subject: [PATCH 0579/1750] cpufreq: intel_pstate: Override parameters if HWP
 forced by BIOS

[ Upstream commit d9a7e9df731670acdc69e81748941ad338f47fab ]

If HWP has been already been enabled by BIOS, it may be
necessary to override some kernel command line parameters.
Once it has been enabled it requires a reset to be disabled.

Suggested-by: Rafael J. Wysocki <rafael@kernel.org>
Signed-off-by: Doug Smythies <dsmythies@telus.net>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/intel_pstate.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 44a5d15a7572..1686705bee7b 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -3035,11 +3035,15 @@ static int __init intel_pstate_init(void)
 	if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
 		return -ENODEV;
 
-	if (no_load)
-		return -ENODEV;
-
 	id = x86_match_cpu(hwp_support_ids);
 	if (id) {
+		bool hwp_forced = intel_pstate_hwp_is_enabled();
+
+		if (hwp_forced)
+			pr_info("HWP enabled by BIOS\n");
+		else if (no_load)
+			return -ENODEV;
+
 		copy_cpu_funcs(&core_funcs);
 		/*
 		 * Avoid enabling HWP for processors without EPP support,
@@ -3049,8 +3053,7 @@ static int __init intel_pstate_init(void)
 		 * If HWP is enabled already, though, there is no choice but to
 		 * deal with it.
 		 */
-		if ((!no_hwp && boot_cpu_has(X86_FEATURE_HWP_EPP)) ||
-		    intel_pstate_hwp_is_enabled()) {
+		if ((!no_hwp && boot_cpu_has(X86_FEATURE_HWP_EPP)) || hwp_forced) {
 			hwp_active++;
 			hwp_mode_bdw = id->driver_data;
 			intel_pstate.attr = hwp_cpufreq_attrs;
@@ -3061,7 +3064,11 @@ static int __init intel_pstate_init(void)
 
 			goto hwp_cpu_matched;
 		}
+		pr_info("HWP not enabled\n");
 	} else {
+		if (no_load)
+			return -ENODEV;
+
 		id = x86_match_cpu(intel_pstate_cpu_ids);
 		if (!id) {
 			pr_info("CPU model not supported\n");
@@ -3138,10 +3145,9 @@ static int __init intel_pstate_setup(char *str)
 	else if (!strcmp(str, "passive"))
 		default_driver = &intel_cpufreq;
 
-	if (!strcmp(str, "no_hwp")) {
-		pr_info("HWP disabled\n");
+	if (!strcmp(str, "no_hwp"))
 		no_hwp = 1;
-	}
+
 	if (!strcmp(str, "force"))
 		force_load = 1;
 	if (!strcmp(str, "hwp_only"))

From 6345a0bee80139ea00a341c4202ebfd1534b5eb0 Mon Sep 17 00:00:00 2001
From: Bixuan Cui <cuibixuan@huawei.com>
Date: Sat, 11 Sep 2021 08:55:57 +0800
Subject: [PATCH 0580/1750] bpf: Add oversize check before call kvcalloc()

[ Upstream commit 0e6491b559704da720f6da09dd0a52c4df44c514 ]

Commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") add the
oversize check. When the allocation is larger than what kmalloc() supports,
the following warning triggered:

WARNING: CPU: 0 PID: 8408 at mm/util.c:597 kvmalloc_node+0x108/0x110 mm/util.c:597
Modules linked in:
CPU: 0 PID: 8408 Comm: syz-executor221 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kvmalloc_node+0x108/0x110 mm/util.c:597
Call Trace:
 kvmalloc include/linux/mm.h:806 [inline]
 kvmalloc_array include/linux/mm.h:824 [inline]
 kvcalloc include/linux/mm.h:829 [inline]
 check_btf_line kernel/bpf/verifier.c:9925 [inline]
 check_btf_info kernel/bpf/verifier.c:10049 [inline]
 bpf_check+0xd634/0x150d0 kernel/bpf/verifier.c:13759
 bpf_prog_load kernel/bpf/syscall.c:2301 [inline]
 __sys_bpf+0x11181/0x126e0 kernel/bpf/syscall.c:4587
 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]
 __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:4689
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Reported-by: syzbot+f3e749d4c662818ae439@syzkaller.appspotmail.com
Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210911005557.45518-1-cuibixuan@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/verifier.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index cba1f86e75cd..0c26757ea7fb 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8822,6 +8822,8 @@ static int check_btf_line(struct bpf_verifier_env *env,
 	nr_linfo = attr->line_info_cnt;
 	if (!nr_linfo)
 		return 0;
+	if (nr_linfo > INT_MAX / sizeof(struct bpf_line_info))
+		return -EINVAL;
 
 	rec_size = attr->line_info_rec_size;
 	if (rec_size < MIN_BPF_LINEINFO_SIZE ||

From 372d3e6ea1e115942fdfb4b25f7003d822d071be Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Fri, 27 Aug 2021 14:32:06 +0200
Subject: [PATCH 0581/1750] xen/balloon: use a kernel thread instead a
 workqueue

[ Upstream commit 8480ed9c2bbd56fc86524998e5f2e3e22f5038f6 ]

Today the Xen ballooning is done via delayed work in a workqueue. This
might result in workqueue hangups being reported in case of large
amounts of memory are being ballooned in one go (here 16GB):

BUG: workqueue lockup - pool cpus=6 node=0 flags=0x0 nice=0 stuck for 64s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
  pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
    in-flight: 229:balloon_process
    pending: cache_reap
workqueue events_freezable_power_: flags=0x84
  pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
    pending: disk_events_workfn
workqueue mm_percpu_wq: flags=0x8
  pwq 12: cpus=6 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
    pending: vmstat_update
pool 12: cpus=6 node=0 flags=0x0 nice=0 hung=64s workers=3 idle: 2222 43

This can easily be avoided by using a dedicated kernel thread for doing
the ballooning work.

Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/20210827123206.15429-1-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/balloon.c | 62 +++++++++++++++++++++++++++++++------------
 1 file changed, 45 insertions(+), 17 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index b57b2067ecbf..65fcbc1e076e 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -43,6 +43,8 @@
 #include <linux/sched.h>
 #include <linux/cred.h>
 #include <linux/errno.h>
+#include <linux/freezer.h>
+#include <linux/kthread.h>
 #include <linux/mm.h>
 #include <linux/memblock.h>
 #include <linux/pagemap.h>
@@ -115,7 +117,7 @@ static struct ctl_table xen_root[] = {
 #define EXTENT_ORDER (fls(XEN_PFN_PER_PAGE) - 1)
 
 /*
- * balloon_process() state:
+ * balloon_thread() state:
  *
  * BP_DONE: done or nothing to do,
  * BP_WAIT: wait to be rescheduled,
@@ -130,6 +132,8 @@ enum bp_state {
 	BP_ECANCELED
 };
 
+/* Main waiting point for xen-balloon thread. */
+static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq);
 
 static DEFINE_MUTEX(balloon_mutex);
 
@@ -144,10 +148,6 @@ static xen_pfn_t frame_list[PAGE_SIZE / sizeof(xen_pfn_t)];
 static LIST_HEAD(ballooned_pages);
 static DECLARE_WAIT_QUEUE_HEAD(balloon_wq);
 
-/* Main work function, always executed in process context. */
-static void balloon_process(struct work_struct *work);
-static DECLARE_DELAYED_WORK(balloon_worker, balloon_process);
-
 /* When ballooning out (allocating memory to return to Xen) we don't really
    want the kernel to try too hard since that can trigger the oom killer. */
 #define GFP_BALLOON \
@@ -366,7 +366,7 @@ static void xen_online_page(struct page *page, unsigned int order)
 static int xen_memory_notifier(struct notifier_block *nb, unsigned long val, void *v)
 {
 	if (val == MEM_ONLINE)
-		schedule_delayed_work(&balloon_worker, 0);
+		wake_up(&balloon_thread_wq);
 
 	return NOTIFY_OK;
 }
@@ -491,18 +491,43 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 }
 
 /*
- * As this is a work item it is guaranteed to run as a single instance only.
+ * Stop waiting if either state is not BP_EAGAIN and ballooning action is
+ * needed, or if the credit has changed while state is BP_EAGAIN.
+ */
+static bool balloon_thread_cond(enum bp_state state, long credit)
+{
+	if (state != BP_EAGAIN)
+		credit = 0;
+
+	return current_credit() != credit || kthread_should_stop();
+}
+
+/*
+ * As this is a kthread it is guaranteed to run as a single instance only.
  * We may of course race updates of the target counts (which are protected
  * by the balloon lock), or with changes to the Xen hard limit, but we will
  * recover from these in time.
  */
-static void balloon_process(struct work_struct *work)
+static int balloon_thread(void *unused)
 {
 	enum bp_state state = BP_DONE;
 	long credit;
+	unsigned long timeout;
 
+	set_freezable();
+	for (;;) {
+		if (state == BP_EAGAIN)
+			timeout = balloon_stats.schedule_delay * HZ;
+		else
+			timeout = 3600 * HZ;
+		credit = current_credit();
+
+		wait_event_interruptible_timeout(balloon_thread_wq,
+				 balloon_thread_cond(state, credit), timeout);
+
+		if (kthread_should_stop())
+			return 0;
 
-	do {
 		mutex_lock(&balloon_mutex);
 
 		credit = current_credit();
@@ -529,12 +554,7 @@ static void balloon_process(struct work_struct *work)
 		mutex_unlock(&balloon_mutex);
 
 		cond_resched();
-
-	} while (credit && state == BP_DONE);
-
-	/* Schedule more work if there is some still to be done. */
-	if (state == BP_EAGAIN)
-		schedule_delayed_work(&balloon_worker, balloon_stats.schedule_delay * HZ);
+	}
 }
 
 /* Resets the Xen limit, sets new target, and kicks off processing. */
@@ -542,7 +562,7 @@ void balloon_set_new_target(unsigned long target)
 {
 	/* No need for lock. Not read-modify-write updates. */
 	balloon_stats.target_pages = target;
-	schedule_delayed_work(&balloon_worker, 0);
+	wake_up(&balloon_thread_wq);
 }
 EXPORT_SYMBOL_GPL(balloon_set_new_target);
 
@@ -647,7 +667,7 @@ void free_xenballooned_pages(int nr_pages, struct page **pages)
 
 	/* The balloon may be too large now. Shrink it if needed. */
 	if (current_credit())
-		schedule_delayed_work(&balloon_worker, 0);
+		wake_up(&balloon_thread_wq);
 
 	mutex_unlock(&balloon_mutex);
 }
@@ -679,6 +699,8 @@ static void __init balloon_add_region(unsigned long start_pfn,
 
 static int __init balloon_init(void)
 {
+	struct task_struct *task;
+
 	if (!xen_domain())
 		return -ENODEV;
 
@@ -722,6 +744,12 @@ static int __init balloon_init(void)
 	}
 #endif
 
+	task = kthread_run(balloon_thread, NULL, "xen-balloon");
+	if (IS_ERR(task)) {
+		pr_err("xen-balloon thread could not be started, ballooning will not work!\n");
+		return PTR_ERR(task);
+	}
+
 	/* Init the xen-balloon driver. */
 	xen_balloon_init();
 

From 2a08960577af16d6ab339dafe2373aae3df7ee22 Mon Sep 17 00:00:00 2001
From: Anton Eidelman <anton.eidelman@gmail.com>
Date: Sun, 12 Sep 2021 12:54:57 -0600
Subject: [PATCH 0582/1750] nvme-multipath: fix ANA state updates when a
 namespace is not present

[ Upstream commit 79f528afa93918519574773ea49a444c104bc1bd ]

nvme_update_ana_state() has a deficiency that results in a failure to
properly update the ana state for a namespace in the following case:

  NSIDs in ctrl->namespaces:	1, 3,    4
  NSIDs in desc->nsids:		1, 2, 3, 4

Loop iteration 0:
    ns index = 0, n = 0, ns->head->ns_id = 1, nsid = 1, MATCH.
Loop iteration 1:
    ns index = 1, n = 1, ns->head->ns_id = 3, nsid = 2, NO MATCH.
Loop iteration 2:
    ns index = 2, n = 2, ns->head->ns_id = 4, nsid = 4, MATCH.

Where the update to the ANA state of NSID 3 is missed.  To fix this
increment n and retry the update with the same ns when ns->head->ns_id is
higher than nsid,

Signed-off-by: Anton Eidelman <anton@lightbitslabs.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/multipath.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 2747efc03825..46a1e24ba6f4 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -509,14 +509,17 @@ static int nvme_update_ana_state(struct nvme_ctrl *ctrl,
 
 	down_read(&ctrl->namespaces_rwsem);
 	list_for_each_entry(ns, &ctrl->namespaces, list) {
-		unsigned nsid = le32_to_cpu(desc->nsids[n]);
-
+		unsigned nsid;
+again:
+		nsid = le32_to_cpu(desc->nsids[n]);
 		if (ns->head->ns_id < nsid)
 			continue;
 		if (ns->head->ns_id == nsid)
 			nvme_update_ns_ana_state(desc, ns);
 		if (++n == nr_nsids)
 			break;
+		if (ns->head->ns_id > nsid)
+			goto again;
 	}
 	up_read(&ctrl->namespaces_rwsem);
 	return 0;

From ecf0dc5a904830c926a64feffd8e01141f89822f Mon Sep 17 00:00:00 2001
From: Ruozhu Li <liruozhu@huawei.com>
Date: Mon, 6 Sep 2021 11:51:34 +0800
Subject: [PATCH 0583/1750] nvme-rdma: destroy cm id before destroy qp to avoid
 use after free

[ Upstream commit 9817d763dbe15327b9b3ff4404fa6f27f927e744 ]

We should always destroy cm_id before destroy qp to avoid to get cma
event after qp was destroyed, which may lead to use after free.
In RDMA connection establishment error flow, don't destroy qp in cm
event handler.Just report cm_error to upper level, qp will be destroy
in nvme_rdma_alloc_queue() after destroy cm id.

Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/rdma.c | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 9c356be7f016..51f4647ea214 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -655,8 +655,8 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
 	if (!test_and_clear_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
 		return;
 
-	nvme_rdma_destroy_queue_ib(queue);
 	rdma_destroy_id(queue->cm_id);
+	nvme_rdma_destroy_queue_ib(queue);
 	mutex_destroy(&queue->queue_lock);
 }
 
@@ -1823,14 +1823,10 @@ static int nvme_rdma_conn_established(struct nvme_rdma_queue *queue)
 	for (i = 0; i < queue->queue_size; i++) {
 		ret = nvme_rdma_post_recv(queue, &queue->rsp_ring[i]);
 		if (ret)
-			goto out_destroy_queue_ib;
+			return ret;
 	}
 
 	return 0;
-
-out_destroy_queue_ib:
-	nvme_rdma_destroy_queue_ib(queue);
-	return ret;
 }
 
 static int nvme_rdma_conn_rejected(struct nvme_rdma_queue *queue,
@@ -1924,14 +1920,10 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
 	if (ret) {
 		dev_err(ctrl->ctrl.device,
 			"rdma_connect_locked failed (%d).\n", ret);
-		goto out_destroy_queue_ib;
+		return ret;
 	}
 
 	return 0;
-
-out_destroy_queue_ib:
-	nvme_rdma_destroy_queue_ib(queue);
-	return ret;
 }
 
 static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
@@ -1962,8 +1954,6 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
 	case RDMA_CM_EVENT_ROUTE_ERROR:
 	case RDMA_CM_EVENT_CONNECT_ERROR:
 	case RDMA_CM_EVENT_UNREACHABLE:
-		nvme_rdma_destroy_queue_ib(queue);
-		fallthrough;
 	case RDMA_CM_EVENT_ADDR_ERROR:
 		dev_dbg(queue->ctrl->ctrl.device,
 			"CM error event %d\n", ev->event);

From 54a4860c6257f4575968998939952bd1aa9dcbce Mon Sep 17 00:00:00 2001
From: Andreas Larsson <andreas@gaisler.com>
Date: Wed, 8 Sep 2021 09:48:22 +0200
Subject: [PATCH 0584/1750] sparc32: page align size in arch_dma_alloc

[ Upstream commit 59583f747664046aaae5588d56d5954fab66cce8 ]

Commit 53b7670e5735 ("sparc: factor the dma coherent mapping into
helper") lost the page align for the calls to dma_make_coherent and
srmmu_unmapiorange. The latter cannot handle a non page aligned len
argument.

Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/kernel/ioport.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c
index 8e1d72a16759..7ceae24b0ca9 100644
--- a/arch/sparc/kernel/ioport.c
+++ b/arch/sparc/kernel/ioport.c
@@ -356,7 +356,9 @@ void *arch_dma_alloc(struct device *dev, size_t size, dma_addr_t *dma_handle,
 void arch_dma_free(struct device *dev, size_t size, void *cpu_addr,
 		dma_addr_t dma_addr, unsigned long attrs)
 {
-	if (!sparc_dma_free_resource(cpu_addr, PAGE_ALIGN(size)))
+	size = PAGE_ALIGN(size);
+
+	if (!sparc_dma_free_resource(cpu_addr, size))
 		return;
 
 	dma_make_coherent(dma_addr, size);

From 526261c1b706fec0ea80ce9f14c8fe8468bee34d Mon Sep 17 00:00:00 2001
From: Simon Ser <contact@emersion.fr>
Date: Tue, 7 Sep 2021 14:19:34 +0000
Subject: [PATCH 0585/1750] amd/display: downgrade validation failure log level

[ Upstream commit 7bbee36d71502ab9a341505da89a017c7ae2e6b2 ]

In amdgpu_dm_atomic_check, dc_validate_global_state is called. On
failure this logs a warning to the kernel journal. However warnings
shouldn't be used for atomic test-only commit failures: user-space
might be perfoming a lot of atomic test-only commits to find the
best hardware configuration.

Downgrade the log to a regular DRM atomic message. While at it, use
the new device-aware logging infrastructure.

This fixes error messages in the kernel when running gamescope [1].

[1]: https://github.com/Plagman/gamescope/issues/245

Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Simon Ser <contact@emersion.fr>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Harry Wentland <hwentlan@amd.com>
Cc: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index bc9df3f216f5..ce21a21ddb23 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -8962,7 +8962,8 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
 			goto fail;
 		status = dc_validate_global_state(dc, dm_state->context, false);
 		if (status != DC_OK) {
-			DC_LOG_WARNING("DC global validation failure: %s (%d)",
+			drm_dbg_atomic(dev,
+				       "DC global validation failure: %s (%d)",
 				       dc_status_to_str(status), status);
 			ret = -EINVAL;
 			goto fail;

From 1963bdb7489cee29472b84e9cdc41b4a09a8b0d6 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Tue, 14 Sep 2021 09:06:55 +0200
Subject: [PATCH 0586/1750] block: check if a profile is actually registered in
 blk_integrity_unregister

[ Upstream commit 783a40a1b3ac7f3714d2776fa8ac8cce3535e4f6 ]

While clearing the profile itself is harmless, we really should not clear
the stable writes flag if it wasn't set due to a registered integrity
profile.

Reported-by: Lihong Kou <koulihong@huawei.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Link: https://lore.kernel.org/r/20210914070657.87677-2-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-integrity.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/block/blk-integrity.c b/block/blk-integrity.c
index 410da060d1f5..e9f943de377a 100644
--- a/block/blk-integrity.c
+++ b/block/blk-integrity.c
@@ -426,8 +426,12 @@ EXPORT_SYMBOL(blk_integrity_register);
  */
 void blk_integrity_unregister(struct gendisk *disk)
 {
+	struct blk_integrity *bi = &disk->queue->integrity;
+
+	if (!bi->profile)
+		return;
 	blk_queue_flag_clear(QUEUE_FLAG_STABLE_WRITES, disk->queue);
-	memset(&disk->queue->integrity, 0, sizeof(struct blk_integrity));
+	memset(bi, 0, sizeof(*bi));
 }
 EXPORT_SYMBOL(blk_integrity_unregister);
 

From 1ef68b84bc11befba7e20bb847ea352b46d9c28f Mon Sep 17 00:00:00 2001
From: Lihong Kou <koulihong@huawei.com>
Date: Tue, 14 Sep 2021 09:06:56 +0200
Subject: [PATCH 0587/1750] block: flush the integrity workqueue in
 blk_integrity_unregister

[ Upstream commit 3df49967f6f1d2121b0c27c381ca1c8386b1dab9 ]

When the integrity profile is unregistered there can still be integrity
reads queued up which could see a NULL verify_fn as shown by the race
window below:

CPU0                                    CPU1
  process_one_work                      nvme_validate_ns
    bio_integrity_verify_fn                nvme_update_ns_info
	                                     nvme_update_disk_info
	                                       blk_integrity_unregister
                                               ---set queue->integrity as 0
	bio_integrity_process
	--access bi->profile->verify_fn(bi is a pointer of queue->integity)

Before calling blk_integrity_unregister in nvme_update_disk_info, we must
make sure that there is no work item in the kintegrityd_wq. Just call
blk_flush_integrity to flush the work queue so the bug can be resolved.

Signed-off-by: Lihong Kou <koulihong@huawei.com>
[hch: split up and shortened the changelog]
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Link: https://lore.kernel.org/r/20210914070657.87677-3-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-integrity.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/block/blk-integrity.c b/block/blk-integrity.c
index e9f943de377a..9e83159f5a52 100644
--- a/block/blk-integrity.c
+++ b/block/blk-integrity.c
@@ -430,6 +430,9 @@ void blk_integrity_unregister(struct gendisk *disk)
 
 	if (!bi->profile)
 		return;
+
+	/* ensure all bios are off the integrity workqueue */
+	blk_flush_integrity();
 	blk_queue_flag_clear(QUEUE_FLAG_STABLE_WRITES, disk->queue);
 	memset(bi, 0, sizeof(*bi));
 }

From f58d305887ad7b24986d58e881f6806bb81b2bdf Mon Sep 17 00:00:00 2001
From: Li Jinlin <lijinlin3@huawei.com>
Date: Tue, 14 Sep 2021 12:26:05 +0800
Subject: [PATCH 0588/1750] blk-cgroup: fix UAF by grabbing blkcg lock before
 destroying blkg pd

[ Upstream commit 858560b27645e7e97aca37ee8f232cccd658fbd2 ]

KASAN reports a use-after-free report when doing fuzz test:

[693354.104835] ==================================================================
[693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160
[693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338

[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147
[693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018
[693354.105612] Call Trace:
[693354.105621]  dump_stack+0xf1/0x19b
[693354.105626]  ? show_regs_print_info+0x5/0x5
[693354.105634]  ? printk+0x9c/0xc3
[693354.105638]  ? cpumask_weight+0x1f/0x1f
[693354.105648]  print_address_description+0x70/0x360
[693354.105654]  kasan_report+0x1b2/0x330
[693354.105659]  ? bfq_io_set_weight_legacy+0xd3/0x160
[693354.105665]  ? bfq_io_set_weight_legacy+0xd3/0x160
[693354.105670]  bfq_io_set_weight_legacy+0xd3/0x160
[693354.105675]  ? bfq_cpd_init+0x20/0x20
[693354.105683]  cgroup_file_write+0x3aa/0x510
[693354.105693]  ? ___slab_alloc+0x507/0x540
[693354.105698]  ? cgroup_file_poll+0x60/0x60
[693354.105702]  ? 0xffffffff89600000
[693354.105708]  ? usercopy_abort+0x90/0x90
[693354.105716]  ? mutex_lock+0xef/0x180
[693354.105726]  kernfs_fop_write+0x1ab/0x280
[693354.105732]  ? cgroup_file_poll+0x60/0x60
[693354.105738]  vfs_write+0xe7/0x230
[693354.105744]  ksys_write+0xb0/0x140
[693354.105749]  ? __ia32_sys_read+0x50/0x50
[693354.105760]  do_syscall_64+0x112/0x370
[693354.105766]  ? syscall_return_slowpath+0x260/0x260
[693354.105772]  ? do_page_fault+0x9b/0x270
[693354.105779]  ? prepare_exit_to_usermode+0xf9/0x1a0
[693354.105784]  ? enter_from_user_mode+0x30/0x30
[693354.105793]  entry_SYSCALL_64_after_hwframe+0x65/0xca

[693354.105875] Allocated by task 1453337:
[693354.106001]  kasan_kmalloc+0xa0/0xd0
[693354.106006]  kmem_cache_alloc_node_trace+0x108/0x220
[693354.106010]  bfq_pd_alloc+0x96/0x120
[693354.106015]  blkcg_activate_policy+0x1b7/0x2b0
[693354.106020]  bfq_create_group_hierarchy+0x1e/0x80
[693354.106026]  bfq_init_queue+0x678/0x8c0
[693354.106031]  blk_mq_init_sched+0x1f8/0x460
[693354.106037]  elevator_switch_mq+0xe1/0x240
[693354.106041]  elevator_switch+0x25/0x40
[693354.106045]  elv_iosched_store+0x1a1/0x230
[693354.106049]  queue_attr_store+0x78/0xb0
[693354.106053]  kernfs_fop_write+0x1ab/0x280
[693354.106056]  vfs_write+0xe7/0x230
[693354.106060]  ksys_write+0xb0/0x140
[693354.106064]  do_syscall_64+0x112/0x370
[693354.106069]  entry_SYSCALL_64_after_hwframe+0x65/0xca

[693354.106114] Freed by task 1453336:
[693354.106225]  __kasan_slab_free+0x130/0x180
[693354.106229]  kfree+0x90/0x1b0
[693354.106233]  blkcg_deactivate_policy+0x12c/0x220
[693354.106238]  bfq_exit_queue+0xf5/0x110
[693354.106241]  blk_mq_exit_sched+0x104/0x130
[693354.106245]  __elevator_exit+0x45/0x60
[693354.106249]  elevator_switch_mq+0xd6/0x240
[693354.106253]  elevator_switch+0x25/0x40
[693354.106257]  elv_iosched_store+0x1a1/0x230
[693354.106261]  queue_attr_store+0x78/0xb0
[693354.106264]  kernfs_fop_write+0x1ab/0x280
[693354.106268]  vfs_write+0xe7/0x230
[693354.106271]  ksys_write+0xb0/0x140
[693354.106275]  do_syscall_64+0x112/0x370
[693354.106280]  entry_SYSCALL_64_after_hwframe+0x65/0xca

[693354.106329] The buggy address belongs to the object at ffff888be0a35580
                 which belongs to the cache kmalloc-1k of size 1024
[693354.106736] The buggy address is located 228 bytes inside of
                 1024-byte region [ffff888be0a35580, ffff888be0a35980)
[693354.107114] The buggy address belongs to the page:
[693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0
[693354.107606] flags: 0x17ffffc0008100(slab|head)
[693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080
[693354.108020] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000
[693354.108278] page dumped because: kasan: bad access detected

[693354.108511] Memory state around the buggy address:
[693354.108671]  ffff888be0a35500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[693354.116396]  ffff888be0a35580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[693354.124473] >ffff888be0a35600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[693354.132421]                                                        ^
[693354.140284]  ffff888be0a35680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[693354.147912]  ffff888be0a35700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[693354.155281] ==================================================================

blkgs are protected by both queue and blkcg locks and holding
either should stabilize them. However, the path of destroying
blkg policy data is only protected by queue lock in
blkcg_activate_policy()/blkcg_deactivate_policy(). Other tasks
can get the blkg policy data before the blkg policy data is
destroyed, and use it after destroyed, which will result in a
use-after-free.

CPU0                             CPU1
blkcg_deactivate_policy
  spin_lock_irq(&q->queue_lock)
                                 bfq_io_set_weight_legacy
                                   spin_lock_irq(&blkcg->lock)
                                   blkg_to_bfqg(blkg)
                                     pd_to_bfqg(blkg->pd[pol->plid])
                                     ^^^^^^blkg->pd[pol->plid] != NULL
                                           bfqg != NULL
  pol->pd_free_fn(blkg->pd[pol->plid])
    pd_to_bfqg(blkg->pd[pol->plid])
    bfqg_put(bfqg)
      kfree(bfqg)
  blkg->pd[pol->plid] = NULL
  spin_unlock_irq(q->queue_lock);
                                   bfq_group_set_weight(bfqg, val, 0)
                                     bfqg->entity.new_weight
                                     ^^^^^^trigger uaf here
                                   spin_unlock_irq(&blkcg->lock);

Fix by grabbing the matching blkcg lock before trying to
destroy blkg policy data.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Li Jinlin <lijinlin3@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20210914042605.3260596-1-lijinlin3@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-cgroup.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index f13688c4b931..5b19665bc486 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -1387,10 +1387,14 @@ int blkcg_activate_policy(struct request_queue *q,
 	/* alloc failed, nothing's initialized yet, free everything */
 	spin_lock_irq(&q->queue_lock);
 	list_for_each_entry(blkg, &q->blkg_list, q_node) {
+		struct blkcg *blkcg = blkg->blkcg;
+
+		spin_lock(&blkcg->lock);
 		if (blkg->pd[pol->plid]) {
 			pol->pd_free_fn(blkg->pd[pol->plid]);
 			blkg->pd[pol->plid] = NULL;
 		}
+		spin_unlock(&blkcg->lock);
 	}
 	spin_unlock_irq(&q->queue_lock);
 	ret = -ENOMEM;
@@ -1422,12 +1426,16 @@ void blkcg_deactivate_policy(struct request_queue *q,
 	__clear_bit(pol->plid, q->blkcg_pols);
 
 	list_for_each_entry(blkg, &q->blkg_list, q_node) {
+		struct blkcg *blkcg = blkg->blkcg;
+
+		spin_lock(&blkcg->lock);
 		if (blkg->pd[pol->plid]) {
 			if (pol->pd_offline_fn)
 				pol->pd_offline_fn(blkg->pd[pol->plid]);
 			pol->pd_free_fn(blkg->pd[pol->plid]);
 			blkg->pd[pol->plid] = NULL;
 		}
+		spin_unlock(&blkcg->lock);
 	}
 
 	spin_unlock_irq(&q->queue_lock);

From e99f9032715e5d109f3af2105e00a8a32baa3497 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Tue, 14 Sep 2021 20:52:24 -0700
Subject: [PATCH 0589/1750] compiler.h: Introduce absolute_pointer macro

[ Upstream commit f6b5f1a56987de837f8e25cd560847106b8632a8 ]

absolute_pointer() disassociates a pointer from its originating symbol
type and context. Use it to prevent compiler warnings/errors such as

  drivers/net/ethernet/i825xx/82596.c: In function 'i82596_probe':
  arch/m68k/include/asm/string.h:72:25: error:
	'__builtin_memcpy' reading 6 bytes from a region of size 0 [-Werror=stringop-overread]

Such warnings may be reported by gcc 11.x for string and memory
operations on fixed addresses.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/compiler.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index b8fe0c23cfff..475d0a3ce059 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -180,6 +180,8 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
     (typeof(ptr)) (__ptr + (off)); })
 #endif
 
+#define absolute_pointer(val)	RELOC_HIDE((void *)(val), 0)
+
 #ifndef OPTIMIZER_HIDE_VAR
 /* Make the optimizer believe the variable can be manipulated arbitrarily. */
 #define OPTIMIZER_HIDE_VAR(var)						\

From 8d768beaf0efb0709fc23f9d826072c414a75938 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Tue, 14 Sep 2021 20:52:25 -0700
Subject: [PATCH 0590/1750] net: i825xx: Use absolute_pointer for memcpy from
 fixed memory location

[ Upstream commit dff2d13114f0beec448da9b3716204eb34b0cf41 ]

gcc 11.x reports the following compiler warning/error.

  drivers/net/ethernet/i825xx/82596.c: In function 'i82596_probe':
  arch/m68k/include/asm/string.h:72:25: error:
	'__builtin_memcpy' reading 6 bytes from a region of size 0 [-Werror=stringop-overread]

Use absolute_pointer() to work around the problem.

Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/i825xx/82596.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c
index fc8c7cd67471..8b12a5ab3818 100644
--- a/drivers/net/ethernet/i825xx/82596.c
+++ b/drivers/net/ethernet/i825xx/82596.c
@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit)
 			err = -ENODEV;
 			goto out;
 		}
-		memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN);	/* YUCK! Get addr from NOVRAM */
+		memcpy(eth_addr, absolute_pointer(0xfffc1f2c), ETH_ALEN); /* YUCK! Get addr from NOVRAM */
 		dev->base_addr = MVME_I596_BASE;
 		dev->irq = (unsigned) MVME16x_IRQ_I596;
 		goto found;

From 5520d27f02a15831e240e14c1f1a19ea6b3f467f Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 6 Sep 2021 16:06:04 -0700
Subject: [PATCH 0591/1750] sparc: avoid stringop-overread errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fc7c028dcdbfe981bca75d2a7b95f363eb691ef3 ]

The sparc mdesc code does pointer games with 'struct mdesc_hdr', but
didn't describe to the compiler how that header is then followed by the
data that the header describes.

As a result, gcc is now unhappy since it does stricter pointer range
tracking, and doesn't understand about how these things work.  This
results in various errors like:

    arch/sparc/kernel/mdesc.c: In function ‘mdesc_node_by_name’:
    arch/sparc/kernel/mdesc.c:647:22: error: ‘strcmp’ reading 1 or more bytes from a region of size 0 [-Werror=stringop-overread]
      647 |                 if (!strcmp(names + ep[ret].name_offset, name))
          |                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

which are easily avoided by just describing 'struct mdesc_hdr' better,
and making the node_block() helper function look into that unsized
data[] that follows the header.

This makes the sparc64 build happy again at least for my cross-compiler
version (gcc version 11.2.1).

Link: https://lore.kernel.org/lkml/CAHk-=wi4NW3NC0xWykkw=6LnjQD6D_rtRtxY9g8gQAJXtQMi8A@mail.gmail.com/
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/kernel/mdesc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c
index 8e645ddac58e..30f171b7b00c 100644
--- a/arch/sparc/kernel/mdesc.c
+++ b/arch/sparc/kernel/mdesc.c
@@ -39,6 +39,7 @@ struct mdesc_hdr {
 	u32	node_sz; /* node block size */
 	u32	name_sz; /* name block size */
 	u32	data_sz; /* data block size */
+	char	data[];
 } __attribute__((aligned(16)));
 
 struct mdesc_elem {
@@ -612,7 +613,7 @@ EXPORT_SYMBOL(mdesc_get_node_info);
 
 static struct mdesc_elem *node_block(struct mdesc_hdr *mdesc)
 {
-	return (struct mdesc_elem *) (mdesc + 1);
+	return (struct mdesc_elem *) mdesc->data;
 }
 
 static void *name_block(struct mdesc_hdr *mdesc)

From 61454e7fd624a24e5c6f73363e66b407dcbcaf1e Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 15 Sep 2021 13:56:37 -0700
Subject: [PATCH 0592/1750] qnx4: avoid stringop-overread errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b7213ffa0e585feb1aee3e7173e965e66ee0abaa ]

The qnx4 directory entries are 64-byte blocks that have different
contents depending on the a status byte that is in the last byte of the
block.

In particular, a directory entry can be either a "link info" entry with
a 48-byte name and pointers to the real inode information, or an "inode
entry" with a smaller 16-byte name and the full inode information.

But the code was written to always just treat the directory name as if
it was part of that "inode entry", and just extend the name to the
longer case if the status byte said it was a link entry.

That work just fine and gives the right results, but now that gcc is
tracking data structure accesses much more, the code can trigger a
compiler error about using up to 48 bytes (the long name) in a structure
that only has that shorter name in it:

   fs/qnx4/dir.c: In function ‘qnx4_readdir’:
   fs/qnx4/dir.c:51:32: error: ‘strnlen’ specified bound 48 exceeds source size 16 [-Werror=stringop-overread]
      51 |                         size = strnlen(de->di_fname, size);
         |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~
   In file included from fs/qnx4/qnx4.h:3,
                    from fs/qnx4/dir.c:16:
   include/uapi/linux/qnx4_fs.h:45:25: note: source object declared here
      45 |         char            di_fname[QNX4_SHORT_NAME_MAX];
         |                         ^~~~~~~~

which is because the source code doesn't really make this whole "one of
two different types" explicit.

Fix this by introducing a very explicit union of the two types, and
basically explaining to the compiler what is really going on.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/qnx4/dir.c | 51 ++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 34 insertions(+), 17 deletions(-)

diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c
index a6ee23aadd28..2a66844b7ff8 100644
--- a/fs/qnx4/dir.c
+++ b/fs/qnx4/dir.c
@@ -15,13 +15,27 @@
 #include <linux/buffer_head.h>
 #include "qnx4.h"
 
+/*
+ * A qnx4 directory entry is an inode entry or link info
+ * depending on the status field in the last byte. The
+ * first byte is where the name start either way, and a
+ * zero means it's empty.
+ */
+union qnx4_directory_entry {
+	struct {
+		char de_name;
+		char de_pad[62];
+		char de_status;
+	};
+	struct qnx4_inode_entry inode;
+	struct qnx4_link_info link;
+};
+
 static int qnx4_readdir(struct file *file, struct dir_context *ctx)
 {
 	struct inode *inode = file_inode(file);
 	unsigned int offset;
 	struct buffer_head *bh;
-	struct qnx4_inode_entry *de;
-	struct qnx4_link_info *le;
 	unsigned long blknum;
 	int ix, ino;
 	int size;
@@ -38,27 +52,30 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx)
 		}
 		ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK;
 		for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) {
+			union qnx4_directory_entry *de;
+			const char *name;
+
 			offset = ix * QNX4_DIR_ENTRY_SIZE;
-			de = (struct qnx4_inode_entry *) (bh->b_data + offset);
-			if (!de->di_fname[0])
+			de = (union qnx4_directory_entry *) (bh->b_data + offset);
+
+			if (!de->de_name)
 				continue;
-			if (!(de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK)))
+			if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK)))
 				continue;
-			if (!(de->di_status & QNX4_FILE_LINK))
-				size = QNX4_SHORT_NAME_MAX;
-			else
-				size = QNX4_NAME_MAX;
-			size = strnlen(de->di_fname, size);
-			QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, de->di_fname));
-			if (!(de->di_status & QNX4_FILE_LINK))
+			if (!(de->de_status & QNX4_FILE_LINK)) {
+				size = sizeof(de->inode.di_fname);
+				name = de->inode.di_fname;
 				ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1;
-			else {
-				le  = (struct qnx4_link_info*)de;
-				ino = ( le32_to_cpu(le->dl_inode_blk) - 1 ) *
+			} else {
+				size = sizeof(de->link.dl_fname);
+				name = de->link.dl_fname;
+				ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) *
 					QNX4_INODES_PER_BLOCK +
-					le->dl_inode_ndx;
+					de->link.dl_inode_ndx;
 			}
-			if (!dir_emit(ctx, de->di_fname, size, ino, DT_UNKNOWN)) {
+			size = strnlen(name, size);
+			QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name));
+			if (!dir_emit(ctx, name, size, ino, DT_UNKNOWN)) {
 				brelse(bh);
 				return 0;
 			}

From fec3bd622db0f116ddf2d158d8349f88970748b9 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Thu, 16 Sep 2021 08:35:42 +0200
Subject: [PATCH 0593/1750] parisc: Use absolute_pointer() to define PAGE0

[ Upstream commit 90cc7bed1ed19f869ae7221a6b41887fe762a6a3 ]

Use absolute_pointer() wrapper for PAGE0 to avoid this compiler warning:

  arch/parisc/kernel/setup.c: In function 'start_parisc':
  error: '__builtin_memcmp_eq' specified bound 8 exceeds source size 0

Signed-off-by: Helge Deller <deller@gmx.de>
Co-Developed-by: Guenter Roeck <linux@roeck-us.net>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/parisc/include/asm/page.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index 6b3f6740a6a6..8802ce651a3a 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -184,7 +184,7 @@ extern int npmem_ranges;
 #include <asm-generic/getorder.h>
 #include <asm/pdc.h>
 
-#define PAGE0   ((struct zeropage *)__PAGE_OFFSET)
+#define PAGE0   ((struct zeropage *)absolute_pointer(__PAGE_OFFSET))
 
 /* DEFINITION OF THE ZERO-PAGE (PAG0) */
 /* based on work by Jason Eckhardt (jason@equator.com) */

From 0a511ba6d2a7e3ac2d9ec8bf28fd18ae5a762ac9 Mon Sep 17 00:00:00 2001
From: Dan Li <ashimida@linux.alibaba.com>
Date: Tue, 14 Sep 2021 17:44:02 +0800
Subject: [PATCH 0594/1750] arm64: Mark __stack_chk_guard as __ro_after_init

[ Upstream commit 9fcb2e93f41c07a400885325e7dbdfceba6efaec ]

__stack_chk_guard is setup once while init stage and never changed
after that.

Although the modification of this variable at runtime will usually
cause the kernel to crash (so does the attacker), it should be marked
as __ro_after_init, and it should not affect performance if it is
placed in the ro_after_init section.

Signed-off-by: Dan Li <ashimida@linux.alibaba.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/1631612642-102881-1-git-send-email-ashimida@linux.alibaba.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/process.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index ed919f633ed8..4999caff3281 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -60,7 +60,7 @@
 
 #if defined(CONFIG_STACKPROTECTOR) && !defined(CONFIG_STACKPROTECTOR_PER_TASK)
 #include <linux/stackprotector.h>
-unsigned long __stack_chk_guard __read_mostly;
+unsigned long __stack_chk_guard __ro_after_init;
 EXPORT_SYMBOL(__stack_chk_guard);
 #endif
 

From 044513c1fadaa29008e3122d4548f52a6b24706c Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 8 Sep 2021 22:00:33 -0700
Subject: [PATCH 0595/1750] alpha: Declare virt_to_phys and virt_to_bus
 parameter as pointer to volatile

[ Upstream commit 35a3f4ef0ab543daa1725b0c963eb8c05e3376f8 ]

Some drivers pass a pointer to volatile data to virt_to_bus() and
virt_to_phys(), and that works fine.  One exception is alpha.  This
results in a number of compile errors such as

  drivers/net/wan/lmc/lmc_main.c: In function 'lmc_softreset':
  drivers/net/wan/lmc/lmc_main.c:1782:50: error:
	passing argument 1 of 'virt_to_bus' discards 'volatile'
	qualifier from pointer target type

  drivers/atm/ambassador.c: In function 'do_loader_command':
  drivers/atm/ambassador.c:1747:58: error:
	passing argument 1 of 'virt_to_bus' discards 'volatile'
	qualifier from pointer target type

Declare the parameter of virt_to_phys and virt_to_bus as pointer to
volatile to fix the problem.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/alpha/include/asm/io.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
index 1f6a909d1fa5..7bc2f444a89a 100644
--- a/arch/alpha/include/asm/io.h
+++ b/arch/alpha/include/asm/io.h
@@ -60,7 +60,7 @@ extern inline void set_hae(unsigned long new_hae)
  * Change virtual addresses to physical addresses and vv.
  */
 #ifdef USE_48_BIT_KSEG
-static inline unsigned long virt_to_phys(void *address)
+static inline unsigned long virt_to_phys(volatile void *address)
 {
 	return (unsigned long)address - IDENT_ADDR;
 }
@@ -70,7 +70,7 @@ static inline void * phys_to_virt(unsigned long address)
 	return (void *) (address + IDENT_ADDR);
 }
 #else
-static inline unsigned long virt_to_phys(void *address)
+static inline unsigned long virt_to_phys(volatile void *address)
 {
         unsigned long phys = (unsigned long)address;
 
@@ -106,7 +106,7 @@ static inline void * phys_to_virt(unsigned long address)
 extern unsigned long __direct_map_base;
 extern unsigned long __direct_map_size;
 
-static inline unsigned long __deprecated virt_to_bus(void *address)
+static inline unsigned long __deprecated virt_to_bus(volatile void *address)
 {
 	unsigned long phys = virt_to_phys(address);
 	unsigned long bus = phys + __direct_map_base;

From 890e25c424eac432ed2d4c96376b51275bd031b1 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 8 Sep 2021 20:57:43 -0700
Subject: [PATCH 0596/1750] net: 6pack: Fix tx timeout and slot time

[ Upstream commit 3c0d2a46c0141913dc6fd126c57d0615677d946e ]

tx timeout and slot time are currently specified in units of HZ.  On
Alpha, HZ is defined as 1024.  When building alpha:allmodconfig, this
results in the following error message.

  drivers/net/hamradio/6pack.c: In function 'sixpack_open':
  drivers/net/hamradio/6pack.c:71:41: error:
  	unsigned conversion from 'int' to 'unsigned char'
  	changes value from '256' to '0'

In the 6PACK protocol, tx timeout is specified in units of 10 ms and
transmitted over the wire:

    https://www.linux-ax25.org/wiki/6PACK

Defining a value dependent on HZ doesn't really make sense, and
presumably comes from the (very historical) situation where HZ was
originally 100.

Note that the SIXP_SLOTTIME use explicitly is about 10ms granularity:

        mod_timer(&sp->tx_t, jiffies + ((when + 1) * HZ) / 100);

and the SIXP_TXDELAY walue is sent as a byte over the wire.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/hamradio/6pack.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index da13683d52d1..bd0beb16d68a 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -68,9 +68,9 @@
 #define SIXP_DAMA_OFF		0
 
 /* default level 2 parameters */
-#define SIXP_TXDELAY			(HZ/4)	/* in 1 s */
+#define SIXP_TXDELAY			25	/* 250 ms */
 #define SIXP_PERSIST			50	/* in 256ths */
-#define SIXP_SLOTTIME			(HZ/10)	/* in 1 s */
+#define SIXP_SLOTTIME			10	/* 100 ms */
 #define SIXP_INIT_RESYNC_TIMEOUT	(3*HZ/2) /* in 1 s */
 #define SIXP_RESYNC_TIMEOUT		5*HZ	/* in 1 s */
 

From db76cb05c0466362410d74c2559d521158030aff Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 18 Sep 2021 10:05:06 -0700
Subject: [PATCH 0597/1750] spi: Fix tegra20 build with CONFIG_PM=n
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit efafec27c5658ed987e720130772f8933c685e87 ]

Without CONFIG_PM enabled, the SET_RUNTIME_PM_OPS() macro ends up being
empty, and the only use of tegra_slink_runtime_{resume,suspend} goes
away, resulting in

  drivers/spi/spi-tegra20-slink.c:1200:12: error: ‘tegra_slink_runtime_resume’ defined but not used [-Werror=unused-function]
   1200 | static int tegra_slink_runtime_resume(struct device *dev)
        |            ^~~~~~~~~~~~~~~~~~~~~~~~~~
  drivers/spi/spi-tegra20-slink.c:1188:12: error: ‘tegra_slink_runtime_suspend’ defined but not used [-Werror=unused-function]
   1188 | static int tegra_slink_runtime_suspend(struct device *dev)
        |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~

mark the functions __maybe_unused to make the build happy.

This hits the alpha allmodconfig build (and others).

Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-tegra20-slink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
index f7c832fd4003..669fc4286231 100644
--- a/drivers/spi/spi-tegra20-slink.c
+++ b/drivers/spi/spi-tegra20-slink.c
@@ -1201,7 +1201,7 @@ static int tegra_slink_resume(struct device *dev)
 }
 #endif
 
-static int tegra_slink_runtime_suspend(struct device *dev)
+static int __maybe_unused tegra_slink_runtime_suspend(struct device *dev)
 {
 	struct spi_master *master = dev_get_drvdata(dev);
 	struct tegra_slink_data *tspi = spi_master_get_devdata(master);
@@ -1213,7 +1213,7 @@ static int tegra_slink_runtime_suspend(struct device *dev)
 	return 0;
 }
 
-static int tegra_slink_runtime_resume(struct device *dev)
+static int __maybe_unused tegra_slink_runtime_resume(struct device *dev)
 {
 	struct spi_master *master = dev_get_drvdata(dev);
 	struct tegra_slink_data *tspi = spi_master_get_devdata(master);

From 9afad85a43f5d77b9b7e9ebf5306d8e47dd87b5f Mon Sep 17 00:00:00 2001
From: Sai Krishna Potthuri <lakshmi.sai.krishna.potthuri@xilinx.com>
Date: Wed, 18 Aug 2021 12:53:14 +0530
Subject: [PATCH 0598/1750] EDAC/synopsys: Fix wrong value type assignment for
 edac_mode

commit 5297cfa6bdf93e3889f78f9b482e2a595a376083 upstream.

dimm->edac_mode contains values of type enum edac_type - not the
corresponding capability flags. Fix that.

Issue caught by Coverity check "enumerated type mixed with another
type."

 [ bp: Rewrite commit message, add tags. ]

Fixes: ae9b56e3996d ("EDAC, synps: Add EDAC support for zynq ddr ecc controller")
Signed-off-by: Sai Krishna Potthuri <lakshmi.sai.krishna.potthuri@xilinx.com>
Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20210818072315.15149-1-shubhrajyoti.datta@xilinx.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/edac/synopsys_edac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c
index 12211dc040e8..1a801a5d3b08 100644
--- a/drivers/edac/synopsys_edac.c
+++ b/drivers/edac/synopsys_edac.c
@@ -782,7 +782,7 @@ static void init_csrows(struct mem_ctl_info *mci)
 
 		for (j = 0; j < csi->nr_channels; j++) {
 			dimm		= csi->channels[j]->dimm;
-			dimm->edac_mode	= EDAC_FLAG_SECDED;
+			dimm->edac_mode	= EDAC_SECDED;
 			dimm->mtype	= p_data->get_mtype(priv->baseaddr);
 			dimm->nr_pages	= (size >> PAGE_SHIFT) / csi->nr_channels;
 			dimm->grain	= SYNPS_EDAC_ERR_GRAIN;

From cc71740ee4d4c469efbc2f6faf329c01d20f91c9 Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Thu, 16 Sep 2021 10:44:06 +0200
Subject: [PATCH 0599/1750] EDAC/dmc520: Assign the proper type to
 dimm->edac_mode

commit 54607282fae6148641a08d81a6e0953b541249c7 upstream.

dimm->edac_mode contains values of type enum edac_type - not the
corresponding capability flags. Fix that.

Fixes: 1088750d7839 ("EDAC: Add EDAC driver for DMC520")
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20210916085258.7544-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/edac/dmc520_edac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/dmc520_edac.c b/drivers/edac/dmc520_edac.c
index fc1153ab1ebb..b8a7d9594afd 100644
--- a/drivers/edac/dmc520_edac.c
+++ b/drivers/edac/dmc520_edac.c
@@ -464,7 +464,7 @@ static void dmc520_init_csrow(struct mem_ctl_info *mci)
 			dimm->grain	= pvt->mem_width_in_bytes;
 			dimm->dtype	= dt;
 			dimm->mtype	= mt;
-			dimm->edac_mode	= EDAC_FLAG_SECDED;
+			dimm->edac_mode	= EDAC_SECDED;
 			dimm->nr_pages	= pages_per_rank / csi->nr_channels;
 		}
 	}

From 67cdb51ab5e252bcd8061936a7f0c65def8f4360 Mon Sep 17 00:00:00 2001
From: Antoine Tenart <atenart@kernel.org>
Date: Thu, 9 Sep 2021 10:56:12 +0200
Subject: [PATCH 0600/1750] thermal/drivers/int340x: Do not set a wrong tcc
 offset on resume

commit 8b4bd256674720709a9d858a219fcac6f2f253b5 upstream.

After upgrading to Linux 5.13.3 I noticed my laptop would shutdown due
to overheat (when it should not). It turned out this was due to commit
fe6a6de6692e ("thermal/drivers/int340x/processor_thermal: Fix tcc setting").

What happens is this drivers uses a global variable to keep track of the
tcc offset (tcc_offset_save) and uses it on resume. The issue is this
variable is initialized to 0, but is only set in
tcc_offset_degree_celsius_store, i.e. when the tcc offset is explicitly
set by userspace. If that does not happen, the resume path will set the
offset to 0 (in my case the h/w default being 3, the offset would become
too low after a suspend/resume cycle).

The issue did not arise before commit fe6a6de6692e, as the function
setting the offset would return if the offset was 0. This is no longer
the case (rightfully).

Fix this by not applying the offset if it wasn't saved before, reverting
back to the old logic. A better approach will come later, but this will
be easier to apply to stable kernels.

The logic to restore the offset after a resume was there long before
commit fe6a6de6692e, but as a value of 0 was considered invalid I'm
referencing the commit that made the issue possible in the Fixes tag
instead.

Fixes: fe6a6de6692e ("thermal/drivers/int340x/processor_thermal: Fix tcc setting")
Cc: stable@vger.kernel.org
Cc: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Tested-by: Srinivas Pandruvada <srinivas.pI andruvada@linux.intel.com>
Link: https://lore.kernel.org/r/20210909085613.5577-2-atenart@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../thermal/intel/int340x_thermal/processor_thermal_device.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
index 74158fa660dd..f5204f96fe72 100644
--- a/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
+++ b/drivers/thermal/intel/int340x_thermal/processor_thermal_device.c
@@ -185,7 +185,7 @@ static int tcc_offset_update(unsigned int tcc)
 	return 0;
 }
 
-static unsigned int tcc_offset_save;
+static int tcc_offset_save = -1;
 
 static ssize_t tcc_offset_degree_celsius_store(struct device *dev,
 				struct device_attribute *attr, const char *buf,
@@ -709,7 +709,8 @@ static int proc_thermal_resume(struct device *dev)
 	proc_dev = dev_get_drvdata(dev);
 	proc_thermal_read_ppcc(proc_dev);
 
-	tcc_offset_update(tcc_offset_save);
+	if (tcc_offset_save >= 0)
+		tcc_offset_update(tcc_offset_save);
 
 	return 0;
 }

From 8373d58c89be9406f64f8facb311ab10b97cd026 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 22 Sep 2021 13:30:59 +0200
Subject: [PATCH 0601/1750] USB: serial: cp210x: fix dropped characters with
 CP2102

commit c32dfec6c1c36bbbcd5d33e949d99aeb215877ec upstream.

Some CP2102 do not support event-insertion mode but return no error when
attempting to enable it.

This means that any event escape characters in the input stream will not
be escaped by the device and consequently regular data may be
interpreted as escape sequences and be removed from the stream by the
driver.

The reporter's device has batch number DCL00X etched into it and as
discovered by the SHA2017 Badge team, counterfeit devices with that
marking can be detected by sending malformed vendor requests. [1][2]

Tests confirm that the possibly counterfeit CP2102 returns a single byte
in response to a malformed two-byte part-number request, while an
original CP2102 returns two bytes. Assume that every CP2102 that behaves
this way also does not support event-insertion mode (e.g. cannot report
parity errors).

[1] https://mobile.twitter.com/sha2017badge/status/1167902087289532418
[2] https://hackaday.com/2017/08/14/hands-on-with-the-shacamp-2017-badge/#comment-3903376

Reported-by: Malte Di Donato <malte@neo-soft.org>
Tested-by: Malte Di Donato <malte@neo-soft.org>
Fixes: a7207e9835a4 ("USB: serial: cp210x: add support for line-status events")
Cc: stable@vger.kernel.org	# 5.9
Link: https://lore.kernel.org/r/20210922113100.20888-1-johan@kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/cp210x.c | 46 +++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 9489adbc4a2f..6d858bdaf33c 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -261,6 +261,7 @@ struct cp210x_serial_private {
 	speed_t			min_speed;
 	speed_t			max_speed;
 	bool			use_actual_rate;
+	bool			no_event_mode;
 };
 
 enum cp210x_event_state {
@@ -1332,12 +1333,16 @@ static void cp210x_change_speed(struct tty_struct *tty,
 
 static void cp210x_enable_event_mode(struct usb_serial_port *port)
 {
+	struct cp210x_serial_private *priv = usb_get_serial_data(port->serial);
 	struct cp210x_port_private *port_priv = usb_get_serial_port_data(port);
 	int ret;
 
 	if (port_priv->event_mode)
 		return;
 
+	if (priv->no_event_mode)
+		return;
+
 	port_priv->event_state = ES_DATA;
 	port_priv->event_mode = true;
 
@@ -2087,6 +2092,46 @@ static void cp210x_init_max_speed(struct usb_serial *serial)
 	priv->use_actual_rate = use_actual_rate;
 }
 
+static void cp2102_determine_quirks(struct usb_serial *serial)
+{
+	struct cp210x_serial_private *priv = usb_get_serial_data(serial);
+	u8 *buf;
+	int ret;
+
+	buf = kmalloc(2, GFP_KERNEL);
+	if (!buf)
+		return;
+	/*
+	 * Some (possibly counterfeit) CP2102 do not support event-insertion
+	 * mode and respond differently to malformed vendor requests.
+	 * Specifically, they return one instead of two bytes when sent a
+	 * two-byte part-number request.
+	 */
+	ret = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
+			CP210X_VENDOR_SPECIFIC, REQTYPE_DEVICE_TO_HOST,
+			CP210X_GET_PARTNUM, 0, buf, 2, USB_CTRL_GET_TIMEOUT);
+	if (ret == 1) {
+		dev_dbg(&serial->interface->dev,
+				"device does not support event-insertion mode\n");
+		priv->no_event_mode = true;
+	}
+
+	kfree(buf);
+}
+
+static void cp210x_determine_quirks(struct usb_serial *serial)
+{
+	struct cp210x_serial_private *priv = usb_get_serial_data(serial);
+
+	switch (priv->partnum) {
+	case CP210X_PARTNUM_CP2102:
+		cp2102_determine_quirks(serial);
+		break;
+	default:
+		break;
+	}
+}
+
 static int cp210x_attach(struct usb_serial *serial)
 {
 	int result;
@@ -2107,6 +2152,7 @@ static int cp210x_attach(struct usb_serial *serial)
 
 	usb_set_serial_data(serial, priv);
 
+	cp210x_determine_quirks(serial);
 	cp210x_init_max_speed(serial);
 
 	result = cp210x_gpio_init(serial);

From 35c0dfbbd3448f6c6e71d513a85fd0acec6aa325 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Mon, 20 Sep 2021 12:03:45 +0200
Subject: [PATCH 0602/1750] xen/balloon: fix balloon kthread freezing

commit 96f5bd03e1be606987644b71899ea56a8d05f825 upstream.

Commit 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a
workqueue") switched the Xen balloon driver to use a kernel thread.
Unfortunately the patch omitted to call try_to_freeze() or to use
wait_event_freezable_timeout(), causing a system suspend to fail.

Fixes: 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a workqueue")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/20210920100345.21939-1-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/balloon.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 65fcbc1e076e..15d4b1ef19f8 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -522,8 +522,8 @@ static int balloon_thread(void *unused)
 			timeout = 3600 * HZ;
 		credit = current_credit();
 
-		wait_event_interruptible_timeout(balloon_thread_wq,
-				 balloon_thread_cond(state, credit), timeout);
+		wait_event_freezable_timeout(balloon_thread_wq,
+			balloon_thread_cond(state, credit), timeout);
 
 		if (kthread_should_stop())
 			return 0;

From 59094296058d22864b7eebaed0fa1fc7adda3b74 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 20 Sep 2021 10:26:21 -0700
Subject: [PATCH 0603/1750] qnx4: work around gcc false positive warning bug

commit d5f6545934c47e97c0b48a645418e877b452a992 upstream.

In commit b7213ffa0e58 ("qnx4: avoid stringop-overread errors") I tried
to teach gcc about how the directory entry structure can be two
different things depending on a status flag.  It made the code clearer,
and it seemed to make gcc happy.

However, Arnd points to a gcc bug, where despite using two different
members of a union, gcc then gets confused, and uses the size of one of
the members to decide if a string overrun happens.  And not necessarily
the rigth one.

End result: with some configurations, gcc-11 will still complain about
the source buffer size being overread:

  fs/qnx4/dir.c: In function 'qnx4_readdir':
  fs/qnx4/dir.c:76:32: error: 'strnlen' specified bound [16, 48] exceeds source size 1 [-Werror=stringop-overread]
     76 |                         size = strnlen(name, size);
        |                                ^~~~~~~~~~~~~~~~~~~
  fs/qnx4/dir.c:26:22: note: source object declared here
     26 |                 char de_name;
        |                      ^~~~~~~

because gcc will get confused about which union member entry is actually
getting accessed, even when the source code is very clear about it.  Gcc
internally will have combined two "redundant" pointers (pointing to
different union elements that are at the same offset), and takes the
size checking from one or the other - not necessarily the right one.

This is clearly a gcc bug, but we can work around it fairly easily.  The
biggest thing here is the big honking comment about why we do what we
do.

Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6
Reported-and-tested-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/qnx4/dir.c | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c
index 2a66844b7ff8..66645a5a35f3 100644
--- a/fs/qnx4/dir.c
+++ b/fs/qnx4/dir.c
@@ -20,12 +20,33 @@
  * depending on the status field in the last byte. The
  * first byte is where the name start either way, and a
  * zero means it's empty.
+ *
+ * Also, due to a bug in gcc, we don't want to use the
+ * real (differently sized) name arrays in the inode and
+ * link entries, but always the 'de_name[]' one in the
+ * fake struct entry.
+ *
+ * See
+ *
+ *   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6
+ *
+ * for details, but basically gcc will take the size of the
+ * 'name' array from one of the used union entries randomly.
+ *
+ * This use of 'de_name[]' (48 bytes) avoids the false positive
+ * warnings that would happen if gcc decides to use 'inode.di_name'
+ * (16 bytes) even when the pointer and size were to come from
+ * 'link.dl_name' (48 bytes).
+ *
+ * In all cases the actual name pointer itself is the same, it's
+ * only the gcc internal 'what is the size of this field' logic
+ * that can get confused.
  */
 union qnx4_directory_entry {
 	struct {
-		char de_name;
-		char de_pad[62];
-		char de_status;
+		const char de_name[48];
+		u8 de_pad[15];
+		u8 de_status;
 	};
 	struct qnx4_inode_entry inode;
 	struct qnx4_link_info link;
@@ -53,29 +74,26 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx)
 		ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK;
 		for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) {
 			union qnx4_directory_entry *de;
-			const char *name;
 
 			offset = ix * QNX4_DIR_ENTRY_SIZE;
 			de = (union qnx4_directory_entry *) (bh->b_data + offset);
 
-			if (!de->de_name)
+			if (!de->de_name[0])
 				continue;
 			if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK)))
 				continue;
 			if (!(de->de_status & QNX4_FILE_LINK)) {
 				size = sizeof(de->inode.di_fname);
-				name = de->inode.di_fname;
 				ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1;
 			} else {
 				size = sizeof(de->link.dl_fname);
-				name = de->link.dl_fname;
 				ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) *
 					QNX4_INODES_PER_BLOCK +
 					de->link.dl_inode_ndx;
 			}
-			size = strnlen(name, size);
+			size = strnlen(de->de_name, size);
 			QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name));
-			if (!dir_emit(ctx, name, size, ino, DT_UNKNOWN)) {
+			if (!dir_emit(ctx, de->de_name, size, ino, DT_UNKNOWN)) {
 				brelse(bh);
 				return 0;
 			}

From f93026b28e2afe5060a493b0bbcee19d12961b7e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 30 Sep 2021 10:11:08 +0200
Subject: [PATCH 0604/1750] Linux 5.10.70

Link: https://lore.kernel.org/r/20210927170225.702078779@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20210928071741.331837387@linuxfoundation.org
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index e14943205b83..4a9541a18618 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 69
+SUBLEVEL = 70
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 49faae851078da1bd853dbb66d528ee7af380ebb Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 20 Sep 2021 12:16:55 +0200
Subject: [PATCH 0605/1750] Revert "drm: protect drm_master pointers in
 drm_lease.c"

This reverts commit 34609faad0c9f9f08d4b59d25c94b78bf5710d93 which is
commit 56f0729a510f92151682ff6c89f69724d5595d6e upstream and came into
the tree in 5.10.67.

This commit adds some drm functions for a drm driver that is not used
by Android and it breaks the abi, so revert it.

Fixes: faf816b0f8d0 ("Linux 5.10.67")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I03c28f0b09131c956c9a456b8d8c38e3a13eff5b
---
 drivers/gpu/drm/drm_auth.c  | 25 ------------
 drivers/gpu/drm/drm_lease.c | 81 +++++++++----------------------------
 include/drm/drm_auth.h      |  1 -
 include/drm/drm_file.h      |  6 ---
 4 files changed, 20 insertions(+), 93 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index c7adbeaf10b1..0024ad93d24b 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -376,31 +376,6 @@ struct drm_master *drm_master_get(struct drm_master *master)
 }
 EXPORT_SYMBOL(drm_master_get);
 
-/**
- * drm_file_get_master - reference &drm_file.master of @file_priv
- * @file_priv: DRM file private
- *
- * Increments the reference count of @file_priv's &drm_file.master and returns
- * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
- *
- * Master pointers returned from this function should be unreferenced using
- * drm_master_put().
- */
-struct drm_master *drm_file_get_master(struct drm_file *file_priv)
-{
-	struct drm_master *master = NULL;
-
-	spin_lock(&file_priv->master_lookup_lock);
-	if (!file_priv->master)
-		goto unlock;
-	master = drm_master_get(file_priv->master);
-
-unlock:
-	spin_unlock(&file_priv->master_lookup_lock);
-	return master;
-}
-EXPORT_SYMBOL(drm_file_get_master);
-
 static void drm_master_destroy(struct kref *kref)
 {
 	struct drm_master *master = container_of(kref, struct drm_master, refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index aef22634005e..da4f085fc09e 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -107,19 +107,10 @@ static bool _drm_has_leased(struct drm_master *master, int id)
  */
 bool _drm_lease_held(struct drm_file *file_priv, int id)
 {
-	bool ret;
-	struct drm_master *master;
-
-	if (!file_priv)
+	if (!file_priv || !file_priv->master)
 		return true;
 
-	master = drm_file_get_master(file_priv);
-	if (!master)
-		return true;
-	ret = _drm_lease_held_master(master, id);
-	drm_master_put(&master);
-
-	return ret;
+	return _drm_lease_held_master(file_priv->master, id);
 }
 
 /**
@@ -138,22 +129,13 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
 	struct drm_master *master;
 	bool ret;
 
-	if (!file_priv)
+	if (!file_priv || !file_priv->master || !file_priv->master->lessor)
 		return true;
 
-	master = drm_file_get_master(file_priv);
-	if (!master)
-		return true;
-	if (!master->lessor) {
-		ret = true;
-		goto out;
-	}
+	master = file_priv->master;
 	mutex_lock(&master->dev->mode_config.idr_mutex);
 	ret = _drm_lease_held_master(master, id);
 	mutex_unlock(&master->dev->mode_config.idr_mutex);
-
-out:
-	drm_master_put(&master);
 	return ret;
 }
 
@@ -173,16 +155,10 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
 	int count_in, count_out;
 	uint32_t crtcs_out = 0;
 
-	if (!file_priv)
+	if (!file_priv || !file_priv->master || !file_priv->master->lessor)
 		return crtcs_in;
 
-	master = drm_file_get_master(file_priv);
-	if (!master)
-		return crtcs_in;
-	if (!master->lessor) {
-		crtcs_out = crtcs_in;
-		goto out;
-	}
+	master = file_priv->master;
 	dev = master->dev;
 
 	count_in = count_out = 0;
@@ -201,9 +177,6 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
 		count_in++;
 	}
 	mutex_unlock(&master->dev->mode_config.idr_mutex);
-
-out:
-	drm_master_put(&master);
 	return crtcs_out;
 }
 
@@ -517,7 +490,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	size_t object_count;
 	int ret = 0;
 	struct idr leases;
-	struct drm_master *lessor;
+	struct drm_master *lessor = lessor_priv->master;
 	struct drm_master *lessee = NULL;
 	struct file *lessee_file = NULL;
 	struct file *lessor_file = lessor_priv->filp;
@@ -529,6 +502,12 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
+	/* Do not allow sub-leases */
+	if (lessor->lessor) {
+		DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+		return -EINVAL;
+	}
+
 	/* need some objects */
 	if (cl->object_count == 0) {
 		DRM_DEBUG_LEASE("no objects in lease\n");
@@ -540,22 +519,12 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 		return -EINVAL;
 	}
 
-	lessor = drm_file_get_master(lessor_priv);
-	/* Do not allow sub-leases */
-	if (lessor->lessor) {
-		DRM_DEBUG_LEASE("recursive leasing not allowed\n");
-		ret = -EINVAL;
-		goto out_lessor;
-	}
-
 	object_count = cl->object_count;
 
 	object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
 			array_size(object_count, sizeof(__u32)));
-	if (IS_ERR(object_ids)) {
-		ret = PTR_ERR(object_ids);
-		goto out_lessor;
-	}
+	if (IS_ERR(object_ids))
+		return PTR_ERR(object_ids);
 
 	idr_init(&leases);
 
@@ -566,15 +535,14 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	if (ret) {
 		DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
 		idr_destroy(&leases);
-		goto out_lessor;
+		return ret;
 	}
 
 	/* Allocate a file descriptor for the lease */
 	fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
 	if (fd < 0) {
 		idr_destroy(&leases);
-		ret = fd;
-		goto out_lessor;
+		return fd;
 	}
 
 	DRM_DEBUG_LEASE("Creating lease\n");
@@ -610,7 +578,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 	/* Hook up the fd */
 	fd_install(fd, lessee_file);
 
-	drm_master_put(&lessor);
 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
 	return 0;
 
@@ -620,8 +587,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
 out_leases:
 	put_unused_fd(fd);
 
-out_lessor:
-	drm_master_put(&lessor);
 	DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
 	return ret;
 }
@@ -644,7 +609,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
 	struct drm_mode_list_lessees *arg = data;
 	__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
 	__u32 count_lessees = arg->count_lessees;
-	struct drm_master *lessor, *lessee;
+	struct drm_master *lessor = lessor_priv->master, *lessee;
 	int count;
 	int ret = 0;
 
@@ -655,7 +620,6 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
-	lessor = drm_file_get_master(lessor_priv);
 	DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
 
 	mutex_lock(&dev->mode_config.idr_mutex);
@@ -679,7 +643,6 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
 		arg->count_lessees = count;
 
 	mutex_unlock(&dev->mode_config.idr_mutex);
-	drm_master_put(&lessor);
 
 	return ret;
 }
@@ -699,7 +662,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
 	struct drm_mode_get_lease *arg = data;
 	__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
 	__u32 count_objects = arg->count_objects;
-	struct drm_master *lessee;
+	struct drm_master *lessee = lessee_priv->master;
 	struct idr *object_idr;
 	int count;
 	void *entry;
@@ -713,7 +676,6 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
-	lessee = drm_file_get_master(lessee_priv);
 	DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
 
 	mutex_lock(&dev->mode_config.idr_mutex);
@@ -741,7 +703,6 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
 		arg->count_objects = count;
 
 	mutex_unlock(&dev->mode_config.idr_mutex);
-	drm_master_put(&lessee);
 
 	return ret;
 }
@@ -760,7 +721,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
 				void *data, struct drm_file *lessor_priv)
 {
 	struct drm_mode_revoke_lease *arg = data;
-	struct drm_master *lessor;
+	struct drm_master *lessor = lessor_priv->master;
 	struct drm_master *lessee;
 	int ret = 0;
 
@@ -770,7 +731,6 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
 
-	lessor = drm_file_get_master(lessor_priv);
 	mutex_lock(&dev->mode_config.idr_mutex);
 
 	lessee = _drm_find_lessee(lessor, arg->lessee_id);
@@ -791,7 +751,6 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
 
 fail:
 	mutex_unlock(&dev->mode_config.idr_mutex);
-	drm_master_put(&lessor);
 
 	return ret;
 }
diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
index f99d3417f304..6bf8b2b78991 100644
--- a/include/drm/drm_auth.h
+++ b/include/drm/drm_auth.h
@@ -107,7 +107,6 @@ struct drm_master {
 };
 
 struct drm_master *drm_master_get(struct drm_master *master);
-struct drm_master *drm_file_get_master(struct drm_file *file_priv);
 void drm_master_put(struct drm_master **master);
 bool drm_is_current_master(struct drm_file *fpriv);
 
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index 726cfe0ff5f5..9b82988e3427 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -233,12 +233,6 @@ struct drm_file {
 	 * this only matches &drm_device.master if the master is the currently
 	 * active one.
 	 *
-	 * When dereferencing this pointer, either hold struct
-	 * &drm_device.master_mutex for the duration of the pointer's use, or
-	 * use drm_file_get_master() if struct &drm_device.master_mutex is not
-	 * currently held and there is no other need to hold it. This prevents
-	 * @master from being freed during use.
-	 *
 	 * See also @authentication and @is_master and the :ref:`section on
 	 * primary nodes and authentication <drm_primary_node>`.
 	 */

From 5b4909f961b9830aba93115dbebd20642d3bcbb8 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 20 Sep 2021 12:25:48 +0200
Subject: [PATCH 0606/1750] Revert "drm: serialize drm_file.master with a new
 spinlock"

This reverts commit 06a553a99bacb00d3bc25f79e75c8e0fbf7a5025 which is
commit 0b0860a3cf5eccf183760b1177a1dcdb821b0b66 upstream and came into
the tree in 5.10.67.

The original commit broke the abi and isn't needed for Android systems,
so revert it.

Fixes: faf816b0f8d0 ("Linux 5.10.67")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I601e116ea2a590f52fe12f59df5288329318ec1c
---
 drivers/gpu/drm/drm_auth.c | 17 ++++++-----------
 drivers/gpu/drm/drm_file.c |  1 -
 include/drm/drm_file.h     | 12 +++---------
 3 files changed, 9 insertions(+), 21 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 0024ad93d24b..232abbba3686 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -135,18 +135,16 @@ static void drm_set_master(struct drm_device *dev, struct drm_file *fpriv,
 static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
 {
 	struct drm_master *old_master;
-	struct drm_master *new_master;
 
 	lockdep_assert_held_once(&dev->master_mutex);
 
 	WARN_ON(fpriv->is_master);
 	old_master = fpriv->master;
-	new_master = drm_master_create(dev);
-	if (!new_master)
+	fpriv->master = drm_master_create(dev);
+	if (!fpriv->master) {
+		fpriv->master = old_master;
 		return -ENOMEM;
-	spin_lock(&fpriv->master_lookup_lock);
-	fpriv->master = new_master;
-	spin_unlock(&fpriv->master_lookup_lock);
+	}
 
 	fpriv->is_master = 1;
 	fpriv->authenticated = 1;
@@ -304,13 +302,10 @@ int drm_master_open(struct drm_file *file_priv)
 	/* if there is no current master make this fd it, but do not create
 	 * any master object for render clients */
 	mutex_lock(&dev->master_mutex);
-	if (!dev->master) {
+	if (!dev->master)
 		ret = drm_new_set_master(dev, file_priv);
-	} else {
-		spin_lock(&file_priv->master_lookup_lock);
+	else
 		file_priv->master = drm_master_get(dev->master);
-		spin_unlock(&file_priv->master_lookup_lock);
-	}
 	mutex_unlock(&dev->master_mutex);
 
 	return ret;
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index 95b783de0dec..01670305df3d 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -177,7 +177,6 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)
 	init_waitqueue_head(&file->event_wait);
 	file->event_space = 4096; /* set aside 4k for event buffer */
 
-	spin_lock_init(&file->master_lookup_lock);
 	mutex_init(&file->event_read_lock);
 
 	if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index 9b82988e3427..b81b3bfb08c8 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,21 +226,15 @@ struct drm_file {
 	/**
 	 * @master:
 	 *
-	 * Master this node is currently associated with. Protected by struct
-	 * &drm_device.master_mutex, and serialized by @master_lookup_lock.
-	 *
-	 * Only relevant if drm_is_primary_client() returns true. Note that
-	 * this only matches &drm_device.master if the master is the currently
-	 * active one.
+	 * Master this node is currently associated with. Only relevant if
+	 * drm_is_primary_client() returns true. Note that this only
+	 * matches &drm_device.master if the master is the currently active one.
 	 *
 	 * See also @authentication and @is_master and the :ref:`section on
 	 * primary nodes and authentication <drm_primary_node>`.
 	 */
 	struct drm_master *master;
 
-	/** @master_lock: Serializes @master. */
-	spinlock_t master_lookup_lock;
-
 	/** @pid: Process that opened this file. */
 	struct pid *pid;
 

From 0dae5f42c0e00ce5d85be8c55199770d1fc455d9 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 20 Sep 2021 14:31:19 +0200
Subject: [PATCH 0607/1750] Revert "drm/vmwgfx: fix potential UAF in
 vmwgfx_surface.c"

This reverts commit d6c91423993e8164ca4162ff046c6437bbd75b53 which is
commit 2bc5da528dd570c5ecabc107e6fbdbc55974276f upstream.  It was part
of the drm api change that is not needed for Android devices and not
reverting it was breaking the build.

Fixes: b3666e45277b ("Revert "drm: protect drm_master pointers in drm_lease.c"")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5e526266b214116981319d2d2e2dfa442d74279f
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index f1a51371de5b..f493b20c7a38 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -866,7 +866,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 	user_srf->prime.base.shareable = false;
 	user_srf->prime.base.tfile = NULL;
 	if (drm_is_primary_client(file_priv))
-		user_srf->master = drm_file_get_master(file_priv);
+		user_srf->master = drm_master_get(file_priv->master);
 
 	/**
 	 * From this point, the generic resource management functions
@@ -1537,7 +1537,7 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
 
 	user_srf = container_of(srf, struct vmw_user_surface, srf);
 	if (drm_is_primary_client(file_priv))
-		user_srf->master = drm_file_get_master(file_priv);
+		user_srf->master = drm_master_get(file_priv->master);
 
 	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
 	if (unlikely(ret != 0))

From 91607afb55a1991ce47d9522ec8d3b79084387af Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 30 Sep 2021 16:00:36 +0200
Subject: [PATCH 0608/1750] Revert "crypto: public_key: fix overflow during
 implicit conversion"

This reverts commit 5df14bba0056fb7d075dd6dc8c26ff3da33e4fc1 which is
commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream and came in the
5.10.67 release.

It breaks the ABI for the public_key_verify_signature() function.  While
it does fix a useful thing, it shouldn't be an issue for any Android
devices so reverting should be safe.

Fixes: 5df14bba0056 ("crypto: public_key: fix overflow during implicit conversion")
Cc: Will Deacon <willdeacon@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I30ee9fec7d778b5d10483917975dd0ebe14aab88
---
 include/crypto/public_key.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index f5bd80858fc5..948c5203ca9c 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -39,9 +39,9 @@ extern void public_key_free(struct public_key *key);
 struct public_key_signature {
 	struct asymmetric_key_id *auth_ids[2];
 	u8 *s;			/* Signature */
-	u8 *digest;
 	u32 s_size;		/* Number of bytes in signature */
-	u32 digest_size;	/* Number of bytes in digest */
+	u8 *digest;
+	u8 digest_size;		/* Number of bytes in digest */
 	const char *pkey_algo;
 	const char *hash_algo;
 	const char *encoding;

From dcf0824c26f768f71d5e9b09667353c7df5ada7f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Fri, 1 Oct 2021 17:04:29 +0200
Subject: [PATCH 0609/1750] Revert "treewide: Change list_sort to use const
 pointers"

This reverts commit 55e6f8b3c0f5cc600df12ddd0371d2703b910fd7 which is
commit 4f0f586bf0c898233d8f316f471a21db2abd522d upstream.

This commit is already in this branch, but in a different fashion, as
CFI is included here.  By having this version, there is a crc error that
is due to the use of typedefs.  Reverting this commit changes nothing
and fixes the CRC issue.

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I97849a104acbc88599481f6c5c9d024570ec5c87
---
 arch/arm64/kvm/vgic/vgic-its.c                        |  8 ++++----
 arch/arm64/kvm/vgic/vgic.c                            |  3 +--
 block/blk-mq-sched.c                                  |  3 +--
 block/blk-mq.c                                        |  3 +--
 drivers/acpi/nfit/core.c                              |  3 +--
 drivers/acpi/numa/hmat.c                              |  3 +--
 drivers/clk/keystone/sci-clk.c                        |  4 ++--
 drivers/gpu/drm/drm_modes.c                           |  3 +--
 drivers/gpu/drm/i915/gt/intel_engine_user.c           |  3 +--
 drivers/gpu/drm/i915/gvt/debugfs.c                    |  2 +-
 drivers/gpu/drm/i915/selftests/i915_gem_gtt.c         |  3 +--
 drivers/gpu/drm/radeon/radeon_cs.c                    |  4 ++--
 .../infiniband/hw/usnic/usnic_uiom_interval_tree.c    |  3 +--
 drivers/interconnect/qcom/bcm-voter.c                 |  2 +-
 drivers/md/raid5.c                                    |  3 +--
 drivers/misc/sram.c                                   |  4 ++--
 drivers/pci/controller/cadence/pcie-cadence-host.c    |  3 +--
 drivers/spi/spi-loopback-test.c                       |  3 +--
 fs/btrfs/raid56.c                                     |  3 +--
 fs/btrfs/tree-log.c                                   |  3 +--
 fs/btrfs/volumes.c                                    |  3 +--
 fs/ext4/fsmap.c                                       |  4 ++--
 fs/gfs2/glock.c                                       |  3 +--
 fs/gfs2/log.c                                         |  2 +-
 fs/gfs2/lops.c                                        |  3 +--
 fs/iomap/buffered-io.c                                |  3 +--
 fs/ubifs/gc.c                                         |  7 +++----
 fs/ubifs/replay.c                                     |  4 ++--
 fs/xfs/scrub/bitmap.c                                 |  4 ++--
 fs/xfs/xfs_bmap_item.c                                |  4 ++--
 fs/xfs/xfs_buf.c                                      |  6 +++---
 fs/xfs/xfs_extent_busy.c                              |  4 ++--
 fs/xfs/xfs_extent_busy.h                              |  3 +--
 fs/xfs/xfs_extfree_item.c                             |  4 ++--
 fs/xfs/xfs_refcount_item.c                            |  4 ++--
 fs/xfs/xfs_rmap_item.c                                |  4 ++--
 include/linux/list_sort.h                             |  7 +++----
 lib/list_sort.c                                       | 11 ++++++++---
 lib/test_list_sort.c                                  |  3 +--
 net/tipc/name_table.c                                 |  4 ++--
 40 files changed, 68 insertions(+), 85 deletions(-)

diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
index b9518f94bd43..40cbaca81333 100644
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -2190,8 +2190,8 @@ static int vgic_its_restore_ite(struct vgic_its *its, u32 event_id,
 	return offset;
 }
 
-static int vgic_its_ite_cmp(void *priv, const struct list_head *a,
-			    const struct list_head *b)
+static int vgic_its_ite_cmp(void *priv, struct list_head *a,
+			    struct list_head *b)
 {
 	struct its_ite *itea = container_of(a, struct its_ite, ite_list);
 	struct its_ite *iteb = container_of(b, struct its_ite, ite_list);
@@ -2329,8 +2329,8 @@ static int vgic_its_restore_dte(struct vgic_its *its, u32 id,
 	return offset;
 }
 
-static int vgic_its_device_cmp(void *priv, const struct list_head *a,
-			       const struct list_head *b)
+static int vgic_its_device_cmp(void *priv, struct list_head *a,
+			       struct list_head *b)
 {
 	struct its_device *deva = container_of(a, struct its_device, dev_list);
 	struct its_device *devb = container_of(b, struct its_device, dev_list);
diff --git a/arch/arm64/kvm/vgic/vgic.c b/arch/arm64/kvm/vgic/vgic.c
index 15b666200f0b..1c597c9885fa 100644
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -255,8 +255,7 @@ static struct kvm_vcpu *vgic_target_oracle(struct vgic_irq *irq)
  * Return negative if "a" sorts before "b", 0 to preserve order, and positive
  * to sort "b" before "a".
  */
-static int vgic_irq_cmp(void *priv, const struct list_head *a,
-			const struct list_head *b)
+static int vgic_irq_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct vgic_irq *irqa = container_of(a, struct vgic_irq, ap_list);
 	struct vgic_irq *irqb = container_of(b, struct vgic_irq, ap_list);
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 24c08963890e..581be65a53c1 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -75,8 +75,7 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
 	blk_mq_run_hw_queue(hctx, true);
 }
 
-static int sched_rq_cmp(void *priv, const struct list_head *a,
-			const struct list_head *b)
+static int sched_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct request *rqa = container_of(a, struct request, queuelist);
 	struct request *rqb = container_of(b, struct request, queuelist);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index fe59a6c75415..61091c0be54a 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1924,8 +1924,7 @@ void blk_mq_insert_requests(struct blk_mq_hw_ctx *hctx, struct blk_mq_ctx *ctx,
 	spin_unlock(&ctx->lock);
 }
 
-static int plug_rq_cmp(void *priv, const struct list_head *a,
-		       const struct list_head *b)
+static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct request *rqa = container_of(a, struct request, queuelist);
 	struct request *rqb = container_of(b, struct request, queuelist);
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index d061bff5cc96..cb18cb5c51b1 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1194,8 +1194,7 @@ static int __nfit_mem_init(struct acpi_nfit_desc *acpi_desc,
 	return 0;
 }
 
-static int nfit_mem_cmp(void *priv, const struct list_head *_a,
-		const struct list_head *_b)
+static int nfit_mem_cmp(void *priv, struct list_head *_a, struct list_head *_b)
 {
 	struct nfit_mem *a = container_of(_a, typeof(*a), list);
 	struct nfit_mem *b = container_of(_b, typeof(*b), list);
diff --git a/drivers/acpi/numa/hmat.c b/drivers/acpi/numa/hmat.c
index 137a5dd880c2..cb73a5d6ea76 100644
--- a/drivers/acpi/numa/hmat.c
+++ b/drivers/acpi/numa/hmat.c
@@ -558,8 +558,7 @@ static bool hmat_update_best(u8 type, u32 value, u32 *best)
 	return updated;
 }
 
-static int initiator_cmp(void *priv, const struct list_head *a,
-			 const struct list_head *b)
+static int initiator_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct memory_initiator *ia;
 	struct memory_initiator *ib;
diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c
index 7e1b136e71ae..aaf31abe1c8f 100644
--- a/drivers/clk/keystone/sci-clk.c
+++ b/drivers/clk/keystone/sci-clk.c
@@ -503,8 +503,8 @@ static int ti_sci_scan_clocks_from_fw(struct sci_clk_provider *provider)
 
 #else
 
-static int _cmp_sci_clk_list(void *priv, const struct list_head *a,
-			     const struct list_head *b)
+static int _cmp_sci_clk_list(void *priv, struct list_head *a,
+			     struct list_head *b)
 {
 	struct sci_clk *ca = container_of(a, struct sci_clk, node);
 	struct sci_clk *cb = container_of(b, struct sci_clk, node);
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index d42c7310bf09..39b092e33e71 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1290,8 +1290,7 @@ EXPORT_SYMBOL(drm_mode_prune_invalid);
  * Negative if @lh_a is better than @lh_b, zero if they're equivalent, or
  * positive if @lh_b is better than @lh_a.
  */
-static int drm_mode_compare(void *priv, const struct list_head *lh_a,
-			    const struct list_head *lh_b)
+static int drm_mode_compare(void *priv, struct list_head *lh_a, struct list_head *lh_b)
 {
 	struct drm_display_mode *a = list_entry(lh_a, struct drm_display_mode, head);
 	struct drm_display_mode *b = list_entry(lh_b, struct drm_display_mode, head);
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_user.c b/drivers/gpu/drm/i915/gt/intel_engine_user.c
index da21d2a10cc9..34e6096f196e 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_user.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_user.c
@@ -49,8 +49,7 @@ static const u8 uabi_classes[] = {
 	[VIDEO_ENHANCEMENT_CLASS] = I915_ENGINE_CLASS_VIDEO_ENHANCE,
 };
 
-static int engine_cmp(void *priv, const struct list_head *A,
-		      const struct list_head *B)
+static int engine_cmp(void *priv, struct list_head *A, struct list_head *B)
 {
 	const struct intel_engine_cs *a =
 		container_of((struct rb_node *)A, typeof(*a), uabi_node);
diff --git a/drivers/gpu/drm/i915/gvt/debugfs.c b/drivers/gpu/drm/i915/gvt/debugfs.c
index 9f1c209d9251..62e6a14ad58e 100644
--- a/drivers/gpu/drm/i915/gvt/debugfs.c
+++ b/drivers/gpu/drm/i915/gvt/debugfs.c
@@ -41,7 +41,7 @@ struct diff_mmio {
 
 /* Compare two diff_mmio items. */
 static int mmio_offset_compare(void *priv,
-	const struct list_head *a, const struct list_head *b)
+	struct list_head *a, struct list_head *b)
 {
 	struct diff_mmio *ma;
 	struct diff_mmio *mb;
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
index 65e28c4cd4ce..713770fb2b92 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
@@ -1075,8 +1075,7 @@ static int igt_ppgtt_shrink_boom(void *arg)
 	return exercise_ppgtt(arg, shrink_boom);
 }
 
-static int sort_holes(void *priv, const struct list_head *A,
-		      const struct list_head *B)
+static int sort_holes(void *priv, struct list_head *A, struct list_head *B)
 {
 	struct drm_mm_node *a = list_entry(A, typeof(*a), hole_stack);
 	struct drm_mm_node *b = list_entry(B, typeof(*b), hole_stack);
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index a78b60b62caf..21ce2f9502c0 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -394,8 +394,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
 	return 0;
 }
 
-static int cmp_size_smaller_first(void *priv, const struct list_head *a,
-				  const struct list_head *b)
+static int cmp_size_smaller_first(void *priv, struct list_head *a,
+				  struct list_head *b)
 {
 	struct radeon_bo_list *la = list_entry(a, struct radeon_bo_list, tv.head);
 	struct radeon_bo_list *lb = list_entry(b, struct radeon_bo_list, tv.head);
diff --git a/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c b/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c
index 29d71267af78..d399523206c7 100644
--- a/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c
+++ b/drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c
@@ -83,8 +83,7 @@ usnic_uiom_interval_node_alloc(long int start, long int last, int ref_cnt,
 	return interval;
 }
 
-static int interval_cmp(void *priv, const struct list_head *a,
-			const struct list_head *b)
+static int interval_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct usnic_uiom_interval_node *node_a, *node_b;
 
diff --git a/drivers/interconnect/qcom/bcm-voter.c b/drivers/interconnect/qcom/bcm-voter.c
index 3c0809095a31..dd0e3bd50b94 100644
--- a/drivers/interconnect/qcom/bcm-voter.c
+++ b/drivers/interconnect/qcom/bcm-voter.c
@@ -39,7 +39,7 @@ struct bcm_voter {
 	u32 tcs_wait;
 };
 
-static int cmp_vcd(void *priv, const struct list_head *a, const struct list_head *b)
+static int cmp_vcd(void *priv, struct list_head *a, struct list_head *b)
 {
 	const struct qcom_icc_bcm *bcm_a =
 			list_entry(a, struct qcom_icc_bcm, list);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index c82953a3299e..39343479ac2a 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -953,8 +953,7 @@ static void dispatch_bio_list(struct bio_list *tmp)
 		submit_bio_noacct(bio);
 }
 
-static int cmp_stripe(void *priv, const struct list_head *a,
-		      const struct list_head *b)
+static int cmp_stripe(void *priv, struct list_head *a, struct list_head *b)
 {
 	const struct r5pending_data *da = list_entry(a,
 				struct r5pending_data, sibling);
diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index 202bf951e909..6c1a23cb3e8c 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -144,8 +144,8 @@ static void sram_free_partitions(struct sram_dev *sram)
 	}
 }
 
-static int sram_reserve_cmp(void *priv, const struct list_head *a,
-					const struct list_head *b)
+static int sram_reserve_cmp(void *priv, struct list_head *a,
+					struct list_head *b)
 {
 	struct sram_reserve *ra = list_entry(a, struct sram_reserve, list);
 	struct sram_reserve *rb = list_entry(b, struct sram_reserve, list);
diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index fb96d37a135c..a40ed9e12b4b 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -345,8 +345,7 @@ static int cdns_pcie_host_bar_config(struct cdns_pcie_rc *rc,
 	return 0;
 }
 
-static int cdns_pcie_host_dma_ranges_cmp(void *priv, const struct list_head *a,
-					 const struct list_head *b)
+static int cdns_pcie_host_dma_ranges_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct resource_entry *entry1, *entry2;
 
diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
index 4d4f77a186a9..89b91cdfb2a5 100644
--- a/drivers/spi/spi-loopback-test.c
+++ b/drivers/spi/spi-loopback-test.c
@@ -454,8 +454,7 @@ struct rx_ranges {
 	u8 *end;
 };
 
-static int rx_ranges_cmp(void *priv, const struct list_head *a,
-			 const struct list_head *b)
+static int rx_ranges_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct rx_ranges *rx_a = list_entry(a, struct rx_ranges, list);
 	struct rx_ranges *rx_b = list_entry(b, struct rx_ranges, list);
diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c
index e65d0fabb83e..9d33bf0154ab 100644
--- a/fs/btrfs/raid56.c
+++ b/fs/btrfs/raid56.c
@@ -1646,8 +1646,7 @@ struct btrfs_plug_cb {
 /*
  * rbios on the plug list are sorted for easier merging.
  */
-static int plug_cmp(void *priv, const struct list_head *a,
-		    const struct list_head *b)
+static int plug_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct btrfs_raid_bio *ra = container_of(a, struct btrfs_raid_bio,
 						 plug_list);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 7bf3936aceda..ec25e5eab349 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4070,8 +4070,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans,
 	return ret;
 }
 
-static int extent_cmp(void *priv, const struct list_head *a,
-		      const struct list_head *b)
+static int extent_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct extent_map *em1, *em2;
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d8b8764f5bd1..509811aabb3f 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1226,8 +1226,7 @@ static int open_fs_devices(struct btrfs_fs_devices *fs_devices,
 	return 0;
 }
 
-static int devid_cmp(void *priv, const struct list_head *a,
-		     const struct list_head *b)
+static int devid_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct btrfs_device *dev1, *dev2;
 
diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
index 4493ef0c715e..4c2a9fe30067 100644
--- a/fs/ext4/fsmap.c
+++ b/fs/ext4/fsmap.c
@@ -354,8 +354,8 @@ static unsigned int ext4_getfsmap_find_sb(struct super_block *sb,
 
 /* Compare two fsmap items. */
 static int ext4_getfsmap_compare(void *priv,
-				 const struct list_head *a,
-				 const struct list_head *b)
+				 struct list_head *a,
+				 struct list_head *b)
 {
 	struct ext4_fsmap *fa;
 	struct ext4_fsmap *fb;
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 03c3407c8e26..cd43c481df4b 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1744,8 +1744,7 @@ void gfs2_glock_complete(struct gfs2_glock *gl, int ret)
 	spin_unlock(&gl->gl_lockref.lock);
 }
 
-static int glock_cmp(void *priv, const struct list_head *a,
-		     const struct list_head *b)
+static int glock_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct gfs2_glock *gla, *glb;
 
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 7473b894e3c6..1955dea999f7 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -605,7 +605,7 @@ void log_flush_wait(struct gfs2_sbd *sdp)
 	}
 }
 
-static int ip_cmp(void *priv, const struct list_head *a, const struct list_head *b)
+static int ip_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct gfs2_inode *ipa, *ipb;
 
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 383ac2190ded..3922b26264f5 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -627,8 +627,7 @@ static void gfs2_check_magic(struct buffer_head *bh)
 	kunmap_atomic(kaddr);
 }
 
-static int blocknr_cmp(void *priv, const struct list_head *a,
-		       const struct list_head *b)
+static int blocknr_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct gfs2_bufdata *bda, *bdb;
 
diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index cd9f7baa5bb7..caed9d98c64a 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -1155,8 +1155,7 @@ iomap_ioend_try_merge(struct iomap_ioend *ioend, struct list_head *more_ioends,
 EXPORT_SYMBOL_GPL(iomap_ioend_try_merge);
 
 static int
-iomap_ioend_compare(void *priv, const struct list_head *a,
-		const struct list_head *b)
+iomap_ioend_compare(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct iomap_ioend *ia = container_of(a, struct iomap_ioend, io_list);
 	struct iomap_ioend *ib = container_of(b, struct iomap_ioend, io_list);
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index dc3e26e9ed7b..a4aaeea63893 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -102,8 +102,7 @@ static int switch_gc_head(struct ubifs_info *c)
  * This function compares data nodes @a and @b. Returns %1 if @a has greater
  * inode or block number, and %-1 otherwise.
  */
-static int data_nodes_cmp(void *priv, const struct list_head *a,
-			  const struct list_head *b)
+static int data_nodes_cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	ino_t inuma, inumb;
 	struct ubifs_info *c = priv;
@@ -146,8 +145,8 @@ static int data_nodes_cmp(void *priv, const struct list_head *a,
  * first and sorted by length in descending order. Directory entry nodes go
  * after inode nodes and are sorted in ascending hash valuer order.
  */
-static int nondata_nodes_cmp(void *priv, const struct list_head *a,
-			     const struct list_head *b)
+static int nondata_nodes_cmp(void *priv, struct list_head *a,
+			     struct list_head *b)
 {
 	ino_t inuma, inumb;
 	struct ubifs_info *c = priv;
diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
index b2f5563d1489..1c6fc99fca30 100644
--- a/fs/ubifs/replay.c
+++ b/fs/ubifs/replay.c
@@ -299,8 +299,8 @@ static int apply_replay_entry(struct ubifs_info *c, struct replay_entry *r)
  * entries @a and @b by comparing their sequence numer.  Returns %1 if @a has
  * greater sequence number and %-1 otherwise.
  */
-static int replay_entries_cmp(void *priv, const struct list_head *a,
-			      const struct list_head *b)
+static int replay_entries_cmp(void *priv, struct list_head *a,
+			      struct list_head *b)
 {
 	struct ubifs_info *c = priv;
 	struct replay_entry *ra, *rb;
diff --git a/fs/xfs/scrub/bitmap.c b/fs/xfs/scrub/bitmap.c
index 813b5f219113..f88694f22d05 100644
--- a/fs/xfs/scrub/bitmap.c
+++ b/fs/xfs/scrub/bitmap.c
@@ -63,8 +63,8 @@ xbitmap_init(
 static int
 xbitmap_range_cmp(
 	void			*priv,
-	const struct list_head	*a,
-	const struct list_head	*b)
+	struct list_head	*a,
+	struct list_head	*b)
 {
 	struct xbitmap_range	*ap;
 	struct xbitmap_range	*bp;
diff --git a/fs/xfs/xfs_bmap_item.c b/fs/xfs/xfs_bmap_item.c
index 984bb480f177..9e16a4d0f97c 100644
--- a/fs/xfs/xfs_bmap_item.c
+++ b/fs/xfs/xfs_bmap_item.c
@@ -265,8 +265,8 @@ xfs_trans_log_finish_bmap_update(
 static int
 xfs_bmap_update_diff_items(
 	void				*priv,
-	const struct list_head		*a,
-	const struct list_head		*b)
+	struct list_head		*a,
+	struct list_head		*b)
 {
 	struct xfs_bmap_intent		*ba;
 	struct xfs_bmap_intent		*bb;
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 118819030dbb..4e4cf91f4f9f 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -2114,9 +2114,9 @@ xfs_buf_delwri_queue(
  */
 static int
 xfs_buf_cmp(
-	void			*priv,
-	const struct list_head	*a,
-	const struct list_head	*b)
+	void		*priv,
+	struct list_head *a,
+	struct list_head *b)
 {
 	struct xfs_buf	*ap = container_of(a, struct xfs_buf, b_list);
 	struct xfs_buf	*bp = container_of(b, struct xfs_buf, b_list);
diff --git a/fs/xfs/xfs_extent_busy.c b/fs/xfs/xfs_extent_busy.c
index 5c2695a42de1..3991e59cfd18 100644
--- a/fs/xfs/xfs_extent_busy.c
+++ b/fs/xfs/xfs_extent_busy.c
@@ -643,8 +643,8 @@ xfs_extent_busy_wait_all(
 int
 xfs_extent_busy_ag_cmp(
 	void			*priv,
-	const struct list_head	*l1,
-	const struct list_head	*l2)
+	struct list_head	*l1,
+	struct list_head	*l2)
 {
 	struct xfs_extent_busy	*b1 =
 		container_of(l1, struct xfs_extent_busy, list);
diff --git a/fs/xfs/xfs_extent_busy.h b/fs/xfs/xfs_extent_busy.h
index 8aea07100092..990ab3891971 100644
--- a/fs/xfs/xfs_extent_busy.h
+++ b/fs/xfs/xfs_extent_busy.h
@@ -58,8 +58,7 @@ void
 xfs_extent_busy_wait_all(struct xfs_mount *mp);
 
 int
-xfs_extent_busy_ag_cmp(void *priv, const struct list_head *a,
-	const struct list_head *b);
+xfs_extent_busy_ag_cmp(void *priv, struct list_head *a, struct list_head *b);
 
 static inline void xfs_extent_busy_sort(struct list_head *list)
 {
diff --git a/fs/xfs/xfs_extfree_item.c b/fs/xfs/xfs_extfree_item.c
index 5c0395256bd1..6c11bfc3d452 100644
--- a/fs/xfs/xfs_extfree_item.c
+++ b/fs/xfs/xfs_extfree_item.c
@@ -397,8 +397,8 @@ xfs_trans_free_extent(
 static int
 xfs_extent_free_diff_items(
 	void				*priv,
-	const struct list_head		*a,
-	const struct list_head		*b)
+	struct list_head		*a,
+	struct list_head		*b)
 {
 	struct xfs_mount		*mp = priv;
 	struct xfs_extent_free_item	*ra;
diff --git a/fs/xfs/xfs_refcount_item.c b/fs/xfs/xfs_refcount_item.c
index 0dee316283a9..7529eb63ce94 100644
--- a/fs/xfs/xfs_refcount_item.c
+++ b/fs/xfs/xfs_refcount_item.c
@@ -269,8 +269,8 @@ xfs_trans_log_finish_refcount_update(
 static int
 xfs_refcount_update_diff_items(
 	void				*priv,
-	const struct list_head		*a,
-	const struct list_head		*b)
+	struct list_head		*a,
+	struct list_head		*b)
 {
 	struct xfs_mount		*mp = priv;
 	struct xfs_refcount_intent	*ra;
diff --git a/fs/xfs/xfs_rmap_item.c b/fs/xfs/xfs_rmap_item.c
index 20905953fe76..7adc996ca6e3 100644
--- a/fs/xfs/xfs_rmap_item.c
+++ b/fs/xfs/xfs_rmap_item.c
@@ -337,8 +337,8 @@ xfs_trans_log_finish_rmap_update(
 static int
 xfs_rmap_update_diff_items(
 	void				*priv,
-	const struct list_head		*a,
-	const struct list_head		*b)
+	struct list_head		*a,
+	struct list_head		*b)
 {
 	struct xfs_mount		*mp = priv;
 	struct xfs_rmap_intent		*ra;
diff --git a/include/linux/list_sort.h b/include/linux/list_sort.h
index 453105f74e05..20f178c24e9d 100644
--- a/include/linux/list_sort.h
+++ b/include/linux/list_sort.h
@@ -6,9 +6,8 @@
 
 struct list_head;
 
-typedef int __attribute__((nonnull(2,3))) (*list_cmp_func_t)(void *,
-		const struct list_head *, const struct list_head *);
-
 __attribute__((nonnull(2,3)))
-void list_sort(void *priv, struct list_head *head, list_cmp_func_t cmp);
+void list_sort(void *priv, struct list_head *head,
+	       int (*cmp)(void *priv, struct list_head *a,
+			  struct list_head *b));
 #endif
diff --git a/lib/list_sort.c b/lib/list_sort.c
index a926d96ffd44..b14accf4ef83 100644
--- a/lib/list_sort.c
+++ b/lib/list_sort.c
@@ -7,13 +7,16 @@
 #include <linux/list_sort.h>
 #include <linux/list.h>
 
+typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
+		struct list_head *, struct list_head *);
+
 /*
  * Returns a list organized in an intermediate format suited
  * to chaining of merge() calls: null-terminated, no reserved or
  * sentinel head node, "prev" links not maintained.
  */
 __attribute__((nonnull(2,3,4)))
-static struct list_head *merge(void *priv, list_cmp_func_t cmp,
+static struct list_head *merge(void *priv, cmp_func cmp,
 				struct list_head *a, struct list_head *b)
 {
 	struct list_head *head, **tail = &head;
@@ -49,7 +52,7 @@ static struct list_head *merge(void *priv, list_cmp_func_t cmp,
  * throughout.
  */
 __attribute__((nonnull(2,3,4,5)))
-static void merge_final(void *priv, list_cmp_func_t cmp, struct list_head *head,
+static void merge_final(void *priv, cmp_func cmp, struct list_head *head,
 			struct list_head *a, struct list_head *b)
 {
 	struct list_head *tail = head;
@@ -182,7 +185,9 @@ static void merge_final(void *priv, list_cmp_func_t cmp, struct list_head *head,
  * 2^(k+1) - 1 (second merge of case 5 when x == 2^(k-1) - 1).
  */
 __attribute__((nonnull(2,3)))
-void list_sort(void *priv, struct list_head *head, list_cmp_func_t cmp)
+void list_sort(void *priv, struct list_head *head,
+		int (*cmp)(void *priv, struct list_head *a,
+			struct list_head *b))
 {
 	struct list_head *list = head->next, *pending = NULL;
 	size_t count = 0;	/* Count of pending */
diff --git a/lib/test_list_sort.c b/lib/test_list_sort.c
index 00daaf23316f..1f017d3b610e 100644
--- a/lib/test_list_sort.c
+++ b/lib/test_list_sort.c
@@ -56,8 +56,7 @@ static int __init check(struct debug_el *ela, struct debug_el *elb)
 	return 0;
 }
 
-static int __init cmp(void *priv, const struct list_head *a,
-		      const struct list_head *b)
+static int __init cmp(void *priv, struct list_head *a, struct list_head *b)
 {
 	struct debug_el *ela, *elb;
 
diff --git a/net/tipc/name_table.c b/net/tipc/name_table.c
index f6a6acef4223..2ac33d32edc2 100644
--- a/net/tipc/name_table.c
+++ b/net/tipc/name_table.c
@@ -381,8 +381,8 @@ static struct publication *tipc_service_remove_publ(struct service_range *sr,
  * Code reused: time_after32() for the same purpose
  */
 #define publication_after(pa, pb) time_after32((pa)->id, (pb)->id)
-static int tipc_publ_sort(void *priv, const struct list_head *a,
-			  const struct list_head *b)
+static int tipc_publ_sort(void *priv, struct list_head *a,
+			  struct list_head *b)
 {
 	struct publication *pa, *pb;
 

From 87b6b38b53ea6abdbfcd8ea89b1c366c2794ca2a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 6 Oct 2021 09:50:53 +0200
Subject: [PATCH 0610/1750] ANDROID: GKI: update .xml file with new symbols to
 track

After merging with android12-5.10, the .xml file needs to have more
symbols added to it to track them properly.

Functions changes summary: 0 Removed, 0 Changed (3770 filtered out), 154 Added functions
Variables changes summary: 0 Removed, 0 Changed (357 filtered out), 33 Added variables

154 Added functions:

  [A] 'function int __hid_register_driver(hid_driver*, module*, const char*)'
  [A] 'function int __hid_request(hid_device*, hid_report*, int)'
  [A] 'function int __irq_alloc_domain_generic_chips(irq_domain*, int, int, const char*, irq_flow_handler_t, unsigned int, unsigned int, irq_gc_flags)'
  [A] 'function void __rt_mutex_init(rt_mutex*, const char*, lock_class_key*)'
  [A] 'function int __traceiter_android_rvh_ufs_complete_init(void*, ufs_hba*)'
  [A] 'function int __traceiter_android_vh_kmalloc_slab(void*, unsigned int, gfp_t, kmem_cache**)'
  [A] 'function int __traceiter_android_vh_save_track_hash(void*, bool, unsigned long int)'
  [A] 'function int __traceiter_android_vh_save_vmalloc_stack(void*, unsigned long int, vm_struct*)'
  [A] 'function int __traceiter_android_vh_show_stack_hash(void*, seq_file*, vm_struct*)'
  [A] 'function int __traceiter_android_vh_usb_dev_resume(void*, usb_device*, pm_message_t, int*)'
  [A] 'function int __traceiter_android_vh_usb_dev_suspend(void*, usb_device*, pm_message_t, int*)'
  [A] 'function tty_driver* __tty_alloc_driver(unsigned int, module*, unsigned long int)'
  [A] 'function int __usb_get_extra_descriptor(char*, unsigned int, unsigned char, void**, size_t)'
  [A] 'function int __v4l2_ctrl_s_ctrl_compound(v4l2_ctrl*, v4l2_ctrl_type, void*)'
  [A] 'function unsigned int _bcd2bin(unsigned char)'
  [A] 'function unsigned char _bin2bcd(unsigned int)'
  [A] 'function int _kstrtoul(const char*, unsigned int, unsigned long int*)'
  [A] 'function int cdc_ncm_bind_common(usbnet*, usb_interface*, u8, int)'
  [A] 'function int cdc_ncm_change_mtu(net_device*, int)'
  [A] 'function sk_buff* cdc_ncm_fill_tx_frame(usbnet*, sk_buff*, __le32)'
  [A] 'function int cdc_ncm_rx_verify_ndp16(sk_buff*, int)'
  [A] 'function int cdc_ncm_rx_verify_nth16(cdc_ncm_ctx*, sk_buff*)'
  [A] 'function u8 cdc_ncm_select_altsetting(usb_interface*)'
  [A] 'function void cdc_ncm_unbind(usbnet*, usb_interface*)'
  [A] 'function int cdc_parse_cdc_header(usb_cdc_parsed_header*, usb_interface*, u8*, int)'
  [A] 'function int clk_get_phase(clk*)'
  [A] 'function clk* clk_register_mux_table(device*, const char*, const char* const*, u8, unsigned long int, void*, u8, u32, u8, u32*, spinlock_t*)'
  [A] 'function int clk_set_phase(clk*, int)'
  [A] 'function void cpufreq_dbs_governor_exit(cpufreq_policy*)'
  [A] 'function int cpufreq_dbs_governor_init(cpufreq_policy*)'
  [A] 'function void cpufreq_dbs_governor_limits(cpufreq_policy*)'
  [A] 'function int cpufreq_dbs_governor_start(cpufreq_policy*)'
  [A] 'function void cpufreq_dbs_governor_stop(cpufreq_policy*)'
  [A] 'function void cpufreq_update_limits(unsigned int)'
  [A] 'function u16 crc16(u16, const u8*, size_t)'
  [A] 'function unsigned int dbs_update(cpufreq_policy*)'
  [A] 'function opp_table* dev_pm_opp_set_prop_name(device*, const char*)'
  [A] 'function int dev_set_mac_address(net_device*, sockaddr*, netlink_ext_ack*)'
  [A] 'function int devfreq_event_disable_edev(devfreq_event_dev*)'
  [A] 'function int devfreq_event_enable_edev(devfreq_event_dev*)'
  [A] 'function devfreq_event_dev* devfreq_event_get_edev_by_phandle(device*, const char*, int)'
  [A] 'function int devfreq_event_get_edev_count(device*, const char*)'
  [A] 'function int devfreq_event_get_event(devfreq_event_dev*, devfreq_event_data*)'
  [A] 'function devfreq_event_dev* devm_devfreq_event_add_edev(device*, devfreq_event_desc*)'
  [A] 'function int devm_devfreq_register_opp_notifier(device*, devfreq*)'
  [A] 'function gpio_desc* devm_gpiod_get_index_optional(device*, const char*, unsigned int, gpiod_flags)'
  [A] 'function void* devm_pci_remap_cfg_resource(device*, resource*)'
  [A] 'function int down_write_trylock(rw_semaphore*)'
  [A] 'function int driver_attach(device_driver*)'
  [A] 'function void drm_mode_sort(list_head*)'
  [A] 'function int extcon_set_state(extcon_dev*, unsigned int, bool)'
  [A] 'function int extcon_sync(extcon_dev*, unsigned int)'
  [A] 'function void gov_update_cpu_data(dbs_data*)'
  [A] 'function int gpiod_is_active_low(const gpio_desc*)'
  [A] 'function void hid_hw_close(hid_device*)'
  [A] 'function int hid_hw_open(hid_device*)'
  [A] 'function int hid_hw_start(hid_device*, unsigned int)'
  [A] 'function void hid_hw_stop(hid_device*)'
  [A] 'function int hid_open_report(hid_device*)'
  [A] 'function int hid_report_raw_event(hid_device*, int, u8*, u32, int)'
  [A] 'function void hid_unregister_driver(hid_driver*)'
  [A] 'function hid_report* hid_validate_values(hid_device*, unsigned int, unsigned int, unsigned int, unsigned int)'
  [A] 'function void iio_channel_release_all(iio_channel*)'
  [A] 'function int iio_update_buffers(iio_dev*, iio_buffer*, iio_buffer*)'
  [A] 'function void in6_dev_finish_destroy(inet6_dev*)'
  [A] 'function bool inode_owner_or_capable(const inode*)'
  [A] 'function int inode_permission(inode*, int)'
  [A] 'function int input_ff_create_memless(input_dev*, void*, int (input_dev*, void*, ff_effect*)*)'
  [A] 'function void input_set_poll_interval(input_dev*, unsigned int)'
  [A] 'function int input_setup_polling(input_dev*, void (input_dev*)*)'
  [A] 'function int irq_gc_set_wake(irq_data*, unsigned int)'
  [A] 'function irq_chip_generic* irq_get_domain_generic_chip(irq_domain*, unsigned int)'
  [A] 'function int of_get_drm_display_mode(device_node*, drm_display_mode*, u32*, int)'
  [A] 'function int of_pci_get_max_link_speed(device_node*)'
  [A] 'function pinctrl_dev* of_pinctrl_get(device_node*)'
  [A] 'function usb_dr_mode of_usb_get_dr_mode_by_phy(device_node*, int)'
  [A] 'function void on_each_cpu_cond(smp_cond_func_t, smp_call_func_t, void*, bool)'
  [A] 'function void pci_remove_root_bus(pci_bus*)'
  [A] 'function int pci_sriov_configure_simple(pci_dev*, int)'
  [A] 'function void pci_stop_root_bus(pci_bus*)'
  [A] 'function int phy_connect_direct(net_device*, phy_device*, void (net_device*)*, phy_interface_t)'
  [A] 'function phy_device* phy_find_first(mii_bus*)'
  [A] 'function void phy_get_pause(phy_device*, bool*, bool*)'
  [A] 'function int phy_mipi_dphy_config_validate(phy_configure_opts_mipi_dphy*)'
  [A] 'function int platform_msi_domain_alloc_irqs(device*, unsigned int, irq_write_msi_msg_t)'
  [A] 'function void platform_msi_domain_free_irqs(device*)'
  [A] 'function int pm_clk_add_clk(device*, clk*)'
  [A] 'function void pm_get_active_wakeup_sources(char*, size_t)'
  [A] 'function int power_supply_am_i_supplied(power_supply*)'
  [A] 'function int profile_event_register(profile_type, notifier_block*)'
  [A] 'function int profile_event_unregister(profile_type, notifier_block*)'
  [A] 'function void put_tty_driver(tty_driver*)'
  [A] 'function int pwm_adjust_config(pwm_device*)'
  [A] 'function int register_qdisc(Qdisc_ops*)'
  [A] 'function int regulator_set_pull_down_regmap(regulator_dev*)'
  [A] 'function int rtc_read_alarm(rtc_device*, rtc_wkalrm*)'
  [A] 'function int rtc_set_alarm(rtc_device*, rtc_wkalrm*)'
  [A] 'function int scsi_register_driver(device_driver*)'
  [A] 'function void sdhci_adma_write_desc(sdhci_host*, void**, dma_addr_t, int, unsigned int)'
  [A] 'function unsigned int sdhci_pltfm_clk_get_max_clock(sdhci_host*)'
  [A] 'function int sdhci_pltfm_unregister(platform_device*)'
  [A] 'function void sdhci_set_clock(sdhci_host*, unsigned int)'
  [A] 'function void sdhci_set_power_and_bus_voltage(sdhci_host*, unsigned char, unsigned short int)'
  [A] 'function void sdhci_set_uhs_signaling(sdhci_host*, unsigned int)'
  [A] 'function u8 sdio_writeb_readb(sdio_func*, u8, unsigned int, int*)'
  [A] 'function int smp_call_function_single_async(int, __call_single_data*)'
  [A] 'function unsigned int stack_trace_save_regs(pt_regs*, unsigned long int*, unsigned int, unsigned int)'
  [A] 'function ssize_t store_sampling_rate(gov_attr_set*, const char*, size_t)'
  [A] 'function int tcp_register_congestion_control(tcp_congestion_ops*)'
  [A] 'function void tcp_reno_cong_avoid(sock*, u32, u32)'
  [A] 'function u32 tcp_reno_ssthresh(sock*)'
  [A] 'function u32 tcp_reno_undo_cwnd(sock*)'
  [A] 'function u32 tcp_slow_start(tcp_sock*, u32)'
  [A] 'function void tcp_unregister_congestion_control(tcp_congestion_ops*)'
  [A] 'function unsigned long int timespec64_to_jiffies(const timespec64*)'
  [A] 'function void tty_ldisc_deref(tty_ldisc*)'
  [A] 'function tty_ldisc* tty_ldisc_ref(tty_struct*)'
  [A] 'function void tty_port_close(tty_port*, tty_struct*, file*)'
  [A] 'function void tty_port_destroy(tty_port*)'
  [A] 'function void tty_port_hangup(tty_port*)'
  [A] 'function void tty_port_init(tty_port*)'
  [A] 'function int tty_port_open(tty_port*, tty_struct*, file*)'
  [A] 'function device* tty_port_register_device(tty_port*, tty_driver*, unsigned int, device*)'
  [A] 'function void tty_port_tty_wakeup(tty_port*)'
  [A] 'function int tty_register_driver(tty_driver*)'
  [A] 'function void tty_set_operations(tty_driver*, const tty_operations*)'
  [A] 'function int tty_standard_install(tty_driver*, tty_struct*)'
  [A] 'function void tty_termios_copy_hw(ktermios*, ktermios*)'
  [A] 'function void tty_unregister_device(tty_driver*, unsigned int)'
  [A] 'function int tty_unregister_driver(tty_driver*)'
  [A] 'function void tty_vhangup(tty_struct*)'
  [A] 'function int ucsi_send_command(ucsi*, u64, void*, size_t)'
  [A] 'function int unregister_qdisc(Qdisc_ops*)'
  [A] 'function int usb_add_phy(usb_phy*, usb_phy_type)'
  [A] 'function void usb_autopm_get_interface_no_resume(usb_interface*)'
  [A] 'function void usb_deregister_dev(usb_interface*, usb_class_driver*)'
  [A] 'function usb_interface* usb_find_interface(usb_driver*, int)'
  [A] 'function usb_device* usb_get_dev(usb_device*)'
  [A] 'function usb_interface* usb_get_intf(usb_interface*)'
  [A] 'function const usb_device_id* usb_match_id(usb_interface*, const usb_device_id*)'
  [A] 'function int usb_match_one_id(usb_interface*, const usb_device_id*)'
  [A] 'function config_group* usb_os_desc_prepare_interf_dir(config_group*, int, usb_os_desc**, char**, module*)'
  [A] 'function void usb_poison_anchored_urbs(usb_anchor*)'
  [A] 'function void usb_put_intf(usb_interface*)'
  [A] 'function int usb_register_dev(usb_interface*, usb_class_driver*)'
  [A] 'function int usb_set_interface(usb_device*, int, int)'
  [A] 'function ssize_t usb_show_dynids(usb_dynids*, char*)'
  [A] 'function ssize_t usb_store_new_id(usb_dynids*, const usb_device_id*, device_driver*, const char*, size_t)'
  [A] 'function void usb_unpoison_urb(urb*)'
  [A] 'function void usbnet_defer_kevent(usbnet*, int)'
  [A] 'function v4l2_ctrl* v4l2_ctrl_new_int_menu(v4l2_ctrl_handler*, const v4l2_ctrl_ops*, u32, u8, u8, const s64*)'
  [A] 'function int v4l2_querymenu(v4l2_ctrl_handler*, v4l2_querymenu*)'
  [A] 'function void vsock_addr_init(sockaddr_vm*, u32, u32)'
  [A] 'function void vsock_remove_sock(vsock_sock*)'

33 Added variables:

  [A] 'tracepoint __tracepoint_android_rvh_arm64_serror_panic'
  [A] 'tracepoint __tracepoint_android_rvh_bad_mode'
  [A] 'tracepoint __tracepoint_android_rvh_dequeue_task_idle'
  [A] 'tracepoint __tracepoint_android_rvh_do_sea'
  [A] 'tracepoint __tracepoint_android_rvh_do_undefinstr'
  [A] 'tracepoint __tracepoint_android_rvh_refrigerator'
  [A] 'tracepoint __tracepoint_android_rvh_ufs_complete_init'
  [A] 'tracepoint __tracepoint_android_vh_dup_task_struct'
  [A] 'tracepoint __tracepoint_android_vh_irqtime_account_process_tick'
  [A] 'tracepoint __tracepoint_android_vh_kmalloc_slab'
  [A] 'tracepoint __tracepoint_android_vh_rtmutex_wait_finish'
  [A] 'tracepoint __tracepoint_android_vh_rtmutex_wait_start'
  [A] 'tracepoint __tracepoint_android_vh_rwsem_read_wait_finish'
  [A] 'tracepoint __tracepoint_android_vh_rwsem_read_wait_start'
  [A] 'tracepoint __tracepoint_android_vh_rwsem_write_wait_finish'
  [A] 'tracepoint __tracepoint_android_vh_rwsem_write_wait_start'
  [A] 'tracepoint __tracepoint_android_vh_save_track_hash'
  [A] 'tracepoint __tracepoint_android_vh_save_vmalloc_stack'
  [A] 'tracepoint __tracepoint_android_vh_sched_show_task'
  [A] 'tracepoint __tracepoint_android_vh_show_stack_hash'
  [A] 'tracepoint __tracepoint_android_vh_try_to_freeze_todo'
  [A] 'tracepoint __tracepoint_android_vh_try_to_freeze_todo_unfrozen'
  [A] 'tracepoint __tracepoint_android_vh_usb_dev_resume'
  [A] 'tracepoint __tracepoint_android_vh_usb_dev_suspend'
  [A] 'tracepoint __tracepoint_android_vh_vmpressure'
  [A] 'tracepoint __tracepoint_android_vh_watchdog_timer_softlockup'
  [A] 'tracepoint __tracepoint_android_vh_wq_lockup_pool'
  [A] 'unsigned long int avenrun[3]'
  [A] 'const clk_ops clk_divider_ro_ops'
  [A] 'const clk_ops clk_mux_ro_ops'
  [A] 'irq_domain_ops irq_generic_chip_ops'
  [A] 'static_key_false memcg_kmem_enabled_key'
  [A] 'ktermios tty_std_termios'

Fixes: 7d8687d4ef89 ("Merge branch 'android12-5.10' into `android12-5.10-lts`")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4c18039a67ad6cf65f6d9824b21d5558513103a2
---
 android/abi_gki_aarch64.xml | 5420 ++++++++++++++++++++++++++++-------
 1 file changed, 4346 insertions(+), 1074 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 0a6ffdb612b7..95e89e80a46f 100755
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -107,6 +107,8 @@
       <elf-symbol name='__get_task_comm' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc2a656d9'/>
       <elf-symbol name='__get_vm_area_caller' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x87eb7b44'/>
       <elf-symbol name='__getblk_gfp' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4c9af7f2'/>
+      <elf-symbol name='__hid_register_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbe362106'/>
+      <elf-symbol name='__hid_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x62d87780'/>
       <elf-symbol name='__hrtimer_get_remaining' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xed269ad2'/>
       <elf-symbol name='__hvc_resize' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb7ef2ce8'/>
       <elf-symbol name='__hw_addr_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf389fe60'/>
@@ -125,6 +127,7 @@
       <elf-symbol name='__iowrite32_copy' type='func-type' binding='weak-binding' visibility='default-visibility' is-defined='yes' crc='0x2dba276a'/>
       <elf-symbol name='__ipv6_addr_type' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd542439'/>
       <elf-symbol name='__irq_alloc_descs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5db075d0'/>
+      <elf-symbol name='__irq_alloc_domain_generic_chips' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd9b5c1a'/>
       <elf-symbol name='__irq_domain_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x73d2ee76'/>
       <elf-symbol name='__irq_set_handler' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x49a38900'/>
       <elf-symbol name='__kfifo_alloc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x139f2189'/>
@@ -212,6 +215,7 @@
       <elf-symbol name='__request_percpu_irq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6d9ee2a0'/>
       <elf-symbol name='__request_region' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xca39ba0'/>
       <elf-symbol name='__rht_bucket_nested' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd0d156e9'/>
+      <elf-symbol name='__rt_mutex_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x40bbb501'/>
       <elf-symbol name='__rtc_register_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfd8cab20'/>
       <elf-symbol name='__sbitmap_queue_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd116ad0'/>
       <elf-symbol name='__scsi_add_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd55434'/>
@@ -334,6 +338,7 @@
       <elf-symbol name='__traceiter_android_rvh_typec_tcpci_chk_contaminant' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x760027e1'/>
       <elf-symbol name='__traceiter_android_rvh_typec_tcpci_get_vbus' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x37614c90'/>
       <elf-symbol name='__traceiter_android_rvh_uclamp_eff_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd727fd8d'/>
+      <elf-symbol name='__traceiter_android_rvh_ufs_complete_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x347db806'/>
       <elf-symbol name='__traceiter_android_rvh_ufs_reprogram_all_keys' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac38cf23'/>
       <elf-symbol name='__traceiter_android_rvh_update_cpu_capacity' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc7020ac9'/>
       <elf-symbol name='__traceiter_android_rvh_update_cpus_allowed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5f74f0f1'/>
@@ -413,6 +418,7 @@
       <elf-symbol name='__traceiter_android_vh_is_fpsimd_save' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6e9c369e'/>
       <elf-symbol name='__traceiter_android_vh_jiffies_update' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x67d76d04'/>
       <elf-symbol name='__traceiter_android_vh_kfree_skb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd93a42f0'/>
+      <elf-symbol name='__traceiter_android_vh_kmalloc_slab' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7cb30b6'/>
       <elf-symbol name='__traceiter_android_vh_logbuf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7e160169'/>
       <elf-symbol name='__traceiter_android_vh_logbuf_pr_cont' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3f999f8c'/>
       <elf-symbol name='__traceiter_android_vh_map_util_freq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd3e2145e'/>
@@ -439,6 +445,8 @@
       <elf-symbol name='__traceiter_android_vh_rwsem_wake' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7a813da7'/>
       <elf-symbol name='__traceiter_android_vh_rwsem_wake_finish' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbd987012'/>
       <elf-symbol name='__traceiter_android_vh_rwsem_write_finished' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd61e47bf'/>
+      <elf-symbol name='__traceiter_android_vh_save_track_hash' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9bc3dfb7'/>
+      <elf-symbol name='__traceiter_android_vh_save_vmalloc_stack' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdf510618'/>
       <elf-symbol name='__traceiter_android_vh_sched_setaffinity_early' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3a5239a6'/>
       <elf-symbol name='__traceiter_android_vh_scheduler_tick' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8c91de8f'/>
       <elf-symbol name='__traceiter_android_vh_sd_update_bus_speed_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd12257ab'/>
@@ -460,6 +468,7 @@
       <elf-symbol name='__traceiter_android_vh_show_max_freq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc5681f17'/>
       <elf-symbol name='__traceiter_android_vh_show_mem' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1d424b7d'/>
       <elf-symbol name='__traceiter_android_vh_show_resume_epoch_val' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x80932910'/>
+      <elf-symbol name='__traceiter_android_vh_show_stack_hash' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x83200c43'/>
       <elf-symbol name='__traceiter_android_vh_show_suspend_epoch_val' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1c84167'/>
       <elf-symbol name='__traceiter_android_vh_snd_compr_use_pause_in_drain' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb6ab1ad2'/>
       <elf-symbol name='__traceiter_android_vh_sound_usb_support_cpu_suspend' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4e022349'/>
@@ -487,6 +496,8 @@
       <elf-symbol name='__traceiter_android_vh_ufs_update_sdev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5afd339e'/>
       <elf-symbol name='__traceiter_android_vh_ufs_update_sysfs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x68f34378'/>
       <elf-symbol name='__traceiter_android_vh_update_topology_flags_workfn' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf9046f81'/>
+      <elf-symbol name='__traceiter_android_vh_usb_dev_resume' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc81c1592'/>
+      <elf-symbol name='__traceiter_android_vh_usb_dev_suspend' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8da0b48e'/>
       <elf-symbol name='__traceiter_android_vh_v4l2subdev_set_fmt' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x966f8717'/>
       <elf-symbol name='__traceiter_android_vh_v4l2subdev_set_frame_interval' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x56062d28'/>
       <elf-symbol name='__traceiter_android_vh_v4l2subdev_set_selection' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x841c50e9'/>
@@ -540,15 +551,18 @@
       <elf-symbol name='__traceiter_workqueue_execute_start' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6b629b42'/>
       <elf-symbol name='__traceiter_xdp_exception' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7b161b9d'/>
       <elf-symbol name='__traceiter_xhci_urb_giveback' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x44185be7'/>
+      <elf-symbol name='__tty_alloc_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe6d6f001'/>
       <elf-symbol name='__tty_insert_flip_char' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa93df441'/>
       <elf-symbol name='__udelay' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9e7d6bd0'/>
       <elf-symbol name='__uio_register_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x27c24536'/>
       <elf-symbol name='__unregister_chrdev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6bc3fbc0'/>
       <elf-symbol name='__update_load_avg_blocked_se' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfbdf5c3e'/>
       <elf-symbol name='__usb_create_hcd' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x93e3fb4f'/>
+      <elf-symbol name='__usb_get_extra_descriptor' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd36760ef'/>
       <elf-symbol name='__usecs_to_jiffies' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1969a8e'/>
       <elf-symbol name='__v4l2_ctrl_modify_range' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9578a8e7'/>
       <elf-symbol name='__v4l2_ctrl_s_ctrl' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x838d88db'/>
+      <elf-symbol name='__v4l2_ctrl_s_ctrl_compound' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6153421'/>
       <elf-symbol name='__v4l2_ctrl_s_ctrl_int64' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x79b8cb1d'/>
       <elf-symbol name='__v4l2_device_register_subdev_nodes' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8408d5e'/>
       <elf-symbol name='__v4l2_find_nearest_size' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe2822320'/>
@@ -567,6 +581,8 @@
       <elf-symbol name='__xfrm_decode_session' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x41b76380'/>
       <elf-symbol name='__xfrm_state_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9c30e2e1'/>
       <elf-symbol name='_atomic_dec_and_lock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcf4fdd4d'/>
+      <elf-symbol name='_bcd2bin' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb6936ffe'/>
+      <elf-symbol name='_bin2bcd' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x80ca5026'/>
       <elf-symbol name='_copy_from_iter' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x39448fe2'/>
       <elf-symbol name='_copy_from_iter_full' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x96ccf3d6'/>
       <elf-symbol name='_copy_to_iter' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe0fb5dfb'/>
@@ -577,6 +593,7 @@
       <elf-symbol name='_dev_info' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8eff6041'/>
       <elf-symbol name='_dev_notice' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xefae1c39'/>
       <elf-symbol name='_dev_warn' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbc7a4422'/>
+      <elf-symbol name='_kstrtoul' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x54a9db5f'/>
       <elf-symbol name='_raw_read_lock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfe8c61f0'/>
       <elf-symbol name='_raw_read_lock_bh' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8dee722d'/>
       <elf-symbol name='_raw_read_lock_irq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x48112d76'/>
@@ -870,6 +887,14 @@
       <elf-symbol name='cancel_delayed_work_sync' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf8beca97'/>
       <elf-symbol name='cancel_work_sync' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd969d6f4'/>
       <elf-symbol name='capable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc6cbbc89'/>
+      <elf-symbol name='cdc_ncm_bind_common' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5d3f3436'/>
+      <elf-symbol name='cdc_ncm_change_mtu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x682eab10'/>
+      <elf-symbol name='cdc_ncm_fill_tx_frame' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x46fbb4ea'/>
+      <elf-symbol name='cdc_ncm_rx_verify_ndp16' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6d31298c'/>
+      <elf-symbol name='cdc_ncm_rx_verify_nth16' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcd14b214'/>
+      <elf-symbol name='cdc_ncm_select_altsetting' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x87283c38'/>
+      <elf-symbol name='cdc_ncm_unbind' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9d35f5b8'/>
+      <elf-symbol name='cdc_parse_cdc_header' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2de88551'/>
       <elf-symbol name='cdev_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2e6debbe'/>
       <elf-symbol name='cdev_alloc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe2d07004'/>
       <elf-symbol name='cdev_del' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9e1bac16'/>
@@ -921,6 +946,7 @@
       <elf-symbol name='clk_enable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x815588a6'/>
       <elf-symbol name='clk_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb770a9bd'/>
       <elf-symbol name='clk_get_parent' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x63150e06'/>
+      <elf-symbol name='clk_get_phase' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1c5ff742'/>
       <elf-symbol name='clk_get_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x556e4390'/>
       <elf-symbol name='clk_hw_get_flags' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xee3aa642'/>
       <elf-symbol name='clk_hw_get_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb62ec837'/>
@@ -953,8 +979,10 @@
       <elf-symbol name='clk_register_fixed_factor' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf4e26a8a'/>
       <elf-symbol name='clk_register_fixed_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1594f658'/>
       <elf-symbol name='clk_register_gate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x92295424'/>
+      <elf-symbol name='clk_register_mux_table' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x556d2606'/>
       <elf-symbol name='clk_round_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x43f81957'/>
       <elf-symbol name='clk_set_parent' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2396c7f0'/>
+      <elf-symbol name='clk_set_phase' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb7329c06'/>
       <elf-symbol name='clk_set_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x76d9b876'/>
       <elf-symbol name='clk_sync_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x266dca8b'/>
       <elf-symbol name='clk_unprepare' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb077e70a'/>
@@ -1014,6 +1042,11 @@
       <elf-symbol name='cpufreq_cpu_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xefeb0f57'/>
       <elf-symbol name='cpufreq_cpu_get_raw' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfd2aed80'/>
       <elf-symbol name='cpufreq_cpu_put' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7557e528'/>
+      <elf-symbol name='cpufreq_dbs_governor_exit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9f006ac0'/>
+      <elf-symbol name='cpufreq_dbs_governor_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdc7d6823'/>
+      <elf-symbol name='cpufreq_dbs_governor_limits' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3a4c16b9'/>
+      <elf-symbol name='cpufreq_dbs_governor_start' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4393f881'/>
+      <elf-symbol name='cpufreq_dbs_governor_stop' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xba566982'/>
       <elf-symbol name='cpufreq_disable_fast_switch' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdcd38056'/>
       <elf-symbol name='cpufreq_driver_fast_switch' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdb9bd4cb'/>
       <elf-symbol name='cpufreq_driver_resolve_freq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ddef6c8'/>
@@ -1042,6 +1075,7 @@
       <elf-symbol name='cpufreq_unregister_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8e4dfc1c'/>
       <elf-symbol name='cpufreq_unregister_governor' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc0d77202'/>
       <elf-symbol name='cpufreq_unregister_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6214aef2'/>
+      <elf-symbol name='cpufreq_update_limits' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x816a41ca'/>
       <elf-symbol name='cpufreq_update_policy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc37f9c6e'/>
       <elf-symbol name='cpuidle_driver_state_disabled' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4a5d0307'/>
       <elf-symbol name='cpuidle_get_cpu_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x798d3949'/>
@@ -1058,6 +1092,7 @@
       <elf-symbol name='cpus_read_lock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa04f945a'/>
       <elf-symbol name='cpus_read_unlock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x18fb2caf'/>
       <elf-symbol name='cpuset_cpus_allowed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x76bc82e1'/>
+      <elf-symbol name='crc16' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbd6841d4'/>
       <elf-symbol name='crc32_be' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4df02057'/>
       <elf-symbol name='crc32_le' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x69dd3b5b'/>
       <elf-symbol name='crc8' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe2aae5cc'/>
@@ -1157,6 +1192,7 @@
       <elf-symbol name='dapm_pinctrl_event' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa5bbfa59'/>
       <elf-symbol name='dapm_regulator_event' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5e67cb12'/>
       <elf-symbol name='datagram_poll' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x23ece91d'/>
+      <elf-symbol name='dbs_update' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf9aee372'/>
       <elf-symbol name='deactivate_locked_super' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x74c7c4'/>
       <elf-symbol name='deactivate_task' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3d03b2a4'/>
       <elf-symbol name='debug_locks_off' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc575c737'/>
@@ -1259,6 +1295,7 @@
       <elf-symbol name='dev_pm_opp_remove_all_dynamic' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x58d2164f'/>
       <elf-symbol name='dev_pm_opp_set_bw' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xee324f7f'/>
       <elf-symbol name='dev_pm_opp_set_clkname' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x808c3e51'/>
+      <elf-symbol name='dev_pm_opp_set_prop_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xeaad849d'/>
       <elf-symbol name='dev_pm_opp_set_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x49f9212d'/>
       <elf-symbol name='dev_pm_opp_set_regulators' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc7f3109f'/>
       <elf-symbol name='dev_pm_opp_set_sharing_cpus' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3ef005c1'/>
@@ -1278,6 +1315,7 @@
       <elf-symbol name='dev_printk' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa2ef36e7'/>
       <elf-symbol name='dev_printk_emit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf765f21a'/>
       <elf-symbol name='dev_queue_xmit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfd08e9b6'/>
+      <elf-symbol name='dev_set_mac_address' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbb4c2efa'/>
       <elf-symbol name='dev_set_mtu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9f5163d'/>
       <elf-symbol name='dev_set_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb02b15cb'/>
       <elf-symbol name='dev_uc_sync_multiple' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbc751942'/>
@@ -1286,6 +1324,11 @@
       <elf-symbol name='devfreq_add_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf38bac94'/>
       <elf-symbol name='devfreq_add_governor' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x273f2dc0'/>
       <elf-symbol name='devfreq_cooling_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb2a916bd'/>
+      <elf-symbol name='devfreq_event_disable_edev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe73518fe'/>
+      <elf-symbol name='devfreq_event_enable_edev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb723f5e0'/>
+      <elf-symbol name='devfreq_event_get_edev_by_phandle' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x324c4492'/>
+      <elf-symbol name='devfreq_event_get_edev_count' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc7382d02'/>
+      <elf-symbol name='devfreq_event_get_event' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf8386da6'/>
       <elf-symbol name='devfreq_get_devfreq_by_node' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdf603074'/>
       <elf-symbol name='devfreq_get_devfreq_by_phandle' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc4d3b5fc'/>
       <elf-symbol name='devfreq_monitor_resume' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x51d51cf8'/>
@@ -1366,7 +1409,9 @@
       <elf-symbol name='devm_clk_put' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x62aa2ae0'/>
       <elf-symbol name='devm_clk_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfba8befb'/>
       <elf-symbol name='devm_devfreq_add_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa11123ba'/>
+      <elf-symbol name='devm_devfreq_event_add_edev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3054cdd5'/>
       <elf-symbol name='devm_devfreq_register_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1054639'/>
+      <elf-symbol name='devm_devfreq_register_opp_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9bc08c7f'/>
       <elf-symbol name='devm_devfreq_remove_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4d73b869'/>
       <elf-symbol name='devm_devfreq_unregister_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xde51fdbf'/>
       <elf-symbol name='devm_device_add_group' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x71021beb'/>
@@ -1392,6 +1437,7 @@
       <elf-symbol name='devm_gpiod_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2b64bf51'/>
       <elf-symbol name='devm_gpiod_get_array' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ad78a61'/>
       <elf-symbol name='devm_gpiod_get_index' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7e37641e'/>
+      <elf-symbol name='devm_gpiod_get_index_optional' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x401251e3'/>
       <elf-symbol name='devm_gpiod_get_optional' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd96311'/>
       <elf-symbol name='devm_gpiod_put' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd825ff99'/>
       <elf-symbol name='devm_gpiod_put_array' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa177b3d3'/>
@@ -1433,6 +1479,7 @@
       <elf-symbol name='devm_of_platform_populate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcf1001c0'/>
       <elf-symbol name='devm_of_pwm_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8d795e56'/>
       <elf-symbol name='devm_pci_alloc_host_bridge' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6ede5728'/>
+      <elf-symbol name='devm_pci_remap_cfg_resource' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x73e37e20'/>
       <elf-symbol name='devm_phy_create' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6797d82d'/>
       <elf-symbol name='devm_phy_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8016a6c4'/>
       <elf-symbol name='devm_phy_optional_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd1d7e13'/>
@@ -1606,11 +1653,13 @@
       <elf-symbol name='down_timeout' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9682235'/>
       <elf-symbol name='down_trylock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfc7e2596'/>
       <elf-symbol name='down_write' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x28ed2847'/>
+      <elf-symbol name='down_write_trylock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd0e551cc'/>
       <elf-symbol name='downgrade_write' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd486fb9c'/>
       <elf-symbol name='dput' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x96850bba'/>
       <elf-symbol name='dql_completed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa00aca2a'/>
       <elf-symbol name='dql_reset' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4ea25709'/>
       <elf-symbol name='drain_workqueue' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa38602cd'/>
+      <elf-symbol name='driver_attach' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x660b5c9e'/>
       <elf-symbol name='driver_create_file' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x44456275'/>
       <elf-symbol name='driver_find_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe9be3e81'/>
       <elf-symbol name='driver_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x83dd6564'/>
@@ -1956,6 +2005,7 @@
       <elf-symbol name='drm_mode_probed_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd7e54fb'/>
       <elf-symbol name='drm_mode_set_crtcinfo' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4575a0ca'/>
       <elf-symbol name='drm_mode_set_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4a35d30d'/>
+      <elf-symbol name='drm_mode_sort' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1421d13'/>
       <elf-symbol name='drm_mode_vrefresh' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1b5340a'/>
       <elf-symbol name='drm_modeset_acquire_fini' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3e5c271d'/>
       <elf-symbol name='drm_modeset_acquire_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x18f40ec8'/>
@@ -2133,7 +2183,9 @@
       <elf-symbol name='extcon_register_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x38e5e394'/>
       <elf-symbol name='extcon_set_property' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8ec996af'/>
       <elf-symbol name='extcon_set_property_capability' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xeb795f74'/>
+      <elf-symbol name='extcon_set_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x42e7846b'/>
       <elf-symbol name='extcon_set_state_sync' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xafb7a5e0'/>
+      <elf-symbol name='extcon_sync' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6850da2f'/>
       <elf-symbol name='extcon_unregister_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9c6a9657'/>
       <elf-symbol name='fasync_helper' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x868ee60d'/>
       <elf-symbol name='fd_install' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7dbab506'/>
@@ -2303,6 +2355,7 @@
       <elf-symbol name='gov_attr_set_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1effeca'/>
       <elf-symbol name='gov_attr_set_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac10b46f'/>
       <elf-symbol name='gov_attr_set_put' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd6de6d04'/>
+      <elf-symbol name='gov_update_cpu_data' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb182536'/>
       <elf-symbol name='gpio_free' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfe990052'/>
       <elf-symbol name='gpio_free_array' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb0d1656c'/>
       <elf-symbol name='gpio_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x47229b5c'/>
@@ -2332,6 +2385,7 @@
       <elf-symbol name='gpiod_get_raw_value_cansleep' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7ee96f3'/>
       <elf-symbol name='gpiod_get_value' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6606192c'/>
       <elf-symbol name='gpiod_get_value_cansleep' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x421f2ad'/>
+      <elf-symbol name='gpiod_is_active_low' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb5606728'/>
       <elf-symbol name='gpiod_set_array_value_cansleep' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe92664b6'/>
       <elf-symbol name='gpiod_set_consumer_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1aa88cb'/>
       <elf-symbol name='gpiod_set_debounce' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7221e927'/>
@@ -2378,8 +2432,16 @@
       <elf-symbol name='hid_add_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4770d7dd'/>
       <elf-symbol name='hid_allocate_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x77526c8a'/>
       <elf-symbol name='hid_destroy_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x67deb5af'/>
+      <elf-symbol name='hid_hw_close' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x28a8a7db'/>
+      <elf-symbol name='hid_hw_open' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x943ae811'/>
+      <elf-symbol name='hid_hw_start' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2f71a7a9'/>
+      <elf-symbol name='hid_hw_stop' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdae460c7'/>
       <elf-symbol name='hid_input_report' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe5b38773'/>
+      <elf-symbol name='hid_open_report' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcc0f3a8c'/>
       <elf-symbol name='hid_parse_report' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8ec262a0'/>
+      <elf-symbol name='hid_report_raw_event' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcdd650a6'/>
+      <elf-symbol name='hid_unregister_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5954b3b9'/>
+      <elf-symbol name='hid_validate_values' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4aad7e86'/>
       <elf-symbol name='hmm_range_fault' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc611b02'/>
       <elf-symbol name='housekeeping_cpumask' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xee49ad1d'/>
       <elf-symbol name='hrtimer_active' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xecd991f'/>
@@ -2501,6 +2563,7 @@
       <elf-symbol name='iio_channel_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x35b59c88'/>
       <elf-symbol name='iio_channel_get_all' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe6898a3a'/>
       <elf-symbol name='iio_channel_release' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd7c406eb'/>
+      <elf-symbol name='iio_channel_release_all' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xea7eb67c'/>
       <elf-symbol name='iio_convert_raw_to_processed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xabec8d67'/>
       <elf-symbol name='iio_dealloc_pollfunc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2c27d423'/>
       <elf-symbol name='iio_device_alloc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x739b1eb3'/>
@@ -2514,8 +2577,10 @@
       <elf-symbol name='iio_read_channel_processed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4e863092'/>
       <elf-symbol name='iio_read_channel_raw' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7fdcbbc0'/>
       <elf-symbol name='iio_trigger_notify_done' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x32c17b35'/>
+      <elf-symbol name='iio_update_buffers' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6304f8c5'/>
       <elf-symbol name='import_iovec' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x29ae814e'/>
       <elf-symbol name='in4_pton' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac5fcec0'/>
+      <elf-symbol name='in6_dev_finish_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x76a2324c'/>
       <elf-symbol name='in6_pton' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x609bcd98'/>
       <elf-symbol name='in_aton' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1b6314fd'/>
       <elf-symbol name='in_egroup_p' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x39461d6a'/>
@@ -2529,11 +2594,14 @@
       <elf-symbol name='init_srcu_struct' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x910e6db5'/>
       <elf-symbol name='init_timer_key' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x79cf5987'/>
       <elf-symbol name='init_wait_entry' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfe487975'/>
+      <elf-symbol name='inode_owner_or_capable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x789544a'/>
+      <elf-symbol name='inode_permission' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x557a6f17'/>
       <elf-symbol name='input_alloc_absinfo' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x51488668'/>
       <elf-symbol name='input_allocate_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe3db3c44'/>
       <elf-symbol name='input_close_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1edc8012'/>
       <elf-symbol name='input_event' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3b938c8d'/>
       <elf-symbol name='input_ff_create' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xafd0f173'/>
+      <elf-symbol name='input_ff_create_memless' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x231c132e'/>
       <elf-symbol name='input_ff_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x28b46b32'/>
       <elf-symbol name='input_free_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd329e1c6'/>
       <elf-symbol name='input_mt_assign_slots' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4a3d248c'/>
@@ -2550,7 +2618,9 @@
       <elf-symbol name='input_register_handler' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac72b90e'/>
       <elf-symbol name='input_set_abs_params' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x837ac1f4'/>
       <elf-symbol name='input_set_capability' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5bfaa8d0'/>
+      <elf-symbol name='input_set_poll_interval' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd65e77bb'/>
       <elf-symbol name='input_set_timestamp' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7e3bed04'/>
+      <elf-symbol name='input_setup_polling' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x921c33d7'/>
       <elf-symbol name='input_unregister_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdf5b2f63'/>
       <elf-symbol name='input_unregister_handle' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf5a2012a'/>
       <elf-symbol name='input_unregister_handler' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa467bfcc'/>
@@ -2660,6 +2730,8 @@
       <elf-symbol name='irq_gc_ack_set_bit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb8ee2fca'/>
       <elf-symbol name='irq_gc_mask_clr_bit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf7b775be'/>
       <elf-symbol name='irq_gc_mask_set_bit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa3c1a7a7'/>
+      <elf-symbol name='irq_gc_set_wake' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x23972238'/>
+      <elf-symbol name='irq_get_domain_generic_chip' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe423bd07'/>
       <elf-symbol name='irq_get_irq_data' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd67517d1'/>
       <elf-symbol name='irq_get_irqchip_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1d222ced'/>
       <elf-symbol name='irq_modify_status' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7522f3ba'/>
@@ -3219,6 +3291,7 @@
       <elf-symbol name='of_get_display_timing' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x61773766'/>
       <elf-symbol name='of_get_display_timings' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x880c06c0'/>
       <elf-symbol name='of_get_dma_window' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x55639ff8'/>
+      <elf-symbol name='of_get_drm_display_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4b20035e'/>
       <elf-symbol name='of_get_i2c_adapter_by_node' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xeb353145'/>
       <elf-symbol name='of_get_mac_address' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x723b1daa'/>
       <elf-symbol name='of_get_named_gpio_flags' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x982b7d12'/>
@@ -3264,6 +3337,7 @@
       <elf-symbol name='of_parse_phandle' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x79746f10'/>
       <elf-symbol name='of_parse_phandle_with_args' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3cbbcd88'/>
       <elf-symbol name='of_parse_phandle_with_fixed_args' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd01477fb'/>
+      <elf-symbol name='of_pci_get_max_link_speed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9dc1ad8f'/>
       <elf-symbol name='of_phandle_iterator_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1d3d2daf'/>
       <elf-symbol name='of_phandle_iterator_next' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6a7d162c'/>
       <elf-symbol name='of_phy_connect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x74c7e2ef'/>
@@ -3272,6 +3346,7 @@
       <elf-symbol name='of_phy_is_fixed_link' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc5a2ca53'/>
       <elf-symbol name='of_phy_register_fixed_link' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe48431b7'/>
       <elf-symbol name='of_phy_simple_xlate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa2094183'/>
+      <elf-symbol name='of_pinctrl_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdca7c17d'/>
       <elf-symbol name='of_platform_depopulate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6fb0100'/>
       <elf-symbol name='of_platform_device_create' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x74cd6e1c'/>
       <elf-symbol name='of_platform_device_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8c9f49e7'/>
@@ -3300,10 +3375,12 @@
       <elf-symbol name='of_thermal_get_trip_points' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaeda21a1'/>
       <elf-symbol name='of_thermal_is_trip_valid' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4755a2c2'/>
       <elf-symbol name='of_translate_address' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x36f6c2b3'/>
+      <elf-symbol name='of_usb_get_dr_mode_by_phy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7533b285'/>
       <elf-symbol name='of_usb_get_phy_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x930245b'/>
       <elf-symbol name='of_usb_host_tpl_support' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3a0a609e'/>
       <elf-symbol name='of_usb_update_otg_caps' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8f7ac68'/>
       <elf-symbol name='on_each_cpu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x294b9ea1'/>
+      <elf-symbol name='on_each_cpu_cond' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb1a5ab8c'/>
       <elf-symbol name='open_candev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc49d1d3c'/>
       <elf-symbol name='orderly_poweroff' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x56256e8a'/>
       <elf-symbol name='page_endio' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd65281f0'/>
@@ -3394,6 +3471,7 @@
       <elf-symbol name='pci_release_regions' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4a05faa'/>
       <elf-symbol name='pci_release_resource' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf0b788cd'/>
       <elf-symbol name='pci_release_selected_regions' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd0b1c8dd'/>
+      <elf-symbol name='pci_remove_root_bus' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb402a5da'/>
       <elf-symbol name='pci_request_irq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x74da130c'/>
       <elf-symbol name='pci_request_region' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdb6d818c'/>
       <elf-symbol name='pci_request_regions' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd26ee740'/>
@@ -3408,6 +3486,8 @@
       <elf-symbol name='pci_set_master' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfba39625'/>
       <elf-symbol name='pci_set_mwi' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6c9fdae2'/>
       <elf-symbol name='pci_set_power_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x48cb85bc'/>
+      <elf-symbol name='pci_sriov_configure_simple' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x356b977a'/>
+      <elf-symbol name='pci_stop_root_bus' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfce1d90e'/>
       <elf-symbol name='pci_store_saved_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7180a796'/>
       <elf-symbol name='pci_try_set_mwi' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcc072d8f'/>
       <elf-symbol name='pci_unmap_rom' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x93d7a4c2'/>
@@ -3462,6 +3542,7 @@
       <elf-symbol name='phy_calibrate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xefe6c0'/>
       <elf-symbol name='phy_configure' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5988c8ba'/>
       <elf-symbol name='phy_connect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe2da3166'/>
+      <elf-symbol name='phy_connect_direct' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xff9d0908'/>
       <elf-symbol name='phy_disconnect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6f3a06f6'/>
       <elf-symbol name='phy_do_ioctl_running' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x87f68851'/>
       <elf-symbol name='phy_drivers_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4dd6e85a'/>
@@ -3474,13 +3555,16 @@
       <elf-symbol name='phy_ethtool_set_eee' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9623fb1f'/>
       <elf-symbol name='phy_ethtool_set_link_ksettings' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x21b2cfa6'/>
       <elf-symbol name='phy_exit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc2c11ca4'/>
+      <elf-symbol name='phy_find_first' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x407f65d9'/>
       <elf-symbol name='phy_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa5bcda36'/>
       <elf-symbol name='phy_get_eee_err' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9f0bd293'/>
+      <elf-symbol name='phy_get_pause' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa0211602'/>
       <elf-symbol name='phy_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8ad088f'/>
       <elf-symbol name='phy_init_eee' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x996f5f36'/>
       <elf-symbol name='phy_init_hw' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x29163f18'/>
       <elf-symbol name='phy_mac_interrupt' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8cdf747a'/>
       <elf-symbol name='phy_mii_ioctl' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8a0f5c2d'/>
+      <elf-symbol name='phy_mipi_dphy_config_validate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x881bad5e'/>
       <elf-symbol name='phy_mipi_dphy_get_default_config' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4848cfb1'/>
       <elf-symbol name='phy_modify' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd82d5460'/>
       <elf-symbol name='phy_modify_changed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x67d7a10b'/>
@@ -3581,8 +3665,11 @@
       <elf-symbol name='platform_get_resource' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2e29445c'/>
       <elf-symbol name='platform_get_resource_byname' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc06cf568'/>
       <elf-symbol name='platform_irq_count' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc7fda62f'/>
+      <elf-symbol name='platform_msi_domain_alloc_irqs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6d11ee67'/>
+      <elf-symbol name='platform_msi_domain_free_irqs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xebf6e58b'/>
       <elf-symbol name='platform_unregister_drivers' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb047000d'/>
       <elf-symbol name='pm_clk_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbde959ec'/>
+      <elf-symbol name='pm_clk_add_clk' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x807ac0bf'/>
       <elf-symbol name='pm_clk_create' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe449fa38'/>
       <elf-symbol name='pm_clk_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x78eb2755'/>
       <elf-symbol name='pm_clk_resume' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6a180e54'/>
@@ -3597,6 +3684,7 @@
       <elf-symbol name='pm_genpd_remove' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc2ad41e5'/>
       <elf-symbol name='pm_genpd_remove_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x907876a9'/>
       <elf-symbol name='pm_genpd_remove_subdomain' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbb28de2'/>
+      <elf-symbol name='pm_get_active_wakeup_sources' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3a8edb31'/>
       <elf-symbol name='pm_relax' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xffe8b403'/>
       <elf-symbol name='pm_runtime_allow' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x687add72'/>
       <elf-symbol name='pm_runtime_autosuspend_expiration' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf861955'/>
@@ -3617,6 +3705,7 @@
       <elf-symbol name='policy_has_boost_freq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x60569ce1'/>
       <elf-symbol name='posix_clock_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x83d63a52'/>
       <elf-symbol name='posix_clock_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x78a471cf'/>
+      <elf-symbol name='power_supply_am_i_supplied' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf42f18b7'/>
       <elf-symbol name='power_supply_changed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x886d3ed1'/>
       <elf-symbol name='power_supply_find_ocv2cap_table' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb0a9a621'/>
       <elf-symbol name='power_supply_get_battery_info' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf96edaab'/>
@@ -3659,6 +3748,8 @@
       <elf-symbol name='proc_set_size' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbe2adf78'/>
       <elf-symbol name='proc_set_user' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcccf4a5e'/>
       <elf-symbol name='proc_symlink' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2a5b7ca3'/>
+      <elf-symbol name='profile_event_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa389a49a'/>
+      <elf-symbol name='profile_event_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdd391eff'/>
       <elf-symbol name='proto_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1968dee6'/>
       <elf-symbol name='proto_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa90509ae'/>
       <elf-symbol name='ps2_begin_command' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa6e396e1'/>
@@ -3681,9 +3772,11 @@
       <elf-symbol name='put_pid' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd3c5d4d0'/>
       <elf-symbol name='put_sg_io_hdr' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5ec4aee6'/>
       <elf-symbol name='put_task_stack' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc8cd8f63'/>
+      <elf-symbol name='put_tty_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8bcb948'/>
       <elf-symbol name='put_unused_fd' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3f4547a7'/>
       <elf-symbol name='put_vaddr_frames' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1b700d37'/>
       <elf-symbol name='putback_movable_pages' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbd6f03f7'/>
+      <elf-symbol name='pwm_adjust_config' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9ef86434'/>
       <elf-symbol name='pwm_apply_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x340b36c6'/>
       <elf-symbol name='pwm_free' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7f17c666'/>
       <elf-symbol name='pwm_get_chip_data' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2a04f5f2'/>
@@ -3781,6 +3874,7 @@
       <elf-symbol name='register_pernet_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3c95853b'/>
       <elf-symbol name='register_pernet_subsys' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc89f14b4'/>
       <elf-symbol name='register_pm_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9cc4f70a'/>
+      <elf-symbol name='register_qdisc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe918f6f3'/>
       <elf-symbol name='register_reboot_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3517383e'/>
       <elf-symbol name='register_restart_handler' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd9d8fd16'/>
       <elf-symbol name='register_shrinker' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x11269594'/>
@@ -3854,6 +3948,7 @@
       <elf-symbol name='regulator_set_current_limit_regmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x13adf665'/>
       <elf-symbol name='regulator_set_load' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbdb1494f'/>
       <elf-symbol name='regulator_set_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac092213'/>
+      <elf-symbol name='regulator_set_pull_down_regmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x891c7fe2'/>
       <elf-symbol name='regulator_set_voltage' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8f258f19'/>
       <elf-symbol name='regulator_set_voltage_sel_regmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x50ba0d14'/>
       <elf-symbol name='regulator_set_voltage_time' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd508d68a'/>
@@ -3968,7 +4063,9 @@
       <elf-symbol name='rtc_class_open' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb620c4e8'/>
       <elf-symbol name='rtc_ktime_to_tm' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe4c2c66c'/>
       <elf-symbol name='rtc_nvmem_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6052639'/>
+      <elf-symbol name='rtc_read_alarm' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x612d5db2'/>
       <elf-symbol name='rtc_read_time' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x174b1e4f'/>
+      <elf-symbol name='rtc_set_alarm' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4f783149'/>
       <elf-symbol name='rtc_set_time' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4559b499'/>
       <elf-symbol name='rtc_time64_to_tm' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x356461c8'/>
       <elf-symbol name='rtc_tm_to_ktime' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x23412816'/>
@@ -4048,6 +4145,7 @@
       <elf-symbol name='scsi_normalize_sense' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfbad3cf0'/>
       <elf-symbol name='scsi_print_command' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa204f4fe'/>
       <elf-symbol name='scsi_print_sense_hdr' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9160a1ae'/>
+      <elf-symbol name='scsi_register_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5165226b'/>
       <elf-symbol name='scsi_register_interface' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x92bf75c7'/>
       <elf-symbol name='scsi_remove_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xad318138'/>
       <elf-symbol name='scsi_remove_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x251ddf69'/>
@@ -4056,6 +4154,7 @@
       <elf-symbol name='scsi_unblock_requests' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4c66d363'/>
       <elf-symbol name='sdev_prefix_printk' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc3100a76'/>
       <elf-symbol name='sdhci_add_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa2e903f8'/>
+      <elf-symbol name='sdhci_adma_write_desc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x55e8da2f'/>
       <elf-symbol name='sdhci_cleanup_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x37490426'/>
       <elf-symbol name='sdhci_cqe_disable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xad1e8eb8'/>
       <elf-symbol name='sdhci_cqe_enable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x52047ddb'/>
@@ -4065,8 +4164,10 @@
       <elf-symbol name='sdhci_enable_v4_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x51c10e74'/>
       <elf-symbol name='sdhci_execute_tuning' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdb79a663'/>
       <elf-symbol name='sdhci_get_property' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe615e6fb'/>
+      <elf-symbol name='sdhci_pltfm_clk_get_max_clock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf48ac8b0'/>
       <elf-symbol name='sdhci_pltfm_free' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xef15dce2'/>
       <elf-symbol name='sdhci_pltfm_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x388347e8'/>
+      <elf-symbol name='sdhci_pltfm_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8ece9464'/>
       <elf-symbol name='sdhci_remove_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x546c283b'/>
       <elf-symbol name='sdhci_request' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x95267c66'/>
       <elf-symbol name='sdhci_request_atomic' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2b38beca'/>
@@ -4075,7 +4176,10 @@
       <elf-symbol name='sdhci_runtime_resume_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x458eb912'/>
       <elf-symbol name='sdhci_runtime_suspend_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x164a5bca'/>
       <elf-symbol name='sdhci_set_bus_width' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xab28f19d'/>
+      <elf-symbol name='sdhci_set_clock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc3be945b'/>
+      <elf-symbol name='sdhci_set_power_and_bus_voltage' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x40e4a79f'/>
       <elf-symbol name='sdhci_set_power_noreg' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x12344b39'/>
+      <elf-symbol name='sdhci_set_uhs_signaling' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x185dcb11'/>
       <elf-symbol name='sdhci_setup_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9c562f4c'/>
       <elf-symbol name='sdhci_suspend_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x247c8b7b'/>
       <elf-symbol name='sdio_claim_host' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9b3810bc'/>
@@ -4098,6 +4202,7 @@
       <elf-symbol name='sdio_signal_irq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc43bf18'/>
       <elf-symbol name='sdio_unregister_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x114763de'/>
       <elf-symbol name='sdio_writeb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x41c02df5'/>
+      <elf-symbol name='sdio_writeb_readb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x31450a32'/>
       <elf-symbol name='sdio_writel' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3ccb0e9d'/>
       <elf-symbol name='sdio_writesb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa9a43a63'/>
       <elf-symbol name='securityfs_create_dir' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4c6b0200'/>
@@ -4256,6 +4361,7 @@
       <elf-symbol name='smp_call_function_any' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8efd59ac'/>
       <elf-symbol name='smp_call_function_many' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe2df8e9a'/>
       <elf-symbol name='smp_call_function_single' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6228c21f'/>
+      <elf-symbol name='smp_call_function_single_async' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6a1cd340'/>
       <elf-symbol name='smp_call_on_cpu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x267df662'/>
       <elf-symbol name='smpboot_register_percpu_thread' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8dd3469d'/>
       <elf-symbol name='smpboot_unregister_percpu_thread' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcc56db'/>
@@ -4511,6 +4617,7 @@
       <elf-symbol name='stack_depot_fetch' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x51a0bc1'/>
       <elf-symbol name='stack_trace_print' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa45c7b90'/>
       <elf-symbol name='stack_trace_save' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6bd1aa56'/>
+      <elf-symbol name='stack_trace_save_regs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc487eb56'/>
       <elf-symbol name='stack_trace_save_tsk' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe8d7e643'/>
       <elf-symbol name='static_key_disable' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb912560d'/>
       <elf-symbol name='static_key_disable_cpuslocked' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe6b79af'/>
@@ -4518,6 +4625,7 @@
       <elf-symbol name='static_key_slow_inc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8e92f7c4'/>
       <elf-symbol name='stop_machine' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdfc04014'/>
       <elf-symbol name='stop_one_cpu_nowait' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbb4465d4'/>
+      <elf-symbol name='store_sampling_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa91801be'/>
       <elf-symbol name='stpcpy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf4db35bc'/>
       <elf-symbol name='strcasecmp' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaafdc258'/>
       <elf-symbol name='strcat' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x61651be'/>
@@ -4603,6 +4711,12 @@
       <elf-symbol name='tasklet_kill' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xea3c74e'/>
       <elf-symbol name='tasklet_setup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa07d1b3c'/>
       <elf-symbol name='tcp_parse_options' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7572a3eb'/>
+      <elf-symbol name='tcp_register_congestion_control' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x830d1ca5'/>
+      <elf-symbol name='tcp_reno_cong_avoid' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe052e0c3'/>
+      <elf-symbol name='tcp_reno_ssthresh' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe76d32b'/>
+      <elf-symbol name='tcp_reno_undo_cwnd' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x34dbb105'/>
+      <elf-symbol name='tcp_slow_start' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa45b71e6'/>
+      <elf-symbol name='tcp_unregister_congestion_control' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x227ff6bd'/>
       <elf-symbol name='tcpci_get_tcpm_port' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbe111953'/>
       <elf-symbol name='tcpci_irq' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6f497a3c'/>
       <elf-symbol name='tcpci_register_port' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb801d79a'/>
@@ -4641,6 +4755,7 @@
       <elf-symbol name='timecounter_read' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6f9e763b'/>
       <elf-symbol name='timer_of_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9174535e'/>
       <elf-symbol name='timer_reduce' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x75c21753'/>
+      <elf-symbol name='timespec64_to_jiffies' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdf93b9d8'/>
       <elf-symbol name='topology_set_thermal_pressure' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xea0dce63'/>
       <elf-symbol name='total_swapcache_pages' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x94f82081'/>
       <elf-symbol name='trace_array_get_by_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x74cf2326'/>
@@ -4718,12 +4833,28 @@
       <elf-symbol name='tty_hangup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4bf61645'/>
       <elf-symbol name='tty_insert_flip_string_fixed_flag' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x80545e76'/>
       <elf-symbol name='tty_kref_put' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac939c40'/>
+      <elf-symbol name='tty_ldisc_deref' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x469fae87'/>
+      <elf-symbol name='tty_ldisc_ref' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7609590a'/>
       <elf-symbol name='tty_mode_ioctl' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x417bf1a7'/>
+      <elf-symbol name='tty_port_close' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x76406461'/>
+      <elf-symbol name='tty_port_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x14669c25'/>
+      <elf-symbol name='tty_port_hangup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xedb2e9f7'/>
+      <elf-symbol name='tty_port_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9a5113a2'/>
+      <elf-symbol name='tty_port_open' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb4d16f48'/>
+      <elf-symbol name='tty_port_register_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x919f9526'/>
       <elf-symbol name='tty_port_tty_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa2a86e1d'/>
+      <elf-symbol name='tty_port_tty_wakeup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x530a7aa'/>
+      <elf-symbol name='tty_register_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x63ae7903'/>
       <elf-symbol name='tty_register_ldisc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3db52eb3'/>
+      <elf-symbol name='tty_set_operations' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x527ea077'/>
+      <elf-symbol name='tty_standard_install' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x85d8b904'/>
       <elf-symbol name='tty_termios_baud_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x409873e3'/>
+      <elf-symbol name='tty_termios_copy_hw' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x30e74134'/>
       <elf-symbol name='tty_termios_encode_baud_rate' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5641485b'/>
+      <elf-symbol name='tty_unregister_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc65f0be5'/>
+      <elf-symbol name='tty_unregister_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf4a49dea'/>
       <elf-symbol name='tty_unregister_ldisc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa120d33c'/>
+      <elf-symbol name='tty_vhangup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9250e1ba'/>
       <elf-symbol name='typec_altmode_get_partner' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5b944414'/>
       <elf-symbol name='typec_altmode_update_active' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xead01e7c'/>
       <elf-symbol name='typec_get_drvdata' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x734a9c4d'/>
@@ -4772,6 +4903,7 @@
       <elf-symbol name='ucsi_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7a43bc71'/>
       <elf-symbol name='ucsi_get_drvdata' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc4603ca2'/>
       <elf-symbol name='ucsi_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x14fc3d73'/>
+      <elf-symbol name='ucsi_send_command' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xec0c620d'/>
       <elf-symbol name='ucsi_set_drvdata' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xef5d6ceb'/>
       <elf-symbol name='ucsi_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x494fa142'/>
       <elf-symbol name='udp4_hwcsum' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5a1b023f'/>
@@ -4841,6 +4973,7 @@
       <elf-symbol name='unregister_pernet_device' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x327ee4c5'/>
       <elf-symbol name='unregister_pernet_subsys' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc674754a'/>
       <elf-symbol name='unregister_pm_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7681946c'/>
+      <elf-symbol name='unregister_qdisc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4e2798c0'/>
       <elf-symbol name='unregister_reboot_notifier' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac1a55be'/>
       <elf-symbol name='unregister_restart_handler' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x40d59096'/>
       <elf-symbol name='unregister_rpmsg_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x31c8e272'/>
@@ -4860,6 +4993,7 @@
       <elf-symbol name='usb_add_gadget' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7ed67fe3'/>
       <elf-symbol name='usb_add_gadget_udc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xde6d5c6f'/>
       <elf-symbol name='usb_add_hcd' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe7b94b3f'/>
+      <elf-symbol name='usb_add_phy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x86f48f44'/>
       <elf-symbol name='usb_add_phy_dev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcfba1162'/>
       <elf-symbol name='usb_alloc_coherent' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe2ceddab'/>
       <elf-symbol name='usb_alloc_dev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd97c0fff'/>
@@ -4874,6 +5008,7 @@
       <elf-symbol name='usb_asmedia_modifyflowcontrol' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd3825c83'/>
       <elf-symbol name='usb_assign_descriptors' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x371c0e4c'/>
       <elf-symbol name='usb_autopm_get_interface' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd937b3ed'/>
+      <elf-symbol name='usb_autopm_get_interface_no_resume' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa53054ba'/>
       <elf-symbol name='usb_autopm_put_interface' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6c6b29fd'/>
       <elf-symbol name='usb_bulk_msg' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa37125'/>
       <elf-symbol name='usb_calc_bus_time' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7e64181d'/>
@@ -4888,6 +5023,7 @@
       <elf-symbol name='usb_decode_ctrl' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4531624f'/>
       <elf-symbol name='usb_del_gadget_udc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x570ef22e'/>
       <elf-symbol name='usb_deregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3713f090'/>
+      <elf-symbol name='usb_deregister_dev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe822527'/>
       <elf-symbol name='usb_disable_xhci_ports' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x545c40a'/>
       <elf-symbol name='usb_disabled' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x19a304ba'/>
       <elf-symbol name='usb_enable_autosuspend' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc6c961cb'/>
@@ -4905,6 +5041,7 @@
       <elf-symbol name='usb_ep_set_halt' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8310b89e'/>
       <elf-symbol name='usb_ep_set_maxpacket_limit' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x77ec757b'/>
       <elf-symbol name='usb_find_common_endpoints' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8eae8dfd'/>
+      <elf-symbol name='usb_find_interface' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe34cd4c7'/>
       <elf-symbol name='usb_free_all_descriptors' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd94a5c25'/>
       <elf-symbol name='usb_free_coherent' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x79b7eb86'/>
       <elf-symbol name='usb_free_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xca0bf864'/>
@@ -4926,10 +5063,12 @@
       <elf-symbol name='usb_gadget_vbus_disconnect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x98c9a408'/>
       <elf-symbol name='usb_gadget_vbus_draw' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9ad0e3fe'/>
       <elf-symbol name='usb_gadget_wakeup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcedd2b6e'/>
+      <elf-symbol name='usb_get_dev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb999b45f'/>
       <elf-symbol name='usb_get_dr_mode' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2e336678'/>
       <elf-symbol name='usb_get_function' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd463183c'/>
       <elf-symbol name='usb_get_function_instance' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4092778a'/>
       <elf-symbol name='usb_get_gadget_udc_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x50b88f41'/>
+      <elf-symbol name='usb_get_intf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe9df4cc0'/>
       <elf-symbol name='usb_get_maximum_speed' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xecda20ec'/>
       <elf-symbol name='usb_get_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x332583b'/>
       <elf-symbol name='usb_gstrings_attach' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x10c531af'/>
@@ -4956,16 +5095,22 @@
       <elf-symbol name='usb_interface_id' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe7b7798d'/>
       <elf-symbol name='usb_kill_anchored_urbs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x962c8ae1'/>
       <elf-symbol name='usb_kill_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa50a37e8'/>
+      <elf-symbol name='usb_match_id' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8015af83'/>
+      <elf-symbol name='usb_match_one_id' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x40c63064'/>
+      <elf-symbol name='usb_os_desc_prepare_interf_dir' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x64479d25'/>
       <elf-symbol name='usb_otg_state_string' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2f0d9053'/>
       <elf-symbol name='usb_phy_get_charger_current' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6a0032e1'/>
       <elf-symbol name='usb_phy_set_charger_current' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9c1af30f'/>
       <elf-symbol name='usb_phy_set_charger_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5183d962'/>
       <elf-symbol name='usb_phy_set_event' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcf271221'/>
+      <elf-symbol name='usb_poison_anchored_urbs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x842f046d'/>
       <elf-symbol name='usb_poison_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb2484436'/>
       <elf-symbol name='usb_put_dev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf6f3714c'/>
       <elf-symbol name='usb_put_function' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa09504a8'/>
       <elf-symbol name='usb_put_function_instance' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x15993252'/>
       <elf-symbol name='usb_put_hcd' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5279e353'/>
+      <elf-symbol name='usb_put_intf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xef5d3e52'/>
+      <elf-symbol name='usb_register_dev' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfc426e57'/>
       <elf-symbol name='usb_register_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8ef88460'/>
       <elf-symbol name='usb_register_notify' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x89bbafc6'/>
       <elf-symbol name='usb_remove_function' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x62ecc28b'/>
@@ -4980,14 +5125,19 @@
       <elf-symbol name='usb_role_switch_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2882d40e'/>
       <elf-symbol name='usb_root_hub_lost_power' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1ca66e75'/>
       <elf-symbol name='usb_set_device_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc405a128'/>
+      <elf-symbol name='usb_set_interface' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc5eb1739'/>
+      <elf-symbol name='usb_show_dynids' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc17e9946'/>
       <elf-symbol name='usb_speed_string' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x77ae495d'/>
+      <elf-symbol name='usb_store_new_id' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9f1f0846'/>
       <elf-symbol name='usb_string_id' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xac9e3175'/>
       <elf-symbol name='usb_submit_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7e007410'/>
       <elf-symbol name='usb_udc_vbus_handler' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5ca7ee45'/>
       <elf-symbol name='usb_unanchor_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x399a458c'/>
+      <elf-symbol name='usb_unpoison_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc518a377'/>
       <elf-symbol name='usb_unregister_notify' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x811dc334'/>
       <elf-symbol name='usb_wakeup_notification' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x84edb62f'/>
       <elf-symbol name='usbnet_change_mtu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x29b080fc'/>
+      <elf-symbol name='usbnet_defer_kevent' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x983cd249'/>
       <elf-symbol name='usbnet_disconnect' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xff76f05'/>
       <elf-symbol name='usbnet_get_drvinfo' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc9eac17c'/>
       <elf-symbol name='usbnet_get_endpoints' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf4f15b5b'/>
@@ -5038,6 +5188,7 @@
       <elf-symbol name='v4l2_ctrl_handler_setup' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfe70f9dd'/>
       <elf-symbol name='v4l2_ctrl_log_status' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8aa2828c'/>
       <elf-symbol name='v4l2_ctrl_new_custom' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbef09d5c'/>
+      <elf-symbol name='v4l2_ctrl_new_int_menu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa6beb5d9'/>
       <elf-symbol name='v4l2_ctrl_new_std' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3da5d575'/>
       <elf-symbol name='v4l2_ctrl_new_std_menu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x663d2402'/>
       <elf-symbol name='v4l2_ctrl_new_std_menu_items' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdbdd5c77'/>
@@ -5108,6 +5259,7 @@
       <elf-symbol name='v4l2_m2m_unregister_media_controller' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf13ff84d'/>
       <elf-symbol name='v4l2_match_dv_timings' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd034392d'/>
       <elf-symbol name='v4l2_pipeline_link_notify' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8b4f4749'/>
+      <elf-symbol name='v4l2_querymenu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xae9f2785'/>
       <elf-symbol name='v4l2_s_ctrl' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x81f0747c'/>
       <elf-symbol name='v4l2_s_parm_cap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb1e6233e'/>
       <elf-symbol name='v4l2_spi_subdev_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd7f32d29'/>
@@ -5258,9 +5410,11 @@
       <elf-symbol name='vring_transport_features' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xeb0324f4'/>
       <elf-symbol name='vscnprintf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaa0c318b'/>
       <elf-symbol name='vsnprintf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x148653'/>
+      <elf-symbol name='vsock_addr_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x73879664'/>
       <elf-symbol name='vsock_core_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd92f239a'/>
       <elf-symbol name='vsock_core_unregister' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x92f526b7'/>
       <elf-symbol name='vsock_for_each_connected_socket' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x72136f78'/>
+      <elf-symbol name='vsock_remove_sock' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa644921c'/>
       <elf-symbol name='vsprintf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x78b887ed'/>
       <elf-symbol name='vunmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x94961283'/>
       <elf-symbol name='vzalloc' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x40a9b349'/>
@@ -5364,6 +5518,8 @@
       <elf-symbol name='__tracepoint_android_rvh_account_irq' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf0f46523'/>
       <elf-symbol name='__tracepoint_android_rvh_after_dequeue_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9ad4f5ba'/>
       <elf-symbol name='__tracepoint_android_rvh_after_enqueue_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x36d08831'/>
+      <elf-symbol name='__tracepoint_android_rvh_arm64_serror_panic' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3eeb0795'/>
+      <elf-symbol name='__tracepoint_android_rvh_bad_mode' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x11c4733a'/>
       <elf-symbol name='__tracepoint_android_rvh_build_perf_domains' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7ff307b5'/>
       <elf-symbol name='__tracepoint_android_rvh_can_migrate_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x89ef9455'/>
       <elf-symbol name='__tracepoint_android_rvh_cgroup_force_kthread_migration' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc180285'/>
@@ -5378,9 +5534,12 @@
       <elf-symbol name='__tracepoint_android_rvh_dequeue_entity' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5f0191c3'/>
       <elf-symbol name='__tracepoint_android_rvh_dequeue_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf992211e'/>
       <elf-symbol name='__tracepoint_android_rvh_dequeue_task_fair' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x34684643'/>
+      <elf-symbol name='__tracepoint_android_rvh_dequeue_task_idle' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x82ae67dd'/>
       <elf-symbol name='__tracepoint_android_rvh_die_kernel_fault' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x33c9af1e'/>
       <elf-symbol name='__tracepoint_android_rvh_do_mem_abort' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xadec6b55'/>
+      <elf-symbol name='__tracepoint_android_rvh_do_sea' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x23501356'/>
       <elf-symbol name='__tracepoint_android_rvh_do_sp_pc_abort' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x1ed564a9'/>
+      <elf-symbol name='__tracepoint_android_rvh_do_undefinstr' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x48a1e8c'/>
       <elf-symbol name='__tracepoint_android_rvh_enqueue_entity' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa9c271c6'/>
       <elf-symbol name='__tracepoint_android_rvh_enqueue_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x55965c95'/>
       <elf-symbol name='__tracepoint_android_rvh_enqueue_task_fair' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6eb0e4b8'/>
@@ -5406,6 +5565,7 @@
       <elf-symbol name='__tracepoint_android_rvh_preempt_disable' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb4ec0da4'/>
       <elf-symbol name='__tracepoint_android_rvh_preempt_enable' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x86d490a6'/>
       <elf-symbol name='__tracepoint_android_rvh_prepare_prio_fork' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xadd0283e'/>
+      <elf-symbol name='__tracepoint_android_rvh_refrigerator' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaa020dd1'/>
       <elf-symbol name='__tracepoint_android_rvh_replace_next_task_fair' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa95004c7'/>
       <elf-symbol name='__tracepoint_android_rvh_report_bug' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb68447d7'/>
       <elf-symbol name='__tracepoint_android_rvh_resume_cpus' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc30c6b6f'/>
@@ -5442,6 +5602,7 @@
       <elf-symbol name='__tracepoint_android_rvh_typec_tcpci_chk_contaminant' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4b7c8cf3'/>
       <elf-symbol name='__tracepoint_android_rvh_typec_tcpci_get_vbus' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x853bba97'/>
       <elf-symbol name='__tracepoint_android_rvh_uclamp_eff_get' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x76a8e7d1'/>
+      <elf-symbol name='__tracepoint_android_rvh_ufs_complete_init' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x149dd525'/>
       <elf-symbol name='__tracepoint_android_rvh_ufs_reprogram_all_keys' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8c77d76'/>
       <elf-symbol name='__tracepoint_android_rvh_update_cpu_capacity' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xef03083e'/>
       <elf-symbol name='__tracepoint_android_rvh_update_cpus_allowed' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf9395534'/>
@@ -5491,6 +5652,7 @@
       <elf-symbol name='__tracepoint_android_vh_do_send_sig_info' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x6db82691'/>
       <elf-symbol name='__tracepoint_android_vh_do_wake_up_sync' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x24bef402'/>
       <elf-symbol name='__tracepoint_android_vh_dump_throttled_rt_tasks' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd29bebac'/>
+      <elf-symbol name='__tracepoint_android_vh_dup_task_struct' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x14fff0cf'/>
       <elf-symbol name='__tracepoint_android_vh_em_cpu_energy' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7ce74918'/>
       <elf-symbol name='__tracepoint_android_vh_enable_thermal_genl_check' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x901a2c7c'/>
       <elf-symbol name='__tracepoint_android_vh_ep_create_wakeup_source' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfdd7bb80'/>
@@ -5518,9 +5680,11 @@
       <elf-symbol name='__tracepoint_android_vh_iommu_setup_dma_ops' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x95f68a6b'/>
       <elf-symbol name='__tracepoint_android_vh_ipi_stop' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8064d573'/>
       <elf-symbol name='__tracepoint_android_vh_ipv6_gen_linklocal_addr' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcd130856'/>
+      <elf-symbol name='__tracepoint_android_vh_irqtime_account_process_tick' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x61bb9d22'/>
       <elf-symbol name='__tracepoint_android_vh_is_fpsimd_save' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x961b247c'/>
       <elf-symbol name='__tracepoint_android_vh_jiffies_update' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5415675e'/>
       <elf-symbol name='__tracepoint_android_vh_kfree_skb' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7d60c113'/>
+      <elf-symbol name='__tracepoint_android_vh_kmalloc_slab' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbc488301'/>
       <elf-symbol name='__tracepoint_android_vh_logbuf' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8bf980ca'/>
       <elf-symbol name='__tracepoint_android_vh_logbuf_pr_cont' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x783fd15a'/>
       <elf-symbol name='__tracepoint_android_vh_map_util_freq' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf9624317'/>
@@ -5546,11 +5710,20 @@
       <elf-symbol name='__tracepoint_android_vh_revert_creds' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbedc98e0'/>
       <elf-symbol name='__tracepoint_android_vh_rmqueue' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8c074b9'/>
       <elf-symbol name='__tracepoint_android_vh_rproc_recovery' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1337b04'/>
+      <elf-symbol name='__tracepoint_android_vh_rtmutex_wait_finish' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xee6fc031'/>
+      <elf-symbol name='__tracepoint_android_vh_rtmutex_wait_start' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdaf6aebd'/>
       <elf-symbol name='__tracepoint_android_vh_rwsem_init' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9be0ac46'/>
+      <elf-symbol name='__tracepoint_android_vh_rwsem_read_wait_finish' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x460eeeee'/>
+      <elf-symbol name='__tracepoint_android_vh_rwsem_read_wait_start' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdc072410'/>
       <elf-symbol name='__tracepoint_android_vh_rwsem_wake' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4c0e628d'/>
       <elf-symbol name='__tracepoint_android_vh_rwsem_wake_finish' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4d5f6143'/>
       <elf-symbol name='__tracepoint_android_vh_rwsem_write_finished' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x365bc31a'/>
+      <elf-symbol name='__tracepoint_android_vh_rwsem_write_wait_finish' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x85c6d9bd'/>
+      <elf-symbol name='__tracepoint_android_vh_rwsem_write_wait_start' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x18bed6ed'/>
+      <elf-symbol name='__tracepoint_android_vh_save_track_hash' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2c772ac0'/>
+      <elf-symbol name='__tracepoint_android_vh_save_vmalloc_stack' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x36909fb9'/>
       <elf-symbol name='__tracepoint_android_vh_sched_setaffinity_early' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcec91b82'/>
+      <elf-symbol name='__tracepoint_android_vh_sched_show_task' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd3537ff4'/>
       <elf-symbol name='__tracepoint_android_vh_scheduler_tick' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa3e74b24'/>
       <elf-symbol name='__tracepoint_android_vh_sd_update_bus_speed_mode' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa28867a'/>
       <elf-symbol name='__tracepoint_android_vh_sdhci_get_cd' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xde374772'/>
@@ -5572,6 +5745,7 @@
       <elf-symbol name='__tracepoint_android_vh_show_max_freq' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8965f857'/>
       <elf-symbol name='__tracepoint_android_vh_show_mem' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4520b6b9'/>
       <elf-symbol name='__tracepoint_android_vh_show_resume_epoch_val' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5c575c4a'/>
+      <elf-symbol name='__tracepoint_android_vh_show_stack_hash' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x629f88d6'/>
       <elf-symbol name='__tracepoint_android_vh_show_suspend_epoch_val' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x64718122'/>
       <elf-symbol name='__tracepoint_android_vh_snd_compr_use_pause_in_drain' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9b89d106'/>
       <elf-symbol name='__tracepoint_android_vh_sound_usb_support_cpu_suspend' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdc96142a'/>
@@ -5580,6 +5754,8 @@
       <elf-symbol name='__tracepoint_android_vh_thermal_pm_notify_suspend' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdbacbda3'/>
       <elf-symbol name='__tracepoint_android_vh_timer_calc_index' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbb9e5425'/>
       <elf-symbol name='__tracepoint_android_vh_timerfd_create' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb7b47b4c'/>
+      <elf-symbol name='__tracepoint_android_vh_try_to_freeze_todo' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfd044c4f'/>
+      <elf-symbol name='__tracepoint_android_vh_try_to_freeze_todo_unfrozen' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8324d153'/>
       <elf-symbol name='__tracepoint_android_vh_tune_inactive_ratio' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xebfa95d0'/>
       <elf-symbol name='__tracepoint_android_vh_tune_scan_type' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2b51008f'/>
       <elf-symbol name='__tracepoint_android_vh_tune_swappiness' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x69b36725'/>
@@ -5599,9 +5775,14 @@
       <elf-symbol name='__tracepoint_android_vh_ufs_update_sdev' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xff48ed3d'/>
       <elf-symbol name='__tracepoint_android_vh_ufs_update_sysfs' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd1493d2e'/>
       <elf-symbol name='__tracepoint_android_vh_update_topology_flags_workfn' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd28119e8'/>
+      <elf-symbol name='__tracepoint_android_vh_usb_dev_resume' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb0b00d33'/>
+      <elf-symbol name='__tracepoint_android_vh_usb_dev_suspend' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x686c4071'/>
       <elf-symbol name='__tracepoint_android_vh_v4l2subdev_set_fmt' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x82ce28ec'/>
       <elf-symbol name='__tracepoint_android_vh_v4l2subdev_set_frame_interval' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x26ad531b'/>
       <elf-symbol name='__tracepoint_android_vh_v4l2subdev_set_selection' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd163b93e'/>
+      <elf-symbol name='__tracepoint_android_vh_vmpressure' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf9257104'/>
+      <elf-symbol name='__tracepoint_android_vh_watchdog_timer_softlockup' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x74ea651e'/>
+      <elf-symbol name='__tracepoint_android_vh_wq_lockup_pool' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5980aaff'/>
       <elf-symbol name='__tracepoint_binder_transaction_received' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xab619a41'/>
       <elf-symbol name='__tracepoint_clock_set_rate' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x19552c17'/>
       <elf-symbol name='__tracepoint_cpu_frequency' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf9093f5b'/>
@@ -5659,14 +5840,17 @@
       <elf-symbol name='arm64_const_caps_ready' size='16' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x14b89635'/>
       <elf-symbol name='arm64_use_ng_mappings' size='1' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaf56600a'/>
       <elf-symbol name='arp_tbl' size='568' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8cf42e34'/>
+      <elf-symbol name='avenrun' size='24' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1e98c74'/>
       <elf-symbol name='balloon_aops' size='208' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x71fb77bb'/>
       <elf-symbol name='bpf_stats_enabled_key' size='16' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf84bd6ee'/>
       <elf-symbol name='clk_divider_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4ed3c288'/>
+      <elf-symbol name='clk_divider_ro_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xae330045'/>
       <elf-symbol name='clk_fixed_factor_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x274e799a'/>
       <elf-symbol name='clk_fixed_rate_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd484b507'/>
       <elf-symbol name='clk_fractional_divider_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcdcf81f5'/>
       <elf-symbol name='clk_gate_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5442693f'/>
       <elf-symbol name='clk_mux_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3348edd8'/>
+      <elf-symbol name='clk_mux_ro_ops' size='216' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb74e5c29'/>
       <elf-symbol name='console_drivers' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4822584'/>
       <elf-symbol name='console_printk' size='16' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2592fc6c'/>
       <elf-symbol name='console_suspend_enabled' size='1' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x366307a'/>
@@ -5725,6 +5909,7 @@
       <elf-symbol name='iomem_resource' size='96' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc7da062f'/>
       <elf-symbol name='ipv6_stub' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8b9e89a5'/>
       <elf-symbol name='irq_domain_simple_ops' size='80' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd460cbd6'/>
+      <elf-symbol name='irq_generic_chip_ops' size='80' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9ea99b47'/>
       <elf-symbol name='irq_stat' size='64' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2391f725'/>
       <elf-symbol name='jiffies' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x15ba50a6'/>
       <elf-symbol name='jiffies_64' size='8' type='object-type' binding='global-binding' visibility='default-visibility' alias='jiffies' is-defined='yes' crc='0x55e77e8'/>
@@ -5738,6 +5923,7 @@
       <elf-symbol name='ksoftirqd' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x66f86b20'/>
       <elf-symbol name='kstat' size='48' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x38869d88'/>
       <elf-symbol name='loops_per_jiffy' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xba497f13'/>
+      <elf-symbol name='memcg_kmem_enabled_key' size='16' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd3543063'/>
       <elf-symbol name='memstart_addr' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9688de8b'/>
       <elf-symbol name='names_cachep' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3096be16'/>
       <elf-symbol name='nd_tbl' size='568' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5023214d'/>
@@ -5809,6 +5995,7 @@
       <elf-symbol name='topology_update_done' size='1' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc7b3d143'/>
       <elf-symbol name='tracepoint_srcu' size='696' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbf451872'/>
       <elf-symbol name='ttm_bo_glob' size='200' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x685376c6'/>
+      <elf-symbol name='tty_std_termios' size='44' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x67b27ec1'/>
       <elf-symbol name='usb_debug_root' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbc6f9adc'/>
       <elf-symbol name='usb_hcd_pci_pm_ops' size='192' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x57b277fa'/>
       <elf-symbol name='usb_hcds_loaded' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc17515d7'/>
@@ -5823,6 +6010,14 @@
       <elf-symbol name='vm_zone_stat' size='96' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ba1187'/>
     </elf-variable-symbols>
     <abi-instr address-size='64' language='LANG_C89' path='various'>
+      <class-decl name='mmpin' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/skbuff.h' line='481' column='1' id='0009269e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='user' type-id='273a7d34' visibility='default' filepath='include/linux/skbuff.h' line='482' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='num_pg' type-id='f0981eeb' visibility='default' filepath='include/linux/skbuff.h' line='483' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='b5b8ebc4' size-in-bits='64' id='001b67aa'/>
       <class-decl name='gro_cell' size-in-bits='3584' is-struct='yes' visibility='default' filepath='net/core/gro_cells.c' line='7' column='1' id='001ff55a'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -5957,81 +6152,81 @@
       <pointer-type-def type-id='bd8642d8' size-in-bits='64' id='00cfc612'/>
       <qualified-type-def type-id='a94a041a' const='yes' id='00d2c7e1'/>
       <pointer-type-def type-id='ed626d0d' size-in-bits='64' id='00e2a7ce'/>
-      <class-decl name='snd_soc_pcm_runtime' size-in-bits='14080' is-struct='yes' visibility='default' filepath='include/sound/soc.h' line='1140' column='1' id='00e3a6d4'>
+      <class-decl name='snd_soc_pcm_runtime' size-in-bits='14080' is-struct='yes' visibility='default' filepath='include/sound/soc.h' line='1146' column='1' id='00e3a6d4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='dev' type-id='fa0b179b' visibility='default' filepath='include/sound/soc.h' line='1141' column='1'/>
+          <var-decl name='dev' type-id='fa0b179b' visibility='default' filepath='include/sound/soc.h' line='1147' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='card' type-id='3059cd0b' visibility='default' filepath='include/sound/soc.h' line='1142' column='1'/>
+          <var-decl name='card' type-id='3059cd0b' visibility='default' filepath='include/sound/soc.h' line='1148' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='dai_link' type-id='af5a73b0' visibility='default' filepath='include/sound/soc.h' line='1143' column='1'/>
+          <var-decl name='dai_link' type-id='af5a73b0' visibility='default' filepath='include/sound/soc.h' line='1149' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='ops' type-id='73803d48' visibility='default' filepath='include/sound/soc.h' line='1144' column='1'/>
+          <var-decl name='ops' type-id='73803d48' visibility='default' filepath='include/sound/soc.h' line='1150' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='params_select' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1146' column='1'/>
+          <var-decl name='params_select' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1152' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='dpcm' type-id='39f07796' visibility='default' filepath='include/sound/soc.h' line='1149' column='1'/>
+          <var-decl name='dpcm' type-id='39f07796' visibility='default' filepath='include/sound/soc.h' line='1155' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12032'>
-          <var-decl name='pmdown_time' type-id='bd54fe1a' visibility='default' filepath='include/sound/soc.h' line='1151' column='1'/>
+          <var-decl name='pmdown_time' type-id='bd54fe1a' visibility='default' filepath='include/sound/soc.h' line='1157' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12096'>
-          <var-decl name='pcm' type-id='4c9f335b' visibility='default' filepath='include/sound/soc.h' line='1154' column='1'/>
+          <var-decl name='pcm' type-id='4c9f335b' visibility='default' filepath='include/sound/soc.h' line='1160' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12160'>
-          <var-decl name='compr' type-id='dc1e097e' visibility='default' filepath='include/sound/soc.h' line='1155' column='1'/>
+          <var-decl name='compr' type-id='dc1e097e' visibility='default' filepath='include/sound/soc.h' line='1161' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12224'>
-          <var-decl name='dais' type-id='8f157e69' visibility='default' filepath='include/sound/soc.h' line='1164' column='1'/>
+          <var-decl name='dais' type-id='8f157e69' visibility='default' filepath='include/sound/soc.h' line='1170' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12288'>
-          <var-decl name='num_codecs' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1165' column='1'/>
+          <var-decl name='num_codecs' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1171' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12320'>
-          <var-decl name='num_cpus' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1166' column='1'/>
+          <var-decl name='num_cpus' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1172' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12352'>
-          <var-decl name='playback_widget' type-id='810606ec' visibility='default' filepath='include/sound/soc.h' line='1168' column='1'/>
+          <var-decl name='playback_widget' type-id='810606ec' visibility='default' filepath='include/sound/soc.h' line='1174' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12416'>
-          <var-decl name='capture_widget' type-id='810606ec' visibility='default' filepath='include/sound/soc.h' line='1169' column='1'/>
+          <var-decl name='capture_widget' type-id='810606ec' visibility='default' filepath='include/sound/soc.h' line='1175' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='12480'>
-          <var-decl name='delayed_work' type-id='5ad6e0ef' visibility='default' filepath='include/sound/soc.h' line='1171' column='1'/>
+          <var-decl name='delayed_work' type-id='5ad6e0ef' visibility='default' filepath='include/sound/soc.h' line='1177' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13568'>
-          <var-decl name='close_delayed_work_func' type-id='d3d046f7' visibility='default' filepath='include/sound/soc.h' line='1172' column='1'/>
+          <var-decl name='close_delayed_work_func' type-id='d3d046f7' visibility='default' filepath='include/sound/soc.h' line='1178' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13632'>
-          <var-decl name='debugfs_dpcm_root' type-id='27675065' visibility='default' filepath='include/sound/soc.h' line='1174' column='1'/>
+          <var-decl name='debugfs_dpcm_root' type-id='27675065' visibility='default' filepath='include/sound/soc.h' line='1180' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13696'>
-          <var-decl name='num' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1177' column='1'/>
+          <var-decl name='num' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1183' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13760'>
-          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/sound/soc.h' line='1178' column='1'/>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/sound/soc.h' line='1184' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13888'>
-          <var-decl name='mark_startup' type-id='06b2cd14' visibility='default' filepath='include/sound/soc.h' line='1181' column='1'/>
+          <var-decl name='mark_startup' type-id='06b2cd14' visibility='default' filepath='include/sound/soc.h' line='1187' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='pop_wait' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1184' column='1'/>
+          <var-decl name='pop_wait' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1190' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='fe_compr' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1185' column='1'/>
+          <var-decl name='fe_compr' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1191' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='13984'>
-          <var-decl name='num_components' type-id='95e97e5e' visibility='default' filepath='include/sound/soc.h' line='1187' column='1'/>
+          <var-decl name='num_components' type-id='95e97e5e' visibility='default' filepath='include/sound/soc.h' line='1193' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='14016'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/sound/soc.h' line='1189' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/sound/soc.h' line='1195' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='14080'>
-          <var-decl name='components' type-id='d936a132' visibility='default' filepath='include/sound/soc.h' line='1191' column='1'/>
+          <var-decl name='components' type-id='d936a132' visibility='default' filepath='include/sound/soc.h' line='1197' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='8cd967bc' size-in-bits='64' id='00e8fe5a'/>
@@ -6153,6 +6348,7 @@
           <var-decl name='private' type-id='eaa32e2f' visibility='default' filepath='include/sound/pcm.h' line='235' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='d285082e' size-in-bits='64' id='015a0234'/>
       <pointer-type-def type-id='e222a326' size-in-bits='64' id='016811bc'/>
       <function-type size-in-bits='64' id='016b3662'>
         <parameter type-id='c50361c5'/>
@@ -6942,6 +7138,35 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='1b632d0e' size-in-bits='64' id='03e056a8'/>
+      <class-decl name='ipv6_txoptions' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/net/ipv6.h' line='287' column='1' id='03e12711'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='refcnt' type-id='64615833' visibility='default' filepath='include/net/ipv6.h' line='288' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='tot_len' type-id='95e97e5e' visibility='default' filepath='include/net/ipv6.h' line='290' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='opt_flen' type-id='d315442e' visibility='default' filepath='include/net/ipv6.h' line='294' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='80'>
+          <var-decl name='opt_nflen' type-id='d315442e' visibility='default' filepath='include/net/ipv6.h' line='295' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='hopopt' type-id='edff578b' visibility='default' filepath='include/net/ipv6.h' line='297' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='dst0opt' type-id='edff578b' visibility='default' filepath='include/net/ipv6.h' line='298' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='srcrt' type-id='40629354' visibility='default' filepath='include/net/ipv6.h' line='299' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='dst1opt' type-id='edff578b' visibility='default' filepath='include/net/ipv6.h' line='300' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/ipv6.h' line='301' column='1'/>
+        </data-member>
+      </class-decl>
       <qualified-type-def type-id='56ed3a25' const='yes' id='03f3693e'/>
       <pointer-type-def type-id='3a7813d3' size-in-bits='64' id='040770fb'/>
       <pointer-type-def type-id='800ed759' size-in-bits='64' id='040ef975'/>
@@ -6962,36 +7187,36 @@
         <parameter type-id='fce0537d'/>
         <return type-id='91ce1af9'/>
       </function-type>
-      <class-decl name='soc_enum' size-in-bits='896' is-struct='yes' visibility='default' filepath='include/sound/soc.h' line='1270' column='1' id='044208ec'>
+      <class-decl name='soc_enum' size-in-bits='896' is-struct='yes' visibility='default' filepath='include/sound/soc.h' line='1276' column='1' id='044208ec'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='reg' type-id='95e97e5e' visibility='default' filepath='include/sound/soc.h' line='1271' column='1'/>
+          <var-decl name='reg' type-id='95e97e5e' visibility='default' filepath='include/sound/soc.h' line='1277' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='shift_l' type-id='002ac4a6' visibility='default' filepath='include/sound/soc.h' line='1272' column='1'/>
+          <var-decl name='shift_l' type-id='002ac4a6' visibility='default' filepath='include/sound/soc.h' line='1278' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='40'>
-          <var-decl name='shift_r' type-id='002ac4a6' visibility='default' filepath='include/sound/soc.h' line='1273' column='1'/>
+          <var-decl name='shift_r' type-id='002ac4a6' visibility='default' filepath='include/sound/soc.h' line='1279' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='items' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1274' column='1'/>
+          <var-decl name='items' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1280' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='mask' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1275' column='1'/>
+          <var-decl name='mask' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1281' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='texts' type-id='13956559' visibility='default' filepath='include/sound/soc.h' line='1276' column='1'/>
+          <var-decl name='texts' type-id='13956559' visibility='default' filepath='include/sound/soc.h' line='1282' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='values' type-id='5b2fd8e8' visibility='default' filepath='include/sound/soc.h' line='1277' column='1'/>
+          <var-decl name='values' type-id='5b2fd8e8' visibility='default' filepath='include/sound/soc.h' line='1283' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='autodisable' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1278' column='1'/>
+          <var-decl name='autodisable' type-id='f0981eeb' visibility='default' filepath='include/sound/soc.h' line='1284' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='dobj' type-id='01edcafc' visibility='default' filepath='include/sound/soc.h' line='1280' column='1'/>
+          <var-decl name='dobj' type-id='01edcafc' visibility='default' filepath='include/sound/soc.h' line='1286' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/sound/soc.h' line='1283' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/sound/soc.h' line='1289' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='ttm_bo_device' size-in-bits='2944' is-struct='yes' visibility='default' filepath='include/drm/ttm/ttm_bo_driver.h' line='316' column='1' id='0448ebb1'>
@@ -7194,6 +7419,17 @@
           <var-decl name='pgprot' type-id='e044eb0d' visibility='default' filepath='arch/arm64/include/asm/pgtable-types.h' line='43' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='ipv6_fl_socklist' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/ipv6.h' line='337' column='1' id='05198978'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='next' type-id='3a14a5ee' visibility='default' filepath='include/net/ipv6.h' line='338' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='fl' type-id='e90fa847' visibility='default' filepath='include/net/ipv6.h' line='339' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/ipv6.h' line='340' column='1'/>
+        </data-member>
+      </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='32' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/perf_event.h' line='389' column='1' id='051df3c3'>
         <data-member access='public'>
           <var-decl name='wakeup_events' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/perf_event.h' line='390' column='1'/>
@@ -7325,6 +7561,35 @@
           <var-decl name='len' type-id='b59d7dce' visibility='default' filepath='drivers/firmware/arm_scmi/common.h' line='123' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='usb_cdc_mbim_desc' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='197' column='1' id='0570fd5e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='198' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='199' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='200' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bcdMBIMVersion' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='202' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='40'>
+          <var-decl name='wMaxControlMessage' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='203' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='56'>
+          <var-decl name='bNumberFilters' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='204' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='bMaxFilterSize' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='205' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='72'>
+          <var-decl name='wMaxSegmentSize' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='206' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='88'>
+          <var-decl name='bmNetworkCapabilities' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='207' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='057e4bd2'>
         <parameter type-id='226853d2'/>
         <parameter type-id='e475ab95'/>
@@ -8103,6 +8368,14 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='97ca9b12' size-in-bits='64' id='0786894c'/>
+      <class-decl name='ip_options_rcu' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/inet_sock.h' line='58' column='1' id='0786b8b4'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/inet_sock.h' line='59' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='opt' type-id='fa35cea9' visibility='default' filepath='include/net/inet_sock.h' line='60' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='4d6fc4c7' size-in-bits='64' id='078de3a3'/>
       <pointer-type-def type-id='0086a11a' size-in-bits='64' id='078f0514'/>
       <pointer-type-def type-id='91f7d512' size-in-bits='64' id='078f3b94'/>
@@ -8346,6 +8619,10 @@
         <parameter type-id='bd0b5822'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='f6898056' size-in-bits='64' id='08a11828'/>
+      <array-type-def dimensions='1' type-id='91ce1af9' size-in-bits='832' id='08a4cc8e'>
+        <subrange length='13' type-id='7ff19f0f' id='487fded1'/>
+      </array-type-def>
       <array-type-def dimensions='1' type-id='91ce1af9' size-in-bits='640' id='08a70b25'>
         <subrange length='10' type-id='7ff19f0f' id='487da03a'/>
       </array-type-def>
@@ -9272,6 +9549,7 @@
       <pointer-type-def type-id='57bfbe05' size-in-bits='64' id='09dbca85'/>
       <pointer-type-def type-id='85bdf127' size-in-bits='64' id='09dcd1bf'/>
       <qualified-type-def type-id='b5b9216e' const='yes' id='09f052f7'/>
+      <pointer-type-def type-id='bdb32c88' size-in-bits='64' id='09f0b23a'/>
       <function-type size-in-bits='64' id='09f0c826'>
         <parameter type-id='6dca061b'/>
         <parameter type-id='eaa32e2f'/>
@@ -9885,6 +10163,7 @@
       <pointer-type-def type-id='b91ab08d' size-in-bits='64' id='0c0416e5'/>
       <pointer-type-def type-id='50801c15' size-in-bits='64' id='0c16aca1'/>
       <pointer-type-def type-id='86a0b663' size-in-bits='64' id='0c197ddf'/>
+      <pointer-type-def type-id='5e084b85' size-in-bits='64' id='0c1984e5'/>
       <qualified-type-def type-id='6193579c' const='yes' id='0c1d8f67'/>
       <function-type size-in-bits='64' id='0c227c61'>
         <parameter type-id='4a935625'/>
@@ -10240,6 +10519,7 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/spmi.h' line='89' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='dcf61f1a' size-in-bits='64' id='0d2afef8'/>
       <pointer-type-def type-id='1f305e7e' size-in-bits='64' id='0d378d14'/>
       <pointer-type-def type-id='d066d157' size-in-bits='64' id='0d3b0dcf'/>
       <function-type size-in-bits='64' id='0d3f29fc'>
@@ -10524,6 +10804,11 @@
       </array-type-def>
       <pointer-type-def type-id='6ba772ee' size-in-bits='64' id='0de721e0'/>
       <pointer-type-def type-id='a8c11af0' size-in-bits='64' id='0dee990a'/>
+      <class-decl name='minmax' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/win_minmax.h' line='18' column='1' id='0df12a77'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='s' type-id='ddf292bf' visibility='default' filepath='include/linux/win_minmax.h' line='19' column='1'/>
+        </data-member>
+      </class-decl>
       <qualified-type-def type-id='39b596d4' const='yes' id='0e085d99'/>
       <pointer-type-def type-id='f16e9b99' size-in-bits='64' id='0e0c1c5d'/>
       <qualified-type-def type-id='fb6b0a12' const='yes' id='0e143c35'/>
@@ -10640,6 +10925,32 @@
           <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/linux/interconnect-provider.h' line='73' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='usb_cdc_ether_desc' size-in-bits='104' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='135' column='1' id='0e5b8ca7'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='136' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='137' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='138' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='iMACAddress' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='140' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='bmEthernetStatistics' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='141' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='wMaxSegmentSize' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='142' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='80'>
+          <var-decl name='wNumberMCFilters' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='143' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='bNumberPowerFilters' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='144' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='hid_ll_driver' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/linux/hid.h' line='800' column='1' id='0e5e2ca6'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='start' type-id='7e01f3db' visibility='default' filepath='include/linux/hid.h' line='801' column='1'/>
@@ -10705,6 +11016,20 @@
           <var-decl name='icmpv6msgdev' type-id='793f0d19' visibility='default' filepath='include/net/if_inet6.h' line='160' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='ipv6_rt_hdr' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/ipv6.h' line='49' column='1' id='0eae882e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='nexthdr' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/ipv6.h' line='50' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='hdrlen' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/ipv6.h' line='51' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='type' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/ipv6.h' line='52' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='segments_left' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/ipv6.h' line='53' column='1'/>
+        </data-member>
+      </class-decl>
       <typedef-decl name='mm_context_t' type-id='c9e2b4ad' filepath='arch/arm64/include/asm/mmu.h' line='27' column='1' id='0eb9c3fd'/>
       <function-type size-in-bits='64' id='0ebe5367'>
         <parameter type-id='fa0b179b'/>
@@ -10783,6 +11108,20 @@
         <parameter type-id='d9863f2f'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <class-decl name='__anonymous_struct__' size-in-bits='96' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/skbuff.h' line='472' column='1' id='0efb3709'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='id' type-id='19c2251e' visibility='default' filepath='include/linux/skbuff.h' line='473' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='len' type-id='1dc6a898' visibility='default' filepath='include/linux/skbuff.h' line='474' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='zerocopy' type-id='1dc6a898' visibility='default' filepath='include/linux/skbuff.h' line='475' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='bytelen' type-id='19c2251e' visibility='default' filepath='include/linux/skbuff.h' line='476' column='1'/>
+        </data-member>
+      </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/in6.h' line='34' column='1' id='0efc37b8'>
         <data-member access='public'>
           <var-decl name='u6_addr8' type-id='9396cabb' visibility='default' filepath='include/uapi/linux/in6.h' line='35' column='1'/>
@@ -11135,6 +11474,9 @@
         <parameter type-id='98671e4f'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <array-type-def dimensions='1' type-id='f6ed712a' size-in-bits='infinite' id='0fdf6c82'>
+        <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
+      </array-type-def>
       <class-decl name='ehci_dbg_port' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/linux/usb/ehci-dbgp.h' line='24' column='1' id='0fdf79a2'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='control' type-id='19c2251e' visibility='default' filepath='include/linux/usb/ehci-dbgp.h' line='25' column='1'/>
@@ -11306,6 +11648,11 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='2ef05706' size-in-bits='64' id='10593a44'/>
+      <function-type size-in-bits='64' id='105b52f0'>
+        <parameter type-id='88146159'/>
+        <parameter type-id='d6184118'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <qualified-type-def type-id='d3860975' const='yes' id='105c9300'/>
       <array-type-def dimensions='1' type-id='b3ad2c1c' size-in-bits='3072' id='105eff46'>
         <subrange length='8' type-id='7ff19f0f' id='56e0c0b1'/>
@@ -11379,6 +11726,53 @@
       <pointer-type-def type-id='dc5abf9a' size-in-bits='64' id='108dbc98'/>
       <pointer-type-def type-id='23d6768c' size-in-bits='64' id='109cc752'/>
       <pointer-type-def type-id='8967eee8' size-in-bits='64' id='109cdb66'/>
+      <class-decl name='usb_cdc_parsed_header' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/usb/cdc.h' line='26' column='1' id='10a51b66'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='usb_cdc_union_desc' type-id='b7f056d4' visibility='default' filepath='include/linux/usb/cdc.h' line='27' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='usb_cdc_header_desc' type-id='015a0234' visibility='default' filepath='include/linux/usb/cdc.h' line='28' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='usb_cdc_call_mgmt_descriptor' type-id='93edac17' visibility='default' filepath='include/linux/usb/cdc.h' line='30' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='usb_cdc_acm_descriptor' type-id='6f7e8184' visibility='default' filepath='include/linux/usb/cdc.h' line='31' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='usb_cdc_country_functional_desc' type-id='1654068f' visibility='default' filepath='include/linux/usb/cdc.h' line='32' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='usb_cdc_network_terminal_desc' type-id='b6bc3316' visibility='default' filepath='include/linux/usb/cdc.h' line='33' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='usb_cdc_ether_desc' type-id='a9c8654f' visibility='default' filepath='include/linux/usb/cdc.h' line='34' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='usb_cdc_dmm_desc' type-id='0c1984e5' visibility='default' filepath='include/linux/usb/cdc.h' line='35' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='usb_cdc_mdlm_desc' type-id='94bfb8eb' visibility='default' filepath='include/linux/usb/cdc.h' line='36' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='576'>
+          <var-decl name='usb_cdc_mdlm_detail_desc' type-id='8b42c33d' visibility='default' filepath='include/linux/usb/cdc.h' line='37' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='usb_cdc_obex_desc' type-id='4875dd9d' visibility='default' filepath='include/linux/usb/cdc.h' line='38' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='704'>
+          <var-decl name='usb_cdc_ncm_desc' type-id='7041aa49' visibility='default' filepath='include/linux/usb/cdc.h' line='39' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='768'>
+          <var-decl name='usb_cdc_mbim_desc' type-id='31efb644' visibility='default' filepath='include/linux/usb/cdc.h' line='40' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='832'>
+          <var-decl name='usb_cdc_mbim_extended_desc' type-id='6253b388' visibility='default' filepath='include/linux/usb/cdc.h' line='41' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='896'>
+          <var-decl name='phonet_magic_present' type-id='b50a4934' visibility='default' filepath='include/linux/usb/cdc.h' line='43' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='__anonymous_struct__' size-in-bits='256' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/mm_types.h' line='142' column='1' id='10a5c92a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='_compound_pad_1' type-id='7359adad' visibility='default' filepath='include/linux/mm_types.h' line='143' column='1'/>
@@ -11546,6 +11940,23 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d36a5b23' size-in-bits='64' id='112f0343'/>
+      <class-decl name='devfreq_event_dev' size-in-bits='7808' is-struct='yes' visibility='default' filepath='include/linux/devfreq-event.h' line='26' column='1' id='112f2691'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='node' type-id='72f469ec' visibility='default' filepath='include/linux/devfreq-event.h' line='27' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='dev' type-id='66e487eb' visibility='default' filepath='include/linux/devfreq-event.h' line='29' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7296'>
+          <var-decl name='lock' type-id='925167dc' visibility='default' filepath='include/linux/devfreq-event.h' line='30' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7680'>
+          <var-decl name='enable_count' type-id='19c2251e' visibility='default' filepath='include/linux/devfreq-event.h' line='31' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7744'>
+          <var-decl name='desc' type-id='dcea1110' visibility='default' filepath='include/linux/devfreq-event.h' line='33' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='a249930e' size-in-bits='64' id='113423d8'/>
       <enum-decl name='i2c_alert_protocol' filepath='include/linux/i2c.h' line='215' column='1' id='113aadc2'>
         <underlying-type type-id='9cac1fee'/>
@@ -11848,7 +12259,7 @@
       <array-type-def dimensions='1' type-id='b65a052d' size-in-bits='infinite' id='11d66d65'>
         <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
       </array-type-def>
-      <typedef-decl name='flow_setup_cb_t' type-id='1322ddb6' filepath='include/net/flow_offload.h' line='450' column='1' id='11d6bd91'/>
+      <typedef-decl name='flow_setup_cb_t' type-id='1322ddb6' filepath='include/net/flow_offload.h' line='451' column='1' id='11d6bd91'/>
       <pointer-type-def type-id='55efd1a3' size-in-bits='64' id='11e02f83'/>
       <pointer-type-def type-id='3eb82749' size-in-bits='64' id='11e11a61'/>
       <pointer-type-def type-id='7e2e2485' size-in-bits='64' id='11e89fb9'/>
@@ -12041,6 +12452,44 @@
           <var-decl name='exit_avg_ms' type-id='6e15744f' visibility='default' filepath='drivers/gpu/drm/drm_self_refresh_helper.c' line='64' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='inet_bind_bucket' size-in-bits='576' is-struct='yes' visibility='default' filepath='include/net/inet_hashtables.h' line='76' column='1' id='1251126e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='ib_net' type-id='c9df1e6c' visibility='default' filepath='include/net/inet_hashtables.h' line='77' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='l3mdev' type-id='95e97e5e' visibility='default' filepath='include/net/inet_hashtables.h' line='78' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='port' type-id='8efea9e5' visibility='default' filepath='include/net/inet_hashtables.h' line='79' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='112'>
+          <var-decl name='fastreuse' type-id='28577a57' visibility='default' filepath='include/net/inet_hashtables.h' line='80' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='120'>
+          <var-decl name='fastreuseport' type-id='28577a57' visibility='default' filepath='include/net/inet_hashtables.h' line='81' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='fastuid' type-id='d80b72e6' visibility='default' filepath='include/net/inet_hashtables.h' line='82' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='160'>
+          <var-decl name='fast_v6_rcv_saddr' type-id='f6ed712a' visibility='default' filepath='include/net/inet_hashtables.h' line='84' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='288'>
+          <var-decl name='fast_rcv_saddr' type-id='78a133c2' visibility='default' filepath='include/net/inet_hashtables.h' line='86' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='fast_sk_family' type-id='8efea9e5' visibility='default' filepath='include/net/inet_hashtables.h' line='87' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='336'>
+          <var-decl name='fast_ipv6_only' type-id='b50a4934' visibility='default' filepath='include/net/inet_hashtables.h' line='88' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='node' type-id='03a4a074' visibility='default' filepath='include/net/inet_hashtables.h' line='89' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='owners' type-id='e151255a' visibility='default' filepath='include/net/inet_hashtables.h' line='90' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='v4l2_event_subscription' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2413' column='1' id='1251351e'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='type' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2414' column='1'/>
@@ -12070,6 +12519,11 @@
           <var-decl name='domain_data' type-id='53e3a7d6' visibility='default' filepath='include/linux/pm.h' line='546' column='1'/>
         </data-member>
       </class-decl>
+      <function-type size-in-bits='64' id='1274f0d2'>
+        <parameter type-id='95e97e5e'/>
+        <parameter type-id='eaa32e2f'/>
+        <return type-id='b50a4934'/>
+      </function-type>
       <typedef-decl name='drm_flip_func_t' type-id='5c8b296f' filepath='include/drm/drm_flip_work.h' line='52' column='1' id='12758247'/>
       <pointer-type-def type-id='88776799' size-in-bits='64' id='127a97dd'/>
       <function-type size-in-bits='64' id='127ce78a'>
@@ -12638,6 +13092,12 @@
           <var-decl name='slots' type-id='5b559658' visibility='default' filepath='include/linux/keyslot-manager.h' line='105' column='1'/>
         </data-member>
       </class-decl>
+      <function-type size-in-bits='64' id='14059615'>
+        <parameter type-id='f772df6d'/>
+        <parameter type-id='d2524501'/>
+        <parameter type-id='841969d0'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <pointer-type-def type-id='d61bf978' size-in-bits='64' id='14061e47'/>
       <pointer-type-def type-id='772a4ddf' size-in-bits='64' id='141b6427'/>
       <class-decl name='neigh_parms' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/net/neighbour.h' line='71' column='1' id='1429eee4'>
@@ -13634,6 +14094,7 @@
         <enumerator name='PSTORE_TYPE_MAX' value='9'/>
       </enum-decl>
       <pointer-type-def type-id='8ae2fb1d' size-in-bits='64' id='165146ad'/>
+      <pointer-type-def type-id='62e0e7f7' size-in-bits='64' id='1654068f'/>
       <pointer-type-def type-id='869f5d80' size-in-bits='64' id='1654d99a'/>
       <pointer-type-def type-id='4dd76d14' size-in-bits='64' id='16575f26'/>
       <class-decl name='rq_flags' size-in-bits='128' is-struct='yes' visibility='default' filepath='kernel/sched/sched.h' line='1230' column='1' id='16588ac8'>
@@ -13960,6 +14421,7 @@
         <parameter type-id='7f6ae768'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='10a51b66' size-in-bits='64' id='16f45b2c'/>
       <class-decl name='nvdimm_fw_ops' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/libnvdimm.h' line='241' column='1' id='16f83885'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='activate_state' type-id='87e32b50' visibility='default' filepath='include/linux/libnvdimm.h' line='242' column='1'/>
@@ -14434,6 +14896,7 @@
         <parameter type-id='e1a56841'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='cfa1a37d' size-in-bits='64' id='17b93571'/>
       <class-decl name='nfs_lock_info' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/nfs_fs_i.h' line='10' column='1' id='17bacae5'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='state' type-id='19c2251e' visibility='default' filepath='include/linux/nfs_fs_i.h' line='11' column='1'/>
@@ -14833,6 +15296,11 @@
         <parameter type-id='1a494567'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <function-type size-in-bits='64' id='1945ad2d'>
+        <parameter type-id='f772df6d'/>
+        <parameter type-id='11f4a000'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <function-type size-in-bits='64' id='194ac023'>
         <parameter type-id='abd62a96'/>
         <parameter type-id='2ae08426'/>
@@ -14968,6 +15436,29 @@
           <var-decl name='data2' type-id='91ce1af9' visibility='default' filepath='include/net/af_vsock.h' line='91' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='usb_cdc_network_terminal_desc' size-in-bits='56' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='123' column='1' id='19834fe0'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='124' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='125' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='126' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bEntityId' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='128' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='iName' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='129' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='40'>
+          <var-decl name='bChannelIndex' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='130' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='48'>
+          <var-decl name='bPhysicalInterface' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='131' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='array_buffer' size-in-bits='320' is-struct='yes' visibility='default' filepath='kernel/trace/trace.h' line='194' column='1' id='1984aef9'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='tr' type-id='898c1076' visibility='default' filepath='kernel/trace/trace.h' line='195' column='1'/>
@@ -16205,8 +16696,8 @@
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='1c800c47'>
-        <parameter type-id='12884b9a'/>
-        <parameter type-id='8bf48c31'/>
+        <parameter type-id='12884b9a' name='dev'/>
+        <parameter type-id='8bf48c31' name='intf'/>
         <return type-id='48b5725f'/>
       </function-type>
       <class-decl name='iw_statistics' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/uapi/linux/wireless.h' line='881' column='1' id='1c8cc2fd'>
@@ -16235,6 +16726,7 @@
         <parameter type-id='f9b06939'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <qualified-type-def type-id='3ea0d50a' const='yes' id='1ca42ff9'/>
       <pointer-type-def type-id='7addb8a1' size-in-bits='64' id='1cb2627d'/>
       <pointer-type-def type-id='b69cad70' size-in-bits='64' id='1cc860f2'/>
       <union-decl name='__anonymous_union__' size-in-bits='1600' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/videodev2.h' line='2319' column='1' id='1ccea1b5'>
@@ -16726,12 +17218,12 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/thermal.h' line='248' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='ethtool_link_ksettings' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='125' column='1' id='1e1b3494'>
+      <class-decl name='ethtool_link_ksettings' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='121' column='1' id='1e1b3494'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='base' type-id='7aeccae5' visibility='default' filepath='include/linux/ethtool.h' line='126' column='1'/>
+          <var-decl name='base' type-id='7aeccae5' visibility='default' filepath='include/linux/ethtool.h' line='122' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='link_modes' type-id='28334c43' visibility='default' filepath='include/linux/ethtool.h' line='131' column='1'/>
+          <var-decl name='link_modes' type-id='28334c43' visibility='default' filepath='include/linux/ethtool.h' line='127' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='input_mt_pos' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/linux/input/mt.h' line='119' column='1' id='1e25d1dc'>
@@ -16867,6 +17359,7 @@
           <var-decl name='handles' type-id='dec44472' visibility='default' filepath='include/drm/drm_prime.h' line='49' column='1'/>
         </data-member>
       </class-decl>
+      <qualified-type-def type-id='d334c4a2' const='yes' id='1ec1e54d'/>
       <pointer-type-def type-id='2922fb19' size-in-bits='64' id='1ed1e4cd'/>
       <pointer-type-def type-id='76959226' size-in-bits='64' id='1ed3660c'/>
       <class-decl name='iphdr' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/uapi/linux/ip.h' line='86' column='1' id='1edbefa6'>
@@ -18657,6 +19150,14 @@
           <var-decl name='poll_completion' type-id='b50a4934' visibility='default' filepath='drivers/firmware/arm_scmi/common.h' line='85' column='1'/>
         </data-member>
       </class-decl>
+      <union-decl name='__anonymous_union__' size-in-bits='16' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='245' column='1' id='23d43bd5'>
+        <data-member access='public'>
+          <var-decl name='bits' type-id='9ebd5abd' visibility='default' filepath='include/linux/ipv6.h' line='263' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='all' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='264' column='1'/>
+        </data-member>
+      </union-decl>
       <pointer-type-def type-id='fd48a6e6' size-in-bits='64' id='23d6768c'/>
       <qualified-type-def type-id='349c0cdf' const='yes' id='23de1228'/>
       <array-type-def dimensions='1' type-id='f9b06939' size-in-bits='248' id='23e37060'>
@@ -19066,6 +19567,137 @@
           <var-decl name='base' type-id='58ba85d8' visibility='default' filepath='include/crypto/internal/hash.h' line='55' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='cdc_ncm_ctx' size-in-bits='2816' is-struct='yes' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='96' column='1' id='24ada124'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='ncm_parm' type-id='d26727c9' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='97' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='tx_timer' type-id='b6993efc' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='98' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='832'>
+          <var-decl name='bh' type-id='7a7ea727' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='99' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1152'>
+          <var-decl name='func_desc' type-id='411e6982' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='101' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1216'>
+          <var-decl name='mbim_desc' type-id='87387369' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='102' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1280'>
+          <var-decl name='mbim_extended_desc' type-id='a29682fb' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='103' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1344'>
+          <var-decl name='ether_desc' type-id='ae990d1c' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='104' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1408'>
+          <var-decl name='control' type-id='8bf48c31' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='106' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1472'>
+          <var-decl name='data' type-id='8bf48c31' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='107' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1536'>
+          <var-decl name='tx_curr_skb' type-id='0fbf3cfd' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='109' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1600'>
+          <var-decl name='tx_rem_skb' type-id='0fbf3cfd' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='110' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1664'>
+          <var-decl name='tx_rem_sign' type-id='2f162548' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='111' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1696'>
+          <var-decl name='mtx' type-id='fb4018a0' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='113' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1728'>
+          <var-decl name='stop' type-id='49178f86' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='114' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1760'>
+          <var-decl name='drvflags' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='115' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1792'>
+          <var-decl name='timer_interval' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='117' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1824'>
+          <var-decl name='max_ndp_size' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='118' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1856'>
+          <var-decl name='is_ndp16' type-id='f9b06939' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='119' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1920'>
+          <var-decl name='' type-id='33c33336' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='120' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1984'>
+          <var-decl name='tx_timer_pending' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='125' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2016'>
+          <var-decl name='tx_curr_frame_num' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='126' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2048'>
+          <var-decl name='rx_max' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='127' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2080'>
+          <var-decl name='tx_max' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='128' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2112'>
+          <var-decl name='tx_curr_size' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='129' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2144'>
+          <var-decl name='tx_low_mem_max_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='130' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2176'>
+          <var-decl name='tx_low_mem_val' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='131' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2208'>
+          <var-decl name='max_datagram_size' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='132' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2240'>
+          <var-decl name='tx_max_datagrams' type-id='1dc6a898' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='133' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2256'>
+          <var-decl name='tx_remainder' type-id='1dc6a898' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='134' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2272'>
+          <var-decl name='tx_modulus' type-id='1dc6a898' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='135' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2288'>
+          <var-decl name='tx_ndp_modulus' type-id='1dc6a898' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='136' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2304'>
+          <var-decl name='tx_seq' type-id='1dc6a898' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='137' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2320'>
+          <var-decl name='rx_seq' type-id='1dc6a898' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='138' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2336'>
+          <var-decl name='min_tx_pkt' type-id='1dc6a898' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='139' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2368'>
+          <var-decl name='tx_curr_frame_payload' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='142' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2400'>
+          <var-decl name='tx_reason_ntb_full' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='143' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2432'>
+          <var-decl name='tx_reason_ndp_full' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='144' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2464'>
+          <var-decl name='tx_reason_timeout' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='145' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2496'>
+          <var-decl name='tx_reason_max_datagram' type-id='19c2251e' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='146' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2560'>
+          <var-decl name='tx_overhead' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='147' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2624'>
+          <var-decl name='tx_ntbs' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='148' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2688'>
+          <var-decl name='rx_overhead' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='149' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2752'>
+          <var-decl name='rx_ntbs' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='150' column='1'/>
+        </data-member>
+      </class-decl>
       <array-type-def dimensions='1' type-id='eaa32e2f' size-in-bits='128' id='24ae0315'>
         <subrange length='2' type-id='7ff19f0f' id='52efc4ef'/>
       </array-type-def>
@@ -20189,6 +20821,7 @@
           <var-decl name='max_xfer' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/ndctl.h' line='26' column='1'/>
         </data-member>
       </class-decl>
+      <qualified-type-def type-id='0e5b8ca7' const='yes' id='27365fde'/>
       <pointer-type-def type-id='ddd7cbfe' size-in-bits='64' id='273a7d34'/>
       <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/exportfs.h' line='120' column='1' id='273ef6eb'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -20230,6 +20863,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='d6ebca75' size-in-bits='64' id='27675065'/>
+      <pointer-type-def type-id='f3b4aca8' size-in-bits='64' id='276b90a6'/>
       <class-decl name='v4l2_ctrl_mpeg2_slice_params' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/media/mpeg2-ctrls.h' line='56' column='1' id='276d5663'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='bit_size' type-id='3f1a6b60' visibility='default' filepath='include/media/mpeg2-ctrls.h' line='57' column='1'/>
@@ -20478,6 +21112,7 @@
         <parameter type-id='00aa6a0e'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='94ac9155' size-in-bits='64' id='280461d5'/>
       <typedef-decl name='drm_ioctl_t' type-id='4e407315' filepath='include/drm/drm_ioctl.h' line='54' column='1' id='28063720'/>
       <function-type size-in-bits='64' id='280730d4'>
         <parameter type-id='77e79a4b'/>
@@ -20513,15 +21148,15 @@
         <parameter type-id='58dc55d6'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='__anonymous_struct__' size-in-bits='384' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/ethtool.h' line='127' column='1' id='28334c43'>
+      <class-decl name='__anonymous_struct__' size-in-bits='384' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/ethtool.h' line='123' column='1' id='28334c43'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='supported' type-id='f05e8e77' visibility='default' filepath='include/linux/ethtool.h' line='128' column='1'/>
+          <var-decl name='supported' type-id='f05e8e77' visibility='default' filepath='include/linux/ethtool.h' line='124' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='advertising' type-id='f05e8e77' visibility='default' filepath='include/linux/ethtool.h' line='129' column='1'/>
+          <var-decl name='advertising' type-id='f05e8e77' visibility='default' filepath='include/linux/ethtool.h' line='125' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='lp_advertising' type-id='f05e8e77' visibility='default' filepath='include/linux/ethtool.h' line='130' column='1'/>
+          <var-decl name='lp_advertising' type-id='f05e8e77' visibility='default' filepath='include/linux/ethtool.h' line='126' column='1'/>
         </data-member>
       </class-decl>
       <typedef-decl name='drm_magic_t' type-id='f0981eeb' filepath='include/uapi/drm/drm.h' line='86' column='1' id='283696d2'/>
@@ -21474,6 +22109,107 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <class-decl name='inet_connection_sock' size-in-bits='12096' is-struct='yes' visibility='default' filepath='include/net/inet_connection_sock.h' line='85' column='1' id='2a0babad'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='icsk_inet' type-id='cec16d30' visibility='default' filepath='include/net/inet_connection_sock.h' line='87' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8384'>
+          <var-decl name='icsk_accept_queue' type-id='a6c77117' visibility='default' filepath='include/net/inet_connection_sock.h' line='88' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='9024'>
+          <var-decl name='icsk_bind_hash' type-id='d535b874' visibility='default' filepath='include/net/inet_connection_sock.h' line='89' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='9088'>
+          <var-decl name='icsk_timeout' type-id='7359adad' visibility='default' filepath='include/net/inet_connection_sock.h' line='90' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='9152'>
+          <var-decl name='icsk_retransmit_timer' type-id='abe41e67' visibility='default' filepath='include/net/inet_connection_sock.h' line='91' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='9600'>
+          <var-decl name='icsk_delack_timer' type-id='abe41e67' visibility='default' filepath='include/net/inet_connection_sock.h' line='92' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10048'>
+          <var-decl name='icsk_rto' type-id='3f1a6b60' visibility='default' filepath='include/net/inet_connection_sock.h' line='93' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10080'>
+          <var-decl name='icsk_rto_min' type-id='3f1a6b60' visibility='default' filepath='include/net/inet_connection_sock.h' line='94' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10112'>
+          <var-decl name='icsk_delack_max' type-id='3f1a6b60' visibility='default' filepath='include/net/inet_connection_sock.h' line='95' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10144'>
+          <var-decl name='icsk_pmtu_cookie' type-id='3f1a6b60' visibility='default' filepath='include/net/inet_connection_sock.h' line='96' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10176'>
+          <var-decl name='icsk_ca_ops' type-id='b3ef56ee' visibility='default' filepath='include/net/inet_connection_sock.h' line='97' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10240'>
+          <var-decl name='icsk_af_ops' type-id='d23c2125' visibility='default' filepath='include/net/inet_connection_sock.h' line='98' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10304'>
+          <var-decl name='icsk_ulp_ops' type-id='c23fc09a' visibility='default' filepath='include/net/inet_connection_sock.h' line='99' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10368'>
+          <var-decl name='icsk_ulp_data' type-id='eaa32e2f' visibility='default' filepath='include/net/inet_connection_sock.h' line='100' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10432'>
+          <var-decl name='icsk_clean_acked' type-id='815f64bf' visibility='default' filepath='include/net/inet_connection_sock.h' line='101' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10496'>
+          <var-decl name='icsk_listen_portaddr_node' type-id='03a4a074' visibility='default' filepath='include/net/inet_connection_sock.h' line='102' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10624'>
+          <var-decl name='icsk_sync_mss' type-id='de90632b' visibility='default' filepath='include/net/inet_connection_sock.h' line='103' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='icsk_ca_state' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='104' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='icsk_ca_initialized' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='105' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='icsk_ca_setsockopt' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='106' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='icsk_ca_dst_locked' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='107' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10696'>
+          <var-decl name='icsk_retransmits' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='108' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10704'>
+          <var-decl name='icsk_pending' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='109' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10712'>
+          <var-decl name='icsk_backoff' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='110' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10720'>
+          <var-decl name='icsk_syn_retries' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='111' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10728'>
+          <var-decl name='icsk_probes_out' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='112' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10736'>
+          <var-decl name='icsk_ext_hdr_len' type-id='d315442e' visibility='default' filepath='include/net/inet_connection_sock.h' line='113' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10752'>
+          <var-decl name='icsk_ack' type-id='9ea617aa' visibility='default' filepath='include/net/inet_connection_sock.h' line='124' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10944'>
+          <var-decl name='icsk_mtup' type-id='5e0338e2' visibility='default' filepath='include/net/inet_connection_sock.h' line='136' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='11104'>
+          <var-decl name='icsk_probes_tstamp' type-id='19c2251e' visibility='default' filepath='include/net/inet_connection_sock.h' line='137' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='11136'>
+          <var-decl name='icsk_user_timeout' type-id='19c2251e' visibility='default' filepath='include/net/inet_connection_sock.h' line='138' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='11200'>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/inet_connection_sock.h' line='140' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='11264'>
+          <var-decl name='icsk_ca_priv' type-id='08a4cc8e' visibility='default' filepath='include/net/inet_connection_sock.h' line='142' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='system_counterval_t' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/timekeeping.h' line='274' column='1' id='2a0f1e3d'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='cycles' type-id='91ce1af9' visibility='default' filepath='include/linux/timekeeping.h' line='275' column='1'/>
@@ -22702,6 +23438,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='53ecac3a' size-in-bits='64' id='2d92dd30'/>
+      <pointer-type-def type-id='33d9b285' size-in-bits='64' id='2d974d69'/>
       <pointer-type-def type-id='b68346f7' size-in-bits='64' id='2da88de7'/>
       <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/linux/xarray.h' line='1129' column='1' id='2db4cfe9'>
         <data-member access='public'>
@@ -23512,6 +24249,26 @@
         <parameter type-id='3aaeef89'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <class-decl name='usb_cdc_mbim_extended_desc' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='211' column='1' id='3093472a'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='212' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='213' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='214' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bcdMBIMExtendedVersion' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='216' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='40'>
+          <var-decl name='bMaxOutstandingCommandMessages' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='217' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='48'>
+          <var-decl name='wMTU' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='218' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='309421a5'>
         <parameter type-id='a585cbc4'/>
         <return type-id='48b5725f'/>
@@ -23903,6 +24660,23 @@
       <pointer-type-def type-id='23a55350' size-in-bits='64' id='31ca1cfa'/>
       <pointer-type-def type-id='e0d0028a' size-in-bits='64' id='31cc9254'/>
       <pointer-type-def type-id='c69a48a7' size-in-bits='64' id='31e035f7'/>
+      <class-decl name='usb_cdc_mdlm_detail_desc' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='167' column='1' id='31e0f35d'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='168' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='169' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='170' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bGuidDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='173' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='bDetailData' type-id='167619f6' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='174' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='31e7d828'>
         <parameter type-id='02f11ed4'/>
         <parameter type-id='7359adad'/>
@@ -23910,6 +24684,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='284cd8d6' size-in-bits='64' id='31eb8cc0'/>
+      <pointer-type-def type-id='0570fd5e' size-in-bits='64' id='31efb644'/>
       <array-type-def dimensions='1' type-id='ad98c82f' size-in-bits='infinite' id='31f1649b'>
         <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
       </array-type-def>
@@ -24242,6 +25017,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='e931abd6' size-in-bits='64' id='32baba38'/>
+      <pointer-type-def type-id='cb08bae1' size-in-bits='64' id='32c73a29'/>
       <enum-decl name='desc_idn' filepath='drivers/scsi/ufs/ufs.h' line='163' column='1' id='32c9d5cb'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='QUERY_DESC_IDN_DEVICE' value='0'/>
@@ -24556,6 +25332,14 @@
           <var-decl name='extack' type-id='5799dc94' visibility='default' filepath='include/linux/netdevice.h' line='920' column='1'/>
         </data-member>
       </class-decl>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='120' column='1' id='33c33336'>
+        <data-member access='public'>
+          <var-decl name='delayed_ndp16' type-id='95e43059' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='121' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='delayed_ndp32' type-id='63c78f87' visibility='default' filepath='include/linux/usb/cdc_ncm.h' line='122' column='1'/>
+        </data-member>
+      </union-decl>
       <pointer-type-def type-id='91015ee2' size-in-bits='64' id='33c348f4'/>
       <function-type size-in-bits='64' id='33c534fd'>
         <parameter type-id='e324928d'/>
@@ -24615,7 +25399,14 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='bbf47576' size-in-bits='64' id='33d93b18'/>
+      <function-type size-in-bits='64' id='33d9b285'>
+        <parameter type-id='74b427eb'/>
+        <parameter type-id='eaa32e2f'/>
+        <parameter type-id='98b22793'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <pointer-type-def type-id='f8eaf96b' size-in-bits='64' id='33dc3b1b'/>
+      <qualified-type-def type-id='3093472a' const='yes' id='33dff9d3'/>
       <pointer-type-def type-id='c8d63c6e' size-in-bits='64' id='33e1dfe4'/>
       <pointer-type-def type-id='656561a5' size-in-bits='64' id='33e2a135'/>
       <enum-decl name='fsg_buffer_state' filepath='drivers/usb/gadget/function/storage_common.h' line='136' column='1' id='33e6bdc5'>
@@ -24886,6 +25677,15 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <function-type size-in-bits='64' id='34dda955'>
+        <parameter type-id='78e7cf52'/>
+        <parameter type-id='0fbf3cfd'/>
+        <parameter type-id='94c948ef'/>
+        <parameter type-id='141b6427'/>
+        <parameter type-id='94c948ef'/>
+        <parameter type-id='d8e6b335'/>
+        <return type-id='f772df6d'/>
+      </function-type>
       <function-type size-in-bits='64' id='34e265cf'>
         <parameter type-id='7837cd88'/>
         <parameter type-id='4a935625'/>
@@ -26138,100 +26938,100 @@
           <var-decl name='flags' type-id='7359adad' visibility='default' filepath='include/linux/usb/hcd.h' line='120' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3328'>
-          <var-decl name='dev_policy' type-id='7e6e640d' visibility='default' filepath='include/linux/usb/hcd.h' line='152' column='1'/>
+          <var-decl name='dev_policy' type-id='7e6e640d' visibility='default' filepath='include/linux/usb/hcd.h' line='154' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='rh_registered' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='155' column='1'/>
+          <var-decl name='rh_registered' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='157' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='rh_pollable' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='156' column='1'/>
+          <var-decl name='rh_pollable' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='158' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='msix_enabled' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='157' column='1'/>
+          <var-decl name='msix_enabled' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='159' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3'>
-          <var-decl name='msi_enabled' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='158' column='1'/>
+          <var-decl name='msi_enabled' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='160' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4'>
-          <var-decl name='skip_phy_initialization' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='164' column='1'/>
+          <var-decl name='skip_phy_initialization' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='166' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5'>
-          <var-decl name='uses_new_polling' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='168' column='1'/>
+          <var-decl name='uses_new_polling' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='170' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6'>
-          <var-decl name='wireless' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='169' column='1'/>
+          <var-decl name='wireless' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='171' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='7'>
-          <var-decl name='has_tt' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='170' column='1'/>
+          <var-decl name='has_tt' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='172' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='8'>
-          <var-decl name='amd_resume_bug' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='171' column='1'/>
+          <var-decl name='amd_resume_bug' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='173' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='9'>
-          <var-decl name='can_do_streams' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='172' column='1'/>
+          <var-decl name='can_do_streams' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='174' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='10'>
-          <var-decl name='tpl_support' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='173' column='1'/>
+          <var-decl name='tpl_support' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='175' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='11'>
-          <var-decl name='cant_recv_wakeups' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='174' column='1'/>
+          <var-decl name='cant_recv_wakeups' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='176' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3392'>
-          <var-decl name='irq' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='177' column='1'/>
+          <var-decl name='irq' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='179' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3456'>
-          <var-decl name='regs' type-id='eaa32e2f' visibility='default' filepath='include/linux/usb/hcd.h' line='178' column='1'/>
+          <var-decl name='regs' type-id='eaa32e2f' visibility='default' filepath='include/linux/usb/hcd.h' line='180' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3520'>
-          <var-decl name='rsrc_start' type-id='acc63fdf' visibility='default' filepath='include/linux/usb/hcd.h' line='179' column='1'/>
+          <var-decl name='rsrc_start' type-id='acc63fdf' visibility='default' filepath='include/linux/usb/hcd.h' line='181' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3584'>
-          <var-decl name='rsrc_len' type-id='acc63fdf' visibility='default' filepath='include/linux/usb/hcd.h' line='180' column='1'/>
+          <var-decl name='rsrc_len' type-id='acc63fdf' visibility='default' filepath='include/linux/usb/hcd.h' line='182' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3648'>
-          <var-decl name='power_budget' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='181' column='1'/>
+          <var-decl name='power_budget' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='183' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3712'>
-          <var-decl name='high_prio_bh' type-id='63972aea' visibility='default' filepath='include/linux/usb/hcd.h' line='183' column='1'/>
+          <var-decl name='high_prio_bh' type-id='63972aea' visibility='default' filepath='include/linux/usb/hcd.h' line='185' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4288'>
-          <var-decl name='low_prio_bh' type-id='63972aea' visibility='default' filepath='include/linux/usb/hcd.h' line='184' column='1'/>
+          <var-decl name='low_prio_bh' type-id='63972aea' visibility='default' filepath='include/linux/usb/hcd.h' line='186' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4864'>
-          <var-decl name='address0_mutex' type-id='e0ea832a' visibility='default' filepath='include/linux/usb/hcd.h' line='197' column='1'/>
+          <var-decl name='address0_mutex' type-id='e0ea832a' visibility='default' filepath='include/linux/usb/hcd.h' line='199' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4928'>
-          <var-decl name='bandwidth_mutex' type-id='e0ea832a' visibility='default' filepath='include/linux/usb/hcd.h' line='198' column='1'/>
+          <var-decl name='bandwidth_mutex' type-id='e0ea832a' visibility='default' filepath='include/linux/usb/hcd.h' line='200' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4992'>
-          <var-decl name='shared_hcd' type-id='fc4f83c1' visibility='default' filepath='include/linux/usb/hcd.h' line='199' column='1'/>
+          <var-decl name='shared_hcd' type-id='fc4f83c1' visibility='default' filepath='include/linux/usb/hcd.h' line='201' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5056'>
-          <var-decl name='primary_hcd' type-id='fc4f83c1' visibility='default' filepath='include/linux/usb/hcd.h' line='200' column='1'/>
+          <var-decl name='primary_hcd' type-id='fc4f83c1' visibility='default' filepath='include/linux/usb/hcd.h' line='202' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5120'>
-          <var-decl name='pool' type-id='9d8055ec' visibility='default' filepath='include/linux/usb/hcd.h' line='204' column='1'/>
+          <var-decl name='pool' type-id='9d8055ec' visibility='default' filepath='include/linux/usb/hcd.h' line='206' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5376'>
-          <var-decl name='state' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/hcd.h' line='206' column='1'/>
+          <var-decl name='state' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/hcd.h' line='208' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5440'>
-          <var-decl name='localmem_pool' type-id='75b9415a' visibility='default' filepath='include/linux/usb/hcd.h' line='221' column='1'/>
+          <var-decl name='localmem_pool' type-id='75b9415a' visibility='default' filepath='include/linux/usb/hcd.h' line='223' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5504'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='229' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='231' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5568'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='230' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='232' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5632'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='231' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='233' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5696'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='232' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='234' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5760'>
-          <var-decl name='hcd_priv' type-id='c99b5ecd' visibility='default' filepath='include/linux/usb/hcd.h' line='237' column='1'/>
+          <var-decl name='hcd_priv' type-id='c99b5ecd' visibility='default' filepath='include/linux/usb/hcd.h' line='239' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='aef83a98' size-in-bits='64' id='39341f7e'/>
@@ -26632,6 +27432,7 @@
       <pointer-type-def type-id='9f19269b' size-in-bits='64' id='3a0b4ecf'/>
       <pointer-type-def type-id='02138eb3' size-in-bits='64' id='3a0c781f'/>
       <pointer-type-def type-id='4e65adfa' size-in-bits='64' id='3a109e70'/>
+      <pointer-type-def type-id='05198978' size-in-bits='64' id='3a14a5ee'/>
       <class-decl name='snd_pcm_mmap_control' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/uapi/sound/asound.h' line='578' column='1' id='3a3e1b69'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='__pad1' type-id='87567824' visibility='default' filepath='include/uapi/sound/asound.h' line='579' column='1'/>
@@ -28136,6 +28937,7 @@
           <var-decl name='req_queue' type-id='5e611ec0' visibility='default' filepath='include/media/media-device.h' line='71' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='8f725b86' size-in-bits='64' id='3d802c7c'/>
       <function-type size-in-bits='64' id='3d84df46'>
         <parameter type-id='b64ad7cb'/>
         <parameter type-id='745b39e8'/>
@@ -28233,6 +29035,17 @@
           <var-decl name='gre' type-id='29e36f6d' visibility='default' filepath='include/net/netfilter/nf_conntrack_tuple.h' line='64' column='1'/>
         </data-member>
       </union-decl>
+      <class-decl name='ip6_sf_socklist' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='78' column='1' id='3df0f7af'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='sl_max' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='79' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='sl_count' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='80' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='sl_addr' type-id='0fdf6c82' visibility='default' filepath='include/net/if_inet6.h' line='81' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='17f9ad66' size-in-bits='64' id='3df34728'/>
       <pointer-type-def type-id='91ce1af9' size-in-bits='64' id='3df9fd28'/>
       <class-decl name='drm_property_blob' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/drm/drm_property.h' line='209' column='1' id='3dfb1294'>
@@ -28404,6 +29217,23 @@
       </enum-decl>
       <pointer-type-def type-id='3bdb8693' size-in-bits='64' id='3e9b5e67'/>
       <pointer-type-def type-id='2cfafd1c' size-in-bits='64' id='3e9fac96'/>
+      <class-decl name='devfreq_event_ops' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/devfreq-event.h' line='65' column='1' id='3ea0d50a'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='enable' type-id='17b93571' visibility='default' filepath='include/linux/devfreq-event.h' line='67' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='disable' type-id='17b93571' visibility='default' filepath='include/linux/devfreq-event.h' line='68' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='reset' type-id='17b93571' visibility='default' filepath='include/linux/devfreq-event.h' line='69' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='set_event' type-id='17b93571' visibility='default' filepath='include/linux/devfreq-event.h' line='72' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='get_event' type-id='ae6a6d9a' visibility='default' filepath='include/linux/devfreq-event.h' line='73' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='dev_pm_ops' size-in-bits='1536' is-struct='yes' visibility='default' filepath='include/linux/pm.h' line='279' column='1' id='3ea82289'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='prepare' type-id='613d39f5' visibility='default' filepath='include/linux/pm.h' line='280' column='1'/>
@@ -28588,6 +29418,14 @@
           <var-decl name='__i_nlink' type-id='f0981eeb' visibility='default' filepath='include/linux/fs.h' line='653' column='1'/>
         </data-member>
       </union-decl>
+      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/skbuff.h' line='468' column='1' id='3ee84947'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='desc' type-id='7359adad' visibility='default' filepath='include/linux/skbuff.h' line='469' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='ctx' type-id='eaa32e2f' visibility='default' filepath='include/linux/skbuff.h' line='470' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='47308153' size-in-bits='64' id='3eef3bc7'/>
       <pointer-type-def type-id='1227fbe9' size-in-bits='64' id='3ef2bf11'/>
       <class-decl name='nh_info' size-in-bits='1088' is-struct='yes' visibility='default' filepath='include/net/nexthop.h' line='51' column='1' id='3f017308'>
@@ -29247,6 +30085,11 @@
         <parameter type-id='1d36520e'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <function-type size-in-bits='64' id='4041f6de'>
+        <parameter type-id='78e7cf52'/>
+        <parameter type-id='0fbf3cfd'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <pointer-type-def type-id='82084f52' size-in-bits='64' id='404b1300'/>
       <pointer-type-def type-id='9a08a831' size-in-bits='64' id='404d559d'/>
       <function-type size-in-bits='64' id='404f4f30'>
@@ -29275,6 +30118,7 @@
         </data-member>
       </union-decl>
       <pointer-type-def type-id='2f04a816' size-in-bits='64' id='4054d674'/>
+      <pointer-type-def type-id='0eae882e' size-in-bits='64' id='40629354'/>
       <pointer-type-def type-id='b4db8337' size-in-bits='64' id='40672f7b'/>
       <qualified-type-def type-id='164a08b2' const='yes' id='406e1a09'/>
       <pointer-type-def type-id='3a3f2b05' size-in-bits='64' id='40735a95'/>
@@ -29671,6 +30515,7 @@
         <parameter type-id='bd0b5822'/>
         <return type-id='79a0948f'/>
       </function-type>
+      <pointer-type-def type-id='b6a8699c' size-in-bits='64' id='411e6982'/>
       <class-decl name='ahash_request' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/crypto/hash.h' line='49' column='1' id='41207a16'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='base' type-id='5e6083f1' visibility='default' filepath='include/crypto/hash.h' line='50' column='1'/>
@@ -30135,6 +30980,23 @@
           <var-decl name='peak' type-id='19c2251e' visibility='default' filepath='include/linux/pm_opp.h' line='54' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='usb_cdc_call_mgmt_descriptor' size-in-bits='40' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='72' column='1' id='42b001af'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='73' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='74' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='75' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bmCapabilities' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='77' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='bDataInterface' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='81' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='217933b7' size-in-bits='64' id='42b02383'/>
       <class-decl name='inet_listen_hashbucket' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/net/inet_hashtables.h' line='112' column='1' id='42b16dba'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -30215,6 +31077,7 @@
       <array-type-def dimensions='1' type-id='84a5c3d4' size-in-bits='240' id='42c95bcb'>
         <subrange length='15' type-id='7ff19f0f' id='8484ba73'/>
       </array-type-def>
+      <class-decl name='ip_mc_socklist' is-struct='yes' visibility='default' is-declaration-only='yes' id='42cd489a'/>
       <pointer-type-def type-id='8e71aea3' size-in-bits='64' id='42dad747'/>
       <pointer-type-def type-id='a198c269' size-in-bits='64' id='42e84365'/>
       <function-type size-in-bits='64' id='42fd5899'>
@@ -32064,6 +32927,7 @@
           <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/genetlink.h' line='17' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='8ebff3ed' size-in-bits='64' id='4875dd9d'/>
       <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/mm_types.h' line='99' column='1' id='4877c7ec'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='dma_addr' type-id='f05e8e77' visibility='default' filepath='include/linux/mm_types.h' line='104' column='1'/>
@@ -32920,7 +33784,7 @@
       <qualified-type-def type-id='d2bd1e05' const='yes' id='4b1c1612'/>
       <typedef-decl name='pte_t' type-id='d7f0cb3c' filepath='arch/arm64/include/asm/pgtable-types.h' line='23' column='1' id='4b2795fc'/>
       <function-type size-in-bits='64' id='4b2a0d9d'>
-        <parameter type-id='8bf48c31'/>
+        <parameter type-id='8bf48c31' name='intf'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='a51c0f4a' size-in-bits='64' id='4b2c3420'/>
@@ -35677,153 +36541,153 @@
           <var-decl name='init' type-id='48cf6abe' visibility='default' filepath='include/sound/soc.h' line='981' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='hc_driver' size-in-bits='3136' is-struct='yes' visibility='default' filepath='include/linux/usb/hcd.h' line='255' column='1' id='519497e3'>
+      <class-decl name='hc_driver' size-in-bits='3136' is-struct='yes' visibility='default' filepath='include/linux/usb/hcd.h' line='257' column='1' id='519497e3'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='description' type-id='80f4b756' visibility='default' filepath='include/linux/usb/hcd.h' line='256' column='1'/>
+          <var-decl name='description' type-id='80f4b756' visibility='default' filepath='include/linux/usb/hcd.h' line='258' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='product_desc' type-id='80f4b756' visibility='default' filepath='include/linux/usb/hcd.h' line='257' column='1'/>
+          <var-decl name='product_desc' type-id='80f4b756' visibility='default' filepath='include/linux/usb/hcd.h' line='259' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='hcd_priv_size' type-id='b59d7dce' visibility='default' filepath='include/linux/usb/hcd.h' line='258' column='1'/>
+          <var-decl name='hcd_priv_size' type-id='b59d7dce' visibility='default' filepath='include/linux/usb/hcd.h' line='260' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='irq' type-id='a4e9cbb0' visibility='default' filepath='include/linux/usb/hcd.h' line='261' column='1'/>
+          <var-decl name='irq' type-id='a4e9cbb0' visibility='default' filepath='include/linux/usb/hcd.h' line='263' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='flags' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/hcd.h' line='263' column='1'/>
+          <var-decl name='flags' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/hcd.h' line='265' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='reset' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='277' column='1'/>
+          <var-decl name='reset' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='279' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='start' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='278' column='1'/>
+          <var-decl name='start' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='280' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='pci_suspend' type-id='f49825dc' visibility='default' filepath='include/linux/usb/hcd.h' line='284' column='1'/>
+          <var-decl name='pci_suspend' type-id='f49825dc' visibility='default' filepath='include/linux/usb/hcd.h' line='286' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='pci_resume' type-id='f49825dc' visibility='default' filepath='include/linux/usb/hcd.h' line='287' column='1'/>
+          <var-decl name='pci_resume' type-id='f49825dc' visibility='default' filepath='include/linux/usb/hcd.h' line='289' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='stop' type-id='2638ad78' visibility='default' filepath='include/linux/usb/hcd.h' line='290' column='1'/>
+          <var-decl name='stop' type-id='2638ad78' visibility='default' filepath='include/linux/usb/hcd.h' line='292' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='shutdown' type-id='2638ad78' visibility='default' filepath='include/linux/usb/hcd.h' line='293' column='1'/>
+          <var-decl name='shutdown' type-id='2638ad78' visibility='default' filepath='include/linux/usb/hcd.h' line='295' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='get_frame_number' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='296' column='1'/>
+          <var-decl name='get_frame_number' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='298' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='urb_enqueue' type-id='26f734e7' visibility='default' filepath='include/linux/usb/hcd.h' line='299' column='1'/>
+          <var-decl name='urb_enqueue' type-id='26f734e7' visibility='default' filepath='include/linux/usb/hcd.h' line='301' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='urb_dequeue' type-id='909b5775' visibility='default' filepath='include/linux/usb/hcd.h' line='301' column='1'/>
+          <var-decl name='urb_dequeue' type-id='909b5775' visibility='default' filepath='include/linux/usb/hcd.h' line='303' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='map_urb_for_dma' type-id='26f734e7' visibility='default' filepath='include/linux/usb/hcd.h' line='313' column='1'/>
+          <var-decl name='map_urb_for_dma' type-id='26f734e7' visibility='default' filepath='include/linux/usb/hcd.h' line='315' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='unmap_urb_for_dma' type-id='da12244f' visibility='default' filepath='include/linux/usb/hcd.h' line='315' column='1'/>
+          <var-decl name='unmap_urb_for_dma' type-id='da12244f' visibility='default' filepath='include/linux/usb/hcd.h' line='317' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='endpoint_disable' type-id='e1007da7' visibility='default' filepath='include/linux/usb/hcd.h' line='318' column='1'/>
+          <var-decl name='endpoint_disable' type-id='e1007da7' visibility='default' filepath='include/linux/usb/hcd.h' line='320' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='endpoint_reset' type-id='e1007da7' visibility='default' filepath='include/linux/usb/hcd.h' line='323' column='1'/>
+          <var-decl name='endpoint_reset' type-id='e1007da7' visibility='default' filepath='include/linux/usb/hcd.h' line='325' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='hub_status_data' type-id='34083223' visibility='default' filepath='include/linux/usb/hcd.h' line='327' column='1'/>
+          <var-decl name='hub_status_data' type-id='34083223' visibility='default' filepath='include/linux/usb/hcd.h' line='329' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='hub_control' type-id='82a5e0a9' visibility='default' filepath='include/linux/usb/hcd.h' line='328' column='1'/>
+          <var-decl name='hub_control' type-id='82a5e0a9' visibility='default' filepath='include/linux/usb/hcd.h' line='330' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='bus_suspend' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='331' column='1'/>
+          <var-decl name='bus_suspend' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='333' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='bus_resume' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='332' column='1'/>
+          <var-decl name='bus_resume' type-id='3d4f6569' visibility='default' filepath='include/linux/usb/hcd.h' line='334' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='start_port_reset' type-id='52f4f223' visibility='default' filepath='include/linux/usb/hcd.h' line='333' column='1'/>
+          <var-decl name='start_port_reset' type-id='52f4f223' visibility='default' filepath='include/linux/usb/hcd.h' line='335' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='get_resuming_ports' type-id='3e34b3ae' visibility='default' filepath='include/linux/usb/hcd.h' line='334' column='1'/>
+          <var-decl name='get_resuming_ports' type-id='3e34b3ae' visibility='default' filepath='include/linux/usb/hcd.h' line='336' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='relinquish_port' type-id='0d7f0367' visibility='default' filepath='include/linux/usb/hcd.h' line='337' column='1'/>
+          <var-decl name='relinquish_port' type-id='0d7f0367' visibility='default' filepath='include/linux/usb/hcd.h' line='339' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='port_handed_over' type-id='ef2f6230' visibility='default' filepath='include/linux/usb/hcd.h' line='339' column='1'/>
+          <var-decl name='port_handed_over' type-id='ef2f6230' visibility='default' filepath='include/linux/usb/hcd.h' line='341' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='clear_tt_buffer_complete' type-id='e1007da7' visibility='default' filepath='include/linux/usb/hcd.h' line='342' column='1'/>
+          <var-decl name='clear_tt_buffer_complete' type-id='e1007da7' visibility='default' filepath='include/linux/usb/hcd.h' line='344' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='alloc_dev' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='347' column='1'/>
+          <var-decl name='alloc_dev' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='349' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='free_dev' type-id='b48dadb7' visibility='default' filepath='include/linux/usb/hcd.h' line='349' column='1'/>
+          <var-decl name='free_dev' type-id='b48dadb7' visibility='default' filepath='include/linux/usb/hcd.h' line='351' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='alloc_streams' type-id='c1729c2a' visibility='default' filepath='include/linux/usb/hcd.h' line='351' column='1'/>
+          <var-decl name='alloc_streams' type-id='c1729c2a' visibility='default' filepath='include/linux/usb/hcd.h' line='353' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='free_streams' type-id='473afbc8' visibility='default' filepath='include/linux/usb/hcd.h' line='357' column='1'/>
+          <var-decl name='free_streams' type-id='473afbc8' visibility='default' filepath='include/linux/usb/hcd.h' line='359' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='add_endpoint' type-id='2c3372f7' visibility='default' filepath='include/linux/usb/hcd.h' line='372' column='1'/>
+          <var-decl name='add_endpoint' type-id='2c3372f7' visibility='default' filepath='include/linux/usb/hcd.h' line='374' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='drop_endpoint' type-id='2c3372f7' visibility='default' filepath='include/linux/usb/hcd.h' line='375' column='1'/>
+          <var-decl name='drop_endpoint' type-id='2c3372f7' visibility='default' filepath='include/linux/usb/hcd.h' line='377' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='check_bandwidth' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='382' column='1'/>
+          <var-decl name='check_bandwidth' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='384' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='reset_bandwidth' type-id='b48dadb7' visibility='default' filepath='include/linux/usb/hcd.h' line='390' column='1'/>
+          <var-decl name='reset_bandwidth' type-id='b48dadb7' visibility='default' filepath='include/linux/usb/hcd.h' line='392' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='address_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='392' column='1'/>
+          <var-decl name='address_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='394' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2304'>
-          <var-decl name='enable_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='394' column='1'/>
+          <var-decl name='enable_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='396' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2368'>
-          <var-decl name='update_hub_device' type-id='cf0b24c2' visibility='default' filepath='include/linux/usb/hcd.h' line='398' column='1'/>
+          <var-decl name='update_hub_device' type-id='cf0b24c2' visibility='default' filepath='include/linux/usb/hcd.h' line='400' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2432'>
-          <var-decl name='reset_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='400' column='1'/>
+          <var-decl name='reset_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='402' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='update_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='404' column='1'/>
+          <var-decl name='update_device' type-id='530cb308' visibility='default' filepath='include/linux/usb/hcd.h' line='406' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2560'>
-          <var-decl name='set_usb2_hw_lpm' type-id='8ceda7f7' visibility='default' filepath='include/linux/usb/hcd.h' line='405' column='1'/>
+          <var-decl name='set_usb2_hw_lpm' type-id='8ceda7f7' visibility='default' filepath='include/linux/usb/hcd.h' line='407' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2624'>
-          <var-decl name='enable_usb3_lpm_timeout' type-id='280dcd9f' visibility='default' filepath='include/linux/usb/hcd.h' line='408' column='1'/>
+          <var-decl name='enable_usb3_lpm_timeout' type-id='280dcd9f' visibility='default' filepath='include/linux/usb/hcd.h' line='410' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2688'>
-          <var-decl name='disable_usb3_lpm_timeout' type-id='280dcd9f' visibility='default' filepath='include/linux/usb/hcd.h' line='413' column='1'/>
+          <var-decl name='disable_usb3_lpm_timeout' type-id='280dcd9f' visibility='default' filepath='include/linux/usb/hcd.h' line='415' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2752'>
-          <var-decl name='find_raw_port_number' type-id='ef2f6230' visibility='default' filepath='include/linux/usb/hcd.h' line='415' column='1'/>
+          <var-decl name='find_raw_port_number' type-id='ef2f6230' visibility='default' filepath='include/linux/usb/hcd.h' line='417' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='port_power' type-id='57938551' visibility='default' filepath='include/linux/usb/hcd.h' line='417' column='1'/>
+          <var-decl name='port_power' type-id='57938551' visibility='default' filepath='include/linux/usb/hcd.h' line='419' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2880'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='419' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='421' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2944'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='420' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='422' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3008'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='421' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='423' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3072'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='422' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='424' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='ff60ef66' size-in-bits='64' id='5198b4a4'/>
@@ -36224,6 +37088,7 @@
       <pointer-type-def type-id='5ef8814f' size-in-bits='64' id='52704eb7'/>
       <pointer-type-def type-id='616601a4' size-in-bits='64' id='52850a16'/>
       <pointer-type-def type-id='f28519a1' size-in-bits='64' id='528735d1'/>
+      <pointer-type-def type-id='ba5db8ea' size-in-bits='64' id='52980ce4'/>
       <class-decl name='uic_command' size-in-bits='448' is-struct='yes' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='94' column='1' id='52999e5a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='command' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='95' column='1'/>
@@ -37274,6 +38139,14 @@
         <enumerator name='VB2_BUF_STATE_DONE' value='5'/>
         <enumerator name='VB2_BUF_STATE_ERROR' value='6'/>
       </enum-decl>
+      <class-decl name='ipv6_opt_hdr' size-in-bits='16' is-struct='yes' visibility='default' filepath='include/uapi/linux/ipv6.h' line='62' column='1' id='5510bbdb'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='nexthdr' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/ipv6.h' line='63' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='hdrlen' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/ipv6.h' line='64' column='1'/>
+        </data-member>
+      </class-decl>
       <enum-decl name='typec_cc_polarity' filepath='include/linux/usb/tcpm.h' line='26' column='1' id='551eebc9'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='TYPEC_POLARITY_CC1' value='0'/>
@@ -37781,6 +38654,44 @@
           <var-decl name='counter' type-id='91ce1af9' visibility='default' filepath='include/linux/iova.h' line='57' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='ip6_flowlabel' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/net/ipv6.h' line='312' column='1' id='55fcdb4f'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='next' type-id='e90fa847' visibility='default' filepath='include/net/ipv6.h' line='313' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='label' type-id='78a133c2' visibility='default' filepath='include/net/ipv6.h' line='314' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='users' type-id='49178f86' visibility='default' filepath='include/net/ipv6.h' line='315' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='dst' type-id='f6ed712a' visibility='default' filepath='include/net/ipv6.h' line='316' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='opt' type-id='d4145729' visibility='default' filepath='include/net/ipv6.h' line='317' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='linger' type-id='7359adad' visibility='default' filepath='include/net/ipv6.h' line='318' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/ipv6.h' line='319' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='share' type-id='f9b06939' visibility='default' filepath='include/net/ipv6.h' line='320' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='576'>
+          <var-decl name='owner' type-id='f3980da2' visibility='default' filepath='include/net/ipv6.h' line='324' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='lastuse' type-id='7359adad' visibility='default' filepath='include/net/ipv6.h' line='325' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='704'>
+          <var-decl name='expires' type-id='7359adad' visibility='default' filepath='include/net/ipv6.h' line='326' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='768'>
+          <var-decl name='fl_net' type-id='a2bff676' visibility='default' filepath='include/net/ipv6.h' line='327' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='6e051ed1' size-in-bits='64' id='56033689'/>
       <pointer-type-def type-id='b201a5c2' size-in-bits='64' id='5606e640'/>
       <array-type-def dimensions='1' type-id='555c6201' size-in-bits='11648' id='561040ad'>
@@ -38159,6 +39070,7 @@
           <var-decl name='node_list' type-id='72f469ec' visibility='default' filepath='include/linux/plist.h' line='80' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='fa35cea9' size-in-bits='64' id='57b94931'/>
       <class-decl name='usb_pd_identity' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/usb/typec.h' line='102' column='1' id='57bfbe05'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='id_header' type-id='19c2251e' visibility='default' filepath='include/linux/usb/typec.h' line='103' column='1'/>
@@ -38210,6 +39122,7 @@
           <var-decl name='local_node' type-id='0afa6ea3' visibility='default' filepath='include/linux/of_graph.h' line='26' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='14059615' size-in-bits='64' id='58220cf1'/>
       <function-type size-in-bits='64' id='5824bc76'>
         <parameter type-id='02f11ed4'/>
         <parameter type-id='7359adad'/>
@@ -38459,6 +39372,7 @@
         <parameter type-id='3eb7c31c' name='mem_flags'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='54718f09' size-in-bits='64' id='58c93391'/>
       <pointer-type-def type-id='514d8c48' size-in-bits='64' id='58cfaa0e'/>
       <pointer-type-def type-id='e1ee975e' size-in-bits='64' id='58d10a98'/>
       <typedef-decl name='snd_pcm_hw_rule_func_t' type-id='657a5cf1' filepath='include/sound/pcm.h' line='226' column='1' id='58d3b2a5'/>
@@ -40154,6 +41068,7 @@
         <parameter type-id='f0981eeb'/>
         <return type-id='4bdecfd7'/>
       </function-type>
+      <pointer-type-def type-id='1274f0d2' size-in-bits='64' id='5c080b64'/>
       <pointer-type-def type-id='5221b18a' size-in-bits='64' id='5c0abad8'/>
       <class-decl name='__kernel_timespec' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/uapi/linux/time_types.h' line='7' column='1' id='5c155a71'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -40299,7 +41214,26 @@
           <var-decl name='reg_rules' type-id='9195bab1' visibility='default' filepath='include/net/regulatory.h' line='231' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='input_dev_poller' is-struct='yes' visibility='default' is-declaration-only='yes' id='5c32afaa'/>
+      <class-decl name='input_dev_poller' size-in-bits='1344' is-struct='yes' visibility='default' filepath='drivers/input/input-poller.c' line='15' column='1' id='5c32afaa'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='poll' type-id='b44880ea' visibility='default' filepath='drivers/input/input-poller.c' line='16' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='poll_interval' type-id='f0981eeb' visibility='default' filepath='drivers/input/input-poller.c' line='18' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='poll_interval_max' type-id='f0981eeb' visibility='default' filepath='drivers/input/input-poller.c' line='19' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='poll_interval_min' type-id='f0981eeb' visibility='default' filepath='drivers/input/input-poller.c' line='20' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='input' type-id='74b427eb' visibility='default' filepath='drivers/input/input-poller.c' line='22' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='work' type-id='5ad6e0ef' visibility='default' filepath='drivers/input/input-poller.c' line='23' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='5c3855b6'>
         <parameter type-id='ca9354d1'/>
         <parameter type-id='b50a4934'/>
@@ -40887,7 +41821,23 @@
         <enumerator name='UTASK_SSTEP_TRAPPED' value='3'/>
       </enum-decl>
       <typedef-decl name='upf_t' type-id='f0981eeb' filepath='include/linux/serial_core.h' line='107' column='1' id='5d1b117e'/>
-      <class-decl name='platform_msi_priv_data' is-struct='yes' visibility='default' is-declaration-only='yes' id='5d1d7263'/>
+      <class-decl name='platform_msi_priv_data' size-in-bits='512' is-struct='yes' visibility='default' filepath='drivers/base/platform-msi.c' line='23' column='1' id='5d1d7263'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='dev' type-id='fa0b179b' visibility='default' filepath='drivers/base/platform-msi.c' line='24' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='host_data' type-id='eaa32e2f' visibility='default' filepath='drivers/base/platform-msi.c' line='25' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='arg' type-id='e36320e9' visibility='default' filepath='drivers/base/platform-msi.c' line='26' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='write_msg' type-id='c335ba2b' visibility='default' filepath='drivers/base/platform-msi.c' line='27' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='devid' type-id='95e97e5e' visibility='default' filepath='drivers/base/platform-msi.c' line='28' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='eca93177' size-in-bits='64' id='5d33005f'/>
       <array-type-def dimensions='1' type-id='bd54fe1a' size-in-bits='192' id='5d34b9c7'>
         <subrange length='3' type-id='7ff19f0f' id='56f209d2'/>
@@ -41038,10 +41988,44 @@
           <var-decl name='cred' type-id='bc33861a' visibility='default' filepath='include/linux/nsproxy.h' line='57' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='__anonymous_struct__' size-in-bits='160' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/inet_connection_sock.h' line='125' column='1' id='5e0338e2'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='enabled' type-id='95e97e5e' visibility='default' filepath='include/net/inet_connection_sock.h' line='126' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='search_high' type-id='95e97e5e' visibility='default' filepath='include/net/inet_connection_sock.h' line='129' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='search_low' type-id='95e97e5e' visibility='default' filepath='include/net/inet_connection_sock.h' line='130' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='probe_size' type-id='95e97e5e' visibility='default' filepath='include/net/inet_connection_sock.h' line='133' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='probe_timestamp' type-id='19c2251e' visibility='default' filepath='include/net/inet_connection_sock.h' line='135' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='5e0713ae'>
         <parameter type-id='12884b9a'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <class-decl name='usb_cdc_dmm_desc' size-in-bits='56' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='148' column='1' id='5e084b85'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bFunctionLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='149' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='150' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubtype' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='151' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bcdVersion' type-id='d315442e' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='152' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='40'>
+          <var-decl name='wMaxCommand' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='153' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='crypto_cipher' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/crypto/internal/cipher.h' line='16' column='1' id='5e09ca8a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='base' type-id='0328c8b6' visibility='default' filepath='include/crypto/internal/cipher.h' line='17' column='1'/>
@@ -42944,6 +43928,26 @@
           <var-decl name='priv' type-id='eaa32e2f' visibility='default' filepath='include/linux/firmware.h' line='17' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='usb_cdc_ncm_ndp32' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='392' column='1' id='6208060f'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='dwSignature' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='393' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='wLength' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='394' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='48'>
+          <var-decl name='wReserved6' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='395' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='dwNextNdpIndex' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='396' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='dwReserved12' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='397' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='dpe32' type-id='e06f4fa6' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='398' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='a35f0003' size-in-bits='64' id='6219347f'/>
       <pointer-type-def type-id='47de6b15' size-in-bits='64' id='6222d42d'/>
       <typedef-decl name='Elf64_Sxword' type-id='49659421' filepath='include/uapi/linux/elf.h' line='23' column='1' id='622e0f13'/>
@@ -42967,6 +43971,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='c3d2316f' size-in-bits='64' id='624a8813'/>
+      <pointer-type-def type-id='3093472a' size-in-bits='64' id='6253b388'/>
       <array-type-def dimensions='1' type-id='8f92235e' size-in-bits='512' id='625d6c02'>
         <subrange length='16' type-id='7ff19f0f' id='848d0938'/>
       </array-type-def>
@@ -43255,6 +44260,23 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='02793b54' size-in-bits='64' id='62d8a75a'/>
+      <class-decl name='usb_cdc_country_functional_desc' size-in-bits='48' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='112' column='1' id='62e0e7f7'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='113' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='114' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='115' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='iCountryCodeRelDate' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='117' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='wCountyCode0' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='118' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='46155a72' size-in-bits='64' id='62e9cc9c'/>
       <class-decl name='typec_altmode_ops' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/linux/usb/typec_altmode.h' line='58' column='1' id='62ec705a'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -43681,8 +44703,10 @@
         <parameter type-id='ee406209'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='6208060f' size-in-bits='64' id='63c78f87'/>
       <pointer-type-def type-id='3ce3a3e9' size-in-bits='64' id='63c7e8e1'/>
       <pointer-type-def type-id='52704eb7' size-in-bits='64' id='63cbc127'/>
+      <pointer-type-def type-id='de68658d' size-in-bits='64' id='63cfef1d'/>
       <class-decl name='nf_hook_ops' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/linux/netfilter.h' line='81' column='1' id='63d6992a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='hook' type-id='c8f8b049' visibility='default' filepath='include/linux/netfilter.h' line='83' column='1'/>
@@ -43836,6 +44860,14 @@
       </function-type>
       <typedef-decl name='refcount_t' type-id='637cfeaf' filepath='include/linux/refcount.h' line='113' column='1' id='64615833'/>
       <typedef-decl name='rpmsg_rx_sig_t' type-id='3362870f' filepath='include/linux/rpmsg.h' line='64' column='1' id='646ceeb7'/>
+      <class-decl name='devfreq_event_data' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/devfreq-event.h' line='47' column='1' id='64705f1a'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='load_count' type-id='7359adad' visibility='default' filepath='include/linux/devfreq-event.h' line='48' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='total_count' type-id='7359adad' visibility='default' filepath='include/linux/devfreq-event.h' line='49' column='1'/>
+        </data-member>
+      </class-decl>
       <typedef-decl name='dma_cookie_t' type-id='a7832498' filepath='include/linux/dmaengine.h' line='23' column='1' id='6478ea0a'/>
       <function-type size-in-bits='64' id='647d371e'>
         <parameter type-id='42988600'/>
@@ -43876,6 +44908,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='006d72ff' size-in-bits='64' id='6495fd5b'/>
+      <pointer-type-def type-id='8a4245ed' size-in-bits='64' id='6499ab7d'/>
       <array-type-def dimensions='1' type-id='91ce1af9' size-in-bits='64' id='64a61909'>
         <subrange length='1' type-id='7ff19f0f' id='52f813b4'/>
       </array-type-def>
@@ -44085,24 +45118,24 @@
       </class-decl>
       <pointer-type-def type-id='b9acff95' size-in-bits='64' id='659a1059'/>
       <pointer-type-def type-id='f8a88be2' size-in-bits='64' id='65a8a3df'/>
-      <union-decl name='__anonymous_union__' size-in-bits='32' is-anonymous='yes' visibility='default' filepath='include/linux/ethtool.h' line='96' column='1' id='65b20802'>
+      <union-decl name='__anonymous_union__' size-in-bits='32' is-anonymous='yes' visibility='default' filepath='include/linux/ethtool.h' line='92' column='1' id='65b20802'>
         <data-member access='public'>
-          <var-decl name='autoneg' type-id='0a2ee428' visibility='default' filepath='include/linux/ethtool.h' line='97' column='1'/>
+          <var-decl name='autoneg' type-id='0a2ee428' visibility='default' filepath='include/linux/ethtool.h' line='93' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='link_training' type-id='f1e6b980' visibility='default' filepath='include/linux/ethtool.h' line='98' column='1'/>
+          <var-decl name='link_training' type-id='f1e6b980' visibility='default' filepath='include/linux/ethtool.h' line='94' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='link_logical_mismatch' type-id='164f6cd2' visibility='default' filepath='include/linux/ethtool.h' line='99' column='1'/>
+          <var-decl name='link_logical_mismatch' type-id='164f6cd2' visibility='default' filepath='include/linux/ethtool.h' line='95' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='bad_signal_integrity' type-id='10b5a989' visibility='default' filepath='include/linux/ethtool.h' line='100' column='1'/>
+          <var-decl name='bad_signal_integrity' type-id='10b5a989' visibility='default' filepath='include/linux/ethtool.h' line='96' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='cable_issue' type-id='fa5fe5da' visibility='default' filepath='include/linux/ethtool.h' line='101' column='1'/>
+          <var-decl name='cable_issue' type-id='fa5fe5da' visibility='default' filepath='include/linux/ethtool.h' line='97' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='__link_ext_substate' type-id='f9b06939' visibility='default' filepath='include/linux/ethtool.h' line='102' column='1'/>
+          <var-decl name='__link_ext_substate' type-id='f9b06939' visibility='default' filepath='include/linux/ethtool.h' line='98' column='1'/>
         </data-member>
       </union-decl>
       <class-decl name='gnet_dump' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/net/gen_stats.h' line='23' column='1' id='65baad60'>
@@ -45375,6 +46408,32 @@
       <pointer-type-def type-id='c148e595' size-in-bits='64' id='68197365'/>
       <pointer-type-def type-id='425496d7' size-in-bits='64' id='6829b047'/>
       <qualified-type-def type-id='8861584a' const='yes' id='682ab981'/>
+      <class-decl name='tcp_rack' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/tcp.h' line='214' column='1' id='682f92a2'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='mstamp' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='215' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='rtt_us' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='216' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='end_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='217' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='last_delivered' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='218' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='160'>
+          <var-decl name='reo_wnd_steps' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='219' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='reo_wnd_persist' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='221' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='dsack_seen' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='222' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='advanced' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='223' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='6d6fcd23' size-in-bits='64' id='682fb763'/>
       <function-type size-in-bits='64' id='6831a786'>
         <parameter type-id='a970a64c'/>
@@ -45386,6 +46445,7 @@
       <qualified-type-def type-id='bdae35f4' const='yes' id='683a8a93'/>
       <pointer-type-def type-id='355fab89' size-in-bits='64' id='6847d33d'/>
       <typedef-decl name='netdev_tx_t' type-id='e246a80b' filepath='include/linux/netdevice.h' line='121' column='1' id='6849a88c'/>
+      <pointer-type-def type-id='4041f6de' size-in-bits='64' id='684afc90'/>
       <pointer-type-def type-id='b855e40d' size-in-bits='64' id='684d860d'/>
       <pointer-type-def type-id='2b18e57b' size-in-bits='64' id='6850d327'/>
       <pointer-type-def type-id='3b03705e' size-in-bits='64' id='6850e780'/>
@@ -47414,6 +48474,7 @@
       </function-type>
       <pointer-type-def type-id='45f4b23b' size-in-bits='64' id='6d26c72b'/>
       <pointer-type-def type-id='32358857' size-in-bits='64' id='6d30564f'/>
+      <pointer-type-def type-id='bcad3f73' size-in-bits='64' id='6d320b83'/>
       <class-decl name='power_supply_desc' size-in-bits='832' is-struct='yes' visibility='default' filepath='include/linux/power_supply.h' line='242' column='1' id='6d39b2d0'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/power_supply.h' line='243' column='1'/>
@@ -48137,6 +49198,7 @@
           <var-decl name='bo' type-id='9d57e433' visibility='default' filepath='include/drm/ttm/ttm_bo_api.h' line='193' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='f0029b4e' size-in-bits='64' id='6f7e8184'/>
       <function-type size-in-bits='64' id='6f7f4c91'>
         <parameter type-id='3eb7c31c'/>
         <parameter type-id='eaa32e2f'/>
@@ -48243,6 +49305,7 @@
         <parameter type-id='f1a65d97'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='0786b8b4' size-in-bits='64' id='70119ea2'/>
       <pointer-type-def type-id='6788fb9a' size-in-bits='64' id='70283254'/>
       <class-decl name='ip_ct_tcp_state' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/linux/netfilter/nf_conntrack_tcp.h' line='8' column='1' id='702d8a24'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -48273,6 +49336,7 @@
         </data-member>
       </union-decl>
       <qualified-type-def type-id='378a6c5a' const='yes' id='703a35bb'/>
+      <pointer-type-def type-id='bdcf5751' size-in-bits='64' id='7041aa49'/>
       <pointer-type-def type-id='5113b296' size-in-bits='64' id='70487b28'/>
       <pointer-type-def type-id='f5c90b3f' size-in-bits='64' id='704982b4'/>
       <class-decl name='writeback_control' is-struct='yes' visibility='default' is-declaration-only='yes' id='705711f5'/>
@@ -49341,6 +50405,7 @@
       </class-decl>
       <typedef-decl name='work_func_t' type-id='939280af' filepath='include/linux/workqueue.h' line='22' column='1' id='72666d3f'/>
       <pointer-type-def type-id='dca78e2c' size-in-bits='64' id='726f2cf6'/>
+      <pointer-type-def type-id='ef40f18b' size-in-bits='64' id='72742e5b'/>
       <pointer-type-def type-id='d97eb63a' size-in-bits='64' id='72789b30'/>
       <class-decl name='bpf_raw_event_map' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/tracepoint-defs.h' line='49' column='1' id='72790540'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -49968,6 +51033,7 @@
           <var-decl name='alg' type-id='dd37d315' visibility='default' filepath='include/crypto/internal/skcipher.h' line='27' column='1'/>
         </data-member>
       </union-decl>
+      <pointer-type-def type-id='bc0d33fe' size-in-bits='64' id='73789784'/>
       <class-decl name='snd_pcm_ops' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/sound/pcm.h' line='53' column='1' id='73803d48'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='open' type-id='ab756384' visibility='default' filepath='include/sound/pcm.h' line='54' column='1'/>
@@ -50796,6 +51862,7 @@
         <parameter type-id='cc1804ea'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='f69f6d0e' size-in-bits='64' id='765eef68'/>
       <function-type size-in-bits='64' id='76620c4d'>
         <parameter type-id='bff05edb'/>
         <parameter type-id='7359adad'/>
@@ -52045,6 +53112,17 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='d800b1bf' size-in-bits='64' id='79dbccfb'/>
+      <class-decl name='inet6_cork' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/ipv6.h' line='194' column='1' id='79e3d9fd'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='opt' type-id='d4145729' visibility='default' filepath='include/linux/ipv6.h' line='195' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='hop_limit' type-id='f9b06939' visibility='default' filepath='include/linux/ipv6.h' line='196' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='72'>
+          <var-decl name='tclass' type-id='f9b06939' visibility='default' filepath='include/linux/ipv6.h' line='197' column='1'/>
+        </data-member>
+      </class-decl>
       <qualified-type-def type-id='b16ef9f3' const='yes' id='79eccb20'/>
       <pointer-type-def type-id='923a53bf' size-in-bits='64' id='79efa3b3'/>
       <pointer-type-def type-id='01ded187' size-in-bits='64' id='79f85ebf'/>
@@ -53670,39 +54748,39 @@
         <parameter type-id='c60ba652'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <class-decl name='usb_tt' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/linux/usb/hcd.h' line='564' column='1' id='7dda8bf2'>
+      <class-decl name='usb_tt' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/linux/usb/hcd.h' line='566' column='1' id='7dda8bf2'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hub' type-id='25e60cb2' visibility='default' filepath='include/linux/usb/hcd.h' line='565' column='1'/>
+          <var-decl name='hub' type-id='25e60cb2' visibility='default' filepath='include/linux/usb/hcd.h' line='567' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='multi' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/hcd.h' line='566' column='1'/>
+          <var-decl name='multi' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/hcd.h' line='568' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='think_time' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='567' column='1'/>
+          <var-decl name='think_time' type-id='f0981eeb' visibility='default' filepath='include/linux/usb/hcd.h' line='569' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='hcpriv' type-id='eaa32e2f' visibility='default' filepath='include/linux/usb/hcd.h' line='568' column='1'/>
+          <var-decl name='hcpriv' type-id='eaa32e2f' visibility='default' filepath='include/linux/usb/hcd.h' line='570' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='include/linux/usb/hcd.h' line='571' column='1'/>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='include/linux/usb/hcd.h' line='573' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='clear_list' type-id='72f469ec' visibility='default' filepath='include/linux/usb/hcd.h' line='572' column='1'/>
+          <var-decl name='clear_list' type-id='72f469ec' visibility='default' filepath='include/linux/usb/hcd.h' line='574' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='clear_work' type-id='ef9025d0' visibility='default' filepath='include/linux/usb/hcd.h' line='573' column='1'/>
+          <var-decl name='clear_work' type-id='ef9025d0' visibility='default' filepath='include/linux/usb/hcd.h' line='575' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='575' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='577' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='576' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='578' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='577' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='579' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='578' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/hcd.h' line='580' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='0181b08d' size-in-bits='64' id='7df445b9'/>
@@ -56033,6 +57111,7 @@
         <parameter type-id='e4330308'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <typedef-decl name='smp_cond_func_t' type-id='5c080b64' filepath='include/linux/smp.h' line='18' column='1' id='82fddac3'/>
       <class-decl name='ieee80211_vht_mcs_info' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/ieee80211.h' line='1688' column='1' id='830056b5'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='rx_mcs_map' type-id='23119536' visibility='default' filepath='include/linux/ieee80211.h' line='1689' column='1'/>
@@ -57204,6 +58283,14 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <class-decl name='usb_cdc_ncm_dpe32' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='386' column='1' id='85938ec6'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='dwDatagramIndex' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='387' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='dwDatagramLength' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='388' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='7ff8f2c1' size-in-bits='64' id='8596937d'/>
       <class-decl name='drm_dp_mst_topology_cbs' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/drm/drm_dp_mst_helper.h' line='516' column='1' id='8596da29'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -57849,6 +58936,7 @@
           <var-decl name='cmd' type-id='8f92235e' visibility='default' filepath='drivers/android/binder_internal.h' line='188' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='eed1c4b9' size-in-bits='64' id='87387369'/>
       <pointer-type-def type-id='3b8b42e1' size-in-bits='64' id='873a2591'/>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/media/v4l2-ctrls.h' line='287' column='1' id='87415f3a'>
         <data-member access='public'>
@@ -58373,6 +59461,7 @@
       <typedef-decl name='__kernel_clock_t' type-id='6a11bd61' filepath='include/uapi/asm-generic/posix_types.h' line='94' column='1' id='880ebc01'/>
       <pointer-type-def type-id='52126317' size-in-bits='64' id='880ef693'/>
       <pointer-type-def type-id='c16a2224' size-in-bits='64' id='88139c0a'/>
+      <pointer-type-def type-id='112f2691' size-in-bits='64' id='88146159'/>
       <class-decl name='serial_icounter_struct' is-struct='yes' visibility='default' is-declaration-only='yes' id='8816ddc1'/>
       <function-type size-in-bits='64' id='8826ec36'>
         <parameter type-id='6ee1a870'/>
@@ -58925,6 +60014,14 @@
         <parameter type-id='5799dc94'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <class-decl name='usb_cdc_ncm_dpe16' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='372' column='1' id='89981240'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='wDatagramIndex' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='373' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='wDatagramLength' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='374' column='1'/>
+        </data-member>
+      </class-decl>
       <qualified-type-def type-id='c2840192' const='yes' id='89990402'/>
       <class-decl name='component_ops' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/component.h' line='16' column='1' id='89a1ee2b'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -59219,201 +60316,201 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='5e7ca5e6' size-in-bits='64' id='8a390024'/>
-      <class-decl name='ethtool_ops' size-in-bits='4160' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='422' column='1' id='8a3b11ed'>
+      <class-decl name='ethtool_ops' size-in-bits='4160' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='418' column='1' id='8a3b11ed'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='supported_coalesce_params' type-id='19c2251e' visibility='default' filepath='include/linux/ethtool.h' line='423' column='1'/>
+          <var-decl name='supported_coalesce_params' type-id='19c2251e' visibility='default' filepath='include/linux/ethtool.h' line='419' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='get_drvinfo' type-id='343c05fa' visibility='default' filepath='include/linux/ethtool.h' line='424' column='1'/>
+          <var-decl name='get_drvinfo' type-id='343c05fa' visibility='default' filepath='include/linux/ethtool.h' line='420' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='get_regs_len' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='425' column='1'/>
+          <var-decl name='get_regs_len' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='421' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='get_regs' type-id='345f0501' visibility='default' filepath='include/linux/ethtool.h' line='426' column='1'/>
+          <var-decl name='get_regs' type-id='345f0501' visibility='default' filepath='include/linux/ethtool.h' line='422' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='get_wol' type-id='afcbd268' visibility='default' filepath='include/linux/ethtool.h' line='427' column='1'/>
+          <var-decl name='get_wol' type-id='afcbd268' visibility='default' filepath='include/linux/ethtool.h' line='423' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='set_wol' type-id='5a92dd37' visibility='default' filepath='include/linux/ethtool.h' line='428' column='1'/>
+          <var-decl name='set_wol' type-id='5a92dd37' visibility='default' filepath='include/linux/ethtool.h' line='424' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='get_msglevel' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='429' column='1'/>
+          <var-decl name='get_msglevel' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='425' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='set_msglevel' type-id='9038f441' visibility='default' filepath='include/linux/ethtool.h' line='430' column='1'/>
+          <var-decl name='set_msglevel' type-id='9038f441' visibility='default' filepath='include/linux/ethtool.h' line='426' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='nway_reset' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='431' column='1'/>
+          <var-decl name='nway_reset' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='427' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='get_link' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='432' column='1'/>
+          <var-decl name='get_link' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='428' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='get_link_ext_state' type-id='55cb433c' visibility='default' filepath='include/linux/ethtool.h' line='433' column='1'/>
+          <var-decl name='get_link_ext_state' type-id='55cb433c' visibility='default' filepath='include/linux/ethtool.h' line='429' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='get_eeprom_len' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='435' column='1'/>
+          <var-decl name='get_eeprom_len' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='431' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='get_eeprom' type-id='67a2c0c8' visibility='default' filepath='include/linux/ethtool.h' line='436' column='1'/>
+          <var-decl name='get_eeprom' type-id='67a2c0c8' visibility='default' filepath='include/linux/ethtool.h' line='432' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='set_eeprom' type-id='67a2c0c8' visibility='default' filepath='include/linux/ethtool.h' line='438' column='1'/>
+          <var-decl name='set_eeprom' type-id='67a2c0c8' visibility='default' filepath='include/linux/ethtool.h' line='434' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='get_coalesce' type-id='5a8326dc' visibility='default' filepath='include/linux/ethtool.h' line='440' column='1'/>
+          <var-decl name='get_coalesce' type-id='5a8326dc' visibility='default' filepath='include/linux/ethtool.h' line='436' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='set_coalesce' type-id='5a8326dc' visibility='default' filepath='include/linux/ethtool.h' line='441' column='1'/>
+          <var-decl name='set_coalesce' type-id='5a8326dc' visibility='default' filepath='include/linux/ethtool.h' line='437' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='get_ringparam' type-id='89b5be7f' visibility='default' filepath='include/linux/ethtool.h' line='442' column='1'/>
+          <var-decl name='get_ringparam' type-id='89b5be7f' visibility='default' filepath='include/linux/ethtool.h' line='438' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='set_ringparam' type-id='807c842c' visibility='default' filepath='include/linux/ethtool.h' line='444' column='1'/>
+          <var-decl name='set_ringparam' type-id='807c842c' visibility='default' filepath='include/linux/ethtool.h' line='440' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='get_pause_stats' type-id='7e1d5dd4' visibility='default' filepath='include/linux/ethtool.h' line='446' column='1'/>
+          <var-decl name='get_pause_stats' type-id='7e1d5dd4' visibility='default' filepath='include/linux/ethtool.h' line='442' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='get_pauseparam' type-id='f45e1d71' visibility='default' filepath='include/linux/ethtool.h' line='448' column='1'/>
+          <var-decl name='get_pauseparam' type-id='f45e1d71' visibility='default' filepath='include/linux/ethtool.h' line='444' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='set_pauseparam' type-id='d57a1ee4' visibility='default' filepath='include/linux/ethtool.h' line='450' column='1'/>
+          <var-decl name='set_pauseparam' type-id='d57a1ee4' visibility='default' filepath='include/linux/ethtool.h' line='446' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='self_test' type-id='4acd4951' visibility='default' filepath='include/linux/ethtool.h' line='452' column='1'/>
+          <var-decl name='self_test' type-id='4acd4951' visibility='default' filepath='include/linux/ethtool.h' line='448' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='get_strings' type-id='27653c4c' visibility='default' filepath='include/linux/ethtool.h' line='453' column='1'/>
+          <var-decl name='get_strings' type-id='27653c4c' visibility='default' filepath='include/linux/ethtool.h' line='449' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='set_phys_id' type-id='e0c03654' visibility='default' filepath='include/linux/ethtool.h' line='454' column='1'/>
+          <var-decl name='set_phys_id' type-id='e0c03654' visibility='default' filepath='include/linux/ethtool.h' line='450' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='get_ethtool_stats' type-id='6c781266' visibility='default' filepath='include/linux/ethtool.h' line='455' column='1'/>
+          <var-decl name='get_ethtool_stats' type-id='6c781266' visibility='default' filepath='include/linux/ethtool.h' line='451' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='begin' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='457' column='1'/>
+          <var-decl name='begin' type-id='2555df59' visibility='default' filepath='include/linux/ethtool.h' line='453' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='complete' type-id='548eee3a' visibility='default' filepath='include/linux/ethtool.h' line='458' column='1'/>
+          <var-decl name='complete' type-id='548eee3a' visibility='default' filepath='include/linux/ethtool.h' line='454' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='get_priv_flags' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='459' column='1'/>
+          <var-decl name='get_priv_flags' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='455' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='set_priv_flags' type-id='0f8df030' visibility='default' filepath='include/linux/ethtool.h' line='460' column='1'/>
+          <var-decl name='set_priv_flags' type-id='0f8df030' visibility='default' filepath='include/linux/ethtool.h' line='456' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='get_sset_count' type-id='d6762aa0' visibility='default' filepath='include/linux/ethtool.h' line='461' column='1'/>
+          <var-decl name='get_sset_count' type-id='d6762aa0' visibility='default' filepath='include/linux/ethtool.h' line='457' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='get_rxnfc' type-id='d67468b4' visibility='default' filepath='include/linux/ethtool.h' line='462' column='1'/>
+          <var-decl name='get_rxnfc' type-id='d67468b4' visibility='default' filepath='include/linux/ethtool.h' line='458' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='set_rxnfc' type-id='fece2110' visibility='default' filepath='include/linux/ethtool.h' line='464' column='1'/>
+          <var-decl name='set_rxnfc' type-id='fece2110' visibility='default' filepath='include/linux/ethtool.h' line='460' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='flash_device' type-id='d91e8ea3' visibility='default' filepath='include/linux/ethtool.h' line='465' column='1'/>
+          <var-decl name='flash_device' type-id='d91e8ea3' visibility='default' filepath='include/linux/ethtool.h' line='461' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='reset' type-id='4814c3f9' visibility='default' filepath='include/linux/ethtool.h' line='466' column='1'/>
+          <var-decl name='reset' type-id='4814c3f9' visibility='default' filepath='include/linux/ethtool.h' line='462' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='get_rxfh_key_size' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='467' column='1'/>
+          <var-decl name='get_rxfh_key_size' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='463' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='get_rxfh_indir_size' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='468' column='1'/>
+          <var-decl name='get_rxfh_indir_size' type-id='92d86499' visibility='default' filepath='include/linux/ethtool.h' line='464' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2304'>
-          <var-decl name='get_rxfh' type-id='de5dab7b' visibility='default' filepath='include/linux/ethtool.h' line='469' column='1'/>
+          <var-decl name='get_rxfh' type-id='de5dab7b' visibility='default' filepath='include/linux/ethtool.h' line='465' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2368'>
-          <var-decl name='set_rxfh' type-id='13680d10' visibility='default' filepath='include/linux/ethtool.h' line='471' column='1'/>
+          <var-decl name='set_rxfh' type-id='13680d10' visibility='default' filepath='include/linux/ethtool.h' line='467' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2432'>
-          <var-decl name='get_rxfh_context' type-id='64efa47a' visibility='default' filepath='include/linux/ethtool.h' line='473' column='1'/>
+          <var-decl name='get_rxfh_context' type-id='64efa47a' visibility='default' filepath='include/linux/ethtool.h' line='469' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='set_rxfh_context' type-id='5f0d472d' visibility='default' filepath='include/linux/ethtool.h' line='475' column='1'/>
+          <var-decl name='set_rxfh_context' type-id='5f0d472d' visibility='default' filepath='include/linux/ethtool.h' line='471' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2560'>
-          <var-decl name='get_channels' type-id='74287ea0' visibility='default' filepath='include/linux/ethtool.h' line='478' column='1'/>
+          <var-decl name='get_channels' type-id='74287ea0' visibility='default' filepath='include/linux/ethtool.h' line='474' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2624'>
-          <var-decl name='set_channels' type-id='b60e7255' visibility='default' filepath='include/linux/ethtool.h' line='479' column='1'/>
+          <var-decl name='set_channels' type-id='b60e7255' visibility='default' filepath='include/linux/ethtool.h' line='475' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2688'>
-          <var-decl name='get_dump_flag' type-id='351add77' visibility='default' filepath='include/linux/ethtool.h' line='480' column='1'/>
+          <var-decl name='get_dump_flag' type-id='351add77' visibility='default' filepath='include/linux/ethtool.h' line='476' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2752'>
-          <var-decl name='get_dump_data' type-id='b7ee351b' visibility='default' filepath='include/linux/ethtool.h' line='481' column='1'/>
+          <var-decl name='get_dump_data' type-id='b7ee351b' visibility='default' filepath='include/linux/ethtool.h' line='477' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='set_dump' type-id='351add77' visibility='default' filepath='include/linux/ethtool.h' line='483' column='1'/>
+          <var-decl name='set_dump' type-id='351add77' visibility='default' filepath='include/linux/ethtool.h' line='479' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2880'>
-          <var-decl name='get_ts_info' type-id='88f4e837' visibility='default' filepath='include/linux/ethtool.h' line='484' column='1'/>
+          <var-decl name='get_ts_info' type-id='88f4e837' visibility='default' filepath='include/linux/ethtool.h' line='480' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2944'>
-          <var-decl name='get_module_info' type-id='20974125' visibility='default' filepath='include/linux/ethtool.h' line='485' column='1'/>
+          <var-decl name='get_module_info' type-id='20974125' visibility='default' filepath='include/linux/ethtool.h' line='481' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3008'>
-          <var-decl name='get_module_eeprom' type-id='67a2c0c8' visibility='default' filepath='include/linux/ethtool.h' line='487' column='1'/>
+          <var-decl name='get_module_eeprom' type-id='67a2c0c8' visibility='default' filepath='include/linux/ethtool.h' line='483' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3072'>
-          <var-decl name='get_eee' type-id='d2be5b16' visibility='default' filepath='include/linux/ethtool.h' line='489' column='1'/>
+          <var-decl name='get_eee' type-id='d2be5b16' visibility='default' filepath='include/linux/ethtool.h' line='485' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3136'>
-          <var-decl name='set_eee' type-id='d2be5b16' visibility='default' filepath='include/linux/ethtool.h' line='490' column='1'/>
+          <var-decl name='set_eee' type-id='d2be5b16' visibility='default' filepath='include/linux/ethtool.h' line='486' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3200'>
-          <var-decl name='get_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='491' column='1'/>
+          <var-decl name='get_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='487' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='set_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='493' column='1'/>
+          <var-decl name='set_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='489' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3328'>
-          <var-decl name='get_per_queue_coalesce' type-id='6f2bf2e3' visibility='default' filepath='include/linux/ethtool.h' line='495' column='1'/>
+          <var-decl name='get_per_queue_coalesce' type-id='6f2bf2e3' visibility='default' filepath='include/linux/ethtool.h' line='491' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3392'>
-          <var-decl name='set_per_queue_coalesce' type-id='6f2bf2e3' visibility='default' filepath='include/linux/ethtool.h' line='497' column='1'/>
+          <var-decl name='set_per_queue_coalesce' type-id='6f2bf2e3' visibility='default' filepath='include/linux/ethtool.h' line='493' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3456'>
-          <var-decl name='get_link_ksettings' type-id='83359c30' visibility='default' filepath='include/linux/ethtool.h' line='499' column='1'/>
+          <var-decl name='get_link_ksettings' type-id='83359c30' visibility='default' filepath='include/linux/ethtool.h' line='495' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3520'>
-          <var-decl name='set_link_ksettings' type-id='5a3c102b' visibility='default' filepath='include/linux/ethtool.h' line='501' column='1'/>
+          <var-decl name='set_link_ksettings' type-id='5a3c102b' visibility='default' filepath='include/linux/ethtool.h' line='497' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3584'>
-          <var-decl name='get_fecparam' type-id='bda101d4' visibility='default' filepath='include/linux/ethtool.h' line='503' column='1'/>
+          <var-decl name='get_fecparam' type-id='bda101d4' visibility='default' filepath='include/linux/ethtool.h' line='499' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3648'>
-          <var-decl name='set_fecparam' type-id='bda101d4' visibility='default' filepath='include/linux/ethtool.h' line='505' column='1'/>
+          <var-decl name='set_fecparam' type-id='bda101d4' visibility='default' filepath='include/linux/ethtool.h' line='501' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3712'>
-          <var-decl name='get_ethtool_phy_stats' type-id='6c781266' visibility='default' filepath='include/linux/ethtool.h' line='507' column='1'/>
+          <var-decl name='get_ethtool_phy_stats' type-id='6c781266' visibility='default' filepath='include/linux/ethtool.h' line='503' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3776'>
-          <var-decl name='get_phy_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='509' column='1'/>
+          <var-decl name='get_phy_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='505' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3840'>
-          <var-decl name='set_phy_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='511' column='1'/>
+          <var-decl name='set_phy_tunable' type-id='a3c69469' visibility='default' filepath='include/linux/ethtool.h' line='507' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3904'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='514' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='510' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3968'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='515' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='511' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4032'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='516' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='512' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4096'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='517' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='513' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='__anonymous_struct__' size-in-bits='96' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/uapi/asm-generic/siginfo.h' line='90' column='1' id='8a41173c'>
@@ -59424,6 +60521,23 @@
           <var-decl name='_pkey' type-id='3f1a6b60' visibility='default' filepath='include/uapi/asm-generic/siginfo.h' line='92' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='tcp_fastopen_request' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='1665' column='1' id='8a4245ed'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='cookie' type-id='98fc5aa2' visibility='default' filepath='include/net/tcp.h' line='1667' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='data' type-id='6b9b777a' visibility='default' filepath='include/net/tcp.h' line='1668' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='size' type-id='b59d7dce' visibility='default' filepath='include/net/tcp.h' line='1669' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='copied' type-id='95e97e5e' visibility='default' filepath='include/net/tcp.h' line='1670' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='uarg' type-id='73789784' visibility='default' filepath='include/net/tcp.h' line='1671' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='snd_soc_tplg_vendor_array' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/sound/asoc.h' line='218' column='1' id='8a4504f5'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='size' type-id='2f162548' visibility='default' filepath='include/uapi/sound/asoc.h' line='219' column='1'/>
@@ -59504,6 +60618,7 @@
           <var-decl name='gain' type-id='3f1a6b60' visibility='default' filepath='include/uapi/sound/compress_params.h' line='317' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='34dda955' size-in-bits='64' id='8aa28e29'/>
       <pointer-type-def type-id='c89340f8' size-in-bits='64' id='8aa9d34a'/>
       <pointer-type-def type-id='5a602650' size-in-bits='64' id='8aae90f2'/>
       <pointer-type-def type-id='3dba7a06' size-in-bits='64' id='8ab4431c'/>
@@ -59586,6 +60701,7 @@
         <parameter type-id='f0981eeb'/>
         <return type-id='b50a4934'/>
       </function-type>
+      <pointer-type-def type-id='31e0f35d' size-in-bits='64' id='8b42c33d'/>
       <enum-decl name='v4l2_priority' filepath='include/uapi/linux/videodev2.h' line='406' column='1' id='8b60a0b9'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='V4L2_PRIORITY_UNSET' value='0'/>
@@ -61120,6 +62236,20 @@
         </data-member>
       </union-decl>
       <pointer-type-def type-id='de10cebd' size-in-bits='64' id='8eba4549'/>
+      <class-decl name='usb_cdc_obex_desc' size-in-bits='40' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='178' column='1' id='8ebff3ed'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='179' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='180' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='181' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bcdVersion' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='183' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='c38207f0' size-in-bits='64' id='8ed5fea6'/>
       <pointer-type-def type-id='1251351e' size-in-bits='64' id='8edac644'/>
       <function-type size-in-bits='64' id='8edc59cf'>
@@ -61293,6 +62423,29 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='278d8d7c' size-in-bits='64' id='8f6b937a'/>
+      <class-decl name='ipv6_mc_socklist' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='89' column='1' id='8f725b86'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='90' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='ifindex' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='91' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='160'>
+          <var-decl name='sfmode' type-id='f0981eeb' visibility='default' filepath='include/net/if_inet6.h' line='92' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='next' type-id='3d802c7c' visibility='default' filepath='include/net/if_inet6.h' line='93' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='sflock' type-id='ac16795b' visibility='default' filepath='include/net/if_inet6.h' line='94' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='sflist' type-id='b25391b7' visibility='default' filepath='include/net/if_inet6.h' line='95' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/if_inet6.h' line='96' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='d86551c2' size-in-bits='64' id='8f7ff038'/>
       <pointer-type-def type-id='7b76bae4' size-in-bits='64' id='8f8224f6'/>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/if.h' line='210' column='1' id='8f8c5495'>
@@ -62632,6 +63785,14 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='7dac1e36' size-in-bits='64' id='91b10e59'/>
+      <class-decl name='in6_pktinfo' size-in-bits='160' is-struct='yes' visibility='default' filepath='include/uapi/linux/ipv6.h' line='21' column='1' id='91b426fc'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='ipi6_addr' type-id='f6ed712a' visibility='default' filepath='include/uapi/linux/ipv6.h' line='22' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='ipi6_ifindex' type-id='95e97e5e' visibility='default' filepath='include/uapi/linux/ipv6.h' line='23' column='1'/>
+        </data-member>
+      </class-decl>
       <typedef-decl name='u64' type-id='d3130597' filepath='include/asm-generic/int-ll64.h' line='23' column='1' id='91ce1af9'/>
       <pointer-type-def type-id='d7c60ba9' size-in-bits='64' id='91d0de51'/>
       <pointer-type-def type-id='d0fea0bb' size-in-bits='64' id='91d6c443'/>
@@ -63119,12 +64280,12 @@
         <parameter type-id='8f92235e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='ethtool_link_ext_state_info' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='94' column='1' id='9359b7f2'>
+      <class-decl name='ethtool_link_ext_state_info' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='90' column='1' id='9359b7f2'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='link_ext_state' type-id='2f1b727c' visibility='default' filepath='include/linux/ethtool.h' line='95' column='1'/>
+          <var-decl name='link_ext_state' type-id='2f1b727c' visibility='default' filepath='include/linux/ethtool.h' line='91' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='' type-id='65b20802' visibility='default' filepath='include/linux/ethtool.h' line='96' column='1'/>
+          <var-decl name='' type-id='65b20802' visibility='default' filepath='include/linux/ethtool.h' line='92' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='935b1156'>
@@ -63293,6 +64454,7 @@
       <array-type-def dimensions='1' type-id='95e97e5e' size-in-bits='2048' id='93e41790'>
         <subrange length='64' type-id='7ff19f0f' id='b10be967'/>
       </array-type-def>
+      <pointer-type-def type-id='42b001af' size-in-bits='64' id='93edac17'/>
       <array-type-def dimensions='1' type-id='3b0abfc6' size-in-bits='768' id='93f82aba'>
         <subrange length='6' type-id='7ff19f0f' id='52fa524b'/>
       </array-type-def>
@@ -63613,6 +64775,29 @@
         </data-member>
       </class-decl>
       <class-decl name='scsi_host_cmd_pool' is-struct='yes' visibility='default' is-declaration-only='yes' id='94982f58'/>
+      <class-decl name='dbs_data' size-in-bits='1600' is-struct='yes' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='38' column='1' id='94ac9155'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='attr_set' type-id='32d20c8c' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='39' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1344'>
+          <var-decl name='tuners' type-id='eaa32e2f' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='40' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1408'>
+          <var-decl name='ignore_nice_load' type-id='f0981eeb' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='41' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1440'>
+          <var-decl name='sampling_rate' type-id='f0981eeb' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='42' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1472'>
+          <var-decl name='sampling_down_factor' type-id='f0981eeb' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='43' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1504'>
+          <var-decl name='up_threshold' type-id='f0981eeb' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='44' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1536'>
+          <var-decl name='io_is_busy' type-id='f0981eeb' visibility='default' filepath='drivers/cpufreq/cpufreq_governor.h' line='45' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='404f4f30' size-in-bits='64' id='94b3d6fa'/>
       <class-decl name='fib_rule' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/net/fib_rules.h' line='20' column='1' id='94b5478d'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -63699,6 +64884,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='61872327' size-in-bits='64' id='94bc2d77'/>
+      <pointer-type-def type-id='9d7259bb' size-in-bits='64' id='94bfb8eb'/>
       <pointer-type-def type-id='8eb05bf5' size-in-bits='64' id='94c01051'/>
       <class-decl name='spmi_driver' size-in-bits='1600' is-struct='yes' visibility='default' filepath='include/linux/spmi.h' line='139' column='1' id='94c01877'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -63990,6 +65176,7 @@
           <var-decl name='fade_level' type-id='d315442e' visibility='default' filepath='include/uapi/linux/input.h' line='337' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='ee0d5fa1' size-in-bits='64' id='95e43059'/>
       <function-type size-in-bits='64' id='95e62b18'>
         <parameter type-id='ccf3b302'/>
         <parameter type-id='95e97e5e'/>
@@ -65415,6 +66602,14 @@
         <return type-id='5e4f599b'/>
       </function-type>
       <qualified-type-def type-id='9a25f4b0' const='yes' id='9a165a97'/>
+      <class-decl name='minmax_sample' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/win_minmax.h' line='12' column='1' id='9a1ac43a'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='t' type-id='19c2251e' visibility='default' filepath='include/linux/win_minmax.h' line='13' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='v' type-id='19c2251e' visibility='default' filepath='include/linux/win_minmax.h' line='14' column='1'/>
+        </data-member>
+      </class-decl>
       <array-type-def dimensions='1' type-id='c6a1f4c6' size-in-bits='360' id='9a1c3c10'>
         <subrange length='15' type-id='7ff19f0f' id='8484ba73'/>
       </array-type-def>
@@ -67144,6 +68339,23 @@
           <var-decl name='callback_head' type-id='e3d8ce29' visibility='default' filepath='include/linux/perf_event.h' line='849' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='usb_cdc_mdlm_desc' size-in-bits='168' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='157' column='1' id='9d7259bb'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='158' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='159' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='160' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bcdVersion' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='162' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='40'>
+          <var-decl name='bGUID' type-id='9396cabb' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='163' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='f4d09092' size-in-bits='64' id='9d7e7820'/>
       <array-type-def dimensions='1' type-id='ab33c616' size-in-bits='256' id='9d8055ec'>
         <subrange length='4' type-id='7ff19f0f' id='16fe7105'/>
@@ -67549,6 +68761,35 @@
         <return type-id='48b5725f'/>
       </function-type>
       <pointer-type-def type-id='cc4a63b9' size-in-bits='64' id='9e99ecc1'/>
+      <class-decl name='__anonymous_struct__' size-in-bits='192' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/inet_connection_sock.h' line='114' column='1' id='9ea617aa'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='pending' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='115' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='quick' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='116' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='pingpong' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='117' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='retry' type-id='8f048e17' visibility='default' filepath='include/net/inet_connection_sock.h' line='118' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='ato' type-id='3f1a6b60' visibility='default' filepath='include/net/inet_connection_sock.h' line='119' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='timeout' type-id='7359adad' visibility='default' filepath='include/net/inet_connection_sock.h' line='120' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='lrcvtime' type-id='3f1a6b60' visibility='default' filepath='include/net/inet_connection_sock.h' line='121' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='160'>
+          <var-decl name='last_seg_size' type-id='d315442e' visibility='default' filepath='include/net/inet_connection_sock.h' line='122' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='176'>
+          <var-decl name='rcv_mss' type-id='d315442e' visibility='default' filepath='include/net/inet_connection_sock.h' line='123' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='hid_report' size-in-bits='16896' is-struct='yes' visibility='default' filepath='include/linux/hid.h' line='478' column='1' id='9ea68709'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/linux/hid.h' line='479' column='1'/>
@@ -67636,6 +68877,53 @@
         <parameter type-id='19c2251e'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <class-decl name='__anonymous_struct__' size-in-bits='16' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/ipv6.h' line='246' column='1' id='9ebd5abd'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='srcrt' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='247' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1'>
+          <var-decl name='osrcrt' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='248' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='rxinfo' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='249' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3'>
+          <var-decl name='rxoinfo' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='250' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='4'>
+          <var-decl name='rxhlim' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='251' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='rxohlim' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='252' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='hopopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='253' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='ohopopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='254' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='dstopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='255' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='9'>
+          <var-decl name='odstopts' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='256' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10'>
+          <var-decl name='rxflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='257' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='11'>
+          <var-decl name='rxtclass' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='258' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12'>
+          <var-decl name='rxpmtu' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='259' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13'>
+          <var-decl name='rxorigdstaddr' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='260' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14'>
+          <var-decl name='recvfragsize' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='261' column='1'/>
+        </data-member>
+      </class-decl>
       <enum-decl name='ehci_hrtimer_event' filepath='drivers/usb/host/ehci.h' line='94' column='1' id='9ebf0a72'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='EHCI_HRTIMER_POLL_ASS' value='0'/>
@@ -69118,6 +70406,14 @@
           <var-decl name='classid' type-id='19c2251e' visibility='default' filepath='include/net/sch_generic.h' line='331' column='1'/>
         </data-member>
       </class-decl>
+      <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/linux/skbuff.h' line='467' column='1' id='a27049de'>
+        <data-member access='public'>
+          <var-decl name='' type-id='3ee84947' visibility='default' filepath='include/linux/skbuff.h' line='468' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='' type-id='0efb3709' visibility='default' filepath='include/linux/skbuff.h' line='472' column='1'/>
+        </data-member>
+      </union-decl>
       <typedef-decl name='swap_func_t' type-id='97c3bf57' filepath='include/linux/types.h' line='225' column='1' id='a271c445'/>
       <class-decl name='gnss_device' size-in-bits='10240' is-struct='yes' visibility='default' filepath='include/linux/gnss.h' line='37' column='1' id='a272e179'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -69185,6 +70481,7 @@
         <enumerator name='DRM_LINK_STATUS_GOOD' value='0'/>
         <enumerator name='DRM_LINK_STATUS_BAD' value='1'/>
       </enum-decl>
+      <pointer-type-def type-id='33dff9d3' size-in-bits='64' id='a29682fb'/>
       <pointer-type-def type-id='a1b495b8' size-in-bits='64' id='a298286a'/>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='420' column='1' id='a29f8367'>
         <data-member access='public'>
@@ -69850,6 +71147,7 @@
           <var-decl name='base' type-id='514fe525' visibility='default' filepath='include/crypto/hash.h' line='46' column='1'/>
         </data-member>
       </class-decl>
+      <qualified-type-def type-id='ef40f18b' const='yes' id='a400949a'/>
       <class-decl name='__anonymous_struct__' size-in-bits='32' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='182' column='1' id='a414c3c0'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='skc_dport' type-id='84a5c3d4' visibility='default' filepath='include/net/sock.h' line='183' column='1'/>
@@ -70418,6 +71716,26 @@
           <var-decl name='completed' type-id='b50a4934' visibility='default' filepath='include/media/media-request.h' line='275' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='fastopen_queue' size-in-bits='320' is-struct='yes' visibility='default' filepath='include/net/request_sock.h' line='153' column='1' id='a5c461a3'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='rskq_rst_head' type-id='94c948ef' visibility='default' filepath='include/net/request_sock.h' line='154' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='rskq_rst_tail' type-id='94c948ef' visibility='default' filepath='include/net/request_sock.h' line='155' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='include/net/request_sock.h' line='159' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='160'>
+          <var-decl name='qlen' type-id='95e97e5e' visibility='default' filepath='include/net/request_sock.h' line='160' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='max_qlen' type-id='95e97e5e' visibility='default' filepath='include/net/request_sock.h' line='161' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='ctx' type-id='104fa32f' visibility='default' filepath='include/net/request_sock.h' line='163' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='ttm_dma_tt' size-in-bits='576' is-struct='yes' visibility='default' filepath='include/drm/ttm/ttm_tt.h' line='103' column='1' id='a5c79252'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='ttm' type-id='57584f2d' visibility='default' filepath='include/drm/ttm/ttm_tt.h' line='104' column='1'/>
@@ -70720,6 +72038,9 @@
       <pointer-type-def type-id='b9930aae' size-in-bits='64' id='a6798dcc'/>
       <pointer-type-def type-id='e079fe29' size-in-bits='64' id='a68064b1'/>
       <pointer-type-def type-id='feeb4c2f' size-in-bits='64' id='a6892387'/>
+      <array-type-def dimensions='1' type-id='b197d821' size-in-bits='256' id='a68b03d1'>
+        <subrange length='4' type-id='7ff19f0f' id='16fe7105'/>
+      </array-type-def>
       <pointer-type-def type-id='332a260c' size-in-bits='64' id='a6945abe'/>
       <function-type size-in-bits='64' id='a69d8a71'>
         <parameter type-id='e7d2a5fc'/>
@@ -70733,6 +72054,32 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='87769f42' size-in-bits='64' id='a6bf568c'/>
+      <class-decl name='request_sock_queue' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/net/request_sock.h' line='173' column='1' id='a6c77117'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='rskq_lock' type-id='fb4018a0' visibility='default' filepath='include/net/request_sock.h' line='174' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='rskq_defer_accept' type-id='f9b06939' visibility='default' filepath='include/net/request_sock.h' line='175' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='synflood_warned' type-id='19c2251e' visibility='default' filepath='include/net/request_sock.h' line='177' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='qlen' type-id='49178f86' visibility='default' filepath='include/net/request_sock.h' line='178' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='young' type-id='49178f86' visibility='default' filepath='include/net/request_sock.h' line='179' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='rskq_accept_head' type-id='94c948ef' visibility='default' filepath='include/net/request_sock.h' line='181' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='rskq_accept_tail' type-id='94c948ef' visibility='default' filepath='include/net/request_sock.h' line='182' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='fastopenq' type-id='a5c461a3' visibility='default' filepath='include/net/request_sock.h' line='183' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='0ff60dc2' size-in-bits='64' id='a6c912f4'/>
       <pointer-type-def type-id='c7d5925c' size-in-bits='64' id='a6cdca2a'/>
       <pointer-type-def type-id='dc49d474' size-in-bits='64' id='a6d2fa52'/>
@@ -72419,6 +73766,7 @@
         <parameter type-id='f0981eeb'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='0e5b8ca7' size-in-bits='64' id='a9c8654f'/>
       <function-type size-in-bits='64' id='a9cba835'>
         <parameter type-id='10216dc5'/>
         <parameter type-id='9638d26e'/>
@@ -72816,15 +74164,15 @@
         <enumerator name='DEVFREQ_TIMER_NUM' value='2'/>
       </enum-decl>
       <pointer-type-def type-id='644441a6' size-in-bits='64' id='aae3718c'/>
-      <class-decl name='dwc3_gadget_ep_cmd_params' size-in-bits='96' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1469' column='1' id='aaf4c449'>
+      <class-decl name='dwc3_gadget_ep_cmd_params' size-in-bits='96' is-struct='yes' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1479' column='1' id='aaf4c449'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='param2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1470' column='1'/>
+          <var-decl name='param2' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1480' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='param1' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1471' column='1'/>
+          <var-decl name='param1' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1481' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='param0' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1472' column='1'/>
+          <var-decl name='param0' type-id='19c2251e' visibility='default' filepath='drivers/usb/dwc3/core.h' line='1482' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='173cc5a0' size-in-bits='64' id='ab05e282'/>
@@ -73971,6 +75319,7 @@
       </class-decl>
       <pointer-type-def type-id='d6b2bd0c' size-in-bits='64' id='ae670bfa'/>
       <pointer-type-def type-id='52e7eff9' size-in-bits='64' id='ae675015'/>
+      <pointer-type-def type-id='105b52f0' size-in-bits='64' id='ae6a6d9a'/>
       <pointer-type-def type-id='5a69ad33' size-in-bits='64' id='ae6f24b7'/>
       <pointer-type-def type-id='a6d40256' size-in-bits='64' id='ae795a50'/>
       <class-decl name='snd_usb_endpoint' size-in-bits='44992' is-struct='yes' visibility='default' filepath='sound/usb/card.h' line='56' column='1' id='ae79630f'>
@@ -74443,6 +75792,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='0286989c' size-in-bits='64' id='ae9790c6'/>
+      <pointer-type-def type-id='27365fde' size-in-bits='64' id='ae990d1c'/>
       <function-type size-in-bits='64' id='ae99f6b5'>
         <parameter type-id='8582e5ec'/>
         <parameter type-id='745b39e8'/>
@@ -75344,6 +76694,7 @@
         <parameter type-id='3921c1a0' name='gser'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='1945ad2d' size-in-bits='64' id='b087f139'/>
       <function-type size-in-bits='64' id='b08da511'>
         <parameter type-id='fb648468'/>
         <parameter type-id='af02a266'/>
@@ -75654,6 +77005,14 @@
         <subrange length='64' type-id='7ff19f0f' id='b10be967'/>
       </array-type-def>
       <pointer-type-def type-id='af3cafff' size-in-bits='64' id='b188cc4f'/>
+      <class-decl name='tcp_sack_block' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/tcp.h' line='73' column='1' id='b197d821'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='start_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='74' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='end_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='75' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='scmi_protocol_events' size-in-bits='256' is-struct='yes' visibility='default' filepath='drivers/firmware/arm_scmi/notify.h' line='72' column='1' id='b19a033a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='queue_sz' type-id='b59d7dce' visibility='default' filepath='drivers/firmware/arm_scmi/notify.h' line='73' column='1'/>
@@ -76003,6 +77362,7 @@
           <var-decl name='skb_mstamp_ns' type-id='91ce1af9' visibility='default' filepath='include/linux/skbuff.h' line='744' column='1'/>
         </data-member>
       </union-decl>
+      <pointer-type-def type-id='3df0f7af' size-in-bits='64' id='b25391b7'/>
       <qualified-type-def type-id='cf20ba04' const='yes' id='b254b8db'/>
       <pointer-type-def type-id='d591777b' size-in-bits='64' id='b25d7387'/>
       <array-type-def dimensions='1' type-id='2e1b0751' size-in-bits='5120' id='b25dce46'>
@@ -76889,6 +78249,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='6cef7733' size-in-bits='64' id='b48dadb7'/>
+      <pointer-type-def type-id='42cd489a' size-in-bits='64' id='b49efd08'/>
       <class-decl name='hdmi_audio_infoframe' size-in-bits='224' is-struct='yes' visibility='default' filepath='include/linux/hdmi.h' line='319' column='1' id='b4a1ba48'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='type' type-id='c573b339' visibility='default' filepath='include/linux/hdmi.h' line='320' column='1'/>
@@ -77623,6 +78984,7 @@
       </class-decl>
       <class-decl name='devlink_port' is-struct='yes' visibility='default' is-declaration-only='yes' id='b62ee7e2'/>
       <pointer-type-def type-id='68a72cd7' size-in-bits='64' id='b6316a7f'/>
+      <pointer-type-def type-id='5260af22' size-in-bits='64' id='b6338998'/>
       <class-decl name='sync_file' size-in-bits='960' is-struct='yes' visibility='default' filepath='include/linux/sync_file.h' line='35' column='1' id='b6352c99'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='file' type-id='77e79a4b' visibility='default' filepath='include/linux/sync_file.h' line='36' column='1'/>
@@ -77792,6 +79154,7 @@
         <parameter type-id='ddfb71fa'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <qualified-type-def type-id='bdcf5751' const='yes' id='b6a8699c'/>
       <pointer-type-def type-id='d7aa071c' size-in-bits='64' id='b6a95a02'/>
       <class-decl name='ethtool_ah_espip4_spec' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/uapi/linux/ethtool.h' line='862' column='1' id='b6a9d1ee'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -77880,6 +79243,7 @@
         <subrange length='4' type-id='7ff19f0f' id='16fe7105'/>
       </array-type-def>
       <pointer-type-def type-id='749378a8' size-in-bits='64' id='b6ba26fa'/>
+      <pointer-type-def type-id='19834fe0' size-in-bits='64' id='b6bc3316'/>
       <function-type size-in-bits='64' id='b6c1136f'>
         <parameter type-id='93762a0a'/>
         <return type-id='48b5725f'/>
@@ -78331,11 +79695,20 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='21e2c677' size-in-bits='64' id='b7ee351b'/>
+      <pointer-type-def type-id='d37cd54e' size-in-bits='64' id='b7f056d4'/>
       <pointer-type-def type-id='daa6240b' size-in-bits='64' id='b7f77f1f'/>
       <pointer-type-def type-id='579042ad' size-in-bits='64' id='b7f92ac9'/>
       <pointer-type-def type-id='c5c76c9c' size-in-bits='64' id='b7f9d8e6'/>
       <pointer-type-def type-id='50af579e' size-in-bits='64' id='b807105c'/>
       <pointer-type-def type-id='d5476b80' size-in-bits='64' id='b80a6036'/>
+      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/tcp.h' line='387' column='1' id='b80da08c'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='probe_seq_start' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='388' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='probe_seq_end' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='389' column='1'/>
+        </data-member>
+      </class-decl>
       <enum-decl name='bpf_prog_type' filepath='include/uapi/linux/bpf.h' line='170' column='1' id='b80df76a'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='BPF_PROG_TYPE_UNSPEC' value='0'/>
@@ -79003,54 +80376,54 @@
           <var-decl name='counters' type-id='9f2cce4b' visibility='default' filepath='include/linux/percpu_counter.h' line='26' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='binder_thread' size-in-bits='3328' is-struct='yes' visibility='default' filepath='drivers/android/binder_internal.h' line='511' column='1' id='b92ecbfe'>
+      <class-decl name='binder_thread' size-in-bits='3328' is-struct='yes' visibility='default' filepath='drivers/android/binder_internal.h' line='513' column='1' id='b92ecbfe'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='proc' type-id='d1cf113c' visibility='default' filepath='drivers/android/binder_internal.h' line='512' column='1'/>
+          <var-decl name='proc' type-id='d1cf113c' visibility='default' filepath='drivers/android/binder_internal.h' line='514' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='rb_node' type-id='2a8a6332' visibility='default' filepath='drivers/android/binder_internal.h' line='513' column='1'/>
+          <var-decl name='rb_node' type-id='2a8a6332' visibility='default' filepath='drivers/android/binder_internal.h' line='515' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='waiting_thread_node' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='514' column='1'/>
+          <var-decl name='waiting_thread_node' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='516' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='pid' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='515' column='1'/>
+          <var-decl name='pid' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='517' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='looper' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='516' column='1'/>
+          <var-decl name='looper' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='518' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='looper_need_return' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='517' column='1'/>
+          <var-decl name='looper_need_return' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='519' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='transaction_stack' type-id='f4c3bb4c' visibility='default' filepath='drivers/android/binder_internal.h' line='518' column='1'/>
+          <var-decl name='transaction_stack' type-id='f4c3bb4c' visibility='default' filepath='drivers/android/binder_internal.h' line='520' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='todo' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='519' column='1'/>
+          <var-decl name='todo' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='521' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='process_todo' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='520' column='1'/>
+          <var-decl name='process_todo' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='522' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='return_error' type-id='873851dc' visibility='default' filepath='drivers/android/binder_internal.h' line='521' column='1'/>
+          <var-decl name='return_error' type-id='873851dc' visibility='default' filepath='drivers/android/binder_internal.h' line='523' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='reply_error' type-id='873851dc' visibility='default' filepath='drivers/android/binder_internal.h' line='522' column='1'/>
+          <var-decl name='reply_error' type-id='873851dc' visibility='default' filepath='drivers/android/binder_internal.h' line='524' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='wait' type-id='b5ab048f' visibility='default' filepath='drivers/android/binder_internal.h' line='523' column='1'/>
+          <var-decl name='wait' type-id='b5ab048f' visibility='default' filepath='drivers/android/binder_internal.h' line='525' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='stats' type-id='7e06c299' visibility='default' filepath='drivers/android/binder_internal.h' line='524' column='1'/>
+          <var-decl name='stats' type-id='7e06c299' visibility='default' filepath='drivers/android/binder_internal.h' line='526' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3168'>
-          <var-decl name='tmp_ref' type-id='49178f86' visibility='default' filepath='drivers/android/binder_internal.h' line='525' column='1'/>
+          <var-decl name='tmp_ref' type-id='49178f86' visibility='default' filepath='drivers/android/binder_internal.h' line='527' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3200'>
-          <var-decl name='is_dead' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='526' column='1'/>
+          <var-decl name='is_dead' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='528' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='task' type-id='f23e2572' visibility='default' filepath='drivers/android/binder_internal.h' line='527' column='1'/>
+          <var-decl name='task' type-id='f23e2572' visibility='default' filepath='drivers/android/binder_internal.h' line='529' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='26761b9f' size-in-bits='64' id='b9348c47'/>
@@ -79611,6 +80984,12 @@
         <subrange length='34' type-id='7ff19f0f' id='6a6a7e00'/>
       </array-type-def>
       <typedef-decl name='snd_kcontrol_tlv_rw_t' type-id='54d4fbda' filepath='include/sound/control.h' line='20' column='1' id='ba5ca324'/>
+      <function-type size-in-bits='64' id='ba5db8ea'>
+        <parameter type-id='f772df6d'/>
+        <parameter type-id='0fbf3cfd'/>
+        <parameter type-id='b1fd62ba'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <function-type size-in-bits='64' id='ba66f720'>
         <parameter type-id='226853d2'/>
         <parameter type-id='f74174a4'/>
@@ -79782,7 +81161,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <function-type size-in-bits='64' id='bb068c9f'>
-        <parameter type-id='37175e4d' name='hdev'/>
+        <parameter type-id='37175e4d' name='device'/>
         <return type-id='95e97e5e'/>
       </function-type>
       <class-decl name='irq_chip_generic' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/linux/irq.h' line='1058' column='1' id='bb06f572'>
@@ -80052,6 +81431,20 @@
         <return type-id='4bdecfd7'/>
       </function-type>
       <pointer-type-def type-id='c83cb72c' size-in-bits='64' id='bc0ca82e'/>
+      <class-decl name='ubuf_info' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/skbuff.h' line='465' column='1' id='bc0d33fe'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='callback' type-id='fc30e234' visibility='default' filepath='include/linux/skbuff.h' line='466' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='' type-id='a27049de' visibility='default' filepath='include/linux/skbuff.h' line='467' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='refcnt' type-id='64615833' visibility='default' filepath='include/linux/skbuff.h' line='479' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='mmp' type-id='0009269e' visibility='default' filepath='include/linux/skbuff.h' line='484' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='075857e5' size-in-bits='64' id='bc155125'/>
       <class-decl name='iw_freq' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/linux/wireless.h' line='706' column='1' id='bc1ac22c'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -80861,37 +82254,37 @@
           <var-decl name='security' type-id='eaa32e2f' visibility='default' filepath='include/linux/sched.h' line='1362' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='22272'>
-          <var-decl name='android_vendor_data1' type-id='4b516a9c' visibility='default' filepath='include/linux/sched.h' line='1379' column='1'/>
+          <var-decl name='android_vendor_data1' type-id='4b516a9c' visibility='default' filepath='include/linux/sched.h' line='1380' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='26368'>
-          <var-decl name='android_oem_data1' type-id='ef7c8fe9' visibility='default' filepath='include/linux/sched.h' line='1380' column='1'/>
+          <var-decl name='android_oem_data1' type-id='ef7c8fe9' visibility='default' filepath='include/linux/sched.h' line='1381' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28416'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1382' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1383' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28480'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1383' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1384' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28544'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1384' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1385' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28608'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1385' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1386' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28672'>
-          <var-decl name='android_kabi_reserved5' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1386' column='1'/>
+          <var-decl name='android_kabi_reserved5' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1387' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28736'>
-          <var-decl name='android_kabi_reserved6' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1387' column='1'/>
+          <var-decl name='android_kabi_reserved6' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1388' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28800'>
-          <var-decl name='android_kabi_reserved7' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1388' column='1'/>
+          <var-decl name='android_kabi_reserved7' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1389' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28864'>
-          <var-decl name='android_kabi_reserved8' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1389' column='1'/>
+          <var-decl name='android_kabi_reserved8' type-id='91ce1af9' visibility='default' filepath='include/linux/sched.h' line='1390' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='28928'>
-          <var-decl name='thread' type-id='0c8a83c7' visibility='default' filepath='include/linux/sched.h' line='1398' column='1'/>
+          <var-decl name='thread' type-id='0c8a83c7' visibility='default' filepath='include/linux/sched.h' line='1399' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='bc51cf2c'>
@@ -81233,175 +82626,175 @@
           <var-decl name='tmf_queue' type-id='e7d2a5fc' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='845' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4800'>
-          <var-decl name='active_uic_cmd' type-id='cdf785b8' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='847' column='1'/>
+          <var-decl name='active_uic_cmd' type-id='cdf785b8' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='853' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4864'>
-          <var-decl name='uic_cmd_mutex' type-id='925167dc' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='848' column='1'/>
+          <var-decl name='uic_cmd_mutex' type-id='925167dc' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='854' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5248'>
-          <var-decl name='uic_async_done' type-id='389faaf7' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='849' column='1'/>
+          <var-decl name='uic_async_done' type-id='389faaf7' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='855' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5312'>
-          <var-decl name='ufshcd_state' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='851' column='1'/>
+          <var-decl name='ufshcd_state' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='857' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5344'>
-          <var-decl name='eh_flags' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='852' column='1'/>
+          <var-decl name='eh_flags' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='858' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5376'>
-          <var-decl name='intr_mask' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='853' column='1'/>
+          <var-decl name='intr_mask' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='859' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5408'>
-          <var-decl name='ee_ctrl_mask' type-id='1dc6a898' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='854' column='1'/>
+          <var-decl name='ee_ctrl_mask' type-id='1dc6a898' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='860' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5424'>
-          <var-decl name='is_powered' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='855' column='1'/>
+          <var-decl name='is_powered' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='861' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5432'>
-          <var-decl name='shutting_down' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='856' column='1'/>
+          <var-decl name='shutting_down' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='862' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5440'>
-          <var-decl name='host_sem' type-id='011244e5' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='857' column='1'/>
+          <var-decl name='host_sem' type-id='011244e5' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='863' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5632'>
-          <var-decl name='eh_wq' type-id='242e3d19' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='860' column='1'/>
+          <var-decl name='eh_wq' type-id='242e3d19' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='866' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5696'>
-          <var-decl name='eh_work' type-id='ef9025d0' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='861' column='1'/>
+          <var-decl name='eh_work' type-id='ef9025d0' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='867' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6080'>
-          <var-decl name='eeh_work' type-id='ef9025d0' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='862' column='1'/>
+          <var-decl name='eeh_work' type-id='ef9025d0' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='868' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6464'>
-          <var-decl name='errors' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='865' column='1'/>
+          <var-decl name='errors' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='871' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6496'>
-          <var-decl name='uic_error' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='866' column='1'/>
+          <var-decl name='uic_error' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='872' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6528'>
-          <var-decl name='saved_err' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='867' column='1'/>
+          <var-decl name='saved_err' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='873' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6560'>
-          <var-decl name='saved_uic_err' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='868' column='1'/>
+          <var-decl name='saved_uic_err' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='874' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6592'>
-          <var-decl name='ufs_stats' type-id='e7596927' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='869' column='1'/>
+          <var-decl name='ufs_stats' type-id='e7596927' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='875' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='18496'>
-          <var-decl name='force_reset' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='870' column='1'/>
+          <var-decl name='force_reset' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='876' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='18504'>
-          <var-decl name='force_pmc' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='871' column='1'/>
+          <var-decl name='force_pmc' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='877' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='18512'>
-          <var-decl name='silence_err_logs' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='872' column='1'/>
+          <var-decl name='silence_err_logs' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='878' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='18560'>
-          <var-decl name='dev_cmd' type-id='19098804' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='875' column='1'/>
+          <var-decl name='dev_cmd' type-id='19098804' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='881' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='19520'>
-          <var-decl name='last_dme_cmd_tstamp' type-id='fbc017ef' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='876' column='1'/>
+          <var-decl name='last_dme_cmd_tstamp' type-id='fbc017ef' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='882' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='19584'>
-          <var-decl name='dev_info' type-id='e3428c48' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='879' column='1'/>
+          <var-decl name='dev_info' type-id='e3428c48' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='885' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='19968'>
-          <var-decl name='auto_bkops_enabled' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='880' column='1'/>
+          <var-decl name='auto_bkops_enabled' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='886' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20032'>
-          <var-decl name='vreg_info' type-id='c9a4cbd1' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='881' column='1'/>
+          <var-decl name='vreg_info' type-id='c9a4cbd1' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='887' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20288'>
-          <var-decl name='clk_list_head' type-id='72f469ec' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='882' column='1'/>
+          <var-decl name='clk_list_head' type-id='72f469ec' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='888' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20416'>
-          <var-decl name='wlun_dev_clr_ua' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='884' column='1'/>
+          <var-decl name='wlun_dev_clr_ua' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='890' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20448'>
-          <var-decl name='req_abort_count' type-id='95e97e5e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='887' column='1'/>
+          <var-decl name='req_abort_count' type-id='95e97e5e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='893' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20480'>
-          <var-decl name='lanes_per_direction' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='890' column='1'/>
+          <var-decl name='lanes_per_direction' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='896' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20512'>
-          <var-decl name='pwr_info' type-id='4020579d' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='891' column='1'/>
+          <var-decl name='pwr_info' type-id='4020579d' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='897' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20736'>
-          <var-decl name='max_pwr_info' type-id='9b642532' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='892' column='1'/>
+          <var-decl name='max_pwr_info' type-id='9b642532' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='898' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='20992'>
-          <var-decl name='clk_gating' type-id='0eeb0815' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='894' column='1'/>
+          <var-decl name='clk_gating' type-id='0eeb0815' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='900' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='23360'>
-          <var-decl name='caps' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='896' column='1'/>
+          <var-decl name='caps' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='902' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='23424'>
-          <var-decl name='devfreq' type-id='f66fa7f4' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='898' column='1'/>
+          <var-decl name='devfreq' type-id='f66fa7f4' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='904' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='23488'>
-          <var-decl name='clk_scaling' type-id='ab4dad02' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='899' column='1'/>
+          <var-decl name='clk_scaling' type-id='ab4dad02' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='905' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='25280'>
-          <var-decl name='is_sys_suspended' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='900' column='1'/>
+          <var-decl name='is_sys_suspended' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='906' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='25312'>
-          <var-decl name='urgent_bkops_lvl' type-id='462d2624' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='902' column='1'/>
+          <var-decl name='urgent_bkops_lvl' type-id='462d2624' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='908' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='25344'>
-          <var-decl name='is_urgent_bkops_lvl_checked' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='903' column='1'/>
+          <var-decl name='is_urgent_bkops_lvl_checked' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='909' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='25408'>
-          <var-decl name='clk_scaling_lock' type-id='f19fdb93' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='905' column='1'/>
+          <var-decl name='clk_scaling_lock' type-id='f19fdb93' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='911' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='25920'>
-          <var-decl name='desc_size' type-id='d69ec031' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='906' column='1'/>
+          <var-decl name='desc_size' type-id='d69ec031' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='912' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='26016'>
-          <var-decl name='scsi_block_reqs_cnt' type-id='49178f86' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='907' column='1'/>
+          <var-decl name='scsi_block_reqs_cnt' type-id='49178f86' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='913' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='26048'>
-          <var-decl name='bsg_dev' type-id='66e487eb' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='909' column='1'/>
+          <var-decl name='bsg_dev' type-id='66e487eb' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='915' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='33216'>
-          <var-decl name='bsg_queue' type-id='e7d2a5fc' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='910' column='1'/>
+          <var-decl name='bsg_queue' type-id='e7d2a5fc' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='916' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='33280'>
-          <var-decl name='wb_buf_flush_enabled' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='911' column='1'/>
+          <var-decl name='wb_buf_flush_enabled' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='917' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='33288'>
-          <var-decl name='wb_enabled' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='912' column='1'/>
+          <var-decl name='wb_enabled' type-id='b50a4934' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='918' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='33344'>
-          <var-decl name='rpm_dev_flush_recheck_work' type-id='5ad6e0ef' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='913' column='1'/>
+          <var-decl name='rpm_dev_flush_recheck_work' type-id='5ad6e0ef' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='919' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='34432'>
-          <var-decl name='monitor' type-id='2251b9ac' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='920' column='1'/>
+          <var-decl name='monitor' type-id='2251b9ac' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='926' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='35584'>
-          <var-decl name='crypto_capabilities' type-id='4721c843' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='923' column='1'/>
+          <var-decl name='crypto_capabilities' type-id='4721c843' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='929' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='35648'>
-          <var-decl name='crypto_cap_array' type-id='d43dc76d' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='924' column='1'/>
+          <var-decl name='crypto_cap_array' type-id='d43dc76d' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='930' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='35712'>
-          <var-decl name='crypto_cfg_register' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='925' column='1'/>
+          <var-decl name='crypto_cfg_register' type-id='19c2251e' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='931' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='35776'>
-          <var-decl name='ksm' type-id='13fcfe64' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='926' column='1'/>
+          <var-decl name='ksm' type-id='13fcfe64' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='932' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='37376'>
-          <var-decl name='debugfs_root' type-id='27675065' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='929' column='1'/>
+          <var-decl name='debugfs_root' type-id='27675065' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='935' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='37440'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='932' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='938' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='37504'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='933' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='939' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='37568'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='934' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='940' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='37632'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='935' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='drivers/scsi/ufs/ufshcd.h' line='941' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='bc6e6178'>
@@ -81613,6 +83006,119 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <qualified-type-def type-id='6739dd09' const='yes' id='bca91994'/>
+      <class-decl name='ipv6_pinfo' size-in-bits='1216' is-struct='yes' visibility='default' filepath='include/linux/ipv6.h' line='208' column='1' id='bcad3f73'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='saddr' type-id='f6ed712a' visibility='default' filepath='include/linux/ipv6.h' line='209' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='sticky_pktinfo' type-id='91b426fc' visibility='default' filepath='include/linux/ipv6.h' line='210' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='daddr_cache' type-id='fea9c20b' visibility='default' filepath='include/linux/ipv6.h' line='211' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='flow_label' type-id='78a133c2' visibility='default' filepath='include/linux/ipv6.h' line='216' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='416'>
+          <var-decl name='frag_size' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='217' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='__unused_1' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='227' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='hop_limit' type-id='b55def60' visibility='default' filepath='include/linux/ipv6.h' line='228' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='mc_loop' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='237' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1'>
+          <var-decl name='__unused_2' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='238' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='mcast_hops' type-id='b55def60' visibility='default' filepath='include/linux/ipv6.h' line='239' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='480'>
+          <var-decl name='ucast_oif' type-id='95e97e5e' visibility='default' filepath='include/linux/ipv6.h' line='241' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='mcast_oif' type-id='95e97e5e' visibility='default' filepath='include/linux/ipv6.h' line='242' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='544'>
+          <var-decl name='rxopt' type-id='23d43bd5' visibility='default' filepath='include/linux/ipv6.h' line='265' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='recverr' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='268' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1'>
+          <var-decl name='sndflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='269' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='repflow' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='270' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3'>
+          <var-decl name='pmtudisc' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='271' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='padding' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='272' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='srcprefs' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='273' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='10'>
+          <var-decl name='dontfrag' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='277' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='11'>
+          <var-decl name='autoflowlabel' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='278' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12'>
+          <var-decl name='autoflowlabel_set' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='279' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13'>
+          <var-decl name='mc_all' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='280' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14'>
+          <var-decl name='recverr_rfc4884' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='281' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15'>
+          <var-decl name='rtalert_isolate' type-id='d315442e' visibility='default' filepath='include/linux/ipv6.h' line='282' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='576'>
+          <var-decl name='min_hopcount' type-id='8f048e17' visibility='default' filepath='include/linux/ipv6.h' line='283' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='584'>
+          <var-decl name='tclass' type-id='8f048e17' visibility='default' filepath='include/linux/ipv6.h' line='284' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='608'>
+          <var-decl name='rcv_flowinfo' type-id='78a133c2' visibility='default' filepath='include/linux/ipv6.h' line='285' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='dst_cookie' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='287' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='672'>
+          <var-decl name='rx_dst_cookie' type-id='3f1a6b60' visibility='default' filepath='include/linux/ipv6.h' line='288' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='704'>
+          <var-decl name='ipv6_mc_list' type-id='3d802c7c' visibility='default' filepath='include/linux/ipv6.h' line='290' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='768'>
+          <var-decl name='ipv6_ac_list' type-id='0d2afef8' visibility='default' filepath='include/linux/ipv6.h' line='291' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='832'>
+          <var-decl name='ipv6_fl_list' type-id='3a14a5ee' visibility='default' filepath='include/linux/ipv6.h' line='292' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='896'>
+          <var-decl name='opt' type-id='d4145729' visibility='default' filepath='include/linux/ipv6.h' line='294' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='960'>
+          <var-decl name='pktoptions' type-id='0fbf3cfd' visibility='default' filepath='include/linux/ipv6.h' line='295' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1024'>
+          <var-decl name='rxpmtu' type-id='0fbf3cfd' visibility='default' filepath='include/linux/ipv6.h' line='296' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1088'>
+          <var-decl name='cork' type-id='79e3d9fd' visibility='default' filepath='include/linux/ipv6.h' line='297' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='bcb69272'>
         <parameter type-id='226853d2'/>
         <parameter type-id='f0981eeb'/>
@@ -82200,6 +83706,11 @@
       </class-decl>
       <pointer-type-def type-id='a343ff61' size-in-bits='64' id='bdb2559a'/>
       <qualified-type-def type-id='db9db9b1' const='yes' id='bdb26574'/>
+      <function-type size-in-bits='64' id='bdb32c88'>
+        <parameter type-id='b11825ce'/>
+        <parameter type-id='7f6ae768'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <function-type size-in-bits='64' id='bdb68106'>
         <parameter type-id='bff05edb'/>
         <parameter type-id='fa0b179b'/>
@@ -82217,6 +83728,23 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='facd5338' size-in-bits='64' id='bdcee7ae'/>
+      <class-decl name='usb_cdc_ncm_desc' size-in-bits='48' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='187' column='1' id='bdcf5751'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='188' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='189' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='190' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bcdNcmVersion' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='192' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='40'>
+          <var-decl name='bmNetworkCapabilities' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='193' column='1'/>
+        </data-member>
+      </class-decl>
       <qualified-type-def type-id='52c7f7a2' const='yes' id='bdd1d6eb'/>
       <function-type size-in-bits='64' id='bdd382a3'>
         <parameter type-id='7e666abe'/>
@@ -82417,6 +83945,17 @@
       <pointer-type-def type-id='3faa6906' size-in-bits='64' id='be6833bc'/>
       <pointer-type-def type-id='3a5c2153' size-in-bits='64' id='be6c7be7'/>
       <pointer-type-def type-id='d4287147' size-in-bits='64' id='be79b65f'/>
+      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/tcp.h' line='373' column='1' id='be7d4e1c'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='rtt_us' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='374' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='375' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='time' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='376' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='e184aa4e' size-in-bits='64' id='be89b2b8'/>
       <class-decl name='blk_stat_callback' size-in-bits='1088' is-struct='yes' visibility='default' filepath='block/blk-stat.h' line='19' column='1' id='be8f4983'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -83073,15 +84612,15 @@
       </function-type>
       <qualified-type-def type-id='f08a8a46' const='yes' id='c0189e56'/>
       <pointer-type-def type-id='3a47d82b' size-in-bits='64' id='c0190993'/>
-      <class-decl name='kasan_cache' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/linux/kasan.h' line='130' column='1' id='c01a68a0'>
+      <class-decl name='kasan_cache' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/linux/kasan.h' line='135' column='1' id='c01a68a0'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='alloc_meta_offset' type-id='95e97e5e' visibility='default' filepath='include/linux/kasan.h' line='131' column='1'/>
+          <var-decl name='alloc_meta_offset' type-id='95e97e5e' visibility='default' filepath='include/linux/kasan.h' line='136' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='free_meta_offset' type-id='95e97e5e' visibility='default' filepath='include/linux/kasan.h' line='132' column='1'/>
+          <var-decl name='free_meta_offset' type-id='95e97e5e' visibility='default' filepath='include/linux/kasan.h' line='137' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='is_kmalloc' type-id='b50a4934' visibility='default' filepath='include/linux/kasan.h' line='133' column='1'/>
+          <var-decl name='is_kmalloc' type-id='b50a4934' visibility='default' filepath='include/linux/kasan.h' line='138' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='c01f4982'>
@@ -83955,6 +85494,7 @@
       <pointer-type-def type-id='5c44a483' size-in-bits='64' id='c23646a3'/>
       <pointer-type-def type-id='fb8e936d' size-in-bits='64' id='c237e829'/>
       <pointer-type-def type-id='a92634ba' size-in-bits='64' id='c23b3cbc'/>
+      <pointer-type-def type-id='cb9a8514' size-in-bits='64' id='c23fc09a'/>
       <pointer-type-def type-id='35210e5c' size-in-bits='64' id='c24523fe'/>
       <pointer-type-def type-id='38cc1773' size-in-bits='64' id='c248c11b'/>
       <pointer-type-def type-id='8838d802' size-in-bits='64' id='c249b570'/>
@@ -84437,6 +85977,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='112801a2' size-in-bits='64' id='c32a771c'/>
+      <typedef-decl name='irq_write_msi_msg_t' type-id='09f0b23a' filepath='include/linux/msi.h' line='29' column='1' id='c335ba2b'/>
       <function-type size-in-bits='64' id='c33808e6'>
         <parameter type-id='8898134d'/>
         <parameter type-id='e68e04c1'/>
@@ -84769,6 +86310,47 @@
         <parameter type-id='a84c031d'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <class-decl name='inet_cork' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/net/inet_sock.h' line='150' column='1' id='c466cd59'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='include/net/inet_sock.h' line='151' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='addr' type-id='78a133c2' visibility='default' filepath='include/net/inet_sock.h' line='152' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='opt' type-id='57b94931' visibility='default' filepath='include/net/inet_sock.h' line='153' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='fragsize' type-id='f0981eeb' visibility='default' filepath='include/net/inet_sock.h' line='154' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='160'>
+          <var-decl name='length' type-id='95e97e5e' visibility='default' filepath='include/net/inet_sock.h' line='155' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='dst' type-id='141b6427' visibility='default' filepath='include/net/inet_sock.h' line='156' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='tx_flags' type-id='f9b06939' visibility='default' filepath='include/net/inet_sock.h' line='157' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='264'>
+          <var-decl name='ttl' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='158' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='272'>
+          <var-decl name='tos' type-id='b55def60' visibility='default' filepath='include/net/inet_sock.h' line='159' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='288'>
+          <var-decl name='priority' type-id='a84c031d' visibility='default' filepath='include/net/inet_sock.h' line='160' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='304'>
+          <var-decl name='gso_size' type-id='d315442e' visibility='default' filepath='include/net/inet_sock.h' line='161' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='transmit_time' type-id='91ce1af9' visibility='default' filepath='include/net/inet_sock.h' line='162' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='mark' type-id='19c2251e' visibility='default' filepath='include/net/inet_sock.h' line='163' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='blk_zone' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/uapi/linux/blkzoned.h' line='106' column='1' id='c46c1f27'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='start' type-id='d3130597' visibility='default' filepath='include/uapi/linux/blkzoned.h' line='107' column='1'/>
@@ -86405,6 +87987,7 @@
         </data-member>
       </union-decl>
       <pointer-type-def type-id='5081ed08' size-in-bits='64' id='c77a71ce'/>
+      <pointer-type-def type-id='24ada124' size-in-bits='64' id='c786c422'/>
       <function-type size-in-bits='64' id='c7873973'>
         <parameter type-id='a2bff676'/>
         <parameter type-id='13103032'/>
@@ -87256,6 +88839,11 @@
         <parameter type-id='11f4a000'/>
         <return type-id='84a5c3d4'/>
       </function-type>
+      <enum-decl name='profile_type' filepath='include/linux/profile.h' line='35' column='1' id='ca54968e'>
+        <underlying-type type-id='9cac1fee'/>
+        <enumerator name='PROFILE_TASK_EXIT' value='0'/>
+        <enumerator name='PROFILE_MUNMAP' value='1'/>
+      </enum-decl>
       <class-decl name='snd_soc_dobj_widget' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/sound/soc-topology.h' line='59' column='1' id='ca569b91'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='kcontrol_type' type-id='f0981eeb' visibility='default' filepath='include/sound/soc-topology.h' line='60' column='1'/>
@@ -87661,7 +89249,7 @@
         <parameter type-id='8bff8096'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <enum-decl name='ethtool_phys_id_state' filepath='include/linux/ethtool.h' line='55' column='1' id='cb317f38'>
+      <enum-decl name='ethtool_phys_id_state' filepath='include/linux/ethtool.h' line='51' column='1' id='cb317f38'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='ETHTOOL_ID_INACTIVE' value='0'/>
         <enumerator name='ETHTOOL_ID_ACTIVE' value='1'/>
@@ -87849,6 +89437,7 @@
           <var-decl name='data' type-id='eaa32e2f' visibility='default' filepath='include/net/xfrm.h' line='262' column='1'/>
         </data-member>
       </class-decl>
+      <qualified-type-def type-id='fccb029f' const='yes' id='cb9a8514'/>
       <pointer-type-def type-id='79a9ff6f' size-in-bits='64' id='cb9cd99f'/>
       <pointer-type-def type-id='c9196d18' size-in-bits='64' id='cba10b6e'/>
       <pointer-type-def type-id='4b7a84f4' size-in-bits='64' id='cba114b6'/>
@@ -88941,6 +90530,101 @@
       </function-type>
       <pointer-type-def type-id='84730732' size-in-bits='64' id='ceacf83c'/>
       <pointer-type-def type-id='98985516' size-in-bits='64' id='cead4188'/>
+      <class-decl name='inet_sock' size-in-bits='8384' is-struct='yes' visibility='default' filepath='include/net/inet_sock.h' line='195' column='1' id='cec16d30'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='sk' type-id='a240f41d' visibility='default' filepath='include/net/inet_sock.h' line='197' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6720'>
+          <var-decl name='pinet6' type-id='6d320b83' visibility='default' filepath='include/net/inet_sock.h' line='199' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6784'>
+          <var-decl name='inet_saddr' type-id='78a133c2' visibility='default' filepath='include/net/inet_sock.h' line='207' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6816'>
+          <var-decl name='uc_ttl' type-id='b55def60' visibility='default' filepath='include/net/inet_sock.h' line='208' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6832'>
+          <var-decl name='cmsg_flags' type-id='d315442e' visibility='default' filepath='include/net/inet_sock.h' line='209' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6848'>
+          <var-decl name='inet_sport' type-id='84a5c3d4' visibility='default' filepath='include/net/inet_sock.h' line='210' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6864'>
+          <var-decl name='inet_id' type-id='d315442e' visibility='default' filepath='include/net/inet_sock.h' line='211' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6912'>
+          <var-decl name='inet_opt' type-id='70119ea2' visibility='default' filepath='include/net/inet_sock.h' line='213' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6976'>
+          <var-decl name='rx_dst_ifindex' type-id='95e97e5e' visibility='default' filepath='include/net/inet_sock.h' line='214' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7008'>
+          <var-decl name='tos' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='215' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7016'>
+          <var-decl name='min_ttl' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='216' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7024'>
+          <var-decl name='mc_ttl' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='217' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7032'>
+          <var-decl name='pmtudisc' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='218' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='recverr' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='219' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1'>
+          <var-decl name='is_icsk' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='220' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='freebind' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='221' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3'>
+          <var-decl name='hdrincl' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='222' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='4'>
+          <var-decl name='mc_loop' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='223' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='transparent' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='224' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='mc_all' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='225' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='nodefrag' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='226' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bind_address_no_port' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='227' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1'>
+          <var-decl name='recverr_rfc4884' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='228' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='defer_connect' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='229' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7056'>
+          <var-decl name='rcv_tos' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='233' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7064'>
+          <var-decl name='convert_csum' type-id='8f048e17' visibility='default' filepath='include/net/inet_sock.h' line='234' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7072'>
+          <var-decl name='uc_index' type-id='95e97e5e' visibility='default' filepath='include/net/inet_sock.h' line='235' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7104'>
+          <var-decl name='mc_index' type-id='95e97e5e' visibility='default' filepath='include/net/inet_sock.h' line='236' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7136'>
+          <var-decl name='mc_addr' type-id='78a133c2' visibility='default' filepath='include/net/inet_sock.h' line='237' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7168'>
+          <var-decl name='mc_list' type-id='b49efd08' visibility='default' filepath='include/net/inet_sock.h' line='238' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7232'>
+          <var-decl name='cork' type-id='da785a0b' visibility='default' filepath='include/net/inet_sock.h' line='239' column='1'/>
+        </data-member>
+      </class-decl>
       <array-type-def dimensions='1' type-id='72a973b7' size-in-bits='49600' id='cec4db9b'>
         <subrange length='31' type-id='7ff19f0f' id='ae5e1d19'/>
       </array-type-def>
@@ -89375,6 +91059,10 @@
         <parameter type-id='eaa32e2f'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <function-type size-in-bits='64' id='cfa1a37d'>
+        <parameter type-id='88146159'/>
+        <return type-id='95e97e5e'/>
+      </function-type>
       <qualified-type-def type-id='63b6be81' const='yes' id='cfa9604e'/>
       <function-type size-in-bits='64' id='cfb839d2'>
         <parameter type-id='db362995' name='pdev'/>
@@ -90348,6 +92036,12 @@
         <parameter type-id='77e79a4b'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <function-type size-in-bits='64' id='d23b37cf'>
+        <parameter type-id='f772df6d'/>
+        <parameter type-id='19c2251e'/>
+        <return type-id='f0981eeb'/>
+      </function-type>
+      <pointer-type-def type-id='1ec1e54d' size-in-bits='64' id='d23c2125'/>
       <function-type size-in-bits='64' id='d2460aa5'>
         <parameter type-id='22be78e8'/>
         <parameter type-id='b50a4934'/>
@@ -90400,6 +92094,44 @@
           <var-decl name='release' type-id='afb80c18' visibility='default' filepath='include/media/media-request.h' line='252' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='usb_cdc_ncm_ntb_parameters' size-in-bits='224' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='319' column='1' id='d26727c9'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='wLength' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='320' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bmNtbFormatsSupported' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='321' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='dwNtbInMaxSize' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='322' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='wNdpInDivisor' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='323' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='80'>
+          <var-decl name='wNdpInPayloadRemainder' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='324' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='96'>
+          <var-decl name='wNdpInAlignment' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='325' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='112'>
+          <var-decl name='wPadding1' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='326' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='dwNtbOutMaxSize' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='327' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='160'>
+          <var-decl name='wNdpOutDivisor' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='328' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='176'>
+          <var-decl name='wNdpOutPayloadRemainder' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='329' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='wNdpOutAlignment' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='330' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='208'>
+          <var-decl name='wNtbOutMaxDatagrams' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='331' column='1'/>
+        </data-member>
+      </class-decl>
       <function-type size-in-bits='64' id='d26d2ca4'>
         <parameter type-id='b7c1d7d5'/>
         <parameter type-id='95e97e5e'/>
@@ -90415,6 +92147,20 @@
         <enumerator name='ZONE_MOVABLE' value='2'/>
         <enumerator name='__MAX_NR_ZONES' value='3'/>
       </enum-decl>
+      <class-decl name='usb_cdc_header_desc' size-in-bits='40' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='63' column='1' id='d285082e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='64' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='65' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='66' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bcdCDC' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='68' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='435002d4' size-in-bits='64' id='d287fe92'/>
       <enum-decl name='usb_dr_mode' filepath='include/linux/usb/otg.h' line='118' column='1' id='d291aaf1'>
         <underlying-type type-id='9cac1fee'/>
@@ -90629,6 +92375,50 @@
           <var-decl name='hentry' type-id='03a4a074' visibility='default' filepath='kernel/workqueue_internal.h' line='28' column='1'/>
         </data-member>
       </union-decl>
+      <class-decl name='inet_connection_sock_af_ops' size-in-bits='768' is-struct='yes' visibility='default' filepath='include/net/inet_connection_sock.h' line='35' column='1' id='d334c4a2'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='queue_xmit' type-id='52980ce4' visibility='default' filepath='include/net/inet_connection_sock.h' line='36' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='send_check' type-id='765eef68' visibility='default' filepath='include/net/inet_connection_sock.h' line='37' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='rebuild_header' type-id='55530c47' visibility='default' filepath='include/net/inet_connection_sock.h' line='38' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='sk_rx_dst_set' type-id='b087f139' visibility='default' filepath='include/net/inet_connection_sock.h' line='39' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='conn_request' type-id='a0f5247f' visibility='default' filepath='include/net/inet_connection_sock.h' line='40' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='syn_recv_sock' type-id='8aa28e29' visibility='default' filepath='include/net/inet_connection_sock.h' line='41' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='net_header_len' type-id='1dc6a898' visibility='default' filepath='include/net/inet_connection_sock.h' line='46' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='400'>
+          <var-decl name='net_frag_header_len' type-id='1dc6a898' visibility='default' filepath='include/net/inet_connection_sock.h' line='47' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='416'>
+          <var-decl name='sockaddr_len' type-id='1dc6a898' visibility='default' filepath='include/net/inet_connection_sock.h' line='48' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='setsockopt' type-id='df9e6665' visibility='default' filepath='include/net/inet_connection_sock.h' line='49' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='getsockopt' type-id='e0fadd76' visibility='default' filepath='include/net/inet_connection_sock.h' line='51' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='576'>
+          <var-decl name='addr2sockaddr' type-id='d9587521' visibility='default' filepath='include/net/inet_connection_sock.h' line='53' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='mtu_reduced' type-id='841969d0' visibility='default' filepath='include/net/inet_connection_sock.h' line='54' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='704'>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/inet_connection_sock.h' line='56' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='b276f0c8' size-in-bits='64' id='d33d33c6'/>
       <function-type size-in-bits='64' id='d34384db'>
         <parameter type-id='c67366c7'/>
@@ -90839,6 +92629,23 @@
       <pointer-type-def type-id='0ad12489' size-in-bits='64' id='d3769ffd'/>
       <pointer-type-def type-id='4dedc1bb' size-in-bits='64' id='d379869f'/>
       <pointer-type-def type-id='08dd4249' size-in-bits='64' id='d37a2705'/>
+      <class-decl name='usb_cdc_union_desc' size-in-bits='40' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='101' column='1' id='d37cd54e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='102' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='103' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='104' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bMasterInterface0' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='106' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='bSlaveInterface0' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='107' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='7e8ddfae' size-in-bits='64' id='d3807eb0'/>
       <function-type size-in-bits='64' id='d385bfac'>
         <parameter type-id='b9af02c3'/>
@@ -90985,6 +92792,7 @@
       </function-type>
       <pointer-type-def type-id='d51b5be7' size-in-bits='64' id='d3ffb002'/>
       <pointer-type-def type-id='c763c2ea' size-in-bits='64' id='d407a0d4'/>
+      <pointer-type-def type-id='03e12711' size-in-bits='64' id='d4145729'/>
       <function-type size-in-bits='64' id='d425ee50'>
         <parameter type-id='e27a9d68'/>
         <parameter type-id='8d4f223b'/>
@@ -90992,12 +92800,12 @@
         <parameter type-id='59cc1ae8'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='ethtool_pause_stats' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='261' column='1' id='d4287147'>
+      <class-decl name='ethtool_pause_stats' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/ethtool.h' line='257' column='1' id='d4287147'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='tx_pause_frames' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='262' column='1'/>
+          <var-decl name='tx_pause_frames' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='258' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='rx_pause_frames' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='263' column='1'/>
+          <var-decl name='rx_pause_frames' type-id='91ce1af9' visibility='default' filepath='include/linux/ethtool.h' line='259' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='9bcc816e' size-in-bits='64' id='d42add34'/>
@@ -91502,6 +93310,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='41d01802' size-in-bits='64' id='d5349744'/>
+      <pointer-type-def type-id='1251126e' size-in-bits='64' id='d535b874'/>
       <pointer-type-def type-id='0742eda5' size-in-bits='64' id='d53c2eb5'/>
       <class-decl name='blk_mq_debugfs_attr' size-in-bits='320' is-struct='yes' visibility='default' filepath='block/blk-mq-debugfs.h' line='9' column='1' id='d53ee986'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -91727,6 +93536,7 @@
         <parameter type-id='eea6b025'/>
         <return type-id='48b5725f'/>
       </function-type>
+      <pointer-type-def type-id='bb75ea85' size-in-bits='64' id='d5df7665'/>
       <pointer-type-def type-id='e3840c87' size-in-bits='64' id='d5dff457'/>
       <class-decl name='genpd_power_state' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/linux/pm_domain.h' line='94' column='1' id='d5e6c299'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -92036,6 +93846,7 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/media/v4l2-ctrls.h' line='395' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='64705f1a' size-in-bits='64' id='d6184118'/>
       <class-decl name='deferred_split' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/mmzone.h' line='714' column='1' id='d619c1c5'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='split_queue_lock' type-id='fb4018a0' visibility='default' filepath='include/linux/mmzone.h' line='715' column='1'/>
@@ -93147,6 +94958,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='50fab010' size-in-bits='64' id='d9481436'/>
+      <pointer-type-def type-id='dae66efd' size-in-bits='64' id='d9587521'/>
       <enum-decl name='usb_phy_type' filepath='include/linux/usb/phy.h' line='37' column='1' id='d95f4827'>
         <underlying-type type-id='9cac1fee'/>
         <enumerator name='USB_PHY_TYPE_UNDEFINED' value='0'/>
@@ -93688,6 +95500,14 @@
         <parameter type-id='b11825ce'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <class-decl name='inet_cork_full' size-in-bits='1152' is-struct='yes' visibility='default' filepath='include/net/inet_sock.h' line='166' column='1' id='da785a0b'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='base' type-id='c466cd59' visibility='default' filepath='include/net/inet_sock.h' line='167' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='fl' type-id='2117397c' visibility='default' filepath='include/net/inet_sock.h' line='168' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='a38d6c05' size-in-bits='64' id='da81d789'/>
       <class-decl name='nd_mapping_desc' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/libnvdimm.h' line='110' column='1' id='da878766'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -93796,6 +95616,11 @@
         <subrange length='38' type-id='7ff19f0f' id='aa4ccdac'/>
       </array-type-def>
       <pointer-type-def type-id='2a275b06' size-in-bits='64' id='dae07608'/>
+      <function-type size-in-bits='64' id='dae66efd'>
+        <parameter type-id='f772df6d'/>
+        <parameter type-id='5c0abad8'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <pointer-type-def type-id='e0d04bd9' size-in-bits='64' id='dae78f89'/>
       <pointer-type-def type-id='036e1e80' size-in-bits='64' id='daf2ec26'/>
       <typedef-decl name='sigset_t' type-id='e6ea37b8' filepath='include/uapi/asm-generic/signal.h' line='63' column='1' id='daf33c64'/>
@@ -95316,6 +97141,18 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <class-decl name='printk_ringbuffer' is-struct='yes' visibility='default' is-declaration-only='yes' id='dce1125a'/>
+      <pointer-type-def type-id='a400949a' size-in-bits='64' id='dcea1110'/>
+      <class-decl name='ipv6_ac_socklist' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/net/if_inet6.h' line='134' column='1' id='dcf61f1a'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='acl_addr' type-id='f6ed712a' visibility='default' filepath='include/net/if_inet6.h' line='135' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='acl_ifindex' type-id='95e97e5e' visibility='default' filepath='include/net/if_inet6.h' line='136' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='acl_next' type-id='0d2afef8' visibility='default' filepath='include/net/if_inet6.h' line='137' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='__kernel_timex' size-in-bits='1664' is-struct='yes' visibility='default' filepath='include/uapi/linux/timex.h' line='102' column='1' id='dcf7564a'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='modes' type-id='f0981eeb' visibility='default' filepath='include/uapi/linux/timex.h' line='103' column='1'/>
@@ -95936,6 +97773,9 @@
           <var-decl name='can_sleep' type-id='b50a4934' visibility='default' filepath='drivers/base/regmap/internal.h' line='166' column='1'/>
         </data-member>
       </class-decl>
+      <array-type-def dimensions='1' type-id='9a1ac43a' size-in-bits='192' id='ddf292bf'>
+        <subrange length='3' type-id='7ff19f0f' id='56f209d2'/>
+      </array-type-def>
       <pointer-type-def type-id='364c344e' size-in-bits='64' id='ddf6796c'/>
       <pointer-type-def type-id='f1828bdc' size-in-bits='64' id='ddfb71fa'/>
       <union-decl name='__anonymous_union__' size-in-bits='32' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/bpf.h' line='603' column='1' id='de021eb5'>
@@ -95957,6 +97797,17 @@
       </union-decl>
       <class-decl name='mnt_namespace' is-struct='yes' visibility='default' is-declaration-only='yes' id='de031042'/>
       <pointer-type-def type-id='32ea5aae' size-in-bits='64' id='de0565b8'/>
+      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/tcp.h' line='380' column='1' id='de05ad5f'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='space' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='381' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='382' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='time' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='383' column='1'/>
+        </data-member>
+      </class-decl>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/cgroup-defs.h' line='791' column='1' id='de05b94c'>
         <data-member access='public'>
           <var-decl name='' type-id='16b0d6e5' visibility='default' filepath='include/linux/cgroup-defs.h' line='793' column='1'/>
@@ -96031,6 +97882,25 @@
       <pointer-type-def type-id='77fe651f' size-in-bits='64' id='de5dab7b'/>
       <pointer-type-def type-id='fad8dcd1' size-in-bits='64' id='de63df21'/>
       <qualified-type-def type-id='a81e67e2' const='yes' id='de640095'/>
+      <function-type size-in-bits='64' id='de66d1aa'>
+        <parameter type-id='73789784'/>
+        <parameter type-id='b50a4934'/>
+        <return type-id='48b5725f'/>
+      </function-type>
+      <class-decl name='usb_class_driver' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/usb.h' line='1302' column='1' id='de68658d'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='name' type-id='26a90f95' visibility='default' filepath='include/linux/usb.h' line='1303' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='devnode' type-id='8cd77b5f' visibility='default' filepath='include/linux/usb.h' line='1304' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='fops' type-id='61758ee5' visibility='default' filepath='include/linux/usb.h' line='1305' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='minor_base' type-id='95e97e5e' visibility='default' filepath='include/linux/usb.h' line='1306' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='e85fe596' size-in-bits='64' id='de6b64d0'/>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/uapi/linux/perf_event.h' line='334' column='1' id='de6d2b01'>
         <data-member access='public'>
@@ -96096,6 +97966,8 @@
           <var-decl name='a' type-id='f22a8abb' visibility='default' filepath='include/asm-generic/local.h' line='24' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='e3aee705' size-in-bits='64' id='de885ea5'/>
+      <pointer-type-def type-id='d23b37cf' size-in-bits='64' id='de90632b'/>
       <qualified-type-def type-id='807869d3' const='yes' id='de9ce8e8'/>
       <function-type size-in-bits='64' id='dea13b10'>
         <parameter type-id='7544e824'/>
@@ -96879,6 +98751,9 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='b0f27198' size-in-bits='64' id='e0677422'/>
+      <array-type-def dimensions='1' type-id='85938ec6' size-in-bits='infinite' id='e06f4fa6'>
+        <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
+      </array-type-def>
       <function-type size-in-bits='64' id='e070d395'>
         <parameter type-id='27f3f5d8'/>
         <parameter type-id='cf29c9b3'/>
@@ -98155,6 +100030,9 @@
       <class-decl name='seccomp_filter' is-struct='yes' visibility='default' is-declaration-only='yes' id='e290c28c'/>
       <pointer-type-def type-id='e4dc0de6' size-in-bits='64' id='e2929c1c'/>
       <pointer-type-def type-id='d802bf72' size-in-bits='64' id='e295c77c'/>
+      <array-type-def dimensions='1' type-id='b197d821' size-in-bits='64' id='e2982e38'>
+        <subrange length='1' type-id='7ff19f0f' id='52f813b4'/>
+      </array-type-def>
       <function-type size-in-bits='64' id='e29a2892'>
         <parameter type-id='7a29ff27'/>
         <parameter type-id='7a29ff27'/>
@@ -98554,6 +100432,419 @@
           <var-decl name='node_list' type-id='72f469ec' visibility='default' filepath='include/linux/plist.h' line='86' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='tcp_sock' size-in-bits='18752' is-struct='yes' visibility='default' filepath='include/linux/tcp.h' line='146' column='1' id='e3aee705'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='inet_conn' type-id='2a0babad' visibility='default' filepath='include/linux/tcp.h' line='148' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12096'>
+          <var-decl name='tcp_header_len' type-id='1dc6a898' visibility='default' filepath='include/linux/tcp.h' line='149' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12112'>
+          <var-decl name='gso_segs' type-id='1dc6a898' visibility='default' filepath='include/linux/tcp.h' line='150' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12128'>
+          <var-decl name='pred_flags' type-id='78a133c2' visibility='default' filepath='include/linux/tcp.h' line='156' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12160'>
+          <var-decl name='bytes_received' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='163' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12224'>
+          <var-decl name='segs_in' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='167' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12256'>
+          <var-decl name='data_segs_in' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='170' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12288'>
+          <var-decl name='rcv_nxt' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='173' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12320'>
+          <var-decl name='copied_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='174' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12352'>
+          <var-decl name='rcv_wup' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='175' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12384'>
+          <var-decl name='snd_nxt' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='176' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12416'>
+          <var-decl name='segs_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='177' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12448'>
+          <var-decl name='data_segs_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='180' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12480'>
+          <var-decl name='bytes_sent' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='183' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12544'>
+          <var-decl name='bytes_acked' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='186' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12608'>
+          <var-decl name='dsack_dups' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='190' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12640'>
+          <var-decl name='snd_una' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='193' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12672'>
+          <var-decl name='snd_sml' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='194' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12704'>
+          <var-decl name='rcv_tstamp' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='195' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12736'>
+          <var-decl name='lsndtime' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='196' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12768'>
+          <var-decl name='last_oow_ack_time' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='197' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12800'>
+          <var-decl name='compressed_ack_rcv_nxt' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='198' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12832'>
+          <var-decl name='tsoffset' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='200' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12864'>
+          <var-decl name='tsq_node' type-id='72f469ec' visibility='default' filepath='include/linux/tcp.h' line='202' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='12992'>
+          <var-decl name='tsorted_sent_queue' type-id='72f469ec' visibility='default' filepath='include/linux/tcp.h' line='203' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13120'>
+          <var-decl name='snd_wl1' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='205' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13152'>
+          <var-decl name='snd_wnd' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='206' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13184'>
+          <var-decl name='max_window' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='207' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13216'>
+          <var-decl name='mss_cache' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='208' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13248'>
+          <var-decl name='window_clamp' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='210' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13280'>
+          <var-decl name='rcv_ssthresh' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='211' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13312'>
+          <var-decl name='rack' type-id='682f92a2' visibility='default' filepath='include/linux/tcp.h' line='224' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13504'>
+          <var-decl name='advmss' type-id='1dc6a898' visibility='default' filepath='include/linux/tcp.h' line='225' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13520'>
+          <var-decl name='compressed_ack' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='226' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='dup_ack_counter' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='227' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='tlp_retrans' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='228' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3'>
+          <var-decl name='unused' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='229' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13536'>
+          <var-decl name='chrono_start' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='230' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13568'>
+          <var-decl name='chrono_stat' type-id='1c745afe' visibility='default' filepath='include/linux/tcp.h' line='231' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='chrono_type' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='232' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='rate_app_limited' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='233' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3'>
+          <var-decl name='fastopen_connect' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='234' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='4'>
+          <var-decl name='fastopen_no_cookie' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='235' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='is_sack_reneg' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='236' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='fastopen_client_fail' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='237' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='nonagle' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='238' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='4'>
+          <var-decl name='thin_lto' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='239' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='recvmsg_inq' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='240' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='repair' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='241' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='frto' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='242' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13680'>
+          <var-decl name='repair_queue' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='243' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='save_syn' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='244' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='syn_data' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='245' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3'>
+          <var-decl name='syn_fastopen' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='246' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='4'>
+          <var-decl name='syn_fastopen_exp' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='247' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='syn_fastopen_ch' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='248' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='6'>
+          <var-decl name='syn_data_acked' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='249' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='7'>
+          <var-decl name='is_cwnd_limited' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='250' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13696'>
+          <var-decl name='tlp_high_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='251' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13728'>
+          <var-decl name='tcp_tx_delay' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='253' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13760'>
+          <var-decl name='tcp_wstamp_ns' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='254' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13824'>
+          <var-decl name='tcp_clock_cache' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='255' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13888'>
+          <var-decl name='tcp_mstamp' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='258' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13952'>
+          <var-decl name='srtt_us' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='259' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='13984'>
+          <var-decl name='mdev_us' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='260' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14016'>
+          <var-decl name='mdev_max_us' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='261' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14048'>
+          <var-decl name='rttvar_us' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='262' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14080'>
+          <var-decl name='rtt_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='263' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14112'>
+          <var-decl name='rtt_min' type-id='0df12a77' visibility='default' filepath='include/linux/tcp.h' line='264' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14304'>
+          <var-decl name='packets_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='266' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14336'>
+          <var-decl name='retrans_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='267' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14368'>
+          <var-decl name='max_packets_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='268' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14400'>
+          <var-decl name='max_packets_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='269' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14432'>
+          <var-decl name='urg_data' type-id='1dc6a898' visibility='default' filepath='include/linux/tcp.h' line='271' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14448'>
+          <var-decl name='ecn_flags' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='272' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14456'>
+          <var-decl name='keepalive_probes' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='273' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14464'>
+          <var-decl name='reordering' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='274' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14496'>
+          <var-decl name='reord_seen' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='275' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14528'>
+          <var-decl name='snd_up' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='276' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14560'>
+          <var-decl name='rx_opt' type-id='08f80c5d' visibility='default' filepath='include/linux/tcp.h' line='281' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14752'>
+          <var-decl name='snd_ssthresh' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='286' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14784'>
+          <var-decl name='snd_cwnd' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='287' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14816'>
+          <var-decl name='snd_cwnd_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='288' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14848'>
+          <var-decl name='snd_cwnd_clamp' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='289' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14880'>
+          <var-decl name='snd_cwnd_used' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='290' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14912'>
+          <var-decl name='snd_cwnd_stamp' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='291' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14944'>
+          <var-decl name='prior_cwnd' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='292' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='14976'>
+          <var-decl name='prr_delivered' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='293' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15008'>
+          <var-decl name='prr_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='295' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15040'>
+          <var-decl name='delivered' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='296' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15072'>
+          <var-decl name='delivered_ce' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='297' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15104'>
+          <var-decl name='lost' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='298' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15136'>
+          <var-decl name='app_limited' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='299' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15168'>
+          <var-decl name='first_tx_mstamp' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='300' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15232'>
+          <var-decl name='delivered_mstamp' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='301' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15296'>
+          <var-decl name='rate_delivered' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='302' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15328'>
+          <var-decl name='rate_interval_us' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='303' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15360'>
+          <var-decl name='rcv_wnd' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='305' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15392'>
+          <var-decl name='write_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='306' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15424'>
+          <var-decl name='notsent_lowat' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='307' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15456'>
+          <var-decl name='pushed_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='308' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15488'>
+          <var-decl name='lost_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='309' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15520'>
+          <var-decl name='sacked_out' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='310' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='15552'>
+          <var-decl name='pacing_timer' type-id='b6993efc' visibility='default' filepath='include/linux/tcp.h' line='312' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16128'>
+          <var-decl name='compressed_ack_timer' type-id='b6993efc' visibility='default' filepath='include/linux/tcp.h' line='313' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16704'>
+          <var-decl name='lost_skb_hint' type-id='0fbf3cfd' visibility='default' filepath='include/linux/tcp.h' line='316' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16768'>
+          <var-decl name='retransmit_skb_hint' type-id='0fbf3cfd' visibility='default' filepath='include/linux/tcp.h' line='317' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16832'>
+          <var-decl name='out_of_order_queue' type-id='dec44472' visibility='default' filepath='include/linux/tcp.h' line='320' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16896'>
+          <var-decl name='ooo_last_skb' type-id='0fbf3cfd' visibility='default' filepath='include/linux/tcp.h' line='321' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16960'>
+          <var-decl name='duplicate_sack' type-id='e2982e38' visibility='default' filepath='include/linux/tcp.h' line='324' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17024'>
+          <var-decl name='selective_acks' type-id='a68b03d1' visibility='default' filepath='include/linux/tcp.h' line='325' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17280'>
+          <var-decl name='recv_sack_cache' type-id='a68b03d1' visibility='default' filepath='include/linux/tcp.h' line='327' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17536'>
+          <var-decl name='highest_sack' type-id='0fbf3cfd' visibility='default' filepath='include/linux/tcp.h' line='329' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17600'>
+          <var-decl name='lost_cnt_hint' type-id='95e97e5e' visibility='default' filepath='include/linux/tcp.h' line='335' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17632'>
+          <var-decl name='prior_ssthresh' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='337' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17664'>
+          <var-decl name='high_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='338' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17696'>
+          <var-decl name='retrans_stamp' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='340' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17728'>
+          <var-decl name='undo_marker' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='343' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17760'>
+          <var-decl name='undo_retrans' type-id='95e97e5e' visibility='default' filepath='include/linux/tcp.h' line='344' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17792'>
+          <var-decl name='bytes_retrans' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='345' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17856'>
+          <var-decl name='total_retrans' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='348' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17888'>
+          <var-decl name='urg_seq' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='350' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17920'>
+          <var-decl name='keepalive_time' type-id='f0981eeb' visibility='default' filepath='include/linux/tcp.h' line='351' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17952'>
+          <var-decl name='keepalive_intvl' type-id='f0981eeb' visibility='default' filepath='include/linux/tcp.h' line='352' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='17984'>
+          <var-decl name='linger2' type-id='95e97e5e' visibility='default' filepath='include/linux/tcp.h' line='354' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18016'>
+          <var-decl name='bpf_sock_ops_cb_flags' type-id='f9b06939' visibility='default' filepath='include/linux/tcp.h' line='359' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18032'>
+          <var-decl name='timeout_rehash' type-id='1dc6a898' visibility='default' filepath='include/linux/tcp.h' line='367' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18048'>
+          <var-decl name='rcv_ooopack' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='369' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18080'>
+          <var-decl name='rcv_rtt_last_tsecr' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='372' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18112'>
+          <var-decl name='rcv_rtt_est' type-id='be7d4e1c' visibility='default' filepath='include/linux/tcp.h' line='377' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18240'>
+          <var-decl name='rcvq_space' type-id='de05ad5f' visibility='default' filepath='include/linux/tcp.h' line='384' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18368'>
+          <var-decl name='mtu_probe' type-id='b80da08c' visibility='default' filepath='include/linux/tcp.h' line='390' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18432'>
+          <var-decl name='mtu_info' type-id='19c2251e' visibility='default' filepath='include/linux/tcp.h' line='391' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18496'>
+          <var-decl name='fastopen_req' type-id='6499ab7d' visibility='default' filepath='include/linux/tcp.h' line='410' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18560'>
+          <var-decl name='fastopen_rsk' type-id='94c948ef' visibility='default' filepath='include/linux/tcp.h' line='414' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18624'>
+          <var-decl name='saved_syn' type-id='be9aaa19' visibility='default' filepath='include/linux/tcp.h' line='415' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='18688'>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/tcp.h' line='417' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='9a25f4b0' size-in-bits='64' id='e3ba02e6'/>
       <pointer-type-def type-id='1c590219' size-in-bits='64' id='e3be65f1'/>
       <function-type size-in-bits='64' id='e3d2455d'>
@@ -100587,6 +102878,7 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='72c0e160' size-in-bits='64' id='e90f4666'/>
+      <pointer-type-def type-id='55fcdb4f' size-in-bits='64' id='e90fa847'/>
       <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/linux/uio.h' line='44' column='1' id='e91837c2'>
         <data-member access='public'>
           <var-decl name='nr_segs' type-id='7359adad' visibility='default' filepath='include/linux/uio.h' line='45' column='1'/>
@@ -100901,6 +103193,7 @@
           <var-decl name='fb_helper' type-id='147b8c0a' visibility='default' filepath='include/drm/drm_device.h' line='330' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='1ca42ff9' size-in-bits='64' id='e9774929'/>
       <pointer-type-def type-id='9f9e2614' size-in-bits='64' id='e9803536'/>
       <function-type size-in-bits='64' id='e9855576'>
         <parameter type-id='77e79a4b'/>
@@ -100997,6 +103290,7 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='8efea9e5' size-in-bits='64' id='e9e550dd'/>
+      <pointer-type-def type-id='fa12cc76' size-in-bits='64' id='e9e8c0f8'/>
       <class-decl name='__anonymous_struct__' size-in-bits='512' is-struct='yes' is-anonymous='yes' visibility='default' filepath='block/blk-mq.h' line='19' column='1' id='e9e9d685'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='block/blk-mq.h' line='20' column='1'/>
@@ -101963,66 +104257,66 @@
           <var-decl name='code' type-id='930ea9f9' visibility='default' filepath='include/drm/drm_edid.h' line='142' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='binder_transaction' size-in-bits='1408' is-struct='yes' visibility='default' filepath='drivers/android/binder_internal.h' line='547' column='1' id='ebce8e86'>
+      <class-decl name='binder_transaction' size-in-bits='1408' is-struct='yes' visibility='default' filepath='drivers/android/binder_internal.h' line='549' column='1' id='ebce8e86'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='debug_id' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='548' column='1'/>
+          <var-decl name='debug_id' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='550' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='work' type-id='ba2d75bf' visibility='default' filepath='drivers/android/binder_internal.h' line='549' column='1'/>
+          <var-decl name='work' type-id='ba2d75bf' visibility='default' filepath='drivers/android/binder_internal.h' line='551' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='from' type-id='dd695fa4' visibility='default' filepath='drivers/android/binder_internal.h' line='550' column='1'/>
+          <var-decl name='from' type-id='dd695fa4' visibility='default' filepath='drivers/android/binder_internal.h' line='552' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='from_parent' type-id='f4c3bb4c' visibility='default' filepath='drivers/android/binder_internal.h' line='551' column='1'/>
+          <var-decl name='from_parent' type-id='f4c3bb4c' visibility='default' filepath='drivers/android/binder_internal.h' line='553' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='to_proc' type-id='d1cf113c' visibility='default' filepath='drivers/android/binder_internal.h' line='552' column='1'/>
+          <var-decl name='to_proc' type-id='d1cf113c' visibility='default' filepath='drivers/android/binder_internal.h' line='554' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='to_thread' type-id='dd695fa4' visibility='default' filepath='drivers/android/binder_internal.h' line='553' column='1'/>
+          <var-decl name='to_thread' type-id='dd695fa4' visibility='default' filepath='drivers/android/binder_internal.h' line='555' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='to_parent' type-id='f4c3bb4c' visibility='default' filepath='drivers/android/binder_internal.h' line='554' column='1'/>
+          <var-decl name='to_parent' type-id='f4c3bb4c' visibility='default' filepath='drivers/android/binder_internal.h' line='556' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='need_reply' type-id='f0981eeb' visibility='default' filepath='drivers/android/binder_internal.h' line='555' column='1'/>
+          <var-decl name='need_reply' type-id='f0981eeb' visibility='default' filepath='drivers/android/binder_internal.h' line='557' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='buffer' type-id='5819e862' visibility='default' filepath='drivers/android/binder_internal.h' line='558' column='1'/>
+          <var-decl name='buffer' type-id='5819e862' visibility='default' filepath='drivers/android/binder_internal.h' line='560' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='code' type-id='f0981eeb' visibility='default' filepath='drivers/android/binder_internal.h' line='559' column='1'/>
+          <var-decl name='code' type-id='f0981eeb' visibility='default' filepath='drivers/android/binder_internal.h' line='561' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='736'>
-          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='drivers/android/binder_internal.h' line='560' column='1'/>
+          <var-decl name='flags' type-id='f0981eeb' visibility='default' filepath='drivers/android/binder_internal.h' line='562' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='priority' type-id='de30810e' visibility='default' filepath='drivers/android/binder_internal.h' line='561' column='1'/>
+          <var-decl name='priority' type-id='de30810e' visibility='default' filepath='drivers/android/binder_internal.h' line='563' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='saved_priority' type-id='de30810e' visibility='default' filepath='drivers/android/binder_internal.h' line='562' column='1'/>
+          <var-decl name='saved_priority' type-id='de30810e' visibility='default' filepath='drivers/android/binder_internal.h' line='564' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='set_priority_called' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='563' column='1'/>
+          <var-decl name='set_priority_called' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='565' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='928'>
-          <var-decl name='sender_euid' type-id='d80b72e6' visibility='default' filepath='drivers/android/binder_internal.h' line='564' column='1'/>
+          <var-decl name='sender_euid' type-id='d80b72e6' visibility='default' filepath='drivers/android/binder_internal.h' line='566' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='fd_fixups' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='565' column='1'/>
+          <var-decl name='fd_fixups' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='567' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='security_ctx' type-id='6867e656' visibility='default' filepath='drivers/android/binder_internal.h' line='566' column='1'/>
+          <var-decl name='security_ctx' type-id='6867e656' visibility='default' filepath='drivers/android/binder_internal.h' line='568' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/android/binder_internal.h' line='573' column='1'/>
+          <var-decl name='lock' type-id='fb4018a0' visibility='default' filepath='drivers/android/binder_internal.h' line='575' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='android_vendor_data1' type-id='91ce1af9' visibility='default' filepath='drivers/android/binder_internal.h' line='574' column='1'/>
+          <var-decl name='android_vendor_data1' type-id='91ce1af9' visibility='default' filepath='drivers/android/binder_internal.h' line='576' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='android_oem_data1' type-id='24a375b2' visibility='default' filepath='drivers/android/binder_internal.h' line='575' column='1'/>
+          <var-decl name='android_oem_data1' type-id='24a375b2' visibility='default' filepath='drivers/android/binder_internal.h' line='577' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='0f840455' size-in-bits='64' id='ebd313ed'/>
@@ -103001,9 +105295,24 @@
           <var-decl name='handler_priv' type-id='eaa32e2f' visibility='default' filepath='include/linux/mmc/host.h' line='257' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='5510bbdb' size-in-bits='64' id='edff578b'/>
       <function-type size-in-bits='64' id='ee076206'>
         <return type-id='48b5725f'/>
       </function-type>
+      <class-decl name='usb_cdc_ncm_ndp16' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='378' column='1' id='ee0d5fa1'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='dwSignature' type-id='2f162548' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='379' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='wLength' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='380' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='48'>
+          <var-decl name='wNextNdpIndex' type-id='23119536' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='381' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='dpe16' type-id='eff0206c' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='382' column='1'/>
+        </data-member>
+      </class-decl>
       <class-decl name='usb_os_desc_table' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/usb/composite.h' line='113' column='1' id='ee0eb9bb'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='if_id' type-id='95e97e5e' visibility='default' filepath='include/linux/usb/composite.h' line='114' column='1'/>
@@ -103367,6 +105676,7 @@
         <enumerator name='kernel_pkey_sign' value='2'/>
         <enumerator name='kernel_pkey_verify' value='3'/>
       </enum-decl>
+      <qualified-type-def type-id='0570fd5e' const='yes' id='eed1c4b9'/>
       <function-type size-in-bits='64' id='eed59d16'>
         <parameter type-id='8504f260'/>
         <parameter type-id='7292109c'/>
@@ -103469,6 +105779,20 @@
       <pointer-type-def type-id='3c2554e1' size-in-bits='64' id='ef2b6bf5'/>
       <pointer-type-def type-id='bab69d9a' size-in-bits='64' id='ef2b6ec8'/>
       <pointer-type-def type-id='e86b7946' size-in-bits='64' id='ef2f6230'/>
+      <class-decl name='devfreq_event_desc' size-in-bits='256' is-struct='yes' visibility='default' filepath='include/linux/devfreq-event.h' line='92' column='1' id='ef40f18b'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='name' type-id='80f4b756' visibility='default' filepath='include/linux/devfreq-event.h' line='93' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='event_type' type-id='19c2251e' visibility='default' filepath='include/linux/devfreq-event.h' line='94' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='driver_data' type-id='eaa32e2f' visibility='default' filepath='include/linux/devfreq-event.h' line='95' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='ops' type-id='e9774929' visibility='default' filepath='include/linux/devfreq-event.h' line='97' column='1'/>
+        </data-member>
+      </class-decl>
       <qualified-type-def type-id='744e4af5' const='yes' id='ef40fb12'/>
       <class-decl name='fib_notifier_ops' size-in-bits='512' is-struct='yes' visibility='default' filepath='include/net/fib_notifier.h' line='28' column='1' id='ef45f062'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -103643,8 +105967,25 @@
         <parameter type-id='eea6b025'/>
         <return type-id='4adb0e6a'/>
       </function-type>
+      <array-type-def dimensions='1' type-id='89981240' size-in-bits='infinite' id='eff0206c'>
+        <subrange length='infinite' type-id='7ff19f0f' id='031f2035'/>
+      </array-type-def>
       <pointer-type-def type-id='2a4c87c4' size-in-bits='64' id='eff2bbc2'/>
       <qualified-type-def type-id='928221d2' const='yes' id='effb3702'/>
+      <class-decl name='usb_cdc_acm_descriptor' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='85' column='1' id='f0029b4e'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='bLength' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='86' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='8'>
+          <var-decl name='bDescriptorType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='87' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='16'>
+          <var-decl name='bDescriptorSubType' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='88' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='24'>
+          <var-decl name='bmCapabilities' type-id='8f048e17' visibility='default' filepath='include/uapi/linux/usb/cdc.h' line='90' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='a9918a4d' size-in-bits='64' id='f0150b1d'/>
       <array-type-def dimensions='1' type-id='a84c031d' size-in-bits='112' id='f01a039e'>
         <subrange length='14' type-id='7ff19f0f' id='48882d96'/>
@@ -105155,6 +107496,14 @@
           <var-decl name='le_num_slave' type-id='f0981eeb' visibility='default' filepath='include/net/bluetooth/hci_core.h' line='124' column='1'/>
         </data-member>
       </class-decl>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/ipv6.h' line='321' column='1' id='f3980da2'>
+        <data-member access='public'>
+          <var-decl name='pid' type-id='b94e5398' visibility='default' filepath='include/net/ipv6.h' line='322' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='uid' type-id='d80b72e6' visibility='default' filepath='include/net/ipv6.h' line='323' column='1'/>
+        </data-member>
+      </union-decl>
       <pointer-type-def type-id='98fc5aa2' size-in-bits='64' id='f3a16a60'/>
       <class-decl name='mdio_device' size-in-bits='7936' is-struct='yes' visibility='default' filepath='include/linux/mdio.h' line='34' column='1' id='f3a32dbb'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -106150,6 +108499,10 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <pointer-type-def type-id='f24c165e' size-in-bits='64' id='f681f934'/>
+      <function-type size-in-bits='64' id='f6898056'>
+        <parameter type-id='78e7cf52'/>
+        <return type-id='b59d7dce'/>
+      </function-type>
       <pointer-type-def type-id='8422a42a' size-in-bits='64' id='f68ddecc'/>
       <class-decl name='rhash_head' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/rhashtable-types.h' line='17' column='1' id='f68e0adc'>
         <data-member access='public' layout-offset-in-bits='0'>
@@ -106202,6 +108555,11 @@
           <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/linux/pci-epc.h' line='65' column='1'/>
         </data-member>
       </class-decl>
+      <function-type size-in-bits='64' id='f69f6d0e'>
+        <parameter type-id='f772df6d'/>
+        <parameter type-id='0fbf3cfd'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <pointer-type-def type-id='5ea5a07d' size-in-bits='64' id='f69fcfe1'/>
       <pointer-type-def type-id='d1043097' size-in-bits='64' id='f6a079db'/>
       <class-decl name='alarm' size-in-bits='1024' is-struct='yes' visibility='default' filepath='include/linux/alarmtimer.h' line='42' column='1' id='f6b32752'>
@@ -107500,6 +109858,12 @@
         <subrange length='8' type-id='7ff19f0f' id='56e0c0b1'/>
       </array-type-def>
       <pointer-type-def type-id='9a9cf0bf' size-in-bits='64' id='fa0eba8f'/>
+      <function-type size-in-bits='64' id='fa12cc76'>
+        <parameter type-id='94f8595c'/>
+        <parameter type-id='f772df6d'/>
+        <parameter type-id='96d7cfec'/>
+        <return type-id='48b5725f'/>
+      </function-type>
       <class-decl name='drm_mode_config_helper_funcs' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/drm/drm_modeset_helper_vtables.h' line='1372' column='1' id='fa206174'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='atomic_commit_tail' type-id='75795f13' visibility='default' filepath='include/drm/drm_modeset_helper_vtables.h' line='1408' column='1'/>
@@ -107563,6 +109927,56 @@
       <class-decl name='cec_pin' is-struct='yes' visibility='default' is-declaration-only='yes' id='fa296b96'/>
       <pointer-type-def type-id='29c8dc19' size-in-bits='64' id='fa32a449'/>
       <pointer-type-def type-id='c2603804' size-in-bits='64' id='fa35bf16'/>
+      <class-decl name='ip_options' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/net/inet_sock.h' line='39' column='1' id='fa35cea9'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='faddr' type-id='78a133c2' visibility='default' filepath='include/net/inet_sock.h' line='40' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='32'>
+          <var-decl name='nexthop' type-id='78a133c2' visibility='default' filepath='include/net/inet_sock.h' line='41' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='64'>
+          <var-decl name='optlen' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='42' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='72'>
+          <var-decl name='srr' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='43' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='80'>
+          <var-decl name='rr' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='44' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='88'>
+          <var-decl name='ts' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='45' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='is_strictroute' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='46' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1'>
+          <var-decl name='srr_is_hit' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='47' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='2'>
+          <var-decl name='is_changed' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='48' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='3'>
+          <var-decl name='rr_needaddr' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='49' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='4'>
+          <var-decl name='ts_needtime' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='50' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='5'>
+          <var-decl name='ts_needaddr' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='51' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='104'>
+          <var-decl name='router_alert' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='52' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='112'>
+          <var-decl name='cipso' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='53' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='120'>
+          <var-decl name='__pad2' type-id='002ac4a6' visibility='default' filepath='include/net/inet_sock.h' line='54' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='__data' type-id='5e6516ee' visibility='default' filepath='include/net/inet_sock.h' line='55' column='1'/>
+        </data-member>
+      </class-decl>
       <qualified-type-def type-id='f5f6e55e' const='yes' id='fa3724eb'/>
       <pointer-type-def type-id='7d43ac00' size-in-bits='64' id='fa3ed3a2'/>
       <pointer-type-def type-id='038d05bd' size-in-bits='64' id='fa43ef1d'/>
@@ -107664,99 +110078,99 @@
         <enumerator name='BPF_OFFLOAD_MAP_FREE' value='3'/>
         <enumerator name='XDP_SETUP_XSK_POOL' value='4'/>
       </enum-decl>
-      <class-decl name='binder_proc' size-in-bits='4800' is-struct='yes' visibility='default' filepath='drivers/android/binder_internal.h' line='439' column='1' id='fa674076'>
+      <class-decl name='binder_proc' size-in-bits='4800' is-struct='yes' visibility='default' filepath='drivers/android/binder_internal.h' line='441' column='1' id='fa674076'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='proc_node' type-id='03a4a074' visibility='default' filepath='drivers/android/binder_internal.h' line='440' column='1'/>
+          <var-decl name='proc_node' type-id='03a4a074' visibility='default' filepath='drivers/android/binder_internal.h' line='442' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='threads' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='441' column='1'/>
+          <var-decl name='threads' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='443' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='nodes' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='442' column='1'/>
+          <var-decl name='nodes' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='444' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='refs_by_desc' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='443' column='1'/>
+          <var-decl name='refs_by_desc' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='445' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='refs_by_node' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='444' column='1'/>
+          <var-decl name='refs_by_node' type-id='dec44472' visibility='default' filepath='drivers/android/binder_internal.h' line='446' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='waiting_threads' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='445' column='1'/>
+          <var-decl name='waiting_threads' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='447' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='pid' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='446' column='1'/>
+          <var-decl name='pid' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='448' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='tsk' type-id='f23e2572' visibility='default' filepath='drivers/android/binder_internal.h' line='447' column='1'/>
+          <var-decl name='tsk' type-id='f23e2572' visibility='default' filepath='drivers/android/binder_internal.h' line='449' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='deferred_work_node' type-id='03a4a074' visibility='default' filepath='drivers/android/binder_internal.h' line='448' column='1'/>
+          <var-decl name='deferred_work_node' type-id='03a4a074' visibility='default' filepath='drivers/android/binder_internal.h' line='450' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='deferred_work' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='449' column='1'/>
+          <var-decl name='deferred_work' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='451' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='800'>
-          <var-decl name='outstanding_txns' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='450' column='1'/>
+          <var-decl name='outstanding_txns' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='452' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='is_dead' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='451' column='1'/>
+          <var-decl name='is_dead' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='453' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='840'>
-          <var-decl name='is_frozen' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='452' column='1'/>
+          <var-decl name='is_frozen' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='454' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='848'>
-          <var-decl name='sync_recv' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='453' column='1'/>
+          <var-decl name='sync_recv' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='455' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='856'>
-          <var-decl name='async_recv' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='454' column='1'/>
+          <var-decl name='async_recv' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='456' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='freeze_wait' type-id='b5ab048f' visibility='default' filepath='drivers/android/binder_internal.h' line='455' column='1'/>
+          <var-decl name='freeze_wait' type-id='b5ab048f' visibility='default' filepath='drivers/android/binder_internal.h' line='457' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='todo' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='457' column='1'/>
+          <var-decl name='todo' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='459' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='stats' type-id='7e06c299' visibility='default' filepath='drivers/android/binder_internal.h' line='458' column='1'/>
+          <var-decl name='stats' type-id='7e06c299' visibility='default' filepath='drivers/android/binder_internal.h' line='460' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2944'>
-          <var-decl name='delivered_death' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='459' column='1'/>
+          <var-decl name='delivered_death' type-id='72f469ec' visibility='default' filepath='drivers/android/binder_internal.h' line='461' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3072'>
-          <var-decl name='max_threads' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='460' column='1'/>
+          <var-decl name='max_threads' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='462' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3104'>
-          <var-decl name='requested_threads' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='461' column='1'/>
+          <var-decl name='requested_threads' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='463' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3136'>
-          <var-decl name='requested_threads_started' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='462' column='1'/>
+          <var-decl name='requested_threads_started' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='464' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3168'>
-          <var-decl name='tmp_ref' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='463' column='1'/>
+          <var-decl name='tmp_ref' type-id='95e97e5e' visibility='default' filepath='drivers/android/binder_internal.h' line='465' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3200'>
-          <var-decl name='default_priority' type-id='de30810e' visibility='default' filepath='drivers/android/binder_internal.h' line='464' column='1'/>
+          <var-decl name='default_priority' type-id='de30810e' visibility='default' filepath='drivers/android/binder_internal.h' line='466' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='debugfs_entry' type-id='27675065' visibility='default' filepath='drivers/android/binder_internal.h' line='465' column='1'/>
+          <var-decl name='debugfs_entry' type-id='27675065' visibility='default' filepath='drivers/android/binder_internal.h' line='467' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3328'>
-          <var-decl name='alloc' type-id='eb5d0d8b' visibility='default' filepath='drivers/android/binder_internal.h' line='466' column='1'/>
+          <var-decl name='alloc' type-id='eb5d0d8b' visibility='default' filepath='drivers/android/binder_internal.h' line='468' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4544'>
-          <var-decl name='context' type-id='05dc2175' visibility='default' filepath='drivers/android/binder_internal.h' line='467' column='1'/>
+          <var-decl name='context' type-id='05dc2175' visibility='default' filepath='drivers/android/binder_internal.h' line='469' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4608'>
-          <var-decl name='inner_lock' type-id='fb4018a0' visibility='default' filepath='drivers/android/binder_internal.h' line='468' column='1'/>
+          <var-decl name='inner_lock' type-id='fb4018a0' visibility='default' filepath='drivers/android/binder_internal.h' line='470' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4640'>
-          <var-decl name='outer_lock' type-id='fb4018a0' visibility='default' filepath='drivers/android/binder_internal.h' line='469' column='1'/>
+          <var-decl name='outer_lock' type-id='fb4018a0' visibility='default' filepath='drivers/android/binder_internal.h' line='471' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4672'>
-          <var-decl name='binderfs_entry' type-id='27675065' visibility='default' filepath='drivers/android/binder_internal.h' line='470' column='1'/>
+          <var-decl name='binderfs_entry' type-id='27675065' visibility='default' filepath='drivers/android/binder_internal.h' line='472' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4736'>
-          <var-decl name='oneway_spam_detection_enabled' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='471' column='1'/>
+          <var-decl name='oneway_spam_detection_enabled' type-id='b50a4934' visibility='default' filepath='drivers/android/binder_internal.h' line='473' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='fa712c1b'>
@@ -108441,6 +110855,7 @@
       <array-type-def dimensions='1' type-id='e151255a' size-in-bits='192' id='fc293b5f'>
         <subrange length='3' type-id='7ff19f0f' id='56f209d2'/>
       </array-type-def>
+      <pointer-type-def type-id='de66d1aa' size-in-bits='64' id='fc30e234'/>
       <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/net/xfrm.h' line='151' column='1' id='fc320d58'>
         <data-member access='public'>
           <var-decl name='gclist' type-id='03a4a074' visibility='default' filepath='include/net/xfrm.h' line='152' column='1'/>
@@ -108581,6 +110996,35 @@
         </data-member>
       </class-decl>
       <pointer-type-def type-id='1f54f780' size-in-bits='64' id='fcc1e09e'/>
+      <class-decl name='tcp_ulp_ops' size-in-bits='704' is-struct='yes' visibility='default' filepath='include/net/tcp.h' line='2189' column='1' id='fccb029f'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='list' type-id='72f469ec' visibility='default' filepath='include/net/tcp.h' line='2190' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='128'>
+          <var-decl name='init' type-id='55530c47' visibility='default' filepath='include/net/tcp.h' line='2193' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='192'>
+          <var-decl name='update' type-id='58220cf1' visibility='default' filepath='include/net/tcp.h' line='2195' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='256'>
+          <var-decl name='release' type-id='841969d0' visibility='default' filepath='include/net/tcp.h' line='2198' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='320'>
+          <var-decl name='get_info' type-id='684afc90' visibility='default' filepath='include/net/tcp.h' line='2200' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='384'>
+          <var-decl name='get_info_size' type-id='08a11828' visibility='default' filepath='include/net/tcp.h' line='2201' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='448'>
+          <var-decl name='clone' type-id='e9e8c0f8' visibility='default' filepath='include/net/tcp.h' line='2203' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='512'>
+          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/net/tcp.h' line='2206' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='640'>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/tcp.h' line='2207' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='c12c58ce' size-in-bits='64' id='fccfeeec'/>
       <function-type size-in-bits='64' id='fcd4ba8e'>
         <parameter type-id='bd1c8eb6'/>
@@ -110659,9 +113103,9 @@
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__ethtool_get_link_ksettings' mangled-name='__ethtool_get_link_ksettings' filepath='net/ethtool/ioctl.c' line='426' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__ethtool_get_link_ksettings'>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='426' column='1'/>
-        <parameter type-id='70de91e2' name='link_ksettings' filepath='net/ethtool/ioctl.c' line='427' column='1'/>
+      <function-decl name='__ethtool_get_link_ksettings' mangled-name='__ethtool_get_link_ksettings' filepath='net/ethtool/ioctl.c' line='427' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__ethtool_get_link_ksettings'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='427' column='1'/>
+        <parameter type-id='70de91e2' name='link_ksettings' filepath='net/ethtool/ioctl.c' line='428' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__fdget' mangled-name='__fdget' filepath='fs/file.c' line='911' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__fdget'>
@@ -110704,6 +113148,18 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='fs/buffer.c' line='1357' column='1'/>
         <return type-id='c485c22c'/>
       </function-decl>
+      <function-decl name='__hid_register_driver' mangled-name='__hid_register_driver' filepath='drivers/hid/hid-core.c' line='2542' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__hid_register_driver'>
+        <parameter type-id='cbd2074d' name='hdrv' filepath='drivers/hid/hid-core.c' line='2542' column='1'/>
+        <parameter type-id='2730d015' name='owner' filepath='drivers/hid/hid-core.c' line='2542' column='1'/>
+        <parameter type-id='80f4b756' name='mod_name' filepath='drivers/hid/hid-core.c' line='2543' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__hid_request' mangled-name='__hid_request' filepath='drivers/hid/hid-core.c' line='1709' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__hid_request'>
+        <parameter type-id='37175e4d' name='hid' filepath='drivers/hid/hid-core.c' line='1709' column='1'/>
+        <parameter type-id='5b4284d1' name='report' filepath='drivers/hid/hid-core.c' line='1709' column='1'/>
+        <parameter type-id='95e97e5e' name='reqtype' filepath='drivers/hid/hid-core.c' line='1710' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__hrtimer_get_remaining' mangled-name='__hrtimer_get_remaining' filepath='kernel/time/hrtimer.c' line='1355' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__hrtimer_get_remaining'>
         <parameter type-id='1ce53783' name='timer' filepath='kernel/time/hrtimer.c' line='1355' column='1'/>
         <parameter type-id='b50a4934' name='adjust' filepath='kernel/time/hrtimer.c' line='1355' column='1'/>
@@ -110813,6 +113269,17 @@
         <parameter type-id='07779cd9' name='affinity' filepath='kernel/irq/irqdesc.c' line='780' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__irq_alloc_domain_generic_chips' mangled-name='__irq_alloc_domain_generic_chips' filepath='kernel/irq/generic-chip.c' line='283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__irq_alloc_domain_generic_chips'>
+        <parameter type-id='7544e824' name='d' filepath='kernel/irq/generic-chip.c' line='283' column='1'/>
+        <parameter type-id='95e97e5e' name='irqs_per_chip' filepath='kernel/irq/generic-chip.c' line='283' column='1'/>
+        <parameter type-id='95e97e5e' name='num_ct' filepath='kernel/irq/generic-chip.c' line='284' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/irq/generic-chip.c' line='284' column='1'/>
+        <parameter type-id='cdb741d3' name='handler' filepath='kernel/irq/generic-chip.c' line='285' column='1'/>
+        <parameter type-id='f0981eeb' name='clr' filepath='kernel/irq/generic-chip.c' line='286' column='1'/>
+        <parameter type-id='f0981eeb' name='set' filepath='kernel/irq/generic-chip.c' line='286' column='1'/>
+        <parameter type-id='7a1ec3b1' name='gcflags' filepath='kernel/irq/generic-chip.c' line='287' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__irq_domain_add' mangled-name='__irq_domain_add' filepath='kernel/irq/irqdomain.c' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__irq_domain_add'>
         <parameter type-id='4a935625' name='fwnode' filepath='kernel/irq/irqdomain.c' line='130' column='1'/>
         <parameter type-id='95e97e5e' name='size' filepath='kernel/irq/irqdomain.c' line='130' column='1'/>
@@ -111309,6 +113776,12 @@
         <parameter type-id='f0981eeb' name='hash' filepath='lib/rhashtable.c' line='1175' column='1'/>
         <return type-id='33f7eff4'/>
       </function-decl>
+      <function-decl name='__rt_mutex_init' mangled-name='__rt_mutex_init' filepath='kernel/locking/rtmutex.c' line='1676' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__rt_mutex_init'>
+        <parameter type-id='3992a90f' name='lock' filepath='kernel/locking/rtmutex.c' line='1676' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='kernel/locking/rtmutex.c' line='1676' column='1'/>
+        <parameter type-id='a57283f9' name='key' filepath='kernel/locking/rtmutex.c' line='1677' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='__rtc_register_device' mangled-name='__rtc_register_device' filepath='drivers/rtc/class.c' line='388' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__rtc_register_device'>
         <parameter type-id='2730d015' name='owner' filepath='drivers/rtc/class.c' line='388' column='1'/>
         <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/class.c' line='388' column='1'/>
@@ -111410,8 +113883,8 @@
         <parameter type-id='f0981eeb' name='flags' filepath='net/core/flow_dissector.c' line='909' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='__skb_get_hash' mangled-name='__skb_get_hash' filepath='net/core/flow_dissector.c' line='1604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_get_hash'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/flow_dissector.c' line='1604' column='1'/>
+      <function-decl name='__skb_get_hash' mangled-name='__skb_get_hash' filepath='net/core/flow_dissector.c' line='1608' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_get_hash'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/flow_dissector.c' line='1608' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='__skb_gso_segment' mangled-name='__skb_gso_segment' filepath='net/core/dev.c' line='3377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__skb_gso_segment'>
@@ -111486,9 +113959,9 @@
         <parameter type-id='f0981eeb' name='w' filepath='lib/hweight.c' line='39' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='__sync_dirty_buffer' mangled-name='__sync_dirty_buffer' filepath='fs/buffer.c' line='3161' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__sync_dirty_buffer'>
-        <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3161' column='1'/>
-        <parameter type-id='95e97e5e' name='op_flags' filepath='fs/buffer.c' line='3161' column='1'/>
+      <function-decl name='__sync_dirty_buffer' mangled-name='__sync_dirty_buffer' filepath='fs/buffer.c' line='3165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__sync_dirty_buffer'>
+        <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3165' column='1'/>
+        <parameter type-id='95e97e5e' name='op_flags' filepath='fs/buffer.c' line='3165' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__sysfs_match_string' mangled-name='__sysfs_match_string' filepath='lib/string.c' line='771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__sysfs_match_string'>
@@ -112068,10 +114541,15 @@
         <parameter type-id='7292109c' name='ret' filepath='include/trace/hooks/sched.h' line='273' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_rvh_ufs_reprogram_all_keys' mangled-name='__traceiter_android_rvh_ufs_reprogram_all_keys' filepath='include/trace/hooks/ufshcd.h' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_ufs_reprogram_all_keys'>
+      <function-decl name='__traceiter_android_rvh_ufs_complete_init' mangled-name='__traceiter_android_rvh_ufs_complete_init' filepath='include/trace/hooks/ufshcd.h' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_ufs_complete_init'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='22' column='1'/>
         <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='22' column='1'/>
-        <parameter type-id='7292109c' name='err' filepath='include/trace/hooks/ufshcd.h' line='22' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_rvh_ufs_reprogram_all_keys' mangled-name='__traceiter_android_rvh_ufs_reprogram_all_keys' filepath='include/trace/hooks/ufshcd.h' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_ufs_reprogram_all_keys'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
+        <parameter type-id='7292109c' name='err' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__traceiter_android_rvh_update_cpu_capacity' mangled-name='__traceiter_android_rvh_update_cpu_capacity' filepath='include/trace/hooks/sched.h' line='190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_rvh_update_cpu_capacity'>
@@ -112582,6 +115060,13 @@
         <parameter type-id='0fbf3cfd' name='skb' filepath='include/trace/hooks/net.h' line='18' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_kmalloc_slab' mangled-name='__traceiter_android_vh_kmalloc_slab' filepath='include/trace/hooks/mm.h' line='120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_kmalloc_slab'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/mm.h' line='120' column='1'/>
+        <parameter type-id='f0981eeb' name='index' filepath='include/trace/hooks/mm.h' line='120' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='include/trace/hooks/mm.h' line='120' column='1'/>
+        <parameter type-id='276b90a6' name='s' filepath='include/trace/hooks/mm.h' line='120' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_logbuf' mangled-name='__traceiter_android_vh_logbuf' filepath='include/trace/hooks/logbuf.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_logbuf'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/logbuf.h' line='16' column='1'/>
         <parameter type-id='eb711f18' name='rb' filepath='include/trace/hooks/logbuf.h' line='16' column='1'/>
@@ -112741,6 +115226,18 @@
         <parameter type-id='9b58df93' name='sem' filepath='include/trace/hooks/rwsem.h' line='21' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_save_track_hash' mangled-name='__traceiter_android_vh_save_track_hash' filepath='include/trace/hooks/mm.h' line='97' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_save_track_hash'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/mm.h' line='97' column='1'/>
+        <parameter type-id='b50a4934' name='alloc' filepath='include/trace/hooks/mm.h' line='97' column='1'/>
+        <parameter type-id='7359adad' name='p' filepath='include/trace/hooks/mm.h' line='97' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_save_vmalloc_stack' mangled-name='__traceiter_android_vh_save_vmalloc_stack' filepath='include/trace/hooks/mm.h' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_save_vmalloc_stack'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/mm.h' line='91' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='include/trace/hooks/mm.h' line='91' column='1'/>
+        <parameter type-id='d295dab2' name='vm' filepath='include/trace/hooks/mm.h' line='91' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_sched_setaffinity_early' mangled-name='__traceiter_android_vh_sched_setaffinity_early' filepath='include/trace/hooks/sched.h' line='314' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_sched_setaffinity_early'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/sched.h' line='314' column='1'/>
         <parameter type-id='f23e2572' name='p' filepath='include/trace/hooks/sched.h' line='314' column='1'/>
@@ -112865,6 +115362,12 @@
         <parameter type-id='91ce1af9' name='resume_cycles' filepath='include/trace/hooks/epoch.h' line='17' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_show_stack_hash' mangled-name='__traceiter_android_vh_show_stack_hash' filepath='include/trace/hooks/mm.h' line='94' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_show_stack_hash'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/mm.h' line='94' column='1'/>
+        <parameter type-id='f8dc9def' name='m' filepath='include/trace/hooks/mm.h' line='94' column='1'/>
+        <parameter type-id='d295dab2' name='v' filepath='include/trace/hooks/mm.h' line='94' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_show_suspend_epoch_val' mangled-name='__traceiter_android_vh_show_suspend_epoch_val' filepath='include/trace/hooks/epoch.h' line='13' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_show_suspend_epoch_val'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/epoch.h' line='13' column='1'/>
         <parameter type-id='91ce1af9' name='suspend_ns' filepath='include/trace/hooks/epoch.h' line='13' column='1'/>
@@ -112967,24 +115470,24 @@
         <parameter type-id='d8e6b335' name='bypass' filepath='include/trace/hooks/typec.h' line='61' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_check_int_errors' mangled-name='__traceiter_android_vh_ufs_check_int_errors' filepath='include/trace/hooks/ufshcd.h' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_check_int_errors'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='53' column='1'/>
-        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='53' column='1'/>
-        <parameter type-id='b50a4934' name='queue_eh_work' filepath='include/trace/hooks/ufshcd.h' line='53' column='1'/>
+      <function-decl name='__traceiter_android_vh_ufs_check_int_errors' mangled-name='__traceiter_android_vh_ufs_check_int_errors' filepath='include/trace/hooks/ufshcd.h' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_check_int_errors'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='57' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='57' column='1'/>
+        <parameter type-id='b50a4934' name='queue_eh_work' filepath='include/trace/hooks/ufshcd.h' line='57' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_clock_scaling' mangled-name='__traceiter_android_vh_ufs_clock_scaling' filepath='include/trace/hooks/ufshcd.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_clock_scaling'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='62' column='1'/>
-        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='62' column='1'/>
-        <parameter type-id='d8e6b335' name='force_out' filepath='include/trace/hooks/ufshcd.h' line='62' column='1'/>
-        <parameter type-id='d8e6b335' name='force_scaling' filepath='include/trace/hooks/ufshcd.h' line='62' column='1'/>
-        <parameter type-id='d8e6b335' name='scale_up' filepath='include/trace/hooks/ufshcd.h' line='62' column='1'/>
+      <function-decl name='__traceiter_android_vh_ufs_clock_scaling' mangled-name='__traceiter_android_vh_ufs_clock_scaling' filepath='include/trace/hooks/ufshcd.h' line='66' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_clock_scaling'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='66' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='66' column='1'/>
+        <parameter type-id='d8e6b335' name='force_out' filepath='include/trace/hooks/ufshcd.h' line='66' column='1'/>
+        <parameter type-id='d8e6b335' name='force_scaling' filepath='include/trace/hooks/ufshcd.h' line='66' column='1'/>
+        <parameter type-id='d8e6b335' name='scale_up' filepath='include/trace/hooks/ufshcd.h' line='66' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_compl_command' mangled-name='__traceiter_android_vh_ufs_compl_command' filepath='include/trace/hooks/ufshcd.h' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_compl_command'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='39' column='1'/>
-        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='39' column='1'/>
-        <parameter type-id='6ca6fa6d' name='lrbp' filepath='include/trace/hooks/ufshcd.h' line='39' column='1'/>
+      <function-decl name='__traceiter_android_vh_ufs_compl_command' mangled-name='__traceiter_android_vh_ufs_compl_command' filepath='include/trace/hooks/ufshcd.h' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_compl_command'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='43' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='43' column='1'/>
+        <parameter type-id='6ca6fa6d' name='lrbp' filepath='include/trace/hooks/ufshcd.h' line='43' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__traceiter_android_vh_ufs_fill_prdt' mangled-name='__traceiter_android_vh_ufs_fill_prdt' filepath='include/trace/hooks/ufshcd.h' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_fill_prdt'>
@@ -112995,42 +115498,42 @@
         <parameter type-id='7292109c' name='err' filepath='include/trace/hooks/ufshcd.h' line='17' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_prepare_command' mangled-name='__traceiter_android_vh_ufs_prepare_command' filepath='include/trace/hooks/ufshcd.h' line='26' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_prepare_command'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
-        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
-        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
-        <parameter type-id='6ca6fa6d' name='lrbp' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
-        <parameter type-id='7292109c' name='err' filepath='include/trace/hooks/ufshcd.h' line='26' column='1'/>
+      <function-decl name='__traceiter_android_vh_ufs_prepare_command' mangled-name='__traceiter_android_vh_ufs_prepare_command' filepath='include/trace/hooks/ufshcd.h' line='30' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_prepare_command'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='30' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='30' column='1'/>
+        <parameter type-id='3dad1a48' name='rq' filepath='include/trace/hooks/ufshcd.h' line='30' column='1'/>
+        <parameter type-id='6ca6fa6d' name='lrbp' filepath='include/trace/hooks/ufshcd.h' line='30' column='1'/>
+        <parameter type-id='7292109c' name='err' filepath='include/trace/hooks/ufshcd.h' line='30' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_send_command' mangled-name='__traceiter_android_vh_ufs_send_command' filepath='include/trace/hooks/ufshcd.h' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_send_command'>
+      <function-decl name='__traceiter_android_vh_ufs_send_command' mangled-name='__traceiter_android_vh_ufs_send_command' filepath='include/trace/hooks/ufshcd.h' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_send_command'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='39' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='39' column='1'/>
+        <parameter type-id='6ca6fa6d' name='lrbp' filepath='include/trace/hooks/ufshcd.h' line='39' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_ufs_send_tm_command' mangled-name='__traceiter_android_vh_ufs_send_tm_command' filepath='include/trace/hooks/ufshcd.h' line='53' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_send_tm_command'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='53' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='53' column='1'/>
+        <parameter type-id='95e97e5e' name='tag' filepath='include/trace/hooks/ufshcd.h' line='53' column='1'/>
+        <parameter type-id='80f4b756' name='str' filepath='include/trace/hooks/ufshcd.h' line='53' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_ufs_send_uic_command' mangled-name='__traceiter_android_vh_ufs_send_uic_command' filepath='include/trace/hooks/ufshcd.h' line='48' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_send_uic_command'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='48' column='1'/>
+        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='48' column='1'/>
+        <parameter type-id='cdf785b8' name='ucmd' filepath='include/trace/hooks/ufshcd.h' line='48' column='1'/>
+        <parameter type-id='80f4b756' name='str' filepath='include/trace/hooks/ufshcd.h' line='48' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_ufs_update_sdev' mangled-name='__traceiter_android_vh_ufs_update_sdev' filepath='include/trace/hooks/ufshcd.h' line='62' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_update_sdev'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='62' column='1'/>
+        <parameter type-id='eb572b74' name='sdev' filepath='include/trace/hooks/ufshcd.h' line='62' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_ufs_update_sysfs' mangled-name='__traceiter_android_vh_ufs_update_sysfs' filepath='include/trace/hooks/ufshcd.h' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_update_sysfs'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='35' column='1'/>
         <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='35' column='1'/>
-        <parameter type-id='6ca6fa6d' name='lrbp' filepath='include/trace/hooks/ufshcd.h' line='35' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_send_tm_command' mangled-name='__traceiter_android_vh_ufs_send_tm_command' filepath='include/trace/hooks/ufshcd.h' line='49' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_send_tm_command'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='49' column='1'/>
-        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='49' column='1'/>
-        <parameter type-id='95e97e5e' name='tag' filepath='include/trace/hooks/ufshcd.h' line='49' column='1'/>
-        <parameter type-id='80f4b756' name='str' filepath='include/trace/hooks/ufshcd.h' line='49' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_send_uic_command' mangled-name='__traceiter_android_vh_ufs_send_uic_command' filepath='include/trace/hooks/ufshcd.h' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_send_uic_command'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='44' column='1'/>
-        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='44' column='1'/>
-        <parameter type-id='cdf785b8' name='ucmd' filepath='include/trace/hooks/ufshcd.h' line='44' column='1'/>
-        <parameter type-id='80f4b756' name='str' filepath='include/trace/hooks/ufshcd.h' line='44' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_update_sdev' mangled-name='__traceiter_android_vh_ufs_update_sdev' filepath='include/trace/hooks/ufshcd.h' line='58' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_update_sdev'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='58' column='1'/>
-        <parameter type-id='eb572b74' name='sdev' filepath='include/trace/hooks/ufshcd.h' line='58' column='1'/>
-        <return type-id='95e97e5e'/>
-      </function-decl>
-      <function-decl name='__traceiter_android_vh_ufs_update_sysfs' mangled-name='__traceiter_android_vh_ufs_update_sysfs' filepath='include/trace/hooks/ufshcd.h' line='31' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ufs_update_sysfs'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/ufshcd.h' line='31' column='1'/>
-        <parameter type-id='442b8d89' name='hba' filepath='include/trace/hooks/ufshcd.h' line='31' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__traceiter_android_vh_update_topology_flags_workfn' mangled-name='__traceiter_android_vh_update_topology_flags_workfn' filepath='include/trace/hooks/topology.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_update_topology_flags_workfn'>
@@ -113038,6 +115541,20 @@
         <parameter type-id='eaa32e2f' name='unused' filepath='include/trace/hooks/topology.h' line='19' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__traceiter_android_vh_usb_dev_resume' mangled-name='__traceiter_android_vh_usb_dev_resume' filepath='include/trace/hooks/usb.h' line='20' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_usb_dev_resume'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/usb.h' line='20' column='1'/>
+        <parameter type-id='25e60cb2' name='udev' filepath='include/trace/hooks/usb.h' line='20' column='1'/>
+        <parameter type-id='08496218' name='msg' filepath='include/trace/hooks/usb.h' line='20' column='1'/>
+        <parameter type-id='7292109c' name='bypass' filepath='include/trace/hooks/usb.h' line='20' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_usb_dev_suspend' mangled-name='__traceiter_android_vh_usb_dev_suspend' filepath='include/trace/hooks/usb.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_usb_dev_suspend'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/usb.h' line='16' column='1'/>
+        <parameter type-id='25e60cb2' name='udev' filepath='include/trace/hooks/usb.h' line='16' column='1'/>
+        <parameter type-id='08496218' name='msg' filepath='include/trace/hooks/usb.h' line='16' column='1'/>
+        <parameter type-id='7292109c' name='bypass' filepath='include/trace/hooks/usb.h' line='16' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__traceiter_android_vh_v4l2subdev_set_fmt' mangled-name='__traceiter_android_vh_v4l2subdev_set_fmt' filepath='include/trace/hooks/v4l2core.h' line='36' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_v4l2subdev_set_fmt'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/v4l2core.h' line='36' column='1'/>
         <parameter type-id='f5438ac7' name='sd' filepath='include/trace/hooks/v4l2core.h' line='36' column='1'/>
@@ -113359,6 +115876,8 @@
       <var-decl name='__tracepoint_android_rvh_account_irq' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_account_irq' visibility='default' filepath='include/trace/hooks/sched.h' line='177' column='1' elf-symbol-id='__tracepoint_android_rvh_account_irq'/>
       <var-decl name='__tracepoint_android_rvh_after_dequeue_task' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_after_dequeue_task' visibility='default' filepath='include/trace/hooks/sched.h' line='326' column='1' elf-symbol-id='__tracepoint_android_rvh_after_dequeue_task'/>
       <var-decl name='__tracepoint_android_rvh_after_enqueue_task' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_after_enqueue_task' visibility='default' filepath='include/trace/hooks/sched.h' line='322' column='1' elf-symbol-id='__tracepoint_android_rvh_after_enqueue_task'/>
+      <var-decl name='__tracepoint_android_rvh_arm64_serror_panic' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_arm64_serror_panic' visibility='default' filepath='include/trace/hooks/traps.h' line='24' column='1' elf-symbol-id='__tracepoint_android_rvh_arm64_serror_panic'/>
+      <var-decl name='__tracepoint_android_rvh_bad_mode' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_bad_mode' visibility='default' filepath='include/trace/hooks/traps.h' line='20' column='1' elf-symbol-id='__tracepoint_android_rvh_bad_mode'/>
       <var-decl name='__tracepoint_android_rvh_build_perf_domains' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_build_perf_domains' visibility='default' filepath='include/trace/hooks/sched.h' line='186' column='1' elf-symbol-id='__tracepoint_android_rvh_build_perf_domains'/>
       <var-decl name='__tracepoint_android_rvh_can_migrate_task' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_can_migrate_task' visibility='default' filepath='include/trace/hooks/sched.h' line='39' column='1' elf-symbol-id='__tracepoint_android_rvh_can_migrate_task'/>
       <var-decl name='__tracepoint_android_rvh_cgroup_force_kthread_migration' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_cgroup_force_kthread_migration' visibility='default' filepath='include/trace/hooks/cgroup.h' line='18' column='1' elf-symbol-id='__tracepoint_android_rvh_cgroup_force_kthread_migration'/>
@@ -113373,9 +115892,12 @@
       <var-decl name='__tracepoint_android_rvh_dequeue_entity' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_dequeue_entity' visibility='default' filepath='include/trace/hooks/sched.h' line='337' column='1' elf-symbol-id='__tracepoint_android_rvh_dequeue_entity'/>
       <var-decl name='__tracepoint_android_rvh_dequeue_task' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_dequeue_task' visibility='default' filepath='include/trace/hooks/sched.h' line='35' column='1' elf-symbol-id='__tracepoint_android_rvh_dequeue_task'/>
       <var-decl name='__tracepoint_android_rvh_dequeue_task_fair' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_dequeue_task_fair' visibility='default' filepath='include/trace/hooks/sched.h' line='349' column='1' elf-symbol-id='__tracepoint_android_rvh_dequeue_task_fair'/>
+      <var-decl name='__tracepoint_android_rvh_dequeue_task_idle' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_dequeue_task_idle' visibility='default' filepath='include/trace/hooks/sched.h' line='246' column='1' elf-symbol-id='__tracepoint_android_rvh_dequeue_task_idle'/>
       <var-decl name='__tracepoint_android_rvh_die_kernel_fault' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_die_kernel_fault' visibility='default' filepath='include/trace/hooks/fault.h' line='15' column='1' elf-symbol-id='__tracepoint_android_rvh_die_kernel_fault'/>
       <var-decl name='__tracepoint_android_rvh_do_mem_abort' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_do_mem_abort' visibility='default' filepath='include/trace/hooks/fault.h' line='23' column='1' elf-symbol-id='__tracepoint_android_rvh_do_mem_abort'/>
+      <var-decl name='__tracepoint_android_rvh_do_sea' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_do_sea' visibility='default' filepath='include/trace/hooks/fault.h' line='19' column='1' elf-symbol-id='__tracepoint_android_rvh_do_sea'/>
       <var-decl name='__tracepoint_android_rvh_do_sp_pc_abort' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_do_sp_pc_abort' visibility='default' filepath='include/trace/hooks/fault.h' line='27' column='1' elf-symbol-id='__tracepoint_android_rvh_do_sp_pc_abort'/>
+      <var-decl name='__tracepoint_android_rvh_do_undefinstr' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_do_undefinstr' visibility='default' filepath='include/trace/hooks/traps.h' line='15' column='1' elf-symbol-id='__tracepoint_android_rvh_do_undefinstr'/>
       <var-decl name='__tracepoint_android_rvh_enqueue_entity' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_enqueue_entity' visibility='default' filepath='include/trace/hooks/sched.h' line='333' column='1' elf-symbol-id='__tracepoint_android_rvh_enqueue_entity'/>
       <var-decl name='__tracepoint_android_rvh_enqueue_task' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_enqueue_task' visibility='default' filepath='include/trace/hooks/sched.h' line='31' column='1' elf-symbol-id='__tracepoint_android_rvh_enqueue_task'/>
       <var-decl name='__tracepoint_android_rvh_enqueue_task_fair' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_enqueue_task_fair' visibility='default' filepath='include/trace/hooks/sched.h' line='345' column='1' elf-symbol-id='__tracepoint_android_rvh_enqueue_task_fair'/>
@@ -113401,6 +115923,7 @@
       <var-decl name='__tracepoint_android_rvh_preempt_disable' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_preempt_disable' visibility='default' filepath='include/trace/hooks/preemptirq.h' line='14' column='1' elf-symbol-id='__tracepoint_android_rvh_preempt_disable'/>
       <var-decl name='__tracepoint_android_rvh_preempt_enable' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_preempt_enable' visibility='default' filepath='include/trace/hooks/preemptirq.h' line='18' column='1' elf-symbol-id='__tracepoint_android_rvh_preempt_enable'/>
       <var-decl name='__tracepoint_android_rvh_prepare_prio_fork' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_prepare_prio_fork' visibility='default' filepath='include/trace/hooks/sched.h' line='48' column='1' elf-symbol-id='__tracepoint_android_rvh_prepare_prio_fork'/>
+      <var-decl name='__tracepoint_android_rvh_refrigerator' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_refrigerator' visibility='default' filepath='include/trace/hooks/cgroup.h' line='21' column='1' elf-symbol-id='__tracepoint_android_rvh_refrigerator'/>
       <var-decl name='__tracepoint_android_rvh_replace_next_task_fair' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_replace_next_task_fair' visibility='default' filepath='include/trace/hooks/sched.h' line='289' column='1' elf-symbol-id='__tracepoint_android_rvh_replace_next_task_fair'/>
       <var-decl name='__tracepoint_android_rvh_report_bug' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_report_bug' visibility='default' filepath='include/trace/hooks/bug.h' line='14' column='1' elf-symbol-id='__tracepoint_android_rvh_report_bug'/>
       <var-decl name='__tracepoint_android_rvh_resume_cpus' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_resume_cpus' visibility='default' filepath='include/trace/hooks/sched.h' line='108' column='1' elf-symbol-id='__tracepoint_android_rvh_resume_cpus'/>
@@ -113437,7 +115960,8 @@
       <var-decl name='__tracepoint_android_rvh_typec_tcpci_chk_contaminant' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_typec_tcpci_chk_contaminant' visibility='default' filepath='include/trace/hooks/typec.h' line='32' column='1' elf-symbol-id='__tracepoint_android_rvh_typec_tcpci_chk_contaminant'/>
       <var-decl name='__tracepoint_android_rvh_typec_tcpci_get_vbus' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_typec_tcpci_get_vbus' visibility='default' filepath='include/trace/hooks/typec.h' line='43' column='1' elf-symbol-id='__tracepoint_android_rvh_typec_tcpci_get_vbus'/>
       <var-decl name='__tracepoint_android_rvh_uclamp_eff_get' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_uclamp_eff_get' visibility='default' filepath='include/trace/hooks/sched.h' line='273' column='1' elf-symbol-id='__tracepoint_android_rvh_uclamp_eff_get'/>
-      <var-decl name='__tracepoint_android_rvh_ufs_reprogram_all_keys' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_ufs_reprogram_all_keys' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='22' column='1' elf-symbol-id='__tracepoint_android_rvh_ufs_reprogram_all_keys'/>
+      <var-decl name='__tracepoint_android_rvh_ufs_complete_init' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_ufs_complete_init' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='22' column='1' elf-symbol-id='__tracepoint_android_rvh_ufs_complete_init'/>
+      <var-decl name='__tracepoint_android_rvh_ufs_reprogram_all_keys' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_ufs_reprogram_all_keys' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='26' column='1' elf-symbol-id='__tracepoint_android_rvh_ufs_reprogram_all_keys'/>
       <var-decl name='__tracepoint_android_rvh_update_cpu_capacity' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_update_cpu_capacity' visibility='default' filepath='include/trace/hooks/sched.h' line='190' column='1' elf-symbol-id='__tracepoint_android_rvh_update_cpu_capacity'/>
       <var-decl name='__tracepoint_android_rvh_update_cpus_allowed' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_update_cpus_allowed' visibility='default' filepath='include/trace/hooks/sched.h' line='128' column='1' elf-symbol-id='__tracepoint_android_rvh_update_cpus_allowed'/>
       <var-decl name='__tracepoint_android_rvh_update_misfit_status' type-id='4ca0c298' mangled-name='__tracepoint_android_rvh_update_misfit_status' visibility='default' filepath='include/trace/hooks/sched.h' line='194' column='1' elf-symbol-id='__tracepoint_android_rvh_update_misfit_status'/>
@@ -113486,6 +116010,7 @@
       <var-decl name='__tracepoint_android_vh_do_send_sig_info' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_do_send_sig_info' visibility='default' filepath='include/trace/hooks/signal.h' line='12' column='1' elf-symbol-id='__tracepoint_android_vh_do_send_sig_info'/>
       <var-decl name='__tracepoint_android_vh_do_wake_up_sync' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_do_wake_up_sync' visibility='default' filepath='include/trace/hooks/sched.h' line='263' column='1' elf-symbol-id='__tracepoint_android_vh_do_wake_up_sync'/>
       <var-decl name='__tracepoint_android_vh_dump_throttled_rt_tasks' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_dump_throttled_rt_tasks' visibility='default' filepath='include/trace/hooks/sched.h' line='73' column='1' elf-symbol-id='__tracepoint_android_vh_dump_throttled_rt_tasks'/>
+      <var-decl name='__tracepoint_android_vh_dup_task_struct' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_dup_task_struct' visibility='default' filepath='include/trace/hooks/sched.h' line='361' column='1' elf-symbol-id='__tracepoint_android_vh_dup_task_struct'/>
       <var-decl name='__tracepoint_android_vh_em_cpu_energy' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_em_cpu_energy' visibility='default' filepath='include/trace/hooks/sched.h' line='236' column='1' elf-symbol-id='__tracepoint_android_vh_em_cpu_energy'/>
       <var-decl name='__tracepoint_android_vh_enable_thermal_genl_check' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_enable_thermal_genl_check' visibility='default' filepath='include/trace/hooks/thermal.h' line='13' column='1' elf-symbol-id='__tracepoint_android_vh_enable_thermal_genl_check'/>
       <var-decl name='__tracepoint_android_vh_ep_create_wakeup_source' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ep_create_wakeup_source' visibility='default' filepath='include/trace/hooks/fs.h' line='13' column='1' elf-symbol-id='__tracepoint_android_vh_ep_create_wakeup_source'/>
@@ -113513,9 +116038,11 @@
       <var-decl name='__tracepoint_android_vh_iommu_setup_dma_ops' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_setup_dma_ops' visibility='default' filepath='include/trace/hooks/iommu.h' line='17' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_setup_dma_ops'/>
       <var-decl name='__tracepoint_android_vh_ipi_stop' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ipi_stop' visibility='default' filepath='include/trace/hooks/debug.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_ipi_stop'/>
       <var-decl name='__tracepoint_android_vh_ipv6_gen_linklocal_addr' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ipv6_gen_linklocal_addr' visibility='default' filepath='include/trace/hooks/ipv6.h' line='14' column='1' elf-symbol-id='__tracepoint_android_vh_ipv6_gen_linklocal_addr'/>
+      <var-decl name='__tracepoint_android_vh_irqtime_account_process_tick' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_irqtime_account_process_tick' visibility='default' filepath='include/trace/hooks/sched.h' line='302' column='1' elf-symbol-id='__tracepoint_android_vh_irqtime_account_process_tick'/>
       <var-decl name='__tracepoint_android_vh_is_fpsimd_save' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_is_fpsimd_save' visibility='default' filepath='include/trace/hooks/fpsimd.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_is_fpsimd_save'/>
       <var-decl name='__tracepoint_android_vh_jiffies_update' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_jiffies_update' visibility='default' filepath='include/trace/hooks/sched.h' line='78' column='1' elf-symbol-id='__tracepoint_android_vh_jiffies_update'/>
       <var-decl name='__tracepoint_android_vh_kfree_skb' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_kfree_skb' visibility='default' filepath='include/trace/hooks/net.h' line='18' column='1' elf-symbol-id='__tracepoint_android_vh_kfree_skb'/>
+      <var-decl name='__tracepoint_android_vh_kmalloc_slab' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_kmalloc_slab' visibility='default' filepath='include/trace/hooks/mm.h' line='120' column='1' elf-symbol-id='__tracepoint_android_vh_kmalloc_slab'/>
       <var-decl name='__tracepoint_android_vh_logbuf' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_logbuf' visibility='default' filepath='include/trace/hooks/logbuf.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_logbuf'/>
       <var-decl name='__tracepoint_android_vh_logbuf_pr_cont' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_logbuf_pr_cont' visibility='default' filepath='include/trace/hooks/logbuf.h' line='20' column='1' elf-symbol-id='__tracepoint_android_vh_logbuf_pr_cont'/>
       <var-decl name='__tracepoint_android_vh_map_util_freq' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_map_util_freq' visibility='default' filepath='include/trace/hooks/sched.h' line='229' column='1' elf-symbol-id='__tracepoint_android_vh_map_util_freq'/>
@@ -113541,11 +116068,20 @@
       <var-decl name='__tracepoint_android_vh_revert_creds' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_revert_creds' visibility='default' filepath='include/trace/hooks/creds.h' line='28' column='1' elf-symbol-id='__tracepoint_android_vh_revert_creds'/>
       <var-decl name='__tracepoint_android_vh_rmqueue' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rmqueue' visibility='default' filepath='include/trace/hooks/mm.h' line='35' column='1' elf-symbol-id='__tracepoint_android_vh_rmqueue'/>
       <var-decl name='__tracepoint_android_vh_rproc_recovery' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rproc_recovery' visibility='default' filepath='include/trace/hooks/remoteproc.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_rproc_recovery'/>
+      <var-decl name='__tracepoint_android_vh_rtmutex_wait_finish' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rtmutex_wait_finish' visibility='default' filepath='include/trace/hooks/dtask.h' line='26' column='1' elf-symbol-id='__tracepoint_android_vh_rtmutex_wait_finish'/>
+      <var-decl name='__tracepoint_android_vh_rtmutex_wait_start' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rtmutex_wait_start' visibility='default' filepath='include/trace/hooks/dtask.h' line='23' column='1' elf-symbol-id='__tracepoint_android_vh_rtmutex_wait_start'/>
       <var-decl name='__tracepoint_android_vh_rwsem_init' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_init' visibility='default' filepath='include/trace/hooks/rwsem.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_init'/>
+      <var-decl name='__tracepoint_android_vh_rwsem_read_wait_finish' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_read_wait_finish' visibility='default' filepath='include/trace/hooks/dtask.h' line='34' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_read_wait_finish'/>
+      <var-decl name='__tracepoint_android_vh_rwsem_read_wait_start' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_read_wait_start' visibility='default' filepath='include/trace/hooks/dtask.h' line='31' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_read_wait_start'/>
       <var-decl name='__tracepoint_android_vh_rwsem_wake' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_wake' visibility='default' filepath='include/trace/hooks/rwsem.h' line='18' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_wake'/>
       <var-decl name='__tracepoint_android_vh_rwsem_wake_finish' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_wake_finish' visibility='default' filepath='include/trace/hooks/rwsem.h' line='29' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_wake_finish'/>
       <var-decl name='__tracepoint_android_vh_rwsem_write_finished' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_write_finished' visibility='default' filepath='include/trace/hooks/rwsem.h' line='21' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_write_finished'/>
+      <var-decl name='__tracepoint_android_vh_rwsem_write_wait_finish' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_write_wait_finish' visibility='default' filepath='include/trace/hooks/dtask.h' line='40' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_write_wait_finish'/>
+      <var-decl name='__tracepoint_android_vh_rwsem_write_wait_start' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_rwsem_write_wait_start' visibility='default' filepath='include/trace/hooks/dtask.h' line='37' column='1' elf-symbol-id='__tracepoint_android_vh_rwsem_write_wait_start'/>
+      <var-decl name='__tracepoint_android_vh_save_track_hash' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_save_track_hash' visibility='default' filepath='include/trace/hooks/mm.h' line='97' column='1' elf-symbol-id='__tracepoint_android_vh_save_track_hash'/>
+      <var-decl name='__tracepoint_android_vh_save_vmalloc_stack' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_save_vmalloc_stack' visibility='default' filepath='include/trace/hooks/mm.h' line='91' column='1' elf-symbol-id='__tracepoint_android_vh_save_vmalloc_stack'/>
       <var-decl name='__tracepoint_android_vh_sched_setaffinity_early' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_sched_setaffinity_early' visibility='default' filepath='include/trace/hooks/sched.h' line='314' column='1' elf-symbol-id='__tracepoint_android_vh_sched_setaffinity_early'/>
+      <var-decl name='__tracepoint_android_vh_sched_show_task' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_sched_show_task' visibility='default' filepath='include/trace/hooks/dtask.h' line='45' column='1' elf-symbol-id='__tracepoint_android_vh_sched_show_task'/>
       <var-decl name='__tracepoint_android_vh_scheduler_tick' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_scheduler_tick' visibility='default' filepath='include/trace/hooks/sched.h' line='27' column='1' elf-symbol-id='__tracepoint_android_vh_scheduler_tick'/>
       <var-decl name='__tracepoint_android_vh_sd_update_bus_speed_mode' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_sd_update_bus_speed_mode' visibility='default' filepath='include/trace/hooks/mmc_core.h' line='23' column='1' elf-symbol-id='__tracepoint_android_vh_sd_update_bus_speed_mode'/>
       <var-decl name='__tracepoint_android_vh_sdhci_get_cd' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_sdhci_get_cd' visibility='default' filepath='include/trace/hooks/mmc_core.h' line='29' column='1' elf-symbol-id='__tracepoint_android_vh_sdhci_get_cd'/>
@@ -113567,6 +116103,7 @@
       <var-decl name='__tracepoint_android_vh_show_max_freq' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_show_max_freq' visibility='default' filepath='include/trace/hooks/cpufreq.h' line='18' column='1' elf-symbol-id='__tracepoint_android_vh_show_max_freq'/>
       <var-decl name='__tracepoint_android_vh_show_mem' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_show_mem' visibility='default' filepath='include/trace/hooks/mm.h' line='68' column='1' elf-symbol-id='__tracepoint_android_vh_show_mem'/>
       <var-decl name='__tracepoint_android_vh_show_resume_epoch_val' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_show_resume_epoch_val' visibility='default' filepath='include/trace/hooks/epoch.h' line='17' column='1' elf-symbol-id='__tracepoint_android_vh_show_resume_epoch_val'/>
+      <var-decl name='__tracepoint_android_vh_show_stack_hash' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_show_stack_hash' visibility='default' filepath='include/trace/hooks/mm.h' line='94' column='1' elf-symbol-id='__tracepoint_android_vh_show_stack_hash'/>
       <var-decl name='__tracepoint_android_vh_show_suspend_epoch_val' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_show_suspend_epoch_val' visibility='default' filepath='include/trace/hooks/epoch.h' line='13' column='1' elf-symbol-id='__tracepoint_android_vh_show_suspend_epoch_val'/>
       <var-decl name='__tracepoint_android_vh_snd_compr_use_pause_in_drain' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_snd_compr_use_pause_in_drain' visibility='default' filepath='include/trace/hooks/snd_compr.h' line='18' column='1' elf-symbol-id='__tracepoint_android_vh_snd_compr_use_pause_in_drain'/>
       <var-decl name='__tracepoint_android_vh_sound_usb_support_cpu_suspend' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_sound_usb_support_cpu_suspend' visibility='default' filepath='include/trace/hooks/sound.h' line='12' column='1' elf-symbol-id='__tracepoint_android_vh_sound_usb_support_cpu_suspend'/>
@@ -113575,6 +116112,8 @@
       <var-decl name='__tracepoint_android_vh_thermal_pm_notify_suspend' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_thermal_pm_notify_suspend' visibility='default' filepath='include/trace/hooks/thermal.h' line='18' column='1' elf-symbol-id='__tracepoint_android_vh_thermal_pm_notify_suspend'/>
       <var-decl name='__tracepoint_android_vh_timer_calc_index' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_timer_calc_index' visibility='default' filepath='include/trace/hooks/timer.h' line='13' column='1' elf-symbol-id='__tracepoint_android_vh_timer_calc_index'/>
       <var-decl name='__tracepoint_android_vh_timerfd_create' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_timerfd_create' visibility='default' filepath='include/trace/hooks/fs.h' line='17' column='1' elf-symbol-id='__tracepoint_android_vh_timerfd_create'/>
+      <var-decl name='__tracepoint_android_vh_try_to_freeze_todo' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_try_to_freeze_todo' visibility='default' filepath='include/trace/hooks/power.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_try_to_freeze_todo'/>
+      <var-decl name='__tracepoint_android_vh_try_to_freeze_todo_unfrozen' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_try_to_freeze_todo_unfrozen' visibility='default' filepath='include/trace/hooks/power.h' line='19' column='1' elf-symbol-id='__tracepoint_android_vh_try_to_freeze_todo_unfrozen'/>
       <var-decl name='__tracepoint_android_vh_tune_inactive_ratio' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_tune_inactive_ratio' visibility='default' filepath='include/trace/hooks/vmscan.h' line='22' column='1' elf-symbol-id='__tracepoint_android_vh_tune_inactive_ratio'/>
       <var-decl name='__tracepoint_android_vh_tune_scan_type' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_tune_scan_type' visibility='default' filepath='include/trace/hooks/vmscan.h' line='13' column='1' elf-symbol-id='__tracepoint_android_vh_tune_scan_type'/>
       <var-decl name='__tracepoint_android_vh_tune_swappiness' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_tune_swappiness' visibility='default' filepath='include/trace/hooks/vmscan.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_tune_swappiness'/>
@@ -113583,20 +116122,25 @@
       <var-decl name='__tracepoint_android_vh_typec_tcpm_adj_current_limit' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_typec_tcpm_adj_current_limit' visibility='default' filepath='include/trace/hooks/typec.h' line='56' column='1' elf-symbol-id='__tracepoint_android_vh_typec_tcpm_adj_current_limit'/>
       <var-decl name='__tracepoint_android_vh_typec_tcpm_get_timer' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_typec_tcpm_get_timer' visibility='default' filepath='include/trace/hooks/typec.h' line='47' column='1' elf-symbol-id='__tracepoint_android_vh_typec_tcpm_get_timer'/>
       <var-decl name='__tracepoint_android_vh_typec_tcpm_log' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_typec_tcpm_log' visibility='default' filepath='include/trace/hooks/typec.h' line='61' column='1' elf-symbol-id='__tracepoint_android_vh_typec_tcpm_log'/>
-      <var-decl name='__tracepoint_android_vh_ufs_check_int_errors' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_check_int_errors' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='53' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_check_int_errors'/>
-      <var-decl name='__tracepoint_android_vh_ufs_clock_scaling' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_clock_scaling' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='62' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_clock_scaling'/>
-      <var-decl name='__tracepoint_android_vh_ufs_compl_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_compl_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='39' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_compl_command'/>
+      <var-decl name='__tracepoint_android_vh_ufs_check_int_errors' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_check_int_errors' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='57' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_check_int_errors'/>
+      <var-decl name='__tracepoint_android_vh_ufs_clock_scaling' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_clock_scaling' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='66' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_clock_scaling'/>
+      <var-decl name='__tracepoint_android_vh_ufs_compl_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_compl_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='43' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_compl_command'/>
       <var-decl name='__tracepoint_android_vh_ufs_fill_prdt' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_fill_prdt' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='17' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_fill_prdt'/>
-      <var-decl name='__tracepoint_android_vh_ufs_prepare_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_prepare_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='26' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_prepare_command'/>
-      <var-decl name='__tracepoint_android_vh_ufs_send_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_send_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='35' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_send_command'/>
-      <var-decl name='__tracepoint_android_vh_ufs_send_tm_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_send_tm_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='49' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_send_tm_command'/>
-      <var-decl name='__tracepoint_android_vh_ufs_send_uic_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_send_uic_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='44' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_send_uic_command'/>
-      <var-decl name='__tracepoint_android_vh_ufs_update_sdev' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_update_sdev' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='58' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_update_sdev'/>
-      <var-decl name='__tracepoint_android_vh_ufs_update_sysfs' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_update_sysfs' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='31' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_update_sysfs'/>
+      <var-decl name='__tracepoint_android_vh_ufs_prepare_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_prepare_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='30' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_prepare_command'/>
+      <var-decl name='__tracepoint_android_vh_ufs_send_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_send_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='39' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_send_command'/>
+      <var-decl name='__tracepoint_android_vh_ufs_send_tm_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_send_tm_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='53' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_send_tm_command'/>
+      <var-decl name='__tracepoint_android_vh_ufs_send_uic_command' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_send_uic_command' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='48' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_send_uic_command'/>
+      <var-decl name='__tracepoint_android_vh_ufs_update_sdev' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_update_sdev' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='62' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_update_sdev'/>
+      <var-decl name='__tracepoint_android_vh_ufs_update_sysfs' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ufs_update_sysfs' visibility='default' filepath='include/trace/hooks/ufshcd.h' line='35' column='1' elf-symbol-id='__tracepoint_android_vh_ufs_update_sysfs'/>
       <var-decl name='__tracepoint_android_vh_update_topology_flags_workfn' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_update_topology_flags_workfn' visibility='default' filepath='include/trace/hooks/topology.h' line='19' column='1' elf-symbol-id='__tracepoint_android_vh_update_topology_flags_workfn'/>
+      <var-decl name='__tracepoint_android_vh_usb_dev_resume' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_usb_dev_resume' visibility='default' filepath='include/trace/hooks/usb.h' line='20' column='1' elf-symbol-id='__tracepoint_android_vh_usb_dev_resume'/>
+      <var-decl name='__tracepoint_android_vh_usb_dev_suspend' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_usb_dev_suspend' visibility='default' filepath='include/trace/hooks/usb.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_usb_dev_suspend'/>
       <var-decl name='__tracepoint_android_vh_v4l2subdev_set_fmt' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_v4l2subdev_set_fmt' visibility='default' filepath='include/trace/hooks/v4l2core.h' line='36' column='1' elf-symbol-id='__tracepoint_android_vh_v4l2subdev_set_fmt'/>
       <var-decl name='__tracepoint_android_vh_v4l2subdev_set_frame_interval' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_v4l2subdev_set_frame_interval' visibility='default' filepath='include/trace/hooks/v4l2core.h' line='42' column='1' elf-symbol-id='__tracepoint_android_vh_v4l2subdev_set_frame_interval'/>
       <var-decl name='__tracepoint_android_vh_v4l2subdev_set_selection' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_v4l2subdev_set_selection' visibility='default' filepath='include/trace/hooks/v4l2core.h' line='30' column='1' elf-symbol-id='__tracepoint_android_vh_v4l2subdev_set_selection'/>
+      <var-decl name='__tracepoint_android_vh_vmpressure' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_vmpressure' visibility='default' filepath='include/trace/hooks/mm.h' line='101' column='1' elf-symbol-id='__tracepoint_android_vh_vmpressure'/>
+      <var-decl name='__tracepoint_android_vh_watchdog_timer_softlockup' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_watchdog_timer_softlockup' visibility='default' filepath='include/trace/hooks/softlockup.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_watchdog_timer_softlockup'/>
+      <var-decl name='__tracepoint_android_vh_wq_lockup_pool' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_wq_lockup_pool' visibility='default' filepath='include/trace/hooks/wqlockup.h' line='14' column='1' elf-symbol-id='__tracepoint_android_vh_wq_lockup_pool'/>
       <var-decl name='__tracepoint_binder_transaction_received' type-id='4ca0c298' mangled-name='__tracepoint_binder_transaction_received' visibility='default' filepath='drivers/android/./binder_trace.h' line='150' column='1' elf-symbol-id='__tracepoint_binder_transaction_received'/>
       <var-decl name='__tracepoint_clock_set_rate' type-id='4ca0c298' mangled-name='__tracepoint_clock_set_rate' visibility='default' filepath='include/trace/events/power.h' line='322' column='1' elf-symbol-id='__tracepoint_clock_set_rate'/>
       <var-decl name='__tracepoint_cpu_frequency' type-id='4ca0c298' mangled-name='__tracepoint_cpu_frequency' visibility='default' filepath='include/trace/events/power.h' line='145' column='1' elf-symbol-id='__tracepoint_cpu_frequency'/>
@@ -113647,6 +116191,12 @@
       <var-decl name='__tracepoint_workqueue_execute_start' type-id='4ca0c298' mangled-name='__tracepoint_workqueue_execute_start' visibility='default' filepath='include/trace/events/workqueue.h' line='82' column='1' elf-symbol-id='__tracepoint_workqueue_execute_start'/>
       <var-decl name='__tracepoint_xdp_exception' type-id='4ca0c298' mangled-name='__tracepoint_xdp_exception' visibility='default' filepath='include/trace/events/xdp.h' line='28' column='1' elf-symbol-id='__tracepoint_xdp_exception'/>
       <var-decl name='__tracepoint_xhci_urb_giveback' type-id='4ca0c298' mangled-name='__tracepoint_xhci_urb_giveback' visibility='default' filepath='drivers/usb/host/./xhci-trace.h' line='307' column='1' elf-symbol-id='__tracepoint_xhci_urb_giveback'/>
+      <function-decl name='__tty_alloc_driver' mangled-name='__tty_alloc_driver' filepath='drivers/tty/tty_io.c' line='3299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__tty_alloc_driver'>
+        <parameter type-id='f0981eeb' name='lines' filepath='drivers/tty/tty_io.c' line='3299' column='1'/>
+        <parameter type-id='2730d015' name='owner' filepath='drivers/tty/tty_io.c' line='3299' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='drivers/tty/tty_io.c' line='3300' column='1'/>
+        <return type-id='c2b4b27b'/>
+      </function-decl>
       <function-decl name='__tty_insert_flip_char' mangled-name='__tty_insert_flip_char' filepath='drivers/tty/tty_buffer.c' line='379' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__tty_insert_flip_char'>
         <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_buffer.c' line='379' column='1'/>
         <parameter type-id='002ac4a6' name='ch' filepath='drivers/tty/tty_buffer.c' line='379' column='1'/>
@@ -113683,6 +116233,14 @@
         <parameter type-id='fc4f83c1' name='primary_hcd' filepath='drivers/usb/core/hcd.c' line='2418' column='1'/>
         <return type-id='fc4f83c1'/>
       </function-decl>
+      <function-decl name='__usb_get_extra_descriptor' mangled-name='__usb_get_extra_descriptor' filepath='drivers/usb/core/usb.c' line='872' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__usb_get_extra_descriptor'>
+        <parameter type-id='26a90f95' name='buffer' filepath='drivers/usb/core/usb.c' line='872' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='drivers/usb/core/usb.c' line='872' column='1'/>
+        <parameter type-id='002ac4a6' name='type' filepath='drivers/usb/core/usb.c' line='873' column='1'/>
+        <parameter type-id='63e171df' name='ptr' filepath='drivers/usb/core/usb.c' line='873' column='1'/>
+        <parameter type-id='b59d7dce' name='minsize' filepath='drivers/usb/core/usb.c' line='873' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__usecs_to_jiffies' mangled-name='__usecs_to_jiffies' filepath='kernel/time/time.c' line='563' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__usecs_to_jiffies'>
         <parameter type-id='20f5f452' name='u' filepath='kernel/time/time.c' line='563' column='1'/>
         <return type-id='7359adad'/>
@@ -113700,6 +116258,12 @@
         <parameter type-id='a7832498' name='val' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4433' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='__v4l2_ctrl_s_ctrl_compound' mangled-name='__v4l2_ctrl_s_ctrl_compound' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4469' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__v4l2_ctrl_s_ctrl_compound'>
+        <parameter type-id='4b8b2cf3' name='ctrl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4469' column='1'/>
+        <parameter type-id='cf13dc99' name='type' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4470' column='1'/>
+        <parameter type-id='eaa32e2f' name='p' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4470' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__v4l2_ctrl_s_ctrl_int64' mangled-name='__v4l2_ctrl_s_ctrl_int64' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4445' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__v4l2_ctrl_s_ctrl_int64'>
         <parameter type-id='4b8b2cf3' name='ctrl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4445' column='1'/>
         <parameter type-id='9b7c55ef' name='val' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4445' column='1'/>
@@ -113811,6 +116375,14 @@
         <parameter type-id='cff2d845' name='lock' filepath='lib/dec_and_lock.c' line='21' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='_bcd2bin' mangled-name='_bcd2bin' filepath='lib/bcd.c' line='5' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_bcd2bin'>
+        <parameter type-id='002ac4a6' name='val' filepath='lib/bcd.c' line='5' column='1'/>
+        <return type-id='f0981eeb'/>
+      </function-decl>
+      <function-decl name='_bin2bcd' mangled-name='_bin2bcd' filepath='lib/bcd.c' line='11' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_bin2bcd'>
+        <parameter type-id='f0981eeb' name='val' filepath='lib/bcd.c' line='11' column='1'/>
+        <return type-id='002ac4a6'/>
+      </function-decl>
       <function-decl name='_copy_from_iter' mangled-name='_copy_from_iter' filepath='lib/iov_iter.c' line='765' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_copy_from_iter'>
         <parameter type-id='eaa32e2f' name='addr' filepath='lib/iov_iter.c' line='765' column='1'/>
         <parameter type-id='b59d7dce' name='bytes' filepath='lib/iov_iter.c' line='765' column='1'/>
@@ -113871,6 +116443,12 @@
         <parameter is-variadic='yes'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='_kstrtoul' mangled-name='_kstrtoul' filepath='lib/kstrtox.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_kstrtoul'>
+        <parameter type-id='80f4b756' name='s' filepath='lib/kstrtox.c' line='175' column='1'/>
+        <parameter type-id='f0981eeb' name='base' filepath='lib/kstrtox.c' line='175' column='1'/>
+        <parameter type-id='1d2c2b85' name='res' filepath='lib/kstrtox.c' line='175' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='_raw_read_lock' mangled-name='_raw_read_lock' filepath='kernel/locking/spinlock.c' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='_raw_read_lock'>
         <parameter type-id='6a6de1b0' name='lock' filepath='kernel/locking/spinlock.c' line='221' column='1'/>
         <return type-id='48b5725f'/>
@@ -114330,6 +116908,7 @@
         <parameter type-id='95e97e5e' name='cpu' filepath='kernel/sched/core.c' line='5360' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <var-decl name='avenrun' type-id='3461381a' mangled-name='avenrun' visibility='default' filepath='kernel/sched/loadavg.c' line='61' column='1' elf-symbol-id='avenrun'/>
       <function-decl name='backlight_device_get_by_type' mangled-name='backlight_device_get_by_type' filepath='drivers/video/backlight/backlight.c' line='468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='backlight_device_get_by_type'>
         <parameter type-id='e7dc2d8e' name='type' filepath='drivers/video/backlight/backlight.c' line='468' column='1'/>
         <return type-id='7a76d041'/>
@@ -114499,8 +117078,8 @@
         <parameter type-id='38b1e3a0' name='bs' filepath='block/bio.c' line='438' column='1'/>
         <return type-id='fb55efa1'/>
       </function-decl>
-      <function-decl name='bio_associate_blkg' mangled-name='bio_associate_blkg' filepath='block/blk-cgroup.c' line='1867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_associate_blkg'>
-        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-cgroup.c' line='1867' column='1'/>
+      <function-decl name='bio_associate_blkg' mangled-name='bio_associate_blkg' filepath='block/blk-cgroup.c' line='1875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_associate_blkg'>
+        <parameter type-id='fb55efa1' name='bio' filepath='block/blk-cgroup.c' line='1875' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bio_chain' mangled-name='bio_chain' filepath='block/bio.c' line='338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_chain'>
@@ -114508,9 +117087,9 @@
         <parameter type-id='fb55efa1' name='parent' filepath='block/bio.c' line='338' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='bio_clone_blkg_association' mangled-name='bio_clone_blkg_association' filepath='block/blk-cgroup.c' line='1889' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_clone_blkg_association'>
-        <parameter type-id='fb55efa1' name='dst' filepath='block/blk-cgroup.c' line='1889' column='1'/>
-        <parameter type-id='fb55efa1' name='src' filepath='block/blk-cgroup.c' line='1889' column='1'/>
+      <function-decl name='bio_clone_blkg_association' mangled-name='bio_clone_blkg_association' filepath='block/blk-cgroup.c' line='1897' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_clone_blkg_association'>
+        <parameter type-id='fb55efa1' name='dst' filepath='block/blk-cgroup.c' line='1897' column='1'/>
+        <parameter type-id='fb55efa1' name='src' filepath='block/blk-cgroup.c' line='1897' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='bio_endio' mangled-name='bio_endio' filepath='block/bio.c' line='1428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='bio_endio'>
@@ -114710,8 +117289,8 @@
         <parameter type-id='f0981eeb' name='hctx_idx' filepath='block/blk-mq.c' line='432' column='1'/>
         <return type-id='3dad1a48'/>
       </function-decl>
-      <function-decl name='blk_mq_alloc_tag_set' mangled-name='blk_mq_alloc_tag_set' filepath='block/blk-mq.c' line='3495' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_tag_set'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3495' column='1'/>
+      <function-decl name='blk_mq_alloc_tag_set' mangled-name='blk_mq_alloc_tag_set' filepath='block/blk-mq.c' line='3507' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_alloc_tag_set'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3507' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='blk_mq_complete_request' mangled-name='blk_mq_complete_request' filepath='block/blk-mq.c' line='699' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_complete_request'>
@@ -114741,8 +117320,8 @@
         <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='508' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_free_tag_set' mangled-name='blk_mq_free_tag_set' filepath='block/blk-mq.c' line='3591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_tag_set'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3591' column='1'/>
+      <function-decl name='blk_mq_free_tag_set' mangled-name='blk_mq_free_tag_set' filepath='block/blk-mq.c' line='3603' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_free_tag_set'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3603' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_freeze_queue' mangled-name='blk_mq_freeze_queue' filepath='block/blk-mq.c' line='182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_freeze_queue'>
@@ -114758,15 +117337,15 @@
         <parameter type-id='7359adad' name='timeout' filepath='block/blk-mq.c' line='157' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_mq_init_queue' mangled-name='blk_mq_init_queue' filepath='block/blk-mq.c' line='3142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_queue'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3142' column='1'/>
+      <function-decl name='blk_mq_init_queue' mangled-name='blk_mq_init_queue' filepath='block/blk-mq.c' line='3154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_queue'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3154' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
-      <function-decl name='blk_mq_init_sq_queue' mangled-name='blk_mq_init_sq_queue' filepath='block/blk-mq.c' line='3152' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_sq_queue'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3152' column='1'/>
-        <parameter type-id='e1962c5d' name='ops' filepath='block/blk-mq.c' line='3153' column='1'/>
-        <parameter type-id='f0981eeb' name='queue_depth' filepath='block/blk-mq.c' line='3154' column='1'/>
-        <parameter type-id='f0981eeb' name='set_flags' filepath='block/blk-mq.c' line='3155' column='1'/>
+      <function-decl name='blk_mq_init_sq_queue' mangled-name='blk_mq_init_sq_queue' filepath='block/blk-mq.c' line='3164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_init_sq_queue'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3164' column='1'/>
+        <parameter type-id='e1962c5d' name='ops' filepath='block/blk-mq.c' line='3165' column='1'/>
+        <parameter type-id='f0981eeb' name='queue_depth' filepath='block/blk-mq.c' line='3166' column='1'/>
+        <parameter type-id='f0981eeb' name='set_flags' filepath='block/blk-mq.c' line='3167' column='1'/>
         <return type-id='e7d2a5fc'/>
       </function-decl>
       <function-decl name='blk_mq_map_queues' mangled-name='blk_mq_map_queues' filepath='block/blk-mq-cpumap.c' line='35' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_map_queues'>
@@ -114788,8 +117367,8 @@
         <parameter type-id='b50a4934' name='kick_requeue_list' filepath='block/blk-mq.c' line='774' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_rq_cpu' mangled-name='blk_mq_rq_cpu' filepath='block/blk-mq.c' line='4012' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_rq_cpu'>
-        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='4012' column='1'/>
+      <function-decl name='blk_mq_rq_cpu' mangled-name='blk_mq_rq_cpu' filepath='block/blk-mq.c' line='4024' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_rq_cpu'>
+        <parameter type-id='3dad1a48' name='rq' filepath='block/blk-mq.c' line='4024' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='blk_mq_run_hw_queue' mangled-name='blk_mq_run_hw_queue' filepath='block/blk-mq.c' line='1628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_run_hw_queue'>
@@ -114862,9 +117441,9 @@
         <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='250' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='blk_mq_update_nr_hw_queues' mangled-name='blk_mq_update_nr_hw_queues' filepath='block/blk-mq.c' line='3794' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_update_nr_hw_queues'>
-        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3794' column='1'/>
-        <parameter type-id='95e97e5e' name='nr_hw_queues' filepath='block/blk-mq.c' line='3794' column='1'/>
+      <function-decl name='blk_mq_update_nr_hw_queues' mangled-name='blk_mq_update_nr_hw_queues' filepath='block/blk-mq.c' line='3806' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_update_nr_hw_queues'>
+        <parameter type-id='cc26d15f' name='set' filepath='block/blk-mq.c' line='3806' column='1'/>
+        <parameter type-id='95e97e5e' name='nr_hw_queues' filepath='block/blk-mq.c' line='3806' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='blk_mq_virtio_map_queues' mangled-name='blk_mq_virtio_map_queues' filepath='block/blk-mq-virtio.c' line='24' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_mq_virtio_map_queues'>
@@ -114873,10 +117452,10 @@
         <parameter type-id='95e97e5e' name='first_vec' filepath='block/blk-mq-virtio.c' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='block/blk-mq.c' line='3958' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
-        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='3958' column='1'/>
-        <parameter type-id='041bc907' name='cookie' filepath='block/blk-mq.c' line='3958' column='1'/>
-        <parameter type-id='b50a4934' name='spin' filepath='block/blk-mq.c' line='3958' column='1'/>
+      <function-decl name='blk_poll' mangled-name='blk_poll' filepath='block/blk-mq.c' line='3970' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_poll'>
+        <parameter type-id='e7d2a5fc' name='q' filepath='block/blk-mq.c' line='3970' column='1'/>
+        <parameter type-id='041bc907' name='cookie' filepath='block/blk-mq.c' line='3970' column='1'/>
+        <parameter type-id='b50a4934' name='spin' filepath='block/blk-mq.c' line='3970' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='blk_put_queue' mangled-name='blk_put_queue' filepath='block/blk-core.c' line='335' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='blk_put_queue'>
@@ -115442,6 +118021,50 @@
         <parameter type-id='95e97e5e' name='cap' filepath='kernel/capability.c' line='447' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
+      <function-decl name='cdc_ncm_bind_common' mangled-name='cdc_ncm_bind_common' filepath='drivers/net/usb/cdc_ncm.c' line='802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_ncm_bind_common'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/cdc_ncm.c' line='802' column='1'/>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/cdc_ncm.c' line='802' column='1'/>
+        <parameter type-id='f9b06939' name='data_altsetting' filepath='drivers/net/usb/cdc_ncm.c' line='802' column='1'/>
+        <parameter type-id='95e97e5e' name='drvflags' filepath='drivers/net/usb/cdc_ncm.c' line='802' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='cdc_ncm_change_mtu' mangled-name='cdc_ncm_change_mtu' filepath='drivers/net/usb/cdc_ncm.c' line='779' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_ncm_change_mtu'>
+        <parameter type-id='68a2d05b' name='net' filepath='drivers/net/usb/cdc_ncm.c' line='779' column='1'/>
+        <parameter type-id='95e97e5e' name='new_mtu' filepath='drivers/net/usb/cdc_ncm.c' line='779' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='cdc_ncm_fill_tx_frame' mangled-name='cdc_ncm_fill_tx_frame' filepath='drivers/net/usb/cdc_ncm.c' line='1181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_ncm_fill_tx_frame'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/cdc_ncm.c' line='1181' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='drivers/net/usb/cdc_ncm.c' line='1181' column='1'/>
+        <parameter type-id='2f162548' name='sign' filepath='drivers/net/usb/cdc_ncm.c' line='1181' column='1'/>
+        <return type-id='0fbf3cfd'/>
+      </function-decl>
+      <function-decl name='cdc_ncm_rx_verify_ndp16' mangled-name='cdc_ncm_rx_verify_ndp16' filepath='drivers/net/usb/cdc_ncm.c' line='1628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_ncm_rx_verify_ndp16'>
+        <parameter type-id='0fbf3cfd' name='skb_in' filepath='drivers/net/usb/cdc_ncm.c' line='1628' column='1'/>
+        <parameter type-id='95e97e5e' name='ndpoffset' filepath='drivers/net/usb/cdc_ncm.c' line='1628' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='cdc_ncm_rx_verify_nth16' mangled-name='cdc_ncm_rx_verify_nth16' filepath='drivers/net/usb/cdc_ncm.c' line='1531' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_ncm_rx_verify_nth16'>
+        <parameter type-id='c786c422' name='ctx' filepath='drivers/net/usb/cdc_ncm.c' line='1531' column='1'/>
+        <parameter type-id='0fbf3cfd' name='skb_in' filepath='drivers/net/usb/cdc_ncm.c' line='1531' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='cdc_ncm_select_altsetting' mangled-name='cdc_ncm_select_altsetting' filepath='drivers/net/usb/cdc_ncm.c' line='1013' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_ncm_select_altsetting'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/cdc_ncm.c' line='1013' column='1'/>
+        <return type-id='f9b06939'/>
+      </function-decl>
+      <function-decl name='cdc_ncm_unbind' mangled-name='cdc_ncm_unbind' filepath='drivers/net/usb/cdc_ncm.c' line='975' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_ncm_unbind'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/cdc_ncm.c' line='975' column='1'/>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/cdc_ncm.c' line='975' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='cdc_parse_cdc_header' mangled-name='cdc_parse_cdc_header' filepath='drivers/usb/core/message.c' line='2279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdc_parse_cdc_header'>
+        <parameter type-id='16f45b2c' name='hdr' filepath='drivers/usb/core/message.c' line='2279' column='1'/>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/message.c' line='2280' column='1'/>
+        <parameter type-id='8bff8096' name='buffer' filepath='drivers/usb/core/message.c' line='2281' column='1'/>
+        <parameter type-id='95e97e5e' name='buflen' filepath='drivers/usb/core/message.c' line='2282' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='cdev_add' mangled-name='cdev_add' filepath='fs/char_dev.c' line='479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cdev_add'>
         <parameter type-id='3e6eb939' name='p' filepath='fs/char_dev.c' line='479' column='1'/>
         <parameter type-id='8504f260' name='dev' filepath='fs/char_dev.c' line='479' column='1'/>
@@ -115692,6 +118315,7 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='clk_divider_ops' type-id='92072f8b' mangled-name='clk_divider_ops' visibility='default' filepath='drivers/clk/clk-divider.c' line='453' column='1' elf-symbol-id='clk_divider_ops'/>
+      <var-decl name='clk_divider_ro_ops' type-id='92072f8b' mangled-name='clk_divider_ro_ops' visibility='default' filepath='drivers/clk/clk-divider.c' line='460' column='1' elf-symbol-id='clk_divider_ro_ops'/>
       <function-decl name='clk_enable' mangled-name='clk_enable' filepath='drivers/clk/clk.c' line='1160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_enable'>
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='1160' column='1'/>
         <return type-id='95e97e5e'/>
@@ -115709,6 +118333,10 @@
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='2489' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
+      <function-decl name='clk_get_phase' mangled-name='clk_get_phase' filepath='drivers/clk/clk.c' line='2773' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_get_phase'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='2773' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='clk_get_rate' mangled-name='clk_get_rate' filepath='drivers/clk/clk.c' line='1673' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_get_rate'>
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='1673' column='1'/>
         <return type-id='7359adad'/>
@@ -115817,6 +118445,7 @@
         <return type-id='f0981eeb'/>
       </function-decl>
       <var-decl name='clk_mux_ops' type-id='92072f8b' mangled-name='clk_mux_ops' visibility='default' filepath='drivers/clk/clk-mux.c' line='136' column='1' elf-symbol-id='clk_mux_ops'/>
+      <var-decl name='clk_mux_ro_ops' type-id='92072f8b' mangled-name='clk_mux_ro_ops' visibility='default' filepath='drivers/clk/clk-mux.c' line='143' column='1' elf-symbol-id='clk_mux_ro_ops'/>
       <function-decl name='clk_notifier_register' mangled-name='clk_notifier_register' filepath='drivers/clk/clk.c' line='4396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_notifier_register'>
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='4396' column='1'/>
         <parameter type-id='d504f73d' name='nb' filepath='drivers/clk/clk.c' line='4396' column='1'/>
@@ -115901,6 +118530,20 @@
         <parameter type-id='cff2d845' name='lock' filepath='drivers/clk/clk-gate.c' line='187' column='1'/>
         <return type-id='7d0bc0eb'/>
       </function-decl>
+      <function-decl name='clk_register_mux_table' mangled-name='clk_register_mux_table' filepath='drivers/clk/clk-mux.c' line='209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_register_mux_table'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/clk/clk-mux.c' line='209' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/clk/clk-mux.c' line='209' column='1'/>
+        <parameter type-id='13956559' name='parent_names' filepath='drivers/clk/clk-mux.c' line='210' column='1'/>
+        <parameter type-id='f9b06939' name='num_parents' filepath='drivers/clk/clk-mux.c' line='210' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='drivers/clk/clk-mux.c' line='211' column='1'/>
+        <parameter type-id='eaa32e2f' name='reg' filepath='drivers/clk/clk-mux.c' line='211' column='1'/>
+        <parameter type-id='f9b06939' name='shift' filepath='drivers/clk/clk-mux.c' line='211' column='1'/>
+        <parameter type-id='19c2251e' name='mask' filepath='drivers/clk/clk-mux.c' line='211' column='1'/>
+        <parameter type-id='f9b06939' name='clk_mux_flags' filepath='drivers/clk/clk-mux.c' line='212' column='1'/>
+        <parameter type-id='f9409001' name='table' filepath='drivers/clk/clk-mux.c' line='212' column='1'/>
+        <parameter type-id='cff2d845' name='lock' filepath='drivers/clk/clk-mux.c' line='212' column='1'/>
+        <return type-id='7d0bc0eb'/>
+      </function-decl>
       <function-decl name='clk_round_rate' mangled-name='clk_round_rate' filepath='drivers/clk/clk.c' line='1479' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_round_rate'>
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='1479' column='1'/>
         <parameter type-id='7359adad' name='rate' filepath='drivers/clk/clk.c' line='1479' column='1'/>
@@ -115911,6 +118554,11 @@
         <parameter type-id='7d0bc0eb' name='parent' filepath='drivers/clk/clk.c' line='2653' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='clk_set_phase' mangled-name='clk_set_phase' filepath='drivers/clk/clk.c' line='2722' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_set_phase'>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='2722' column='1'/>
+        <parameter type-id='95e97e5e' name='degrees' filepath='drivers/clk/clk.c' line='2722' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='clk_set_rate' mangled-name='clk_set_rate' filepath='drivers/clk/clk.c' line='2309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='clk_set_rate'>
         <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/clk/clk.c' line='2309' column='1'/>
         <parameter type-id='7359adad' name='rate' filepath='drivers/clk/clk.c' line='2309' column='1'/>
@@ -116195,6 +118843,26 @@
         <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='248' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='cpufreq_dbs_governor_exit' mangled-name='cpufreq_dbs_governor_exit' filepath='drivers/cpufreq/cpufreq_governor.c' line='477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_dbs_governor_exit'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq_governor.c' line='477' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='cpufreq_dbs_governor_init' mangled-name='cpufreq_dbs_governor_init' filepath='drivers/cpufreq/cpufreq_governor.c' line='391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_dbs_governor_init'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq_governor.c' line='391' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='cpufreq_dbs_governor_limits' mangled-name='cpufreq_dbs_governor_limits' filepath='drivers/cpufreq/cpufreq_governor.c' line='555' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_dbs_governor_limits'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq_governor.c' line='555' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='cpufreq_dbs_governor_start' mangled-name='cpufreq_dbs_governor_start' filepath='drivers/cpufreq/cpufreq_governor.c' line='505' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_dbs_governor_start'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq_governor.c' line='505' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='cpufreq_dbs_governor_stop' mangled-name='cpufreq_dbs_governor_stop' filepath='drivers/cpufreq/cpufreq_governor.c' line='543' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_dbs_governor_stop'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq_governor.c' line='543' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='cpufreq_disable_fast_switch' mangled-name='cpufreq_disable_fast_switch' filepath='drivers/cpufreq/cpufreq.c' line='520' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_disable_fast_switch'>
         <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq.c' line='520' column='1'/>
         <return type-id='48b5725f'/>
@@ -116322,6 +118990,10 @@
         <parameter type-id='f0981eeb' name='list' filepath='drivers/cpufreq/cpufreq.c' line='2035' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='cpufreq_update_limits' mangled-name='cpufreq_update_limits' filepath='drivers/cpufreq/cpufreq.c' line='2592' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_update_limits'>
+        <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2592' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='cpufreq_update_policy' mangled-name='cpufreq_update_policy' filepath='drivers/cpufreq/cpufreq.c' line='2563' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='cpufreq_update_policy'>
         <parameter type-id='f0981eeb' name='cpu' filepath='drivers/cpufreq/cpufreq.c' line='2563' column='1'/>
         <return type-id='48b5725f'/>
@@ -116396,6 +119068,12 @@
         <parameter type-id='74bccedd' name='pmask' filepath='kernel/cgroup/cpuset.c' line='3346' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='crc16' mangled-name='crc16' filepath='lib/crc16.c' line='55' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crc16'>
+        <parameter type-id='1dc6a898' name='crc' filepath='lib/crc16.c' line='55' column='1'/>
+        <parameter type-id='bbaf3419' name='buffer' filepath='lib/crc16.c' line='55' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='lib/crc16.c' line='55' column='1'/>
+        <return type-id='1dc6a898'/>
+      </function-decl>
       <function-decl name='crc32_be' mangled-name='crc32_be' filepath='lib/crc32.c' line='340' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='crc32_be'>
         <parameter type-id='19c2251e' name='crc' filepath='lib/crc32.c' line='340' column='1'/>
         <parameter type-id='354f7eb9' name='p' filepath='lib/crc32.c' line='340' column='1'/>
@@ -116917,6 +119595,10 @@
         <parameter type-id='a54c778f' name='wait' filepath='net/core/datagram.c' line='798' column='1'/>
         <return type-id='8f254b08'/>
       </function-decl>
+      <function-decl name='dbs_update' mangled-name='dbs_update' filepath='drivers/cpufreq/cpufreq_governor.c' line='114' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dbs_update'>
+        <parameter type-id='343c3ae4' name='policy' filepath='drivers/cpufreq/cpufreq_governor.c' line='114' column='1'/>
+        <return type-id='f0981eeb'/>
+      </function-decl>
       <function-decl name='deactivate_locked_super' mangled-name='deactivate_locked_super' filepath='fs/super.c' line='329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='deactivate_locked_super'>
         <parameter type-id='42c8f564' name='s' filepath='fs/super.c' line='329' column='1'/>
         <return type-id='48b5725f'/>
@@ -117377,40 +120059,40 @@
         <parameter type-id='873a2591' name='table' filepath='drivers/opp/cpu.c' line='44' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_add_table' mangled-name='dev_pm_opp_of_add_table' filepath='drivers/opp/of.c' line='973' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='973' column='1'/>
+      <function-decl name='dev_pm_opp_of_add_table' mangled-name='dev_pm_opp_of_add_table' filepath='drivers/opp/of.c' line='965' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='965' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_add_table_indexed' mangled-name='dev_pm_opp_of_add_table_indexed' filepath='drivers/opp/of.c' line='1017' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table_indexed'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='1017' column='1'/>
-        <parameter type-id='95e97e5e' name='index' filepath='drivers/opp/of.c' line='1017' column='1'/>
+      <function-decl name='dev_pm_opp_of_add_table_indexed' mangled-name='dev_pm_opp_of_add_table_indexed' filepath='drivers/opp/of.c' line='1009' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_add_table_indexed'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='1009' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/opp/of.c' line='1009' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_cpumask_add_table' mangled-name='dev_pm_opp_of_cpumask_add_table' filepath='drivers/opp/of.c' line='1066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_cpumask_add_table'>
-        <parameter type-id='5f8a1ac4' name='cpumask' filepath='drivers/opp/of.c' line='1066' column='1'/>
+      <function-decl name='dev_pm_opp_of_cpumask_add_table' mangled-name='dev_pm_opp_of_cpumask_add_table' filepath='drivers/opp/of.c' line='1058' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_cpumask_add_table'>
+        <parameter type-id='5f8a1ac4' name='cpumask' filepath='drivers/opp/of.c' line='1058' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_cpumask_remove_table' mangled-name='dev_pm_opp_of_cpumask_remove_table' filepath='drivers/opp/of.c' line='1054' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_cpumask_remove_table'>
-        <parameter type-id='5f8a1ac4' name='cpumask' filepath='drivers/opp/of.c' line='1054' column='1'/>
+      <function-decl name='dev_pm_opp_of_cpumask_remove_table' mangled-name='dev_pm_opp_of_cpumask_remove_table' filepath='drivers/opp/of.c' line='1046' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_cpumask_remove_table'>
+        <parameter type-id='5f8a1ac4' name='cpumask' filepath='drivers/opp/of.c' line='1046' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_find_icc_paths' mangled-name='dev_pm_opp_of_find_icc_paths' filepath='drivers/opp/of.c' line='372' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_find_icc_paths'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='372' column='1'/>
-        <parameter type-id='e62a60bd' name='opp_table' filepath='drivers/opp/of.c' line='373' column='1'/>
+      <function-decl name='dev_pm_opp_of_find_icc_paths' mangled-name='dev_pm_opp_of_find_icc_paths' filepath='drivers/opp/of.c' line='364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_find_icc_paths'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='364' column='1'/>
+        <parameter type-id='e62a60bd' name='opp_table' filepath='drivers/opp/of.c' line='365' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_get_sharing_cpus' mangled-name='dev_pm_opp_of_get_sharing_cpus' filepath='drivers/opp/of.c' line='1123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_get_sharing_cpus'>
-        <parameter type-id='fa0b179b' name='cpu_dev' filepath='drivers/opp/of.c' line='1123' column='1'/>
-        <parameter type-id='74bccedd' name='cpumask' filepath='drivers/opp/of.c' line='1124' column='1'/>
+      <function-decl name='dev_pm_opp_of_get_sharing_cpus' mangled-name='dev_pm_opp_of_get_sharing_cpus' filepath='drivers/opp/of.c' line='1115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_get_sharing_cpus'>
+        <parameter type-id='fa0b179b' name='cpu_dev' filepath='drivers/opp/of.c' line='1115' column='1'/>
+        <parameter type-id='74bccedd' name='cpumask' filepath='drivers/opp/of.c' line='1116' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_register_em' mangled-name='dev_pm_opp_of_register_em' filepath='drivers/opp/of.c' line='1300' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_register_em'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='1300' column='1'/>
-        <parameter type-id='74bccedd' name='cpus' filepath='drivers/opp/of.c' line='1300' column='1'/>
+      <function-decl name='dev_pm_opp_of_register_em' mangled-name='dev_pm_opp_of_register_em' filepath='drivers/opp/of.c' line='1292' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_register_em'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='1292' column='1'/>
+        <parameter type-id='74bccedd' name='cpus' filepath='drivers/opp/of.c' line='1292' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dev_pm_opp_of_remove_table' mangled-name='dev_pm_opp_of_remove_table' filepath='drivers/opp/of.c' line='636' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_remove_table'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='636' column='1'/>
+      <function-decl name='dev_pm_opp_of_remove_table' mangled-name='dev_pm_opp_of_remove_table' filepath='drivers/opp/of.c' line='628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_of_remove_table'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/of.c' line='628' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='dev_pm_opp_put' mangled-name='dev_pm_opp_put' filepath='drivers/opp/core.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_put'>
@@ -117457,6 +120139,11 @@
         <parameter type-id='80f4b756' name='name' filepath='drivers/opp/core.c' line='1865' column='1'/>
         <return type-id='e62a60bd'/>
       </function-decl>
+      <function-decl name='dev_pm_opp_set_prop_name' mangled-name='dev_pm_opp_set_prop_name' filepath='drivers/opp/core.c' line='1665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_set_prop_name'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='1665' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/opp/core.c' line='1665' column='1'/>
+        <return type-id='e62a60bd'/>
+      </function-decl>
       <function-decl name='dev_pm_opp_set_rate' mangled-name='dev_pm_opp_set_rate' filepath='drivers/opp/core.c' line='914' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_pm_opp_set_rate'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/opp/core.c' line='914' column='1'/>
         <parameter type-id='7359adad' name='target_freq' filepath='drivers/opp/core.c' line='914' column='1'/>
@@ -117558,6 +120245,12 @@
         <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/dev.c' line='4192' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='dev_set_mac_address' mangled-name='dev_set_mac_address' filepath='net/core/dev.c' line='8724' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_set_mac_address'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='8724' column='1'/>
+        <parameter type-id='5c0abad8' name='sa' filepath='net/core/dev.c' line='8724' column='1'/>
+        <parameter type-id='5799dc94' name='extack' filepath='net/core/dev.c' line='8725' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='dev_set_mtu' mangled-name='dev_set_mtu' filepath='net/core/dev.c' line='8639' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dev_set_mtu'>
         <parameter type-id='68a2d05b' name='dev' filepath='net/core/dev.c' line='8639' column='1'/>
         <parameter type-id='95e97e5e' name='new_mtu' filepath='net/core/dev.c' line='8639' column='1'/>
@@ -117601,6 +120294,30 @@
         <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/devfreq_cooling.c' line='557' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='devfreq_event_disable_edev' mangled-name='devfreq_event_disable_edev' filepath='drivers/devfreq/devfreq-event.c' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_event_disable_edev'>
+        <parameter type-id='88146159' name='edev' filepath='drivers/devfreq/devfreq-event.c' line='69' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='devfreq_event_enable_edev' mangled-name='devfreq_event_enable_edev' filepath='drivers/devfreq/devfreq-event.c' line='37' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_event_enable_edev'>
+        <parameter type-id='88146159' name='edev' filepath='drivers/devfreq/devfreq-event.c' line='37' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='devfreq_event_get_edev_by_phandle' mangled-name='devfreq_event_get_edev_by_phandle' filepath='drivers/devfreq/devfreq-event.c' line='221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_event_get_edev_by_phandle'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq-event.c' line='221' column='1'/>
+        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq-event.c' line='222' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/devfreq/devfreq-event.c' line='222' column='1'/>
+        <return type-id='88146159'/>
+      </function-decl>
+      <function-decl name='devfreq_event_get_edev_count' mangled-name='devfreq_event_get_edev_count' filepath='drivers/devfreq/devfreq-event.c' line='266' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_event_get_edev_count'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq-event.c' line='266' column='1'/>
+        <parameter type-id='80f4b756' name='phandle_name' filepath='drivers/devfreq/devfreq-event.c' line='266' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='devfreq_event_get_event' mangled-name='devfreq_event_get_event' filepath='drivers/devfreq/devfreq-event.c' line='160' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_event_get_event'>
+        <parameter type-id='88146159' name='edev' filepath='drivers/devfreq/devfreq-event.c' line='160' column='1'/>
+        <parameter type-id='d6184118' name='edata' filepath='drivers/devfreq/devfreq-event.c' line='161' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='devfreq_get_devfreq_by_node' mangled-name='devfreq_get_devfreq_by_node' filepath='drivers/devfreq/devfreq.c' line='994' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devfreq_get_devfreq_by_node'>
         <parameter type-id='9a537bbe' name='node' filepath='drivers/devfreq/devfreq.c' line='994' column='1'/>
         <return type-id='f66fa7f4'/>
@@ -118019,6 +120736,11 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/devfreq/devfreq.c' line='966' column='1'/>
         <return type-id='f66fa7f4'/>
       </function-decl>
+      <function-decl name='devm_devfreq_event_add_edev' mangled-name='devm_devfreq_event_add_edev' filepath='drivers/devfreq/devfreq-event.c' line='397' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_event_add_edev'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq-event.c' line='397' column='1'/>
+        <parameter type-id='72742e5b' name='desc' filepath='drivers/devfreq/devfreq-event.c' line='398' column='1'/>
+        <return type-id='88146159'/>
+      </function-decl>
       <function-decl name='devm_devfreq_register_notifier' mangled-name='devm_devfreq_register_notifier' filepath='drivers/devfreq/devfreq.c' line='2079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_notifier'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='2079' column='1'/>
         <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='2080' column='1'/>
@@ -118026,6 +120748,11 @@
         <parameter type-id='f0981eeb' name='list' filepath='drivers/devfreq/devfreq.c' line='2082' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='devm_devfreq_register_opp_notifier' mangled-name='devm_devfreq_register_opp_notifier' filepath='drivers/devfreq/devfreq.c' line='1965' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_register_opp_notifier'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1965' column='1'/>
+        <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1966' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='devm_devfreq_remove_device' mangled-name='devm_devfreq_remove_device' filepath='drivers/devfreq/devfreq.c' line='1064' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_devfreq_remove_device'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/devfreq/devfreq.c' line='1064' column='1'/>
         <parameter type-id='f66fa7f4' name='devfreq' filepath='drivers/devfreq/devfreq.c' line='1064' column='1'/>
@@ -118176,6 +120903,13 @@
         <parameter type-id='38d4936d' name='flags' filepath='drivers/gpio/gpiolib-devres.c' line='96' column='1'/>
         <return type-id='26760480'/>
       </function-decl>
+      <function-decl name='devm_gpiod_get_index_optional' mangled-name='devm_gpiod_get_index_optional' filepath='drivers/gpio/gpiolib-devres.c' line='241' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_gpiod_get_index_optional'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/gpio/gpiolib-devres.c' line='241' column='1'/>
+        <parameter type-id='80f4b756' name='con_id' filepath='drivers/gpio/gpiolib-devres.c' line='242' column='1'/>
+        <parameter type-id='f0981eeb' name='index' filepath='drivers/gpio/gpiolib-devres.c' line='243' column='1'/>
+        <parameter type-id='38d4936d' name='flags' filepath='drivers/gpio/gpiolib-devres.c' line='244' column='1'/>
+        <return type-id='26760480'/>
+      </function-decl>
       <function-decl name='devm_gpiod_get_optional' mangled-name='devm_gpiod_get_optional' filepath='drivers/gpio/gpiolib-devres.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_gpiod_get_optional'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/gpio/gpiolib-devres.c' line='74' column='1'/>
         <parameter type-id='80f4b756' name='con_id' filepath='drivers/gpio/gpiolib-devres.c' line='75' column='1'/>
@@ -118418,6 +121152,11 @@
         <parameter type-id='b59d7dce' name='priv' filepath='drivers/pci/probe.c' line='622' column='1'/>
         <return type-id='cb0dbc3c'/>
       </function-decl>
+      <function-decl name='devm_pci_remap_cfg_resource' mangled-name='devm_pci_remap_cfg_resource' filepath='drivers/pci/pci.c' line='4202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_pci_remap_cfg_resource'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/pci/pci.c' line='4202' column='1'/>
+        <parameter type-id='c9d64c0d' name='res' filepath='drivers/pci/pci.c' line='4203' column='1'/>
+        <return type-id='eaa32e2f'/>
+      </function-decl>
       <function-decl name='devm_phy_create' mangled-name='devm_phy_create' filepath='drivers/phy/phy-core.c' line='943' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_phy_create'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/phy/phy-core.c' line='943' column='1'/>
         <parameter type-id='9a537bbe' name='node' filepath='drivers/phy/phy-core.c' line='943' column='1'/>
@@ -118447,17 +121186,17 @@
         <parameter type-id='73ea90c5' name='p' filepath='drivers/pinctrl/core.c' line='1374' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='devm_pinctrl_register' mangled-name='devm_pinctrl_register' filepath='drivers/pinctrl/core.c' line='2226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_pinctrl_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/pinctrl/core.c' line='2226' column='1'/>
-        <parameter type-id='d4682107' name='pctldesc' filepath='drivers/pinctrl/core.c' line='2227' column='1'/>
-        <parameter type-id='eaa32e2f' name='driver_data' filepath='drivers/pinctrl/core.c' line='2228' column='1'/>
+      <function-decl name='devm_pinctrl_register' mangled-name='devm_pinctrl_register' filepath='drivers/pinctrl/core.c' line='2225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_pinctrl_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/pinctrl/core.c' line='2225' column='1'/>
+        <parameter type-id='d4682107' name='pctldesc' filepath='drivers/pinctrl/core.c' line='2226' column='1'/>
+        <parameter type-id='eaa32e2f' name='driver_data' filepath='drivers/pinctrl/core.c' line='2227' column='1'/>
         <return type-id='10216dc5'/>
       </function-decl>
-      <function-decl name='devm_pinctrl_register_and_init' mangled-name='devm_pinctrl_register_and_init' filepath='drivers/pinctrl/core.c' line='2260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_pinctrl_register_and_init'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/pinctrl/core.c' line='2260' column='1'/>
-        <parameter type-id='d4682107' name='pctldesc' filepath='drivers/pinctrl/core.c' line='2261' column='1'/>
-        <parameter type-id='eaa32e2f' name='driver_data' filepath='drivers/pinctrl/core.c' line='2262' column='1'/>
-        <parameter type-id='53a00f3d' name='pctldev' filepath='drivers/pinctrl/core.c' line='2263' column='1'/>
+      <function-decl name='devm_pinctrl_register_and_init' mangled-name='devm_pinctrl_register_and_init' filepath='drivers/pinctrl/core.c' line='2259' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_pinctrl_register_and_init'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/pinctrl/core.c' line='2259' column='1'/>
+        <parameter type-id='d4682107' name='pctldesc' filepath='drivers/pinctrl/core.c' line='2260' column='1'/>
+        <parameter type-id='eaa32e2f' name='driver_data' filepath='drivers/pinctrl/core.c' line='2261' column='1'/>
+        <parameter type-id='53a00f3d' name='pctldev' filepath='drivers/pinctrl/core.c' line='2262' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='devm_platform_get_and_ioremap_resource' mangled-name='devm_platform_get_and_ioremap_resource' filepath='drivers/base/platform.c' line='80' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_platform_get_and_ioremap_resource'>
@@ -118653,12 +121392,12 @@
         <parameter type-id='f22e4524' name='ctlr' filepath='drivers/spi/spi.c' line='2829' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='devm_thermal_of_cooling_device_register' mangled-name='devm_thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_thermal_of_cooling_device_register'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/thermal/thermal_core.c' line='1221' column='1'/>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1222' column='1'/>
-        <parameter type-id='26a90f95' name='type' filepath='drivers/thermal/thermal_core.c' line='1223' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1223' column='1'/>
-        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1224' column='1'/>
+      <function-decl name='devm_thermal_of_cooling_device_register' mangled-name='devm_thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1220' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_thermal_of_cooling_device_register'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/thermal/thermal_core.c' line='1220' column='1'/>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1221' column='1'/>
+        <parameter type-id='26a90f95' name='type' filepath='drivers/thermal/thermal_core.c' line='1222' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1222' column='1'/>
+        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1223' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
       <function-decl name='devm_thermal_zone_of_sensor_register' mangled-name='devm_thermal_zone_of_sensor_register' filepath='drivers/thermal/thermal_of.c' line='615' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='devm_thermal_zone_of_sensor_register'>
@@ -118812,105 +121551,105 @@
         <parameter type-id='27f3f5d8' name='chan' filepath='drivers/dma/dmaengine.c' line='1498' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_attach' mangled-name='dma_buf_attach' filepath='drivers/dma-buf/dma-buf.c' line='815' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_attach'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='815' column='1'/>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/dma-buf/dma-buf.c' line='816' column='1'/>
+      <function-decl name='dma_buf_attach' mangled-name='dma_buf_attach' filepath='drivers/dma-buf/dma-buf.c' line='841' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_attach'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='841' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/dma-buf/dma-buf.c' line='842' column='1'/>
         <return type-id='e68e04c1'/>
       </function-decl>
-      <function-decl name='dma_buf_begin_cpu_access' mangled-name='dma_buf_begin_cpu_access' filepath='drivers/dma-buf/dma-buf.c' line='1133' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_begin_cpu_access'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1133' column='1'/>
-        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1134' column='1'/>
+      <function-decl name='dma_buf_begin_cpu_access' mangled-name='dma_buf_begin_cpu_access' filepath='drivers/dma-buf/dma-buf.c' line='1159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_begin_cpu_access'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1159' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1160' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_begin_cpu_access_partial' mangled-name='dma_buf_begin_cpu_access_partial' filepath='drivers/dma-buf/dma-buf.c' line='1155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_begin_cpu_access_partial'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1155' column='1'/>
-        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1156' column='1'/>
-        <parameter type-id='f0981eeb' name='offset' filepath='drivers/dma-buf/dma-buf.c' line='1157' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='drivers/dma-buf/dma-buf.c' line='1157' column='1'/>
+      <function-decl name='dma_buf_begin_cpu_access_partial' mangled-name='dma_buf_begin_cpu_access_partial' filepath='drivers/dma-buf/dma-buf.c' line='1181' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_begin_cpu_access_partial'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1181' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1182' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='drivers/dma-buf/dma-buf.c' line='1183' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='drivers/dma-buf/dma-buf.c' line='1183' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_detach' mangled-name='dma_buf_detach' filepath='drivers/dma-buf/dma-buf.c' line='830' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_detach'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='830' column='1'/>
-        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='830' column='1'/>
+      <function-decl name='dma_buf_detach' mangled-name='dma_buf_detach' filepath='drivers/dma-buf/dma-buf.c' line='856' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_detach'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='856' column='1'/>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='856' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_dynamic_attach' mangled-name='dma_buf_dynamic_attach' filepath='drivers/dma-buf/dma-buf.c' line='727' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_dynamic_attach'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='727' column='1'/>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/dma-buf/dma-buf.c' line='727' column='1'/>
-        <parameter type-id='ce74919f' name='importer_ops' filepath='drivers/dma-buf/dma-buf.c' line='728' column='1'/>
-        <parameter type-id='eaa32e2f' name='importer_priv' filepath='drivers/dma-buf/dma-buf.c' line='729' column='1'/>
+      <function-decl name='dma_buf_dynamic_attach' mangled-name='dma_buf_dynamic_attach' filepath='drivers/dma-buf/dma-buf.c' line='753' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_dynamic_attach'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='753' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/dma-buf/dma-buf.c' line='753' column='1'/>
+        <parameter type-id='ce74919f' name='importer_ops' filepath='drivers/dma-buf/dma-buf.c' line='754' column='1'/>
+        <parameter type-id='eaa32e2f' name='importer_priv' filepath='drivers/dma-buf/dma-buf.c' line='755' column='1'/>
         <return type-id='e68e04c1'/>
       </function-decl>
-      <function-decl name='dma_buf_end_cpu_access' mangled-name='dma_buf_end_cpu_access' filepath='drivers/dma-buf/dma-buf.c' line='1191' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_end_cpu_access'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1191' column='1'/>
-        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1192' column='1'/>
+      <function-decl name='dma_buf_end_cpu_access' mangled-name='dma_buf_end_cpu_access' filepath='drivers/dma-buf/dma-buf.c' line='1217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_end_cpu_access'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1217' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1218' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_end_cpu_access_partial' mangled-name='dma_buf_end_cpu_access_partial' filepath='drivers/dma-buf/dma-buf.c' line='1205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_end_cpu_access_partial'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1205' column='1'/>
-        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1206' column='1'/>
-        <parameter type-id='f0981eeb' name='offset' filepath='drivers/dma-buf/dma-buf.c' line='1207' column='1'/>
-        <parameter type-id='f0981eeb' name='len' filepath='drivers/dma-buf/dma-buf.c' line='1207' column='1'/>
+      <function-decl name='dma_buf_end_cpu_access_partial' mangled-name='dma_buf_end_cpu_access_partial' filepath='drivers/dma-buf/dma-buf.c' line='1231' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_end_cpu_access_partial'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1231' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1232' column='1'/>
+        <parameter type-id='f0981eeb' name='offset' filepath='drivers/dma-buf/dma-buf.c' line='1233' column='1'/>
+        <parameter type-id='f0981eeb' name='len' filepath='drivers/dma-buf/dma-buf.c' line='1233' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_export' mangled-name='dma_buf_export' filepath='drivers/dma-buf/dma-buf.c' line='545' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_export'>
-        <parameter type-id='aecb451e' name='exp_info' filepath='drivers/dma-buf/dma-buf.c' line='545' column='1'/>
+      <function-decl name='dma_buf_export' mangled-name='dma_buf_export' filepath='drivers/dma-buf/dma-buf.c' line='571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_export'>
+        <parameter type-id='aecb451e' name='exp_info' filepath='drivers/dma-buf/dma-buf.c' line='571' column='1'/>
         <return type-id='5e4f599b'/>
       </function-decl>
-      <function-decl name='dma_buf_fd' mangled-name='dma_buf_fd' filepath='drivers/dma-buf/dma-buf.c' line='644' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_fd'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='644' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='drivers/dma-buf/dma-buf.c' line='644' column='1'/>
+      <function-decl name='dma_buf_fd' mangled-name='dma_buf_fd' filepath='drivers/dma-buf/dma-buf.c' line='670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_fd'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='670' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='drivers/dma-buf/dma-buf.c' line='670' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_get' mangled-name='dma_buf_get' filepath='drivers/dma-buf/dma-buf.c' line='669' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_get'>
-        <parameter type-id='95e97e5e' name='fd' filepath='drivers/dma-buf/dma-buf.c' line='669' column='1'/>
+      <function-decl name='dma_buf_get' mangled-name='dma_buf_get' filepath='drivers/dma-buf/dma-buf.c' line='695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_get'>
+        <parameter type-id='95e97e5e' name='fd' filepath='drivers/dma-buf/dma-buf.c' line='695' column='1'/>
         <return type-id='5e4f599b'/>
       </function-decl>
-      <function-decl name='dma_buf_get_flags' mangled-name='dma_buf_get_flags' filepath='drivers/dma-buf/dma-buf.c' line='1348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_get_flags'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1348' column='1'/>
-        <parameter type-id='1d2c2b85' name='flags' filepath='drivers/dma-buf/dma-buf.c' line='1348' column='1'/>
+      <function-decl name='dma_buf_get_flags' mangled-name='dma_buf_get_flags' filepath='drivers/dma-buf/dma-buf.c' line='1374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_get_flags'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1374' column='1'/>
+        <parameter type-id='1d2c2b85' name='flags' filepath='drivers/dma-buf/dma-buf.c' line='1374' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_map_attachment' mangled-name='dma_buf_map_attachment' filepath='drivers/dma-buf/dma-buf.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_map_attachment'>
-        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='910' column='1'/>
-        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='911' column='1'/>
+      <function-decl name='dma_buf_map_attachment' mangled-name='dma_buf_map_attachment' filepath='drivers/dma-buf/dma-buf.c' line='936' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_map_attachment'>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='936' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='937' column='1'/>
         <return type-id='4adb0e6a'/>
       </function-decl>
-      <function-decl name='dma_buf_mmap' mangled-name='dma_buf_mmap' filepath='drivers/dma-buf/dma-buf.c' line='1235' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_mmap'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1235' column='1'/>
-        <parameter type-id='2ae08426' name='vma' filepath='drivers/dma-buf/dma-buf.c' line='1235' column='1'/>
-        <parameter type-id='7359adad' name='pgoff' filepath='drivers/dma-buf/dma-buf.c' line='1236' column='1'/>
+      <function-decl name='dma_buf_mmap' mangled-name='dma_buf_mmap' filepath='drivers/dma-buf/dma-buf.c' line='1261' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_mmap'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1261' column='1'/>
+        <parameter type-id='2ae08426' name='vma' filepath='drivers/dma-buf/dma-buf.c' line='1261' column='1'/>
+        <parameter type-id='7359adad' name='pgoff' filepath='drivers/dma-buf/dma-buf.c' line='1262' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_move_notify' mangled-name='dma_buf_move_notify' filepath='drivers/dma-buf/dma-buf.c' line='1006' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_move_notify'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1006' column='1'/>
+      <function-decl name='dma_buf_move_notify' mangled-name='dma_buf_move_notify' filepath='drivers/dma-buf/dma-buf.c' line='1032' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_move_notify'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1032' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_pin' mangled-name='dma_buf_pin' filepath='drivers/dma-buf/dma-buf.c' line='865' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_pin'>
-        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='865' column='1'/>
+      <function-decl name='dma_buf_pin' mangled-name='dma_buf_pin' filepath='drivers/dma-buf/dma-buf.c' line='891' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_pin'>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='891' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dma_buf_put' mangled-name='dma_buf_put' filepath='drivers/dma-buf/dma-buf.c' line='697' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_put'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='697' column='1'/>
+      <function-decl name='dma_buf_put' mangled-name='dma_buf_put' filepath='drivers/dma-buf/dma-buf.c' line='723' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_put'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='723' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_unmap_attachment' mangled-name='dma_buf_unmap_attachment' filepath='drivers/dma-buf/dma-buf.c' line='972' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_unmap_attachment'>
-        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='972' column='1'/>
-        <parameter type-id='4adb0e6a' name='sg_table' filepath='drivers/dma-buf/dma-buf.c' line='973' column='1'/>
-        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='974' column='1'/>
+      <function-decl name='dma_buf_unmap_attachment' mangled-name='dma_buf_unmap_attachment' filepath='drivers/dma-buf/dma-buf.c' line='998' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_unmap_attachment'>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='998' column='1'/>
+        <parameter type-id='4adb0e6a' name='sg_table' filepath='drivers/dma-buf/dma-buf.c' line='999' column='1'/>
+        <parameter type-id='eea6b025' name='direction' filepath='drivers/dma-buf/dma-buf.c' line='1000' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_unpin' mangled-name='dma_buf_unpin' filepath='drivers/dma-buf/dma-buf.c' line='884' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_unpin'>
-        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='884' column='1'/>
+      <function-decl name='dma_buf_unpin' mangled-name='dma_buf_unpin' filepath='drivers/dma-buf/dma-buf.c' line='910' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_unpin'>
+        <parameter type-id='e68e04c1' name='attach' filepath='drivers/dma-buf/dma-buf.c' line='910' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='dma_buf_vmap' mangled-name='dma_buf_vmap' filepath='drivers/dma-buf/dma-buf.c' line='1289' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vmap'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1289' column='1'/>
+      <function-decl name='dma_buf_vmap' mangled-name='dma_buf_vmap' filepath='drivers/dma-buf/dma-buf.c' line='1315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vmap'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1315' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='dma_buf_vunmap' mangled-name='dma_buf_vunmap' filepath='drivers/dma-buf/dma-buf.c' line='1329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vunmap'>
-        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1329' column='1'/>
-        <parameter type-id='eaa32e2f' name='vaddr' filepath='drivers/dma-buf/dma-buf.c' line='1329' column='1'/>
+      <function-decl name='dma_buf_vunmap' mangled-name='dma_buf_vunmap' filepath='drivers/dma-buf/dma-buf.c' line='1355' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dma_buf_vunmap'>
+        <parameter type-id='5e4f599b' name='dmabuf' filepath='drivers/dma-buf/dma-buf.c' line='1355' column='1'/>
+        <parameter type-id='eaa32e2f' name='vaddr' filepath='drivers/dma-buf/dma-buf.c' line='1355' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='dma_contiguous_default_area' type-id='6f67b38a' mangled-name='dma_contiguous_default_area' visibility='default' filepath='kernel/dma/contiguous.c' line='60' column='1' elf-symbol-id='dma_contiguous_default_area'/>
@@ -119381,6 +122120,10 @@
         <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1564' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='down_write_trylock' mangled-name='down_write_trylock' filepath='kernel/locking/rwsem.c' line='1593' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='down_write_trylock'>
+        <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1593' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='downgrade_write' mangled-name='downgrade_write' filepath='kernel/locking/rwsem.c' line='1628' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='downgrade_write'>
         <parameter type-id='9b58df93' name='sem' filepath='kernel/locking/rwsem.c' line='1628' column='1'/>
         <return type-id='48b5725f'/>
@@ -119402,6 +122145,10 @@
         <parameter type-id='242e3d19' name='wq' filepath='kernel/workqueue.c' line='2950' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='driver_attach' mangled-name='driver_attach' filepath='drivers/base/dd.c' line='1115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_attach'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/base/dd.c' line='1115' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='driver_create_file' mangled-name='driver_create_file' filepath='drivers/base/driver.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='driver_create_file'>
         <parameter type-id='00c7b870' name='drv' filepath='drivers/base/driver.c' line='101' column='1'/>
         <parameter type-id='1a5996d5' name='attr' filepath='drivers/base/driver.c' line='102' column='1'/>
@@ -120122,11 +122869,11 @@
         <parameter type-id='b50a4934' name='margins' filepath='drivers/gpu/drm/drm_modes.c' line='142' column='1'/>
         <return type-id='11e02f83'/>
       </function-decl>
-      <function-decl name='drm_debugfs_create_files' mangled-name='drm_debugfs_create_files' filepath='drivers/gpu/drm/drm_debugfs.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_debugfs_create_files'>
-        <parameter type-id='09894807' name='files' filepath='drivers/gpu/drm/drm_debugfs.c' line='175' column='1'/>
-        <parameter type-id='95e97e5e' name='count' filepath='drivers/gpu/drm/drm_debugfs.c' line='175' column='1'/>
-        <parameter type-id='27675065' name='root' filepath='drivers/gpu/drm/drm_debugfs.c' line='176' column='1'/>
-        <parameter type-id='6c3b3f8e' name='minor' filepath='drivers/gpu/drm/drm_debugfs.c' line='176' column='1'/>
+      <function-decl name='drm_debugfs_create_files' mangled-name='drm_debugfs_create_files' filepath='drivers/gpu/drm/drm_debugfs.c' line='176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_debugfs_create_files'>
+        <parameter type-id='09894807' name='files' filepath='drivers/gpu/drm/drm_debugfs.c' line='176' column='1'/>
+        <parameter type-id='95e97e5e' name='count' filepath='drivers/gpu/drm/drm_debugfs.c' line='176' column='1'/>
+        <parameter type-id='27675065' name='root' filepath='drivers/gpu/drm/drm_debugfs.c' line='177' column='1'/>
+        <parameter type-id='6c3b3f8e' name='minor' filepath='drivers/gpu/drm/drm_debugfs.c' line='177' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='drm_default_rgb_quant_range' mangled-name='drm_default_rgb_quant_range' filepath='drivers/gpu/drm/drm_edid.c' line='4835' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_default_rgb_quant_range'>
@@ -120217,18 +122964,18 @@
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/gpu/drm/drm_edid.c' line='1932' column='1'/>
         <return type-id='c91d1bf1'/>
       </function-decl>
-      <function-decl name='drm_dp_atomic_find_vcpi_slots' mangled-name='drm_dp_atomic_find_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4372' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_atomic_find_vcpi_slots'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4372' column='1'/>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4373' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4374' column='1'/>
-        <parameter type-id='95e97e5e' name='pbn' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4374' column='1'/>
-        <parameter type-id='95e97e5e' name='pbn_div' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4375' column='1'/>
+      <function-decl name='drm_dp_atomic_find_vcpi_slots' mangled-name='drm_dp_atomic_find_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_atomic_find_vcpi_slots'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4374' column='1'/>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4375' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4376' column='1'/>
+        <parameter type-id='95e97e5e' name='pbn' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4376' column='1'/>
+        <parameter type-id='95e97e5e' name='pbn_div' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4377' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_dp_atomic_release_vcpi_slots' mangled-name='drm_dp_atomic_release_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4466' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_atomic_release_vcpi_slots'>
-        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4466' column='1'/>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4467' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4468' column='1'/>
+      <function-decl name='drm_dp_atomic_release_vcpi_slots' mangled-name='drm_dp_atomic_release_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_atomic_release_vcpi_slots'>
+        <parameter type-id='e3dd029e' name='state' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4468' column='1'/>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4469' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4470' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_dp_aux_init' mangled-name='drm_dp_aux_init' filepath='drivers/gpu/drm/drm_dp_helper.c' line='1634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_aux_init'>
@@ -120247,10 +122994,10 @@
         <parameter type-id='f9b06939' name='link_bw' filepath='drivers/gpu/drm/drm_dp_helper.c' line='178' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_dp_calc_pbn_mode' mangled-name='drm_dp_calc_pbn_mode' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4717' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_calc_pbn_mode'>
-        <parameter type-id='95e97e5e' name='clock' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4717' column='1'/>
-        <parameter type-id='95e97e5e' name='bpp' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4717' column='1'/>
-        <parameter type-id='b50a4934' name='dsc' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4717' column='1'/>
+      <function-decl name='drm_dp_calc_pbn_mode' mangled-name='drm_dp_calc_pbn_mode' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4719' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_calc_pbn_mode'>
+        <parameter type-id='95e97e5e' name='clock' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4719' column='1'/>
+        <parameter type-id='95e97e5e' name='bpp' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4719' column='1'/>
+        <parameter type-id='b50a4934' name='dsc' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4719' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_dp_channel_eq_ok' mangled-name='drm_dp_channel_eq_ok' filepath='drivers/gpu/drm/drm_dp_helper.c' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_channel_eq_ok'>
@@ -120258,8 +123005,8 @@
         <parameter type-id='95e97e5e' name='lane_count' filepath='drivers/gpu/drm/drm_dp_helper.c' line='65' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_dp_check_act_status' mangled-name='drm_dp_check_act_status' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4677' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_check_act_status'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4677' column='1'/>
+      <function-decl name='drm_dp_check_act_status' mangled-name='drm_dp_check_act_status' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4679' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_check_act_status'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4679' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_dp_clock_recovery_ok' mangled-name='drm_dp_clock_recovery_ok' filepath='drivers/gpu/drm/drm_dp_helper.c' line='84' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_clock_recovery_ok'>
@@ -120303,9 +123050,9 @@
         <parameter type-id='b50a4934' name='is_edp' filepath='drivers/gpu/drm/drm_dp_helper.c' line='1993' column='1'/>
         <return type-id='f9b06939'/>
       </function-decl>
-      <function-decl name='drm_dp_find_vcpi_slots' mangled-name='drm_dp_find_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4308' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_find_vcpi_slots'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4308' column='1'/>
-        <parameter type-id='95e97e5e' name='pbn' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4309' column='1'/>
+      <function-decl name='drm_dp_find_vcpi_slots' mangled-name='drm_dp_find_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4310' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_find_vcpi_slots'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4310' column='1'/>
+        <parameter type-id='95e97e5e' name='pbn' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4311' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_dp_get_adjust_request_pre_emphasis' mangled-name='drm_dp_get_adjust_request_pre_emphasis' filepath='drivers/gpu/drm/drm_dp_helper.c' line='112' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_get_adjust_request_pre_emphasis'>
@@ -120334,77 +123081,77 @@
         <parameter type-id='bbaf3419' name='dpcd' filepath='drivers/gpu/drm/drm_dp_helper.c' line='135' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_allocate_vcpi' mangled-name='drm_dp_mst_allocate_vcpi' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4508' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_allocate_vcpi'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4508' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4509' column='1'/>
-        <parameter type-id='95e97e5e' name='pbn' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4509' column='1'/>
-        <parameter type-id='95e97e5e' name='slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4509' column='1'/>
+      <function-decl name='drm_dp_mst_allocate_vcpi' mangled-name='drm_dp_mst_allocate_vcpi' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4510' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_allocate_vcpi'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4510' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4511' column='1'/>
+        <parameter type-id='95e97e5e' name='pbn' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4511' column='1'/>
+        <parameter type-id='95e97e5e' name='slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4511' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_deallocate_vcpi' mangled-name='drm_dp_mst_deallocate_vcpi' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_deallocate_vcpi'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4588' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4589' column='1'/>
+      <function-decl name='drm_dp_mst_deallocate_vcpi' mangled-name='drm_dp_mst_deallocate_vcpi' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4590' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_deallocate_vcpi'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4590' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4591' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_detect_port' mangled-name='drm_dp_mst_detect_port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4219' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_detect_port'>
-        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4219' column='1'/>
-        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4220' column='1'/>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4221' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4222' column='1'/>
+      <function-decl name='drm_dp_mst_detect_port' mangled-name='drm_dp_mst_detect_port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_detect_port'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4221' column='1'/>
+        <parameter type-id='d1499e71' name='ctx' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4222' column='1'/>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4223' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4224' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_dump_topology' mangled-name='drm_dp_mst_dump_topology' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4802' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_dump_topology'>
-        <parameter type-id='f8dc9def' name='m' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4802' column='1'/>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4803' column='1'/>
+      <function-decl name='drm_dp_mst_dump_topology' mangled-name='drm_dp_mst_dump_topology' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4804' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_dump_topology'>
+        <parameter type-id='f8dc9def' name='m' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4804' column='1'/>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4805' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_get_edid' mangled-name='drm_dp_mst_get_edid' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4276' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_get_edid'>
-        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4276' column='1'/>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4276' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4276' column='1'/>
+      <function-decl name='drm_dp_mst_get_edid' mangled-name='drm_dp_mst_get_edid' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4278' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_get_edid'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4278' column='1'/>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4278' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4278' column='1'/>
         <return type-id='c91d1bf1'/>
       </function-decl>
       <function-decl name='drm_dp_mst_get_port_malloc' mangled-name='drm_dp_mst_get_port_malloc' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='1539' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_get_port_malloc'>
         <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='1539' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_hpd_irq' mangled-name='drm_dp_mst_hpd_irq' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4182' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_hpd_irq'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4182' column='1'/>
-        <parameter type-id='8bff8096' name='esi' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4182' column='1'/>
-        <parameter type-id='d8e6b335' name='handled' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4182' column='1'/>
+      <function-decl name='drm_dp_mst_hpd_irq' mangled-name='drm_dp_mst_hpd_irq' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_hpd_irq'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4184' column='1'/>
+        <parameter type-id='8bff8096' name='esi' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4184' column='1'/>
+        <parameter type-id='d8e6b335' name='handled' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4184' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_dp_mst_put_port_malloc' mangled-name='drm_dp_mst_put_port_malloc' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='1557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_put_port_malloc'>
         <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='1557' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_reset_vcpi_slots' mangled-name='drm_dp_mst_reset_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4569' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_reset_vcpi_slots'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4569' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4569' column='1'/>
+      <function-decl name='drm_dp_mst_reset_vcpi_slots' mangled-name='drm_dp_mst_reset_vcpi_slots' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_reset_vcpi_slots'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4571' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='4571' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_topology_mgr_destroy' mangled-name='drm_dp_mst_topology_mgr_destroy' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5492' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_topology_mgr_destroy'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5492' column='1'/>
+      <function-decl name='drm_dp_mst_topology_mgr_destroy' mangled-name='drm_dp_mst_topology_mgr_destroy' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5494' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_topology_mgr_destroy'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5494' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_topology_mgr_init' mangled-name='drm_dp_mst_topology_mgr_init' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5423' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_topology_mgr_init'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5423' column='1'/>
-        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5424' column='1'/>
-        <parameter type-id='7c5f8cd8' name='aux' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5424' column='1'/>
-        <parameter type-id='95e97e5e' name='max_dpcd_transaction_bytes' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5425' column='1'/>
-        <parameter type-id='95e97e5e' name='max_payloads' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5426' column='1'/>
-        <parameter type-id='95e97e5e' name='conn_base_id' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5426' column='1'/>
+      <function-decl name='drm_dp_mst_topology_mgr_init' mangled-name='drm_dp_mst_topology_mgr_init' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_topology_mgr_init'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5425' column='1'/>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5426' column='1'/>
+        <parameter type-id='7c5f8cd8' name='aux' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5426' column='1'/>
+        <parameter type-id='95e97e5e' name='max_dpcd_transaction_bytes' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5427' column='1'/>
+        <parameter type-id='95e97e5e' name='max_payloads' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5428' column='1'/>
+        <parameter type-id='95e97e5e' name='conn_base_id' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='5428' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_dp_mst_topology_mgr_set_mst' mangled-name='drm_dp_mst_topology_mgr_set_mst' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3698' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_topology_mgr_set_mst'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3698' column='1'/>
-        <parameter type-id='b50a4934' name='mst_state' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3698' column='1'/>
+      <function-decl name='drm_dp_mst_topology_mgr_set_mst' mangled-name='drm_dp_mst_topology_mgr_set_mst' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3700' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_mst_topology_mgr_set_mst'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3700' column='1'/>
+        <parameter type-id='b50a4934' name='mst_state' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3700' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_dp_send_power_updown_phy' mangled-name='drm_dp_send_power_updown_phy' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_send_power_updown_phy'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3211' column='1'/>
-        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3212' column='1'/>
-        <parameter type-id='b50a4934' name='power_up' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3212' column='1'/>
+      <function-decl name='drm_dp_send_power_updown_phy' mangled-name='drm_dp_send_power_updown_phy' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3213' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_send_power_updown_phy'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3213' column='1'/>
+        <parameter type-id='c45d1018' name='port' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3214' column='1'/>
+        <parameter type-id='b50a4934' name='power_up' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_dp_set_subconnector_property' mangled-name='drm_dp_set_subconnector_property' filepath='drivers/gpu/drm/drm_dp_helper.c' line='1102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_set_subconnector_property'>
@@ -120414,12 +123161,12 @@
         <parameter type-id='bbaf3419' name='port_cap' filepath='drivers/gpu/drm/drm_dp_helper.c' line='1105' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='drm_dp_update_payload_part1' mangled-name='drm_dp_update_payload_part1' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3362' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_update_payload_part1'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3362' column='1'/>
+      <function-decl name='drm_dp_update_payload_part1' mangled-name='drm_dp_update_payload_part1' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_update_payload_part1'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3364' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='drm_dp_update_payload_part2' mangled-name='drm_dp_update_payload_part2' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3488' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_update_payload_part2'>
-        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3488' column='1'/>
+      <function-decl name='drm_dp_update_payload_part2' mangled-name='drm_dp_update_payload_part2' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3490' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dp_update_payload_part2'>
+        <parameter type-id='88a6d23d' name='mgr' filepath='drivers/gpu/drm/drm_dp_mst_topology.c' line='3490' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='drm_dsc_compute_rc_parameters' mangled-name='drm_dsc_compute_rc_parameters' filepath='drivers/gpu/drm/drm_dsc.c' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_dsc_compute_rc_parameters'>
@@ -121153,6 +123900,10 @@
         <parameter type-id='11e02f83' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='740' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='drm_mode_sort' mangled-name='drm_mode_sort' filepath='drivers/gpu/drm/drm_modes.c' line='1321' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_sort'>
+        <parameter type-id='e84b031a' name='mode_list' filepath='drivers/gpu/drm/drm_modes.c' line='1321' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='drm_mode_vrefresh' mangled-name='drm_mode_vrefresh' filepath='drivers/gpu/drm/drm_modes.c' line='758' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_vrefresh'>
         <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='758' column='1'/>
         <return type-id='95e97e5e'/>
@@ -121783,10 +124534,10 @@
         <parameter type-id='f9841541' name='params' filepath='drivers/usb/dwc3/gadget.c' line='273' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='dwc3_stop_active_transfer' mangled-name='dwc3_stop_active_transfer' filepath='drivers/usb/dwc3/gadget.c' line='3534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dwc3_stop_active_transfer'>
-        <parameter type-id='b31af340' name='dep' filepath='drivers/usb/dwc3/gadget.c' line='3534' column='1'/>
-        <parameter type-id='b50a4934' name='force' filepath='drivers/usb/dwc3/gadget.c' line='3534' column='1'/>
-        <parameter type-id='b50a4934' name='interrupt' filepath='drivers/usb/dwc3/gadget.c' line='3535' column='1'/>
+      <function-decl name='dwc3_stop_active_transfer' mangled-name='dwc3_stop_active_transfer' filepath='drivers/usb/dwc3/gadget.c' line='3536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dwc3_stop_active_transfer'>
+        <parameter type-id='b31af340' name='dep' filepath='drivers/usb/dwc3/gadget.c' line='3536' column='1'/>
+        <parameter type-id='b50a4934' name='force' filepath='drivers/usb/dwc3/gadget.c' line='3536' column='1'/>
+        <parameter type-id='b50a4934' name='interrupt' filepath='drivers/usb/dwc3/gadget.c' line='3537' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='edac_device_add_device' mangled-name='edac_device_add_device' filepath='drivers/edac/edac_device.c' line='448' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='edac_device_add_device'>
@@ -122013,20 +124764,20 @@
         <parameter type-id='f9b06939' name='result' filepath='net/ethtool/cabletest.c' line='163' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ethtool_op_get_link' mangled-name='ethtool_op_get_link' filepath='net/ethtool/ioctl.c' line='39' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_op_get_link'>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='39' column='1'/>
+      <function-decl name='ethtool_op_get_link' mangled-name='ethtool_op_get_link' filepath='net/ethtool/ioctl.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_op_get_link'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='40' column='1'/>
         <return type-id='19c2251e'/>
       </function-decl>
-      <function-decl name='ethtool_op_get_ts_info' mangled-name='ethtool_op_get_ts_info' filepath='net/ethtool/ioctl.c' line='45' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_op_get_ts_info'>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='45' column='1'/>
-        <parameter type-id='fa058983' name='info' filepath='net/ethtool/ioctl.c' line='45' column='1'/>
+      <function-decl name='ethtool_op_get_ts_info' mangled-name='ethtool_op_get_ts_info' filepath='net/ethtool/ioctl.c' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_op_get_ts_info'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='46' column='1'/>
+        <parameter type-id='fa058983' name='info' filepath='net/ethtool/ioctl.c' line='46' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ethtool_virtdev_set_link_ksettings' mangled-name='ethtool_virtdev_set_link_ksettings' filepath='net/ethtool/ioctl.c' line='610' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_virtdev_set_link_ksettings'>
-        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='610' column='1'/>
-        <parameter type-id='b2c34f11' name='cmd' filepath='net/ethtool/ioctl.c' line='611' column='1'/>
-        <parameter type-id='f9409001' name='dev_speed' filepath='net/ethtool/ioctl.c' line='612' column='1'/>
-        <parameter type-id='8bff8096' name='dev_duplex' filepath='net/ethtool/ioctl.c' line='612' column='1'/>
+      <function-decl name='ethtool_virtdev_set_link_ksettings' mangled-name='ethtool_virtdev_set_link_ksettings' filepath='net/ethtool/ioctl.c' line='611' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ethtool_virtdev_set_link_ksettings'>
+        <parameter type-id='68a2d05b' name='dev' filepath='net/ethtool/ioctl.c' line='611' column='1'/>
+        <parameter type-id='b2c34f11' name='cmd' filepath='net/ethtool/ioctl.c' line='612' column='1'/>
+        <parameter type-id='f9409001' name='dev_speed' filepath='net/ethtool/ioctl.c' line='613' column='1'/>
+        <parameter type-id='8bff8096' name='dev_duplex' filepath='net/ethtool/ioctl.c' line='613' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='event_triggers_call' mangled-name='event_triggers_call' filepath='kernel/trace/trace_events_trigger.c' line='56' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='event_triggers_call'>
@@ -122106,12 +124857,23 @@
         <parameter type-id='f0981eeb' name='prop' filepath='drivers/extcon/extcon.c' line='817' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='extcon_set_state' mangled-name='extcon_set_state' filepath='drivers/extcon/extcon.c' line='522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_state'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='522' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='522' column='1'/>
+        <parameter type-id='b50a4934' name='state' filepath='drivers/extcon/extcon.c' line='522' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='extcon_set_state_sync' mangled-name='extcon_set_state_sync' filepath='drivers/extcon/extcon.c' line='577' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_set_state_sync'>
         <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='577' column='1'/>
         <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='577' column='1'/>
         <parameter type-id='b50a4934' name='state' filepath='drivers/extcon/extcon.c' line='577' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='extcon_sync' mangled-name='extcon_sync' filepath='drivers/extcon/extcon.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_sync'>
+        <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='408' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='408' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='extcon_unregister_notifier' mangled-name='extcon_unregister_notifier' filepath='drivers/extcon/extcon.c' line='928' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='extcon_unregister_notifier'>
         <parameter type-id='c0d6fada' name='edev' filepath='drivers/extcon/extcon.c' line='928' column='1'/>
         <parameter type-id='f0981eeb' name='id' filepath='drivers/extcon/extcon.c' line='928' column='1'/>
@@ -122231,7 +124993,7 @@
         <parameter type-id='69bf7bee' name='size' filepath='fs/read_write.c' line='162' column='1'/>
         <return type-id='69bf7bee'/>
       </function-decl>
-      <var-decl name='flow_keys_basic_dissector' type-id='379be6ec' mangled-name='flow_keys_basic_dissector' visibility='default' filepath='net/core/flow_dissector.c' line='1792' column='1' elf-symbol-id='flow_keys_basic_dissector'/>
+      <var-decl name='flow_keys_basic_dissector' type-id='379be6ec' mangled-name='flow_keys_basic_dissector' visibility='default' filepath='net/core/flow_dissector.c' line='1796' column='1' elf-symbol-id='flow_keys_basic_dissector'/>
       <function-decl name='flush_dcache_page' mangled-name='flush_dcache_page' filepath='arch/arm64/mm/flush.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='flush_dcache_page'>
         <parameter type-id='02f11ed4' name='page' filepath='arch/arm64/mm/flush.c' line='70' column='1'/>
         <return type-id='48b5725f'/>
@@ -122285,8 +125047,8 @@
         <parameter type-id='d9fbdc06' name='vec' filepath='mm/frame_vector.c' line='179' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='free_buffer_head' mangled-name='free_buffer_head' filepath='fs/buffer.c' line='3373' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_buffer_head'>
-        <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3373' column='1'/>
+      <function-decl name='free_buffer_head' mangled-name='free_buffer_head' filepath='fs/buffer.c' line='3377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_buffer_head'>
+        <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3377' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='free_candev' mangled-name='free_candev' filepath='drivers/net/can/dev/dev.c' line='800' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='free_candev'>
@@ -122648,10 +125410,10 @@
         <parameter type-id='807869d3' name='duplex_chg_out' filepath='drivers/net/mii.c' line='586' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='generic_perform_write' mangled-name='generic_perform_write' filepath='mm/filemap.c' line='3425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_perform_write'>
-        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3425' column='1'/>
-        <parameter type-id='4fa10f9e' name='i' filepath='mm/filemap.c' line='3426' column='1'/>
-        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3426' column='1'/>
+      <function-decl name='generic_perform_write' mangled-name='generic_perform_write' filepath='mm/filemap.c' line='3427' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_perform_write'>
+        <parameter type-id='77e79a4b' name='file' filepath='mm/filemap.c' line='3427' column='1'/>
+        <parameter type-id='4fa10f9e' name='i' filepath='mm/filemap.c' line='3428' column='1'/>
+        <parameter type-id='69bf7bee' name='pos' filepath='mm/filemap.c' line='3428' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
       <function-decl name='generic_shutdown_super' mangled-name='generic_shutdown_super' filepath='fs/super.c' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='generic_shutdown_super'>
@@ -122866,12 +125628,12 @@
       <function-decl name='get_state_synchronize_rcu' mangled-name='get_state_synchronize_rcu' filepath='kernel/rcu/tree.c' line='3688' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_state_synchronize_rcu'>
         <return type-id='7359adad'/>
       </function-decl>
-      <function-decl name='get_task_exe_file' mangled-name='get_task_exe_file' filepath='kernel/fork.c' line='1225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_exe_file'>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1225' column='1'/>
+      <function-decl name='get_task_exe_file' mangled-name='get_task_exe_file' filepath='kernel/fork.c' line='1226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_exe_file'>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1226' column='1'/>
         <return type-id='77e79a4b'/>
       </function-decl>
-      <function-decl name='get_task_mm' mangled-name='get_task_mm' filepath='kernel/fork.c' line='1250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_mm'>
-        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1250' column='1'/>
+      <function-decl name='get_task_mm' mangled-name='get_task_mm' filepath='kernel/fork.c' line='1251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_mm'>
+        <parameter type-id='f23e2572' name='task' filepath='kernel/fork.c' line='1251' column='1'/>
         <return type-id='df4b7819'/>
       </function-decl>
       <function-decl name='get_task_pid' mangled-name='get_task_pid' filepath='kernel/pid.c' line='439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='get_task_pid'>
@@ -122997,6 +125759,10 @@
         <parameter type-id='e84b031a' name='list_node' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='66' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
+      <function-decl name='gov_update_cpu_data' mangled-name='gov_update_cpu_data' filepath='drivers/cpufreq/cpufreq_governor.c' line='95' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gov_update_cpu_data'>
+        <parameter type-id='280461d5' name='dbs_data' filepath='drivers/cpufreq/cpufreq_governor.c' line='95' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <var-decl name='governor_sysfs_ops' type-id='0f840455' mangled-name='governor_sysfs_ops' visibility='default' filepath='drivers/cpufreq/cpufreq_governor_attr_set.c' line='42' column='1' elf-symbol-id='governor_sysfs_ops'/>
       <function-decl name='gpio_free' mangled-name='gpio_free' filepath='drivers/gpio/gpiolib-legacy.c' line='9' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpio_free'>
         <parameter type-id='f0981eeb' name='gpio' filepath='drivers/gpio/gpiolib-legacy.c' line='9' column='1'/>
@@ -123141,6 +125907,10 @@
         <parameter type-id='5bed570d' name='desc' filepath='drivers/gpio/gpiolib.c' line='3415' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='gpiod_is_active_low' mangled-name='gpiod_is_active_low' filepath='drivers/gpio/gpiolib.c' line='2584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiod_is_active_low'>
+        <parameter type-id='5bed570d' name='desc' filepath='drivers/gpio/gpiolib.c' line='2584' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='gpiod_set_array_value_cansleep' mangled-name='gpiod_set_array_value_cansleep' filepath='drivers/gpio/gpiolib.c' line='3575' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='gpiod_set_array_value_cansleep'>
         <parameter type-id='f0981eeb' name='array_size' filepath='drivers/gpio/gpiolib.c' line='3575' column='1'/>
         <parameter type-id='35c9579e' name='desc_array' filepath='drivers/gpio/gpiolib.c' line='3576' column='1'/>
@@ -123360,6 +126130,23 @@
         <parameter type-id='37175e4d' name='hdev' filepath='drivers/hid/hid-core.c' line='2504' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='hid_hw_close' mangled-name='hid_hw_close' filepath='drivers/hid/hid-core.c' line='2120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_hw_close'>
+        <parameter type-id='37175e4d' name='hdev' filepath='drivers/hid/hid-core.c' line='2120' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='hid_hw_open' mangled-name='hid_hw_open' filepath='drivers/hid/hid-core.c' line='2092' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_hw_open'>
+        <parameter type-id='37175e4d' name='hdev' filepath='drivers/hid/hid-core.c' line='2092' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='hid_hw_start' mangled-name='hid_hw_start' filepath='drivers/hid/hid-core.c' line='2050' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_hw_start'>
+        <parameter type-id='37175e4d' name='hdev' filepath='drivers/hid/hid-core.c' line='2050' column='1'/>
+        <parameter type-id='f0981eeb' name='connect_mask' filepath='drivers/hid/hid-core.c' line='2050' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='hid_hw_stop' mangled-name='hid_hw_stop' filepath='drivers/hid/hid-core.c' line='2077' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_hw_stop'>
+        <parameter type-id='37175e4d' name='hdev' filepath='drivers/hid/hid-core.c' line='2077' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='hid_input_report' mangled-name='hid_input_report' filepath='drivers/hid/hid-core.c' line='1810' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_input_report'>
         <parameter type-id='37175e4d' name='hid' filepath='drivers/hid/hid-core.c' line='1810' column='1'/>
         <parameter type-id='95e97e5e' name='type' filepath='drivers/hid/hid-core.c' line='1810' column='1'/>
@@ -123368,14 +126155,38 @@
         <parameter type-id='95e97e5e' name='interrupt' filepath='drivers/hid/hid-core.c' line='1810' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='hid_open_report' mangled-name='hid_open_report' filepath='drivers/hid/hid-core.c' line='1190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_open_report'>
+        <parameter type-id='37175e4d' name='device' filepath='drivers/hid/hid-core.c' line='1190' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='hid_parse_report' mangled-name='hid_parse_report' filepath='drivers/hid/hid-core.c' line='937' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_parse_report'>
         <parameter type-id='37175e4d' name='hid' filepath='drivers/hid/hid-core.c' line='937' column='1'/>
         <parameter type-id='474e5dcc' name='start' filepath='drivers/hid/hid-core.c' line='937' column='1'/>
         <parameter type-id='f0981eeb' name='size' filepath='drivers/hid/hid-core.c' line='937' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='hmm_range_fault' mangled-name='hmm_range_fault' filepath='mm/hmm.c' line='568' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hmm_range_fault'>
-        <parameter type-id='f9d3500f' name='range' filepath='mm/hmm.c' line='568' column='1'/>
+      <function-decl name='hid_report_raw_event' mangled-name='hid_report_raw_event' filepath='drivers/hid/hid-core.c' line='1743' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_report_raw_event'>
+        <parameter type-id='37175e4d' name='hid' filepath='drivers/hid/hid-core.c' line='1743' column='1'/>
+        <parameter type-id='95e97e5e' name='type' filepath='drivers/hid/hid-core.c' line='1743' column='1'/>
+        <parameter type-id='8bff8096' name='data' filepath='drivers/hid/hid-core.c' line='1743' column='1'/>
+        <parameter type-id='19c2251e' name='size' filepath='drivers/hid/hid-core.c' line='1743' column='1'/>
+        <parameter type-id='95e97e5e' name='interrupt' filepath='drivers/hid/hid-core.c' line='1744' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='hid_unregister_driver' mangled-name='hid_unregister_driver' filepath='drivers/hid/hid-core.c' line='2565' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_unregister_driver'>
+        <parameter type-id='cbd2074d' name='hdrv' filepath='drivers/hid/hid-core.c' line='2565' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='hid_validate_values' mangled-name='hid_validate_values' filepath='drivers/hid/hid-core.c' line='964' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hid_validate_values'>
+        <parameter type-id='37175e4d' name='hid' filepath='drivers/hid/hid-core.c' line='964' column='1'/>
+        <parameter type-id='f0981eeb' name='type' filepath='drivers/hid/hid-core.c' line='965' column='1'/>
+        <parameter type-id='f0981eeb' name='id' filepath='drivers/hid/hid-core.c' line='965' column='1'/>
+        <parameter type-id='f0981eeb' name='field_index' filepath='drivers/hid/hid-core.c' line='966' column='1'/>
+        <parameter type-id='f0981eeb' name='report_counts' filepath='drivers/hid/hid-core.c' line='967' column='1'/>
+        <return type-id='5b4284d1'/>
+      </function-decl>
+      <function-decl name='hmm_range_fault' mangled-name='hmm_range_fault' filepath='mm/hmm.c' line='571' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='hmm_range_fault'>
+        <parameter type-id='f9d3500f' name='range' filepath='mm/hmm.c' line='571' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='housekeeping_cpumask' mangled-name='housekeeping_cpumask' filepath='kernel/sched/isolation.c' line='40' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='housekeeping_cpumask'>
@@ -123984,6 +126795,10 @@
         <parameter type-id='2712709a' name='channel' filepath='drivers/iio/inkern.c' line='347' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='iio_channel_release_all' mangled-name='iio_channel_release_all' filepath='drivers/iio/inkern.c' line='458' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iio_channel_release_all'>
+        <parameter type-id='2712709a' name='channels' filepath='drivers/iio/inkern.c' line='458' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='iio_convert_raw_to_processed' mangled-name='iio_convert_raw_to_processed' filepath='drivers/iio/inkern.c' line='617' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iio_convert_raw_to_processed'>
         <parameter type-id='2712709a' name='chan' filepath='drivers/iio/inkern.c' line='617' column='1'/>
         <parameter type-id='95e97e5e' name='raw' filepath='drivers/iio/inkern.c' line='617' column='1'/>
@@ -124048,6 +126863,12 @@
         <parameter type-id='54e54fbb' name='trig' filepath='drivers/iio/industrialio-trigger.c' line='203' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='iio_update_buffers' mangled-name='iio_update_buffers' filepath='drivers/iio/industrialio-buffer.c' line='1113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='iio_update_buffers'>
+        <parameter type-id='226853d2' name='indio_dev' filepath='drivers/iio/industrialio-buffer.c' line='1113' column='1'/>
+        <parameter type-id='aa9ea333' name='insert_buffer' filepath='drivers/iio/industrialio-buffer.c' line='1114' column='1'/>
+        <parameter type-id='aa9ea333' name='remove_buffer' filepath='drivers/iio/industrialio-buffer.c' line='1115' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='import_iovec' mangled-name='import_iovec' filepath='lib/iov_iter.c' line='1812' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='import_iovec'>
         <parameter type-id='95e97e5e' name='type' filepath='lib/iov_iter.c' line='1812' column='1'/>
         <parameter type-id='2c556848' name='uvec' filepath='lib/iov_iter.c' line='1812' column='1'/>
@@ -124065,6 +126886,10 @@
         <parameter type-id='7d3cd834' name='end' filepath='net/core/utils.c' line='120' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='in6_dev_finish_destroy' mangled-name='in6_dev_finish_destroy' filepath='net/ipv6/addrconf_core.c' line='248' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='in6_dev_finish_destroy'>
+        <parameter type-id='f026b16b' name='idev' filepath='net/ipv6/addrconf_core.c' line='248' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='in6_pton' mangled-name='in6_pton' filepath='net/core/utils.c' line='184' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='in6_pton'>
         <parameter type-id='80f4b756' name='src' filepath='net/core/utils.c' line='184' column='1'/>
         <parameter type-id='95e97e5e' name='srclen' filepath='net/core/utils.c' line='184' column='1'/>
@@ -124141,6 +126966,15 @@
         <parameter type-id='95e97e5e' name='flags' filepath='kernel/sched/wait.c' line='275' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='inode_owner_or_capable' mangled-name='inode_owner_or_capable' filepath='fs/inode.c' line='2167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_owner_or_capable'>
+        <parameter type-id='c5a4eb7f' name='inode' filepath='fs/inode.c' line='2167' column='1'/>
+        <return type-id='b50a4934'/>
+      </function-decl>
+      <function-decl name='inode_permission' mangled-name='inode_permission' filepath='fs/namei.c' line='442' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='inode_permission'>
+        <parameter type-id='7e666abe' name='inode' filepath='fs/namei.c' line='442' column='1'/>
+        <parameter type-id='95e97e5e' name='mask' filepath='fs/namei.c' line='442' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='input_alloc_absinfo' mangled-name='input_alloc_absinfo' filepath='drivers/input/input.c' line='486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_alloc_absinfo'>
         <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input.c' line='486' column='1'/>
         <return type-id='48b5725f'/>
@@ -124164,6 +126998,12 @@
         <parameter type-id='f0981eeb' name='max_effects' filepath='drivers/input/ff-core.c' line='305' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='input_ff_create_memless' mangled-name='input_ff_create_memless' filepath='drivers/input/ff-memless.c' line='510' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_ff_create_memless'>
+        <parameter type-id='74b427eb' name='dev' filepath='drivers/input/ff-memless.c' line='510' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/input/ff-memless.c' line='510' column='1'/>
+        <parameter type-id='2d974d69' name='play_effect' filepath='drivers/input/ff-memless.c' line='511' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='input_ff_destroy' mangled-name='input_ff_destroy' filepath='drivers/input/ff-core.c' line='365' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_ff_destroy'>
         <parameter type-id='74b427eb' name='dev' filepath='drivers/input/ff-core.c' line='365' column='1'/>
         <return type-id='48b5725f'/>
@@ -124245,11 +127085,21 @@
         <parameter type-id='f0981eeb' name='code' filepath='drivers/input/input.c' line='1977' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='input_set_poll_interval' mangled-name='input_set_poll_interval' filepath='drivers/input/input-poller.c' line='105' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_set_poll_interval'>
+        <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input-poller.c' line='105' column='1'/>
+        <parameter type-id='f0981eeb' name='interval' filepath='drivers/input/input-poller.c' line='105' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='input_set_timestamp' mangled-name='input_set_timestamp' filepath='drivers/input/input.c' line='1942' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_set_timestamp'>
         <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input.c' line='1942' column='1'/>
         <parameter type-id='fbc017ef' name='timestamp' filepath='drivers/input/input.c' line='1942' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='input_setup_polling' mangled-name='input_setup_polling' filepath='drivers/input/input-poller.c' line='68' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_setup_polling'>
+        <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input-poller.c' line='68' column='1'/>
+        <parameter type-id='b44880ea' name='poll_fn' filepath='drivers/input/input-poller.c' line='69' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='input_unregister_device' mangled-name='input_unregister_device' filepath='drivers/input/input.c' line='2260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='input_unregister_device'>
         <parameter type-id='74b427eb' name='dev' filepath='drivers/input/input.c' line='2260' column='1'/>
         <return type-id='48b5725f'/>
@@ -124828,6 +127678,17 @@
         <parameter type-id='1c475548' name='d' filepath='kernel/irq/generic-chip.c' line='55' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='irq_gc_set_wake' mangled-name='irq_gc_set_wake' filepath='kernel/irq/generic-chip.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_gc_set_wake'>
+        <parameter type-id='1c475548' name='d' filepath='kernel/irq/generic-chip.c' line='187' column='1'/>
+        <parameter type-id='f0981eeb' name='on' filepath='kernel/irq/generic-chip.c' line='187' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <var-decl name='irq_generic_chip_ops' type-id='0926e4bd' mangled-name='irq_generic_chip_ops' visibility='default' filepath='kernel/irq/generic-chip.c' line='448' column='1' elf-symbol-id='irq_generic_chip_ops'/>
+      <function-decl name='irq_get_domain_generic_chip' mangled-name='irq_get_domain_generic_chip' filepath='kernel/irq/generic-chip.c' line='360' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_get_domain_generic_chip'>
+        <parameter type-id='7544e824' name='d' filepath='kernel/irq/generic-chip.c' line='360' column='1'/>
+        <parameter type-id='f0981eeb' name='hw_irq' filepath='kernel/irq/generic-chip.c' line='360' column='1'/>
+        <return type-id='e53d7a90'/>
+      </function-decl>
       <function-decl name='irq_get_irq_data' mangled-name='irq_get_irq_data' filepath='kernel/irq/chip.c' line='159' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='irq_get_irq_data'>
         <parameter type-id='f0981eeb' name='irq' filepath='kernel/irq/chip.c' line='159' column='1'/>
         <return type-id='1c475548'/>
@@ -124932,8 +127793,8 @@
       <function-decl name='is_console_locked' mangled-name='is_console_locked' filepath='kernel/printk/printk.c' line='2385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_console_locked'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='is_dma_buf_file' mangled-name='is_dma_buf_file' filepath='drivers/dma-buf/dma-buf.c' line='465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_dma_buf_file'>
-        <parameter type-id='77e79a4b' name='file' filepath='drivers/dma-buf/dma-buf.c' line='465' column='1'/>
+      <function-decl name='is_dma_buf_file' mangled-name='is_dma_buf_file' filepath='drivers/dma-buf/dma-buf.c' line='491' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_dma_buf_file'>
+        <parameter type-id='77e79a4b' name='file' filepath='drivers/dma-buf/dma-buf.c' line='491' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='is_vmalloc_addr' mangled-name='is_vmalloc_addr' filepath='mm/vmalloc.c' line='46' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_vmalloc_addr'>
@@ -125041,23 +127902,23 @@
         <parameter type-id='549da823' name='mnt' filepath='fs/namespace.c' line='3896' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kernel_bind' mangled-name='kernel_bind' filepath='net/socket.c' line='3515' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_bind'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3515' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3515' column='1'/>
-        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3515' column='1'/>
+      <function-decl name='kernel_bind' mangled-name='kernel_bind' filepath='net/socket.c' line='3392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_bind'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3392' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3392' column='1'/>
+        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3392' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kernel_connect' mangled-name='kernel_connect' filepath='net/socket.c' line='3584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_connect'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3584' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3584' column='1'/>
-        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3584' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='3585' column='1'/>
+      <function-decl name='kernel_connect' mangled-name='kernel_connect' filepath='net/socket.c' line='3461' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_connect'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3461' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3461' column='1'/>
+        <parameter type-id='95e97e5e' name='addrlen' filepath='net/socket.c' line='3461' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/socket.c' line='3462' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kernel_cpustat' type-id='7b5f27b3' mangled-name='kernel_cpustat' visibility='default' filepath='kernel/sched/core.c' line='4152' column='1' elf-symbol-id='kernel_cpustat'/>
-      <function-decl name='kernel_getsockname' mangled-name='kernel_getsockname' filepath='net/socket.c' line='3600' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_getsockname'>
-        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3600' column='1'/>
-        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3600' column='1'/>
+      <function-decl name='kernel_getsockname' mangled-name='kernel_getsockname' filepath='net/socket.c' line='3477' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kernel_getsockname'>
+        <parameter type-id='13103032' name='sock' filepath='net/socket.c' line='3477' column='1'/>
+        <parameter type-id='5c0abad8' name='addr' filepath='net/socket.c' line='3477' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kernel_kobj' type-id='d30bdc51' mangled-name='kernel_kobj' visibility='default' filepath='kernel/ksysfs.c' line='208' column='1' elf-symbol-id='kernel_kobj'/>
@@ -125158,8 +128019,8 @@
         <parameter type-id='eaa32e2f' name='x' filepath='mm/util.c' line='40' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kfree_sensitive' mangled-name='kfree_sensitive' filepath='mm/slab_common.c' line='1153' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_sensitive'>
-        <parameter type-id='eaa32e2f' name='p' filepath='mm/slab_common.c' line='1153' column='1'/>
+      <function-decl name='kfree_sensitive' mangled-name='kfree_sensitive' filepath='mm/slab_common.c' line='1163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_sensitive'>
+        <parameter type-id='eaa32e2f' name='p' filepath='mm/slab_common.c' line='1163' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kfree_skb' mangled-name='kfree_skb' filepath='net/core/skbuff.c' line='706' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kfree_skb'>
@@ -125193,17 +128054,17 @@
         <parameter type-id='09896a23' name='cancel' filepath='fs/aio.c' line='561' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <var-decl name='kmalloc_caches' type-id='5a527497' mangled-name='kmalloc_caches' visibility='default' filepath='mm/slab_common.c' line='594' column='1' elf-symbol-id='kmalloc_caches'/>
-      <function-decl name='kmalloc_order' mangled-name='kmalloc_order' filepath='mm/slab_common.c' line='839' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmalloc_order'>
-        <parameter type-id='b59d7dce' name='size' filepath='mm/slab_common.c' line='839' column='1'/>
-        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='839' column='1'/>
-        <parameter type-id='f0981eeb' name='order' filepath='mm/slab_common.c' line='839' column='1'/>
+      <var-decl name='kmalloc_caches' type-id='5a527497' mangled-name='kmalloc_caches' visibility='default' filepath='mm/slab_common.c' line='604' column='1' elf-symbol-id='kmalloc_caches'/>
+      <function-decl name='kmalloc_order' mangled-name='kmalloc_order' filepath='mm/slab_common.c' line='849' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmalloc_order'>
+        <parameter type-id='b59d7dce' name='size' filepath='mm/slab_common.c' line='849' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='849' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='mm/slab_common.c' line='849' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kmalloc_order_trace' mangled-name='kmalloc_order_trace' filepath='mm/slab_common.c' line='862' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmalloc_order_trace'>
-        <parameter type-id='b59d7dce' name='size' filepath='mm/slab_common.c' line='862' column='1'/>
-        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='862' column='1'/>
-        <parameter type-id='f0981eeb' name='order' filepath='mm/slab_common.c' line='862' column='1'/>
+      <function-decl name='kmalloc_order_trace' mangled-name='kmalloc_order_trace' filepath='mm/slab_common.c' line='872' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmalloc_order_trace'>
+        <parameter type-id='b59d7dce' name='size' filepath='mm/slab_common.c' line='872' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='872' column='1'/>
+        <parameter type-id='f0981eeb' name='order' filepath='mm/slab_common.c' line='872' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='kmem_cache_alloc' mangled-name='kmem_cache_alloc' filepath='mm/slub.c' line='2952' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_alloc'>
@@ -125217,12 +128078,12 @@
         <parameter type-id='b59d7dce' name='size' filepath='mm/slub.c' line='2964' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='kmem_cache_create' mangled-name='kmem_cache_create' filepath='mm/slab_common.c' line='408' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_create'>
-        <parameter type-id='80f4b756' name='name' filepath='mm/slab_common.c' line='408' column='1'/>
-        <parameter type-id='f0981eeb' name='size' filepath='mm/slab_common.c' line='408' column='1'/>
-        <parameter type-id='f0981eeb' name='align' filepath='mm/slab_common.c' line='408' column='1'/>
-        <parameter type-id='f7fe96cb' name='flags' filepath='mm/slab_common.c' line='409' column='1'/>
-        <parameter type-id='b7f9d8e6' name='ctor' filepath='mm/slab_common.c' line='409' column='1'/>
+      <function-decl name='kmem_cache_create' mangled-name='kmem_cache_create' filepath='mm/slab_common.c' line='418' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_create'>
+        <parameter type-id='80f4b756' name='name' filepath='mm/slab_common.c' line='418' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='mm/slab_common.c' line='418' column='1'/>
+        <parameter type-id='f0981eeb' name='align' filepath='mm/slab_common.c' line='418' column='1'/>
+        <parameter type-id='f7fe96cb' name='flags' filepath='mm/slab_common.c' line='419' column='1'/>
+        <parameter type-id='b7f9d8e6' name='ctor' filepath='mm/slab_common.c' line='419' column='1'/>
         <return type-id='f3b4aca8'/>
       </function-decl>
       <function-decl name='kmem_cache_create_usercopy' mangled-name='kmem_cache_create_usercopy' filepath='mm/slab_common.c' line='303' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_create_usercopy'>
@@ -125235,8 +128096,8 @@
         <parameter type-id='b7f9d8e6' name='ctor' filepath='mm/slab_common.c' line='307' column='1'/>
         <return type-id='f3b4aca8'/>
       </function-decl>
-      <function-decl name='kmem_cache_destroy' mangled-name='kmem_cache_destroy' filepath='mm/slab_common.c' line='487' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_destroy'>
-        <parameter type-id='f3b4aca8' name='s' filepath='mm/slab_common.c' line='487' column='1'/>
+      <function-decl name='kmem_cache_destroy' mangled-name='kmem_cache_destroy' filepath='mm/slab_common.c' line='497' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_destroy'>
+        <parameter type-id='f3b4aca8' name='s' filepath='mm/slab_common.c' line='497' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kmem_cache_free' mangled-name='kmem_cache_free' filepath='mm/slub.c' line='3206' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmem_cache_free'>
@@ -125339,10 +128200,10 @@
         <parameter type-id='9b23c9ad' name='envp_ext' filepath='lib/kobject_uevent.c' line='458' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='krealloc' mangled-name='krealloc' filepath='mm/slab_common.c' line='1125' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='krealloc'>
-        <parameter type-id='eaa32e2f' name='p' filepath='mm/slab_common.c' line='1125' column='1'/>
-        <parameter type-id='b59d7dce' name='new_size' filepath='mm/slab_common.c' line='1125' column='1'/>
-        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='1125' column='1'/>
+      <function-decl name='krealloc' mangled-name='krealloc' filepath='mm/slab_common.c' line='1135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='krealloc'>
+        <parameter type-id='eaa32e2f' name='p' filepath='mm/slab_common.c' line='1135' column='1'/>
+        <parameter type-id='b59d7dce' name='new_size' filepath='mm/slab_common.c' line='1135' column='1'/>
+        <parameter type-id='3eb7c31c' name='flags' filepath='mm/slab_common.c' line='1135' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
       <function-decl name='kset_create_and_add' mangled-name='kset_create_and_add' filepath='lib/kobject.c' line='1005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kset_create_and_add'>
@@ -125360,8 +128221,8 @@
         <parameter type-id='89b70200' name='k' filepath='lib/kobject.c' line='890' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ksize' mangled-name='ksize' filepath='mm/slab_common.c' line='1179' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ksize'>
-        <parameter type-id='eaa32e2f' name='objp' filepath='mm/slab_common.c' line='1179' column='1'/>
+      <function-decl name='ksize' mangled-name='ksize' filepath='mm/slab_common.c' line='1189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ksize'>
+        <parameter type-id='eaa32e2f' name='objp' filepath='mm/slab_common.c' line='1189' column='1'/>
         <return type-id='b59d7dce'/>
       </function-decl>
       <var-decl name='ksoftirqd' type-id='f23e2572' mangled-name='ksoftirqd' visibility='default' filepath='kernel/softirq.c' line='60' column='1' elf-symbol-id='ksoftirqd'/>
@@ -125820,10 +128681,10 @@
         <return type-id='459ae684'/>
       </function-decl>
       <var-decl name='loops_per_jiffy' type-id='7359adad' mangled-name='loops_per_jiffy' visibility='default' filepath='init/main.c' line='231' column='1' elf-symbol-id='loops_per_jiffy'/>
-      <function-decl name='lru_cache_disable' mangled-name='lru_cache_disable' filepath='mm/swap.c' line='953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lru_cache_disable'>
+      <function-decl name='lru_cache_disable' mangled-name='lru_cache_disable' filepath='mm/swap.c' line='966' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lru_cache_disable'>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='lru_cache_enable' mangled-name='lru_cache_enable' filepath='mm/swap.c' line='939' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lru_cache_enable'>
+      <function-decl name='lru_cache_enable' mangled-name='lru_cache_enable' filepath='mm/swap.c' line='952' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lru_cache_enable'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='lzo1x_1_compress' mangled-name='lzo1x_1_compress' filepath='lib/lzo/lzo1x_compress.c' line='381' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lzo1x_1_compress'>
@@ -126093,6 +128954,7 @@
         <parameter type-id='2522883d' name='size' filepath='mm/memblock.c' line='799' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <var-decl name='memcg_kmem_enabled_key' type-id='237c0d27' mangled-name='memcg_kmem_enabled_key' visibility='default' filepath='mm/memcontrol.c' line='394' column='1' elf-symbol-id='memcg_kmem_enabled_key'/>
       <function-decl name='memchr_inv' mangled-name='memchr_inv' filepath='lib/string.c' line='1087' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='memchr_inv'>
         <parameter type-id='eaa32e2f' name='start' filepath='lib/string.c' line='1087' column='1'/>
         <parameter type-id='95e97e5e' name='c' filepath='lib/string.c' line='1087' column='1'/>
@@ -126746,8 +129608,8 @@
         <parameter type-id='47f117d4' name='mrq' filepath='drivers/mmc/core/core.c' line='603' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='mmput' mangled-name='mmput' filepath='kernel/fork.c' line='1143' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmput'>
-        <parameter type-id='df4b7819' name='mm' filepath='kernel/fork.c' line='1143' column='1'/>
+      <function-decl name='mmput' mangled-name='mmput' filepath='kernel/fork.c' line='1144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmput'>
+        <parameter type-id='df4b7819' name='mm' filepath='kernel/fork.c' line='1144' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='mmu_interval_notifier_insert' mangled-name='mmu_interval_notifier_insert' filepath='mm/mmu_notifier.c' line='1002' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='mmu_interval_notifier_insert'>
@@ -127097,8 +129959,8 @@
         <parameter type-id='f772df6d' name='sk' filepath='net/netlink/af_netlink.c' line='2104' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='netlink_register_notifier' mangled-name='netlink_register_notifier' filepath='net/netlink/af_netlink.c' line='2734' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_register_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2734' column='1'/>
+      <function-decl name='netlink_register_notifier' mangled-name='netlink_register_notifier' filepath='net/netlink/af_netlink.c' line='2736' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_register_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2736' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='netlink_unicast' mangled-name='netlink_unicast' filepath='net/netlink/af_netlink.c' line='1315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unicast'>
@@ -127108,8 +129970,8 @@
         <parameter type-id='95e97e5e' name='nonblock' filepath='net/netlink/af_netlink.c' line='1316' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='netlink_unregister_notifier' mangled-name='netlink_unregister_notifier' filepath='net/netlink/af_netlink.c' line='2740' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unregister_notifier'>
-        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2740' column='1'/>
+      <function-decl name='netlink_unregister_notifier' mangled-name='netlink_unregister_notifier' filepath='net/netlink/af_netlink.c' line='2742' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='netlink_unregister_notifier'>
+        <parameter type-id='d504f73d' name='nb' filepath='net/netlink/af_netlink.c' line='2742' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='new_inode' mangled-name='new_inode' filepath='fs/inode.c' line='953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='new_inode'>
@@ -127630,6 +130492,13 @@
         <parameter type-id='78c01427' name='size' filepath='drivers/iommu/of_iommu.c' line='37' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='of_get_drm_display_mode' mangled-name='of_get_drm_display_mode' filepath='drivers/gpu/drm/drm_modes.c' line='708' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_drm_display_mode'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/gpu/drm/drm_modes.c' line='708' column='1'/>
+        <parameter type-id='11e02f83' name='dmode' filepath='drivers/gpu/drm/drm_modes.c' line='709' column='1'/>
+        <parameter type-id='f9409001' name='bus_flags' filepath='drivers/gpu/drm/drm_modes.c' line='709' column='1'/>
+        <parameter type-id='95e97e5e' name='index' filepath='drivers/gpu/drm/drm_modes.c' line='710' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='of_get_i2c_adapter_by_node' mangled-name='of_get_i2c_adapter_by_node' filepath='drivers/i2c/i2c-core-of.c' line='168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_get_i2c_adapter_by_node'>
         <parameter type-id='9a537bbe' name='node' filepath='drivers/i2c/i2c-core-of.c' line='168' column='1'/>
         <return type-id='b9af02c3'/>
@@ -127859,6 +130728,10 @@
         <parameter type-id='51a94113' name='out_args' filepath='drivers/of/base.c' line='1714' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='of_pci_get_max_link_speed' mangled-name='of_pci_get_max_link_speed' filepath='drivers/pci/of.c' line='591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_pci_get_max_link_speed'>
+        <parameter type-id='9a537bbe' name='node' filepath='drivers/pci/of.c' line='591' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='of_phandle_iterator_init' mangled-name='of_phandle_iterator_init' filepath='drivers/of/base.c' line='1240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_phandle_iterator_init'>
         <parameter type-id='58cfaa0e' name='it' filepath='drivers/of/base.c' line='1240' column='1'/>
         <parameter type-id='0afa6ea3' name='np' filepath='drivers/of/base.c' line='1241' column='1'/>
@@ -127900,6 +130773,10 @@
         <parameter type-id='51a94113' name='args' filepath='drivers/phy/phy-core.c' line='634' column='1'/>
         <return type-id='503ff1ba'/>
       </function-decl>
+      <function-decl name='of_pinctrl_get' mangled-name='of_pinctrl_get' filepath='drivers/pinctrl/devicetree.c' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_pinctrl_get'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/pinctrl/devicetree.c' line='103' column='1'/>
+        <return type-id='10216dc5'/>
+      </function-decl>
       <function-decl name='of_platform_depopulate' mangled-name='of_platform_depopulate' filepath='drivers/of/platform.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_platform_depopulate'>
         <parameter type-id='fa0b179b' name='parent' filepath='drivers/of/platform.c' line='588' column='1'/>
         <return type-id='48b5725f'/>
@@ -128068,6 +130945,11 @@
         <parameter type-id='90144368' name='in_addr' filepath='drivers/of/address.c' line='613' column='1'/>
         <return type-id='91ce1af9'/>
       </function-decl>
+      <function-decl name='of_usb_get_dr_mode_by_phy' mangled-name='of_usb_get_dr_mode_by_phy' filepath='drivers/usb/common/common.c' line='256' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_usb_get_dr_mode_by_phy'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/usb/common/common.c' line='256' column='1'/>
+        <parameter type-id='95e97e5e' name='arg0' filepath='drivers/usb/common/common.c' line='256' column='1'/>
+        <return type-id='d291aaf1'/>
+      </function-decl>
       <function-decl name='of_usb_get_phy_mode' mangled-name='of_usb_get_phy_mode' filepath='drivers/usb/phy/of.c' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='of_usb_get_phy_mode'>
         <parameter type-id='9a537bbe' name='np' filepath='drivers/usb/phy/of.c' line='28' column='1'/>
         <return type-id='46b5771e'/>
@@ -128087,6 +130969,13 @@
         <parameter type-id='95e97e5e' name='wait' filepath='kernel/smp.c' line='832' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='on_each_cpu_cond' mangled-name='on_each_cpu_cond' filepath='kernel/smp.c' line='916' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='on_each_cpu_cond'>
+        <parameter type-id='82fddac3' name='cond_func' filepath='kernel/smp.c' line='916' column='1'/>
+        <parameter type-id='89714567' name='func' filepath='kernel/smp.c' line='916' column='1'/>
+        <parameter type-id='eaa32e2f' name='info' filepath='kernel/smp.c' line='917' column='1'/>
+        <parameter type-id='b50a4934' name='wait' filepath='kernel/smp.c' line='917' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <var-decl name='oops_in_progress' type-id='95e97e5e' mangled-name='oops_in_progress' visibility='default' filepath='kernel/printk/printk.c' line='81' column='1' elf-symbol-id='oops_in_progress'/>
       <function-decl name='open_candev' mangled-name='open_candev' filepath='drivers/net/can/dev/dev.c' line='848' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='open_candev'>
         <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/can/dev/dev.c' line='848' column='1'/>
@@ -128227,12 +131116,12 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pcie/aer.c' line='249' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_alloc_irq_vectors_affinity' mangled-name='pci_alloc_irq_vectors_affinity' filepath='drivers/pci/msi.c' line='1218' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_alloc_irq_vectors_affinity'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1218' column='1'/>
-        <parameter type-id='f0981eeb' name='min_vecs' filepath='drivers/pci/msi.c' line='1218' column='1'/>
-        <parameter type-id='f0981eeb' name='max_vecs' filepath='drivers/pci/msi.c' line='1219' column='1'/>
-        <parameter type-id='f0981eeb' name='flags' filepath='drivers/pci/msi.c' line='1219' column='1'/>
-        <parameter type-id='8a876638' name='affd' filepath='drivers/pci/msi.c' line='1220' column='1'/>
+      <function-decl name='pci_alloc_irq_vectors_affinity' mangled-name='pci_alloc_irq_vectors_affinity' filepath='drivers/pci/msi.c' line='1221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_alloc_irq_vectors_affinity'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1221' column='1'/>
+        <parameter type-id='f0981eeb' name='min_vecs' filepath='drivers/pci/msi.c' line='1221' column='1'/>
+        <parameter type-id='f0981eeb' name='max_vecs' filepath='drivers/pci/msi.c' line='1222' column='1'/>
+        <parameter type-id='f0981eeb' name='flags' filepath='drivers/pci/msi.c' line='1222' column='1'/>
+        <parameter type-id='8a876638' name='affd' filepath='drivers/pci/msi.c' line='1223' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_assign_resource' mangled-name='pci_assign_resource' filepath='drivers/pci/setup-res.c' line='310' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_assign_resource'>
@@ -128255,12 +131144,12 @@
         <parameter type-id='08496218' name='state' filepath='drivers/pci/pci.c' line='1373' column='1'/>
         <return type-id='49c32219'/>
       </function-decl>
-      <function-decl name='pci_clear_master' mangled-name='pci_clear_master' filepath='drivers/pci/pci.c' line='4312' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_clear_master'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4312' column='1'/>
+      <function-decl name='pci_clear_master' mangled-name='pci_clear_master' filepath='drivers/pci/pci.c' line='4309' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_clear_master'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4309' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_d3cold_disable' mangled-name='pci_d3cold_disable' filepath='drivers/pci/pci.c' line='3005' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_d3cold_disable'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='3005' column='1'/>
+      <function-decl name='pci_d3cold_disable' mangled-name='pci_d3cold_disable' filepath='drivers/pci/pci.c' line='3001' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_d3cold_disable'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='3001' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_dev_present' mangled-name='pci_dev_present' filepath='drivers/pci/search.c' line='380' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_dev_present'>
@@ -128275,20 +131164,20 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/iommu/iommu.c' line='1389' column='1'/>
         <return type-id='0b19fc54'/>
       </function-decl>
-      <function-decl name='pci_device_is_present' mangled-name='pci_device_is_present' filepath='drivers/pci/pci.c' line='6149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_device_is_present'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='6149' column='1'/>
+      <function-decl name='pci_device_is_present' mangled-name='pci_device_is_present' filepath='drivers/pci/pci.c' line='6146' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_device_is_present'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='6146' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='pci_disable_device' mangled-name='pci_disable_device' filepath='drivers/pci/pci.c' line='2149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_device'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='2149' column='1'/>
+      <function-decl name='pci_disable_device' mangled-name='pci_disable_device' filepath='drivers/pci/pci.c' line='2145' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_device'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='2145' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_disable_msi' mangled-name='pci_disable_msi' filepath='drivers/pci/msi.c' line='971' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msi'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='971' column='1'/>
+      <function-decl name='pci_disable_msi' mangled-name='pci_disable_msi' filepath='drivers/pci/msi.c' line='974' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msi'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='974' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_disable_msix' mangled-name='pci_disable_msix' filepath='drivers/pci/msi.c' line='1058' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msix'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1058' column='1'/>
+      <function-decl name='pci_disable_msix' mangled-name='pci_disable_msix' filepath='drivers/pci/msi.c' line='1061' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_msix'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1061' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_disable_pcie_error_reporting' mangled-name='pci_disable_pcie_error_reporting' filepath='drivers/pci/pcie/aer.c' line='237' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_disable_pcie_error_reporting'>
@@ -128299,28 +131188,28 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/iov.c' line='943' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_enable_atomic_ops_to_root' mangled-name='pci_enable_atomic_ops_to_root' filepath='drivers/pci/pci.c' line='3667' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_atomic_ops_to_root'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='3667' column='1'/>
-        <parameter type-id='19c2251e' name='cap_mask' filepath='drivers/pci/pci.c' line='3667' column='1'/>
+      <function-decl name='pci_enable_atomic_ops_to_root' mangled-name='pci_enable_atomic_ops_to_root' filepath='drivers/pci/pci.c' line='3663' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_atomic_ops_to_root'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='3663' column='1'/>
+        <parameter type-id='19c2251e' name='cap_mask' filepath='drivers/pci/pci.c' line='3663' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_enable_device' mangled-name='pci_enable_device' filepath='drivers/pci/pci.c' line='1956' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_device'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='1956' column='1'/>
+      <function-decl name='pci_enable_device' mangled-name='pci_enable_device' filepath='drivers/pci/pci.c' line='1952' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_device'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='1952' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_enable_device_mem' mangled-name='pci_enable_device_mem' filepath='drivers/pci/pci.c' line='1939' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_device_mem'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='1939' column='1'/>
+      <function-decl name='pci_enable_device_mem' mangled-name='pci_enable_device_mem' filepath='drivers/pci/pci.c' line='1935' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_device_mem'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='1935' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_enable_msi' mangled-name='pci_enable_msi' filepath='drivers/pci/msi.c' line='1136' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_msi'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1136' column='1'/>
+      <function-decl name='pci_enable_msi' mangled-name='pci_enable_msi' filepath='drivers/pci/msi.c' line='1139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_msi'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1139' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_enable_msix_range' mangled-name='pci_enable_msix_range' filepath='drivers/pci/msi.c' line='1193' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_msix_range'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1193' column='1'/>
-        <parameter type-id='682fb763' name='entries' filepath='drivers/pci/msi.c' line='1193' column='1'/>
-        <parameter type-id='95e97e5e' name='minvec' filepath='drivers/pci/msi.c' line='1194' column='1'/>
-        <parameter type-id='95e97e5e' name='maxvec' filepath='drivers/pci/msi.c' line='1194' column='1'/>
+      <function-decl name='pci_enable_msix_range' mangled-name='pci_enable_msix_range' filepath='drivers/pci/msi.c' line='1196' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_msix_range'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1196' column='1'/>
+        <parameter type-id='682fb763' name='entries' filepath='drivers/pci/msi.c' line='1196' column='1'/>
+        <parameter type-id='95e97e5e' name='minvec' filepath='drivers/pci/msi.c' line='1197' column='1'/>
+        <parameter type-id='95e97e5e' name='maxvec' filepath='drivers/pci/msi.c' line='1197' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_enable_pcie_error_reporting' mangled-name='pci_enable_pcie_error_reporting' filepath='drivers/pci/pcie/aer.c' line='225' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_pcie_error_reporting'>
@@ -128332,10 +131221,10 @@
         <parameter type-id='95e97e5e' name='nr_virtfn' filepath='drivers/pci/iov.c' line='928' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_enable_wake' mangled-name='pci_enable_wake' filepath='drivers/pci/pci.c' line='2513' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_wake'>
-        <parameter type-id='85196e3f' name='pci_dev' filepath='drivers/pci/pci.c' line='2513' column='1'/>
-        <parameter type-id='49c32219' name='state' filepath='drivers/pci/pci.c' line='2513' column='1'/>
-        <parameter type-id='b50a4934' name='enable' filepath='drivers/pci/pci.c' line='2513' column='1'/>
+      <function-decl name='pci_enable_wake' mangled-name='pci_enable_wake' filepath='drivers/pci/pci.c' line='2509' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_enable_wake'>
+        <parameter type-id='85196e3f' name='pci_dev' filepath='drivers/pci/pci.c' line='2509' column='1'/>
+        <parameter type-id='49c32219' name='state' filepath='drivers/pci/pci.c' line='2509' column='1'/>
+        <parameter type-id='b50a4934' name='enable' filepath='drivers/pci/pci.c' line='2509' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_epc_clear_bar' mangled-name='pci_epc_clear_bar' filepath='drivers/pci/endpoint/pci-epc-core.c' line='411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_epc_clear_bar'>
@@ -128404,8 +131293,8 @@
         <parameter type-id='eaa32e2f' name='dev_id' filepath='drivers/pci/irq.c' line='70' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_free_irq_vectors' mangled-name='pci_free_irq_vectors' filepath='drivers/pci/msi.c' line='1271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_free_irq_vectors'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1271' column='1'/>
+      <function-decl name='pci_free_irq_vectors' mangled-name='pci_free_irq_vectors' filepath='drivers/pci/msi.c' line='1274' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_free_irq_vectors'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1274' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_generic_config_read' mangled-name='pci_generic_config_read' filepath='drivers/pci/access.c' line='77' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_generic_config_read'>
@@ -128445,9 +131334,9 @@
         <parameter type-id='cb0dbc3c' name='bridge' filepath='drivers/pci/probe.c' line='3005' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_intx' mangled-name='pci_intx' filepath='drivers/pci/pci.c' line='4454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_intx'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='4454' column='1'/>
-        <parameter type-id='95e97e5e' name='enable' filepath='drivers/pci/pci.c' line='4454' column='1'/>
+      <function-decl name='pci_intx' mangled-name='pci_intx' filepath='drivers/pci/pci.c' line='4451' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_intx'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='4451' column='1'/>
+        <parameter type-id='95e97e5e' name='enable' filepath='drivers/pci/pci.c' line='4451' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_iomap' mangled-name='pci_iomap' filepath='lib/pci_iomap.c' line='111' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_iomap'>
@@ -128468,14 +131357,14 @@
         <parameter type-id='95e97e5e' name='bar' filepath='drivers/pci/pci.c' line='216' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='pci_irq_get_affinity' mangled-name='pci_irq_get_affinity' filepath='drivers/pci/msi.c' line='1317' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_get_affinity'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1317' column='1'/>
-        <parameter type-id='95e97e5e' name='nr' filepath='drivers/pci/msi.c' line='1317' column='1'/>
+      <function-decl name='pci_irq_get_affinity' mangled-name='pci_irq_get_affinity' filepath='drivers/pci/msi.c' line='1320' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_get_affinity'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1320' column='1'/>
+        <parameter type-id='95e97e5e' name='nr' filepath='drivers/pci/msi.c' line='1320' column='1'/>
         <return type-id='5f8a1ac4'/>
       </function-decl>
-      <function-decl name='pci_irq_vector' mangled-name='pci_irq_vector' filepath='drivers/pci/msi.c' line='1283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_vector'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1283' column='1'/>
-        <parameter type-id='f0981eeb' name='nr' filepath='drivers/pci/msi.c' line='1283' column='1'/>
+      <function-decl name='pci_irq_vector' mangled-name='pci_irq_vector' filepath='drivers/pci/msi.c' line='1286' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_irq_vector'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='1286' column='1'/>
+        <parameter type-id='f0981eeb' name='nr' filepath='drivers/pci/msi.c' line='1286' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_load_and_free_saved_state' mangled-name='pci_load_and_free_saved_state' filepath='drivers/pci/pci.c' line='1792' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_load_and_free_saved_state'>
@@ -128498,13 +131387,13 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci-driver.c' line='224' column='1'/>
         <return type-id='92fc8aa5'/>
       </function-decl>
-      <function-decl name='pci_msi_create_irq_domain' mangled-name='pci_msi_create_irq_domain' filepath='drivers/pci/msi.c' line='1486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_create_irq_domain'>
-        <parameter type-id='4a935625' name='fwnode' filepath='drivers/pci/msi.c' line='1486' column='1'/>
-        <parameter type-id='a9bcccf8' name='info' filepath='drivers/pci/msi.c' line='1487' column='1'/>
-        <parameter type-id='7544e824' name='parent' filepath='drivers/pci/msi.c' line='1488' column='1'/>
+      <function-decl name='pci_msi_create_irq_domain' mangled-name='pci_msi_create_irq_domain' filepath='drivers/pci/msi.c' line='1489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_create_irq_domain'>
+        <parameter type-id='4a935625' name='fwnode' filepath='drivers/pci/msi.c' line='1489' column='1'/>
+        <parameter type-id='a9bcccf8' name='info' filepath='drivers/pci/msi.c' line='1490' column='1'/>
+        <parameter type-id='7544e824' name='parent' filepath='drivers/pci/msi.c' line='1491' column='1'/>
         <return type-id='7544e824'/>
       </function-decl>
-      <function-decl name='pci_msi_enabled' mangled-name='pci_msi_enabled' filepath='drivers/pci/msi.c' line='1079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_enabled'>
+      <function-decl name='pci_msi_enabled' mangled-name='pci_msi_enabled' filepath='drivers/pci/msi.c' line='1082' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_enabled'>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_msi_mask_irq' mangled-name='pci_msi_mask_irq' filepath='drivers/pci/msi.c' line='253' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msi_mask_irq'>
@@ -128515,8 +131404,8 @@
         <parameter type-id='1c475548' name='data' filepath='drivers/pci/msi.c' line='263' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_msix_vec_count' mangled-name='pci_msix_vec_count' filepath='drivers/pci/msi.c' line='989' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msix_vec_count'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='989' column='1'/>
+      <function-decl name='pci_msix_vec_count' mangled-name='pci_msix_vec_count' filepath='drivers/pci/msi.c' line='992' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_msix_vec_count'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/msi.c' line='992' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_num_vf' mangled-name='pci_num_vf' filepath='drivers/pci/iov.c' line='960' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_num_vf'>
@@ -128541,13 +131430,13 @@
         <parameter type-id='26d4d46f' name='val' filepath='drivers/pci/access.c' line='533' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_release_region' mangled-name='pci_release_region' filepath='drivers/pci/pci.c' line='3799' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_region'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3799' column='1'/>
-        <parameter type-id='95e97e5e' name='bar' filepath='drivers/pci/pci.c' line='3799' column='1'/>
+      <function-decl name='pci_release_region' mangled-name='pci_release_region' filepath='drivers/pci/pci.c' line='3795' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_region'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3795' column='1'/>
+        <parameter type-id='95e97e5e' name='bar' filepath='drivers/pci/pci.c' line='3795' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_release_regions' mangled-name='pci_release_regions' filepath='drivers/pci/pci.c' line='3957' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_regions'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3957' column='1'/>
+      <function-decl name='pci_release_regions' mangled-name='pci_release_regions' filepath='drivers/pci/pci.c' line='3953' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_regions'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3953' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_release_resource' mangled-name='pci_release_resource' filepath='drivers/pci/setup-res.c' line='394' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_resource'>
@@ -128555,9 +131444,13 @@
         <parameter type-id='95e97e5e' name='resno' filepath='drivers/pci/setup-res.c' line='394' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_release_selected_regions' mangled-name='pci_release_selected_regions' filepath='drivers/pci/pci.c' line='3896' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_selected_regions'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3896' column='1'/>
-        <parameter type-id='95e97e5e' name='bars' filepath='drivers/pci/pci.c' line='3896' column='1'/>
+      <function-decl name='pci_release_selected_regions' mangled-name='pci_release_selected_regions' filepath='drivers/pci/pci.c' line='3892' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_release_selected_regions'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3892' column='1'/>
+        <parameter type-id='95e97e5e' name='bars' filepath='drivers/pci/pci.c' line='3892' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='pci_remove_root_bus' mangled-name='pci_remove_root_bus' filepath='drivers/pci/remove.c' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_remove_root_bus'>
+        <parameter type-id='d1feb554' name='bus' filepath='drivers/pci/remove.c' line='147' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pci_request_irq' mangled-name='pci_request_irq' filepath='drivers/pci/irq.c' line='33' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_irq'>
@@ -128570,29 +131463,29 @@
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_request_region' mangled-name='pci_request_region' filepath='drivers/pci/pci.c' line='3882' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_region'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3882' column='1'/>
-        <parameter type-id='95e97e5e' name='bar' filepath='drivers/pci/pci.c' line='3882' column='1'/>
-        <parameter type-id='80f4b756' name='res_name' filepath='drivers/pci/pci.c' line='3882' column='1'/>
+      <function-decl name='pci_request_region' mangled-name='pci_request_region' filepath='drivers/pci/pci.c' line='3878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_region'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3878' column='1'/>
+        <parameter type-id='95e97e5e' name='bar' filepath='drivers/pci/pci.c' line='3878' column='1'/>
+        <parameter type-id='80f4b756' name='res_name' filepath='drivers/pci/pci.c' line='3878' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_request_regions' mangled-name='pci_request_regions' filepath='drivers/pci/pci.c' line='3976' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_regions'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3976' column='1'/>
-        <parameter type-id='80f4b756' name='res_name' filepath='drivers/pci/pci.c' line='3976' column='1'/>
+      <function-decl name='pci_request_regions' mangled-name='pci_request_regions' filepath='drivers/pci/pci.c' line='3972' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_regions'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3972' column='1'/>
+        <parameter type-id='80f4b756' name='res_name' filepath='drivers/pci/pci.c' line='3972' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_request_selected_regions' mangled-name='pci_request_selected_regions' filepath='drivers/pci/pci.c' line='3932' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_selected_regions'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3932' column='1'/>
-        <parameter type-id='95e97e5e' name='bars' filepath='drivers/pci/pci.c' line='3932' column='1'/>
-        <parameter type-id='80f4b756' name='res_name' filepath='drivers/pci/pci.c' line='3933' column='1'/>
+      <function-decl name='pci_request_selected_regions' mangled-name='pci_request_selected_regions' filepath='drivers/pci/pci.c' line='3928' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_request_selected_regions'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='3928' column='1'/>
+        <parameter type-id='95e97e5e' name='bars' filepath='drivers/pci/pci.c' line='3928' column='1'/>
+        <parameter type-id='80f4b756' name='res_name' filepath='drivers/pci/pci.c' line='3929' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_rescan_bus' mangled-name='pci_rescan_bus' filepath='drivers/pci/probe.c' line='3226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_rescan_bus'>
         <parameter type-id='d1feb554' name='bus' filepath='drivers/pci/probe.c' line='3226' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='pci_reset_function' mangled-name='pci_reset_function' filepath='drivers/pci/pci.c' line='5154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_reset_function'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5154' column='1'/>
+      <function-decl name='pci_reset_function' mangled-name='pci_reset_function' filepath='drivers/pci/pci.c' line='5151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_reset_function'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5151' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_resize_resource' mangled-name='pci_resize_resource' filepath='drivers/pci/setup-res.c' line='410' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_resize_resource'>
@@ -128613,17 +131506,17 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='1554' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_select_bars' mangled-name='pci_select_bars' filepath='drivers/pci/pci.c' line='5996' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_select_bars'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5996' column='1'/>
-        <parameter type-id='7359adad' name='flags' filepath='drivers/pci/pci.c' line='5996' column='1'/>
+      <function-decl name='pci_select_bars' mangled-name='pci_select_bars' filepath='drivers/pci/pci.c' line='5993' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_select_bars'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5993' column='1'/>
+        <parameter type-id='7359adad' name='flags' filepath='drivers/pci/pci.c' line='5993' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_set_master' mangled-name='pci_set_master' filepath='drivers/pci/pci.c' line='4301' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_set_master'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4301' column='1'/>
+      <function-decl name='pci_set_master' mangled-name='pci_set_master' filepath='drivers/pci/pci.c' line='4298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_set_master'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4298' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='pci_set_mwi' mangled-name='pci_set_mwi' filepath='drivers/pci/pci.c' line='4364' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_set_mwi'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4364' column='1'/>
+      <function-decl name='pci_set_mwi' mangled-name='pci_set_mwi' filepath='drivers/pci/pci.c' line='4361' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_set_mwi'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4361' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_set_power_state' mangled-name='pci_set_power_state' filepath='drivers/pci/pci.c' line='1313' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_set_power_state'>
@@ -128631,12 +131524,21 @@
         <parameter type-id='49c32219' name='state' filepath='drivers/pci/pci.c' line='1313' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='pci_sriov_configure_simple' mangled-name='pci_sriov_configure_simple' filepath='drivers/pci/iov.c' line='1066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_sriov_configure_simple'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/iov.c' line='1066' column='1'/>
+        <parameter type-id='95e97e5e' name='nr_virtfn' filepath='drivers/pci/iov.c' line='1066' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='pci_stop_root_bus' mangled-name='pci_stop_root_bus' filepath='drivers/pci/remove.c' line='129' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_stop_root_bus'>
+        <parameter type-id='d1feb554' name='bus' filepath='drivers/pci/remove.c' line='129' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='pci_store_saved_state' mangled-name='pci_store_saved_state' filepath='drivers/pci/pci.c' line='1716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_store_saved_state'>
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='1716' column='1'/>
         <return type-id='e4acc659'/>
       </function-decl>
-      <function-decl name='pci_try_set_mwi' mangled-name='pci_try_set_mwi' filepath='drivers/pci/pci.c' line='4417' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_try_set_mwi'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4417' column='1'/>
+      <function-decl name='pci_try_set_mwi' mangled-name='pci_try_set_mwi' filepath='drivers/pci/pci.c' line='4414' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_try_set_mwi'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='4414' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_unmap_rom' mangled-name='pci_unmap_rom' filepath='drivers/pci/rom.c' line='187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_unmap_rom'>
@@ -128652,9 +131554,9 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/iov.c' line='976' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pci_wake_from_d3' mangled-name='pci_wake_from_d3' filepath='drivers/pci/pci.c' line='2536' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_wake_from_d3'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='2536' column='1'/>
-        <parameter type-id='b50a4934' name='enable' filepath='drivers/pci/pci.c' line='2536' column='1'/>
+      <function-decl name='pci_wake_from_d3' mangled-name='pci_wake_from_d3' filepath='drivers/pci/pci.c' line='2532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_wake_from_d3'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='2532' column='1'/>
+        <parameter type-id='b50a4934' name='enable' filepath='drivers/pci/pci.c' line='2532' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pci_walk_bus' mangled-name='pci_walk_bus' filepath='drivers/pci/bus.c' line='374' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pci_walk_bus'>
@@ -128691,11 +131593,11 @@
         <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pcie/aspm.c' line='1193' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='pcie_bandwidth_available' mangled-name='pcie_bandwidth_available' filepath='drivers/pci/pci.c' line='5823' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_bandwidth_available'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5823' column='1'/>
-        <parameter type-id='9c084b0f' name='limiting_dev' filepath='drivers/pci/pci.c' line='5823' column='1'/>
-        <parameter type-id='982c1b74' name='speed' filepath='drivers/pci/pci.c' line='5824' column='1'/>
-        <parameter type-id='d3ffb002' name='width' filepath='drivers/pci/pci.c' line='5825' column='1'/>
+      <function-decl name='pcie_bandwidth_available' mangled-name='pcie_bandwidth_available' filepath='drivers/pci/pci.c' line='5820' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_bandwidth_available'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5820' column='1'/>
+        <parameter type-id='9c084b0f' name='limiting_dev' filepath='drivers/pci/pci.c' line='5820' column='1'/>
+        <parameter type-id='982c1b74' name='speed' filepath='drivers/pci/pci.c' line='5821' column='1'/>
+        <parameter type-id='d3ffb002' name='width' filepath='drivers/pci/pci.c' line='5822' column='1'/>
         <return type-id='19c2251e'/>
       </function-decl>
       <function-decl name='pcie_capability_clear_and_set_word' mangled-name='pcie_capability_clear_and_set_word' filepath='drivers/pci/access.c' line='489' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_capability_clear_and_set_word'>
@@ -128717,21 +131619,21 @@
         <parameter type-id='1dc6a898' name='val' filepath='drivers/pci/access.c' line='465' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pcie_get_mps' mangled-name='pcie_get_mps' filepath='drivers/pci/pci.c' line='5771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_get_mps'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5771' column='1'/>
+      <function-decl name='pcie_get_mps' mangled-name='pcie_get_mps' filepath='drivers/pci/pci.c' line='5768' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_get_mps'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5768' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pcie_get_speed_cap' mangled-name='pcie_get_speed_cap' filepath='drivers/pci/pci.c' line='5874' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_get_speed_cap'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5874' column='1'/>
+      <function-decl name='pcie_get_speed_cap' mangled-name='pcie_get_speed_cap' filepath='drivers/pci/pci.c' line='5871' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_get_speed_cap'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5871' column='1'/>
         <return type-id='f290f4ed'/>
       </function-decl>
-      <function-decl name='pcie_set_mps' mangled-name='pcie_set_mps' filepath='drivers/pci/pci.c' line='5789' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_set_mps'>
-        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5789' column='1'/>
-        <parameter type-id='95e97e5e' name='mps' filepath='drivers/pci/pci.c' line='5789' column='1'/>
+      <function-decl name='pcie_set_mps' mangled-name='pcie_set_mps' filepath='drivers/pci/pci.c' line='5786' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcie_set_mps'>
+        <parameter type-id='85196e3f' name='dev' filepath='drivers/pci/pci.c' line='5786' column='1'/>
+        <parameter type-id='95e97e5e' name='mps' filepath='drivers/pci/pci.c' line='5786' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pcim_enable_device' mangled-name='pcim_enable_device' filepath='drivers/pci/pci.c' line='2029' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcim_enable_device'>
-        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='2029' column='1'/>
+      <function-decl name='pcim_enable_device' mangled-name='pcim_enable_device' filepath='drivers/pci/pci.c' line='2025' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcim_enable_device'>
+        <parameter type-id='85196e3f' name='pdev' filepath='drivers/pci/pci.c' line='2025' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='pcpu_nr_pages' mangled-name='pcpu_nr_pages' filepath='mm/percpu.c' line='3167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pcpu_nr_pages'>
@@ -128902,6 +131804,13 @@
         <parameter type-id='d61bf978' name='interface' filepath='drivers/net/phy/phy_device.c' line='1015' column='1'/>
         <return type-id='7efbcaaf'/>
       </function-decl>
+      <function-decl name='phy_connect_direct' mangled-name='phy_connect_direct' filepath='drivers/net/phy/phy_device.c' line='977' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_connect_direct'>
+        <parameter type-id='68a2d05b' name='dev' filepath='drivers/net/phy/phy_device.c' line='977' column='1'/>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='977' column='1'/>
+        <parameter type-id='548eee3a' name='handler' filepath='drivers/net/phy/phy_device.c' line='978' column='1'/>
+        <parameter type-id='d61bf978' name='interface' filepath='drivers/net/phy/phy_device.c' line='979' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='phy_disconnect' mangled-name='phy_disconnect' filepath='drivers/net/phy/phy_device.c' line='1045' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_disconnect'>
         <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='1045' column='1'/>
         <return type-id='48b5725f'/>
@@ -128961,6 +131870,10 @@
         <parameter type-id='503ff1ba' name='phy' filepath='drivers/phy/phy-core.c' line='261' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='phy_find_first' mangled-name='phy_find_first' filepath='drivers/net/phy/phy_device.c' line='925' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_find_first'>
+        <parameter type-id='ff47b24b' name='bus' filepath='drivers/net/phy/phy_device.c' line='925' column='1'/>
+        <return type-id='7efbcaaf'/>
+      </function-decl>
       <function-decl name='phy_get' mangled-name='phy_get' filepath='drivers/phy/phy-core.c' line='664' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_get'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/phy/phy-core.c' line='664' column='1'/>
         <parameter type-id='80f4b756' name='string' filepath='drivers/phy/phy-core.c' line='664' column='1'/>
@@ -128970,6 +131883,12 @@
         <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy.c' line='1321' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='phy_get_pause' mangled-name='phy_get_pause' filepath='drivers/net/phy/phy_device.c' line='2692' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_get_pause'>
+        <parameter type-id='7efbcaaf' name='phydev' filepath='drivers/net/phy/phy_device.c' line='2692' column='1'/>
+        <parameter type-id='d8e6b335' name='tx_pause' filepath='drivers/net/phy/phy_device.c' line='2692' column='1'/>
+        <parameter type-id='d8e6b335' name='rx_pause' filepath='drivers/net/phy/phy_device.c' line='2692' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='phy_init' mangled-name='phy_init' filepath='drivers/phy/phy-core.c' line='232' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_init'>
         <parameter type-id='503ff1ba' name='phy' filepath='drivers/phy/phy-core.c' line='232' column='1'/>
         <return type-id='95e97e5e'/>
@@ -128993,6 +131912,10 @@
         <parameter type-id='95e97e5e' name='cmd' filepath='drivers/net/phy/phy.c' line='350' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='phy_mipi_dphy_config_validate' mangled-name='phy_mipi_dphy_config_validate' filepath='drivers/phy/phy-core-mipi-dphy.c' line='86' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_mipi_dphy_config_validate'>
+        <parameter type-id='37cfc122' name='cfg' filepath='drivers/phy/phy-core-mipi-dphy.c' line='86' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='phy_mipi_dphy_get_default_config' mangled-name='phy_mipi_dphy_get_default_config' filepath='drivers/phy/phy-core-mipi-dphy.c' line='22' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='phy_mipi_dphy_get_default_config'>
         <parameter type-id='7359adad' name='pixel_clock' filepath='drivers/phy/phy-core-mipi-dphy.c' line='22' column='1'/>
         <parameter type-id='f0981eeb' name='bpp' filepath='drivers/phy/phy-core-mipi-dphy.c' line='23' column='1'/>
@@ -129349,8 +132272,8 @@
         <parameter type-id='f418ceb3' name='state' filepath='drivers/pinctrl/core.c' line='1318' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='pinctrl_unregister' mangled-name='pinctrl_unregister' filepath='drivers/pinctrl/core.c' line='2164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pinctrl_unregister'>
-        <parameter type-id='10216dc5' name='pctldev' filepath='drivers/pinctrl/core.c' line='2164' column='1'/>
+      <function-decl name='pinctrl_unregister' mangled-name='pinctrl_unregister' filepath='drivers/pinctrl/core.c' line='2163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pinctrl_unregister'>
+        <parameter type-id='10216dc5' name='pctldev' filepath='drivers/pinctrl/core.c' line='2163' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='pinctrl_utils_add_map_configs' mangled-name='pinctrl_utils_add_map_configs' filepath='drivers/pinctrl/pinctrl-utils.c' line='73' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pinctrl_utils_add_map_configs'>
@@ -129518,6 +132441,16 @@
         <parameter type-id='db362995' name='dev' filepath='drivers/base/platform.c' line='278' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='platform_msi_domain_alloc_irqs' mangled-name='platform_msi_domain_alloc_irqs' filepath='drivers/base/platform-msi.c' line='251' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_msi_domain_alloc_irqs'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/platform-msi.c' line='251' column='1'/>
+        <parameter type-id='f0981eeb' name='nvec' filepath='drivers/base/platform-msi.c' line='251' column='1'/>
+        <parameter type-id='c335ba2b' name='write_msi_msg' filepath='drivers/base/platform-msi.c' line='252' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='platform_msi_domain_free_irqs' mangled-name='platform_msi_domain_free_irqs' filepath='drivers/base/platform-msi.c' line='284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_msi_domain_free_irqs'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/platform-msi.c' line='284' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='platform_unregister_drivers' mangled-name='platform_unregister_drivers' filepath='drivers/base/platform.c' line='1010' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='platform_unregister_drivers'>
         <parameter type-id='77e06080' name='drivers' filepath='drivers/base/platform.c' line='1010' column='1'/>
         <parameter type-id='f0981eeb' name='count' filepath='drivers/base/platform.c' line='1011' column='1'/>
@@ -129528,6 +132461,11 @@
         <parameter type-id='80f4b756' name='con_id' filepath='drivers/base/power/clock_ops.c' line='123' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='pm_clk_add_clk' mangled-name='pm_clk_add_clk' filepath='drivers/base/power/clock_ops.c' line='139' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_clk_add_clk'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/clock_ops.c' line='139' column='1'/>
+        <parameter type-id='7d0bc0eb' name='clk' filepath='drivers/base/power/clock_ops.c' line='139' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='pm_clk_create' mangled-name='pm_clk_create' filepath='drivers/base/power/clock_ops.c' line='350' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_clk_create'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/base/power/clock_ops.c' line='350' column='1'/>
         <return type-id='95e97e5e'/>
@@ -129589,6 +132527,11 @@
         <parameter type-id='855e3679' name='subdomain' filepath='drivers/base/power/domain.c' line='1875' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='pm_get_active_wakeup_sources' mangled-name='pm_get_active_wakeup_sources' filepath='drivers/base/power/wakeup.c' line='878' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_get_active_wakeup_sources'>
+        <parameter type-id='26a90f95' name='pending_wakeup_source' filepath='drivers/base/power/wakeup.c' line='878' column='1'/>
+        <parameter type-id='b59d7dce' name='max' filepath='drivers/base/power/wakeup.c' line='878' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <var-decl name='pm_power_off' type-id='953b12f8' mangled-name='pm_power_off' visibility='default' filepath='arch/arm64/kernel/process.c' line='72' column='1' elf-symbol-id='pm_power_off'/>
       <var-decl name='pm_power_off_prepare' type-id='953b12f8' mangled-name='pm_power_off_prepare' visibility='default' filepath='kernel/reboot.c' line='55' column='1' elf-symbol-id='pm_power_off_prepare'/>
       <function-decl name='pm_relax' mangled-name='pm_relax' filepath='drivers/base/power/wakeup.c' line='776' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pm_relax'>
@@ -129678,6 +132621,10 @@
         <parameter type-id='11777d05' name='clk' filepath='kernel/time/posix-clock.c' line='182' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='power_supply_am_i_supplied' mangled-name='power_supply_am_i_supplied' filepath='drivers/power/supply/power_supply_core.c' line='334' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_am_i_supplied'>
+        <parameter type-id='c0c93c9e' name='psy' filepath='drivers/power/supply/power_supply_core.c' line='334' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='power_supply_changed' mangled-name='power_supply_changed' filepath='drivers/power/supply/power_supply_core.c' line='121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='power_supply_changed'>
         <parameter type-id='c0c93c9e' name='psy' filepath='drivers/power/supply/power_supply_core.c' line='121' column='1'/>
         <return type-id='48b5725f'/>
@@ -129916,6 +132863,16 @@
         <parameter type-id='80f4b756' name='dest' filepath='fs/proc/generic.c' line='462' column='1'/>
         <return type-id='d077e928'/>
       </function-decl>
+      <function-decl name='profile_event_register' mangled-name='profile_event_register' filepath='kernel/profile.c' line='171' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='profile_event_register'>
+        <parameter type-id='ca54968e' name='type' filepath='kernel/profile.c' line='171' column='1'/>
+        <parameter type-id='d504f73d' name='n' filepath='kernel/profile.c' line='171' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='profile_event_unregister' mangled-name='profile_event_unregister' filepath='kernel/profile.c' line='190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='profile_event_unregister'>
+        <parameter type-id='ca54968e' name='type' filepath='kernel/profile.c' line='190' column='1'/>
+        <parameter type-id='d504f73d' name='n' filepath='kernel/profile.c' line='190' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='proto_register' mangled-name='proto_register' filepath='net/core/sock.c' line='3468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_register'>
         <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3468' column='1'/>
         <parameter type-id='95e97e5e' name='alloc_slab' filepath='net/core/sock.c' line='3468' column='1'/>
@@ -130020,6 +132977,10 @@
         <parameter type-id='f23e2572' name='tsk' filepath='kernel/fork.c' line='441' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='put_tty_driver' mangled-name='put_tty_driver' filepath='drivers/tty/tty_io.c' line='3397' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_tty_driver'>
+        <parameter type-id='c2b4b27b' name='d' filepath='drivers/tty/tty_io.c' line='3397' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='put_unused_fd' mangled-name='put_unused_fd' filepath='fs/file.c' line='575' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='put_unused_fd'>
         <parameter type-id='f0981eeb' name='fd' filepath='fs/file.c' line='575' column='1'/>
         <return type-id='48b5725f'/>
@@ -130032,6 +132993,10 @@
         <parameter type-id='e84b031a' name='l' filepath='mm/migrate.c' line='143' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='pwm_adjust_config' mangled-name='pwm_adjust_config' filepath='drivers/pwm/core.c' line='695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pwm_adjust_config'>
+        <parameter type-id='f06adae0' name='pwm' filepath='drivers/pwm/core.c' line='695' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='pwm_apply_state' mangled-name='pwm_apply_state' filepath='drivers/pwm/core.c' line='574' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='pwm_apply_state'>
         <parameter type-id='f06adae0' name='pwm' filepath='drivers/pwm/core.c' line='574' column='1'/>
         <parameter type-id='73a11e20' name='state' filepath='drivers/pwm/core.c' line='574' column='1'/>
@@ -130298,11 +133263,11 @@
         <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/core.c' line='5583' column='1'/>
         <return type-id='29af9a71'/>
       </function-decl>
-      <function-decl name='read_cache_page' mangled-name='read_cache_page' filepath='mm/filemap.c' line='3248' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='read_cache_page'>
-        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3248' column='1'/>
-        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3249' column='1'/>
-        <parameter type-id='83ac4446' name='filler' filepath='mm/filemap.c' line='3250' column='1'/>
-        <parameter type-id='eaa32e2f' name='data' filepath='mm/filemap.c' line='3251' column='1'/>
+      <function-decl name='read_cache_page' mangled-name='read_cache_page' filepath='mm/filemap.c' line='3250' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='read_cache_page'>
+        <parameter type-id='f57039f0' name='mapping' filepath='mm/filemap.c' line='3250' column='1'/>
+        <parameter type-id='7359adad' name='index' filepath='mm/filemap.c' line='3251' column='1'/>
+        <parameter type-id='83ac4446' name='filler' filepath='mm/filemap.c' line='3252' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='mm/filemap.c' line='3253' column='1'/>
         <return type-id='02f11ed4'/>
       </function-decl>
       <var-decl name='reboot_mode' type-id='fdb20761' mangled-name='reboot_mode' visibility='default' filepath='kernel/reboot.c' line='34' column='1' elf-symbol-id='reboot_mode'/>
@@ -130464,6 +133429,10 @@
         <parameter type-id='d504f73d' name='nb' filepath='kernel/power/main.c' line='71' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='register_qdisc' mangled-name='register_qdisc' filepath='net/sched/sch_api.c' line='130' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_qdisc'>
+        <parameter type-id='d6369c88' name='qops' filepath='net/sched/sch_api.c' line='130' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='register_reboot_notifier' mangled-name='register_reboot_notifier' filepath='kernel/reboot.c' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_reboot_notifier'>
         <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='91' column='1'/>
         <return type-id='95e97e5e'/>
@@ -130839,6 +133808,10 @@
         <parameter type-id='f0981eeb' name='mode' filepath='drivers/regulator/core.c' line='4316' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='regulator_set_pull_down_regmap' mangled-name='regulator_set_pull_down_regmap' filepath='drivers/regulator/helpers.c' line='703' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_pull_down_regmap'>
+        <parameter type-id='43c38462' name='rdev' filepath='drivers/regulator/helpers.c' line='703' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='regulator_set_voltage' mangled-name='regulator_set_voltage' filepath='drivers/regulator/core.c' line='3930' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='regulator_set_voltage'>
         <parameter type-id='850c13f6' name='regulator' filepath='drivers/regulator/core.c' line='3930' column='1'/>
         <parameter type-id='95e97e5e' name='min_uV' filepath='drivers/regulator/core.c' line='3930' column='1'/>
@@ -130879,9 +133852,9 @@
         <parameter type-id='fce0537d' name='fw' filepath='drivers/base/firmware_loader/main.c' line='1049' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='release_pages' mangled-name='release_pages' filepath='mm/swap.c' line='986' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_pages'>
-        <parameter type-id='9f93c9da' name='pages' filepath='mm/swap.c' line='986' column='1'/>
-        <parameter type-id='95e97e5e' name='nr' filepath='mm/swap.c' line='986' column='1'/>
+      <function-decl name='release_pages' mangled-name='release_pages' filepath='mm/swap.c' line='999' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_pages'>
+        <parameter type-id='9f93c9da' name='pages' filepath='mm/swap.c' line='999' column='1'/>
+        <parameter type-id='95e97e5e' name='nr' filepath='mm/swap.c' line='999' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='release_sock' mangled-name='release_sock' filepath='net/core/sock.c' line='3067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_sock'>
@@ -131427,11 +134400,21 @@
         <parameter type-id='d06e7441' name='nvmem_config' filepath='drivers/rtc/nvmem.c' line='81' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='rtc_read_alarm' mangled-name='rtc_read_alarm' filepath='drivers/rtc/interface.c' line='386' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_read_alarm'>
+        <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/interface.c' line='386' column='1'/>
+        <parameter type-id='6d120807' name='alarm' filepath='drivers/rtc/interface.c' line='386' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='rtc_read_time' mangled-name='rtc_read_time' filepath='drivers/rtc/interface.c' line='110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_read_time'>
         <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/interface.c' line='110' column='1'/>
         <parameter type-id='2b8e7a42' name='tm' filepath='drivers/rtc/interface.c' line='110' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='rtc_set_alarm' mangled-name='rtc_set_alarm' filepath='drivers/rtc/interface.c' line='448' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_set_alarm'>
+        <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/interface.c' line='448' column='1'/>
+        <parameter type-id='6d120807' name='alarm' filepath='drivers/rtc/interface.c' line='448' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='rtc_set_time' mangled-name='rtc_set_time' filepath='drivers/rtc/interface.c' line='126' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='rtc_set_time'>
         <parameter type-id='5992ae83' name='rtc' filepath='drivers/rtc/interface.c' line='126' column='1'/>
         <parameter type-id='2b8e7a42' name='tm' filepath='drivers/rtc/interface.c' line='126' column='1'/>
@@ -131822,6 +134805,10 @@
         <parameter type-id='d6a0d460' name='sshdr' filepath='drivers/scsi/scsi_logging.c' line='359' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='scsi_register_driver' mangled-name='scsi_register_driver' filepath='drivers/scsi/scsi_sysfs.c' line='1557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_register_driver'>
+        <parameter type-id='00c7b870' name='drv' filepath='drivers/scsi/scsi_sysfs.c' line='1557' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='scsi_register_interface' mangled-name='scsi_register_interface' filepath='drivers/scsi/scsi_sysfs.c' line='1565' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='scsi_register_interface'>
         <parameter type-id='ec167ceb' name='intf' filepath='drivers/scsi/scsi_sysfs.c' line='1565' column='1'/>
         <return type-id='95e97e5e'/>
@@ -131859,6 +134846,14 @@
         <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='4756' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='sdhci_adma_write_desc' mangled-name='sdhci_adma_write_desc' filepath='drivers/mmc/host/sdhci.c' line='688' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_adma_write_desc'>
+        <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='688' column='1'/>
+        <parameter type-id='63e171df' name='desc' filepath='drivers/mmc/host/sdhci.c' line='688' column='1'/>
+        <parameter type-id='cf29c9b3' name='addr' filepath='drivers/mmc/host/sdhci.c' line='689' column='1'/>
+        <parameter type-id='95e97e5e' name='len' filepath='drivers/mmc/host/sdhci.c' line='689' column='1'/>
+        <parameter type-id='f0981eeb' name='cmd' filepath='drivers/mmc/host/sdhci.c' line='689' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='sdhci_cleanup_host' mangled-name='sdhci_cleanup_host' filepath='drivers/mmc/host/sdhci.c' line='4667' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_cleanup_host'>
         <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='4667' column='1'/>
         <return type-id='48b5725f'/>
@@ -131901,6 +134896,10 @@
         <parameter type-id='db362995' name='pdev' filepath='drivers/mmc/host/sdhci-pltfm.c' line='79' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='sdhci_pltfm_clk_get_max_clock' mangled-name='sdhci_pltfm_clk_get_max_clock' filepath='drivers/mmc/host/sdhci-pltfm.c' line='28' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_pltfm_clk_get_max_clock'>
+        <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci-pltfm.c' line='28' column='1'/>
+        <return type-id='f0981eeb'/>
+      </function-decl>
       <function-decl name='sdhci_pltfm_free' mangled-name='sdhci_pltfm_free' filepath='drivers/mmc/host/sdhci-pltfm.c' line='165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_pltfm_free'>
         <parameter type-id='db362995' name='pdev' filepath='drivers/mmc/host/sdhci-pltfm.c' line='165' column='1'/>
         <return type-id='48b5725f'/>
@@ -131911,6 +134910,10 @@
         <parameter type-id='b59d7dce' name='priv_size' filepath='drivers/mmc/host/sdhci-pltfm.c' line='118' column='1'/>
         <return type-id='2661e0d9'/>
       </function-decl>
+      <function-decl name='sdhci_pltfm_unregister' mangled-name='sdhci_pltfm_unregister' filepath='drivers/mmc/host/sdhci-pltfm.c' line='194' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_pltfm_unregister'>
+        <parameter type-id='db362995' name='pdev' filepath='drivers/mmc/host/sdhci-pltfm.c' line='194' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='sdhci_remove_host' mangled-name='sdhci_remove_host' filepath='drivers/mmc/host/sdhci.c' line='4777' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_remove_host'>
         <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='4777' column='1'/>
         <parameter type-id='95e97e5e' name='dead' filepath='drivers/mmc/host/sdhci.c' line='4777' column='1'/>
@@ -131949,12 +134952,28 @@
         <parameter type-id='95e97e5e' name='width' filepath='drivers/mmc/host/sdhci.c' line='2200' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='sdhci_set_clock' mangled-name='sdhci_set_clock' filepath='drivers/mmc/host/sdhci.c' line='1996' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_set_clock'>
+        <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='1996' column='1'/>
+        <parameter type-id='f0981eeb' name='clock' filepath='drivers/mmc/host/sdhci.c' line='1996' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='sdhci_set_power_and_bus_voltage' mangled-name='sdhci_set_power_and_bus_voltage' filepath='drivers/mmc/host/sdhci.c' line='2115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_set_power_and_bus_voltage'>
+        <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='2115' column='1'/>
+        <parameter type-id='002ac4a6' name='mode' filepath='drivers/mmc/host/sdhci.c' line='2116' column='1'/>
+        <parameter type-id='8efea9e5' name='vdd' filepath='drivers/mmc/host/sdhci.c' line='2117' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='sdhci_set_power_noreg' mangled-name='sdhci_set_power_noreg' filepath='drivers/mmc/host/sdhci.c' line='2025' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_set_power_noreg'>
         <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='2025' column='1'/>
         <parameter type-id='002ac4a6' name='mode' filepath='drivers/mmc/host/sdhci.c' line='2025' column='1'/>
         <parameter type-id='8efea9e5' name='vdd' filepath='drivers/mmc/host/sdhci.c' line='2026' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='sdhci_set_uhs_signaling' mangled-name='sdhci_set_uhs_signaling' filepath='drivers/mmc/host/sdhci.c' line='2220' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_set_uhs_signaling'>
+        <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='2220' column='1'/>
+        <parameter type-id='f0981eeb' name='timing' filepath='drivers/mmc/host/sdhci.c' line='2220' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='sdhci_setup_host' mangled-name='sdhci_setup_host' filepath='drivers/mmc/host/sdhci.c' line='4116' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdhci_setup_host'>
         <parameter type-id='2661e0d9' name='host' filepath='drivers/mmc/host/sdhci.c' line='4116' column='1'/>
         <return type-id='95e97e5e'/>
@@ -132067,6 +135086,13 @@
         <parameter type-id='7292109c' name='err_ret' filepath='drivers/mmc/core/sdio_io.c' line='412' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='sdio_writeb_readb' mangled-name='sdio_writeb_readb' filepath='drivers/mmc/core/sdio_io.c' line='441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_writeb_readb'>
+        <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='441' column='1'/>
+        <parameter type-id='f9b06939' name='write_byte' filepath='drivers/mmc/core/sdio_io.c' line='441' column='1'/>
+        <parameter type-id='f0981eeb' name='addr' filepath='drivers/mmc/core/sdio_io.c' line='442' column='1'/>
+        <parameter type-id='7292109c' name='err_ret' filepath='drivers/mmc/core/sdio_io.c' line='442' column='1'/>
+        <return type-id='f9b06939'/>
+      </function-decl>
       <function-decl name='sdio_writel' mangled-name='sdio_writel' filepath='drivers/mmc/core/sdio_io.c' line='609' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sdio_writel'>
         <parameter type-id='c1880945' name='func' filepath='drivers/mmc/core/sdio_io.c' line='609' column='1'/>
         <parameter type-id='19c2251e' name='b' filepath='drivers/mmc/core/sdio_io.c' line='609' column='1'/>
@@ -132240,18 +135266,18 @@
         <parameter type-id='97fbef77' name='serdev' filepath='drivers/tty/serdev/core.c' line='237' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_set_termios' mangled-name='serial8250_do_set_termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2713' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_termios'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2713' column='1'/>
-        <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2713' column='1'/>
-        <parameter type-id='e55856e5' name='old' filepath='drivers/tty/serial/8250/8250_port.c' line='2714' column='1'/>
+      <function-decl name='serial8250_do_set_termios' mangled-name='serial8250_do_set_termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2714' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_set_termios'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2714' column='1'/>
+        <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/serial/8250/8250_port.c' line='2714' column='1'/>
+        <parameter type-id='e55856e5' name='old' filepath='drivers/tty/serial/8250/8250_port.c' line='2715' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_shutdown' mangled-name='serial8250_do_shutdown' filepath='drivers/tty/serial/8250/8250_port.c' line='2451' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_shutdown'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2451' column='1'/>
+      <function-decl name='serial8250_do_shutdown' mangled-name='serial8250_do_shutdown' filepath='drivers/tty/serial/8250/8250_port.c' line='2452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_shutdown'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2452' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_do_startup' mangled-name='serial8250_do_startup' filepath='drivers/tty/serial/8250/8250_port.c' line='2165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_startup'>
-        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2165' column='1'/>
+      <function-decl name='serial8250_do_startup' mangled-name='serial8250_do_startup' filepath='drivers/tty/serial/8250/8250_port.c' line='2166' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_do_startup'>
+        <parameter type-id='af051c69' name='port' filepath='drivers/tty/serial/8250/8250_port.c' line='2166' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='serial8250_get_port' mangled-name='serial8250_get_port' filepath='drivers/tty/serial/8250/8250_core.c' line='411' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_get_port'>
@@ -132266,12 +135292,12 @@
         <parameter type-id='95e97e5e' name='line' filepath='drivers/tty/serial/8250/8250_core.c' line='780' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_rpm_get' mangled-name='serial8250_rpm_get' filepath='drivers/tty/serial/8250/8250_port.c' line='575' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_rpm_get'>
-        <parameter type-id='b26c7631' name='p' filepath='drivers/tty/serial/8250/8250_port.c' line='575' column='1'/>
+      <function-decl name='serial8250_rpm_get' mangled-name='serial8250_rpm_get' filepath='drivers/tty/serial/8250/8250_port.c' line='576' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_rpm_get'>
+        <parameter type-id='b26c7631' name='p' filepath='drivers/tty/serial/8250/8250_port.c' line='576' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='serial8250_rpm_put' mangled-name='serial8250_rpm_put' filepath='drivers/tty/serial/8250/8250_port.c' line='583' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_rpm_put'>
-        <parameter type-id='b26c7631' name='p' filepath='drivers/tty/serial/8250/8250_port.c' line='583' column='1'/>
+      <function-decl name='serial8250_rpm_put' mangled-name='serial8250_rpm_put' filepath='drivers/tty/serial/8250/8250_port.c' line='584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_rpm_put'>
+        <parameter type-id='b26c7631' name='p' filepath='drivers/tty/serial/8250/8250_port.c' line='584' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='serial8250_suspend_port' mangled-name='serial8250_suspend_port' filepath='drivers/tty/serial/8250/8250_core.c' line='757' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='serial8250_suspend_port'>
@@ -132930,6 +135956,11 @@
         <parameter type-id='95e97e5e' name='wait' filepath='kernel/smp.c' line='469' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='smp_call_function_single_async' mangled-name='smp_call_function_single_async' filepath='kernel/smp.c' line='546' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_function_single_async'>
+        <parameter type-id='95e97e5e' name='cpu' filepath='kernel/smp.c' line='546' column='1'/>
+        <parameter type-id='d5df7665' name='csd' filepath='kernel/smp.c' line='546' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='smp_call_on_cpu' mangled-name='smp_call_on_cpu' filepath='kernel/smp.c' line='1021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='smp_call_on_cpu'>
         <parameter type-id='f0981eeb' name='cpu' filepath='kernel/smp.c' line='1021' column='1'/>
         <parameter type-id='b9b212f5' name='func' filepath='kernel/smp.c' line='1021' column='1'/>
@@ -133712,18 +136743,18 @@
         <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3177' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dpcm_get_substream' mangled-name='snd_soc_dpcm_get_substream' filepath='sound/soc/soc-pcm.c' line='2908' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dpcm_get_substream'>
-        <parameter type-id='95316552' name='be' filepath='sound/soc/soc-pcm.c' line='2908' column='1'/>
-        <parameter type-id='95e97e5e' name='stream' filepath='sound/soc/soc-pcm.c' line='2908' column='1'/>
+      <function-decl name='snd_soc_dpcm_get_substream' mangled-name='snd_soc_dpcm_get_substream' filepath='sound/soc/soc-pcm.c' line='2912' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dpcm_get_substream'>
+        <parameter type-id='95316552' name='be' filepath='sound/soc/soc-pcm.c' line='2912' column='1'/>
+        <parameter type-id='95e97e5e' name='stream' filepath='sound/soc/soc-pcm.c' line='2912' column='1'/>
         <return type-id='06b2cd14'/>
       </function-decl>
       <function-decl name='snd_soc_find_dai' mangled-name='snd_soc_find_dai' filepath='sound/soc/soc-core.c' line='810' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_find_dai'>
         <parameter type-id='18cfbc8f' name='dlc' filepath='sound/soc/soc-core.c' line='811' column='1'/>
         <return type-id='1c936db9'/>
       </function-decl>
-      <function-decl name='snd_soc_get_dai_name' mangled-name='snd_soc_get_dai_name' filepath='sound/soc/soc-core.c' line='3044' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_get_dai_name'>
-        <parameter type-id='51a94113' name='args' filepath='sound/soc/soc-core.c' line='3044' column='1'/>
-        <parameter type-id='7d3cd834' name='dai_name' filepath='sound/soc/soc-core.c' line='3045' column='1'/>
+      <function-decl name='snd_soc_get_dai_name' mangled-name='snd_soc_get_dai_name' filepath='sound/soc/soc-core.c' line='3052' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_get_dai_name'>
+        <parameter type-id='51a94113' name='args' filepath='sound/soc/soc-core.c' line='3052' column='1'/>
+        <parameter type-id='7d3cd834' name='dai_name' filepath='sound/soc/soc-core.c' line='3053' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_get_enum_double' mangled-name='snd_soc_get_enum_double' filepath='sound/soc/soc-ops.c' line='59' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_get_enum_double'>
@@ -133761,9 +136792,9 @@
         <parameter type-id='0e291009' name='uinfo' filepath='sound/soc/soc-ops.c' line='41' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_info_multi_ext' mangled-name='snd_soc_info_multi_ext' filepath='sound/soc/soc-core.c' line='3021' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_info_multi_ext'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-core.c' line='3021' column='1'/>
-        <parameter type-id='0e291009' name='uinfo' filepath='sound/soc/soc-core.c' line='3022' column='1'/>
+      <function-decl name='snd_soc_info_multi_ext' mangled-name='snd_soc_info_multi_ext' filepath='sound/soc/soc-core.c' line='3029' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_info_multi_ext'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-core.c' line='3029' column='1'/>
+        <parameter type-id='0e291009' name='uinfo' filepath='sound/soc/soc-core.c' line='3030' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_info_volsw' mangled-name='snd_soc_info_volsw' filepath='sound/soc/soc-ops.c' line='175' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_info_volsw'>
@@ -133818,61 +136849,61 @@
         <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-compress.c' line='750' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_get_dai_link_codecs' mangled-name='snd_soc_of_get_dai_link_codecs' filepath='sound/soc/soc-core.c' line='3162' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_get_dai_link_codecs'>
-        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-core.c' line='3162' column='1'/>
-        <parameter type-id='9a537bbe' name='of_node' filepath='sound/soc/soc-core.c' line='3163' column='1'/>
-        <parameter type-id='af5a73b0' name='dai_link' filepath='sound/soc/soc-core.c' line='3164' column='1'/>
+      <function-decl name='snd_soc_of_get_dai_link_codecs' mangled-name='snd_soc_of_get_dai_link_codecs' filepath='sound/soc/soc-core.c' line='3170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_get_dai_link_codecs'>
+        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-core.c' line='3170' column='1'/>
+        <parameter type-id='9a537bbe' name='of_node' filepath='sound/soc/soc-core.c' line='3171' column='1'/>
+        <parameter type-id='af5a73b0' name='dai_link' filepath='sound/soc/soc-core.c' line='3172' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_get_dai_name' mangled-name='snd_soc_of_get_dai_name' filepath='sound/soc/soc-core.c' line='3109' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_get_dai_name'>
-        <parameter type-id='9a537bbe' name='of_node' filepath='sound/soc/soc-core.c' line='3109' column='1'/>
-        <parameter type-id='7d3cd834' name='dai_name' filepath='sound/soc/soc-core.c' line='3110' column='1'/>
+      <function-decl name='snd_soc_of_get_dai_name' mangled-name='snd_soc_of_get_dai_name' filepath='sound/soc/soc-core.c' line='3117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_get_dai_name'>
+        <parameter type-id='9a537bbe' name='of_node' filepath='sound/soc/soc-core.c' line='3117' column='1'/>
+        <parameter type-id='7d3cd834' name='dai_name' filepath='sound/soc/soc-core.c' line='3118' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_parse_audio_routing' mangled-name='snd_soc_of_parse_audio_routing' filepath='sound/soc/soc-core.c' line='2780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_audio_routing'>
-        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2780' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2781' column='1'/>
+      <function-decl name='snd_soc_of_parse_audio_routing' mangled-name='snd_soc_of_parse_audio_routing' filepath='sound/soc/soc-core.c' line='2788' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_audio_routing'>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2788' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2789' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_parse_audio_simple_widgets' mangled-name='snd_soc_of_parse_audio_simple_widgets' filepath='sound/soc/soc-core.c' line='2626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_audio_simple_widgets'>
-        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2626' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2627' column='1'/>
+      <function-decl name='snd_soc_of_parse_audio_simple_widgets' mangled-name='snd_soc_of_parse_audio_simple_widgets' filepath='sound/soc/soc-core.c' line='2634' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_audio_simple_widgets'>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2634' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2635' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_parse_aux_devs' mangled-name='snd_soc_of_parse_aux_devs' filepath='sound/soc/soc-core.c' line='2836' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_aux_devs'>
-        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2836' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2836' column='1'/>
+      <function-decl name='snd_soc_of_parse_aux_devs' mangled-name='snd_soc_of_parse_aux_devs' filepath='sound/soc/soc-core.c' line='2844' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_aux_devs'>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2844' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2844' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_parse_card_name' mangled-name='snd_soc_of_parse_card_name' filepath='sound/soc/soc-core.c' line='2589' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_card_name'>
-        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2589' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2590' column='1'/>
+      <function-decl name='snd_soc_of_parse_card_name' mangled-name='snd_soc_of_parse_card_name' filepath='sound/soc/soc-core.c' line='2597' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_card_name'>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2597' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2598' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_parse_daifmt' mangled-name='snd_soc_of_parse_daifmt' filepath='sound/soc/soc-core.c' line='2867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_daifmt'>
-        <parameter type-id='9a537bbe' name='np' filepath='sound/soc/soc-core.c' line='2867' column='1'/>
-        <parameter type-id='80f4b756' name='prefix' filepath='sound/soc/soc-core.c' line='2868' column='1'/>
-        <parameter type-id='856b89fc' name='bitclkmaster' filepath='sound/soc/soc-core.c' line='2869' column='1'/>
-        <parameter type-id='856b89fc' name='framemaster' filepath='sound/soc/soc-core.c' line='2870' column='1'/>
+      <function-decl name='snd_soc_of_parse_daifmt' mangled-name='snd_soc_of_parse_daifmt' filepath='sound/soc/soc-core.c' line='2875' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_daifmt'>
+        <parameter type-id='9a537bbe' name='np' filepath='sound/soc/soc-core.c' line='2875' column='1'/>
+        <parameter type-id='80f4b756' name='prefix' filepath='sound/soc/soc-core.c' line='2876' column='1'/>
+        <parameter type-id='856b89fc' name='bitclkmaster' filepath='sound/soc/soc-core.c' line='2877' column='1'/>
+        <parameter type-id='856b89fc' name='framemaster' filepath='sound/soc/soc-core.c' line='2878' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
-      <function-decl name='snd_soc_of_parse_node_prefix' mangled-name='snd_soc_of_parse_node_prefix' filepath='sound/soc/soc-core.c' line='2761' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_node_prefix'>
-        <parameter type-id='9a537bbe' name='np' filepath='sound/soc/soc-core.c' line='2761' column='1'/>
-        <parameter type-id='f10279fe' name='codec_conf' filepath='sound/soc/soc-core.c' line='2762' column='1'/>
-        <parameter type-id='9a537bbe' name='of_node' filepath='sound/soc/soc-core.c' line='2763' column='1'/>
-        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2764' column='1'/>
+      <function-decl name='snd_soc_of_parse_node_prefix' mangled-name='snd_soc_of_parse_node_prefix' filepath='sound/soc/soc-core.c' line='2769' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_node_prefix'>
+        <parameter type-id='9a537bbe' name='np' filepath='sound/soc/soc-core.c' line='2769' column='1'/>
+        <parameter type-id='f10279fe' name='codec_conf' filepath='sound/soc/soc-core.c' line='2770' column='1'/>
+        <parameter type-id='9a537bbe' name='of_node' filepath='sound/soc/soc-core.c' line='2771' column='1'/>
+        <parameter type-id='80f4b756' name='propname' filepath='sound/soc/soc-core.c' line='2772' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='snd_soc_of_parse_tdm_slot' mangled-name='snd_soc_of_parse_tdm_slot' filepath='sound/soc/soc-core.c' line='2725' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_tdm_slot'>
-        <parameter type-id='9a537bbe' name='np' filepath='sound/soc/soc-core.c' line='2725' column='1'/>
-        <parameter type-id='807869d3' name='tx_mask' filepath='sound/soc/soc-core.c' line='2726' column='1'/>
-        <parameter type-id='807869d3' name='rx_mask' filepath='sound/soc/soc-core.c' line='2727' column='1'/>
-        <parameter type-id='807869d3' name='slots' filepath='sound/soc/soc-core.c' line='2728' column='1'/>
-        <parameter type-id='807869d3' name='slot_width' filepath='sound/soc/soc-core.c' line='2729' column='1'/>
+      <function-decl name='snd_soc_of_parse_tdm_slot' mangled-name='snd_soc_of_parse_tdm_slot' filepath='sound/soc/soc-core.c' line='2733' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_parse_tdm_slot'>
+        <parameter type-id='9a537bbe' name='np' filepath='sound/soc/soc-core.c' line='2733' column='1'/>
+        <parameter type-id='807869d3' name='tx_mask' filepath='sound/soc/soc-core.c' line='2734' column='1'/>
+        <parameter type-id='807869d3' name='rx_mask' filepath='sound/soc/soc-core.c' line='2735' column='1'/>
+        <parameter type-id='807869d3' name='slots' filepath='sound/soc/soc-core.c' line='2736' column='1'/>
+        <parameter type-id='807869d3' name='slot_width' filepath='sound/soc/soc-core.c' line='2737' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_of_put_dai_link_codecs' mangled-name='snd_soc_of_put_dai_link_codecs' filepath='sound/soc/soc-core.c' line='3134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_put_dai_link_codecs'>
-        <parameter type-id='af5a73b0' name='dai_link' filepath='sound/soc/soc-core.c' line='3134' column='1'/>
+      <function-decl name='snd_soc_of_put_dai_link_codecs' mangled-name='snd_soc_of_put_dai_link_codecs' filepath='sound/soc/soc-core.c' line='3142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_of_put_dai_link_codecs'>
+        <parameter type-id='af5a73b0' name='dai_link' filepath='sound/soc/soc-core.c' line='3142' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_soc_params_to_bclk' mangled-name='snd_soc_params_to_bclk' filepath='sound/soc/soc-utils.c' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_params_to_bclk'>
@@ -133917,11 +136948,11 @@
         <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2176' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_register_component' mangled-name='snd_soc_register_component' filepath='sound/soc/soc-core.c' line='2519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_register_component'>
-        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-core.c' line='2519' column='1'/>
-        <parameter type-id='f030c2b8' name='component_driver' filepath='sound/soc/soc-core.c' line='2520' column='1'/>
-        <parameter type-id='763d26a2' name='dai_drv' filepath='sound/soc/soc-core.c' line='2521' column='1'/>
-        <parameter type-id='95e97e5e' name='num_dai' filepath='sound/soc/soc-core.c' line='2522' column='1'/>
+      <function-decl name='snd_soc_register_component' mangled-name='snd_soc_register_component' filepath='sound/soc/soc-core.c' line='2527' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_register_component'>
+        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-core.c' line='2527' column='1'/>
+        <parameter type-id='f030c2b8' name='component_driver' filepath='sound/soc/soc-core.c' line='2528' column='1'/>
+        <parameter type-id='763d26a2' name='dai_drv' filepath='sound/soc/soc-core.c' line='2529' column='1'/>
+        <parameter type-id='95e97e5e' name='num_dai' filepath='sound/soc/soc-core.c' line='2530' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_resume' mangled-name='snd_soc_resume' filepath='sound/soc/soc-core.c' line='711' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_resume'>
@@ -133968,12 +136999,12 @@
         <parameter type-id='1dc6a898' name='event_type' filepath='sound/soc/soc-topology.c' line='665' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_unregister_card' mangled-name='snd_soc_unregister_card' filepath='sound/soc/soc-core.c' line='2209' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_unregister_card'>
-        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2209' column='1'/>
+      <function-decl name='snd_soc_unregister_card' mangled-name='snd_soc_unregister_card' filepath='sound/soc/soc-core.c' line='2217' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_unregister_card'>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-core.c' line='2217' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_unregister_component' mangled-name='snd_soc_unregister_component' filepath='sound/soc/soc-core.c' line='2572' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_unregister_component'>
-        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-core.c' line='2572' column='1'/>
+      <function-decl name='snd_soc_unregister_component' mangled-name='snd_soc_unregister_component' filepath='sound/soc/soc-core.c' line='2580' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_unregister_component'>
+        <parameter type-id='fa0b179b' name='dev' filepath='sound/soc/soc-core.c' line='2580' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='snd_usb_enable_audio_stream' mangled-name='snd_usb_enable_audio_stream' filepath='sound/usb/pcm.c' line='688' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_usb_enable_audio_stream'>
@@ -134313,6 +137344,13 @@
         <parameter type-id='f0981eeb' name='skipnr' filepath='kernel/stacktrace.c' line='112' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
+      <function-decl name='stack_trace_save_regs' mangled-name='stack_trace_save_regs' filepath='kernel/stacktrace.c' line='164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stack_trace_save_regs'>
+        <parameter type-id='4616a179' name='regs' filepath='kernel/stacktrace.c' line='164' column='1'/>
+        <parameter type-id='1d2c2b85' name='store' filepath='kernel/stacktrace.c' line='164' column='1'/>
+        <parameter type-id='f0981eeb' name='size' filepath='kernel/stacktrace.c' line='165' column='1'/>
+        <parameter type-id='f0981eeb' name='skipnr' filepath='kernel/stacktrace.c' line='165' column='1'/>
+        <return type-id='f0981eeb'/>
+      </function-decl>
       <function-decl name='stack_trace_save_tsk' mangled-name='stack_trace_save_tsk' filepath='kernel/stacktrace.c' line='135' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stack_trace_save_tsk'>
         <parameter type-id='f23e2572' name='tsk' filepath='kernel/stacktrace.c' line='135' column='1'/>
         <parameter type-id='1d2c2b85' name='store' filepath='kernel/stacktrace.c' line='135' column='1'/>
@@ -134349,6 +137387,12 @@
         <parameter type-id='cc8decc0' name='work_buf' filepath='kernel/stop_machine.c' line='359' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
+      <function-decl name='store_sampling_rate' mangled-name='store_sampling_rate' filepath='drivers/cpufreq/cpufreq_governor.c' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='store_sampling_rate'>
+        <parameter type-id='902fed1a' name='attr_set' filepath='drivers/cpufreq/cpufreq_governor.c' line='44' column='1'/>
+        <parameter type-id='80f4b756' name='buf' filepath='drivers/cpufreq/cpufreq_governor.c' line='44' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='drivers/cpufreq/cpufreq_governor.c' line='45' column='1'/>
+        <return type-id='79a0948f'/>
+      </function-decl>
       <function-decl name='stpcpy' mangled-name='stpcpy' filepath='lib/string.c' line='291' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='stpcpy'>
         <parameter type-id='266fe297' name='dest' filepath='lib/string.c' line='291' column='1'/>
         <parameter type-id='9d26089a' name='src' filepath='lib/string.c' line='291' column='1'/>
@@ -134481,10 +137525,10 @@
         <parameter type-id='80f4b756'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='submit_bh' mangled-name='submit_bh' filepath='fs/buffer.c' line='3082' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bh'>
-        <parameter type-id='95e97e5e' name='op' filepath='fs/buffer.c' line='3082' column='1'/>
-        <parameter type-id='95e97e5e' name='op_flags' filepath='fs/buffer.c' line='3082' column='1'/>
-        <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3082' column='1'/>
+      <function-decl name='submit_bh' mangled-name='submit_bh' filepath='fs/buffer.c' line='3086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bh'>
+        <parameter type-id='95e97e5e' name='op' filepath='fs/buffer.c' line='3086' column='1'/>
+        <parameter type-id='95e97e5e' name='op_flags' filepath='fs/buffer.c' line='3086' column='1'/>
+        <parameter type-id='c485c22c' name='bh' filepath='fs/buffer.c' line='3086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='submit_bio' mangled-name='submit_bio' filepath='block/blk-core.c' line='1076' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='submit_bio'>
@@ -134757,6 +137801,33 @@
         <parameter type-id='f3a16a60' name='foc' filepath='net/ipv4/tcp_input.c' line='3959' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='tcp_register_congestion_control' mangled-name='tcp_register_congestion_control' filepath='net/ipv4/tcp_cong.c' line='70' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_register_congestion_control'>
+        <parameter type-id='58c93391' name='ca' filepath='net/ipv4/tcp_cong.c' line='70' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='tcp_reno_cong_avoid' mangled-name='tcp_reno_cong_avoid' filepath='net/ipv4/tcp_cong.c' line='436' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_reno_cong_avoid'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/ipv4/tcp_cong.c' line='436' column='1'/>
+        <parameter type-id='19c2251e' name='ack' filepath='net/ipv4/tcp_cong.c' line='436' column='1'/>
+        <parameter type-id='19c2251e' name='acked' filepath='net/ipv4/tcp_cong.c' line='436' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tcp_reno_ssthresh' mangled-name='tcp_reno_ssthresh' filepath='net/ipv4/tcp_cong.c' line='455' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_reno_ssthresh'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/ipv4/tcp_cong.c' line='455' column='1'/>
+        <return type-id='19c2251e'/>
+      </function-decl>
+      <function-decl name='tcp_reno_undo_cwnd' mangled-name='tcp_reno_undo_cwnd' filepath='net/ipv4/tcp_cong.c' line='463' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_reno_undo_cwnd'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/ipv4/tcp_cong.c' line='463' column='1'/>
+        <return type-id='19c2251e'/>
+      </function-decl>
+      <function-decl name='tcp_slow_start' mangled-name='tcp_slow_start' filepath='net/ipv4/tcp_cong.c' line='396' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_slow_start'>
+        <parameter type-id='de885ea5' name='tp' filepath='net/ipv4/tcp_cong.c' line='396' column='1'/>
+        <parameter type-id='19c2251e' name='acked' filepath='net/ipv4/tcp_cong.c' line='396' column='1'/>
+        <return type-id='19c2251e'/>
+      </function-decl>
+      <function-decl name='tcp_unregister_congestion_control' mangled-name='tcp_unregister_congestion_control' filepath='net/ipv4/tcp_cong.c' line='104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcp_unregister_congestion_control'>
+        <parameter type-id='58c93391' name='ca' filepath='net/ipv4/tcp_cong.c' line='104' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='tcpci_get_tcpm_port' mangled-name='tcpci_get_tcpm_port' filepath='drivers/usb/typec/tcpm/tcpci.c' line='64' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tcpci_get_tcpm_port'>
         <parameter type-id='eefe253e' name='tcpci' filepath='drivers/usb/typec/tcpm/tcpci.c' line='64' column='1'/>
         <return type-id='426e425b'/>
@@ -134819,63 +137890,63 @@
         <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_helpers.c' line='188' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thermal_cooling_device_register' mangled-name='thermal_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1166' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_register'>
-        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1166' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1166' column='1'/>
-        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1167' column='1'/>
+      <function-decl name='thermal_cooling_device_register' mangled-name='thermal_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1165' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_register'>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1165' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1165' column='1'/>
+        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1166' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
-      <function-decl name='thermal_cooling_device_unregister' mangled-name='thermal_cooling_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1263' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_unregister'>
-        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='1263' column='1'/>
+      <function-decl name='thermal_cooling_device_unregister' mangled-name='thermal_cooling_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1262' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_cooling_device_unregister'>
+        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='1262' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thermal_of_cooling_device_register' mangled-name='thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1189' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_of_cooling_device_register'>
-        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1189' column='1'/>
-        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1190' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1190' column='1'/>
-        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1191' column='1'/>
+      <function-decl name='thermal_of_cooling_device_register' mangled-name='thermal_of_cooling_device_register' filepath='drivers/thermal/thermal_core.c' line='1188' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_of_cooling_device_register'>
+        <parameter type-id='9a537bbe' name='np' filepath='drivers/thermal/thermal_core.c' line='1188' column='1'/>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1189' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1189' column='1'/>
+        <parameter type-id='6f4dc085' name='ops' filepath='drivers/thermal/thermal_core.c' line='1190' column='1'/>
         <return type-id='2feec21f'/>
       </function-decl>
       <var-decl name='thermal_pressure' type-id='7359adad' mangled-name='thermal_pressure' visibility='default' filepath='drivers/base/arch_topology.c' line='71' column='1' elf-symbol-id='thermal_pressure'/>
-      <function-decl name='thermal_zone_bind_cooling_device' mangled-name='thermal_zone_bind_cooling_device' filepath='drivers/thermal/thermal_core.c' line='823' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_bind_cooling_device'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='823' column='1'/>
-        <parameter type-id='95e97e5e' name='trip' filepath='drivers/thermal/thermal_core.c' line='824' column='1'/>
-        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='825' column='1'/>
-        <parameter type-id='7359adad' name='upper' filepath='drivers/thermal/thermal_core.c' line='826' column='1'/>
-        <parameter type-id='7359adad' name='lower' filepath='drivers/thermal/thermal_core.c' line='826' column='1'/>
-        <parameter type-id='f0981eeb' name='weight' filepath='drivers/thermal/thermal_core.c' line='827' column='1'/>
+      <function-decl name='thermal_zone_bind_cooling_device' mangled-name='thermal_zone_bind_cooling_device' filepath='drivers/thermal/thermal_core.c' line='822' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_bind_cooling_device'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='822' column='1'/>
+        <parameter type-id='95e97e5e' name='trip' filepath='drivers/thermal/thermal_core.c' line='823' column='1'/>
+        <parameter type-id='2feec21f' name='cdev' filepath='drivers/thermal/thermal_core.c' line='824' column='1'/>
+        <parameter type-id='7359adad' name='upper' filepath='drivers/thermal/thermal_core.c' line='825' column='1'/>
+        <parameter type-id='7359adad' name='lower' filepath='drivers/thermal/thermal_core.c' line='825' column='1'/>
+        <parameter type-id='f0981eeb' name='weight' filepath='drivers/thermal/thermal_core.c' line='826' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_disable' mangled-name='thermal_zone_device_disable' filepath='drivers/thermal/thermal_core.c' line='528' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_disable'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='528' column='1'/>
+      <function-decl name='thermal_zone_device_disable' mangled-name='thermal_zone_device_disable' filepath='drivers/thermal/thermal_core.c' line='527' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_disable'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='527' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_enable' mangled-name='thermal_zone_device_enable' filepath='drivers/thermal/thermal_core.c' line='522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_enable'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='522' column='1'/>
+      <function-decl name='thermal_zone_device_enable' mangled-name='thermal_zone_device_enable' filepath='drivers/thermal/thermal_core.c' line='521' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_enable'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='521' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_is_enabled' mangled-name='thermal_zone_device_is_enabled' filepath='drivers/thermal/thermal_core.c' line='534' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_is_enabled'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='534' column='1'/>
+      <function-decl name='thermal_zone_device_is_enabled' mangled-name='thermal_zone_device_is_enabled' filepath='drivers/thermal/thermal_core.c' line='533' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_is_enabled'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='533' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_register' mangled-name='thermal_zone_device_register' filepath='drivers/thermal/thermal_core.c' line='1377' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_register'>
-        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
-        <parameter type-id='95e97e5e' name='trips' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
-        <parameter type-id='95e97e5e' name='mask' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
-        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
-        <parameter type-id='1e6fe389' name='ops' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
-        <parameter type-id='e2cbf964' name='tzp' filepath='drivers/thermal/thermal_core.c' line='1379' column='1'/>
-        <parameter type-id='95e97e5e' name='passive_delay' filepath='drivers/thermal/thermal_core.c' line='1379' column='1'/>
-        <parameter type-id='95e97e5e' name='polling_delay' filepath='drivers/thermal/thermal_core.c' line='1380' column='1'/>
+      <function-decl name='thermal_zone_device_register' mangled-name='thermal_zone_device_register' filepath='drivers/thermal/thermal_core.c' line='1376' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_register'>
+        <parameter type-id='80f4b756' name='type' filepath='drivers/thermal/thermal_core.c' line='1376' column='1'/>
+        <parameter type-id='95e97e5e' name='trips' filepath='drivers/thermal/thermal_core.c' line='1376' column='1'/>
+        <parameter type-id='95e97e5e' name='mask' filepath='drivers/thermal/thermal_core.c' line='1376' column='1'/>
+        <parameter type-id='eaa32e2f' name='devdata' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
+        <parameter type-id='1e6fe389' name='ops' filepath='drivers/thermal/thermal_core.c' line='1377' column='1'/>
+        <parameter type-id='e2cbf964' name='tzp' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
+        <parameter type-id='95e97e5e' name='passive_delay' filepath='drivers/thermal/thermal_core.c' line='1378' column='1'/>
+        <parameter type-id='95e97e5e' name='polling_delay' filepath='drivers/thermal/thermal_core.c' line='1379' column='1'/>
         <return type-id='404b1300'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_unregister' mangled-name='thermal_zone_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1518' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_unregister'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='1518' column='1'/>
+      <function-decl name='thermal_zone_device_unregister' mangled-name='thermal_zone_device_unregister' filepath='drivers/thermal/thermal_core.c' line='1517' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_unregister'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='1517' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='thermal_zone_device_update' mangled-name='thermal_zone_device_update' filepath='drivers/thermal/thermal_core.c' line='548' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_update'>
-        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='548' column='1'/>
-        <parameter type-id='b5808f5e' name='event' filepath='drivers/thermal/thermal_core.c' line='549' column='1'/>
+      <function-decl name='thermal_zone_device_update' mangled-name='thermal_zone_device_update' filepath='drivers/thermal/thermal_core.c' line='547' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_device_update'>
+        <parameter type-id='404b1300' name='tz' filepath='drivers/thermal/thermal_core.c' line='547' column='1'/>
+        <parameter type-id='b5808f5e' name='event' filepath='drivers/thermal/thermal_core.c' line='548' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='thermal_zone_get_slope' mangled-name='thermal_zone_get_slope' filepath='drivers/thermal/thermal_helpers.c' line='226' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_slope'>
@@ -134887,8 +137958,8 @@
         <parameter type-id='7292109c' name='temp' filepath='drivers/thermal/thermal_helpers.c' line='78' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='thermal_zone_get_zone_by_name' mangled-name='thermal_zone_get_zone_by_name' filepath='drivers/thermal/thermal_core.c' line='1586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_zone_by_name'>
-        <parameter type-id='80f4b756' name='name' filepath='drivers/thermal/thermal_core.c' line='1586' column='1'/>
+      <function-decl name='thermal_zone_get_zone_by_name' mangled-name='thermal_zone_get_zone_by_name' filepath='drivers/thermal/thermal_core.c' line='1585' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_get_zone_by_name'>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/thermal/thermal_core.c' line='1585' column='1'/>
         <return type-id='404b1300'/>
       </function-decl>
       <function-decl name='thermal_zone_of_sensor_register' mangled-name='thermal_zone_of_sensor_register' filepath='drivers/thermal/thermal_of.c' line='493' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='thermal_zone_of_sensor_register'>
@@ -134949,6 +138020,10 @@
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='timer_unstable_counter_workaround' type-id='aa357a64' mangled-name='timer_unstable_counter_workaround' visibility='default' filepath='drivers/clocksource/arm_arch_timer.c' line='383' column='1' elf-symbol-id='timer_unstable_counter_workaround'/>
+      <function-decl name='timespec64_to_jiffies' mangled-name='timespec64_to_jiffies' filepath='kernel/time/time.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='timespec64_to_jiffies'>
+        <parameter type-id='0817f042' name='value' filepath='kernel/time/time.c' line='588' column='1'/>
+        <return type-id='7359adad'/>
+      </function-decl>
       <function-decl name='topology_set_thermal_pressure' mangled-name='topology_set_thermal_pressure' filepath='drivers/base/arch_topology.c' line='74' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='topology_set_thermal_pressure'>
         <parameter type-id='5f8a1ac4' name='cpus' filepath='drivers/base/arch_topology.c' line='74' column='1'/>
         <parameter type-id='7359adad' name='th_pressure' filepath='drivers/base/arch_topology.c' line='75' column='1'/>
@@ -135369,6 +138444,14 @@
         <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_io.c' line='1570' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='tty_ldisc_deref' mangled-name='tty_ldisc_deref' filepath='drivers/tty/tty_ldisc.c' line='304' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_ldisc_deref'>
+        <parameter type-id='e0bbd59c' name='ld' filepath='drivers/tty/tty_ldisc.c' line='304' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_ldisc_ref' mangled-name='tty_ldisc_ref' filepath='drivers/tty/tty_ldisc.c' line='283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_ldisc_ref'>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_ldisc.c' line='283' column='1'/>
+        <return type-id='e0bbd59c'/>
+      </function-decl>
       <function-decl name='tty_mode_ioctl' mangled-name='tty_mode_ioctl' filepath='drivers/tty/tty_ioctl.c' line='663' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_mode_ioctl'>
         <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_ioctl.c' line='663' column='1'/>
         <parameter type-id='77e79a4b' name='file' filepath='drivers/tty/tty_ioctl.c' line='663' column='1'/>
@@ -135376,29 +138459,97 @@
         <parameter type-id='7359adad' name='arg' filepath='drivers/tty/tty_ioctl.c' line='664' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='tty_port_close' mangled-name='tty_port_close' filepath='drivers/tty/tty_port.c' line='631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_close'>
+        <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='631' column='1'/>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_port.c' line='631' column='1'/>
+        <parameter type-id='77e79a4b' name='filp' filepath='drivers/tty/tty_port.c' line='632' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_port_destroy' mangled-name='tty_port_destroy' filepath='drivers/tty/tty_port.c' line='246' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_destroy'>
+        <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='246' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_port_hangup' mangled-name='tty_port_hangup' filepath='drivers/tty/tty_port.c' line='345' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_hangup'>
+        <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='345' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_port_init' mangled-name='tty_port_init' filepath='drivers/tty/tty_port.c' line='61' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_init'>
+        <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='61' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_port_open' mangled-name='tty_port_open' filepath='drivers/tty/tty_port.c' line='670' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_open'>
+        <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='670' column='1'/>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_port.c' line='670' column='1'/>
+        <parameter type-id='77e79a4b' name='filp' filepath='drivers/tty/tty_port.c' line='671' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='tty_port_register_device' mangled-name='tty_port_register_device' filepath='drivers/tty/tty_port.c' line='108' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_register_device'>
+        <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='108' column='1'/>
+        <parameter type-id='c2b4b27b' name='driver' filepath='drivers/tty/tty_port.c' line='109' column='1'/>
+        <parameter type-id='f0981eeb' name='index' filepath='drivers/tty/tty_port.c' line='109' column='1'/>
+        <parameter type-id='fa0b179b' name='device' filepath='drivers/tty/tty_port.c' line='110' column='1'/>
+        <return type-id='fa0b179b'/>
+      </function-decl>
       <function-decl name='tty_port_tty_get' mangled-name='tty_port_tty_get' filepath='drivers/tty/tty_port.c' line='283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_tty_get'>
         <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='283' column='1'/>
         <return type-id='572fbdca'/>
       </function-decl>
+      <function-decl name='tty_port_tty_wakeup' mangled-name='tty_port_tty_wakeup' filepath='drivers/tty/tty_port.c' line='386' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_port_tty_wakeup'>
+        <parameter type-id='ec77b5b8' name='port' filepath='drivers/tty/tty_port.c' line='386' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_register_driver' mangled-name='tty_register_driver' filepath='drivers/tty/tty_io.c' line='3406' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_register_driver'>
+        <parameter type-id='c2b4b27b' name='driver' filepath='drivers/tty/tty_io.c' line='3406' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='tty_register_ldisc' mangled-name='tty_register_ldisc' filepath='drivers/tty/tty_ldisc.c' line='61' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_register_ldisc'>
         <parameter type-id='95e97e5e' name='disc' filepath='drivers/tty/tty_ldisc.c' line='61' column='1'/>
         <parameter type-id='9d632ac5' name='new_ldisc' filepath='drivers/tty/tty_ldisc.c' line='61' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='tty_set_operations' mangled-name='tty_set_operations' filepath='drivers/tty/tty_io.c' line='3390' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_set_operations'>
+        <parameter type-id='c2b4b27b' name='driver' filepath='drivers/tty/tty_io.c' line='3390' column='1'/>
+        <parameter type-id='f2c18b44' name='op' filepath='drivers/tty/tty_io.c' line='3391' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_standard_install' mangled-name='tty_standard_install' filepath='drivers/tty/tty_io.c' line='1283' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_standard_install'>
+        <parameter type-id='c2b4b27b' name='driver' filepath='drivers/tty/tty_io.c' line='1283' column='1'/>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_io.c' line='1283' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <var-decl name='tty_std_termios' type-id='2f8662b5' mangled-name='tty_std_termios' visibility='default' filepath='drivers/tty/tty_io.c' line='122' column='1' elf-symbol-id='tty_std_termios'/>
       <function-decl name='tty_termios_baud_rate' mangled-name='tty_termios_baud_rate' filepath='drivers/tty/tty_baudrate.c' line='57' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_termios_baud_rate'>
         <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/tty_baudrate.c' line='57' column='1'/>
         <return type-id='6a8e8a14'/>
       </function-decl>
+      <function-decl name='tty_termios_copy_hw' mangled-name='tty_termios_copy_hw' filepath='drivers/tty/tty_ioctl.c' line='273' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_termios_copy_hw'>
+        <parameter type-id='e55856e5' name='new' filepath='drivers/tty/tty_ioctl.c' line='273' column='1'/>
+        <parameter type-id='e55856e5' name='old' filepath='drivers/tty/tty_ioctl.c' line='273' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='tty_termios_encode_baud_rate' mangled-name='tty_termios_encode_baud_rate' filepath='drivers/tty/tty_baudrate.c' line='141' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_termios_encode_baud_rate'>
         <parameter type-id='e55856e5' name='termios' filepath='drivers/tty/tty_baudrate.c' line='141' column='1'/>
         <parameter type-id='6a8e8a14' name='ibaud' filepath='drivers/tty/tty_baudrate.c' line='142' column='1'/>
         <parameter type-id='6a8e8a14' name='obaud' filepath='drivers/tty/tty_baudrate.c' line='142' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='tty_unregister_device' mangled-name='tty_unregister_device' filepath='drivers/tty/tty_io.c' line='3279' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_unregister_device'>
+        <parameter type-id='c2b4b27b' name='driver' filepath='drivers/tty/tty_io.c' line='3279' column='1'/>
+        <parameter type-id='f0981eeb' name='index' filepath='drivers/tty/tty_io.c' line='3279' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='tty_unregister_driver' mangled-name='tty_unregister_driver' filepath='drivers/tty/tty_io.c' line='3468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_unregister_driver'>
+        <parameter type-id='c2b4b27b' name='driver' filepath='drivers/tty/tty_io.c' line='3468' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='tty_unregister_ldisc' mangled-name='tty_unregister_ldisc' filepath='drivers/tty/tty_ldisc.c' line='90' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_unregister_ldisc'>
         <parameter type-id='95e97e5e' name='disc' filepath='drivers/tty/tty_ldisc.c' line='90' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='tty_vhangup' mangled-name='tty_vhangup' filepath='drivers/tty/tty_io.c' line='694' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='tty_vhangup'>
+        <parameter type-id='572fbdca' name='tty' filepath='drivers/tty/tty_io.c' line='694' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='typec_altmode_get_partner' mangled-name='typec_altmode_get_partner' filepath='drivers/usb/typec/bus.c' line='199' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='typec_altmode_get_partner'>
         <parameter type-id='02913b69' name='adev' filepath='drivers/usb/typec/bus.c' line='199' column='1'/>
         <return type-id='9aa82888'/>
@@ -135638,6 +138789,13 @@
         <parameter type-id='2c25e09d' name='ucsi' filepath='drivers/usb/typec/ucsi/ucsi.c' line='1332' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='ucsi_send_command' mangled-name='ucsi_send_command' filepath='drivers/usb/typec/ucsi/ucsi.c' line='149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ucsi_send_command'>
+        <parameter type-id='2c25e09d' name='ucsi' filepath='drivers/usb/typec/ucsi/ucsi.c' line='149' column='1'/>
+        <parameter type-id='91ce1af9' name='command' filepath='drivers/usb/typec/ucsi/ucsi.c' line='149' column='1'/>
+        <parameter type-id='eaa32e2f' name='data' filepath='drivers/usb/typec/ucsi/ucsi.c' line='150' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='drivers/usb/typec/ucsi/ucsi.c' line='150' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='ucsi_set_drvdata' mangled-name='ucsi_set_drvdata' filepath='drivers/usb/typec/ucsi/ucsi.c' line='1287' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ucsi_set_drvdata'>
         <parameter type-id='2c25e09d' name='ucsi' filepath='drivers/usb/typec/ucsi/ucsi.c' line='1287' column='1'/>
         <parameter type-id='eaa32e2f' name='data' filepath='drivers/usb/typec/ucsi/ucsi.c' line='1287' column='1'/>
@@ -135653,64 +138811,64 @@
         <parameter type-id='78a133c2' name='dst' filepath='net/ipv4/udp.c' line='807' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_alloc_host' mangled-name='ufshcd_alloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9312' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_alloc_host'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/scsi/ufs/ufshcd.c' line='9312' column='1'/>
-        <parameter type-id='f38ff799' name='hba_handle' filepath='drivers/scsi/ufs/ufshcd.c' line='9312' column='1'/>
+      <function-decl name='ufshcd_alloc_host' mangled-name='ufshcd_alloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9303' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_alloc_host'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/scsi/ufs/ufshcd.c' line='9303' column='1'/>
+        <parameter type-id='f38ff799' name='hba_handle' filepath='drivers/scsi/ufs/ufshcd.c' line='9303' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_auto_hibern8_update' mangled-name='ufshcd_auto_hibern8_update' filepath='drivers/scsi/ufs/ufshcd.c' line='4147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_auto_hibern8_update'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4147' column='1'/>
-        <parameter type-id='19c2251e' name='ahit' filepath='drivers/scsi/ufs/ufshcd.c' line='4147' column='1'/>
+      <function-decl name='ufshcd_auto_hibern8_update' mangled-name='ufshcd_auto_hibern8_update' filepath='drivers/scsi/ufs/ufshcd.c' line='4148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_auto_hibern8_update'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4148' column='1'/>
+        <parameter type-id='19c2251e' name='ahit' filepath='drivers/scsi/ufs/ufshcd.c' line='4148' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_bkops_ctrl' mangled-name='ufshcd_bkops_ctrl' filepath='drivers/scsi/ufs/ufshcd.c' line='5481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_bkops_ctrl'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5481' column='1'/>
-        <parameter type-id='462d2624' name='status' filepath='drivers/scsi/ufs/ufshcd.c' line='5482' column='1'/>
+      <function-decl name='ufshcd_bkops_ctrl' mangled-name='ufshcd_bkops_ctrl' filepath='drivers/scsi/ufs/ufshcd.c' line='5482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_bkops_ctrl'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5482' column='1'/>
+        <parameter type-id='462d2624' name='status' filepath='drivers/scsi/ufs/ufshcd.c' line='5483' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_config_pwr_mode' mangled-name='ufshcd_config_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4356' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_config_pwr_mode'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4356' column='1'/>
-        <parameter type-id='35f4156d' name='desired_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4357' column='1'/>
+      <function-decl name='ufshcd_config_pwr_mode' mangled-name='ufshcd_config_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4357' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_config_pwr_mode'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4357' column='1'/>
+        <parameter type-id='35f4156d' name='desired_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4358' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_dealloc_host' mangled-name='ufshcd_dealloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9284' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dealloc_host'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9284' column='1'/>
+      <function-decl name='ufshcd_dealloc_host' mangled-name='ufshcd_dealloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dealloc_host'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9275' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_delay_us' mangled-name='ufshcd_delay_us' filepath='drivers/scsi/ufs/ufshcd.c' line='587' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_delay_us'>
-        <parameter type-id='7359adad' name='us' filepath='drivers/scsi/ufs/ufshcd.c' line='587' column='1'/>
-        <parameter type-id='7359adad' name='tolerance' filepath='drivers/scsi/ufs/ufshcd.c' line='587' column='1'/>
+      <function-decl name='ufshcd_delay_us' mangled-name='ufshcd_delay_us' filepath='drivers/scsi/ufs/ufshcd.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_delay_us'>
+        <parameter type-id='7359adad' name='us' filepath='drivers/scsi/ufs/ufshcd.c' line='588' column='1'/>
+        <parameter type-id='7359adad' name='tolerance' filepath='drivers/scsi/ufs/ufshcd.c' line='588' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_dme_get_attr' mangled-name='ufshcd_dme_get_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_get_attr'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3864' column='1'/>
-        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3864' column='1'/>
-        <parameter type-id='f9409001' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1'/>
-        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1'/>
+      <function-decl name='ufshcd_dme_get_attr' mangled-name='ufshcd_dme_get_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_get_attr'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1'/>
+        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1'/>
+        <parameter type-id='f9409001' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3866' column='1'/>
+        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3866' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_dme_set_attr' mangled-name='ufshcd_dme_set_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3820' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_set_attr'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3820' column='1'/>
-        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3820' column='1'/>
-        <parameter type-id='f9b06939' name='attr_set' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1'/>
-        <parameter type-id='19c2251e' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1'/>
-        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1'/>
+      <function-decl name='ufshcd_dme_set_attr' mangled-name='ufshcd_dme_set_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_set_attr'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1'/>
+        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1'/>
+        <parameter type-id='f9b06939' name='attr_set' filepath='drivers/scsi/ufs/ufshcd.c' line='3822' column='1'/>
+        <parameter type-id='19c2251e' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3822' column='1'/>
+        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3822' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_dump_regs' mangled-name='ufshcd_dump_regs' filepath='drivers/scsi/ufs/ufshcd.c' line='102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dump_regs'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='102' column='1'/>
-        <parameter type-id='b59d7dce' name='offset' filepath='drivers/scsi/ufs/ufshcd.c' line='102' column='1'/>
-        <parameter type-id='b59d7dce' name='len' filepath='drivers/scsi/ufs/ufshcd.c' line='102' column='1'/>
-        <parameter type-id='80f4b756' name='prefix' filepath='drivers/scsi/ufs/ufshcd.c' line='103' column='1'/>
+      <function-decl name='ufshcd_dump_regs' mangled-name='ufshcd_dump_regs' filepath='drivers/scsi/ufs/ufshcd.c' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dump_regs'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='103' column='1'/>
+        <parameter type-id='b59d7dce' name='offset' filepath='drivers/scsi/ufs/ufshcd.c' line='103' column='1'/>
+        <parameter type-id='b59d7dce' name='len' filepath='drivers/scsi/ufs/ufshcd.c' line='103' column='1'/>
+        <parameter type-id='80f4b756' name='prefix' filepath='drivers/scsi/ufs/ufshcd.c' line='104' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_fixup_dev_quirks' mangled-name='ufshcd_fixup_dev_quirks' filepath='drivers/scsi/ufs/ufshcd.c' line='7441' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_fixup_dev_quirks'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='7441' column='1'/>
-        <parameter type-id='c5251c27' name='fixups' filepath='drivers/scsi/ufs/ufshcd.c' line='7441' column='1'/>
+      <function-decl name='ufshcd_fixup_dev_quirks' mangled-name='ufshcd_fixup_dev_quirks' filepath='drivers/scsi/ufs/ufshcd.c' line='7430' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_fixup_dev_quirks'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='7430' column='1'/>
+        <parameter type-id='c5251c27' name='fixups' filepath='drivers/scsi/ufs/ufshcd.c' line='7430' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_get_local_unipro_ver' mangled-name='ufshcd_get_local_unipro_ver' filepath='drivers/scsi/ufs/ufshcd.c' line='901' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_get_local_unipro_ver'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='901' column='1'/>
+      <function-decl name='ufshcd_get_local_unipro_ver' mangled-name='ufshcd_get_local_unipro_ver' filepath='drivers/scsi/ufs/ufshcd.c' line='902' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_get_local_unipro_ver'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='902' column='1'/>
         <return type-id='19c2251e'/>
       </function-decl>
       <function-decl name='ufshcd_get_pwr_dev_param' mangled-name='ufshcd_get_pwr_dev_param' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_get_pwr_dev_param'>
@@ -135719,31 +138877,31 @@
         <parameter type-id='35f4156d' name='agreed_pwr' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='254' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_hba_enable' mangled-name='ufshcd_hba_enable' filepath='drivers/scsi/ufs/ufshcd.c' line='4567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_enable'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4567' column='1'/>
+      <function-decl name='ufshcd_hba_enable' mangled-name='ufshcd_hba_enable' filepath='drivers/scsi/ufs/ufshcd.c' line='4568' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_enable'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4568' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_hba_stop' mangled-name='ufshcd_hba_stop' filepath='drivers/scsi/ufs/ufshcd.c' line='4481' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_stop'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4481' column='1'/>
+      <function-decl name='ufshcd_hba_stop' mangled-name='ufshcd_hba_stop' filepath='drivers/scsi/ufs/ufshcd.c' line='4482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_stop'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4482' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_hold' mangled-name='ufshcd_hold' filepath='drivers/scsi/ufs/ufshcd.c' line='1652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hold'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1652' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='drivers/scsi/ufs/ufshcd.c' line='1652' column='1'/>
+      <function-decl name='ufshcd_hold' mangled-name='ufshcd_hold' filepath='drivers/scsi/ufs/ufshcd.c' line='1653' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hold'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1653' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='drivers/scsi/ufs/ufshcd.c' line='1653' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_link_recovery' mangled-name='ufshcd_link_recovery' filepath='drivers/scsi/ufs/ufshcd.c' line='4065' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_link_recovery'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4065' column='1'/>
+      <function-decl name='ufshcd_link_recovery' mangled-name='ufshcd_link_recovery' filepath='drivers/scsi/ufs/ufshcd.c' line='4066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_link_recovery'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4066' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_make_hba_operational' mangled-name='ufshcd_make_hba_operational' filepath='drivers/scsi/ufs/ufshcd.c' line='4431' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_make_hba_operational'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4431' column='1'/>
+      <function-decl name='ufshcd_make_hba_operational' mangled-name='ufshcd_make_hba_operational' filepath='drivers/scsi/ufs/ufshcd.c' line='4432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_make_hba_operational'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4432' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_map_desc_id_to_length' mangled-name='ufshcd_map_desc_id_to_length' filepath='drivers/scsi/ufs/ufshcd.c' line='3296' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_map_desc_id_to_length'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3296' column='1'/>
-        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3296' column='1'/>
-        <parameter type-id='7292109c' name='desc_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1'/>
+      <function-decl name='ufshcd_map_desc_id_to_length' mangled-name='ufshcd_map_desc_id_to_length' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_map_desc_id_to_length'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1'/>
+        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1'/>
+        <parameter type-id='7292109c' name='desc_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3298' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ufshcd_pltfrm_init' mangled-name='ufshcd_pltfrm_init' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_pltfrm_init'>
@@ -135775,91 +138933,91 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='183' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_attr' mangled-name='ufshcd_query_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3103' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3103' column='1'/>
-        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
-        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
-        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
+      <function-decl name='ufshcd_query_attr' mangled-name='ufshcd_query_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
+        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
+        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
+        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_attr_retry' mangled-name='ufshcd_query_attr_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3169' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr_retry'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3169' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1'/>
-        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1'/>
-        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1'/>
-        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
+      <function-decl name='ufshcd_query_attr_retry' mangled-name='ufshcd_query_attr_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr_retry'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
+        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
+        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
+        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3172' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_descriptor_retry' mangled-name='ufshcd_query_descriptor_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3270' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_descriptor_retry'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3270' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3271' column='1'/>
-        <parameter type-id='32c9d5cb' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3272' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3272' column='1'/>
-        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3273' column='1'/>
-        <parameter type-id='8bff8096' name='desc_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3274' column='1'/>
-        <parameter type-id='7292109c' name='buf_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3274' column='1'/>
+      <function-decl name='ufshcd_query_descriptor_retry' mangled-name='ufshcd_query_descriptor_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_descriptor_retry'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3271' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3272' column='1'/>
+        <parameter type-id='32c9d5cb' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3273' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3273' column='1'/>
+        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3274' column='1'/>
+        <parameter type-id='8bff8096' name='desc_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3275' column='1'/>
+        <parameter type-id='7292109c' name='buf_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3275' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_flag' mangled-name='ufshcd_query_flag' filepath='drivers/scsi/ufs/ufshcd.c' line='3033' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3033' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3033' column='1'/>
-        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1'/>
-        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1'/>
+      <function-decl name='ufshcd_query_flag' mangled-name='ufshcd_query_flag' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1'/>
+        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3035' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3035' column='1'/>
+        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='3035' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_flag_retry' mangled-name='ufshcd_query_flag_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='2999' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag_retry'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='2999' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1'/>
-        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1'/>
-        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1'/>
+      <function-decl name='ufshcd_query_flag_retry' mangled-name='ufshcd_query_flag_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag_retry'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
+        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
+        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_read_desc_param' mangled-name='ufshcd_read_desc_param' filepath='drivers/scsi/ufs/ufshcd.c' line='3332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_read_desc_param'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3332' column='1'/>
-        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3333' column='1'/>
-        <parameter type-id='95e97e5e' name='desc_index' filepath='drivers/scsi/ufs/ufshcd.c' line='3334' column='1'/>
-        <parameter type-id='f9b06939' name='param_offset' filepath='drivers/scsi/ufs/ufshcd.c' line='3335' column='1'/>
-        <parameter type-id='8bff8096' name='param_read_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3336' column='1'/>
-        <parameter type-id='f9b06939' name='param_size' filepath='drivers/scsi/ufs/ufshcd.c' line='3337' column='1'/>
+      <function-decl name='ufshcd_read_desc_param' mangled-name='ufshcd_read_desc_param' filepath='drivers/scsi/ufs/ufshcd.c' line='3333' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_read_desc_param'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3333' column='1'/>
+        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3334' column='1'/>
+        <parameter type-id='95e97e5e' name='desc_index' filepath='drivers/scsi/ufs/ufshcd.c' line='3335' column='1'/>
+        <parameter type-id='f9b06939' name='param_offset' filepath='drivers/scsi/ufs/ufshcd.c' line='3336' column='1'/>
+        <parameter type-id='8bff8096' name='param_read_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3337' column='1'/>
+        <parameter type-id='f9b06939' name='param_size' filepath='drivers/scsi/ufs/ufshcd.c' line='3338' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_release' mangled-name='ufshcd_release' filepath='drivers/scsi/ufs/ufshcd.c' line='1830' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_release'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1830' column='1'/>
+      <function-decl name='ufshcd_release' mangled-name='ufshcd_release' filepath='drivers/scsi/ufs/ufshcd.c' line='1831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_release'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1831' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_remove' mangled-name='ufshcd_remove' filepath='drivers/scsi/ufs/ufshcd.c' line='9264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_remove'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9264' column='1'/>
+      <function-decl name='ufshcd_remove' mangled-name='ufshcd_remove' filepath='drivers/scsi/ufs/ufshcd.c' line='9255' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_remove'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9255' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_shutdown' mangled-name='ufshcd_shutdown' filepath='drivers/scsi/ufs/ufshcd.c' line='9233' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_shutdown'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9233' column='1'/>
+      <function-decl name='ufshcd_shutdown' mangled-name='ufshcd_shutdown' filepath='drivers/scsi/ufs/ufshcd.c' line='9224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_shutdown'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9224' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_system_resume' mangled-name='ufshcd_system_resume' filepath='drivers/scsi/ufs/ufshcd.c' line='9132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_resume'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9132' column='1'/>
+      <function-decl name='ufshcd_system_resume' mangled-name='ufshcd_system_resume' filepath='drivers/scsi/ufs/ufshcd.c' line='9123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_resume'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9123' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_system_suspend' mangled-name='ufshcd_system_suspend' filepath='drivers/scsi/ufs/ufshcd.c' line='9078' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_suspend'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9078' column='1'/>
+      <function-decl name='ufshcd_system_suspend' mangled-name='ufshcd_system_suspend' filepath='drivers/scsi/ufs/ufshcd.c' line='9069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_suspend'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9069' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_uic_hibern8_enter' mangled-name='ufshcd_uic_hibern8_enter' filepath='drivers/scsi/ufs/ufshcd.c' line='4096' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_enter'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4096' column='1'/>
+      <function-decl name='ufshcd_uic_hibern8_enter' mangled-name='ufshcd_uic_hibern8_enter' filepath='drivers/scsi/ufs/ufshcd.c' line='4097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_enter'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4097' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_uic_hibern8_exit' mangled-name='ufshcd_uic_hibern8_exit' filepath='drivers/scsi/ufs/ufshcd.c' line='4120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_exit'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4120' column='1'/>
+      <function-decl name='ufshcd_uic_hibern8_exit' mangled-name='ufshcd_uic_hibern8_exit' filepath='drivers/scsi/ufs/ufshcd.c' line='4121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_exit'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4121' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_update_evt_hist' mangled-name='ufshcd_update_evt_hist' filepath='drivers/scsi/ufs/ufshcd.c' line='4630' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_update_evt_hist'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4630' column='1'/>
-        <parameter type-id='19c2251e' name='id' filepath='drivers/scsi/ufs/ufshcd.c' line='4630' column='1'/>
-        <parameter type-id='19c2251e' name='val' filepath='drivers/scsi/ufs/ufshcd.c' line='4630' column='1'/>
+      <function-decl name='ufshcd_update_evt_hist' mangled-name='ufshcd_update_evt_hist' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_update_evt_hist'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1'/>
+        <parameter type-id='19c2251e' name='id' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1'/>
+        <parameter type-id='19c2251e' name='val' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='uio_unregister_device' mangled-name='uio_unregister_device' filepath='drivers/uio/uio.c' line='1042' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uio_unregister_device'>
@@ -135977,6 +139135,10 @@
         <parameter type-id='d504f73d' name='nb' filepath='kernel/power/main.c' line='77' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='unregister_qdisc' mangled-name='unregister_qdisc' filepath='net/sched/sch_api.c' line='174' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_qdisc'>
+        <parameter type-id='d6369c88' name='qops' filepath='net/sched/sch_api.c' line='174' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='unregister_reboot_notifier' mangled-name='unregister_reboot_notifier' filepath='kernel/reboot.c' line='106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_reboot_notifier'>
         <parameter type-id='d504f73d' name='nb' filepath='kernel/reboot.c' line='106' column='1'/>
         <return type-id='95e97e5e'/>
@@ -136059,6 +139221,11 @@
         <parameter type-id='7359adad' name='irqflags' filepath='drivers/usb/core/hcd.c' line='2639' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='usb_add_phy' mangled-name='usb_add_phy' filepath='drivers/usb/phy/phy.c' line='626' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_phy'>
+        <parameter type-id='ca9354d1' name='x' filepath='drivers/usb/phy/phy.c' line='626' column='1'/>
+        <parameter type-id='d95f4827' name='type' filepath='drivers/usb/phy/phy.c' line='626' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='usb_add_phy_dev' mangled-name='usb_add_phy_dev' filepath='drivers/usb/phy/phy.c' line='672' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_add_phy_dev'>
         <parameter type-id='ca9354d1' name='x' filepath='drivers/usb/phy/phy.c' line='672' column='1'/>
         <return type-id='95e97e5e'/>
@@ -136122,6 +139289,10 @@
         <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/driver.c' line='1825' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='usb_autopm_get_interface_no_resume' mangled-name='usb_autopm_get_interface_no_resume' filepath='drivers/usb/core/driver.c' line='1883' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_autopm_get_interface_no_resume'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/driver.c' line='1883' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='usb_autopm_put_interface' mangled-name='usb_autopm_put_interface' filepath='drivers/usb/core/driver.c' line='1747' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_autopm_put_interface'>
         <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/driver.c' line='1747' column='1'/>
         <return type-id='48b5725f'/>
@@ -136205,6 +139376,11 @@
         <parameter type-id='46ae908a' name='driver' filepath='drivers/usb/core/driver.c' line='1100' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_deregister_dev' mangled-name='usb_deregister_dev' filepath='drivers/usb/core/file.c' line='230' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_deregister_dev'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/file.c' line='230' column='1'/>
+        <parameter type-id='63cfef1d' name='class_driver' filepath='drivers/usb/core/file.c' line='231' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='usb_disable_xhci_ports' mangled-name='usb_disable_xhci_ports' filepath='drivers/usb/host/pci-quirks.c' line='1124' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_disable_xhci_ports'>
         <parameter type-id='85196e3f' name='xhci_pdev' filepath='drivers/usb/host/pci-quirks.c' line='1124' column='1'/>
         <return type-id='48b5725f'/>
@@ -136283,6 +139459,11 @@
         <parameter type-id='5fce7261' name='int_out' filepath='drivers/usb/core/usb.c' line='139' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='usb_find_interface' mangled-name='usb_find_interface' filepath='drivers/usb/core/usb.c' line='352' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_find_interface'>
+        <parameter type-id='46ae908a' name='drv' filepath='drivers/usb/core/usb.c' line='352' column='1'/>
+        <parameter type-id='95e97e5e' name='minor' filepath='drivers/usb/core/usb.c' line='352' column='1'/>
+        <return type-id='8bf48c31'/>
+      </function-decl>
       <function-decl name='usb_free_all_descriptors' mangled-name='usb_free_all_descriptors' filepath='drivers/usb/gadget/config.c' line='202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_free_all_descriptors'>
         <parameter type-id='e5411c2c' name='f' filepath='drivers/usb/gadget/config.c' line='202' column='1'/>
         <return type-id='48b5725f'/>
@@ -136382,6 +139563,10 @@
         <parameter type-id='49a58c0c' name='gadget' filepath='drivers/usb/gadget/udc/core.c' line='493' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='usb_get_dev' mangled-name='usb_get_dev' filepath='drivers/usb/core/usb.c' line='694' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_get_dev'>
+        <parameter type-id='25e60cb2' name='dev' filepath='drivers/usb/core/usb.c' line='694' column='1'/>
+        <return type-id='25e60cb2'/>
+      </function-decl>
       <function-decl name='usb_get_dr_mode' mangled-name='usb_get_dr_mode' filepath='drivers/usb/common/common.c' line='190' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_get_dr_mode'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/common/common.c' line='190' column='1'/>
         <return type-id='d291aaf1'/>
@@ -136397,6 +139582,10 @@
       <function-decl name='usb_get_gadget_udc_name' mangled-name='usb_get_gadget_udc_name' filepath='drivers/usb/gadget/udc/core.c' line='1393' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_get_gadget_udc_name'>
         <return type-id='26a90f95'/>
       </function-decl>
+      <function-decl name='usb_get_intf' mangled-name='usb_get_intf' filepath='drivers/usb/core/usb.c' line='728' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_get_intf'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/usb.c' line='728' column='1'/>
+        <return type-id='8bf48c31'/>
+      </function-decl>
       <function-decl name='usb_get_maximum_speed' mangled-name='usb_get_maximum_speed' filepath='drivers/usb/common/common.c' line='107' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_get_maximum_speed'>
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/usb/common/common.c' line='107' column='1'/>
         <return type-id='4e532009'/>
@@ -136467,8 +139656,8 @@
         <parameter type-id='85196e3f' name='dev' filepath='drivers/usb/core/hcd-pci.c' line='363' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_hcd_platform_shutdown' mangled-name='usb_hcd_platform_shutdown' filepath='drivers/usb/core/hcd.c' line='2913' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_platform_shutdown'>
-        <parameter type-id='db362995' name='dev' filepath='drivers/usb/core/hcd.c' line='2913' column='1'/>
+      <function-decl name='usb_hcd_platform_shutdown' mangled-name='usb_hcd_platform_shutdown' filepath='drivers/usb/core/hcd.c' line='2930' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_platform_shutdown'>
+        <parameter type-id='db362995' name='dev' filepath='drivers/usb/core/hcd.c' line='2930' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_hcd_poll_rh_status' mangled-name='usb_hcd_poll_rh_status' filepath='drivers/usb/core/hcd.c' line='753' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_poll_rh_status'>
@@ -136523,6 +139712,24 @@
         <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='703' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_match_id' mangled-name='usb_match_id' filepath='drivers/usb/core/driver.c' line='807' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_match_id'>
+        <parameter type-id='8bf48c31' name='interface' filepath='drivers/usb/core/driver.c' line='807' column='1'/>
+        <parameter type-id='bc57058f' name='id' filepath='drivers/usb/core/driver.c' line='808' column='1'/>
+        <return type-id='bc57058f'/>
+      </function-decl>
+      <function-decl name='usb_match_one_id' mangled-name='usb_match_one_id' filepath='drivers/usb/core/driver.c' line='714' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_match_one_id'>
+        <parameter type-id='8bf48c31' name='interface' filepath='drivers/usb/core/driver.c' line='714' column='1'/>
+        <parameter type-id='bc57058f' name='id' filepath='drivers/usb/core/driver.c' line='715' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='usb_os_desc_prepare_interf_dir' mangled-name='usb_os_desc_prepare_interf_dir' filepath='drivers/usb/gadget/configfs.c' line='1228' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_os_desc_prepare_interf_dir'>
+        <parameter type-id='97aff453' name='parent' filepath='drivers/usb/gadget/configfs.c' line='1229' column='1'/>
+        <parameter type-id='95e97e5e' name='n_interf' filepath='drivers/usb/gadget/configfs.c' line='1230' column='1'/>
+        <parameter type-id='b6338998' name='desc' filepath='drivers/usb/gadget/configfs.c' line='1231' column='1'/>
+        <parameter type-id='9b23c9ad' name='names' filepath='drivers/usb/gadget/configfs.c' line='1232' column='1'/>
+        <parameter type-id='2730d015' name='owner' filepath='drivers/usb/gadget/configfs.c' line='1233' column='1'/>
+        <return type-id='97aff453'/>
+      </function-decl>
       <function-decl name='usb_otg_state_string' mangled-name='usb_otg_state_string' filepath='drivers/usb/common/common.c' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_otg_state_string'>
         <parameter type-id='4c0c8157' name='state' filepath='drivers/usb/common/common.c' line='43' column='1'/>
         <return type-id='80f4b756'/>
@@ -136548,6 +139755,10 @@
         <parameter type-id='7359adad' name='event' filepath='drivers/usb/phy/phy.c' line='721' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_poison_anchored_urbs' mangled-name='usb_poison_anchored_urbs' filepath='drivers/usb/core/urb.c' line='838' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_poison_anchored_urbs'>
+        <parameter type-id='bd300bf3' name='anchor' filepath='drivers/usb/core/urb.c' line='838' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='usb_poison_urb' mangled-name='usb_poison_urb' filepath='drivers/usb/core/urb.c' line='744' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_poison_urb'>
         <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='744' column='1'/>
         <return type-id='48b5725f'/>
@@ -136568,6 +139779,15 @@
         <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2557' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_put_intf' mangled-name='usb_put_intf' filepath='drivers/usb/core/usb.c' line='744' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_put_intf'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/usb.c' line='744' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
+      <function-decl name='usb_register_dev' mangled-name='usb_register_dev' filepath='drivers/usb/core/file.c' line='156' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_register_dev'>
+        <parameter type-id='8bf48c31' name='intf' filepath='drivers/usb/core/file.c' line='156' column='1'/>
+        <parameter type-id='63cfef1d' name='class_driver' filepath='drivers/usb/core/file.c' line='157' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='usb_register_driver' mangled-name='usb_register_driver' filepath='drivers/usb/core/driver.c' line='1047' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_register_driver'>
         <parameter type-id='46ae908a' name='new_driver' filepath='drivers/usb/core/driver.c' line='1047' column='1'/>
         <parameter type-id='2730d015' name='owner' filepath='drivers/usb/core/driver.c' line='1047' column='1'/>
@@ -136583,8 +139803,8 @@
         <parameter type-id='e5411c2c' name='f' filepath='drivers/usb/gadget/composite.c' line='354' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='usb_remove_hcd' mangled-name='usb_remove_hcd' filepath='drivers/usb/core/hcd.c' line='2845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_remove_hcd'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2845' column='1'/>
+      <function-decl name='usb_remove_hcd' mangled-name='usb_remove_hcd' filepath='drivers/usb/core/hcd.c' line='2859' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_remove_hcd'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='2859' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='usb_remove_phy' mangled-name='usb_remove_phy' filepath='drivers/usb/phy/phy.c' line='703' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_remove_phy'>
@@ -136630,10 +139850,29 @@
         <parameter type-id='901a91cb' name='new_state' filepath='drivers/usb/core/hub.c' line='2043' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_set_interface' mangled-name='usb_set_interface' filepath='drivers/usb/core/message.c' line='1523' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_set_interface'>
+        <parameter type-id='25e60cb2' name='dev' filepath='drivers/usb/core/message.c' line='1523' column='1'/>
+        <parameter type-id='95e97e5e' name='interface' filepath='drivers/usb/core/message.c' line='1523' column='1'/>
+        <parameter type-id='95e97e5e' name='alternate' filepath='drivers/usb/core/message.c' line='1523' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='usb_show_dynids' mangled-name='usb_show_dynids' filepath='drivers/usb/core/driver.c' line='115' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_show_dynids'>
+        <parameter type-id='32c73a29' name='dynids' filepath='drivers/usb/core/driver.c' line='115' column='1'/>
+        <parameter type-id='26a90f95' name='buf' filepath='drivers/usb/core/driver.c' line='115' column='1'/>
+        <return type-id='79a0948f'/>
+      </function-decl>
       <function-decl name='usb_speed_string' mangled-name='usb_speed_string' filepath='drivers/usb/common/common.c' line='91' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_speed_string'>
         <parameter type-id='4e532009' name='speed' filepath='drivers/usb/common/common.c' line='91' column='1'/>
         <return type-id='80f4b756'/>
       </function-decl>
+      <function-decl name='usb_store_new_id' mangled-name='usb_store_new_id' filepath='drivers/usb/core/driver.c' line='43' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_store_new_id'>
+        <parameter type-id='32c73a29' name='dynids' filepath='drivers/usb/core/driver.c' line='43' column='1'/>
+        <parameter type-id='bc57058f' name='id_table' filepath='drivers/usb/core/driver.c' line='44' column='1'/>
+        <parameter type-id='00c7b870' name='driver' filepath='drivers/usb/core/driver.c' line='45' column='1'/>
+        <parameter type-id='80f4b756' name='buf' filepath='drivers/usb/core/driver.c' line='46' column='1'/>
+        <parameter type-id='b59d7dce' name='count' filepath='drivers/usb/core/driver.c' line='46' column='1'/>
+        <return type-id='79a0948f'/>
+      </function-decl>
       <function-decl name='usb_string_id' mangled-name='usb_string_id' filepath='drivers/usb/gadget/composite.c' line='1275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_string_id'>
         <parameter type-id='2a895c01' name='cdev' filepath='drivers/usb/gadget/composite.c' line='1275' column='1'/>
         <return type-id='95e97e5e'/>
@@ -136652,6 +139891,10 @@
         <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='164' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_unpoison_urb' mangled-name='usb_unpoison_urb' filepath='drivers/usb/core/urb.c' line='759' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_unpoison_urb'>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/urb.c' line='759' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='usb_unregister_notify' mangled-name='usb_unregister_notify' filepath='drivers/usb/core/notify.c' line='42' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_unregister_notify'>
         <parameter type-id='d504f73d' name='nb' filepath='drivers/usb/core/notify.c' line='42' column='1'/>
         <return type-id='48b5725f'/>
@@ -136666,6 +139909,11 @@
         <parameter type-id='95e97e5e' name='new_mtu' filepath='drivers/net/usb/usbnet.c' line='375' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='usbnet_defer_kevent' mangled-name='usbnet_defer_kevent' filepath='drivers/net/usb/usbnet.c' line='451' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_defer_kevent'>
+        <parameter type-id='12884b9a' name='dev' filepath='drivers/net/usb/usbnet.c' line='451' column='1'/>
+        <parameter type-id='95e97e5e' name='work' filepath='drivers/net/usb/usbnet.c' line='451' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='usbnet_disconnect' mangled-name='usbnet_disconnect' filepath='drivers/net/usb/usbnet.c' line='1567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usbnet_disconnect'>
         <parameter type-id='8bf48c31' name='intf' filepath='drivers/net/usb/usbnet.c' line='1567' column='1'/>
         <return type-id='48b5725f'/>
@@ -136935,6 +140183,15 @@
         <parameter type-id='eaa32e2f' name='priv' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='2883' column='1'/>
         <return type-id='4b8b2cf3'/>
       </function-decl>
+      <function-decl name='v4l2_ctrl_new_int_menu' mangled-name='v4l2_ctrl_new_int_menu' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3035' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_ctrl_new_int_menu'>
+        <parameter type-id='2b59fa5e' name='hdl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3035' column='1'/>
+        <parameter type-id='1086b623' name='ops' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3036' column='1'/>
+        <parameter type-id='19c2251e' name='id' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3037' column='1'/>
+        <parameter type-id='f9b06939' name='_max' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3037' column='1'/>
+        <parameter type-id='f9b06939' name='_def' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3037' column='1'/>
+        <parameter type-id='43ae54cf' name='qmenu_int' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3037' column='1'/>
+        <return type-id='4b8b2cf3'/>
+      </function-decl>
       <function-decl name='v4l2_ctrl_new_std' mangled-name='v4l2_ctrl_new_std' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='2926' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_ctrl_new_std'>
         <parameter type-id='2b59fa5e' name='hdl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='2926' column='1'/>
         <parameter type-id='1086b623' name='ops' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='2927' column='1'/>
@@ -137308,6 +140565,11 @@
         <parameter type-id='f0981eeb' name='notification' filepath='drivers/media/v4l2-core/v4l2-mc.c' line='557' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='v4l2_querymenu' mangled-name='v4l2_querymenu' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3446' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_querymenu'>
+        <parameter type-id='2b59fa5e' name='hdl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3446' column='1'/>
+        <parameter type-id='4394e2c1' name='qm' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='3446' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='v4l2_s_ctrl' mangled-name='v4l2_s_ctrl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4413' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='v4l2_s_ctrl'>
         <parameter type-id='b7db9582' name='fh' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4413' column='1'/>
         <parameter type-id='2b59fa5e' name='hdl' filepath='drivers/media/v4l2-core/v4l2-ctrls.c' line='4413' column='1'/>
@@ -138120,6 +141382,12 @@
         <parameter type-id='5f919c1f'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='vsock_addr_init' mangled-name='vsock_addr_init' filepath='net/vmw_vsock/vsock_addr.c' line='14' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_addr_init'>
+        <parameter type-id='b6a6ca60' name='addr' filepath='net/vmw_vsock/vsock_addr.c' line='14' column='1'/>
+        <parameter type-id='19c2251e' name='cid' filepath='net/vmw_vsock/vsock_addr.c' line='14' column='1'/>
+        <parameter type-id='19c2251e' name='port' filepath='net/vmw_vsock/vsock_addr.c' line='14' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='vsock_core_register' mangled-name='vsock_core_register' filepath='net/vmw_vsock/af_vsock.c' line='2167' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_core_register'>
         <parameter type-id='c6c5bd96' name='t' filepath='net/vmw_vsock/af_vsock.c' line='2167' column='1'/>
         <parameter type-id='95e97e5e' name='features' filepath='net/vmw_vsock/af_vsock.c' line='2167' column='1'/>
@@ -138133,6 +141401,10 @@
         <parameter type-id='841969d0' name='fn' filepath='net/vmw_vsock/af_vsock.c' line='336' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='vsock_remove_sock' mangled-name='vsock_remove_sock' filepath='net/vmw_vsock/af_vsock.c' line='329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsock_remove_sock'>
+        <parameter type-id='ecb0ce18' name='vsk' filepath='net/vmw_vsock/af_vsock.c' line='329' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='vsprintf' mangled-name='vsprintf' filepath='lib/vsprintf.c' line='2854' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vsprintf'>
         <parameter type-id='26a90f95' name='buf' filepath='lib/vsprintf.c' line='2854' column='1'/>
         <parameter type-id='80f4b756' name='fmt' filepath='lib/vsprintf.c' line='2854' column='1'/>
@@ -138395,15 +141667,15 @@
         <parameter type-id='19c2251e' name='reqid' filepath='net/xfrm/xfrm_state.c' line='1190' column='1'/>
         <return type-id='328dda6e'/>
       </function-decl>
-      <function-decl name='xhci_add_endpoint' mangled-name='xhci_add_endpoint' filepath='drivers/usb/host/xhci.c' line='1832' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_add_endpoint'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='1832' column='1'/>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='1832' column='1'/>
-        <parameter type-id='15adb516' name='ep' filepath='drivers/usb/host/xhci.c' line='1833' column='1'/>
+      <function-decl name='xhci_add_endpoint' mangled-name='xhci_add_endpoint' filepath='drivers/usb/host/xhci.c' line='1833' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_add_endpoint'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='1833' column='1'/>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='1833' column='1'/>
+        <parameter type-id='15adb516' name='ep' filepath='drivers/usb/host/xhci.c' line='1834' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_address_device' mangled-name='xhci_address_device' filepath='drivers/usb/host/xhci.c' line='4221' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_address_device'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='4221' column='1'/>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='4221' column='1'/>
+      <function-decl name='xhci_address_device' mangled-name='xhci_address_device' filepath='drivers/usb/host/xhci.c' line='4222' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_address_device'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='4222' column='1'/>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='4222' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xhci_alloc_command' mangled-name='xhci_alloc_command' filepath='drivers/usb/host/xhci-mem.c' line='1814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_alloc_command'>
@@ -138427,19 +141699,19 @@
         <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci-hub.c' line='1598' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_check_bandwidth' mangled-name='xhci_check_bandwidth' filepath='drivers/usb/host/xhci.c' line='2876' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_check_bandwidth'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='2876' column='1'/>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='2876' column='1'/>
+      <function-decl name='xhci_check_bandwidth' mangled-name='xhci_check_bandwidth' filepath='drivers/usb/host/xhci.c' line='2877' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_check_bandwidth'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='2877' column='1'/>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='2877' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xhci_check_trb_in_td_math' mangled-name='xhci_check_trb_in_td_math' filepath='drivers/usb/host/xhci-mem.c' line='2079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_check_trb_in_td_math'>
         <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-mem.c' line='2079' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_drop_endpoint' mangled-name='xhci_drop_endpoint' filepath='drivers/usb/host/xhci.c' line='1749' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_drop_endpoint'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='1749' column='1'/>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='1749' column='1'/>
-        <parameter type-id='15adb516' name='ep' filepath='drivers/usb/host/xhci.c' line='1750' column='1'/>
+      <function-decl name='xhci_drop_endpoint' mangled-name='xhci_drop_endpoint' filepath='drivers/usb/host/xhci.c' line='1750' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_drop_endpoint'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='1750' column='1'/>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='1750' column='1'/>
+        <parameter type-id='15adb516' name='ep' filepath='drivers/usb/host/xhci.c' line='1751' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xhci_free_command' mangled-name='xhci_free_command' filepath='drivers/usb/host/xhci-mem.c' line='1865' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_free_command'>
@@ -138452,13 +141724,13 @@
         <parameter type-id='d7409d08' name='erst' filepath='drivers/usb/host/xhci-mem.c' line='1906' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xhci_gen_setup' mangled-name='xhci_gen_setup' filepath='drivers/usb/host/xhci.c' line='5154' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_gen_setup'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='5154' column='1'/>
-        <parameter type-id='67f831c0' name='get_quirks' filepath='drivers/usb/host/xhci.c' line='5154' column='1'/>
+      <function-decl name='xhci_gen_setup' mangled-name='xhci_gen_setup' filepath='drivers/usb/host/xhci.c' line='5155' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_gen_setup'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='5155' column='1'/>
+        <parameter type-id='67f831c0' name='get_quirks' filepath='drivers/usb/host/xhci.c' line='5155' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_get_endpoint_index' mangled-name='xhci_get_endpoint_index' filepath='drivers/usb/host/xhci.c' line='1298' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_get_endpoint_index'>
-        <parameter type-id='a07d0491' name='desc' filepath='drivers/usb/host/xhci.c' line='1298' column='1'/>
+      <function-decl name='xhci_get_endpoint_index' mangled-name='xhci_get_endpoint_index' filepath='drivers/usb/host/xhci.c' line='1299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_get_endpoint_index'>
+        <parameter type-id='a07d0491' name='desc' filepath='drivers/usb/host/xhci.c' line='1299' column='1'/>
         <return type-id='f0981eeb'/>
       </function-decl>
       <function-decl name='xhci_get_ep_ctx' mangled-name='xhci_get_ep_ctx' filepath='drivers/usb/host/xhci-mem.c' line='594' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_get_ep_ctx'>
@@ -138476,9 +141748,9 @@
         <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci-ring.c' line='2905' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_init_driver' mangled-name='xhci_init_driver' filepath='drivers/usb/host/xhci.c' line='5398' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_init_driver'>
-        <parameter type-id='c07d5ba3' name='drv' filepath='drivers/usb/host/xhci.c' line='5398' column='1'/>
-        <parameter type-id='9a55ba3d' name='over' filepath='drivers/usb/host/xhci.c' line='5399' column='1'/>
+      <function-decl name='xhci_init_driver' mangled-name='xhci_init_driver' filepath='drivers/usb/host/xhci.c' line='5399' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_init_driver'>
+        <parameter type-id='c07d5ba3' name='drv' filepath='drivers/usb/host/xhci.c' line='5399' column='1'/>
+        <parameter type-id='9a55ba3d' name='over' filepath='drivers/usb/host/xhci.c' line='5400' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='xhci_initialize_ring_info' mangled-name='xhci_initialize_ring_info' filepath='drivers/usb/host/xhci-mem.c' line='299' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_initialize_ring_info'>
@@ -138501,14 +141773,14 @@
         <parameter type-id='95e97e5e' name='suspend' filepath='drivers/usb/host/xhci-ring.c' line='4360' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='xhci_reset_bandwidth' mangled-name='xhci_reset_bandwidth' filepath='drivers/usb/host/xhci.c' line='2975' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_reset_bandwidth'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='2975' column='1'/>
-        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='2975' column='1'/>
+      <function-decl name='xhci_reset_bandwidth' mangled-name='xhci_reset_bandwidth' filepath='drivers/usb/host/xhci.c' line='2976' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_reset_bandwidth'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/xhci.c' line='2976' column='1'/>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/host/xhci.c' line='2976' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xhci_resume' mangled-name='xhci_resume' filepath='drivers/usb/host/xhci.c' line='1085' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_resume'>
-        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='1085' column='1'/>
-        <parameter type-id='b50a4934' name='hibernated' filepath='drivers/usb/host/xhci.c' line='1085' column='1'/>
+      <function-decl name='xhci_resume' mangled-name='xhci_resume' filepath='drivers/usb/host/xhci.c' line='1086' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_resume'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='1086' column='1'/>
+        <parameter type-id='b50a4934' name='hibernated' filepath='drivers/usb/host/xhci.c' line='1086' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xhci_ring_alloc' mangled-name='xhci_ring_alloc' filepath='drivers/usb/host/xhci-mem.c' line='423' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_ring_alloc'>
@@ -138538,9 +141810,9 @@
         <parameter type-id='9689f21b' name='seg' filepath='drivers/usb/host/xhci-mem.c' line='68' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xhci_suspend' mangled-name='xhci_suspend' filepath='drivers/usb/host/xhci.c' line='971' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_suspend'>
-        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='971' column='1'/>
-        <parameter type-id='b50a4934' name='do_wakeup' filepath='drivers/usb/host/xhci.c' line='971' column='1'/>
+      <function-decl name='xhci_suspend' mangled-name='xhci_suspend' filepath='drivers/usb/host/xhci.c' line='972' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_suspend'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='972' column='1'/>
+        <parameter type-id='b50a4934' name='do_wakeup' filepath='drivers/usb/host/xhci.c' line='972' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='xhci_trb_virt_to_dma' mangled-name='xhci_trb_virt_to_dma' filepath='drivers/usb/host/xhci-ring.c' line='69' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_trb_virt_to_dma'>
@@ -138553,8 +141825,8 @@
         <parameter type-id='2e0bb6d4' name='event_ring_deq' filepath='drivers/usb/host/xhci-ring.c' line='2982' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='xhci_vendor_get_ops' mangled-name='xhci_vendor_get_ops' filepath='drivers/usb/host/xhci.c' line='4317' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_vendor_get_ops'>
-        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='4317' column='1'/>
+      <function-decl name='xhci_vendor_get_ops' mangled-name='xhci_vendor_get_ops' filepath='drivers/usb/host/xhci.c' line='4318' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='xhci_vendor_get_ops'>
+        <parameter type-id='0c65b409' name='xhci' filepath='drivers/usb/host/xhci.c' line='4318' column='1'/>
         <return type-id='1e9ca7e3'/>
       </function-decl>
       <function-decl name='zlib_deflate' mangled-name='zlib_deflate' filepath='lib/zlib_deflate/deflate.c' line='329' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='zlib_deflate'>

From d570c48dd37dbe8fc6875d4461d01a9554ae2560 Mon Sep 17 00:00:00 2001
From: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Date: Mon, 28 Jun 2021 10:45:09 -0300
Subject: [PATCH 0611/1750] tty: Fix out-of-bound vmalloc access in imageblit

[ Upstream commit 3b0c406124719b625b1aba431659f5cdc24a982c ]

This issue happens when a userspace program does an ioctl
FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct
containing only the fields xres, yres, and bits_per_pixel
with values.

If this struct is the same as the previous ioctl, the
vc_resize() detects it and doesn't call the resize_screen(),
leaving the fb_var_screeninfo incomplete. And this leads to
the updatescrollmode() calculates a wrong value to
fbcon_display->vrows, which makes the real_y() return a
wrong value of y, and that value, eventually, causes
the imageblit to access an out-of-bound address value.

To solve this issue I made the resize_screen() be called
even if the screen does not need any resizing, so it will
"fix and fill" the fb_var_screeninfo independently.

Cc: stable <stable@vger.kernel.org> # after 5.15-rc2 is out, give it time to bake
Reported-and-tested-by: syzbot+858dc7a2f7ef07c2c219@syzkaller.appspotmail.com
Signed-off-by: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>
Link: https://lore.kernel.org/r/20210628134509.15895-1-igormtorrente@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/vt/vt.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
index cea40ef090b7..a7ee1171eeb3 100644
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -1220,8 +1220,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
 	new_row_size = new_cols << 1;
 	new_screen_size = new_row_size * new_rows;
 
-	if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
-		return 0;
+	if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) {
+		/*
+		 * This function is being called here to cover the case
+		 * where the userspace calls the FBIOPUT_VSCREENINFO twice,
+		 * passing the same fb_var_screeninfo containing the fields
+		 * yres/xres equal to a number non-multiple of vc_font.height
+		 * and yres_virtual/xres_virtual equal to number lesser than the
+		 * vc_font.height and yres/xres.
+		 * In the second call, the struct fb_var_screeninfo isn't
+		 * being modified by the underlying driver because of the
+		 * if above, and this causes the fbcon_display->vrows to become
+		 * negative and it eventually leads to out-of-bound
+		 * access by the imageblit function.
+		 * To give the correct values to the struct and to not have
+		 * to deal with possible errors from the code below, we call
+		 * the resize_screen here as well.
+		 */
+		return resize_screen(vc, new_cols, new_rows, user);
+	}
 
 	if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
 		return -EINVAL;

From a7d4fc84404d45d72f4490417e8cc3efa4af93f1 Mon Sep 17 00:00:00 2001
From: Kevin Hao <haokexin@gmail.com>
Date: Thu, 5 Aug 2021 15:29:17 +0800
Subject: [PATCH 0612/1750] cpufreq: schedutil: Use kobject release() method to
 free sugov_tunables

[ Upstream commit e5c6b312ce3cc97e90ea159446e6bfa06645364d ]

The struct sugov_tunables is protected by the kobject, so we can't free
it directly. Otherwise we would get a call trace like this:
  ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30
  WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100
  Modules linked in:
  CPU: 3 PID: 720 Comm: a.sh Tainted: G        W         5.14.0-rc1-next-20210715-yocto-standard+ #507
  Hardware name: Marvell OcteonTX CN96XX board (DT)
  pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--)
  pc : debug_print_object+0xb8/0x100
  lr : debug_print_object+0xb8/0x100
  sp : ffff80001ecaf910
  x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80
  x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000
  x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20
  x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010
  x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365
  x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69
  x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0
  x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001
  x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000
  x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000
  Call trace:
   debug_print_object+0xb8/0x100
   __debug_check_no_obj_freed+0x1c0/0x230
   debug_check_no_obj_freed+0x20/0x88
   slab_free_freelist_hook+0x154/0x1c8
   kfree+0x114/0x5d0
   sugov_exit+0xbc/0xc0
   cpufreq_exit_governor+0x44/0x90
   cpufreq_set_policy+0x268/0x4a8
   store_scaling_governor+0xe0/0x128
   store+0xc0/0xf0
   sysfs_kf_write+0x54/0x80
   kernfs_fop_write_iter+0x128/0x1c0
   new_sync_write+0xf0/0x190
   vfs_write+0x2d4/0x478
   ksys_write+0x74/0x100
   __arm64_sys_write+0x24/0x30
   invoke_syscall.constprop.0+0x54/0xe0
   do_el0_svc+0x64/0x158
   el0_svc+0x2c/0xb0
   el0t_64_sync_handler+0xb0/0xb8
   el0t_64_sync+0x198/0x19c
  irq event stamp: 5518
  hardirqs last  enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8
  hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0
  softirqs last  enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0
  softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8

So split the original sugov_tunables_free() into two functions,
sugov_clear_global_tunables() is just used to clear the global_tunables
and the new sugov_tunables_free() is used as kobj_type::release to
release the sugov_tunables safely.

Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/cpufreq_schedutil.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 97d318b0cd0c..5e39da0ae086 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -610,9 +610,17 @@ static struct attribute *sugov_attrs[] = {
 };
 ATTRIBUTE_GROUPS(sugov);
 
+static void sugov_tunables_free(struct kobject *kobj)
+{
+	struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj);
+
+	kfree(to_sugov_tunables(attr_set));
+}
+
 static struct kobj_type sugov_tunables_ktype = {
 	.default_groups = sugov_groups,
 	.sysfs_ops = &governor_sysfs_ops,
+	.release = &sugov_tunables_free,
 };
 
 /********************** cpufreq governor interface *********************/
@@ -712,12 +720,10 @@ static struct sugov_tunables *sugov_tunables_alloc(struct sugov_policy *sg_polic
 	return tunables;
 }
 
-static void sugov_tunables_free(struct sugov_tunables *tunables)
+static void sugov_clear_global_tunables(void)
 {
 	if (!have_governor_per_policy())
 		global_tunables = NULL;
-
-	kfree(tunables);
 }
 
 static int sugov_init(struct cpufreq_policy *policy)
@@ -780,7 +786,7 @@ static int sugov_init(struct cpufreq_policy *policy)
 fail:
 	kobject_put(&tunables->attr_set.kobj);
 	policy->governor_data = NULL;
-	sugov_tunables_free(tunables);
+	sugov_clear_global_tunables();
 
 stop_kthread:
 	sugov_kthread_stop(sg_policy);
@@ -807,7 +813,7 @@ static void sugov_exit(struct cpufreq_policy *policy)
 	count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook);
 	policy->governor_data = NULL;
 	if (!count)
-		sugov_tunables_free(tunables);
+		sugov_clear_global_tunables();
 
 	mutex_unlock(&global_tunables_lock);
 

From 2193cf76f43acdbd87b8609c7206f0b414b241d9 Mon Sep 17 00:00:00 2001
From: Saurav Kashyap <skashyap@marvell.com>
Date: Mon, 9 Aug 2021 21:37:18 -0700
Subject: [PATCH 0613/1750] scsi: qla2xxx: Changes to support kdump kernel for
 NVMe BFS

[ Upstream commit 4a0a542fe5e4273baf9228459ef3f75c29490cba ]

The MSI-X and MSI calls fails in kdump kernel. Because of this
qla2xxx_create_qpair() fails leading to .create_queue callback failure.
The fix is to return existing qpair instead of allocating new one and
allocate a single hw queue.

[   19.975838] qla2xxx [0000:d8:00.1]-00c7:11: MSI-X: Failed to enable support,
giving   up -- 16/-28.
[   19.984885] qla2xxx [0000:d8:00.1]-0037:11: Falling back-to MSI mode --
ret=-28.
[   19.992278] qla2xxx [0000:d8:00.1]-0039:11: Falling back-to INTa mode --
ret=-28.
..
..
..
[   21.141518] qla2xxx [0000:d8:00.0]-2104:2: qla_nvme_alloc_queue: handle
00000000e7ee499d, idx =1, qsize 32
[   21.151166] qla2xxx [0000:d8:00.0]-0181:2: FW/Driver is not multi-queue capable.
[   21.158558] qla2xxx [0000:d8:00.0]-2122:2: Failed to allocate qpair
[   21.164824] nvme nvme0: NVME-FC{0}: reset: Reconnect attempt failed (-22)
[   21.171612] nvme nvme0: NVME-FC{0}: Reconnect attempt in 2 seconds

Link: https://lore.kernel.org/r/20210810043720.1137-13-njavali@marvell.com
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_def.h  |  1 -
 drivers/scsi/qla2xxx/qla_isr.c  |  2 ++
 drivers/scsi/qla2xxx/qla_nvme.c | 40 +++++++++++++++------------------
 3 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 4f0486fe30dd..e1fd91a58120 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -3913,7 +3913,6 @@ struct qla_hw_data {
 		uint32_t	scm_supported_f:1;
 				/* Enabled in Driver */
 		uint32_t	scm_enabled:1;
-		uint32_t	max_req_queue_warned:1;
 		uint32_t	plogi_template_valid:1;
 	} flags;
 
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index a24b82de4aab..5e040b6debc8 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -4158,6 +4158,8 @@ qla2x00_request_irqs(struct qla_hw_data *ha, struct rsp_que *rsp)
 		ql_dbg(ql_dbg_init, vha, 0x0125,
 		    "INTa mode: Enabled.\n");
 		ha->flags.mr_intr_valid = 1;
+		/* Set max_qpair to 0, as MSI-X and MSI in not enabled */
+		ha->max_qpairs = 0;
 	}
 
 clear_risc_ints:
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index f6c76a063294..5acee3c798d4 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -109,19 +109,24 @@ static int qla_nvme_alloc_queue(struct nvme_fc_local_port *lport,
 		return -EINVAL;
 	}
 
-	if (ha->queue_pair_map[qidx]) {
-		*handle = ha->queue_pair_map[qidx];
-		ql_log(ql_log_info, vha, 0x2121,
-		    "Returning existing qpair of %p for idx=%x\n",
-		    *handle, qidx);
-		return 0;
-	}
+	/* Use base qpair if max_qpairs is 0 */
+	if (!ha->max_qpairs) {
+		qpair = ha->base_qpair;
+	} else {
+		if (ha->queue_pair_map[qidx]) {
+			*handle = ha->queue_pair_map[qidx];
+			ql_log(ql_log_info, vha, 0x2121,
+			       "Returning existing qpair of %p for idx=%x\n",
+			       *handle, qidx);
+			return 0;
+		}
 
-	qpair = qla2xxx_create_qpair(vha, 5, vha->vp_idx, true);
-	if (qpair == NULL) {
-		ql_log(ql_log_warn, vha, 0x2122,
-		    "Failed to allocate qpair\n");
-		return -EINVAL;
+		qpair = qla2xxx_create_qpair(vha, 5, vha->vp_idx, true);
+		if (!qpair) {
+			ql_log(ql_log_warn, vha, 0x2122,
+			       "Failed to allocate qpair\n");
+			return -EINVAL;
+		}
 	}
 	*handle = qpair;
 
@@ -715,18 +720,9 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)
 
 	WARN_ON(vha->nvme_local_port);
 
-	if (ha->max_req_queues < 3) {
-		if (!ha->flags.max_req_queue_warned)
-			ql_log(ql_log_info, vha, 0x2120,
-			       "%s: Disabling FC-NVME due to lack of free queue pairs (%d).\n",
-			       __func__, ha->max_req_queues);
-		ha->flags.max_req_queue_warned = 1;
-		return ret;
-	}
-
 	qla_nvme_fc_transport.max_hw_queues =
 	    min((uint8_t)(qla_nvme_fc_transport.max_hw_queues),
-		(uint8_t)(ha->max_req_queues - 2));
+		(uint8_t)(ha->max_qpairs ? ha->max_qpairs : 1));
 
 	pinfo.node_name = wwn_to_u64(vha->node_name);
 	pinfo.port_name = wwn_to_u64(vha->port_name);

From 3945c481360caee7d496c95b5c73afe923a1c7cd Mon Sep 17 00:00:00 2001
From: James Morse <james.morse@arm.com>
Date: Tue, 14 Sep 2021 16:56:23 +0000
Subject: [PATCH 0614/1750] cpufreq: schedutil: Destroy mutex before
 kobject_put() frees the memory

[ Upstream commit cdef1196608892b9a46caa5f2b64095a7f0be60c ]

Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release()
method to free sugov_tunables") kobject_put() has kfree()d the
attr_set before gov_attr_set_put() returns.

kobject_put() isn't the last user of attr_set in gov_attr_set_put(),
the subsequent mutex_destroy() triggers a use-after-free:
| BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60
| Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20
|
| CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369
| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development
| Platform, BIOS EDK II Jul 30 2018
| Call trace:
|  dump_backtrace+0x0/0x380
|  show_stack+0x1c/0x30
|  dump_stack_lvl+0x8c/0xb8
|  print_address_description.constprop.0+0x74/0x2b8
|  kasan_report+0x1f4/0x210
|  kasan_check_range+0xfc/0x1a4
|  __kasan_check_read+0x38/0x60
|  mutex_is_locked+0x20/0x60
|  mutex_destroy+0x80/0x100
|  gov_attr_set_put+0xfc/0x150
|  sugov_exit+0x78/0x190
|  cpufreq_offline.isra.0+0x2c0/0x660
|  cpuhp_cpufreq_offline+0x14/0x24
|  cpuhp_invoke_callback+0x430/0x6d0
|  cpuhp_thread_fun+0x1b0/0x624
|  smpboot_thread_fn+0x5e0/0xa6c
|  kthread+0x3a0/0x450
|  ret_from_fork+0x10/0x20

Swap the order of the calls.

Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
index 66b05a326910..a6f365b9cc1a 100644
--- a/drivers/cpufreq/cpufreq_governor_attr_set.c
+++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
@@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
 	if (count)
 		return count;
 
-	kobject_put(&attr_set->kobj);
 	mutex_destroy(&attr_set->update_lock);
+	kobject_put(&attr_set->kobj);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(gov_attr_set_put);

From 23115ca7d22718662418a79962551ad42033cbd3 Mon Sep 17 00:00:00 2001
From: Pawel Laszczak <pawell@cadence.com>
Date: Tue, 7 Sep 2021 08:26:19 +0200
Subject: [PATCH 0615/1750] usb: cdns3: fix race condition before setting
 doorbell

[ Upstream commit b69ec50b3e55c4b2a85c8bc46763eaf330605847 ]

For DEV_VER_V3 version there exist race condition between clearing
ep_sts.EP_STS_TRBERR and setting ep_cmd.EP_CMD_DRDY bit.
Setting EP_CMD_DRDY will be ignored by controller when
EP_STS_TRBERR is set. So, between these two instructions we have
a small time gap in which the EP_STSS_TRBERR can be set. In such case
the transfer will not start after setting doorbell.

Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
cc: <stable@vger.kernel.org> # 5.12.x
Tested-by: Aswath Govindraju <a-govindraju@ti.com>
Reviewed-by: Aswath Govindraju <a-govindraju@ti.com>
Signed-off-by: Pawel Laszczak <pawell@cadence.com>
Link: https://lore.kernel.org/r/20210907062619.34622-1-pawell@gli-login.cadence.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/cdns3/gadget.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
index 9d38f864cb68..e11162294413 100644
--- a/drivers/usb/cdns3/gadget.c
+++ b/drivers/usb/cdns3/gadget.c
@@ -1101,6 +1101,19 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep,
 	return 0;
 }
 
+static void cdns3_rearm_drdy_if_needed(struct cdns3_endpoint *priv_ep)
+{
+	struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
+
+	if (priv_dev->dev_ver < DEV_VER_V3)
+		return;
+
+	if (readl(&priv_dev->regs->ep_sts) & EP_STS_TRBERR) {
+		writel(EP_STS_TRBERR, &priv_dev->regs->ep_sts);
+		writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
+	}
+}
+
 /**
  * cdns3_ep_run_transfer - start transfer on no-default endpoint hardware
  * @priv_ep: endpoint object
@@ -1352,6 +1365,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,
 		/*clearing TRBERR and EP_STS_DESCMIS before seting DRDY*/
 		writel(EP_STS_TRBERR | EP_STS_DESCMIS, &priv_dev->regs->ep_sts);
 		writel(EP_CMD_DRDY, &priv_dev->regs->ep_cmd);
+		cdns3_rearm_drdy_if_needed(priv_ep);
 		trace_cdns3_doorbell_epx(priv_ep->name,
 					 readl(&priv_dev->regs->ep_traddr));
 	}

From e9edc7bc611a2c3b3079677abe97e7fa9db596ce Mon Sep 17 00:00:00 2001
From: Cameron Berkenpas <cam@neo-zeon.de>
Date: Mon, 13 Sep 2021 14:26:29 -0700
Subject: [PATCH 0616/1750] ALSA: hda/realtek: Quirks to enable speaker output
 for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.

commit ad7cc2d41b7a8d0c5c5ecff37c3de7a4e137b3a6 upstream.

This patch initializes and enables speaker output on the Lenovo Legion 7i
15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 series of laptops using the
HDA verb sequence specific to each model.

Speaker automute is suppressed for the Lenovo Legion 7i 15IMHG05 to avoid
breaking speaker output on resume and when devices are unplugged from its
headphone jack.

Thanks to: Andreas Holzer, Vincent Morel, sycxyc, Max Christian Pohle and
all others that helped.

[ minor coding style fixes by tiwai ]

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555
Signed-off-by: Cameron Berkenpas <cam@neo-zeon.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210913212627.339362-1-cam@neo-zeon.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 129 ++++++++++++++++++++++++++++++++++
 1 file changed, 129 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f47f639980db..9f37adb2b4d0 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6375,6 +6375,20 @@ static void alc_fixup_thinkpad_acpi(struct hda_codec *codec,
 	hda_fixup_thinkpad_acpi(codec, fix, action);
 }
 
+/* Fixup for Lenovo Legion 15IMHg05 speaker output on headset removal. */
+static void alc287_fixup_legion_15imhg05_speakers(struct hda_codec *codec,
+						  const struct hda_fixup *fix,
+						  int action)
+{
+	struct alc_spec *spec = codec->spec;
+
+	switch (action) {
+	case HDA_FIXUP_ACT_PRE_PROBE:
+		spec->gen.suppress_auto_mute = 1;
+		break;
+	}
+}
+
 /* for alc295_fixup_hp_top_speakers */
 #include "hp_x360_helper.c"
 
@@ -6591,6 +6605,10 @@ enum {
 	ALC623_FIXUP_LENOVO_THINKSTATION_P340,
 	ALC255_FIXUP_ACER_HEADPHONE_AND_MIC,
 	ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST,
+	ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS,
+	ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
+	ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
+	ALC287_FIXUP_13S_GEN2_SPEAKERS
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -8175,6 +8193,113 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
 	},
+	[ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS] = {
+		.type = HDA_FIXUP_VERBS,
+		//.v.verbs = legion_15imhg05_coefs,
+		.v.verbs = (const struct hda_verb[]) {
+			 // set left speaker Legion 7i.
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+
+			 // set right speaker Legion 7i.
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+			 {}
+		},
+		.chained = true,
+		.chain_id = ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
+	},
+	[ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc287_fixup_legion_15imhg05_speakers,
+		.chained = true,
+		.chain_id = ALC269_FIXUP_HEADSET_MODE,
+	},
+	[ALC287_FIXUP_YOGA7_14ITL_SPEAKERS] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			 // set left speaker Yoga 7i.
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x1a },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+
+			 // set right speaker Yoga 7i.
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x46 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xc },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x2a },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+
+			 { 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			 { 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+			 {}
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_HEADSET_MODE,
+	},
+	[ALC287_FIXUP_13S_GEN2_SPEAKERS] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x42 },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+			{}
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_HEADSET_MODE,
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8567,6 +8692,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x17aa, 0x3818, "Lenovo C940", ALC298_FIXUP_LENOVO_SPK_VOLUME),
 	SND_PCI_QUIRK(0x17aa, 0x3827, "Ideapad S740", ALC285_FIXUP_IDEAPAD_S740_COEF),
 	SND_PCI_QUIRK(0x17aa, 0x3843, "Yoga 9i", ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP),
+	SND_PCI_QUIRK(0x17aa, 0x3813, "Legion 7i 15IMHG05", ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS),
+	SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
+	SND_PCI_QUIRK(0x17aa, 0x3853, "Lenovo Yoga 7 15ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
+	SND_PCI_QUIRK(0x17aa, 0x3819, "Lenovo 13s Gen2 ITL", ALC287_FIXUP_13S_GEN2_SPEAKERS),
 	SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
 	SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),

From d1d0016e4a7d317c7680f63e61f717c066157b57 Mon Sep 17 00:00:00 2001
From: Jia He <justin.he@arm.com>
Date: Wed, 22 Sep 2021 23:29:19 +0800
Subject: [PATCH 0617/1750] ACPI: NFIT: Use fallback node id when numa info in
 NFIT table is incorrect

commit f060db99374e80e853ac4916b49f0a903f65e9dc upstream.

When ACPI NFIT table is failing to populate correct numa information
on arm64, dax_kmem will get NUMA_NO_NODE from the NFIT driver.

Without this patch, pmem can't be probed as RAM devices on arm64 guest:
  $ndctl create-namespace -fe namespace0.0 --mode=devdax --map=dev -s 1g -a 128M
  kmem dax0.0: rejecting DAX region [mem 0x240400000-0x2bfffffff] with invalid node: -1
  kmem: probe of dax0.0 failed with error -22

Suggested-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Jia He <justin.he@arm.com>
Cc: <stable@vger.kernel.org>
Fixes: c221c0b0308f ("device-dax: "Hotplug" persistent memory for use like normal RAM")
Link: https://lore.kernel.org/r/20210922152919.6940-1-justin.he@arm.com
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/nfit/core.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index d061bff5cc96..99e23a5df026 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -3018,6 +3018,18 @@ static int acpi_nfit_register_region(struct acpi_nfit_desc *acpi_desc,
 		ndr_desc->target_node = NUMA_NO_NODE;
 	}
 
+	/* Fallback to address based numa information if node lookup failed */
+	if (ndr_desc->numa_node == NUMA_NO_NODE) {
+		ndr_desc->numa_node = memory_add_physaddr_to_nid(spa->address);
+		dev_info(acpi_desc->dev, "changing numa node from %d to %d for nfit region [%pa-%pa]",
+			NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
+	}
+	if (ndr_desc->target_node == NUMA_NO_NODE) {
+		ndr_desc->target_node = phys_to_target_node(spa->address);
+		dev_info(acpi_desc->dev, "changing target node from %d to %d for nfit region [%pa-%pa]",
+			NUMA_NO_NODE, ndr_desc->numa_node, &res.start, &res.end);
+	}
+
 	/*
 	 * Persistence domain bits are hierarchical, if
 	 * ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then

From 23a6dfa10f0379509b334ee6db428488b7fbe0a0 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Thu, 16 Sep 2021 13:34:24 -0700
Subject: [PATCH 0618/1750] fs-verity: fix signed integer overflow with i_size
 near S64_MAX

commit 80f6e3080bfcf865062a926817b3ca6c4a137a57 upstream.

If the file size is almost S64_MAX, the calculated number of Merkle tree
levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to
fail.  This is unintentional, since as the comment above the definition
of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of
data using SHA-256 and 4K blocks.  (Specifically, 4096*128**8 >= 2**64.)

The bug is actually that when the number of blocks in the first level is
calculated from i_size, there is a signed integer overflow due to i_size
being signed.  Fix this by treating i_size as unsigned.

This was found by the new test "generic: test fs-verity EFBIG scenarios"
(https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io).

This didn't affect ext4 or f2fs since those have a smaller maximum file
size, but it did affect btrfs which allows files up to S64_MAX bytes.

Reported-by: Boris Burkov <boris@bur.io>
Fixes: 3fda4c617e84 ("fs-verity: implement FS_IOC_ENABLE_VERITY ioctl")
Fixes: fd2d1acfcadf ("fs-verity: add the hook for file ->open()")
Cc: <stable@vger.kernel.org> # v5.4+
Reviewed-by: Boris Burkov <boris@bur.io>
Link: https://lore.kernel.org/r/20210916203424.113376-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/verity/enable.c | 2 +-
 fs/verity/open.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/verity/enable.c b/fs/verity/enable.c
index 5ab3bbec8108..734862e608fd 100644
--- a/fs/verity/enable.c
+++ b/fs/verity/enable.c
@@ -177,7 +177,7 @@ static int build_merkle_tree(struct file *filp,
 	 * (level 0) and ascending to the root node (level 'num_levels - 1').
 	 * Then at the end (level 'num_levels'), calculate the root hash.
 	 */
-	blocks = (inode->i_size + params->block_size - 1) >>
+	blocks = ((u64)inode->i_size + params->block_size - 1) >>
 		 params->log_blocksize;
 	for (level = 0; level <= params->num_levels; level++) {
 		err = build_merkle_tree_level(filp, level, blocks, params,
diff --git a/fs/verity/open.c b/fs/verity/open.c
index bfe0280c14e4..67d71f7b1b48 100644
--- a/fs/verity/open.c
+++ b/fs/verity/open.c
@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params,
 	 */
 
 	/* Compute number of levels and the number of blocks in each level */
-	blocks = (inode->i_size + params->block_size - 1) >> log_blocksize;
+	blocks = ((u64)inode->i_size + params->block_size - 1) >> log_blocksize;
 	pr_debug("Data is %lld bytes (%llu blocks)\n", inode->i_size, blocks);
 	while (blocks > 1) {
 		if (params->num_levels >= FS_VERITY_MAX_LEVELS) {

From 196dabd96bbfd8b816aeeb9b7a59bd489ed0ac89 Mon Sep 17 00:00:00 2001
From: Paul Fertser <fercerpav@gmail.com>
Date: Fri, 24 Sep 2021 12:30:09 +0300
Subject: [PATCH 0619/1750] hwmon: (tmp421) handle I2C errors

commit 2938b2978a70d4cc10777ee71c9e512ffe4e0f4b upstream.

Function i2c_smbus_read_byte_data() can return a negative error number
instead of the data read if I2C transaction failed for whatever reason.

Lack of error checking can lead to serious issues on production
hardware, e.g. errors treated as temperatures produce spurious critical
temperature-crossed-threshold errors in BMC logs for OCP server
hardware. The patch was tested with Mellanox OCP Mezzanine card
emulating TMP421 protocol for temperature sensing which sometimes leads
to I2C protocol error during early boot up stage.

Fixes: 9410700b881f ("hwmon: Add driver for Texas Instruments TMP421/422/423 sensor chips")
Cc: stable@vger.kernel.org
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Link: https://lore.kernel.org/r/20210924093011.26083-1-fercerpav@gmail.com
[groeck: dropped unnecessary line breaks]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/tmp421.c | 38 ++++++++++++++++++++++++++++----------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
index ede66ea6a730..8fd8c3a94dfe 100644
--- a/drivers/hwmon/tmp421.c
+++ b/drivers/hwmon/tmp421.c
@@ -119,38 +119,56 @@ static int temp_from_u16(u16 reg)
 	return (temp * 1000 + 128) / 256;
 }
 
-static struct tmp421_data *tmp421_update_device(struct device *dev)
+static int tmp421_update_device(struct tmp421_data *data)
 {
-	struct tmp421_data *data = dev_get_drvdata(dev);
 	struct i2c_client *client = data->client;
+	int ret = 0;
 	int i;
 
 	mutex_lock(&data->update_lock);
 
 	if (time_after(jiffies, data->last_updated + (HZ / 2)) ||
 	    !data->valid) {
-		data->config = i2c_smbus_read_byte_data(client,
-			TMP421_CONFIG_REG_1);
+		ret = i2c_smbus_read_byte_data(client, TMP421_CONFIG_REG_1);
+		if (ret < 0)
+			goto exit;
+		data->config = ret;
 
 		for (i = 0; i < data->channels; i++) {
-			data->temp[i] = i2c_smbus_read_byte_data(client,
-				TMP421_TEMP_MSB[i]) << 8;
-			data->temp[i] |= i2c_smbus_read_byte_data(client,
-				TMP421_TEMP_LSB[i]);
+			ret = i2c_smbus_read_byte_data(client, TMP421_TEMP_MSB[i]);
+			if (ret < 0)
+				goto exit;
+			data->temp[i] = ret << 8;
+
+			ret = i2c_smbus_read_byte_data(client, TMP421_TEMP_LSB[i]);
+			if (ret < 0)
+				goto exit;
+			data->temp[i] |= ret;
 		}
 		data->last_updated = jiffies;
 		data->valid = 1;
 	}
 
+exit:
 	mutex_unlock(&data->update_lock);
 
-	return data;
+	if (ret < 0) {
+		data->valid = 0;
+		return ret;
+	}
+
+	return 0;
 }
 
 static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,
 		       u32 attr, int channel, long *val)
 {
-	struct tmp421_data *tmp421 = tmp421_update_device(dev);
+	struct tmp421_data *tmp421 = dev_get_drvdata(dev);
+	int ret = 0;
+
+	ret = tmp421_update_device(tmp421);
+	if (ret)
+		return ret;
 
 	switch (attr) {
 	case hwmon_temp_input:

From 7c4fd5de39f273626a2b0f3a446d2cc85cd47616 Mon Sep 17 00:00:00 2001
From: Nadezda Lutovinova <lutovinova@ispras.ru>
Date: Tue, 21 Sep 2021 18:51:53 +0300
Subject: [PATCH 0620/1750] hwmon: (w83793) Fix NULL pointer dereference by
 removing unnecessary structure field

commit dd4d747ef05addab887dc8ff0d6ab9860bbcd783 upstream.

If driver read tmp value sufficient for
(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().

The patch fixes possible NULL pointer dereference by removing lm75[].

Found by Linux Driver Verification project (linuxtesting.org).

Cc: stable@vger.kernel.org
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210921155153.28098-3-lutovinova@ispras.ru
[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/w83793.c | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/drivers/hwmon/w83793.c b/drivers/hwmon/w83793.c
index e7d0484eabe4..1d2854de1cfc 100644
--- a/drivers/hwmon/w83793.c
+++ b/drivers/hwmon/w83793.c
@@ -202,7 +202,6 @@ static inline s8 TEMP_TO_REG(long val, s8 min, s8 max)
 }
 
 struct w83793_data {
-	struct i2c_client *lm75[2];
 	struct device *hwmon_dev;
 	struct mutex update_lock;
 	char valid;			/* !=0 if following fields are valid */
@@ -1566,7 +1565,6 @@ w83793_detect_subclients(struct i2c_client *client)
 	int address = client->addr;
 	u8 tmp;
 	struct i2c_adapter *adapter = client->adapter;
-	struct w83793_data *data = i2c_get_clientdata(client);
 
 	id = i2c_adapter_id(adapter);
 	if (force_subclients[0] == id && force_subclients[1] == address) {
@@ -1586,21 +1584,19 @@ w83793_detect_subclients(struct i2c_client *client)
 	}
 
 	tmp = w83793_read_value(client, W83793_REG_I2C_SUBADDR);
-	if (!(tmp & 0x08))
-		data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
-							  0x48 + (tmp & 0x7));
-	if (!(tmp & 0x80)) {
-		if (!IS_ERR(data->lm75[0])
-		    && ((tmp & 0x7) == ((tmp >> 4) & 0x7))) {
-			dev_err(&client->dev,
-				"duplicate addresses 0x%x, "
-				"use force_subclients\n", data->lm75[0]->addr);
-			return -ENODEV;
-		}
-		data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
-							  0x48 + ((tmp >> 4) & 0x7));
+
+	if (!(tmp & 0x88) && (tmp & 0x7) == ((tmp >> 4) & 0x7)) {
+		dev_err(&client->dev,
+			"duplicate addresses 0x%x, use force_subclient\n", 0x48 + (tmp & 0x7));
+		return -ENODEV;
 	}
 
+	if (!(tmp & 0x08))
+		devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (tmp & 0x7));
+
+	if (!(tmp & 0x80))
+		devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((tmp >> 4) & 0x7));
+
 	return 0;
 }
 

From 1499bb2c3a87a2efea0065adab2bd66badee61c3 Mon Sep 17 00:00:00 2001
From: Nadezda Lutovinova <lutovinova@ispras.ru>
Date: Tue, 21 Sep 2021 18:51:52 +0300
Subject: [PATCH 0621/1750] hwmon: (w83792d) Fix NULL pointer dereference by
 removing unnecessary structure field

commit 0f36b88173f028e372668ae040ab1a496834d278 upstream.

If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().

The patch fixes possible NULL pointer dereference by removing lm75[].

Found by Linux Driver Verification project (linuxtesting.org).

Cc: stable@vger.kernel.org
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210921155153.28098-2-lutovinova@ispras.ru
[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/w83792d.c | 28 +++++++++++-----------------
 1 file changed, 11 insertions(+), 17 deletions(-)

diff --git a/drivers/hwmon/w83792d.c b/drivers/hwmon/w83792d.c
index abd5c3a722b9..1f175f381350 100644
--- a/drivers/hwmon/w83792d.c
+++ b/drivers/hwmon/w83792d.c
@@ -264,9 +264,6 @@ struct w83792d_data {
 	char valid;		/* !=0 if following fields are valid */
 	unsigned long last_updated;	/* In jiffies */
 
-	/* array of 2 pointers to subclients */
-	struct i2c_client *lm75[2];
-
 	u8 in[9];		/* Register value */
 	u8 in_max[9];		/* Register value */
 	u8 in_min[9];		/* Register value */
@@ -927,7 +924,6 @@ w83792d_detect_subclients(struct i2c_client *new_client)
 	int address = new_client->addr;
 	u8 val;
 	struct i2c_adapter *adapter = new_client->adapter;
-	struct w83792d_data *data = i2c_get_clientdata(new_client);
 
 	id = i2c_adapter_id(adapter);
 	if (force_subclients[0] == id && force_subclients[1] == address) {
@@ -946,21 +942,19 @@ w83792d_detect_subclients(struct i2c_client *new_client)
 	}
 
 	val = w83792d_read_value(new_client, W83792D_REG_I2C_SUBADDR);
-	if (!(val & 0x08))
-		data->lm75[0] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
-							  0x48 + (val & 0x7));
-	if (!(val & 0x80)) {
-		if (!IS_ERR(data->lm75[0]) &&
-			((val & 0x7) == ((val >> 4) & 0x7))) {
-			dev_err(&new_client->dev,
-				"duplicate addresses 0x%x, use force_subclient\n",
-				data->lm75[0]->addr);
-			return -ENODEV;
-		}
-		data->lm75[1] = devm_i2c_new_dummy_device(&new_client->dev, adapter,
-							  0x48 + ((val >> 4) & 0x7));
+
+	if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
+		dev_err(&new_client->dev,
+			"duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
+		return -ENODEV;
 	}
 
+	if (!(val & 0x08))
+		devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + (val & 0x7));
+
+	if (!(val & 0x80))
+		devm_i2c_new_dummy_device(&new_client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
+
 	return 0;
 }
 

From 516d9055039017a20a698103be2b556b4c976bb8 Mon Sep 17 00:00:00 2001
From: Nadezda Lutovinova <lutovinova@ispras.ru>
Date: Tue, 21 Sep 2021 18:51:51 +0300
Subject: [PATCH 0622/1750] hwmon: (w83791d) Fix NULL pointer dereference by
 removing unnecessary structure field

commit 943c15ac1b84d378da26bba41c83c67e16499ac4 upstream.

If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().

The patch fixes possible NULL pointer dereference by removing lm75[].

Found by Linux Driver Verification project (linuxtesting.org).

Cc: stable@vger.kernel.org
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210921155153.28098-1-lutovinova@ispras.ru
[groeck: Dropped unnecessary continuation lines, fixed multi-line alignment]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/w83791d.c | 29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 37b25a1474c4..3c1be2c11fdf 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -273,9 +273,6 @@ struct w83791d_data {
 	char valid;			/* !=0 if following fields are valid */
 	unsigned long last_updated;	/* In jiffies */
 
-	/* array of 2 pointers to subclients */
-	struct i2c_client *lm75[2];
-
 	/* volts */
 	u8 in[NUMBER_OF_VIN];		/* Register value */
 	u8 in_max[NUMBER_OF_VIN];	/* Register value */
@@ -1257,7 +1254,6 @@ static const struct attribute_group w83791d_group_fanpwm45 = {
 static int w83791d_detect_subclients(struct i2c_client *client)
 {
 	struct i2c_adapter *adapter = client->adapter;
-	struct w83791d_data *data = i2c_get_clientdata(client);
 	int address = client->addr;
 	int i, id;
 	u8 val;
@@ -1280,22 +1276,19 @@ static int w83791d_detect_subclients(struct i2c_client *client)
 	}
 
 	val = w83791d_read(client, W83791D_REG_I2C_SUBADDR);
-	if (!(val & 0x08))
-		data->lm75[0] = devm_i2c_new_dummy_device(&client->dev, adapter,
-							  0x48 + (val & 0x7));
-	if (!(val & 0x80)) {
-		if (!IS_ERR(data->lm75[0]) &&
-				((val & 0x7) == ((val >> 4) & 0x7))) {
-			dev_err(&client->dev,
-				"duplicate addresses 0x%x, "
-				"use force_subclient\n",
-				data->lm75[0]->addr);
-			return -ENODEV;
-		}
-		data->lm75[1] = devm_i2c_new_dummy_device(&client->dev, adapter,
-							  0x48 + ((val >> 4) & 0x7));
+
+	if (!(val & 0x88) && (val & 0x7) == ((val >> 4) & 0x7)) {
+		dev_err(&client->dev,
+			"duplicate addresses 0x%x, use force_subclient\n", 0x48 + (val & 0x7));
+		return -ENODEV;
 	}
 
+	if (!(val & 0x08))
+		devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + (val & 0x7));
+
+	if (!(val & 0x80))
+		devm_i2c_new_dummy_device(&client->dev, adapter, 0x48 + ((val >> 4) & 0x7));
+
 	return 0;
 }
 

From bd4e446a6947528f6ea7e0e7f19031a4389a4017 Mon Sep 17 00:00:00 2001
From: Andrey Gusakov <andrey.gusakov@cogentembedded.com>
Date: Thu, 23 Sep 2021 20:22:16 +0300
Subject: [PATCH 0623/1750] gpio: pca953x: do not ignore i2c errors

commit 540cffbab8b8e6c52a4121666ca18d6e94586ed2 upstream.

Per gpio_chip interface, error shall be proparated to the caller.

Attempt to silent diagnostics by returning zero (as written in the
comment) is plain wrong, because the zero return can be interpreted by
the caller as the gpio value.

Cc: stable@vger.kernel.org
Signed-off-by: Andrey Gusakov <andrey.gusakov@cogentembedded.com>
Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpio-pca953x.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 7cc7d137133a..3a3aeef1017f 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -467,15 +467,8 @@ static int pca953x_gpio_get_value(struct gpio_chip *gc, unsigned off)
 	mutex_lock(&chip->i2c_lock);
 	ret = regmap_read(chip->regmap, inreg, &reg_val);
 	mutex_unlock(&chip->i2c_lock);
-	if (ret < 0) {
-		/*
-		 * NOTE:
-		 * diagnostic already emitted; that's all we should
-		 * do unless gpio_*_value_cansleep() calls become different
-		 * from their nonsleeping siblings (and report faults).
-		 */
-		return 0;
-	}
+	if (ret < 0)
+		return ret;
 
 	return !!(reg_val & bit);
 }

From 201ba843fef53d7098ed30d359046938e3b50193 Mon Sep 17 00:00:00 2001
From: Jonathan Hsu <jonathan.hsu@mediatek.com>
Date: Fri, 24 Sep 2021 16:58:48 +0800
Subject: [PATCH 0624/1750] scsi: ufs: Fix illegal offset in UPIU event trace

commit e8c2da7e329ce004fee748b921e4c765dc2fa338 upstream.

Fix incorrect index for UTMRD reference in ufshcd_add_tm_upiu_trace().

Link: https://lore.kernel.org/r/20210924085848.25500-1-jonathan.hsu@mediatek.com
Fixes: 4b42d557a8ad ("scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs")
Cc: stable@vger.kernel.org
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jonathan Hsu <jonathan.hsu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/ufs/ufshcd.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 4dabd09400c6..3139d9df6f32 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -318,8 +318,7 @@ static void ufshcd_add_query_upiu_trace(struct ufs_hba *hba, unsigned int tag,
 static void ufshcd_add_tm_upiu_trace(struct ufs_hba *hba, unsigned int tag,
 		const char *str)
 {
-	int off = (int)tag - hba->nutrs;
-	struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[off];
+	struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[tag];
 
 	trace_ufshcd_upiu(dev_name(hba->dev), str, &descp->req_header,
 			&descp->input_param1);

From 57de2dcb18742dc2860861c9f496da7d42b67da0 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 27 Sep 2021 11:58:39 +0200
Subject: [PATCH 0625/1750] mac80211: fix use-after-free in CCMP/GCMP RX

commit 94513069eb549737bcfc3d988d6ed4da948a2de8 upstream.

When PN checking is done in mac80211, for fragmentation we need
to copy the PN to the RX struct so we can later use it to do a
comparison, since commit bf30ca922a0c ("mac80211: check defrag
PN against current frame").

Unfortunately, in that commit I used the 'hdr' variable without
it being necessarily valid, so use-after-free could occur if it
was necessary to reallocate (parts of) the frame.

Fix this by reloading the variable after the code that results
in the reallocations, if any.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.

Cc: stable@vger.kernel.org
Fixes: bf30ca922a0c ("mac80211: check defrag PN against current frame")
Link: https://lore.kernel.org/r/20210927115838.12b9ac6bb233.I1d066acd5408a662c3b6e828122cd314fcb28cdb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/mac80211/wpa.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index bca47fad5a16..4eed23e27610 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -520,6 +520,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx,
 			return RX_DROP_UNUSABLE;
 	}
 
+	/* reload hdr - skb might have been reallocated */
+	hdr = (void *)rx->skb->data;
+
 	data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len;
 	if (!rx->sta || data_len < 0)
 		return RX_DROP_UNUSABLE;
@@ -749,6 +752,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx)
 			return RX_DROP_UNUSABLE;
 	}
 
+	/* reload hdr - skb might have been reallocated */
+	hdr = (void *)rx->skb->data;
+
 	data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len;
 	if (!rx->sta || data_len < 0)
 		return RX_DROP_UNUSABLE;

From 782122ae7db0c4af199a0fdb4d03fcc1e2c7b734 Mon Sep 17 00:00:00 2001
From: Zelin Deng <zelin.deng@linux.alibaba.com>
Date: Wed, 29 Sep 2021 13:13:48 +0800
Subject: [PATCH 0626/1750] x86/kvmclock: Move this_cpu_pvti into kvmclock.h

commit ad9af930680bb396c87582edc172b3a7cf2a3fbf upstream.

There're other modules might use hv_clock_per_cpu variable like ptp_kvm,
so move it into kvmclock.h and export the symbol to make it visiable to
other modules.

Signed-off-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Cc: <stable@vger.kernel.org>
Message-Id: <1632892429-101194-2-git-send-email-zelin.deng@linux.alibaba.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/kvmclock.h | 14 ++++++++++++++
 arch/x86/kernel/kvmclock.c      | 13 ++-----------
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/arch/x86/include/asm/kvmclock.h b/arch/x86/include/asm/kvmclock.h
index eceea9299097..6c5765192102 100644
--- a/arch/x86/include/asm/kvmclock.h
+++ b/arch/x86/include/asm/kvmclock.h
@@ -2,6 +2,20 @@
 #ifndef _ASM_X86_KVM_CLOCK_H
 #define _ASM_X86_KVM_CLOCK_H
 
+#include <linux/percpu.h>
+
 extern struct clocksource kvm_clock;
 
+DECLARE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
+
+static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
+{
+	return &this_cpu_read(hv_clock_per_cpu)->pvti;
+}
+
+static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
+{
+	return this_cpu_read(hv_clock_per_cpu);
+}
+
 #endif /* _ASM_X86_KVM_CLOCK_H */
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index c4ac26333bc4..bb657e2e6c68 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -50,18 +50,9 @@ early_param("no-kvmclock-vsyscall", parse_no_kvmclock_vsyscall);
 static struct pvclock_vsyscall_time_info
 			hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE);
 static struct pvclock_wall_clock wall_clock __bss_decrypted;
-static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
 static struct pvclock_vsyscall_time_info *hvclock_mem;
-
-static inline struct pvclock_vcpu_time_info *this_cpu_pvti(void)
-{
-	return &this_cpu_read(hv_clock_per_cpu)->pvti;
-}
-
-static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock(void)
-{
-	return this_cpu_read(hv_clock_per_cpu);
-}
+DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);
+EXPORT_PER_CPU_SYMBOL_GPL(hv_clock_per_cpu);
 
 /*
  * The wallclock is the time of day when we booted. Since then, some time may

From bebabb76ad9acca8858e0371e102fb60d708e25b Mon Sep 17 00:00:00 2001
From: Vitaly Kuznetsov <vkuznets@redhat.com>
Date: Fri, 27 Aug 2021 11:25:14 +0200
Subject: [PATCH 0627/1750] KVM: x86: Fix stack-out-of-bounds memory access
 from ioapic_write_indirect()

commit 2f9b68f57c6278c322793a06063181deded0ad69 upstream.

KASAN reports the following issue:

 BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm]
 Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798

 CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G               X --------- ---
 Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020
 Call Trace:
  dump_stack+0xa5/0xe6
  print_address_description.constprop.0+0x18/0x130
  ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm]
  __kasan_report.cold+0x7f/0x114
  ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm]
  kasan_report+0x38/0x50
  kasan_check_range+0xf5/0x1d0
  kvm_make_vcpus_request_mask+0x174/0x440 [kvm]
  kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm]
  ? kvm_arch_exit+0x110/0x110 [kvm]
  ? sched_clock+0x5/0x10
  ioapic_write_indirect+0x59f/0x9e0 [kvm]
  ? static_obj+0xc0/0xc0
  ? __lock_acquired+0x1d2/0x8c0
  ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm]

The problem appears to be that 'vcpu_bitmap' is allocated as a single long
on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear
the lower 16 bits of it with bitmap_zero() for no particular reason (my
guess would be that 'bitmap' and 'vcpu_bitmap' variables in
kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed
16-bit long, the later should accommodate all possible vCPUs).

Fixes: 7ee30bc132c6 ("KVM: x86: deliver KVM IOAPIC scan request to target vCPUs")
Fixes: 9a2ae9f6b6bb ("KVM: x86: Zero the IOAPIC scan request dest vCPUs bitmap")
Reported-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210827092516.1027264-7-vkuznets@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/ioapic.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index ff005fe738a4..8c065da73f8e 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -319,8 +319,8 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
 	unsigned index;
 	bool mask_before, mask_after;
 	union kvm_ioapic_redirect_entry *e;
-	unsigned long vcpu_bitmap;
 	int old_remote_irr, old_delivery_status, old_dest_id, old_dest_mode;
+	DECLARE_BITMAP(vcpu_bitmap, KVM_MAX_VCPUS);
 
 	switch (ioapic->ioregsel) {
 	case IOAPIC_REG_VERSION:
@@ -384,9 +384,9 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
 			irq.shorthand = APIC_DEST_NOSHORT;
 			irq.dest_id = e->fields.dest_id;
 			irq.msi_redir_hint = false;
-			bitmap_zero(&vcpu_bitmap, 16);
+			bitmap_zero(vcpu_bitmap, KVM_MAX_VCPUS);
 			kvm_bitmap_or_dest_vcpus(ioapic->kvm, &irq,
-						 &vcpu_bitmap);
+						 vcpu_bitmap);
 			if (old_dest_mode != e->fields.dest_mode ||
 			    old_dest_id != e->fields.dest_id) {
 				/*
@@ -399,10 +399,10 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val)
 				    kvm_lapic_irq_dest_mode(
 					!!e->fields.dest_mode);
 				kvm_bitmap_or_dest_vcpus(ioapic->kvm, &irq,
-							 &vcpu_bitmap);
+							 vcpu_bitmap);
 			}
 			kvm_make_scan_ioapic_request_mask(ioapic->kvm,
-							  &vcpu_bitmap);
+							  vcpu_bitmap);
 		} else {
 			kvm_make_scan_ioapic_request(ioapic->kvm);
 		}

From 4ed671e6bc62325729311dbc75c6db52d10233a7 Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk@redhat.com>
Date: Tue, 14 Sep 2021 18:48:16 +0300
Subject: [PATCH 0628/1750] KVM: x86: nSVM: don't copy virt_ext from vmcb12

commit faf6b755629627f19feafa75b32e81cd7738f12d upstream.

These field correspond to features that we don't expose yet to L2

While currently there are no CVE worthy features in this field,
if AMD adds more features to this field, that could allow guest
escapes similar to CVE-2021-3653 and CVE-2021-3656.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20210914154825.104886-6-mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/svm/nested.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
index df17146e841f..f0946872f5e6 100644
--- a/arch/x86/kvm/svm/nested.c
+++ b/arch/x86/kvm/svm/nested.c
@@ -447,7 +447,6 @@ static void nested_prepare_vmcb_control(struct vcpu_svm *svm)
 		(svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) |
 		(svm->nested.hsave->control.int_ctl & int_ctl_vmcb01_bits);
 
-	svm->vmcb->control.virt_ext            = svm->nested.ctl.virt_ext;
 	svm->vmcb->control.int_vector          = svm->nested.ctl.int_vector;
 	svm->vmcb->control.int_state           = svm->nested.ctl.int_state;
 	svm->vmcb->control.event_inj           = svm->nested.ctl.event_inj;

From 3778511dfc5941b0ee99d1040faab5c69e51dfac Mon Sep 17 00:00:00 2001
From: Vitaly Kuznetsov <vkuznets@redhat.com>
Date: Tue, 7 Sep 2021 18:35:30 +0200
Subject: [PATCH 0629/1750] KVM: nVMX: Filter out all unsupported controls when
 eVMCS was activated

commit 8d68bad6d869fae8f4d50ab6423538dec7da72d1 upstream.

Windows Server 2022 with Hyper-V role enabled failed to boot on KVM when
enlightened VMCS is advertised. Debugging revealed there are two exposed
secondary controls it is not happy with: SECONDARY_EXEC_ENABLE_VMFUNC and
SECONDARY_EXEC_SHADOW_VMCS. These controls are known to be unsupported,
as there are no corresponding fields in eVMCSv1 (see the comment above
EVMCS1_UNSUPPORTED_2NDEXEC definition).

Previously, commit 31de3d2500e4 ("x86/kvm/hyper-v: move VMX controls
sanitization out of nested_enable_evmcs()") introduced the required
filtering mechanism for VMX MSRs but for some reason put only known
to be problematic (and not full EVMCS1_UNSUPPORTED_* lists) controls
there.

Note, Windows Server 2022 seems to have gained some sanity check for VMX
MSRs: it doesn't even try to launch a guest when there's something it
doesn't like, nested_evmcs_check_controls() mechanism can't catch the
problem.

Let's be bold this time and instead of playing whack-a-mole just filter out
all unsupported controls from VMX MSRs.

Fixes: 31de3d2500e4 ("x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs()")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Message-Id: <20210907163530.110066-1-vkuznets@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/evmcs.c | 12 +++++++++---
 arch/x86/kvm/vmx/vmx.c   |  9 +++++----
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kvm/vmx/evmcs.c b/arch/x86/kvm/vmx/evmcs.c
index f3199bb02f22..c0d6fee9225f 100644
--- a/arch/x86/kvm/vmx/evmcs.c
+++ b/arch/x86/kvm/vmx/evmcs.c
@@ -352,14 +352,20 @@ void nested_evmcs_filter_control_msr(u32 msr_index, u64 *pdata)
 	switch (msr_index) {
 	case MSR_IA32_VMX_EXIT_CTLS:
 	case MSR_IA32_VMX_TRUE_EXIT_CTLS:
-		ctl_high &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL;
+		ctl_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL;
 		break;
 	case MSR_IA32_VMX_ENTRY_CTLS:
 	case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
-		ctl_high &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL;
+		ctl_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL;
 		break;
 	case MSR_IA32_VMX_PROCBASED_CTLS2:
-		ctl_high &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES;
+		ctl_high &= ~EVMCS1_UNSUPPORTED_2NDEXEC;
+		break;
+	case MSR_IA32_VMX_PINBASED_CTLS:
+		ctl_high &= ~EVMCS1_UNSUPPORTED_PINCTRL;
+		break;
+	case MSR_IA32_VMX_VMFUNC:
+		ctl_low &= ~EVMCS1_UNSUPPORTED_VMFUNC;
 		break;
 	}
 
diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index fcd8bcb7e0ea..e0dba0037a85 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -1867,10 +1867,11 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 				    &msr_info->data))
 			return 1;
 		/*
-		 * Enlightened VMCS v1 doesn't have certain fields, but buggy
-		 * Hyper-V versions are still trying to use corresponding
-		 * features when they are exposed. Filter out the essential
-		 * minimum.
+		 * Enlightened VMCS v1 doesn't have certain VMCS fields but
+		 * instead of just ignoring the features, different Hyper-V
+		 * versions are either trying to use them and fail or do some
+		 * sanity checking and refuse to boot. Filter all unsupported
+		 * features out.
 		 */
 		if (!msr_info->host_initiated &&
 		    vmx->nested.enlightened_vmcs_enabled)

From 249e5e5a501ee69b26d55b68f863671396e62f7f Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Wed, 1 Sep 2021 13:30:26 -0700
Subject: [PATCH 0630/1750] KVM: rseq: Update rseq when processing
 NOTIFY_RESUME on xfer to KVM guest

commit 8646e53633f314e4d746a988240d3b951a92f94a upstream.

Invoke rseq's NOTIFY_RESUME handler when processing the flag prior to
transferring to a KVM guest, which is roughly equivalent to an exit to
userspace and processes many of the same pending actions.  While the task
cannot be in an rseq critical section as the KVM path is reachable only
by via ioctl(KVM_RUN), the side effects that apply to rseq outside of a
critical section still apply, e.g. the current CPU needs to be updated if
the task is migrated.

Clearing TIF_NOTIFY_RESUME without informing rseq can lead to segfaults
and other badness in userspace VMMs that use rseq in combination with KVM,
e.g. due to the CPU ID being stale after task migration.

Fixes: 72c3c0fe54a3 ("x86/kvm: Use generic xfer to guest work function")
Reported-by: Peter Foley <pefoley@google.com>
Bisected-by: Doug Evans <dje@google.com>
Acked-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210901203030.1292304-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[sean: Resolve benign conflict due to unrelated access_ok() check in 5.10]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/entry/kvm.c |  4 +++-
 kernel/rseq.c      | 13 ++++++++++---
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/kernel/entry/kvm.c b/kernel/entry/kvm.c
index b6678a5e3cf6..2a3139dab109 100644
--- a/kernel/entry/kvm.c
+++ b/kernel/entry/kvm.c
@@ -16,8 +16,10 @@ static int xfer_to_guest_mode_work(struct kvm_vcpu *vcpu, unsigned long ti_work)
 		if (ti_work & _TIF_NEED_RESCHED)
 			schedule();
 
-		if (ti_work & _TIF_NOTIFY_RESUME)
+		if (ti_work & _TIF_NOTIFY_RESUME) {
 			tracehook_notify_resume(NULL);
+			rseq_handle_notify_resume(NULL, NULL);
+		}
 
 		ret = arch_xfer_to_guest_mode_handle_work(vcpu, ti_work);
 		if (ret)
diff --git a/kernel/rseq.c b/kernel/rseq.c
index a4f86a9d6937..0077713bf240 100644
--- a/kernel/rseq.c
+++ b/kernel/rseq.c
@@ -268,9 +268,16 @@ void __rseq_handle_notify_resume(struct ksignal *ksig, struct pt_regs *regs)
 		return;
 	if (unlikely(!access_ok(t->rseq, sizeof(*t->rseq))))
 		goto error;
-	ret = rseq_ip_fixup(regs);
-	if (unlikely(ret < 0))
-		goto error;
+	/*
+	 * regs is NULL if and only if the caller is in a syscall path.  Skip
+	 * fixup and leave rseq_cs as is so that rseq_sycall() will detect and
+	 * kill a misbehaving userspace on debug kernels.
+	 */
+	if (regs) {
+		ret = rseq_ip_fixup(regs);
+		if (unlikely(ret < 0))
+			goto error;
+	}
 	if (unlikely(rseq_update_cpu_id(t)))
 		goto error;
 	return;

From 31a13f039e15e6e16d30081cd07a8bbb1d9526e3 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Tue, 14 Sep 2021 16:57:46 +0200
Subject: [PATCH 0631/1750] media: ir_toy: prevent device from hanging during
 transmit

commit f0c15b360fb65ee39849afe987c16eb3d0175d0d upstream.

If the IR Toy is receiving IR while a transmit is done, it may end up
hanging. We can prevent this from happening by re-entering sample mode
just before issuing the transmit command.

Link: https://github.com/bengtmartensson/HarcHardware/discussions/25

Cc: stable@vger.kernel.org
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/ir_toy.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
index 3e729a17b35f..48d52baec1a1 100644
--- a/drivers/media/rc/ir_toy.c
+++ b/drivers/media/rc/ir_toy.c
@@ -24,6 +24,7 @@ static const u8 COMMAND_VERSION[] = { 'v' };
 // End transmit and repeat reset command so we exit sump mode
 static const u8 COMMAND_RESET[] = { 0xff, 0xff, 0, 0, 0, 0, 0 };
 static const u8 COMMAND_SMODE_ENTER[] = { 's' };
+static const u8 COMMAND_SMODE_EXIT[] = { 0 };
 static const u8 COMMAND_TXSTART[] = { 0x26, 0x24, 0x25, 0x03 };
 
 #define REPLY_XMITCOUNT 't'
@@ -309,12 +310,30 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count)
 		buf[i] = cpu_to_be16(v);
 	}
 
-	buf[count] = cpu_to_be16(0xffff);
+	buf[count] = 0xffff;
 
 	irtoy->tx_buf = buf;
 	irtoy->tx_len = size;
 	irtoy->emitted = 0;
 
+	// There is an issue where if the unit is receiving IR while the
+	// first TXSTART command is sent, the device might end up hanging
+	// with its led on. It does not respond to any command when this
+	// happens. To work around this, re-enter sample mode.
+	err = irtoy_command(irtoy, COMMAND_SMODE_EXIT,
+			    sizeof(COMMAND_SMODE_EXIT), STATE_RESET);
+	if (err) {
+		dev_err(irtoy->dev, "exit sample mode: %d\n", err);
+		return err;
+	}
+
+	err = irtoy_command(irtoy, COMMAND_SMODE_ENTER,
+			    sizeof(COMMAND_SMODE_ENTER), STATE_COMMAND);
+	if (err) {
+		dev_err(irtoy->dev, "enter sample mode: %d\n", err);
+		return err;
+	}
+
 	err = irtoy_command(irtoy, COMMAND_TXSTART, sizeof(COMMAND_TXSTART),
 			    STATE_TX);
 	kfree(buf);

From 0a16c9751e0f1de96f08643216cf1f19e8a5a787 Mon Sep 17 00:00:00 2001
From: Jason Gunthorpe <jgg@nvidia.com>
Date: Wed, 15 Sep 2021 17:21:43 -0300
Subject: [PATCH 0632/1750] RDMA/cma: Do not change
 route.addr.src_addr.ss_family

commit bc0bdc5afaa740d782fbf936aaeebd65e5c2921d upstream.

If the state is not idle then rdma_bind_addr() will immediately fail and
no change to global state should happen.

For instance if the state is already RDMA_CM_LISTEN then this will corrupt
the src_addr and would cause the test in cma_cancel_operation():

		if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev)

To view a mangled src_addr, eg with a IPv6 loopback address but an IPv4
family, failing the test.

This would manifest as this trace from syzkaller:

  BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26
  Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204

  CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  Call Trace:
   __dump_stack lib/dump_stack.c:79 [inline]
   dump_stack+0x141/0x1d7 lib/dump_stack.c:120
   print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232
   __kasan_report mm/kasan/report.c:399 [inline]
   kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
   __list_add_valid+0x93/0xa0 lib/list_debug.c:26
   __list_add include/linux/list.h:67 [inline]
   list_add_tail include/linux/list.h:100 [inline]
   cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline]
   rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751
   ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102
   ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732
   vfs_write+0x28e/0xa30 fs/read_write.c:603
   ksys_write+0x1ee/0x250 fs/read_write.c:658
   do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
   entry_SYSCALL_64_after_hwframe+0x44/0xae

Which is indicating that an rdma_id_private was destroyed without doing
cma_cancel_listens().

Instead of trying to re-use the src_addr memory to indirectly create an
any address build one explicitly on the stack and bind to that as any
other normal flow would do.

Link: https://lore.kernel.org/r/0-v1-9fbb33f5e201+2a-cma_listen_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transition more clear")
Reported-by: syzbot+6bb0528b13611047209c@syzkaller.appspotmail.com
Tested-by: Hao Sun <sunhao.th@gmail.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/core/cma.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 34b94e525390..a4962b499b61 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3732,9 +3732,13 @@ int rdma_listen(struct rdma_cm_id *id, int backlog)
 	int ret;
 
 	if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_LISTEN)) {
+		struct sockaddr_in any_in = {
+			.sin_family = AF_INET,
+			.sin_addr.s_addr = htonl(INADDR_ANY),
+		};
+
 		/* For a well behaved ULP state will be RDMA_CM_IDLE */
-		id->route.addr.src_addr.ss_family = AF_INET;
-		ret = rdma_bind_addr(id, cma_src_addr(id_priv));
+		ret = rdma_bind_addr(id, (struct sockaddr *)&any_in);
 		if (ret)
 			return ret;
 		if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,

From c331fad63b6d527193ae8b7c056b2f10fef53c81 Mon Sep 17 00:00:00 2001
From: Charlene Liu <Charlene.Liu@amd.com>
Date: Mon, 20 Sep 2021 14:30:02 -0400
Subject: [PATCH 0633/1750] drm/amd/display: Pass PCI deviceid into DC

commit d942856865c733ff60450de9691af796ad71d7bc upstream.

[why]
pci deviceid not passed to dal dc, without proper break,
dcn2.x falls into dcn3.x code path

[how]
pass in pci deviceid, and break once dal_version initialized.

Reviewed-by: Zhan Liu <Zhan.Liu@amd.com>
Acked-by: Anson Jacob <Anson.Jacob@amd.com>
Signed-off-by: Charlene Liu <Charlene.Liu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index ce21a21ddb23..d9525fbedad2 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -951,6 +951,7 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)
 
 	init_data.asic_id.pci_revision_id = adev->pdev->revision;
 	init_data.asic_id.hw_internal_rev = adev->external_rev_id;
+	init_data.asic_id.chip_id = adev->pdev->device;
 
 	init_data.asic_id.vram_width = adev->gmc.vram_width;
 	/* TODO: initialize init_data.asic_id.vram_type here!!!! */

From 9f382e1edf90ae03be43dbd4976c2a332cd7ce2d Mon Sep 17 00:00:00 2001
From: Hawking Zhang <Hawking.Zhang@amd.com>
Date: Sun, 26 Sep 2021 22:19:35 +0800
Subject: [PATCH 0634/1750] drm/amdgpu: correct initial cp_hqd_quantum for gfx9

commit 9f52c25f59b504a29dda42d83ac1e24d2af535d4 upstream.

didn't read the value of mmCP_HQD_QUANTUM from correct
register offset

Signed-off-by: Hawking Zhang <Hawking.Zhang@amd.com>
Reviewed-by: Le Ma <Le.Ma@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
index ac3a88197b2f..c7d6a677d86d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -3542,7 +3542,7 @@ static int gfx_v9_0_mqd_init(struct amdgpu_ring *ring)
 
 	/* set static priority for a queue/ring */
 	gfx_v9_0_mqd_set_priority(ring, mqd);
-	mqd->cp_hqd_quantum = RREG32(mmCP_HQD_QUANTUM);
+	mqd->cp_hqd_quantum = RREG32_SOC15(GC, 0, mmCP_HQD_QUANTUM);
 
 	/* map_queues packet doesn't need activate the queue,
 	 * so only kiq need set this field.

From 12cbdaeeb5d4dfde7a8c2f9eed93bcfa4f4653cd Mon Sep 17 00:00:00 2001
From: Andrea Claudi <aclaudi@redhat.com>
Date: Fri, 10 Sep 2021 18:08:39 +0200
Subject: [PATCH 0635/1750] ipvs: check that ip_vs_conn_tab_bits is between 8
 and 20

[ Upstream commit 69e73dbfda14fbfe748d3812da1244cce2928dcb ]

ip_vs_conn_tab_bits may be provided by the user through the
conn_tab_bits module parameter. If this value is greater than 31, or
less than 0, the shift operator used to derive tab_size causes undefined
behaviour.

Fix this checking ip_vs_conn_tab_bits value to be in the range specified
in ipvs Kconfig. If not, simply use default value.

Fixes: 6f7edb4881bf ("IPVS: Allow boot time change of hash size")
Reported-by: Yi Chen <yiche@redhat.com>
Signed-off-by: Andrea Claudi <aclaudi@redhat.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipvs/ip_vs_conn.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index c100c6b112c8..2c467c422dc6 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -1468,6 +1468,10 @@ int __init ip_vs_conn_init(void)
 	int idx;
 
 	/* Compute size and mask */
+	if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) {
+		pr_info("conn_tab_bits not in [8, 20]. Using default value\n");
+		ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS;
+	}
 	ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits;
 	ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1;
 

From d93f65586c59a555dc4ef2fe365d32457bef0fde Mon Sep 17 00:00:00 2001
From: Hou Tao <houtao1@huawei.com>
Date: Tue, 14 Sep 2021 10:33:51 +0800
Subject: [PATCH 0636/1750] bpf: Handle return value of
 BPF_PROG_TYPE_STRUCT_OPS prog

[ Upstream commit 356ed64991c6847a0c4f2e8fa3b1133f7a14f1fc ]

Currently if a function ptr in struct_ops has a return value, its
caller will get a random return value from it, because the return
value of related BPF_PROG_TYPE_STRUCT_OPS prog is just dropped.

So adding a new flag BPF_TRAMP_F_RET_FENTRY_RET to tell bpf trampoline
to save and return the return value of struct_ops prog if ret_size of
the function ptr is greater than 0. Also restricting the flag to be
used alone.

Fixes: 85d33df357b6 ("bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS")
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210914023351.3664499-1-houtao1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/net/bpf_jit_comp.c | 53 ++++++++++++++++++++++++++++---------
 include/linux/bpf.h         |  2 ++
 kernel/bpf/bpf_struct_ops.c |  7 +++--
 3 files changed, 47 insertions(+), 15 deletions(-)

diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 0a962cd6bac1..a0a7ead52698 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -1547,7 +1547,7 @@ static void restore_regs(const struct btf_func_model *m, u8 **prog, int nr_args,
 }
 
 static int invoke_bpf_prog(const struct btf_func_model *m, u8 **pprog,
-			   struct bpf_prog *p, int stack_size, bool mod_ret)
+			   struct bpf_prog *p, int stack_size, bool save_ret)
 {
 	u8 *prog = *pprog;
 	int cnt = 0;
@@ -1573,11 +1573,15 @@ static int invoke_bpf_prog(const struct btf_func_model *m, u8 **pprog,
 	if (emit_call(&prog, p->bpf_func, prog))
 		return -EINVAL;
 
-	/* BPF_TRAMP_MODIFY_RETURN trampolines can modify the return
+	/*
+	 * BPF_TRAMP_MODIFY_RETURN trampolines can modify the return
 	 * of the previous call which is then passed on the stack to
 	 * the next BPF program.
+	 *
+	 * BPF_TRAMP_FENTRY trampoline may need to return the return
+	 * value of BPF_PROG_TYPE_STRUCT_OPS prog.
 	 */
-	if (mod_ret)
+	if (save_ret)
 		emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -8);
 
 	if (p->aux->sleepable) {
@@ -1645,13 +1649,15 @@ static int emit_cond_near_jump(u8 **pprog, void *func, void *ip, u8 jmp_cond)
 }
 
 static int invoke_bpf(const struct btf_func_model *m, u8 **pprog,
-		      struct bpf_tramp_progs *tp, int stack_size)
+		      struct bpf_tramp_progs *tp, int stack_size,
+		      bool save_ret)
 {
 	int i;
 	u8 *prog = *pprog;
 
 	for (i = 0; i < tp->nr_progs; i++) {
-		if (invoke_bpf_prog(m, &prog, tp->progs[i], stack_size, false))
+		if (invoke_bpf_prog(m, &prog, tp->progs[i], stack_size,
+				    save_ret))
 			return -EINVAL;
 	}
 	*pprog = prog;
@@ -1694,6 +1700,23 @@ static int invoke_bpf_mod_ret(const struct btf_func_model *m, u8 **pprog,
 	return 0;
 }
 
+static bool is_valid_bpf_tramp_flags(unsigned int flags)
+{
+	if ((flags & BPF_TRAMP_F_RESTORE_REGS) &&
+	    (flags & BPF_TRAMP_F_SKIP_FRAME))
+		return false;
+
+	/*
+	 * BPF_TRAMP_F_RET_FENTRY_RET is only used by bpf_struct_ops,
+	 * and it must be used alone.
+	 */
+	if ((flags & BPF_TRAMP_F_RET_FENTRY_RET) &&
+	    (flags & ~BPF_TRAMP_F_RET_FENTRY_RET))
+		return false;
+
+	return true;
+}
+
 /* Example:
  * __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev);
  * its 'struct btf_func_model' will be nr_args=2
@@ -1766,17 +1789,19 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i
 	struct bpf_tramp_progs *fmod_ret = &tprogs[BPF_TRAMP_MODIFY_RETURN];
 	u8 **branches = NULL;
 	u8 *prog;
+	bool save_ret;
 
 	/* x86-64 supports up to 6 arguments. 7+ can be added in the future */
 	if (nr_args > 6)
 		return -ENOTSUPP;
 
-	if ((flags & BPF_TRAMP_F_RESTORE_REGS) &&
-	    (flags & BPF_TRAMP_F_SKIP_FRAME))
+	if (!is_valid_bpf_tramp_flags(flags))
 		return -EINVAL;
 
-	if (flags & BPF_TRAMP_F_CALL_ORIG)
-		stack_size += 8; /* room for return value of orig_call */
+	/* room for return value of orig_call or fentry prog */
+	save_ret = flags & (BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_RET_FENTRY_RET);
+	if (save_ret)
+		stack_size += 8;
 
 	if (flags & BPF_TRAMP_F_SKIP_FRAME)
 		/* skip patched call instruction and point orig_call to actual
@@ -1803,7 +1828,8 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i
 	}
 
 	if (fentry->nr_progs)
-		if (invoke_bpf(m, &prog, fentry, stack_size))
+		if (invoke_bpf(m, &prog, fentry, stack_size,
+			       flags & BPF_TRAMP_F_RET_FENTRY_RET))
 			return -EINVAL;
 
 	if (fmod_ret->nr_progs) {
@@ -1850,7 +1876,7 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i
 	}
 
 	if (fexit->nr_progs)
-		if (invoke_bpf(m, &prog, fexit, stack_size)) {
+		if (invoke_bpf(m, &prog, fexit, stack_size, false)) {
 			ret = -EINVAL;
 			goto cleanup;
 		}
@@ -1870,9 +1896,10 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i
 			ret = -EINVAL;
 			goto cleanup;
 		}
-		/* restore original return value back into RAX */
-		emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, -8);
 	}
+	/* restore return value of orig_call or fentry prog back into RAX */
+	if (save_ret)
+		emit_ldx(&prog, BPF_DW, BPF_REG_0, BPF_REG_FP, -8);
 
 	EMIT1(0x5B); /* pop rbx */
 	EMIT1(0xC9); /* leave */
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 3f93a50c25ef..0caa448f7b40 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -526,6 +526,8 @@ struct btf_func_model {
  * programs only. Should not be used with normal calls and indirect calls.
  */
 #define BPF_TRAMP_F_SKIP_FRAME		BIT(2)
+/* Return the return value of fentry prog. Only used by bpf_struct_ops. */
+#define BPF_TRAMP_F_RET_FENTRY_RET	BIT(4)
 
 /* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50
  * bytes on x86.  Pick a number to fit into BPF_IMAGE_SIZE / 2
diff --git a/kernel/bpf/bpf_struct_ops.c b/kernel/bpf/bpf_struct_ops.c
index f527063864b5..ac283f9b2332 100644
--- a/kernel/bpf/bpf_struct_ops.c
+++ b/kernel/bpf/bpf_struct_ops.c
@@ -367,6 +367,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,
 		const struct btf_type *mtype, *ptype;
 		struct bpf_prog *prog;
 		u32 moff;
+		u32 flags;
 
 		moff = btf_member_bit_offset(t, member) / 8;
 		ptype = btf_type_resolve_ptr(btf_vmlinux, member->type, NULL);
@@ -430,10 +431,12 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,
 
 		tprogs[BPF_TRAMP_FENTRY].progs[0] = prog;
 		tprogs[BPF_TRAMP_FENTRY].nr_progs = 1;
+		flags = st_ops->func_models[i].ret_size > 0 ?
+			BPF_TRAMP_F_RET_FENTRY_RET : 0;
 		err = arch_prepare_bpf_trampoline(NULL, image,
 						  st_map->image + PAGE_SIZE,
-						  &st_ops->func_models[i], 0,
-						  tprogs, NULL);
+						  &st_ops->func_models[i],
+						  flags, tprogs, NULL);
 		if (err < 0)
 			goto reset_unlock;
 

From 62ba3c50104b405b522bf539eebf70cf0dce8fcd Mon Sep 17 00:00:00 2001
From: Christoph Lameter <cl@gentwo.de>
Date: Wed, 8 Sep 2021 13:43:28 +0200
Subject: [PATCH 0637/1750] IB/cma: Do not send IGMP leaves for sendonly
 Multicast groups

[ Upstream commit 2cc74e1ee31d00393b6698ec80b322fd26523da4 ]

ROCE uses IGMP for Multicast instead of the native Infiniband system where
joins are required in order to post messages on the Multicast group.  On
Ethernet one can send Multicast messages to arbitrary addresses without
the need to subscribe to a group.

So ROCE correctly does not send IGMP joins during rdma_join_multicast().

F.e. in cma_iboe_join_multicast() we see:

   if (addr->sa_family == AF_INET) {
                if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) {
                        ib.rec.hop_limit = IPV6_DEFAULT_HOPLIMIT;
                        if (!send_only) {
                                err = cma_igmp_send(ndev, &ib.rec.mgid,
                                                    true);
                        }
                }
        } else {

So the IGMP join is suppressed as it is unnecessary.

However no such check is done in destroy_mc(). And therefore leaving a
sendonly multicast group will send an IGMP leave.

This means that the following scenario can lead to a multicast receiver
unexpectedly being unsubscribed from a MC group:

1. Sender thread does a sendonly join on MC group X. No IGMP join
   is sent.

2. Receiver thread does a regular join on the same MC Group x.
   IGMP join is sent and the receiver begins to get messages.

3. Sender thread terminates and destroys MC group X.
   IGMP leave is sent and the receiver no longer receives data.

This patch adds the same logic for sendonly joins to destroy_mc() that is
also used in cma_iboe_join_multicast().

Fixes: ab15c95a17b3 ("IB/core: Support for CMA multicast join flags")
Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2109081340540.668072@gentwo.de
Signed-off-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index a4962b499b61..3029e96161b5 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1814,6 +1814,8 @@ static void cma_release_port(struct rdma_id_private *id_priv)
 static void destroy_mc(struct rdma_id_private *id_priv,
 		       struct cma_multicast *mc)
 {
+	bool send_only = mc->join_state == BIT(SENDONLY_FULLMEMBER_JOIN);
+
 	if (rdma_cap_ib_mcast(id_priv->id.device, id_priv->id.port_num))
 		ib_sa_free_multicast(mc->sa_mc);
 
@@ -1830,7 +1832,10 @@ static void destroy_mc(struct rdma_id_private *id_priv,
 
 			cma_set_mgid(id_priv, (struct sockaddr *)&mc->addr,
 				     &mgid);
-			cma_igmp_send(ndev, &mgid, false);
+
+			if (!send_only)
+				cma_igmp_send(ndev, &mgid, false);
+
 			dev_put(ndev);
 		}
 

From 3f4e68902d2e545033c80d7ad62fd9a439e573f4 Mon Sep 17 00:00:00 2001
From: Tao Liu <thomas.liu@ucloud.cn>
Date: Mon, 13 Sep 2021 17:33:44 +0800
Subject: [PATCH 0638/1750] RDMA/cma: Fix listener leak in
 rdma_cma_listen_on_all() failure

[ Upstream commit ca465e1f1f9b38fe916a36f7d80c5d25f2337c81 ]

If cma_listen_on_all() fails it leaves the per-device ID still on the
listen_list but the state is not set to RDMA_CM_ADDR_BOUND.

When the cmid is eventually destroyed cma_cancel_listens() is not called
due to the wrong state, however the per-device IDs are still holding the
refcount preventing the ID from being destroyed, thus deadlocking:

 task:rping state:D stack:   0 pid:19605 ppid: 47036 flags:0x00000084
 Call Trace:
  __schedule+0x29a/0x780
  ? free_unref_page_commit+0x9b/0x110
  schedule+0x3c/0xa0
  schedule_timeout+0x215/0x2b0
  ? __flush_work+0x19e/0x1e0
  wait_for_completion+0x8d/0xf0
  _destroy_id+0x144/0x210 [rdma_cm]
  ucma_close_id+0x2b/0x40 [rdma_ucm]
  __destroy_id+0x93/0x2c0 [rdma_ucm]
  ? __xa_erase+0x4a/0xa0
  ucma_destroy_id+0x9a/0x120 [rdma_ucm]
  ucma_write+0xb8/0x130 [rdma_ucm]
  vfs_write+0xb4/0x250
  ksys_write+0xb5/0xd0
  ? syscall_trace_enter.isra.19+0x123/0x190
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Ensure that cma_listen_on_all() atomically unwinds its action under the
lock during error.

Fixes: c80a0c52d85c ("RDMA/cma: Add missing error handling of listen_id")
Link: https://lore.kernel.org/r/20210913093344.17230-1-thomas.liu@ucloud.cn
Signed-off-by: Tao Liu <thomas.liu@ucloud.cn>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/core/cma.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 3029e96161b5..8e54184566f7 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1750,15 +1750,16 @@ static void cma_cancel_route(struct rdma_id_private *id_priv)
 	}
 }
 
-static void cma_cancel_listens(struct rdma_id_private *id_priv)
+static void _cma_cancel_listens(struct rdma_id_private *id_priv)
 {
 	struct rdma_id_private *dev_id_priv;
 
+	lockdep_assert_held(&lock);
+
 	/*
 	 * Remove from listen_any_list to prevent added devices from spawning
 	 * additional listen requests.
 	 */
-	mutex_lock(&lock);
 	list_del(&id_priv->list);
 
 	while (!list_empty(&id_priv->listen_list)) {
@@ -1772,6 +1773,12 @@ static void cma_cancel_listens(struct rdma_id_private *id_priv)
 		rdma_destroy_id(&dev_id_priv->id);
 		mutex_lock(&lock);
 	}
+}
+
+static void cma_cancel_listens(struct rdma_id_private *id_priv)
+{
+	mutex_lock(&lock);
+	_cma_cancel_listens(id_priv);
 	mutex_unlock(&lock);
 }
 
@@ -2582,7 +2589,7 @@ static int cma_listen_on_all(struct rdma_id_private *id_priv)
 	return 0;
 
 err_listen:
-	list_del(&id_priv->list);
+	_cma_cancel_listens(id_priv);
 	mutex_unlock(&lock);
 	if (to_destroy)
 		rdma_destroy_id(&to_destroy->id);

From c61736a994fe68b0e5498e4e84e1c9108dc41075 Mon Sep 17 00:00:00 2001
From: Piotr Krysiuk <piotras@gmail.com>
Date: Wed, 15 Sep 2021 17:04:37 +0100
Subject: [PATCH 0639/1750] bpf, mips: Validate conditional branch offsets

[ Upstream commit 37cb28ec7d3a36a5bace7063a3dba633ab110f8b ]

The conditional branch instructions on MIPS use 18-bit signed offsets
allowing for a branch range of 128 KBytes (backward and forward).
However, this limit is not observed by the cBPF JIT compiler, and so
the JIT compiler emits out-of-range branches when translating certain
cBPF programs. A specific example of such a cBPF program is included in
the "BPF_MAXINSNS: exec all MSH" test from lib/test_bpf.c that executes
anomalous machine code containing incorrect branch offsets under JIT.

Furthermore, this issue can be abused to craft undesirable machine
code, where the control flow is hijacked to execute arbitrary Kernel
code.

The following steps can be used to reproduce the issue:

  # echo 1 > /proc/sys/net/core/bpf_jit_enable
  # modprobe test_bpf test_name="BPF_MAXINSNS: exec all MSH"

This should produce multiple warnings from build_bimm() similar to:

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 209 at arch/mips/mm/uasm-mips.c:210 build_insn+0x558/0x590
  Micro-assembler field overflow
  Modules linked in: test_bpf(+)
  CPU: 0 PID: 209 Comm: modprobe Not tainted 5.14.3 #1
  Stack : 00000000 807bb824 82b33c9c 801843c0 00000000 00000004 00000000 63c9b5ee
          82b33af4 80999898 80910000 80900000 82fd6030 00000001 82b33a98 82087180
          00000000 00000000 80873b28 00000000 000000fc 82b3394c 00000000 2e34312e
          6d6d6f43 809a180f 809a1836 6f6d203a 80900000 00000001 82b33bac 80900000
          00027f80 00000000 00000000 807bb824 00000000 804ed790 001cc317 00000001
  [...]
  Call Trace:
  [<80108f44>] show_stack+0x38/0x118
  [<807a7aac>] dump_stack_lvl+0x5c/0x7c
  [<807a4b3c>] __warn+0xcc/0x140
  [<807a4c3c>] warn_slowpath_fmt+0x8c/0xb8
  [<8011e198>] build_insn+0x558/0x590
  [<8011e358>] uasm_i_bne+0x20/0x2c
  [<80127b48>] build_body+0xa58/0x2a94
  [<80129c98>] bpf_jit_compile+0x114/0x1e4
  [<80613fc4>] bpf_prepare_filter+0x2ec/0x4e4
  [<8061423c>] bpf_prog_create+0x80/0xc4
  [<c0a006e4>] test_bpf_init+0x300/0xba8 [test_bpf]
  [<8010051c>] do_one_initcall+0x50/0x1d4
  [<801c5e54>] do_init_module+0x60/0x220
  [<801c8b20>] sys_finit_module+0xc4/0xfc
  [<801144d0>] syscall_common+0x34/0x58
  [...]
  ---[ end trace a287d9742503c645 ]---

Then the anomalous machine code executes:

=> 0xc0a18000:  addiu   sp,sp,-16
   0xc0a18004:  sw      s3,0(sp)
   0xc0a18008:  sw      s4,4(sp)
   0xc0a1800c:  sw      s5,8(sp)
   0xc0a18010:  sw      ra,12(sp)
   0xc0a18014:  move    s5,a0
   0xc0a18018:  move    s4,zero
   0xc0a1801c:  move    s3,zero

   # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0)
   0xc0a18020:  lui     t6,0x8012
   0xc0a18024:  ori     t4,t6,0x9e14
   0xc0a18028:  li      a1,0
   0xc0a1802c:  jalr    t4
   0xc0a18030:  move    a0,s5
   0xc0a18034:  bnez    v0,0xc0a1ffb8           # incorrect branch offset
   0xc0a18038:  move    v0,zero
   0xc0a1803c:  andi    s4,s3,0xf
   0xc0a18040:  b       0xc0a18048
   0xc0a18044:  sll     s4,s4,0x2
   [...]

   # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0)
   0xc0a1ffa0:  lui     t6,0x8012
   0xc0a1ffa4:  ori     t4,t6,0x9e14
   0xc0a1ffa8:  li      a1,0
   0xc0a1ffac:  jalr    t4
   0xc0a1ffb0:  move    a0,s5
   0xc0a1ffb4:  bnez    v0,0xc0a1ffb8           # incorrect branch offset
   0xc0a1ffb8:  move    v0,zero
   0xc0a1ffbc:  andi    s4,s3,0xf
   0xc0a1ffc0:  b       0xc0a1ffc8
   0xc0a1ffc4:  sll     s4,s4,0x2

   # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0)
   0xc0a1ffc8:  lui     t6,0x8012
   0xc0a1ffcc:  ori     t4,t6,0x9e14
   0xc0a1ffd0:  li      a1,0
   0xc0a1ffd4:  jalr    t4
   0xc0a1ffd8:  move    a0,s5
   0xc0a1ffdc:  bnez    v0,0xc0a3ffb8           # correct branch offset
   0xc0a1ffe0:  move    v0,zero
   0xc0a1ffe4:  andi    s4,s3,0xf
   0xc0a1ffe8:  b       0xc0a1fff0
   0xc0a1ffec:  sll     s4,s4,0x2
   [...]

   # epilogue
   0xc0a3ffb8:  lw      s3,0(sp)
   0xc0a3ffbc:  lw      s4,4(sp)
   0xc0a3ffc0:  lw      s5,8(sp)
   0xc0a3ffc4:  lw      ra,12(sp)
   0xc0a3ffc8:  addiu   sp,sp,16
   0xc0a3ffcc:  jr      ra
   0xc0a3ffd0:  nop

To mitigate this issue, we assert the branch ranges for each emit call
that could generate an out-of-range branch.

Fixes: 36366e367ee9 ("MIPS: BPF: Restore MIPS32 cBPF JIT")
Fixes: c6610de353da ("MIPS: net: Add BPF JIT")
Signed-off-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Cc: Paul Burton <paulburton@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://lore.kernel.org/bpf/20210915160437.4080-1-piotras@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/net/bpf_jit.c | 57 +++++++++++++++++++++++++++++++----------
 1 file changed, 43 insertions(+), 14 deletions(-)

diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
index 0af88622c619..cb6d22439f71 100644
--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -662,6 +662,11 @@ static void build_epilogue(struct jit_ctx *ctx)
 	((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative : func) : \
 	 func##_positive)
 
+static bool is_bad_offset(int b_off)
+{
+	return b_off > 0x1ffff || b_off < -0x20000;
+}
+
 static int build_body(struct jit_ctx *ctx)
 {
 	const struct bpf_prog *prog = ctx->skf;
@@ -728,7 +733,10 @@ static int build_body(struct jit_ctx *ctx)
 			/* Load return register on DS for failures */
 			emit_reg_move(r_ret, r_zero, ctx);
 			/* Return with error */
-			emit_b(b_imm(prog->len, ctx), ctx);
+			b_off = b_imm(prog->len, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_b(b_off, ctx);
 			emit_nop(ctx);
 			break;
 		case BPF_LD | BPF_W | BPF_IND:
@@ -775,8 +783,10 @@ static int build_body(struct jit_ctx *ctx)
 			emit_jalr(MIPS_R_RA, r_s0, ctx);
 			emit_reg_move(MIPS_R_A0, r_skb, ctx); /* delay slot */
 			/* Check the error value */
-			emit_bcond(MIPS_COND_NE, r_ret, 0,
-				   b_imm(prog->len, ctx), ctx);
+			b_off = b_imm(prog->len, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_NE, r_ret, 0, b_off, ctx);
 			emit_reg_move(r_ret, r_zero, ctx);
 			/* We are good */
 			/* X <- P[1:K] & 0xf */
@@ -855,8 +865,10 @@ static int build_body(struct jit_ctx *ctx)
 			/* A /= X */
 			ctx->flags |= SEEN_X | SEEN_A;
 			/* Check if r_X is zero */
-			emit_bcond(MIPS_COND_EQ, r_X, r_zero,
-				   b_imm(prog->len, ctx), ctx);
+			b_off = b_imm(prog->len, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx);
 			emit_load_imm(r_ret, 0, ctx); /* delay slot */
 			emit_div(r_A, r_X, ctx);
 			break;
@@ -864,8 +876,10 @@ static int build_body(struct jit_ctx *ctx)
 			/* A %= X */
 			ctx->flags |= SEEN_X | SEEN_A;
 			/* Check if r_X is zero */
-			emit_bcond(MIPS_COND_EQ, r_X, r_zero,
-				   b_imm(prog->len, ctx), ctx);
+			b_off = b_imm(prog->len, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_EQ, r_X, r_zero, b_off, ctx);
 			emit_load_imm(r_ret, 0, ctx); /* delay slot */
 			emit_mod(r_A, r_X, ctx);
 			break;
@@ -926,7 +940,10 @@ static int build_body(struct jit_ctx *ctx)
 			break;
 		case BPF_JMP | BPF_JA:
 			/* pc += K */
-			emit_b(b_imm(i + k + 1, ctx), ctx);
+			b_off = b_imm(i + k + 1, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_b(b_off, ctx);
 			emit_nop(ctx);
 			break;
 		case BPF_JMP | BPF_JEQ | BPF_K:
@@ -1056,12 +1073,16 @@ static int build_body(struct jit_ctx *ctx)
 			break;
 		case BPF_RET | BPF_A:
 			ctx->flags |= SEEN_A;
-			if (i != prog->len - 1)
+			if (i != prog->len - 1) {
 				/*
 				 * If this is not the last instruction
 				 * then jump to the epilogue
 				 */
-				emit_b(b_imm(prog->len, ctx), ctx);
+				b_off = b_imm(prog->len, ctx);
+				if (is_bad_offset(b_off))
+					return -E2BIG;
+				emit_b(b_off, ctx);
+			}
 			emit_reg_move(r_ret, r_A, ctx); /* delay slot */
 			break;
 		case BPF_RET | BPF_K:
@@ -1075,7 +1096,10 @@ static int build_body(struct jit_ctx *ctx)
 				 * If this is not the last instruction
 				 * then jump to the epilogue
 				 */
-				emit_b(b_imm(prog->len, ctx), ctx);
+				b_off = b_imm(prog->len, ctx);
+				if (is_bad_offset(b_off))
+					return -E2BIG;
+				emit_b(b_off, ctx);
 				emit_nop(ctx);
 			}
 			break;
@@ -1133,8 +1157,10 @@ static int build_body(struct jit_ctx *ctx)
 			/* Load *dev pointer */
 			emit_load_ptr(r_s0, r_skb, off, ctx);
 			/* error (0) in the delay slot */
-			emit_bcond(MIPS_COND_EQ, r_s0, r_zero,
-				   b_imm(prog->len, ctx), ctx);
+			b_off = b_imm(prog->len, ctx);
+			if (is_bad_offset(b_off))
+				return -E2BIG;
+			emit_bcond(MIPS_COND_EQ, r_s0, r_zero, b_off, ctx);
 			emit_reg_move(r_ret, r_zero, ctx);
 			if (code == (BPF_ANC | SKF_AD_IFINDEX)) {
 				BUILD_BUG_ON(sizeof_field(struct net_device, ifindex) != 4);
@@ -1244,7 +1270,10 @@ void bpf_jit_compile(struct bpf_prog *fp)
 
 	/* Generate the actual JIT code */
 	build_prologue(&ctx);
-	build_body(&ctx);
+	if (build_body(&ctx)) {
+		module_memfree(ctx.target);
+		goto out;
+	}
 	build_epilogue(&ctx);
 
 	/* Update the icache */

From 76bbb482d33bfcd7e9070ecf594c9ec73e01c930 Mon Sep 17 00:00:00 2001
From: Vadim Pasternak <vadimp@nvidia.com>
Date: Thu, 16 Sep 2021 21:31:51 +0300
Subject: [PATCH 0640/1750] hwmon: (mlxreg-fan) Return non-zero value when fan
 current state is enforced from sysfs

[ Upstream commit e6fab7af6ba1bc77c78713a83876f60ca7a4a064 ]

Fan speed minimum can be enforced from sysfs. For example, setting
current fan speed to 20 is used to enforce fan speed to be at 100%
speed, 19 - to be not below 90% speed, etcetera. This feature provides
ability to limit fan speed according to some system wise
considerations, like absence of some replaceable units or high system
ambient temperature.

Request for changing fan minimum speed is configuration request and can
be set only through 'sysfs' write procedure. In this situation value of
argument 'state' is above nominal fan speed maximum.

Return non-zero code in this case to avoid
thermal_cooling_device_stats_update() call, because in this case
statistics update violates thermal statistics table range.
The issues is observed in case kernel is configured with option
CONFIG_THERMAL_STATISTICS.

Here is the trace from KASAN:
[  159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0
[  159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444
[  159.545625] Call Trace:
[  159.548366]  dump_stack+0x92/0xc1
[  159.552084]  ? thermal_cooling_device_stats_update+0x7d/0xb0
[  159.635869]  thermal_zone_device_update+0x345/0x780
[  159.688711]  thermal_zone_device_set_mode+0x7d/0xc0
[  159.694174]  mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core]
[  159.700972]  ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core]
[  159.731827]  mlxsw_thermal_init+0x763/0x880 [mlxsw_core]
[  160.070233] RIP: 0033:0x7fd995909970
[  160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ..
[  160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970
[  160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001
[  160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700
[  160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013
[  160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013
[  160.143671]
[  160.145338] Allocated by task 2924:
[  160.149242]  kasan_save_stack+0x19/0x40
[  160.153541]  __kasan_kmalloc+0x7f/0xa0
[  160.157743]  __kmalloc+0x1a2/0x2b0
[  160.161552]  thermal_cooling_device_setup_sysfs+0xf9/0x1a0
[  160.167687]  __thermal_cooling_device_register+0x1b5/0x500
[  160.173833]  devm_thermal_of_cooling_device_register+0x60/0xa0
[  160.180356]  mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan]
[  160.248140]
[  160.249807] The buggy address belongs to the object at ffff888116163400
[  160.249807]  which belongs to the cache kmalloc-1k of size 1024
[  160.263814] The buggy address is located 64 bytes to the right of
[  160.263814]  1024-byte region [ffff888116163400, ffff888116163800)
[  160.277536] The buggy address belongs to the page:
[  160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160
[  160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0
[  160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2)
[  160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0
[  160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000
[  160.327033] page dumped because: kasan: bad access detected
[  160.333270]
[  160.334937] Memory state around the buggy address:
[  160.356469] >ffff888116163800: fc ..

Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20210916183151.869427-1-vadimp@nvidia.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/mlxreg-fan.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c
index ed8d59d4eecb..bd8f5a3aaad9 100644
--- a/drivers/hwmon/mlxreg-fan.c
+++ b/drivers/hwmon/mlxreg-fan.c
@@ -291,8 +291,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 {
 	struct mlxreg_fan *fan = cdev->devdata;
 	unsigned long cur_state;
+	int i, config = 0;
 	u32 regval;
-	int i;
 	int err;
 
 	/*
@@ -305,6 +305,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 	 * overwritten.
 	 */
 	if (state >= MLXREG_FAN_SPEED_MIN && state <= MLXREG_FAN_SPEED_MAX) {
+		/*
+		 * This is configuration change, which is only supported through sysfs.
+		 * For configuration non-zero value is to be returned to avoid thermal
+		 * statistics update.
+		 */
+		config = 1;
 		state -= MLXREG_FAN_MAX_STATE;
 		for (i = 0; i < state; i++)
 			fan->cooling_levels[i] = state;
@@ -319,7 +325,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 
 		cur_state = MLXREG_FAN_PWM_DUTY2STATE(regval);
 		if (state < cur_state)
-			return 0;
+			return config;
 
 		state = cur_state;
 	}
@@ -335,7 +341,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,
 		dev_err(fan->dev, "Failed to write PWM duty\n");
 		return err;
 	}
-	return 0;
+	return config;
 }
 
 static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {

From 3748871e1215834a5671849162afbcc4328f7f96 Mon Sep 17 00:00:00 2001
From: Chih-Kang Chang <gary.chang@realtek.com>
Date: Mon, 30 Aug 2021 15:32:40 +0800
Subject: [PATCH 0641/1750] mac80211: Fix ieee80211_amsdu_aggregate frag_tail
 bug

[ Upstream commit fe94bac626d9c1c5bc98ab32707be8a9d7f8adba ]

In ieee80211_amsdu_aggregate() set a pointer frag_tail point to the
end of skb_shinfo(head)->frag_list, and use it to bind other skb in
the end of this function. But when execute ieee80211_amsdu_aggregate()
->ieee80211_amsdu_realloc_pad()->pskb_expand_head(), the address of
skb_shinfo(head)->frag_list will be changed. However, the
ieee80211_amsdu_aggregate() not update frag_tail after call
pskb_expand_head(). That will cause the second skb can't bind to the
head skb appropriately.So we update the address of frag_tail to fix it.

Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://lore.kernel.org/r/20210830073240.12736-1-pkshih@realtek.com
[reword comment]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/tx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 673ad3cf2c3a..bef517ccdecb 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3365,6 +3365,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
 	if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
 		goto out;
 
+	/* If n == 2, the "while (*frag_tail)" loop above didn't execute
+	 * and  frag_tail should be &skb_shinfo(head)->frag_list.
+	 * However, ieee80211_amsdu_prepare_head() can reallocate it.
+	 * Reload frag_tail to have it pointing to the correct place.
+	 */
+	if (n == 2)
+		frag_tail = &skb_shinfo(head)->frag_list;
+
 	/*
 	 * Pad out the previous subframe to a multiple of 4 by adding the
 	 * padding to the next one, that's being added. Note that head->len

From 1282bb00835ff79d2d9c023055d514df5b4de260 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Mon, 20 Sep 2021 14:45:22 +0200
Subject: [PATCH 0642/1750] mac80211: limit injected vht mcs/nss in
 ieee80211_parse_tx_radiotap

[ Upstream commit 13cb6d826e0ac0d144b0d48191ff1a111d32f0c6 ]

Limit max values for vht mcs and nss in ieee80211_parse_tx_radiotap
routine in order to fix the following warning reported by syzbot:

WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline]
WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244
Modules linked in:
CPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline]
RIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244
RSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216
RAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000
RDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003
RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100
R10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8
R13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004
FS:  00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740
 netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089
 __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165
 __bpf_tx_skb net/core/filter.c:2114 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2139 [inline]
 __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162
 ____bpf_clone_redirect net/core/filter.c:2429 [inline]
 bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401
 bpf_prog_eeb6f53a69e5c6a2+0x59/0x234
 bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline]
 __bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_prog_run include/linux/filter.h:631 [inline]
 bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119
 bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663
 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline]
 __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605
 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4689 [inline]
 __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9

Reported-by: syzbot+0196ac871673f0c20f68@syzkaller.appspotmail.com
Fixes: 646e76bb5daf4 ("mac80211: parse VHT info in injected frames")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://lore.kernel.org/r/c26c3f02dcb38ab63b2f2534cb463d95ee81bb13.1632141760.git.lorenzo@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/tx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index bef517ccdecb..bbbcc678c655 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2177,7 +2177,11 @@ bool ieee80211_parse_tx_radiotap(struct sk_buff *skb,
 			}
 
 			vht_mcs = iterator.this_arg[4] >> 4;
+			if (vht_mcs > 11)
+				vht_mcs = 0;
 			vht_nss = iterator.this_arg[4] & 0xF;
+			if (!vht_nss || vht_nss > 8)
+				vht_nss = 1;
 			break;
 
 		/*

From 8576e72ac5d651c3ef41afc54b657bed7e9a69d7 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 20 Sep 2021 15:40:05 +0200
Subject: [PATCH 0643/1750] mac80211: mesh: fix potentially unaligned access

[ Upstream commit b9731062ce8afd35cf723bf3a8ad55d208f915a5 ]

The pointer here points directly into the frame, so the
access is potentially unaligned. Use get_unaligned_le16
to avoid that.

Fixes: 3f52b7e328c5 ("mac80211: mesh power save basics")
Link: https://lore.kernel.org/r/20210920154009.3110ff75be0c.Ib6a2ff9e9cc9bc6fca50fce631ec1ce725cc926b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/mesh_ps.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/mesh_ps.c b/net/mac80211/mesh_ps.c
index 204830a55240..3fbd0b9ff913 100644
--- a/net/mac80211/mesh_ps.c
+++ b/net/mac80211/mesh_ps.c
@@ -2,6 +2,7 @@
 /*
  * Copyright 2012-2013, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
  * Copyright 2012-2013, cozybit Inc.
+ * Copyright (C) 2021 Intel Corporation
  */
 
 #include "mesh.h"
@@ -588,7 +589,7 @@ void ieee80211_mps_frame_release(struct sta_info *sta,
 
 	/* only transmit to PS STA with announced, non-zero awake window */
 	if (test_sta_flag(sta, WLAN_STA_PS_STA) &&
-	    (!elems->awake_window || !le16_to_cpu(*elems->awake_window)))
+	    (!elems->awake_window || !get_unaligned_le16(elems->awake_window)))
 		return;
 
 	if (!test_sta_flag(sta, WLAN_STA_MPSP_OWNER))

From 2c204cf594df3b9468368dc9d0b24d482d93cda7 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Wed, 15 Sep 2021 11:29:37 +0200
Subject: [PATCH 0644/1750] mac80211-hwsim: fix late beacon hrtimer handling

[ Upstream commit 313bbd1990b6ddfdaa7da098d0c56b098a833572 ]

Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx
that our handling of the hrtimer here is wrong: If the timer fires
late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot)
then it tries to actually rearm the timer at the next deadline,
which might be in the past already:

 1          2          3          N          N+1
 |          |          |   ...    |          |

 ^ intended to fire here (1)
            ^ next deadline here (2)
                                      ^ actually fired here

The next time it fires, it's later, but will still try to schedule
for the next deadline (now 3), etc. until it catches up with N,
but that might take a long time, causing stalls etc.

Now, all of this is simulation, so we just have to fix it, but
note that the behaviour is wrong even per spec, since there's no
value then in sending all those beacons unaligned - they should be
aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a
bit (or a lot) late, then just resume at that point.

Therefore, change the code to use hrtimer_forward_now() which will
ensure that the next firing of the timer would be at N+1 (in the
picture), i.e. the next interval point after the current time.

Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: syzbot+0e964fad69a9c462bc1e@syzkaller.appspotmail.com
Fixes: 01e59e467ecf ("mac80211_hwsim: hrtimer beacon")
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210915112936.544f383472eb.I3f9712009027aa09244b65399bf18bf482a8c4f1@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mac80211_hwsim.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 4ca0b06d09ad..b793d61d15d2 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1795,8 +1795,8 @@ mac80211_hwsim_beacon(struct hrtimer *timer)
 		bcn_int -= data->bcn_delta;
 		data->bcn_delta = 0;
 	}
-	hrtimer_forward(&data->beacon_timer, hrtimer_get_expires(timer),
-			ns_to_ktime(bcn_int * NSEC_PER_USEC));
+	hrtimer_forward_now(&data->beacon_timer,
+			    ns_to_ktime(bcn_int * NSEC_PER_USEC));
 	return HRTIMER_RESTART;
 }
 

From 9c6591ae8e63f93c895ad5e2703c36c548aac997 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Thu, 23 Sep 2021 00:05:04 -0400
Subject: [PATCH 0645/1750] sctp: break out if skb_header_pointer returns NULL
 in sctp_rcv_ootb

[ Upstream commit f7e745f8e94492a8ac0b0a26e25f2b19d342918f ]

We should always check if skb_header_pointer's return is NULL before
using it, otherwise it may cause null-ptr-deref, as syzbot reported:

  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline]
  RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196
  Call Trace:
  <IRQ>
   sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109
   ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422
   ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463
   NF_HOOK include/linux/netfilter.h:307 [inline]
   NF_HOOK include/linux/netfilter.h:301 [inline]
   ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472
   dst_input include/net/dst.h:460 [inline]
   ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline]
   NF_HOOK include/linux/netfilter.h:307 [inline]
   NF_HOOK include/linux/netfilter.h:301 [inline]
   ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297

Fixes: 3acb50c18d8d ("sctp: delay as much as possible skb_linearize")
Reported-by: syzbot+581aff2ae6b860625116@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/input.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 49c49a4d203f..34494a0b28bd 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -677,7 +677,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb)
 		ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
 
 		/* Break out if chunk length is less then minimal. */
-		if (ntohs(ch->length) < sizeof(_ch))
+		if (!ch || ntohs(ch->length) < sizeof(_ch))
 			break;
 
 		ch_end = offset + SCTP_PAD4(ntohs(ch->length));

From 560271d09f780726f52f65cb6f19f0e95084abdc Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Thu, 23 Sep 2021 17:04:11 -0700
Subject: [PATCH 0646/1750] mptcp: don't return sockets in foreign netns

[ Upstream commit ea1300b9df7c8e8b65695a08b8f6aaf4b25fec9c ]

mptcp_token_get_sock() may return a mptcp socket that is in
a different net namespace than the socket that received the token value.

The mptcp syncookie code path had an explicit check for this,
this moves the test into mptcp_token_get_sock() function.

Eventually token.c should be converted to pernet storage, but
such change is not suitable for net tree.

Fixes: 2c5ebd001d4f0 ("mptcp: refactor token container")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mptcp/mptcp_diag.c |  2 +-
 net/mptcp/protocol.h   |  2 +-
 net/mptcp/subflow.c    |  2 +-
 net/mptcp/syncookies.c | 13 +------------
 net/mptcp/token.c      | 11 ++++++++---
 net/mptcp/token_test.c | 14 ++++++++------
 6 files changed, 20 insertions(+), 24 deletions(-)

diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c
index 5f390a97f556..f1af3f44875e 100644
--- a/net/mptcp/mptcp_diag.c
+++ b/net/mptcp/mptcp_diag.c
@@ -36,7 +36,7 @@ static int mptcp_diag_dump_one(struct netlink_callback *cb,
 	struct sock *sk;
 
 	net = sock_net(in_skb->sk);
-	msk = mptcp_token_get_sock(req->id.idiag_cookie[0]);
+	msk = mptcp_token_get_sock(net, req->id.idiag_cookie[0]);
 	if (!msk)
 		goto out_nosk;
 
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 13ab89dc1914..3e5af8397434 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -424,7 +424,7 @@ int mptcp_token_new_connect(struct sock *sk);
 void mptcp_token_accept(struct mptcp_subflow_request_sock *r,
 			struct mptcp_sock *msk);
 bool mptcp_token_exists(u32 token);
-struct mptcp_sock *mptcp_token_get_sock(u32 token);
+struct mptcp_sock *mptcp_token_get_sock(struct net *net, u32 token);
 struct mptcp_sock *mptcp_token_iter_next(const struct net *net, long *s_slot,
 					 long *s_num);
 void mptcp_token_destroy(struct mptcp_sock *msk);
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index bba5696fee36..2e9238490924 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -69,7 +69,7 @@ static struct mptcp_sock *subflow_token_join_request(struct request_sock *req,
 	struct mptcp_sock *msk;
 	int local_id;
 
-	msk = mptcp_token_get_sock(subflow_req->token);
+	msk = mptcp_token_get_sock(sock_net(req_to_sk(req)), subflow_req->token);
 	if (!msk) {
 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINNOTOKEN);
 		return NULL;
diff --git a/net/mptcp/syncookies.c b/net/mptcp/syncookies.c
index 37127781aee9..7f22526346a7 100644
--- a/net/mptcp/syncookies.c
+++ b/net/mptcp/syncookies.c
@@ -108,18 +108,12 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl
 
 	e->valid = 0;
 
-	msk = mptcp_token_get_sock(e->token);
+	msk = mptcp_token_get_sock(net, e->token);
 	if (!msk) {
 		spin_unlock_bh(&join_entry_locks[i]);
 		return false;
 	}
 
-	/* If this fails, the token got re-used in the mean time by another
-	 * mptcp socket in a different netns, i.e. entry is outdated.
-	 */
-	if (!net_eq(sock_net((struct sock *)msk), net))
-		goto err_put;
-
 	subflow_req->remote_nonce = e->remote_nonce;
 	subflow_req->local_nonce = e->local_nonce;
 	subflow_req->backup = e->backup;
@@ -128,11 +122,6 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl
 	subflow_req->msk = msk;
 	spin_unlock_bh(&join_entry_locks[i]);
 	return true;
-
-err_put:
-	spin_unlock_bh(&join_entry_locks[i]);
-	sock_put((struct sock *)msk);
-	return false;
 }
 
 void __init mptcp_join_cookie_init(void)
diff --git a/net/mptcp/token.c b/net/mptcp/token.c
index 0691a4883f3a..f0d656bf27ad 100644
--- a/net/mptcp/token.c
+++ b/net/mptcp/token.c
@@ -232,6 +232,7 @@ bool mptcp_token_exists(u32 token)
 
 /**
  * mptcp_token_get_sock - retrieve mptcp connection sock using its token
+ * @net: restrict to this namespace
  * @token: token of the mptcp connection to retrieve
  *
  * This function returns the mptcp connection structure with the given token.
@@ -239,7 +240,7 @@ bool mptcp_token_exists(u32 token)
  *
  * returns NULL if no connection with the given token value exists.
  */
-struct mptcp_sock *mptcp_token_get_sock(u32 token)
+struct mptcp_sock *mptcp_token_get_sock(struct net *net, u32 token)
 {
 	struct hlist_nulls_node *pos;
 	struct token_bucket *bucket;
@@ -252,11 +253,15 @@ struct mptcp_sock *mptcp_token_get_sock(u32 token)
 again:
 	sk_nulls_for_each_rcu(sk, pos, &bucket->msk_chain) {
 		msk = mptcp_sk(sk);
-		if (READ_ONCE(msk->token) != token)
+		if (READ_ONCE(msk->token) != token ||
+		    !net_eq(sock_net(sk), net))
 			continue;
+
 		if (!refcount_inc_not_zero(&sk->sk_refcnt))
 			goto not_found;
-		if (READ_ONCE(msk->token) != token) {
+
+		if (READ_ONCE(msk->token) != token ||
+		    !net_eq(sock_net(sk), net)) {
 			sock_put(sk);
 			goto again;
 		}
diff --git a/net/mptcp/token_test.c b/net/mptcp/token_test.c
index e1bd6f0a0676..5d984bec1cd8 100644
--- a/net/mptcp/token_test.c
+++ b/net/mptcp/token_test.c
@@ -11,6 +11,7 @@ static struct mptcp_subflow_request_sock *build_req_sock(struct kunit *test)
 			    GFP_USER);
 	KUNIT_EXPECT_NOT_ERR_OR_NULL(test, req);
 	mptcp_token_init_request((struct request_sock *)req);
+	sock_net_set((struct sock *)req, &init_net);
 	return req;
 }
 
@@ -22,7 +23,7 @@ static void mptcp_token_test_req_basic(struct kunit *test)
 	KUNIT_ASSERT_EQ(test, 0,
 			mptcp_token_new_request((struct request_sock *)req));
 	KUNIT_EXPECT_NE(test, 0, (int)req->token);
-	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(req->token));
+	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(&init_net, req->token));
 
 	/* cleanup */
 	mptcp_token_destroy_request((struct request_sock *)req);
@@ -55,6 +56,7 @@ static struct mptcp_sock *build_msk(struct kunit *test)
 	msk = kunit_kzalloc(test, sizeof(struct mptcp_sock), GFP_USER);
 	KUNIT_EXPECT_NOT_ERR_OR_NULL(test, msk);
 	refcount_set(&((struct sock *)msk)->sk_refcnt, 1);
+	sock_net_set((struct sock *)msk, &init_net);
 	return msk;
 }
 
@@ -74,11 +76,11 @@ static void mptcp_token_test_msk_basic(struct kunit *test)
 			mptcp_token_new_connect((struct sock *)icsk));
 	KUNIT_EXPECT_NE(test, 0, (int)ctx->token);
 	KUNIT_EXPECT_EQ(test, ctx->token, msk->token);
-	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(ctx->token));
+	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(&init_net, ctx->token));
 	KUNIT_EXPECT_EQ(test, 2, (int)refcount_read(&sk->sk_refcnt));
 
 	mptcp_token_destroy(msk);
-	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(ctx->token));
+	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(&init_net, ctx->token));
 }
 
 static void mptcp_token_test_accept(struct kunit *test)
@@ -90,11 +92,11 @@ static void mptcp_token_test_accept(struct kunit *test)
 			mptcp_token_new_request((struct request_sock *)req));
 	msk->token = req->token;
 	mptcp_token_accept(req, msk);
-	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(msk->token));
+	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(&init_net, msk->token));
 
 	/* this is now a no-op */
 	mptcp_token_destroy_request((struct request_sock *)req);
-	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(msk->token));
+	KUNIT_EXPECT_PTR_EQ(test, msk, mptcp_token_get_sock(&init_net, msk->token));
 
 	/* cleanup */
 	mptcp_token_destroy(msk);
@@ -116,7 +118,7 @@ static void mptcp_token_test_destroyed(struct kunit *test)
 
 	/* simulate race on removal */
 	refcount_set(&sk->sk_refcnt, 0);
-	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(msk->token));
+	KUNIT_EXPECT_PTR_EQ(test, null_msk, mptcp_token_get_sock(&init_net, msk->token));
 
 	/* cleanup */
 	mptcp_token_destroy(msk);

From 89d96f147d82c74f8ec1e2812695fbf89ec3e7ee Mon Sep 17 00:00:00 2001
From: Paul Fertser <fercerpav@gmail.com>
Date: Fri, 24 Sep 2021 12:30:10 +0300
Subject: [PATCH 0647/1750] hwmon: (tmp421) report /PVLD condition as fault

[ Upstream commit 540effa7f283d25bcc13c0940d808002fee340b8 ]

For both local and remote sensors all the supported ICs can report an
"undervoltage lockout" condition which means the conversion wasn't
properly performed due to insufficient power supply voltage and so the
measurement results can't be trusted.

Fixes: 9410700b881f ("hwmon: Add driver for Texas Instruments TMP421/422/423 sensor chips")
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Link: https://lore.kernel.org/r/20210924093011.26083-2-fercerpav@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/tmp421.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
index 8fd8c3a94dfe..c9ef83627bb7 100644
--- a/drivers/hwmon/tmp421.c
+++ b/drivers/hwmon/tmp421.c
@@ -179,10 +179,10 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,
 		return 0;
 	case hwmon_temp_fault:
 		/*
-		 * The OPEN bit signals a fault. This is bit 0 of the temperature
-		 * register (low byte).
+		 * Any of OPEN or /PVLD bits indicate a hardware mulfunction
+		 * and the conversion result may be incorrect
 		 */
-		*val = tmp421->temp[channel] & 0x01;
+		*val = !!(tmp421->temp[channel] & 0x03);
 		return 0;
 	default:
 		return -EOPNOTSUPP;
@@ -195,9 +195,6 @@ static umode_t tmp421_is_visible(const void *data, enum hwmon_sensor_types type,
 {
 	switch (attr) {
 	case hwmon_temp_fault:
-		if (channel == 0)
-			return 0;
-		return 0444;
 	case hwmon_temp_input:
 		return 0444;
 	default:

From 5ee40530b0a6eaae24f77c63411bb1216caab0e2 Mon Sep 17 00:00:00 2001
From: Paul Fertser <fercerpav@gmail.com>
Date: Fri, 24 Sep 2021 12:30:11 +0300
Subject: [PATCH 0648/1750] hwmon: (tmp421) fix rounding for negative values

[ Upstream commit 724e8af85854c4d3401313b6dd7d79cf792d8990 ]

Old code produces -24999 for 0b1110011100000000 input in standard format due to
always rounding up rather than "away from zero".

Use the common macro for division, unify and simplify the conversion code along
the way.

Fixes: 9410700b881f ("hwmon: Add driver for Texas Instruments TMP421/422/423 sensor chips")
Signed-off-by: Paul Fertser <fercerpav@gmail.com>
Link: https://lore.kernel.org/r/20210924093011.26083-3-fercerpav@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/tmp421.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
index c9ef83627bb7..b963a369c5ab 100644
--- a/drivers/hwmon/tmp421.c
+++ b/drivers/hwmon/tmp421.c
@@ -100,23 +100,17 @@ struct tmp421_data {
 	s16 temp[4];
 };
 
-static int temp_from_s16(s16 reg)
+static int temp_from_raw(u16 reg, bool extended)
 {
 	/* Mask out status bits */
 	int temp = reg & ~0xf;
 
-	return (temp * 1000 + 128) / 256;
-}
+	if (extended)
+		temp = temp - 64 * 256;
+	else
+		temp = (s16)temp;
 
-static int temp_from_u16(u16 reg)
-{
-	/* Mask out status bits */
-	int temp = reg & ~0xf;
-
-	/* Add offset for extended temperature range. */
-	temp -= 64 * 256;
-
-	return (temp * 1000 + 128) / 256;
+	return DIV_ROUND_CLOSEST(temp * 1000, 256);
 }
 
 static int tmp421_update_device(struct tmp421_data *data)
@@ -172,10 +166,8 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,
 
 	switch (attr) {
 	case hwmon_temp_input:
-		if (tmp421->config & TMP421_CONFIG_RANGE)
-			*val = temp_from_u16(tmp421->temp[channel]);
-		else
-			*val = temp_from_s16(tmp421->temp[channel]);
+		*val = temp_from_raw(tmp421->temp[channel],
+				     tmp421->config & TMP421_CONFIG_RANGE);
 		return 0;
 	case hwmon_temp_fault:
 		/*

From b22c5e2c8e0380430a1c6d9ccbac8cb19d4ce986 Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Thu, 23 Sep 2021 16:23:33 +0300
Subject: [PATCH 0649/1750] net: enetc: fix the incorrect clearing of IF_MODE
 bits

[ Upstream commit 325fd36ae76a6d089983b2d2eccb41237d35b221 ]

The enetc phylink .mac_config handler intends to clear the IFMODE field
(bits 1:0) of the PM0_IF_MODE register, but incorrectly clears all the
other fields instead.

For normal operation, the bug was inconsequential, due to the fact that
we write the PM0_IF_MODE register in two stages, first in
phylink .mac_config (which incorrectly cleared out a bunch of stuff),
then we update the speed and duplex to the correct values in
phylink .mac_link_up.

Judging by the code (not tested), it looks like maybe loopback mode was
broken, since this is one of the settings in PM0_IF_MODE which is
incorrectly cleared.

Fixes: c76a97218dcb ("net: enetc: force the RGMII speed and duplex instead of operating in inband mode")
Reported-by: Pavel Machek (CIP) <pavel@denx.de>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/enetc/enetc_pf.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
index 68133563a40c..716b396bf094 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
@@ -504,8 +504,7 @@ static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode)
 
 	if (phy_interface_mode_is_rgmii(phy_mode)) {
 		val = enetc_port_rd(hw, ENETC_PM0_IF_MODE);
-		val &= ~ENETC_PM0_IFM_EN_AUTO;
-		val &= ENETC_PM0_IFM_IFMODE_MASK;
+		val &= ~(ENETC_PM0_IFM_EN_AUTO | ENETC_PM0_IFM_IFMODE_MASK);
 		val |= ENETC_PM0_IFM_IFMODE_GMII | ENETC_PM0_IFM_RG;
 		enetc_port_wr(hw, ENETC_PM0_IF_MODE, val);
 	}

From 8de12ad9162ca2648c82d631c47c2f7de565aa73 Mon Sep 17 00:00:00 2001
From: Xiao Liang <shaw.leon@gmail.com>
Date: Thu, 23 Sep 2021 23:03:19 +0800
Subject: [PATCH 0650/1750] net: ipv4: Fix rtnexthop len when RTA_FLOW is
 present

[ Upstream commit 597aa16c782496bf74c5dc3b45ff472ade6cee64 ]

Multipath RTA_FLOW is embedded in nexthop. Dump it in fib_add_nexthop()
to get the length of rtnexthop correct.

Fixes: b0f60193632e ("ipv4: Refactor nexthop attributes in fib_dump_info")
Signed-off-by: Xiao Liang <shaw.leon@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/ip_fib.h     |  2 +-
 include/net/nexthop.h    |  2 +-
 net/ipv4/fib_semantics.c | 16 +++++++++-------
 net/ipv6/route.c         |  5 +++--
 4 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 2ec062aaa978..4d431d7b4415 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -553,5 +553,5 @@ int ip_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
 int fib_nexthop_info(struct sk_buff *skb, const struct fib_nh_common *nh,
 		     u8 rt_family, unsigned char *flags, bool skip_oif);
 int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nh,
-		    int nh_weight, u8 rt_family);
+		    int nh_weight, u8 rt_family, u32 nh_tclassid);
 #endif  /* _NET_FIB_H */
diff --git a/include/net/nexthop.h b/include/net/nexthop.h
index 4c8c9fe9a3f0..fd87d727aa21 100644
--- a/include/net/nexthop.h
+++ b/include/net/nexthop.h
@@ -211,7 +211,7 @@ int nexthop_mpath_fill_node(struct sk_buff *skb, struct nexthop *nh,
 		struct fib_nh_common *nhc = &nhi->fib_nhc;
 		int weight = nhg->nh_entries[i].weight;
 
-		if (fib_add_nexthop(skb, nhc, weight, rt_family) < 0)
+		if (fib_add_nexthop(skb, nhc, weight, rt_family, 0) < 0)
 			return -EMSGSIZE;
 	}
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 1f75dc686b6b..642503e89924 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1663,7 +1663,7 @@ EXPORT_SYMBOL_GPL(fib_nexthop_info);
 
 #if IS_ENABLED(CONFIG_IP_ROUTE_MULTIPATH) || IS_ENABLED(CONFIG_IPV6)
 int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nhc,
-		    int nh_weight, u8 rt_family)
+		    int nh_weight, u8 rt_family, u32 nh_tclassid)
 {
 	const struct net_device *dev = nhc->nhc_dev;
 	struct rtnexthop *rtnh;
@@ -1681,6 +1681,9 @@ int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nhc,
 
 	rtnh->rtnh_flags = flags;
 
+	if (nh_tclassid && nla_put_u32(skb, RTA_FLOW, nh_tclassid))
+		goto nla_put_failure;
+
 	/* length of rtnetlink header + attributes */
 	rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *)rtnh;
 
@@ -1708,14 +1711,13 @@ static int fib_add_multipath(struct sk_buff *skb, struct fib_info *fi)
 	}
 
 	for_nexthops(fi) {
-		if (fib_add_nexthop(skb, &nh->nh_common, nh->fib_nh_weight,
-				    AF_INET) < 0)
-			goto nla_put_failure;
+		u32 nh_tclassid = 0;
 #ifdef CONFIG_IP_ROUTE_CLASSID
-		if (nh->nh_tclassid &&
-		    nla_put_u32(skb, RTA_FLOW, nh->nh_tclassid))
-			goto nla_put_failure;
+		nh_tclassid = nh->nh_tclassid;
 #endif
+		if (fib_add_nexthop(skb, &nh->nh_common, nh->fib_nh_weight,
+				    AF_INET, nh_tclassid) < 0)
+			goto nla_put_failure;
 	} endfor_nexthops(fi);
 
 mp_end:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 168a7b4d957a..a68a7d7c0728 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5566,14 +5566,15 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
 			goto nla_put_failure;
 
 		if (fib_add_nexthop(skb, &rt->fib6_nh->nh_common,
-				    rt->fib6_nh->fib_nh_weight, AF_INET6) < 0)
+				    rt->fib6_nh->fib_nh_weight, AF_INET6,
+				    0) < 0)
 			goto nla_put_failure;
 
 		list_for_each_entry_safe(sibling, next_sibling,
 					 &rt->fib6_siblings, fib6_siblings) {
 			if (fib_add_nexthop(skb, &sibling->fib6_nh->nh_common,
 					    sibling->fib6_nh->fib_nh_weight,
-					    AF_INET6) < 0)
+					    AF_INET6, 0) < 0)
 				goto nla_put_failure;
 		}
 

From 8321738c6e5ab8c85983c3ac5d7d36e0ccc451ae Mon Sep 17 00:00:00 2001
From: Aaro Koskinen <aaro.koskinen@iki.fi>
Date: Fri, 24 Sep 2021 01:00:16 +0300
Subject: [PATCH 0651/1750] smsc95xx: fix stalled rx after link change

[ Upstream commit 5ab8a447bcfee1ded709e7ff5dc7608ca9f66ae2 ]

After commit 05b35e7eb9a1 ("smsc95xx: add phylib support"), link changes
are no longer propagated to usbnet. As a result, rx URB allocation won't
happen until there is a packet sent out first (this might never happen,
e.g. running just ssh server with a static IP). Fix by triggering usbnet
EVENT_LINK_CHANGE.

Fixes: 05b35e7eb9a1 ("smsc95xx: add phylib support")
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/smsc95xx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index ea0d5f04dc3a..465e11dcdf12 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1178,7 +1178,10 @@ static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)
 
 static void smsc95xx_handle_link_change(struct net_device *net)
 {
+	struct usbnet *dev = netdev_priv(net);
+
 	phy_print_status(net->phydev);
+	usbnet_defer_kevent(dev, EVENT_LINK_CHANGE);
 }
 
 static int smsc95xx_start_phy(struct usbnet *dev)

From d35d95e8b9da638d27bce9552262e0c486138343 Mon Sep 17 00:00:00 2001
From: Matthew Auld <matthew.auld@intel.com>
Date: Tue, 21 Sep 2021 14:42:02 +0100
Subject: [PATCH 0652/1750] drm/i915/request: fix early tracepoints

[ Upstream commit c83ff0186401169eb27ce5057d820b7a863455c3 ]

Currently we blow up in trace_dma_fence_init, when calling into
get_driver_name or get_timeline_name, since both the engine and context
might be NULL(or contain some garbage address) in the case of newly
allocated slab objects via the request ctor. Note that we also use
SLAB_TYPESAFE_BY_RCU here, which allows requests to be immediately
freed, but delay freeing the underlying page by an RCU grace period.
With this scheme requests can be re-allocated, at the same time as they
are also being read by some lockless RCU lookup mechanism.

In the ctor case, which is only called for new slab objects(i.e allocate
new page and call the ctor for each object) it's safe to reset the
context/engine prior to calling into dma_fence_init, since we can be
certain that no one is doing an RCU lookup which might depend on peeking
at the engine/context, like in active_engine(), since the object can't
yet be externally visible.

In the recycled case(which might also be externally visible) the request
refcount always transitions from 0->1 after we set the context/engine
etc, which should ensure it's valid to dereference the engine for
example, when doing an RCU list-walk, so long as we can also increment
the refcount first. If the refcount is already zero, then the request is
considered complete/released.  If it's non-zero, then the request might
be in the process of being re-allocated, or potentially still in flight,
however after successfully incrementing the refcount, it's possible to
carefully inspect the request state, to determine if the request is
still what we were looking for. Note that all externally visible
requests returned to the cache must have zero refcount.

One possible fix then is to move dma_fence_init out from the request
ctor. Originally this was how it was done, but it was moved in:

commit 855e39e65cfc33a73724f1cc644ffc5754864a20
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Feb 3 09:41:48 2020 +0000

    drm/i915: Initialise basic fence before acquiring seqno

where it looks like intel_timeline_get_seqno() relied on some of the
rq->fence state, but that is no longer the case since:

commit 12ca695d2c1ed26b2dcbb528b42813bd0f216cfc
Author: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Date:   Tue Mar 23 16:49:50 2021 +0100

    drm/i915: Do not share hwsp across contexts any more, v8.

intel_timeline_get_seqno() could also be cleaned up slightly by dropping
the request argument.

Moving dma_fence_init back out of the ctor, should ensure we have enough
of the request initialised in case of trace_dma_fence_init.
Functionally this should be the same, and is effectively what we were
already open coding before, except now we also assign the fence->lock
and fence->ops, but since these are invariant for recycled
requests(which might be externally visible), and will therefore already
hold the same value, it shouldn't matter.

An alternative fix, since we don't yet have a fully initialised request
when in the ctor, is just setting the context/engine as NULL, but this
does require adding some extra handling in get_driver_name etc.

v2(Daniel):
  - Try to make the commit message less confusing

Fixes: 855e39e65cfc ("drm/i915: Initialise basic fence before acquiring seqno")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Michael Mason <michael.w.mason@intel.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210921134202.3803151-1-matthew.auld@intel.com
(cherry picked from commit be988eaee1cb208c4445db46bc3ceaf75f586f0b)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/i915/i915_request.c | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
index d8fef42ca38e..896389f93029 100644
--- a/drivers/gpu/drm/i915/i915_request.c
+++ b/drivers/gpu/drm/i915/i915_request.c
@@ -776,8 +776,6 @@ static void __i915_request_ctor(void *arg)
 	i915_sw_fence_init(&rq->submit, submit_notify);
 	i915_sw_fence_init(&rq->semaphore, semaphore_notify);
 
-	dma_fence_init(&rq->fence, &i915_fence_ops, &rq->lock, 0, 0);
-
 	rq->capture_list = NULL;
 
 	init_llist_head(&rq->execute_cb);
@@ -840,17 +838,12 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp)
 	rq->ring = ce->ring;
 	rq->execution_mask = ce->engine->mask;
 
-	kref_init(&rq->fence.refcount);
-	rq->fence.flags = 0;
-	rq->fence.error = 0;
-	INIT_LIST_HEAD(&rq->fence.cb_list);
-
 	ret = intel_timeline_get_seqno(tl, rq, &seqno);
 	if (ret)
 		goto err_free;
 
-	rq->fence.context = tl->fence_context;
-	rq->fence.seqno = seqno;
+	dma_fence_init(&rq->fence, &i915_fence_ops, &rq->lock,
+		       tl->fence_context, seqno);
 
 	RCU_INIT_POINTER(rq->timeline, tl);
 	RCU_INIT_POINTER(rq->hwsp_cacheline, tl->hwsp_cacheline);

From ee4d0495a65e366538063907c8b4459245620e0c Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 26 Sep 2021 19:41:24 +0200
Subject: [PATCH 0653/1750] dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fe23036192c95b66e60d019d2ec1814d0d561ffd ]

The datasheets suggests the 6161 uses a per port setting for jumbo
frames. Testing has however shown this is not correct, it uses the old
style chip wide MTU control. Change the ops in the 6161 structure to
reflect this.

Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU")
Reported by: 曹煜 <cao88yu@gmail.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 184cbc93328c..caa3c4f30405 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3455,7 +3455,6 @@ static const struct mv88e6xxx_ops mv88e6161_ops = {
 	.port_set_frame_mode = mv88e6351_port_set_frame_mode,
 	.port_set_egress_floods = mv88e6352_port_set_egress_floods,
 	.port_set_ether_type = mv88e6351_port_set_ether_type,
-	.port_set_jumbo_size = mv88e6165_port_set_jumbo_size,
 	.port_egress_rate_limiting = mv88e6097_port_egress_rate_limiting,
 	.port_pause_limit = mv88e6097_port_pause_limit,
 	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
@@ -3480,6 +3479,7 @@ static const struct mv88e6xxx_ops mv88e6161_ops = {
 	.avb_ops = &mv88e6165_avb_ops,
 	.ptp_ops = &mv88e6165_ptp_ops,
 	.phylink_validate = mv88e6185_phylink_validate,
+	.set_max_frame_size = mv88e6185_g1_set_max_frame_size,
 };
 
 static const struct mv88e6xxx_ops mv88e6165_ops = {

From 7b771b12229e82dac66cf0090d0774475a3c662c Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 26 Sep 2021 19:41:25 +0200
Subject: [PATCH 0654/1750] dsa: mv88e6xxx: Fix MTU definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b92ce2f54c0f0ff781e914ec189c25f7bf1b1ec2 ]

The MTU passed to the DSA driver is the payload size, typically 1500.
However, the switch uses the frame size when applying restrictions.
Adjust the MTU with the size of the Ethernet header and the frame
checksum. The VLAN header also needs to be included when the frame
size it per port, but not when it is global.

Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU")
Reported by: 曹煜 <cao88yu@gmail.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/mv88e6xxx/chip.c    | 12 ++++++------
 drivers/net/dsa/mv88e6xxx/global1.c |  2 ++
 drivers/net/dsa/mv88e6xxx/port.c    |  2 ++
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index caa3c4f30405..50bbea220fbf 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2613,8 +2613,8 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 	if (err)
 		return err;
 
-	/* Port Control 2: don't force a good FCS, set the maximum frame size to
-	 * 10240 bytes, disable 802.1q tags checking, don't discard tagged or
+	/* Port Control 2: don't force a good FCS, set the MTU size to
+	 * 10222 bytes, disable 802.1q tags checking, don't discard tagged or
 	 * untagged frames on this port, do a destination address lookup on all
 	 * received packets as usual, disable ARP mirroring and don't send a
 	 * copy of all transmitted/received frames on this port to the CPU.
@@ -2633,7 +2633,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
 		return err;
 
 	if (chip->info->ops->port_set_jumbo_size) {
-		err = chip->info->ops->port_set_jumbo_size(chip, port, 10240);
+		err = chip->info->ops->port_set_jumbo_size(chip, port, 10218);
 		if (err)
 			return err;
 	}
@@ -2718,10 +2718,10 @@ static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int port)
 	struct mv88e6xxx_chip *chip = ds->priv;
 
 	if (chip->info->ops->port_set_jumbo_size)
-		return 10240;
+		return 10240 - VLAN_ETH_HLEN - ETH_FCS_LEN;
 	else if (chip->info->ops->set_max_frame_size)
-		return 1632;
-	return 1522;
+		return 1632 - VLAN_ETH_HLEN - ETH_FCS_LEN;
+	return 1522 - VLAN_ETH_HLEN - ETH_FCS_LEN;
 }
 
 static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
diff --git a/drivers/net/dsa/mv88e6xxx/global1.c b/drivers/net/dsa/mv88e6xxx/global1.c
index 33d443a37efc..9936ae69e5ee 100644
--- a/drivers/net/dsa/mv88e6xxx/global1.c
+++ b/drivers/net/dsa/mv88e6xxx/global1.c
@@ -232,6 +232,8 @@ int mv88e6185_g1_set_max_frame_size(struct mv88e6xxx_chip *chip, int mtu)
 	u16 val;
 	int err;
 
+	mtu += ETH_HLEN + ETH_FCS_LEN;
+
 	err = mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &val);
 	if (err)
 		return err;
diff --git a/drivers/net/dsa/mv88e6xxx/port.c b/drivers/net/dsa/mv88e6xxx/port.c
index 8128dc607cf4..dfd9e8292e9a 100644
--- a/drivers/net/dsa/mv88e6xxx/port.c
+++ b/drivers/net/dsa/mv88e6xxx/port.c
@@ -1082,6 +1082,8 @@ int mv88e6165_port_set_jumbo_size(struct mv88e6xxx_chip *chip, int port,
 	u16 reg;
 	int err;
 
+	size += VLAN_ETH_HLEN + ETH_FCS_LEN;
+
 	err = mv88e6xxx_port_read(chip, port, MV88E6XXX_PORT_CTL2, &reg);
 	if (err)
 		return err;

From c20a0ad7b6a054d77c3f20660befe77eaae3f24d Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 26 Sep 2021 19:41:26 +0200
Subject: [PATCH 0655/1750] dsa: mv88e6xxx: Include tagger overhead when
 setting MTU for DSA and CPU ports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b9c587fed61cf88bd45822c3159644445f6d5aa6 ]

Same members of the Marvell Ethernet switches impose MTU restrictions
on ports used for connecting to the CPU or another switch for DSA. If
the MTU is set too low, tagged frames will be discarded. Ensure the
worst case tagger overhead is included in setting the MTU for DSA and
CPU ports.

Fixes: 1baf0fac10fb ("net: dsa: mv88e6xxx: Use chip-wide max frame size for MTU")
Reported by: 曹煜 <cao88yu@gmail.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/mv88e6xxx/chip.c | 9 ++++++---
 drivers/net/dsa/mv88e6xxx/chip.h | 1 +
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 50bbea220fbf..18388ea5ebd9 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2718,10 +2718,10 @@ static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int port)
 	struct mv88e6xxx_chip *chip = ds->priv;
 
 	if (chip->info->ops->port_set_jumbo_size)
-		return 10240 - VLAN_ETH_HLEN - ETH_FCS_LEN;
+		return 10240 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN;
 	else if (chip->info->ops->set_max_frame_size)
-		return 1632 - VLAN_ETH_HLEN - ETH_FCS_LEN;
-	return 1522 - VLAN_ETH_HLEN - ETH_FCS_LEN;
+		return 1632 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN;
+	return 1522 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN;
 }
 
 static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
@@ -2729,6 +2729,9 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
 	struct mv88e6xxx_chip *chip = ds->priv;
 	int ret = 0;
 
+	if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port))
+		new_mtu += EDSA_HLEN;
+
 	mv88e6xxx_reg_lock(chip);
 	if (chip->info->ops->port_set_jumbo_size)
 		ret = chip->info->ops->port_set_jumbo_size(chip, port, new_mtu);
diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index 81c244fc0419..51a7ff44478e 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h
@@ -18,6 +18,7 @@
 #include <linux/timecounter.h>
 #include <net/dsa.h>
 
+#define EDSA_HLEN		8
 #define MV88E6XXX_N_FID		4096
 
 /* PVT limits for 4-bit port and 5-bit switch */

From f2edf80cdd0316e9e3452437e9797e948b8271bf Mon Sep 17 00:00:00 2001
From: Jacob Keller <jacob.e.keller@intel.com>
Date: Wed, 8 Sep 2021 10:52:36 -0700
Subject: [PATCH 0656/1750] e100: fix length calculation in e100_get_regs_len

[ Upstream commit 4329c8dc110b25d5f04ed20c6821bb60deff279f ]

commit abf9b902059f ("e100: cleanup unneeded math") tried to simplify
e100_get_regs_len and remove a double 'divide and then multiply'
calculation that the e100_reg_regs_len function did.

This change broke the size calculation entirely as it failed to account
for the fact that the numbered registers are actually 4 bytes wide and
not 1 byte. This resulted in a significant under allocation of the
register buffer used by e100_get_regs.

Fix this by properly multiplying the register count by u32 first before
adding the size of the dump buffer.

Fixes: abf9b902059f ("e100: cleanup unneeded math")
Reported-by: Felicitas Hetzelt <felicitashetzelt@gmail.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e100.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 609e47b8287d..fee329d98621 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -2435,7 +2435,11 @@ static void e100_get_drvinfo(struct net_device *netdev,
 static int e100_get_regs_len(struct net_device *netdev)
 {
 	struct nic *nic = netdev_priv(netdev);
-	return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf);
+
+	/* We know the number of registers, and the size of the dump buffer.
+	 * Calculate the total size in bytes.
+	 */
+	return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf);
 }
 
 static void e100_get_regs(struct net_device *netdev,

From 7e3eda32b88140252f11c81b100bda4a43f4a727 Mon Sep 17 00:00:00 2001
From: Jacob Keller <jacob.e.keller@intel.com>
Date: Wed, 8 Sep 2021 10:52:37 -0700
Subject: [PATCH 0657/1750] e100: fix buffer overrun in e100_get_regs

[ Upstream commit 51032e6f17ce990d06123ad7307f258c50d25aa7 ]

The e100_get_regs function is used to implement a simple register dump
for the e100 device. The data is broken into a couple of MAC control
registers, and then a series of PHY registers, followed by a memory dump
buffer.

The total length of the register dump is defined as (1 + E100_PHY_REGS)
* sizeof(u32) + sizeof(nic->mem->dump_buf).

The logic for filling in the PHY registers uses a convoluted inverted
count for loop which counts from E100_PHY_REGS (0x1C) down to 0, and
assigns the slots 1 + E100_PHY_REGS - i. The first loop iteration will
fill in [1] and the final loop iteration will fill in [1 + 0x1C]. This
is actually one more than the supposed number of PHY registers.

The memory dump buffer is then filled into the space at
[2 + E100_PHY_REGS] which will cause that memcpy to assign 4 bytes past
the total size.

The end result is that we overrun the total buffer size allocated by the
kernel, which could lead to a panic or other issues due to memory
corruption.

It is difficult to determine the actual total number of registers
here. The only 8255x datasheet I could find indicates there are 28 total
MDI registers. However, we're reading 29 here, and reading them in
reverse!

In addition, the ethtool e100 register dump interface appears to read
the first PHY register to determine if the device is in MDI or MDIx
mode. This doesn't appear to be documented anywhere within the 8255x
datasheet. I can only assume it must be in register 28 (the extra
register we're reading here).

Lets not change any of the intended meaning of what we copy here. Just
extend the space by 4 bytes to account for the extra register and
continue copying the data out in the same order.

Change the E100_PHY_REGS value to be the correct total (29) so that the
total register dump size is calculated properly. Fix the offset for
where we copy the dump buffer so that it doesn't overrun the total size.

Re-write the for loop to use counting up instead of the convoluted
down-counting. Correct the mdio_read offset to use the 0-based register
offsets, but maintain the bizarre reverse ordering so that we have the
ABI expected by applications like ethtool. This requires and additional
subtraction of 1. It seems a bit odd but it makes the flow of assignment
into the register buffer easier to follow.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Felicitas Hetzelt <felicitashetzelt@gmail.com>
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e100.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index fee329d98621..ee86ea12fa37 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -2431,7 +2431,7 @@ static void e100_get_drvinfo(struct net_device *netdev,
 		sizeof(info->bus_info));
 }
 
-#define E100_PHY_REGS 0x1C
+#define E100_PHY_REGS 0x1D
 static int e100_get_regs_len(struct net_device *netdev)
 {
 	struct nic *nic = netdev_priv(netdev);
@@ -2453,14 +2453,18 @@ static void e100_get_regs(struct net_device *netdev,
 	buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 |
 		ioread8(&nic->csr->scb.cmd_lo) << 16 |
 		ioread16(&nic->csr->scb.status);
-	for (i = E100_PHY_REGS; i >= 0; i--)
-		buff[1 + E100_PHY_REGS - i] =
-			mdio_read(netdev, nic->mii.phy_id, i);
+	for (i = 0; i < E100_PHY_REGS; i++)
+		/* Note that we read the registers in reverse order. This
+		 * ordering is the ABI apparently used by ethtool and other
+		 * applications.
+		 */
+		buff[1 + i] = mdio_read(netdev, nic->mii.phy_id,
+					E100_PHY_REGS - 1 - i);
 	memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf));
 	e100_exec_cb(nic, NULL, e100_dump);
 	msleep(10);
-	memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf,
-		sizeof(nic->mem->dump_buf));
+	memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf,
+	       sizeof(nic->mem->dump_buf));
 }
 
 static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)

From f908072391a653776d7ce9e23d63d3789a6c4b7d Mon Sep 17 00:00:00 2001
From: Yixing Liu <liuyixing1@huawei.com>
Date: Fri, 11 Dec 2020 09:37:36 +0800
Subject: [PATCH 0658/1750] RDMA/hns: Fix inaccurate prints

[ Upstream commit 61918e9b008492f48577692428aca3cebf56111a ]

Some %d in print format string should be %u, and some prints miss the
useful errno or are in nonstandard format. Just fix above issues.

Link: https://lore.kernel.org/r/1607650657-35992-11-git-send-email-liweihang@huawei.com
Signed-off-by: Yixing Liu <liuyixing1@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_alloc.c |  4 +-
 drivers/infiniband/hw/hns/hns_roce_cq.c    | 35 +++++++------
 drivers/infiniband/hw/hns/hns_roce_hem.c   | 18 +++----
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 30 +++++------
 drivers/infiniband/hw/hns/hns_roce_mr.c    | 10 ++--
 drivers/infiniband/hw/hns/hns_roce_pd.c    |  2 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c    | 61 +++++++++++++---------
 drivers/infiniband/hw/hns/hns_roce_srq.c   | 37 +++++++------
 8 files changed, 107 insertions(+), 90 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_alloc.c b/drivers/infiniband/hw/hns/hns_roce_alloc.c
index a6b23dec1adc..5b2baf89d110 100644
--- a/drivers/infiniband/hw/hns/hns_roce_alloc.c
+++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c
@@ -240,7 +240,7 @@ int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs,
 	end = start + buf_cnt;
 	if (end > buf->npages) {
 		dev_err(hr_dev->dev,
-			"Failed to check kmem bufs, end %d + %d total %d!\n",
+			"failed to check kmem bufs, end %d + %d total %u!\n",
 			start, buf_cnt, buf->npages);
 		return -EINVAL;
 	}
@@ -262,7 +262,7 @@ int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs,
 	u64 addr;
 
 	if (page_shift < HNS_HW_PAGE_SHIFT) {
-		dev_err(hr_dev->dev, "Failed to check umem page shift %d!\n",
+		dev_err(hr_dev->dev, "failed to check umem page shift %u!\n",
 			page_shift);
 		return -EINVAL;
 	}
diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index da346129f6e9..8a6bded9c11c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -50,29 +50,29 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq)
 
 	ret = hns_roce_mtr_find(hr_dev, &hr_cq->mtr, 0, mtts, ARRAY_SIZE(mtts),
 				&dma_handle);
-	if (ret < 1) {
-		ibdev_err(ibdev, "Failed to find CQ mtr\n");
+	if (!ret) {
+		ibdev_err(ibdev, "failed to find CQ mtr, ret = %d.\n", ret);
 		return -EINVAL;
 	}
 
 	cq_table = &hr_dev->cq_table;
 	ret = hns_roce_bitmap_alloc(&cq_table->bitmap, &hr_cq->cqn);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc CQ bitmap, err %d\n", ret);
+		ibdev_err(ibdev, "failed to alloc CQ bitmap, ret = %d.\n", ret);
 		return ret;
 	}
 
 	/* Get CQC memory HEM(Hardware Entry Memory) table */
 	ret = hns_roce_table_get(hr_dev, &cq_table->table, hr_cq->cqn);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to get CQ(0x%lx) context, err %d\n",
+		ibdev_err(ibdev, "failed to get CQ(0x%lx) context, ret = %d.\n",
 			  hr_cq->cqn, ret);
 		goto err_out;
 	}
 
 	ret = xa_err(xa_store(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL));
 	if (ret) {
-		ibdev_err(ibdev, "Failed to xa_store CQ\n");
+		ibdev_err(ibdev, "failed to xa_store CQ, ret = %d.\n", ret);
 		goto err_put;
 	}
 
@@ -91,7 +91,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq)
 	hns_roce_free_cmd_mailbox(hr_dev, mailbox);
 	if (ret) {
 		ibdev_err(ibdev,
-			  "Failed to send create cmd for CQ(0x%lx), err %d\n",
+			  "failed to send create cmd for CQ(0x%lx), ret = %d.\n",
 			  hr_cq->cqn, ret);
 		goto err_xa;
 	}
@@ -147,7 +147,7 @@ static int alloc_cq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq,
 {
 	struct ib_device *ibdev = &hr_dev->ib_dev;
 	struct hns_roce_buf_attr buf_attr = {};
-	int err;
+	int ret;
 
 	buf_attr.page_shift = hr_dev->caps.cqe_buf_pg_sz + HNS_HW_PAGE_SHIFT;
 	buf_attr.region[0].size = hr_cq->cq_depth * hr_cq->cqe_size;
@@ -155,13 +155,13 @@ static int alloc_cq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq,
 	buf_attr.region_count = 1;
 	buf_attr.fixed_page = true;
 
-	err = hns_roce_mtr_create(hr_dev, &hr_cq->mtr, &buf_attr,
+	ret = hns_roce_mtr_create(hr_dev, &hr_cq->mtr, &buf_attr,
 				  hr_dev->caps.cqe_ba_pg_sz + HNS_HW_PAGE_SHIFT,
 				  udata, addr);
-	if (err)
-		ibdev_err(ibdev, "Failed to alloc CQ mtr, err %d\n", err);
+	if (ret)
+		ibdev_err(ibdev, "failed to alloc CQ mtr, ret = %d.\n", ret);
 
-	return err;
+	return ret;
 }
 
 static void free_cq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq)
@@ -252,13 +252,13 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
 	int ret;
 
 	if (cq_entries < 1 || cq_entries > hr_dev->caps.max_cqes) {
-		ibdev_err(ibdev, "Failed to check CQ count %d max=%d\n",
+		ibdev_err(ibdev, "failed to check CQ count %u, max = %u.\n",
 			  cq_entries, hr_dev->caps.max_cqes);
 		return -EINVAL;
 	}
 
 	if (vector >= hr_dev->caps.num_comp_vectors) {
-		ibdev_err(ibdev, "Failed to check CQ vector=%d max=%d\n",
+		ibdev_err(ibdev, "failed to check CQ vector = %d, max = %d.\n",
 			  vector, hr_dev->caps.num_comp_vectors);
 		return -EINVAL;
 	}
@@ -276,7 +276,7 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
 		ret = ib_copy_from_udata(&ucmd, udata,
 					 min(udata->inlen, sizeof(ucmd)));
 		if (ret) {
-			ibdev_err(ibdev, "Failed to copy CQ udata, err %d\n",
+			ibdev_err(ibdev, "failed to copy CQ udata, ret = %d.\n",
 				  ret);
 			return ret;
 		}
@@ -286,19 +286,20 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
 
 	ret = alloc_cq_buf(hr_dev, hr_cq, udata, ucmd.buf_addr);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc CQ buf, err %d\n", ret);
+		ibdev_err(ibdev, "failed to alloc CQ buf, ret = %d.\n", ret);
 		return ret;
 	}
 
 	ret = alloc_cq_db(hr_dev, hr_cq, udata, ucmd.db_addr, &resp);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc CQ db, err %d\n", ret);
+		ibdev_err(ibdev, "failed to alloc CQ db, ret = %d.\n", ret);
 		goto err_cq_buf;
 	}
 
 	ret = alloc_cqc(hr_dev, hr_cq);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc CQ context, err %d\n", ret);
+		ibdev_err(ibdev,
+			  "failed to alloc CQ context, ret = %d.\n", ret);
 		goto err_cq_db;
 	}
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index 66f9f036ef94..c880a8be7e3c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -184,7 +184,7 @@ static int get_hem_table_config(struct hns_roce_dev *hr_dev,
 		mhop->hop_num = hr_dev->caps.srqc_hop_num;
 		break;
 	default:
-		dev_err(dev, "Table %d not support multi-hop addressing!\n",
+		dev_err(dev, "table %u not support multi-hop addressing!\n",
 			type);
 		return -EINVAL;
 	}
@@ -232,8 +232,8 @@ int hns_roce_calc_hem_mhop(struct hns_roce_dev *hr_dev,
 		mhop->l0_idx = table_idx;
 		break;
 	default:
-		dev_err(dev, "Table %d not support hop_num = %d!\n",
-			     table->type, mhop->hop_num);
+		dev_err(dev, "table %u not support hop_num = %u!\n",
+			table->type, mhop->hop_num);
 		return -EINVAL;
 	}
 	if (mhop->l0_idx >= mhop->ba_l0_num)
@@ -438,13 +438,13 @@ static int calc_hem_config(struct hns_roce_dev *hr_dev,
 		index->buf = l0_idx;
 		break;
 	default:
-		ibdev_err(ibdev, "Table %d not support mhop.hop_num = %d!\n",
+		ibdev_err(ibdev, "table %u not support mhop.hop_num = %u!\n",
 			  table->type, mhop->hop_num);
 		return -EINVAL;
 	}
 
 	if (unlikely(index->buf >= table->num_hem)) {
-		ibdev_err(ibdev, "Table %d exceed hem limt idx %llu,max %lu!\n",
+		ibdev_err(ibdev, "table %u exceed hem limt idx %llu, max %lu!\n",
 			  table->type, index->buf, table->num_hem);
 		return -EINVAL;
 	}
@@ -714,15 +714,15 @@ static void clear_mhop_hem(struct hns_roce_dev *hr_dev,
 			step_idx = hop_num;
 
 		if (hr_dev->hw->clear_hem(hr_dev, table, obj, step_idx))
-			ibdev_warn(ibdev, "Clear hop%d HEM failed.\n", hop_num);
+			ibdev_warn(ibdev, "failed to clear hop%u HEM.\n", hop_num);
 
 		if (index->inited & HEM_INDEX_L1)
 			if (hr_dev->hw->clear_hem(hr_dev, table, obj, 1))
-				ibdev_warn(ibdev, "Clear HEM step 1 failed.\n");
+				ibdev_warn(ibdev, "failed to clear HEM step 1.\n");
 
 		if (index->inited & HEM_INDEX_L0)
 			if (hr_dev->hw->clear_hem(hr_dev, table, obj, 0))
-				ibdev_warn(ibdev, "Clear HEM step 0 failed.\n");
+				ibdev_warn(ibdev, "failed to clear HEM step 0.\n");
 	}
 }
 
@@ -1234,7 +1234,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev,
 	}
 
 	if (offset < r->offset) {
-		dev_err(hr_dev->dev, "invalid offset %d,min %d!\n",
+		dev_err(hr_dev->dev, "invalid offset %d, min %u!\n",
 			offset, r->offset);
 		return -EINVAL;
 	}
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index ebcf26dec1e3..c29ba8ee51e2 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -361,7 +361,7 @@ static int check_send_valid(struct hns_roce_dev *hr_dev,
 	} else if (unlikely(hr_qp->state == IB_QPS_RESET ||
 		   hr_qp->state == IB_QPS_INIT ||
 		   hr_qp->state == IB_QPS_RTR)) {
-		ibdev_err(ibdev, "failed to post WQE, QP state %d!\n",
+		ibdev_err(ibdev, "failed to post WQE, QP state %hhu!\n",
 			  hr_qp->state);
 		return -EINVAL;
 	} else if (unlikely(hr_dev->state >= HNS_ROCE_DEVICE_STATE_RST_DOWN)) {
@@ -665,7 +665,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp,
 		wqe_idx = (qp->sq.head + nreq) & (qp->sq.wqe_cnt - 1);
 
 		if (unlikely(wr->num_sge > qp->sq.max_gs)) {
-			ibdev_err(ibdev, "num_sge=%d > qp->sq.max_gs=%d\n",
+			ibdev_err(ibdev, "num_sge = %d > qp->sq.max_gs = %u.\n",
 				  wr->num_sge, qp->sq.max_gs);
 			ret = -EINVAL;
 			*bad_wr = wr;
@@ -750,7 +750,7 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp,
 		wqe_idx = (hr_qp->rq.head + nreq) & (hr_qp->rq.wqe_cnt - 1);
 
 		if (unlikely(wr->num_sge > hr_qp->rq.max_gs)) {
-			ibdev_err(ibdev, "rq:num_sge=%d >= qp->sq.max_gs=%d\n",
+			ibdev_err(ibdev, "num_sge = %d >= max_sge = %u.\n",
 				  wr->num_sge, hr_qp->rq.max_gs);
 			ret = -EINVAL;
 			*bad_wr = wr;
@@ -1920,8 +1920,8 @@ static void calc_pg_sz(int obj_num, int obj_size, int hop_num, int ctx_bt_num,
 		obj_per_chunk = ctx_bt_num * obj_per_chunk_default;
 		break;
 	default:
-		pr_err("Table %d not support hop_num = %d!\n", hem_type,
-			hop_num);
+		pr_err("table %u not support hop_num = %u!\n", hem_type,
+		       hop_num);
 		return;
 	}
 
@@ -3562,7 +3562,7 @@ static int get_op_for_set_hem(struct hns_roce_dev *hr_dev, u32 type,
 		break;
 	default:
 		dev_warn(hr_dev->dev,
-			 "Table %d not to be written by mailbox!\n", type);
+			 "table %u not to be written by mailbox!\n", type);
 		return -EINVAL;
 	}
 
@@ -3681,7 +3681,7 @@ static int hns_roce_v2_clear_hem(struct hns_roce_dev *hr_dev,
 		op = HNS_ROCE_CMD_DESTROY_SRQC_BT0;
 		break;
 	default:
-		dev_warn(dev, "Table %d not to be destroyed by mailbox!\n",
+		dev_warn(dev, "table %u not to be destroyed by mailbox!\n",
 			 table->type);
 		return 0;
 	}
@@ -4318,7 +4318,7 @@ static int modify_qp_rtr_to_rts(struct ib_qp *ibqp,
 
 	ret = config_qp_sq_buf(hr_dev, hr_qp, context, qpc_mask);
 	if (ret) {
-		ibdev_err(ibdev, "failed to config sq buf, ret %d\n", ret);
+		ibdev_err(ibdev, "failed to config sq buf, ret = %d.\n", ret);
 		return ret;
 	}
 
@@ -4804,7 +4804,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
 	/* SW pass context to HW */
 	ret = hns_roce_v2_qp_modify(hr_dev, context, qpc_mask, hr_qp);
 	if (ret) {
-		ibdev_err(ibdev, "failed to modify QP, ret = %d\n", ret);
+		ibdev_err(ibdev, "failed to modify QP, ret = %d.\n", ret);
 		goto out;
 	}
 
@@ -4897,7 +4897,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
 
 	ret = hns_roce_v2_query_qpc(hr_dev, hr_qp, &context);
 	if (ret) {
-		ibdev_err(ibdev, "failed to query QPC, ret = %d\n", ret);
+		ibdev_err(ibdev, "failed to query QPC, ret = %d.\n", ret);
 		ret = -EINVAL;
 		goto out;
 	}
@@ -5018,7 +5018,7 @@ static int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev,
 					    hr_qp->state, IB_QPS_RESET);
 		if (ret)
 			ibdev_err(ibdev,
-				  "failed to modify QP to RST, ret = %d\n",
+				  "failed to modify QP to RST, ret = %d.\n",
 				  ret);
 	}
 
@@ -5057,7 +5057,7 @@ static int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
 	ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata);
 	if (ret)
 		ibdev_err(&hr_dev->ib_dev,
-			  "failed to destroy QP 0x%06lx, ret = %d\n",
+			  "failed to destroy QP, QPN = 0x%06lx, ret = %d.\n",
 			  hr_qp->qpn, ret);
 
 	hns_roce_qp_destroy(hr_dev, hr_qp, udata);
@@ -5080,7 +5080,7 @@ static int hns_roce_v2_qp_flow_control_init(struct hns_roce_dev *hr_dev,
 	hns_roce_cmq_setup_basic_desc(&desc, HNS_ROCE_OPC_RESET_SCCC, false);
 	ret =  hns_roce_cmq_send(hr_dev, &desc, 1);
 	if (ret) {
-		ibdev_err(ibdev, "failed to reset SCC ctx, ret = %d\n", ret);
+		ibdev_err(ibdev, "failed to reset SCC ctx, ret = %d.\n", ret);
 		goto out;
 	}
 
@@ -5090,7 +5090,7 @@ static int hns_roce_v2_qp_flow_control_init(struct hns_roce_dev *hr_dev,
 	clr->qpn = cpu_to_le32(hr_qp->qpn);
 	ret =  hns_roce_cmq_send(hr_dev, &desc, 1);
 	if (ret) {
-		ibdev_err(ibdev, "failed to clear SCC ctx, ret = %d\n", ret);
+		ibdev_err(ibdev, "failed to clear SCC ctx, ret = %d.\n", ret);
 		goto out;
 	}
 
@@ -5339,7 +5339,7 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period)
 	hns_roce_free_cmd_mailbox(hr_dev, mailbox);
 	if (ret)
 		ibdev_err(&hr_dev->ib_dev,
-			  "failed to process cmd when modifying CQ, ret = %d\n",
+			  "failed to process cmd when modifying CQ, ret = %d.\n",
 			  ret);
 
 	return ret;
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index 7f81a695e9af..027ec8413ac2 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -185,14 +185,14 @@ static int hns_roce_mr_enable(struct hns_roce_dev *hr_dev,
 	else
 		ret = hr_dev->hw->frmr_write_mtpt(hr_dev, mailbox->buf, mr);
 	if (ret) {
-		dev_err(dev, "Write mtpt fail!\n");
+		dev_err(dev, "failed to write mtpt, ret = %d.\n", ret);
 		goto err_page;
 	}
 
 	ret = hns_roce_hw_create_mpt(hr_dev, mailbox,
 				     mtpt_idx & (hr_dev->caps.num_mtpts - 1));
 	if (ret) {
-		dev_err(dev, "CREATE_MPT failed (%d)\n", ret);
+		dev_err(dev, "failed to create mpt, ret = %d.\n", ret);
 		goto err_page;
 	}
 
@@ -495,7 +495,7 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents,
 
 	ret = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, hns_roce_set_page);
 	if (ret < 1) {
-		ibdev_err(ibdev, "failed to store sg pages %d %d, cnt = %d.\n",
+		ibdev_err(ibdev, "failed to store sg pages %u %u, cnt = %d.\n",
 			  mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, ret);
 		goto err_page_list;
 	}
@@ -862,7 +862,7 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
 		if (r->offset + r->count > page_cnt) {
 			err = -EINVAL;
 			ibdev_err(ibdev,
-				  "Failed to check mtr%d end %d + %d, max %d\n",
+				  "failed to check mtr%u end %u + %u, max %u.\n",
 				  i, r->offset, r->count, page_cnt);
 			return err;
 		}
@@ -870,7 +870,7 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
 		err = mtr_map_region(hr_dev, mtr, &pages[r->offset], r);
 		if (err) {
 			ibdev_err(ibdev,
-				  "Failed to map mtr%d offset %d, err %d\n",
+				  "failed to map mtr%u offset %u, ret = %d.\n",
 				  i, r->offset, err);
 			return err;
 		}
diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c
index f78fa1d3d807..012a769d6a6a 100644
--- a/drivers/infiniband/hw/hns/hns_roce_pd.c
+++ b/drivers/infiniband/hw/hns/hns_roce_pd.c
@@ -65,7 +65,7 @@ int hns_roce_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
 
 	ret = hns_roce_pd_alloc(to_hr_dev(ib_dev), &pd->pdn);
 	if (ret) {
-		ibdev_err(ib_dev, "failed to alloc pd, ret = %d\n", ret);
+		ibdev_err(ib_dev, "failed to alloc pd, ret = %d.\n", ret);
 		return ret;
 	}
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
index 7ce9ad8aee1e..291e06d63150 100644
--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
+++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
@@ -452,12 +452,12 @@ static int check_sq_size_with_integrity(struct hns_roce_dev *hr_dev,
 	/* Sanity check SQ size before proceeding */
 	if (ucmd->log_sq_stride > max_sq_stride ||
 	    ucmd->log_sq_stride < HNS_ROCE_IB_MIN_SQ_STRIDE) {
-		ibdev_err(&hr_dev->ib_dev, "Failed to check SQ stride size\n");
+		ibdev_err(&hr_dev->ib_dev, "failed to check SQ stride size.\n");
 		return -EINVAL;
 	}
 
 	if (cap->max_send_sge > hr_dev->caps.max_sq_sg) {
-		ibdev_err(&hr_dev->ib_dev, "Failed to check SQ SGE size %d\n",
+		ibdev_err(&hr_dev->ib_dev, "failed to check SQ SGE size %u.\n",
 			  cap->max_send_sge);
 		return -EINVAL;
 	}
@@ -563,7 +563,7 @@ static int set_kernel_sq_size(struct hns_roce_dev *hr_dev,
 
 	cnt = roundup_pow_of_two(max(cap->max_send_wr, hr_dev->caps.min_wqes));
 	if (cnt > hr_dev->caps.max_wqes) {
-		ibdev_err(ibdev, "failed to check WQE num, WQE num = %d.\n",
+		ibdev_err(ibdev, "failed to check WQE num, WQE num = %u.\n",
 			  cnt);
 		return -EINVAL;
 	}
@@ -736,7 +736,8 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 						   &hr_qp->sdb);
 			if (ret) {
 				ibdev_err(ibdev,
-					  "Failed to map user SQ doorbell\n");
+					  "failed to map user SQ doorbell, ret = %d.\n",
+					  ret);
 				goto err_out;
 			}
 			hr_qp->en_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB;
@@ -747,7 +748,8 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 						   &hr_qp->rdb);
 			if (ret) {
 				ibdev_err(ibdev,
-					  "Failed to map user RQ doorbell\n");
+					  "failed to map user RQ doorbell, ret = %d.\n",
+					  ret);
 				goto err_sdb;
 			}
 			hr_qp->en_flags |= HNS_ROCE_QP_CAP_RQ_RECORD_DB;
@@ -763,7 +765,8 @@ static int alloc_qp_db(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 			ret = hns_roce_alloc_db(hr_dev, &hr_qp->rdb, 0);
 			if (ret) {
 				ibdev_err(ibdev,
-					  "Failed to alloc kernel RQ doorbell\n");
+					  "failed to alloc kernel RQ doorbell, ret = %d.\n",
+					  ret);
 				goto err_out;
 			}
 			*hr_qp->rdb.db_record = 0;
@@ -806,14 +809,14 @@ static int alloc_kernel_wrid(struct hns_roce_dev *hr_dev,
 
 	sq_wrid = kcalloc(hr_qp->sq.wqe_cnt, sizeof(u64), GFP_KERNEL);
 	if (ZERO_OR_NULL_PTR(sq_wrid)) {
-		ibdev_err(ibdev, "Failed to alloc SQ wrid\n");
+		ibdev_err(ibdev, "failed to alloc SQ wrid.\n");
 		return -ENOMEM;
 	}
 
 	if (hr_qp->rq.wqe_cnt) {
 		rq_wrid = kcalloc(hr_qp->rq.wqe_cnt, sizeof(u64), GFP_KERNEL);
 		if (ZERO_OR_NULL_PTR(rq_wrid)) {
-			ibdev_err(ibdev, "Failed to alloc RQ wrid\n");
+			ibdev_err(ibdev, "failed to alloc RQ wrid.\n");
 			ret = -ENOMEM;
 			goto err_sq;
 		}
@@ -873,7 +876,9 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 
 		ret = set_user_sq_size(hr_dev, &init_attr->cap, hr_qp, ucmd);
 		if (ret)
-			ibdev_err(ibdev, "Failed to set user SQ size\n");
+			ibdev_err(ibdev,
+				  "failed to set user SQ size, ret = %d.\n",
+				  ret);
 	} else {
 		if (init_attr->create_flags &
 		    IB_QP_CREATE_BLOCK_MULTICAST_LOOPBACK) {
@@ -888,7 +893,9 @@ static int set_qp_param(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp,
 
 		ret = set_kernel_sq_size(hr_dev, &init_attr->cap, hr_qp);
 		if (ret)
-			ibdev_err(ibdev, "Failed to set kernel SQ size\n");
+			ibdev_err(ibdev,
+				  "failed to set kernel SQ size, ret = %d.\n",
+				  ret);
 	}
 
 	return ret;
@@ -914,45 +921,48 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev,
 
 	ret = set_qp_param(hr_dev, hr_qp, init_attr, udata, &ucmd);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to set QP param\n");
+		ibdev_err(ibdev, "failed to set QP param, ret = %d.\n", ret);
 		return ret;
 	}
 
 	if (!udata) {
 		ret = alloc_kernel_wrid(hr_dev, hr_qp);
 		if (ret) {
-			ibdev_err(ibdev, "Failed to alloc wrid\n");
+			ibdev_err(ibdev, "failed to alloc wrid, ret = %d.\n",
+				  ret);
 			return ret;
 		}
 	}
 
 	ret = alloc_qp_db(hr_dev, hr_qp, init_attr, udata, &ucmd, &resp);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc QP doorbell\n");
+		ibdev_err(ibdev, "failed to alloc QP doorbell, ret = %d.\n",
+			  ret);
 		goto err_wrid;
 	}
 
 	ret = alloc_qp_buf(hr_dev, hr_qp, init_attr, udata, ucmd.buf_addr);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc QP buffer\n");
+		ibdev_err(ibdev, "failed to alloc QP buffer, ret = %d.\n", ret);
 		goto err_db;
 	}
 
 	ret = alloc_qpn(hr_dev, hr_qp);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc QPN\n");
+		ibdev_err(ibdev, "failed to alloc QPN, ret = %d.\n", ret);
 		goto err_buf;
 	}
 
 	ret = alloc_qpc(hr_dev, hr_qp);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc QP context\n");
+		ibdev_err(ibdev, "failed to alloc QP context, ret = %d.\n",
+			  ret);
 		goto err_qpn;
 	}
 
 	ret = hns_roce_qp_store(hr_dev, hr_qp, init_attr);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to store QP\n");
+		ibdev_err(ibdev, "failed to store QP, ret = %d.\n", ret);
 		goto err_qpc;
 	}
 
@@ -1098,9 +1108,8 @@ static int hns_roce_check_qp_attr(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 
 	if ((attr_mask & IB_QP_PORT) &&
 	    (attr->port_num == 0 || attr->port_num > hr_dev->caps.num_ports)) {
-		ibdev_err(&hr_dev->ib_dev,
-			"attr port_num invalid.attr->port_num=%d\n",
-			attr->port_num);
+		ibdev_err(&hr_dev->ib_dev, "invalid attr, port_num = %u.\n",
+			  attr->port_num);
 		return -EINVAL;
 	}
 
@@ -1108,8 +1117,8 @@ static int hns_roce_check_qp_attr(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 		p = attr_mask & IB_QP_PORT ? (attr->port_num - 1) : hr_qp->port;
 		if (attr->pkey_index >= hr_dev->caps.pkey_table_len[p]) {
 			ibdev_err(&hr_dev->ib_dev,
-				"attr pkey_index invalid.attr->pkey_index=%d\n",
-				attr->pkey_index);
+				  "invalid attr, pkey_index = %u.\n",
+				  attr->pkey_index);
 			return -EINVAL;
 		}
 	}
@@ -1117,16 +1126,16 @@ static int hns_roce_check_qp_attr(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 	if (attr_mask & IB_QP_MAX_QP_RD_ATOMIC &&
 	    attr->max_rd_atomic > hr_dev->caps.max_qp_init_rdma) {
 		ibdev_err(&hr_dev->ib_dev,
-			"attr max_rd_atomic invalid.attr->max_rd_atomic=%d\n",
-			attr->max_rd_atomic);
+			  "invalid attr, max_rd_atomic = %u.\n",
+			  attr->max_rd_atomic);
 		return -EINVAL;
 	}
 
 	if (attr_mask & IB_QP_MAX_DEST_RD_ATOMIC &&
 	    attr->max_dest_rd_atomic > hr_dev->caps.max_qp_dest_rdma) {
 		ibdev_err(&hr_dev->ib_dev,
-			"attr max_dest_rd_atomic invalid.attr->max_dest_rd_atomic=%d\n",
-			attr->max_dest_rd_atomic);
+			  "invalid attr, max_dest_rd_atomic = %u.\n",
+			  attr->max_dest_rd_atomic);
 		return -EINVAL;
 	}
 
diff --git a/drivers/infiniband/hw/hns/hns_roce_srq.c b/drivers/infiniband/hw/hns/hns_roce_srq.c
index 75d74f4bb52c..f27523e1a12d 100644
--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
@@ -93,7 +93,8 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq,
 	ret = hns_roce_mtr_find(hr_dev, &srq->buf_mtr, 0, mtts_wqe,
 				ARRAY_SIZE(mtts_wqe), &dma_handle_wqe);
 	if (ret < 1) {
-		ibdev_err(ibdev, "Failed to find mtr for SRQ WQE\n");
+		ibdev_err(ibdev, "failed to find mtr for SRQ WQE, ret = %d.\n",
+			  ret);
 		return -ENOBUFS;
 	}
 
@@ -101,32 +102,34 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq,
 	ret = hns_roce_mtr_find(hr_dev, &srq->idx_que.mtr, 0, mtts_idx,
 				ARRAY_SIZE(mtts_idx), &dma_handle_idx);
 	if (ret < 1) {
-		ibdev_err(ibdev, "Failed to find mtr for SRQ idx\n");
+		ibdev_err(ibdev, "failed to find mtr for SRQ idx, ret = %d.\n",
+			  ret);
 		return -ENOBUFS;
 	}
 
 	ret = hns_roce_bitmap_alloc(&srq_table->bitmap, &srq->srqn);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc SRQ number, err %d\n", ret);
+		ibdev_err(ibdev,
+			  "failed to alloc SRQ number, ret = %d.\n", ret);
 		return -ENOMEM;
 	}
 
 	ret = hns_roce_table_get(hr_dev, &srq_table->table, srq->srqn);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to get SRQC table, err %d\n", ret);
+		ibdev_err(ibdev, "failed to get SRQC table, ret = %d.\n", ret);
 		goto err_out;
 	}
 
 	ret = xa_err(xa_store(&srq_table->xa, srq->srqn, srq, GFP_KERNEL));
 	if (ret) {
-		ibdev_err(ibdev, "Failed to store SRQC, err %d\n", ret);
+		ibdev_err(ibdev, "failed to store SRQC, ret = %d.\n", ret);
 		goto err_put;
 	}
 
 	mailbox = hns_roce_alloc_cmd_mailbox(hr_dev);
 	if (IS_ERR_OR_NULL(mailbox)) {
 		ret = -ENOMEM;
-		ibdev_err(ibdev, "Failed to alloc mailbox for SRQC\n");
+		ibdev_err(ibdev, "failed to alloc mailbox for SRQC.\n");
 		goto err_xa;
 	}
 
@@ -137,7 +140,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq,
 	ret = hns_roce_hw_create_srq(hr_dev, mailbox, srq->srqn);
 	hns_roce_free_cmd_mailbox(hr_dev, mailbox);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to config SRQC, err %d\n", ret);
+		ibdev_err(ibdev, "failed to config SRQC, ret = %d.\n", ret);
 		goto err_xa;
 	}
 
@@ -198,7 +201,8 @@ static int alloc_srq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq,
 				  hr_dev->caps.srqwqe_ba_pg_sz +
 				  HNS_HW_PAGE_SHIFT, udata, addr);
 	if (err)
-		ibdev_err(ibdev, "Failed to alloc SRQ buf mtr, err %d\n", err);
+		ibdev_err(ibdev,
+			  "failed to alloc SRQ buf mtr, ret = %d.\n", err);
 
 	return err;
 }
@@ -229,14 +233,15 @@ static int alloc_srq_idx(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq,
 				  hr_dev->caps.idx_ba_pg_sz + HNS_HW_PAGE_SHIFT,
 				  udata, addr);
 	if (err) {
-		ibdev_err(ibdev, "Failed to alloc SRQ idx mtr, err %d\n", err);
+		ibdev_err(ibdev,
+			  "failed to alloc SRQ idx mtr, ret = %d.\n", err);
 		return err;
 	}
 
 	if (!udata) {
 		idx_que->bitmap = bitmap_zalloc(srq->wqe_cnt, GFP_KERNEL);
 		if (!idx_que->bitmap) {
-			ibdev_err(ibdev, "Failed to alloc SRQ idx bitmap\n");
+			ibdev_err(ibdev, "failed to alloc SRQ idx bitmap.\n");
 			err = -ENOMEM;
 			goto err_idx_mtr;
 		}
@@ -303,7 +308,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
 		ret = ib_copy_from_udata(&ucmd, udata,
 					 min(udata->inlen, sizeof(ucmd)));
 		if (ret) {
-			ibdev_err(ibdev, "Failed to copy SRQ udata, err %d\n",
+			ibdev_err(ibdev, "failed to copy SRQ udata, ret = %d.\n",
 				  ret);
 			return ret;
 		}
@@ -311,20 +316,21 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
 
 	ret = alloc_srq_buf(hr_dev, srq, udata, ucmd.buf_addr);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc SRQ buffer, err %d\n", ret);
+		ibdev_err(ibdev,
+			  "failed to alloc SRQ buffer, ret = %d.\n", ret);
 		return ret;
 	}
 
 	ret = alloc_srq_idx(hr_dev, srq, udata, ucmd.que_addr);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc SRQ idx, err %d\n", ret);
+		ibdev_err(ibdev, "failed to alloc SRQ idx, ret = %d.\n", ret);
 		goto err_buf_alloc;
 	}
 
 	if (!udata) {
 		ret = alloc_srq_wrid(hr_dev, srq);
 		if (ret) {
-			ibdev_err(ibdev, "Failed to alloc SRQ wrid, err %d\n",
+			ibdev_err(ibdev, "failed to alloc SRQ wrid, ret = %d.\n",
 				  ret);
 			goto err_idx_alloc;
 		}
@@ -336,7 +342,8 @@ int hns_roce_create_srq(struct ib_srq *ib_srq,
 
 	ret = alloc_srqc(hr_dev, srq, to_hr_pd(ib_srq->pd)->pdn, cqn, 0, 0);
 	if (ret) {
-		ibdev_err(ibdev, "Failed to alloc SRQ context, err %d\n", ret);
+		ibdev_err(ibdev,
+			  "failed to alloc SRQ context, ret = %d.\n", ret);
 		goto err_wrid_alloc;
 	}
 

From 59efda5073abb4fff2ce8c90ca9c2d25882e84a4 Mon Sep 17 00:00:00 2001
From: Lorenz Bauer <lmb@cloudflare.com>
Date: Wed, 22 Sep 2021 12:11:52 +0100
Subject: [PATCH 0659/1750] bpf: Exempt CAP_BPF from checks against
 bpf_jit_limit

[ Upstream commit 8a98ae12fbefdb583a7696de719a1d57e5e940a2 ]

When introducing CAP_BPF, bpf_jit_charge_modmem() was not changed to treat
programs with CAP_BPF as privileged for the purpose of JIT memory allocation.
This means that a program without CAP_BPF can block a program with CAP_BPF
from loading a program.

Fix this by checking bpf_capable() in bpf_jit_charge_modmem().

Fixes: 2c78ee898d8f ("bpf: Implement CAP_BPF")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210922111153.19843-1-lmb@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index d12efb2550d3..2e4a658d65d6 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -831,7 +831,7 @@ int bpf_jit_charge_modmem(u32 pages)
 {
 	if (atomic_long_add_return(pages, &bpf_jit_current) >
 	    (bpf_jit_limit >> PAGE_SHIFT)) {
-		if (!capable(CAP_SYS_ADMIN)) {
+		if (!bpf_capable()) {
 			atomic_long_sub(pages, &bpf_jit_current);
 			return -EPERM;
 		}

From 4967ae9ab44b8a92b51859dfdf6b81794a61b9a6 Mon Sep 17 00:00:00 2001
From: Jiri Benc <jbenc@redhat.com>
Date: Mon, 27 Sep 2021 18:01:36 +0200
Subject: [PATCH 0660/1750] selftests, bpf: Fix makefile dependencies on libbpf

[ Upstream commit d888eaac4fb1df30320bb1305a8f78efe86524c6 ]

When building bpf selftest with make -j, I'm randomly getting build failures
such as this one:

  In file included from progs/bpf_flow.c:19:
  [...]/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:11:10: fatal error: 'bpf_helper_defs.h' file not found
  #include "bpf_helper_defs.h"
           ^~~~~~~~~~~~~~~~~~~

The file that fails the build varies between runs but it's always in the
progs/ subdir.

The reason is a missing make dependency on libbpf for the .o files in
progs/. There was a dependency before commit 3ac2e20fba07e but that commit
removed it to prevent unneeded rebuilds. However, that only works if libbpf
has been built already; the 'wildcard' prerequisite does not trigger when
there's no bpf_helper_defs.h generated yet.

Keep the libbpf as an order-only prerequisite to satisfy both goals. It is
always built before the progs/ objects but it does not trigger unnecessary
rebuilds by itself.

Fixes: 3ac2e20fba07e ("selftests/bpf: BPF object files should depend only on libbpf headers")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/ee84ab66436fba05a197f952af23c98d90eb6243.1632758415.git.jbenc@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/Makefile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index b5322d60068c..1d9155533360 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -326,7 +326,8 @@ $(TRUNNER_BPF_OBJS): $(TRUNNER_OUTPUT)/%.o:				\
 		     $(TRUNNER_BPF_PROGS_DIR)/%.c			\
 		     $(TRUNNER_BPF_PROGS_DIR)/*.h			\
 		     $$(INCLUDE_DIR)/vmlinux.h				\
-		     $(wildcard $(BPFDIR)/bpf_*.h) | $(TRUNNER_OUTPUT)
+		     $(wildcard $(BPFDIR)/bpf_*.h)			\
+		     | $(TRUNNER_OUTPUT) $$(BPFOBJ)
 	$$(call $(TRUNNER_BPF_BUILD_RULE),$$<,$$@,			\
 					  $(TRUNNER_BPF_CFLAGS),	\
 					  $(TRUNNER_BPF_LDFLAGS))

From f1dd6e10f077cef7f8a073fae759db8e41705ac8 Mon Sep 17 00:00:00 2001
From: Jiri Benc <jbenc@redhat.com>
Date: Thu, 23 Sep 2021 10:40:22 +0200
Subject: [PATCH 0661/1750] selftests, bpf: test_lwt_ip_encap: Really disable
 rp_filter

[ Upstream commit 79e2c306667542b8ee2d9a9d947eadc7039f0a3c ]

It's not enough to set net.ipv4.conf.all.rp_filter=0, that does not override
a greater rp_filter value on the individual interfaces. We also need to set
net.ipv4.conf.default.rp_filter=0 before creating the interfaces. That way,
they'll also get their own rp_filter value of zero.

Fixes: 0fde56e4385b0 ("selftests: bpf: add test_lwt_ip_encap selftest")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/b1cdd9d469f09ea6e01e9c89a6071c79b7380f89.1632386362.git.jbenc@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_lwt_ip_encap.sh | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
index 59ea56945e6c..b497bb85b667 100755
--- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
+++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh
@@ -112,6 +112,14 @@ setup()
 	ip netns add "${NS2}"
 	ip netns add "${NS3}"
 
+	# rp_filter gets confused by what these tests are doing, so disable it
+	ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0
+	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0
+	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0
+	ip netns exec ${NS1} sysctl -wq net.ipv4.conf.default.rp_filter=0
+	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0
+	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0
+
 	ip link add veth1 type veth peer name veth2
 	ip link add veth3 type veth peer name veth4
 	ip link add veth5 type veth peer name veth6
@@ -236,11 +244,6 @@ setup()
 	ip -netns ${NS1} -6 route add ${IPv6_GRE}/128 dev veth5 via ${IPv6_6} ${VRF}
 	ip -netns ${NS2} -6 route add ${IPv6_GRE}/128 dev veth7 via ${IPv6_8} ${VRF}
 
-	# rp_filter gets confused by what these tests are doing, so disable it
-	ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0
-	ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0
-	ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0
-
 	TMPFILE=$(mktemp /tmp/test_lwt_ip_encap.XXXXXX)
 
 	sleep 1  # reduce flakiness

From 1f2ca30fbde6387c2c68e7b8fc3bdda3158d2789 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 27 Sep 2021 16:13:02 +0200
Subject: [PATCH 0662/1750] net: ks8851: fix link error

[ Upstream commit 51bb08dd04a05035a64504faa47651d36b0f3125 ]

An object file cannot be built for both loadable module and built-in
use at the same time:

arm-linux-gnueabi-ld: drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common':
ks8851_common.c:(.text+0xf80): undefined reference to `__this_module'

Change the ks8851_common code to be a standalone module instead,
and use Makefile logic to ensure this is built-in if at least one
of its two users is.

Fixes: 797047f875b5 ("net: ks8851: Implement Parallel bus operations")
Link: https://lore.kernel.org/netdev/20210125121937.3900988-1-arnd@kernel.org/
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Marek Vasut <marex@denx.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/micrel/Makefile        | 6 ++----
 drivers/net/ethernet/micrel/ks8851_common.c | 8 ++++++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/micrel/Makefile b/drivers/net/ethernet/micrel/Makefile
index 5cc00d22c708..6ecc4eb30e74 100644
--- a/drivers/net/ethernet/micrel/Makefile
+++ b/drivers/net/ethernet/micrel/Makefile
@@ -4,8 +4,6 @@
 #
 
 obj-$(CONFIG_KS8842) += ks8842.o
-obj-$(CONFIG_KS8851) += ks8851.o
-ks8851-objs = ks8851_common.o ks8851_spi.o
-obj-$(CONFIG_KS8851_MLL) += ks8851_mll.o
-ks8851_mll-objs = ks8851_common.o ks8851_par.o
+obj-$(CONFIG_KS8851) += ks8851_common.o ks8851_spi.o
+obj-$(CONFIG_KS8851_MLL) += ks8851_common.o ks8851_par.o
 obj-$(CONFIG_KSZ884X_PCI) += ksz884x.o
diff --git a/drivers/net/ethernet/micrel/ks8851_common.c b/drivers/net/ethernet/micrel/ks8851_common.c
index d65872172229..f74eae8eed02 100644
--- a/drivers/net/ethernet/micrel/ks8851_common.c
+++ b/drivers/net/ethernet/micrel/ks8851_common.c
@@ -1031,6 +1031,7 @@ int ks8851_suspend(struct device *dev)
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(ks8851_suspend);
 
 int ks8851_resume(struct device *dev)
 {
@@ -1044,6 +1045,7 @@ int ks8851_resume(struct device *dev)
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(ks8851_resume);
 #endif
 
 int ks8851_probe_common(struct net_device *netdev, struct device *dev,
@@ -1175,6 +1177,7 @@ int ks8851_probe_common(struct net_device *netdev, struct device *dev,
 err_reg_io:
 	return ret;
 }
+EXPORT_SYMBOL_GPL(ks8851_probe_common);
 
 int ks8851_remove_common(struct device *dev)
 {
@@ -1191,3 +1194,8 @@ int ks8851_remove_common(struct device *dev)
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(ks8851_remove_common);
+
+MODULE_DESCRIPTION("KS8851 Network driver");
+MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
+MODULE_LICENSE("GPL");

From 0306a2c7df7ebe7c740ecb6c845668401ed3cc8e Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Tue, 28 Sep 2021 06:33:15 -0600
Subject: [PATCH 0663/1750] Revert "block, bfq: honor already-setup queue
 merges"

[ Upstream commit ebc69e897e17373fbe1daaff1debaa77583a5284 ]

This reverts commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b.

We have had several folks complain that this causes hangs for them, which
is especially problematic as the commit has also hit stable already.

As no resolution seems to be forthcoming right now, revert the patch.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=214503
Fixes: 2d52c58b9c9b ("block, bfq: honor already-setup queue merges")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/bfq-iosched.c | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 65c200e0ecb5..b8c2ddc01aec 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2526,15 +2526,6 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)
 	 * are likely to increase the throughput.
 	 */
 	bfqq->new_bfqq = new_bfqq;
-	/*
-	 * The above assignment schedules the following redirections:
-	 * each time some I/O for bfqq arrives, the process that
-	 * generated that I/O is disassociated from bfqq and
-	 * associated with new_bfqq. Here we increases new_bfqq->ref
-	 * in advance, adding the number of processes that are
-	 * expected to be associated with new_bfqq as they happen to
-	 * issue I/O.
-	 */
 	new_bfqq->ref += process_refs;
 	return new_bfqq;
 }
@@ -2594,10 +2585,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 {
 	struct bfq_queue *in_service_bfqq, *new_bfqq;
 
-	/* if a merge has already been setup, then proceed with that first */
-	if (bfqq->new_bfqq)
-		return bfqq->new_bfqq;
-
 	/*
 	 * Do not perform queue merging if the device is non
 	 * rotational and performs internal queueing. In fact, such a
@@ -2652,6 +2639,9 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,
 	if (bfq_too_late_for_merging(bfqq))
 		return NULL;
 
+	if (bfqq->new_bfqq)
+		return bfqq->new_bfqq;
+
 	if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq))
 		return NULL;
 

From 16138cf938dc1194ba1dddcd7028080f35322ddc Mon Sep 17 00:00:00 2001
From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
Date: Mon, 27 Sep 2021 21:44:08 +0530
Subject: [PATCH 0664/1750] scsi: csiostor: Add module softdep on cxgb4

[ Upstream commit 79a7482249a7353bc86aff8127954d5febf02472 ]

Both cxgb4 and csiostor drivers run on their own independent Physical
Function. But when cxgb4 and csiostor are both being loaded in parallel via
modprobe, there is a race when firmware upgrade is attempted by both the
drivers.

When the cxgb4 driver initiates the firmware upgrade, it halts the firmware
and the chip until upgrade is complete. When the csiostor driver is coming
up in parallel, the firmware mailbox communication fails with timeouts and
the csiostor driver probe fails.

Add a module soft dependency on cxgb4 driver to ensure loading csiostor
triggers cxgb4 to load first when available to avoid the firmware upgrade
race.

Link: https://lore.kernel.org/r/1632759248-15382-1-git-send-email-rahul.lakkireddy@chelsio.com
Fixes: a3667aaed569 ("[SCSI] csiostor: Chelsio FCoE offload driver")
Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/csiostor/csio_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
index 390b07bf92b9..ccbded3353bd 100644
--- a/drivers/scsi/csiostor/csio_init.c
+++ b/drivers/scsi/csiostor/csio_init.c
@@ -1254,3 +1254,4 @@ MODULE_DEVICE_TABLE(pci, csio_pci_tbl);
 MODULE_VERSION(CSIO_DRV_VERSION);
 MODULE_FIRMWARE(FW_FNAME_T5);
 MODULE_FIRMWARE(FW_FNAME_T6);
+MODULE_SOFTDEP("pre: cxgb4");

From 20f6c4a31a525edd9ea6243712b868ba0e4e331e Mon Sep 17 00:00:00 2001
From: Feng Zhou <zhoufeng.zf@bytedance.com>
Date: Tue, 28 Sep 2021 15:23:59 -0700
Subject: [PATCH 0665/1750] ixgbe: Fix NULL pointer dereference in
 ixgbe_xdp_setup

[ Upstream commit 513e605d7a9ce136886cb42ebb2c40e9a6eb6333 ]

The ixgbe driver currently generates a NULL pointer dereference with
some machine (online cpus < 63). This is due to the fact that the
maximum value of num_xdp_queues is nr_cpu_ids. Code is in
"ixgbe_set_rss_queues"".

Here's how the problem repeats itself:
Some machine (online cpus < 63), And user set num_queues to 63 through
ethtool. Code is in the "ixgbe_set_channels",
	adapter->ring_feature[RING_F_FDIR].limit = count;

It becomes 63.

When user use xdp, "ixgbe_set_rss_queues" will set queues num.
	adapter->num_rx_queues = rss_i;
	adapter->num_tx_queues = rss_i;
	adapter->num_xdp_queues = ixgbe_xdp_queues(adapter);

And rss_i's value is from
	f = &adapter->ring_feature[RING_F_FDIR];
	rss_i = f->indices = f->limit;

So "num_rx_queues" > "num_xdp_queues", when run to "ixgbe_xdp_setup",
	for (i = 0; i < adapter->num_rx_queues; i++)
		if (adapter->xdp_ring[i]->xsk_umem)

It leads to panic.

Call trace:
[exception RIP: ixgbe_xdp+368]
RIP: ffffffffc02a76a0  RSP: ffff9fe16202f8d0  RFLAGS: 00010297
RAX: 0000000000000000  RBX: 0000000000000020  RCX: 0000000000000000
RDX: 0000000000000000  RSI: 000000000000001c  RDI: ffffffffa94ead90
RBP: ffff92f8f24c0c18   R8: 0000000000000000   R9: 0000000000000000
R10: ffff9fe16202f830  R11: 0000000000000000  R12: ffff92f8f24c0000
R13: ffff9fe16202fc01  R14: 000000000000000a  R15: ffffffffc02a7530
ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc
 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808
 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235
10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384
11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd
12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb
13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88
14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319
15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290
16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8
17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64
18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9
19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c

So I fix ixgbe_max_channels so that it will not allow a setting of queues
to be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup,
take the smaller value of num_rx_queues and num_xdp_queues.

Fixes: 4a9b32f30f80 ("ixgbe: fix potential RX buffer starvation for AF_XDP")
Signed-off-by: Feng Zhou <zhoufeng.zf@bytedance.com>
Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c    | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index a280aa34ca1d..55983904b6df 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -3216,7 +3216,7 @@ static unsigned int ixgbe_max_channels(struct ixgbe_adapter *adapter)
 		max_combined = ixgbe_max_rss_indices(adapter);
 	}
 
-	return max_combined;
+	return min_t(int, max_combined, num_online_cpus());
 }
 
 static void ixgbe_get_channels(struct net_device *dev,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 37439b76fcb5..ffe322136c58 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -10123,6 +10123,7 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)
 	struct ixgbe_adapter *adapter = netdev_priv(dev);
 	struct bpf_prog *old_prog;
 	bool need_reset;
+	int num_queues;
 
 	if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED)
 		return -EINVAL;
@@ -10172,11 +10173,14 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)
 	/* Kick start the NAPI context if there is an AF_XDP socket open
 	 * on that queue id. This so that receiving will start.
 	 */
-	if (need_reset && prog)
-		for (i = 0; i < adapter->num_rx_queues; i++)
+	if (need_reset && prog) {
+		num_queues = min_t(int, adapter->num_rx_queues,
+				   adapter->num_xdp_queues);
+		for (i = 0; i < num_queues; i++)
 			if (adapter->xdp_ring[i]->xsk_pool)
 				(void)ixgbe_xsk_wakeup(adapter->netdev, i,
 						       XDP_WAKEUP_RX);
+	}
 
 	return 0;
 }

From f8ba689cb69523144d10606096ef686002dd7285 Mon Sep 17 00:00:00 2001
From: Jian Shen <shenjian15@huawei.com>
Date: Wed, 29 Sep 2021 17:35:49 +0800
Subject: [PATCH 0666/1750] net: hns3: do not allow call hns3_nic_net_open
 repeatedly

[ Upstream commit 5b09e88e1bf7fe86540fab4b5f3eece8abead39e ]

hns3_nic_net_open() is not allowed to called repeatly, but there
is no checking for this. When doing device reset and setup tc
concurrently, there is a small oppotunity to call hns3_nic_net_open
repeatedly, and cause kernel bug by calling napi_enable twice.

The calltrace information is like below:
[ 3078.222780] ------------[ cut here ]------------
[ 3078.230255] kernel BUG at net/core/dev.c:6991!
[ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O)
[ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G           O      5.14.0-rc4+ #1
[ 3078.269102] Hardware name:  , BIOS KpxxxFPGA 1P B600 V181 08/12/2021
[ 3078.276801] Workqueue: hclge hclge_service_task [hclge]
[ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--)
[ 3078.296168] pc : napi_enable+0x80/0x84
tc qdisc sho[w  3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3]

[ 3078.314771] sp : ffff8000108abb20
[ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300
[ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000
[ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880
[ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000
[ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930
[ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4
[ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8
[ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344
[ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938
[ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0
[ 3078.414657] Call trace:
[ 3078.418517]  napi_enable+0x80/0x84
[ 3078.424626]  hns3_reset_notify_up_enet+0x78/0xd0 [hns3]
[ 3078.433469]  hns3_reset_notify+0x64/0x80 [hns3]
[ 3078.441430]  hclge_notify_client+0x68/0xb0 [hclge]
[ 3078.450511]  hclge_reset_rebuild+0x524/0x884 [hclge]
[ 3078.458879]  hclge_reset_service_task+0x3c4/0x680 [hclge]
[ 3078.467470]  hclge_service_task+0xb0/0xb54 [hclge]
[ 3078.475675]  process_one_work+0x1dc/0x48c
[ 3078.481888]  worker_thread+0x15c/0x464
[ 3078.487104]  kthread+0x160/0x170
[ 3078.492479]  ret_from_fork+0x10/0x18
[ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000)
[ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]---

Once hns3_nic_net_open() is excute success, the flag
HNS3_NIC_STATE_DOWN will be cleared. So add checking for this
flag, directly return when HNS3_NIC_STATE_DOWN is no set.

Fixes: e888402789b9 ("net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 936b9cfe1a62..4777db2623cf 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -444,6 +444,11 @@ static int hns3_nic_net_open(struct net_device *netdev)
 	if (hns3_nic_resetting(netdev))
 		return -EBUSY;
 
+	if (!test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
+		netdev_warn(netdev, "net open repeatedly!\n");
+		return 0;
+	}
+
 	netif_carrier_off(netdev);
 
 	ret = hns3_nic_set_real_num_queue(netdev);

From 8d3d27664ef42775c14118c0127d015c687c744f Mon Sep 17 00:00:00 2001
From: Yonglong Liu <liuyonglong@huawei.com>
Date: Sat, 28 Nov 2020 11:51:50 +0800
Subject: [PATCH 0667/1750] net: hns3: keep MAC pause mode when multiple TCs
 are enabled

[ Upstream commit d78e5b6a6764cb6e83668806b63d74566db36399 ]

Bellow HNAE3_DEVICE_VERSION_V3, MAC pause mode just support one
TC, when enabled multiple TCs, force enable PFC mode.

HNAE3_DEVICE_VERSION_V3 can support MAC pause mode on multiple
TCs, so when enable multiple TCs, just keep MAC pause mode,
and enable PFC mode just according to the user settings.

Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index e8495f58a1a8..42e82bf69b8e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -682,7 +682,7 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
 	}
 }
 
-static void hclge_pfc_info_init(struct hclge_dev *hdev)
+static void hclge_update_fc_mode_by_dcb_flag(struct hclge_dev *hdev)
 {
 	if (!(hdev->flag & HCLGE_FLAG_DCB_ENABLE)) {
 		if (hdev->fc_mode_last_time == HCLGE_FC_PFC)
@@ -700,6 +700,27 @@ static void hclge_pfc_info_init(struct hclge_dev *hdev)
 	}
 }
 
+static void hclge_update_fc_mode(struct hclge_dev *hdev)
+{
+	if (!hdev->tm_info.pfc_en) {
+		hdev->tm_info.fc_mode = hdev->fc_mode_last_time;
+		return;
+	}
+
+	if (hdev->tm_info.fc_mode != HCLGE_FC_PFC) {
+		hdev->fc_mode_last_time = hdev->tm_info.fc_mode;
+		hdev->tm_info.fc_mode = HCLGE_FC_PFC;
+	}
+}
+
+static void hclge_pfc_info_init(struct hclge_dev *hdev)
+{
+	if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V3)
+		hclge_update_fc_mode(hdev);
+	else
+		hclge_update_fc_mode_by_dcb_flag(hdev);
+}
+
 static void hclge_tm_schd_info_init(struct hclge_dev *hdev)
 {
 	hclge_tm_pg_info_init(hdev);

From 64dae9551f8af31033836a043f2273fee2a74c55 Mon Sep 17 00:00:00 2001
From: Jian Shen <shenjian15@huawei.com>
Date: Wed, 29 Sep 2021 17:35:52 +0800
Subject: [PATCH 0668/1750] net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE
 and HCLGE_FLAG_DCB_ENABLE

[ Upstream commit 0472e95ffeac8e61259eec17ab61608c6b35599d ]

HCLGE_FLAG_MQPRIO_ENABLE is supposed to set when enable
multiple TCs with tc mqprio, and HCLGE_FLAG_DCB_ENABLE is
supposed to set when enable multiple TCs with ets. But
the driver mixed the flags when updating the tm configuration.

Furtherly, PFC should be available when HCLGE_FLAG_MQPRIO_ENABLE
too, so remove the unnecessary limitation.

Fixes: 5a5c90917467 ("net: hns3: add support for tc mqprio offload")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../hisilicon/hns3/hns3pf/hclge_dcb.c         |  7 +++--
 .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 31 +++----------------
 2 files changed, 10 insertions(+), 28 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
index a93c7eb4e7cb..28a90ead4795 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
@@ -248,6 +248,10 @@ static int hclge_ieee_setets(struct hnae3_handle *h, struct ieee_ets *ets)
 	}
 
 	hclge_tm_schd_info_update(hdev, num_tc);
+	if (num_tc > 1)
+		hdev->flag |= HCLGE_FLAG_DCB_ENABLE;
+	else
+		hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
 
 	ret = hclge_ieee_ets_to_tm_info(hdev, ets);
 	if (ret)
@@ -313,8 +317,7 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
 	u8 i, j, pfc_map, *prio_tc;
 	int ret;
 
-	if (!(hdev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE) ||
-	    hdev->flag & HCLGE_FLAG_MQPRIO_ENABLE)
+	if (!(hdev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE))
 		return -EINVAL;
 
 	if (pfc->pfc_en == hdev->tm_info.pfc_en)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index 42e82bf69b8e..69d081515c60 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -646,14 +646,6 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)
 	for (i = 0; i < HNAE3_MAX_USER_PRIO; i++)
 		hdev->tm_info.prio_tc[i] =
 			(i >= hdev->tm_info.num_tc) ? 0 : i;
-
-	/* DCB is enabled if we have more than 1 TC or pfc_en is
-	 * non-zero.
-	 */
-	if (hdev->tm_info.num_tc > 1 || hdev->tm_info.pfc_en)
-		hdev->flag |= HCLGE_FLAG_DCB_ENABLE;
-	else
-		hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
 }
 
 static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
@@ -684,10 +676,10 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
 
 static void hclge_update_fc_mode_by_dcb_flag(struct hclge_dev *hdev)
 {
-	if (!(hdev->flag & HCLGE_FLAG_DCB_ENABLE)) {
+	if (hdev->tm_info.num_tc == 1 && !hdev->tm_info.pfc_en) {
 		if (hdev->fc_mode_last_time == HCLGE_FC_PFC)
 			dev_warn(&hdev->pdev->dev,
-				 "DCB is disable, but last mode is FC_PFC\n");
+				 "Only 1 tc used, but last mode is FC_PFC\n");
 
 		hdev->tm_info.fc_mode = hdev->fc_mode_last_time;
 	} else if (hdev->tm_info.fc_mode != HCLGE_FC_PFC) {
@@ -713,7 +705,7 @@ static void hclge_update_fc_mode(struct hclge_dev *hdev)
 	}
 }
 
-static void hclge_pfc_info_init(struct hclge_dev *hdev)
+void hclge_tm_pfc_info_update(struct hclge_dev *hdev)
 {
 	if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V3)
 		hclge_update_fc_mode(hdev);
@@ -729,7 +721,7 @@ static void hclge_tm_schd_info_init(struct hclge_dev *hdev)
 
 	hclge_tm_vport_info_update(hdev);
 
-	hclge_pfc_info_init(hdev);
+	hclge_tm_pfc_info_update(hdev);
 }
 
 static int hclge_tm_pg_to_pri_map(struct hclge_dev *hdev)
@@ -1465,19 +1457,6 @@ void hclge_tm_schd_info_update(struct hclge_dev *hdev, u8 num_tc)
 	hclge_tm_schd_info_init(hdev);
 }
 
-void hclge_tm_pfc_info_update(struct hclge_dev *hdev)
-{
-	/* DCB is enabled if we have more than 1 TC or pfc_en is
-	 * non-zero.
-	 */
-	if (hdev->tm_info.num_tc > 1 || hdev->tm_info.pfc_en)
-		hdev->flag |= HCLGE_FLAG_DCB_ENABLE;
-	else
-		hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE;
-
-	hclge_pfc_info_init(hdev);
-}
-
 int hclge_tm_init_hw(struct hclge_dev *hdev, bool init)
 {
 	int ret;
@@ -1523,7 +1502,7 @@ int hclge_tm_vport_map_update(struct hclge_dev *hdev)
 	if (ret)
 		return ret;
 
-	if (!(hdev->flag & HCLGE_FLAG_DCB_ENABLE))
+	if (hdev->tm_info.num_tc == 1 && !hdev->tm_info.pfc_en)
 		return 0;
 
 	return hclge_tm_bp_setup(hdev);

From d4a14faf7919b331d95d87d7d84e36774f9408c4 Mon Sep 17 00:00:00 2001
From: Jian Shen <shenjian15@huawei.com>
Date: Wed, 29 Sep 2021 17:35:53 +0800
Subject: [PATCH 0669/1750] net: hns3: fix show wrong state when add existing
 uc mac address

[ Upstream commit 108b3c7810e14892c4a1819b1d268a2c785c087c ]

Currently, if function adds an existing unicast mac address, eventhough
driver will not add this address into hardware, but it will return 0 in
function hclge_add_uc_addr_common(). It will cause the state of this
unicast mac address is ACTIVE in driver, but it should be in TO-ADD state.

To fix this problem, function hclge_add_uc_addr_common() returns -EEXIST
if mac address is existing, and delete two error log to avoid printing
them all the time after this modification.

Fixes: 72110b567479 ("net: hns3: return 0 and print warning when hit duplicate MAC")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../hisilicon/hns3/hns3pf/hclge_main.c        | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 24357e907155..0e869f449f12 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -7581,15 +7581,8 @@ int hclge_add_uc_addr_common(struct hclge_vport *vport,
 	}
 
 	/* check if we just hit the duplicate */
-	if (!ret) {
-		dev_warn(&hdev->pdev->dev, "VF %u mac(%pM) exists\n",
-			 vport->vport_id, addr);
-		return 0;
-	}
-
-	dev_err(&hdev->pdev->dev,
-		"PF failed to add unicast entry(%pM) in the MAC table\n",
-		addr);
+	if (!ret)
+		return -EEXIST;
 
 	return ret;
 }
@@ -7743,7 +7736,13 @@ static void hclge_sync_vport_mac_list(struct hclge_vport *vport,
 		} else {
 			set_bit(HCLGE_VPORT_STATE_MAC_TBL_CHANGE,
 				&vport->state);
-			break;
+
+			/* If one unicast mac address is existing in hardware,
+			 * we need to try whether other unicast mac addresses
+			 * are new addresses that can be added.
+			 */
+			if (ret != -EEXIST)
+				break;
 		}
 	}
 }

From 8e89876c84b23d79a7ea58c3f5c300695a227570 Mon Sep 17 00:00:00 2001
From: Huazhong Tan <tanhuazhong@huawei.com>
Date: Fri, 26 Mar 2021 09:36:25 +0800
Subject: [PATCH 0670/1750] net: hns3: fix prototype warning

[ Upstream commit a1e144d7dc3c55aa4d451e3a23cd8f34cd65ee01 ]

Correct a report warning in hns3_ethtool.c

Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index c0aa3be0cdfb..0aee100902ff 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -301,7 +301,7 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)
 }
 
 /**
- * hns3_nic_self_test - self test
+ * hns3_self_test - self test
  * @ndev: net device
  * @eth_test: test cmd
  * @data: test result

From 85e4f5d28d25c40965004c225133457f3bcb0ac9 Mon Sep 17 00:00:00 2001
From: Peng Li <lipeng321@huawei.com>
Date: Mon, 30 Aug 2021 14:06:37 +0800
Subject: [PATCH 0671/1750] net: hns3: reconstruct function hns3_self_test

[ Upstream commit 4c8dab1c709c5a715bce14efdb8f4e889d86aa04 ]

This patch reconstructs function hns3_self_test to reduce the code
cycle complexity and make code more concise.

Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/hisilicon/hns3/hns3_ethtool.c    | 101 +++++++++++-------
 1 file changed, 64 insertions(+), 37 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 0aee100902ff..436d777cce06 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -300,33 +300,8 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)
 	return ret_val;
 }
 
-/**
- * hns3_self_test - self test
- * @ndev: net device
- * @eth_test: test cmd
- * @data: test result
- */
-static void hns3_self_test(struct net_device *ndev,
-			   struct ethtool_test *eth_test, u64 *data)
+static void hns3_set_selftest_param(struct hnae3_handle *h, int (*st_param)[2])
 {
-	struct hns3_nic_priv *priv = netdev_priv(ndev);
-	struct hnae3_handle *h = priv->ae_handle;
-	int st_param[HNS3_SELF_TEST_TYPE_NUM][2];
-	bool if_running = netif_running(ndev);
-	int test_index = 0;
-	u32 i;
-
-	if (hns3_nic_resetting(ndev)) {
-		netdev_err(ndev, "dev resetting!");
-		return;
-	}
-
-	/* Only do offline selftest, or pass by default */
-	if (eth_test->flags != ETH_TEST_FL_OFFLINE)
-		return;
-
-	netif_dbg(h, drv, ndev, "self test start");
-
 	st_param[HNAE3_LOOP_APP][0] = HNAE3_LOOP_APP;
 	st_param[HNAE3_LOOP_APP][1] =
 			h->flags & HNAE3_SUPPORT_APP_LOOPBACK;
@@ -343,6 +318,18 @@ static void hns3_self_test(struct net_device *ndev,
 	st_param[HNAE3_LOOP_PHY][0] = HNAE3_LOOP_PHY;
 	st_param[HNAE3_LOOP_PHY][1] =
 			h->flags & HNAE3_SUPPORT_PHY_LOOPBACK;
+}
+
+static void hns3_selftest_prepare(struct net_device *ndev,
+				  bool if_running, int (*st_param)[2])
+{
+	struct hns3_nic_priv *priv = netdev_priv(ndev);
+	struct hnae3_handle *h = priv->ae_handle;
+
+	if (netif_msg_ifdown(h))
+		netdev_info(ndev, "self test start\n");
+
+	hns3_set_selftest_param(h, st_param);
 
 	if (if_running)
 		ndev->netdev_ops->ndo_stop(ndev);
@@ -361,6 +348,35 @@ static void hns3_self_test(struct net_device *ndev,
 		h->ae_algo->ops->halt_autoneg(h, true);
 
 	set_bit(HNS3_NIC_STATE_TESTING, &priv->state);
+}
+
+static void hns3_selftest_restore(struct net_device *ndev, bool if_running)
+{
+	struct hns3_nic_priv *priv = netdev_priv(ndev);
+	struct hnae3_handle *h = priv->ae_handle;
+
+	clear_bit(HNS3_NIC_STATE_TESTING, &priv->state);
+
+	if (h->ae_algo->ops->halt_autoneg)
+		h->ae_algo->ops->halt_autoneg(h, false);
+
+#if IS_ENABLED(CONFIG_VLAN_8021Q)
+	if (h->ae_algo->ops->enable_vlan_filter)
+		h->ae_algo->ops->enable_vlan_filter(h, true);
+#endif
+
+	if (if_running)
+		ndev->netdev_ops->ndo_open(ndev);
+
+	if (netif_msg_ifdown(h))
+		netdev_info(ndev, "self test end\n");
+}
+
+static void hns3_do_selftest(struct net_device *ndev, int (*st_param)[2],
+			     struct ethtool_test *eth_test, u64 *data)
+{
+	int test_index = 0;
+	u32 i;
 
 	for (i = 0; i < HNS3_SELF_TEST_TYPE_NUM; i++) {
 		enum hnae3_loop loop_type = (enum hnae3_loop)st_param[i][0];
@@ -379,21 +395,32 @@ static void hns3_self_test(struct net_device *ndev,
 
 		test_index++;
 	}
+}
 
-	clear_bit(HNS3_NIC_STATE_TESTING, &priv->state);
+/**
+ * hns3_nic_self_test - self test
+ * @ndev: net device
+ * @eth_test: test cmd
+ * @data: test result
+ */
+static void hns3_self_test(struct net_device *ndev,
+			   struct ethtool_test *eth_test, u64 *data)
+{
+	int st_param[HNS3_SELF_TEST_TYPE_NUM][2];
+	bool if_running = netif_running(ndev);
 
-	if (h->ae_algo->ops->halt_autoneg)
-		h->ae_algo->ops->halt_autoneg(h, false);
+	if (hns3_nic_resetting(ndev)) {
+		netdev_err(ndev, "dev resetting!");
+		return;
+	}
 
-#if IS_ENABLED(CONFIG_VLAN_8021Q)
-	if (h->ae_algo->ops->enable_vlan_filter)
-		h->ae_algo->ops->enable_vlan_filter(h, true);
-#endif
+	/* Only do offline selftest, or pass by default */
+	if (eth_test->flags != ETH_TEST_FL_OFFLINE)
+		return;
 
-	if (if_running)
-		ndev->netdev_ops->ndo_open(ndev);
-
-	netif_dbg(h, drv, ndev, "self test end\n");
+	hns3_selftest_prepare(ndev, if_running, st_param);
+	hns3_do_selftest(ndev, st_param, eth_test, data);
+	hns3_selftest_restore(ndev, if_running);
 }
 
 static int hns3_get_sset_count(struct net_device *netdev, int stringset)

From 071febc37e066c9bd6f417179b4f763d0b13437b Mon Sep 17 00:00:00 2001
From: Guangbin Huang <huangguangbin2@huawei.com>
Date: Wed, 29 Sep 2021 17:35:55 +0800
Subject: [PATCH 0672/1750] net: hns3: fix always enable rx vlan filter problem
 after selftest

[ Upstream commit 27bf4af69fcb9845fb2f0076db5d562ec072e70f ]

Currently, the rx vlan filter will always be disabled before selftest and
be enabled after selftest as the rx vlan filter feature is fixed on in
old device earlier than V3.

However, this feature is not fixed in some new devices and it can be
disabled by user. In this case, it is wrong if rx vlan filter is enabled
after selftest. So fix it.

Fixes: bcc26e8dc432 ("net: hns3: remove unused code in hns3_self_test()")
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index 436d777cce06..cd0d7a546957 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -336,7 +336,8 @@ static void hns3_selftest_prepare(struct net_device *ndev,
 
 #if IS_ENABLED(CONFIG_VLAN_8021Q)
 	/* Disable the vlan filter for selftest does not support it */
-	if (h->ae_algo->ops->enable_vlan_filter)
+	if (h->ae_algo->ops->enable_vlan_filter &&
+	    ndev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
 		h->ae_algo->ops->enable_vlan_filter(h, false);
 #endif
 
@@ -361,7 +362,8 @@ static void hns3_selftest_restore(struct net_device *ndev, bool if_running)
 		h->ae_algo->ops->halt_autoneg(h, false);
 
 #if IS_ENABLED(CONFIG_VLAN_8021Q)
-	if (h->ae_algo->ops->enable_vlan_filter)
+	if (h->ae_algo->ops->enable_vlan_filter &&
+	    ndev->features & NETIF_F_HW_VLAN_CTAG_FILTER)
 		h->ae_algo->ops->enable_vlan_filter(h, true);
 #endif
 

From e63f6d8fe74a5e65a77189cc13930630e8e88971 Mon Sep 17 00:00:00 2001
From: Florian Fainelli <f.fainelli@gmail.com>
Date: Tue, 28 Sep 2021 13:32:33 -0700
Subject: [PATCH 0673/1750] net: phy: bcm7xxx: Fixed indirect MMD operations

[ Upstream commit d88fd1b546ff19c8040cfaea76bf16aed1c5a0bb ]

When EEE support was added to the 28nm EPHY it was assumed that it would
be able to support the standard clause 45 over clause 22 register access
method. It turns out that the PHY does not support that, which is the
very reason for using the indirect shadow mode 2 bank 3 access method.

Implement {read,write}_mmd to allow the standard PHY library routines
pertaining to EEE querying and configuration to work correctly on these
PHYs. This forces us to implement a __phy_set_clr_bits() function that
does not grab the MDIO bus lock since the PHY driver's {read,write}_mmd
functions are always called with that lock held.

Fixes: 83ee102a6998 ("net: phy: bcm7xxx: add support for 28nm EPHY")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/bcm7xxx.c | 114 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 110 insertions(+), 4 deletions(-)

diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
index 15812001b3ff..115044e21c74 100644
--- a/drivers/net/phy/bcm7xxx.c
+++ b/drivers/net/phy/bcm7xxx.c
@@ -27,7 +27,12 @@
 #define MII_BCM7XXX_SHD_2_ADDR_CTRL	0xe
 #define MII_BCM7XXX_SHD_2_CTRL_STAT	0xf
 #define MII_BCM7XXX_SHD_2_BIAS_TRIM	0x1a
+#define MII_BCM7XXX_SHD_3_PCS_CTRL	0x0
+#define MII_BCM7XXX_SHD_3_PCS_STATUS	0x1
+#define MII_BCM7XXX_SHD_3_EEE_CAP	0x2
 #define MII_BCM7XXX_SHD_3_AN_EEE_ADV	0x3
+#define MII_BCM7XXX_SHD_3_EEE_LP	0x4
+#define MII_BCM7XXX_SHD_3_EEE_WK_ERR	0x5
 #define MII_BCM7XXX_SHD_3_PCS_CTRL_2	0x6
 #define  MII_BCM7XXX_PCS_CTRL_2_DEF	0x4400
 #define MII_BCM7XXX_SHD_3_AN_STAT	0xb
@@ -216,25 +221,37 @@ static int bcm7xxx_28nm_resume(struct phy_device *phydev)
 	return genphy_config_aneg(phydev);
 }
 
-static int phy_set_clr_bits(struct phy_device *dev, int location,
-					int set_mask, int clr_mask)
+static int __phy_set_clr_bits(struct phy_device *dev, int location,
+			      int set_mask, int clr_mask)
 {
 	int v, ret;
 
-	v = phy_read(dev, location);
+	v = __phy_read(dev, location);
 	if (v < 0)
 		return v;
 
 	v &= ~clr_mask;
 	v |= set_mask;
 
-	ret = phy_write(dev, location, v);
+	ret = __phy_write(dev, location, v);
 	if (ret < 0)
 		return ret;
 
 	return v;
 }
 
+static int phy_set_clr_bits(struct phy_device *dev, int location,
+			    int set_mask, int clr_mask)
+{
+	int ret;
+
+	mutex_lock(&dev->mdio.bus->mdio_lock);
+	ret = __phy_set_clr_bits(dev, location, set_mask, clr_mask);
+	mutex_unlock(&dev->mdio.bus->mdio_lock);
+
+	return ret;
+}
+
 static int bcm7xxx_28nm_ephy_01_afe_config_init(struct phy_device *phydev)
 {
 	int ret;
@@ -398,6 +415,93 @@ static int bcm7xxx_28nm_ephy_config_init(struct phy_device *phydev)
 	return bcm7xxx_28nm_ephy_apd_enable(phydev);
 }
 
+#define MII_BCM7XXX_REG_INVALID	0xff
+
+static u8 bcm7xxx_28nm_ephy_regnum_to_shd(u16 regnum)
+{
+	switch (regnum) {
+	case MDIO_CTRL1:
+		return MII_BCM7XXX_SHD_3_PCS_CTRL;
+	case MDIO_STAT1:
+		return MII_BCM7XXX_SHD_3_PCS_STATUS;
+	case MDIO_PCS_EEE_ABLE:
+		return MII_BCM7XXX_SHD_3_EEE_CAP;
+	case MDIO_AN_EEE_ADV:
+		return MII_BCM7XXX_SHD_3_AN_EEE_ADV;
+	case MDIO_AN_EEE_LPABLE:
+		return MII_BCM7XXX_SHD_3_EEE_LP;
+	case MDIO_PCS_EEE_WK_ERR:
+		return MII_BCM7XXX_SHD_3_EEE_WK_ERR;
+	default:
+		return MII_BCM7XXX_REG_INVALID;
+	}
+}
+
+static bool bcm7xxx_28nm_ephy_dev_valid(int devnum)
+{
+	return devnum == MDIO_MMD_AN || devnum == MDIO_MMD_PCS;
+}
+
+static int bcm7xxx_28nm_ephy_read_mmd(struct phy_device *phydev,
+				      int devnum, u16 regnum)
+{
+	u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum);
+	int ret;
+
+	if (!bcm7xxx_28nm_ephy_dev_valid(devnum) ||
+	    shd == MII_BCM7XXX_REG_INVALID)
+		return -EOPNOTSUPP;
+
+	/* set shadow mode 2 */
+	ret = __phy_set_clr_bits(phydev, MII_BCM7XXX_TEST,
+				 MII_BCM7XXX_SHD_MODE_2, 0);
+	if (ret < 0)
+		return ret;
+
+	/* Access the desired shadow register address */
+	ret = __phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd);
+	if (ret < 0)
+		goto reset_shadow_mode;
+
+	ret = __phy_read(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT);
+
+reset_shadow_mode:
+	/* reset shadow mode 2 */
+	__phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0,
+			   MII_BCM7XXX_SHD_MODE_2);
+	return ret;
+}
+
+static int bcm7xxx_28nm_ephy_write_mmd(struct phy_device *phydev,
+				       int devnum, u16 regnum, u16 val)
+{
+	u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum);
+	int ret;
+
+	if (!bcm7xxx_28nm_ephy_dev_valid(devnum) ||
+	    shd == MII_BCM7XXX_REG_INVALID)
+		return -EOPNOTSUPP;
+
+	/* set shadow mode 2 */
+	ret = __phy_set_clr_bits(phydev, MII_BCM7XXX_TEST,
+				 MII_BCM7XXX_SHD_MODE_2, 0);
+	if (ret < 0)
+		return ret;
+
+	/* Access the desired shadow register address */
+	ret = __phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd);
+	if (ret < 0)
+		goto reset_shadow_mode;
+
+	/* Write the desired value in the shadow register */
+	__phy_write(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT, val);
+
+reset_shadow_mode:
+	/* reset shadow mode 2 */
+	return __phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0,
+				  MII_BCM7XXX_SHD_MODE_2);
+}
+
 static int bcm7xxx_28nm_ephy_resume(struct phy_device *phydev)
 {
 	int ret;
@@ -595,6 +699,8 @@ static void bcm7xxx_28nm_remove(struct phy_device *phydev)
 	.get_stats	= bcm7xxx_28nm_get_phy_stats,			\
 	.probe		= bcm7xxx_28nm_probe,				\
 	.remove		= bcm7xxx_28nm_remove,				\
+	.read_mmd	= bcm7xxx_28nm_ephy_read_mmd,			\
+	.write_mmd	= bcm7xxx_28nm_ephy_write_mmd,			\
 }
 
 #define BCM7XXX_40NM_EPHY(_oui, _name)					\

From d0d520c19e7ea19ed38dc5797b12397b6ccf9f88 Mon Sep 17 00:00:00 2001
From: Vlad Buslov <vladbu@nvidia.com>
Date: Wed, 29 Sep 2021 18:08:49 +0300
Subject: [PATCH 0674/1750] net: sched: flower: protect fl_walk() with rcu

[ Upstream commit d5ef190693a7d76c5c192d108e8dec48307b46ee ]

Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul()
also removed rcu protection of individual filters which causes following
use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain
rcu read lock while iterating and taking the filter reference and temporary
release the lock while calling arg->fn() callback that can sleep.

KASAN trace:

[  352.773640] ==================================================================
[  352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower]
[  352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987

[  352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2
[  352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[  352.781022] Call Trace:
[  352.781573]  dump_stack_lvl+0x46/0x5a
[  352.782332]  print_address_description.constprop.0+0x1f/0x140
[  352.783400]  ? fl_walk+0x159/0x240 [cls_flower]
[  352.784292]  ? fl_walk+0x159/0x240 [cls_flower]
[  352.785138]  kasan_report.cold+0x83/0xdf
[  352.785851]  ? fl_walk+0x159/0x240 [cls_flower]
[  352.786587]  kasan_check_range+0x145/0x1a0
[  352.787337]  fl_walk+0x159/0x240 [cls_flower]
[  352.788163]  ? fl_put+0x10/0x10 [cls_flower]
[  352.789007]  ? __mutex_unlock_slowpath.constprop.0+0x220/0x220
[  352.790102]  tcf_chain_dump+0x231/0x450
[  352.790878]  ? tcf_chain_tp_delete_empty+0x170/0x170
[  352.791833]  ? __might_sleep+0x2e/0xc0
[  352.792594]  ? tfilter_notify+0x170/0x170
[  352.793400]  ? __mutex_unlock_slowpath.constprop.0+0x220/0x220
[  352.794477]  tc_dump_tfilter+0x385/0x4b0
[  352.795262]  ? tc_new_tfilter+0x1180/0x1180
[  352.796103]  ? __mod_node_page_state+0x1f/0xc0
[  352.796974]  ? __build_skb_around+0x10e/0x130
[  352.797826]  netlink_dump+0x2c0/0x560
[  352.798563]  ? netlink_getsockopt+0x430/0x430
[  352.799433]  ? __mutex_unlock_slowpath.constprop.0+0x220/0x220
[  352.800542]  __netlink_dump_start+0x356/0x440
[  352.801397]  rtnetlink_rcv_msg+0x3ff/0x550
[  352.802190]  ? tc_new_tfilter+0x1180/0x1180
[  352.802872]  ? rtnl_calcit.isra.0+0x1f0/0x1f0
[  352.803668]  ? tc_new_tfilter+0x1180/0x1180
[  352.804344]  ? _copy_from_iter_nocache+0x800/0x800
[  352.805202]  ? kasan_set_track+0x1c/0x30
[  352.805900]  netlink_rcv_skb+0xc6/0x1f0
[  352.806587]  ? rht_deferred_worker+0x6b0/0x6b0
[  352.807455]  ? rtnl_calcit.isra.0+0x1f0/0x1f0
[  352.808324]  ? netlink_ack+0x4d0/0x4d0
[  352.809086]  ? netlink_deliver_tap+0x62/0x3d0
[  352.809951]  netlink_unicast+0x353/0x480
[  352.810744]  ? netlink_attachskb+0x430/0x430
[  352.811586]  ? __alloc_skb+0xd7/0x200
[  352.812349]  netlink_sendmsg+0x396/0x680
[  352.813132]  ? netlink_unicast+0x480/0x480
[  352.813952]  ? __import_iovec+0x192/0x210
[  352.814759]  ? netlink_unicast+0x480/0x480
[  352.815580]  sock_sendmsg+0x6c/0x80
[  352.816299]  ____sys_sendmsg+0x3a5/0x3c0
[  352.817096]  ? kernel_sendmsg+0x30/0x30
[  352.817873]  ? __ia32_sys_recvmmsg+0x150/0x150
[  352.818753]  ___sys_sendmsg+0xd8/0x140
[  352.819518]  ? sendmsg_copy_msghdr+0x110/0x110
[  352.820402]  ? ___sys_recvmsg+0xf4/0x1a0
[  352.821110]  ? __copy_msghdr_from_user+0x260/0x260
[  352.821934]  ? _raw_spin_lock+0x81/0xd0
[  352.822680]  ? __handle_mm_fault+0xef3/0x1b20
[  352.823549]  ? rb_insert_color+0x2a/0x270
[  352.824373]  ? copy_page_range+0x16b0/0x16b0
[  352.825209]  ? perf_event_update_userpage+0x2d0/0x2d0
[  352.826190]  ? __fget_light+0xd9/0xf0
[  352.826941]  __sys_sendmsg+0xb3/0x130
[  352.827613]  ? __sys_sendmsg_sock+0x20/0x20
[  352.828377]  ? do_user_addr_fault+0x2c5/0x8a0
[  352.829184]  ? fpregs_assert_state_consistent+0x52/0x60
[  352.830001]  ? exit_to_user_mode_prepare+0x32/0x160
[  352.830845]  do_syscall_64+0x35/0x80
[  352.831445]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  352.832331] RIP: 0033:0x7f7bee973c17
[  352.833078] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10
[  352.836202] RSP: 002b:00007ffcbb368e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  352.837524] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7bee973c17
[  352.838715] RDX: 0000000000000000 RSI: 00007ffcbb368e50 RDI: 0000000000000003
[  352.839838] RBP: 00007ffcbb36d090 R08: 00000000cea96d79 R09: 00007f7beea34a40
[  352.841021] R10: 00000000004059bb R11: 0000000000000246 R12: 000000000046563f
[  352.842208] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffcbb36d088

[  352.843784] Allocated by task 2960:
[  352.844451]  kasan_save_stack+0x1b/0x40
[  352.845173]  __kasan_kmalloc+0x7c/0x90
[  352.845873]  fl_change+0x282/0x22db [cls_flower]
[  352.846696]  tc_new_tfilter+0x6cf/0x1180
[  352.847493]  rtnetlink_rcv_msg+0x471/0x550
[  352.848323]  netlink_rcv_skb+0xc6/0x1f0
[  352.849097]  netlink_unicast+0x353/0x480
[  352.849886]  netlink_sendmsg+0x396/0x680
[  352.850678]  sock_sendmsg+0x6c/0x80
[  352.851398]  ____sys_sendmsg+0x3a5/0x3c0
[  352.852202]  ___sys_sendmsg+0xd8/0x140
[  352.852967]  __sys_sendmsg+0xb3/0x130
[  352.853718]  do_syscall_64+0x35/0x80
[  352.854457]  entry_SYSCALL_64_after_hwframe+0x44/0xae

[  352.855830] Freed by task 7:
[  352.856421]  kasan_save_stack+0x1b/0x40
[  352.857139]  kasan_set_track+0x1c/0x30
[  352.857854]  kasan_set_free_info+0x20/0x30
[  352.858609]  __kasan_slab_free+0xed/0x130
[  352.859348]  kfree+0xa7/0x3c0
[  352.859951]  process_one_work+0x44d/0x780
[  352.860685]  worker_thread+0x2e2/0x7e0
[  352.861390]  kthread+0x1f4/0x220
[  352.862022]  ret_from_fork+0x1f/0x30

[  352.862955] Last potentially related work creation:
[  352.863758]  kasan_save_stack+0x1b/0x40
[  352.864378]  kasan_record_aux_stack+0xab/0xc0
[  352.865028]  insert_work+0x30/0x160
[  352.865617]  __queue_work+0x351/0x670
[  352.866261]  rcu_work_rcufn+0x30/0x40
[  352.866917]  rcu_core+0x3b2/0xdb0
[  352.867561]  __do_softirq+0xf6/0x386

[  352.868708] Second to last potentially related work creation:
[  352.869779]  kasan_save_stack+0x1b/0x40
[  352.870560]  kasan_record_aux_stack+0xab/0xc0
[  352.871426]  call_rcu+0x5f/0x5c0
[  352.872108]  queue_rcu_work+0x44/0x50
[  352.872855]  __fl_put+0x17c/0x240 [cls_flower]
[  352.873733]  fl_delete+0xc7/0x100 [cls_flower]
[  352.874607]  tc_del_tfilter+0x510/0xb30
[  352.886085]  rtnetlink_rcv_msg+0x471/0x550
[  352.886875]  netlink_rcv_skb+0xc6/0x1f0
[  352.887636]  netlink_unicast+0x353/0x480
[  352.888285]  netlink_sendmsg+0x396/0x680
[  352.888942]  sock_sendmsg+0x6c/0x80
[  352.889583]  ____sys_sendmsg+0x3a5/0x3c0
[  352.890311]  ___sys_sendmsg+0xd8/0x140
[  352.891019]  __sys_sendmsg+0xb3/0x130
[  352.891716]  do_syscall_64+0x35/0x80
[  352.892395]  entry_SYSCALL_64_after_hwframe+0x44/0xae

[  352.893666] The buggy address belongs to the object at ffff8881c8251000
                which belongs to the cache kmalloc-2k of size 2048
[  352.895696] The buggy address is located 1152 bytes inside of
                2048-byte region [ffff8881c8251000, ffff8881c8251800)
[  352.897640] The buggy address belongs to the page:
[  352.898492] page:00000000213bac35 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c8250
[  352.900110] head:00000000213bac35 order:3 compound_mapcount:0 compound_pincount:0
[  352.901541] flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff)
[  352.902908] raw: 002ffff800010200 0000000000000000 dead000000000122 ffff888100042f00
[  352.904391] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[  352.905861] page dumped because: kasan: bad access detected

[  352.907323] Memory state around the buggy address:
[  352.908218]  ffff8881c8251380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  352.909471]  ffff8881c8251400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  352.910735] >ffff8881c8251480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  352.912012]                    ^
[  352.912642]  ffff8881c8251500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  352.913919]  ffff8881c8251580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  352.915185] ==================================================================

Fixes: d39d714969cd ("idr: introduce idr_for_each_entry_continue_ul()")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Acked-by: Cong Wang <cong.wang@bytedance.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/cls_flower.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index a5212a3f86e2..8ff6945b9f8f 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -2169,18 +2169,24 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg,
 
 	arg->count = arg->skip;
 
+	rcu_read_lock();
 	idr_for_each_entry_continue_ul(&head->handle_idr, f, tmp, id) {
 		/* don't return filters that are being deleted */
 		if (!refcount_inc_not_zero(&f->refcnt))
 			continue;
+		rcu_read_unlock();
+
 		if (arg->fn(tp, f, arg) < 0) {
 			__fl_put(f);
 			arg->stop = 1;
+			rcu_read_lock();
 			break;
 		}
 		__fl_put(f);
 		arg->count++;
+		rcu_read_lock();
 	}
+	rcu_read_unlock();
 	arg->cookie = id;
 }
 

From 3db53827a0e9130d9e2cbe3c3b5bca601caa4c74 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 29 Sep 2021 15:57:50 -0700
Subject: [PATCH 0675/1750] af_unix: fix races in sk_peer_pid and sk_peer_cred
 accesses

[ Upstream commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b ]

Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations
are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred.

In order to fix this issue, this patch adds a new spinlock that needs
to be used whenever these fields are read or written.

Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently
reading sk->sk_peer_pid which makes no sense, as this field
is only possibly set by AF_UNIX sockets.
We will have to clean this in a separate patch.
This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback"
or implementing what was truly expected.

Fixes: 109f6e39fa07 ("af_unix: Allow SO_PEERCRED to work across namespaces.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jann Horn <jannh@google.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sock.h |  2 ++
 net/core/sock.c    | 32 ++++++++++++++++++++++++++------
 net/unix/af_unix.c | 34 ++++++++++++++++++++++++++++------
 3 files changed, 56 insertions(+), 12 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index 3c7addf95150..cdca984f3630 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -479,8 +479,10 @@ struct sock {
 	u32			sk_ack_backlog;
 	u32			sk_max_ack_backlog;
 	kuid_t			sk_uid;
+	spinlock_t		sk_peer_lock;
 	struct pid		*sk_peer_pid;
 	const struct cred	*sk_peer_cred;
+
 	long			sk_rcvtimeo;
 	ktime_t			sk_stamp;
 #if BITS_PER_LONG==32
diff --git a/net/core/sock.c b/net/core/sock.c
index d638c5361ed2..f9c835167391 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1255,6 +1255,16 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
 }
 EXPORT_SYMBOL(sock_setsockopt);
 
+static const struct cred *sk_get_peer_cred(struct sock *sk)
+{
+	const struct cred *cred;
+
+	spin_lock(&sk->sk_peer_lock);
+	cred = get_cred(sk->sk_peer_cred);
+	spin_unlock(&sk->sk_peer_lock);
+
+	return cred;
+}
 
 static void cred_to_ucred(struct pid *pid, const struct cred *cred,
 			  struct ucred *ucred)
@@ -1428,7 +1438,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 		struct ucred peercred;
 		if (len > sizeof(peercred))
 			len = sizeof(peercred);
+
+		spin_lock(&sk->sk_peer_lock);
 		cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
+		spin_unlock(&sk->sk_peer_lock);
+
 		if (copy_to_user(optval, &peercred, len))
 			return -EFAULT;
 		goto lenout;
@@ -1436,20 +1450,23 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
 
 	case SO_PEERGROUPS:
 	{
+		const struct cred *cred;
 		int ret, n;
 
-		if (!sk->sk_peer_cred)
+		cred = sk_get_peer_cred(sk);
+		if (!cred)
 			return -ENODATA;
 
-		n = sk->sk_peer_cred->group_info->ngroups;
+		n = cred->group_info->ngroups;
 		if (len < n * sizeof(gid_t)) {
 			len = n * sizeof(gid_t);
+			put_cred(cred);
 			return put_user(len, optlen) ? -EFAULT : -ERANGE;
 		}
 		len = n * sizeof(gid_t);
 
-		ret = groups_to_user((gid_t __user *)optval,
-				     sk->sk_peer_cred->group_info);
+		ret = groups_to_user((gid_t __user *)optval, cred->group_info);
+		put_cred(cred);
 		if (ret)
 			return ret;
 		goto lenout;
@@ -1788,9 +1805,10 @@ static void __sk_destruct(struct rcu_head *head)
 		sk->sk_frag.page = NULL;
 	}
 
-	if (sk->sk_peer_cred)
-		put_cred(sk->sk_peer_cred);
+	/* We do not need to acquire sk->sk_peer_lock, we are the last user. */
+	put_cred(sk->sk_peer_cred);
 	put_pid(sk->sk_peer_pid);
+
 	if (likely(sk->sk_net_refcnt))
 		put_net(sock_net(sk));
 	sk_prot_free(sk->sk_prot_creator, sk);
@@ -3000,6 +3018,8 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
 	sk->sk_peer_pid 	=	NULL;
 	sk->sk_peer_cred	=	NULL;
+	spin_lock_init(&sk->sk_peer_lock);
+
 	sk->sk_write_pending	=	0;
 	sk->sk_rcvlowat		=	1;
 	sk->sk_rcvtimeo		=	MAX_SCHEDULE_TIMEOUT;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index d5c0ae34b1e4..b7edca89e0ba 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -593,20 +593,42 @@ static void unix_release_sock(struct sock *sk, int embrion)
 
 static void init_peercred(struct sock *sk)
 {
-	put_pid(sk->sk_peer_pid);
-	if (sk->sk_peer_cred)
-		put_cred(sk->sk_peer_cred);
+	const struct cred *old_cred;
+	struct pid *old_pid;
+
+	spin_lock(&sk->sk_peer_lock);
+	old_pid = sk->sk_peer_pid;
+	old_cred = sk->sk_peer_cred;
 	sk->sk_peer_pid  = get_pid(task_tgid(current));
 	sk->sk_peer_cred = get_current_cred();
+	spin_unlock(&sk->sk_peer_lock);
+
+	put_pid(old_pid);
+	put_cred(old_cred);
 }
 
 static void copy_peercred(struct sock *sk, struct sock *peersk)
 {
-	put_pid(sk->sk_peer_pid);
-	if (sk->sk_peer_cred)
-		put_cred(sk->sk_peer_cred);
+	const struct cred *old_cred;
+	struct pid *old_pid;
+
+	if (sk < peersk) {
+		spin_lock(&sk->sk_peer_lock);
+		spin_lock_nested(&peersk->sk_peer_lock, SINGLE_DEPTH_NESTING);
+	} else {
+		spin_lock(&peersk->sk_peer_lock);
+		spin_lock_nested(&sk->sk_peer_lock, SINGLE_DEPTH_NESTING);
+	}
+	old_pid = sk->sk_peer_pid;
+	old_cred = sk->sk_peer_cred;
 	sk->sk_peer_pid  = get_pid(peersk->sk_peer_pid);
 	sk->sk_peer_cred = get_cred(peersk->sk_peer_cred);
+
+	spin_unlock(&sk->sk_peer_lock);
+	spin_unlock(&peersk->sk_peer_lock);
+
+	put_pid(old_pid);
+	put_cred(old_cred);
 }
 
 static int unix_listen(struct socket *sock, int backlog)

From 7fc5f60a01bbcce366d2180722f2bf71c9e3c3df Mon Sep 17 00:00:00 2001
From: Kan Liang <kan.liang@linux.intel.com>
Date: Tue, 28 Sep 2021 08:19:03 -0700
Subject: [PATCH 0676/1750] perf/x86/intel: Update event constraints for ICX

[ Upstream commit ecc2123e09f9e71ddc6c53d71e283b8ada685fe2 ]

According to the latest event list, the event encoding 0xEF is only
available on the first 4 counters. Add it into the event constraints
table.

Fixes: 6017608936c1 ("perf/x86/intel: Add Icelake support")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/1632842343-25862-1-git-send-email-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/intel/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 3b8b8eede1a8..4684bf9fcc42 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -263,6 +263,7 @@ static struct event_constraint intel_icl_event_constraints[] = {
 	INTEL_EVENT_CONSTRAINT_RANGE(0xa8, 0xb0, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0xb7, 0xbd, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0xd0, 0xe6, 0xf),
+	INTEL_EVENT_CONSTRAINT(0xef, 0xf),
 	INTEL_EVENT_CONSTRAINT_RANGE(0xf0, 0xf4, 0xf),
 	EVENT_CONSTRAINT_END
 };

From 44c600a57d57547a0bb4865f2589cfb26728b524 Mon Sep 17 00:00:00 2001
From: Vadim Pasternak <vadimp@nvidia.com>
Date: Mon, 27 Sep 2021 10:07:40 +0300
Subject: [PATCH 0677/1750] hwmon: (pmbus/mp2975) Add missed POUT attribute for
 page 1 mp2975 controller

[ Upstream commit 2292e2f685cd5c65e3f47bbcf9f469513acc3195 ]

Add missed attribute for reading POUT from page 1.
It is supported by device, but has been missed in initial commit.

Fixes: 2c6fcbb21149 ("hwmon: (pmbus) Add support for MPS Multi-phase mp2975 controller")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20210927070740.2149290-1-vadimp@nvidia.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/mp2975.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/mp2975.c b/drivers/hwmon/pmbus/mp2975.c
index 1c3e2a9453b1..a41fe06e0ad4 100644
--- a/drivers/hwmon/pmbus/mp2975.c
+++ b/drivers/hwmon/pmbus/mp2975.c
@@ -54,7 +54,7 @@
 
 #define MP2975_RAIL2_FUNC	(PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT | \
 				 PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT | \
-				 PMBUS_PHASE_VIRTUAL)
+				 PMBUS_HAVE_POUT | PMBUS_PHASE_VIRTUAL)
 
 struct mp2975_data {
 	struct pmbus_driver_info info;

From 011b4de950d80d9438e67b44622e2a587e097d56 Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Mon, 27 Sep 2021 08:43:06 -0700
Subject: [PATCH 0678/1750] nvme: add command id quirk for apple controllers

commit a2941f6aa71a72be2c82c0a168523a492d093530 upstream.

Some apple controllers use the command id as an index to implementation
specific data structures and will fail if the value is out of bounds.
The nvme driver's recently introduced command sequence number breaks
this controller.

Provide a quirk so these spec incompliant controllers can function as
before. The driver will not have the ability to detect bad completions
when this quirk is used, but we weren't previously checking this anyway.

The quirk bit was selected so that it can readily apply to stable.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=214509
Cc: Sven Peter <sven@svenpeter.dev>
Reported-by: Orlando Chamberlain <redecorating@protonmail.com>
Reported-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Tested-by: Sven Peter <sven@svenpeter.dev>
Link: https://lore.kernel.org/r/20210927154306.387437-1-kbusch@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/core.c | 4 +++-
 drivers/nvme/host/nvme.h | 6 ++++++
 drivers/nvme/host/pci.c  | 3 ++-
 3 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index bbc3efef5027..99b5152482fe 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -831,6 +831,7 @@ EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);
 blk_status_t nvme_setup_cmd(struct nvme_ns *ns, struct request *req,
 		struct nvme_command *cmd)
 {
+	struct nvme_ctrl *ctrl = nvme_req(req)->ctrl;
 	blk_status_t ret = BLK_STS_OK;
 
 	nvme_clear_nvme_request(req);
@@ -877,7 +878,8 @@ blk_status_t nvme_setup_cmd(struct nvme_ns *ns, struct request *req,
 		return BLK_STS_IOERR;
 	}
 
-	nvme_req(req)->genctr++;
+	if (!(ctrl->quirks & NVME_QUIRK_SKIP_CID_GEN))
+		nvme_req(req)->genctr++;
 	cmd->common.command_id = nvme_cid(req);
 	trace_nvme_setup_cmd(req, cmd);
 	return ret;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 8c735c55c15b..5dd1dd8021ba 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -144,6 +144,12 @@ enum nvme_quirks {
 	 * NVMe 1.3 compliance.
 	 */
 	NVME_QUIRK_NO_NS_DESC_LIST		= (1 << 15),
+
+	/*
+	 * The controller requires the command_id value be be limited, so skip
+	 * encoding the generation sequence number.
+	 */
+	NVME_QUIRK_SKIP_CID_GEN			= (1 << 17),
 };
 
 /*
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 09767a805492..d79abb88a0c6 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3259,7 +3259,8 @@ static const struct pci_device_id nvme_id_table[] = {
 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005),
 		.driver_data = NVME_QUIRK_SINGLE_VECTOR |
 				NVME_QUIRK_128_BYTES_SQES |
-				NVME_QUIRK_SHARED_TAGS },
+				NVME_QUIRK_SHARED_TAGS |
+				NVME_QUIRK_SKIP_CID_GEN },
 
 	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
 	{ 0, }

From 15fd3954bca729467675b976e85f54f1d03a2aad Mon Sep 17 00:00:00 2001
From: Chen Jingwen <chenjingwen6@huawei.com>
Date: Tue, 28 Sep 2021 20:56:57 +0800
Subject: [PATCH 0679/1750] elf: don't use MAP_FIXED_NOREPLACE for elf
 interpreter mappings

commit 9b2f72cc0aa4bb444541bb87581c35b7508b37d3 upstream.

In commit b212921b13bd ("elf: don't use MAP_FIXED_NOREPLACE for elf
executable mappings") we still leave MAP_FIXED_NOREPLACE in place for
load_elf_interp.

Unfortunately, this will cause kernel to fail to start with:

    1 (init): Uhuuh, elf segment at 00003ffff7ffd000 requested but the memory is mapped already
    Failed to execute /init (error -17)

The reason is that the elf interpreter (ld.so) has overlapping segments.

  readelf -l ld-2.31.so
  Program Headers:
    Type           Offset             VirtAddr           PhysAddr
                   FileSiz            MemSiz              Flags  Align
    LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000
                   0x000000000002c94c 0x000000000002c94c  R E    0x10000
    LOAD           0x000000000002dae0 0x000000000003dae0 0x000000000003dae0
                   0x00000000000021e8 0x0000000000002320  RW     0x10000
    LOAD           0x000000000002fe00 0x000000000003fe00 0x000000000003fe00
                   0x00000000000011ac 0x0000000000001328  RW     0x10000

The reason for this problem is the same as described in commit
ad55eac74f20 ("elf: enforce MAP_FIXED on overlaying elf segments").

Not only executable binaries, elf interpreters (e.g. ld.so) can have
overlapping elf segments, so we better drop MAP_FIXED_NOREPLACE and go
back to MAP_FIXED in load_elf_interp.

Fixes: 4ed28639519c ("fs, elf: drop MAP_FIXED usage from elf_map")
Cc: <stable@vger.kernel.org> # v4.19
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Michal Hocko <mhocko@suse.com>
Signed-off-by: Chen Jingwen <chenjingwen6@huawei.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/binfmt_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index fa50e8936f5f..04c4aa7a1df2 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -627,7 +627,7 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
 
 			vaddr = eppnt->p_vaddr;
 			if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
-				elf_type |= MAP_FIXED_NOREPLACE;
+				elf_type |= MAP_FIXED;
 			else if (no_base && interp_elf_ex->e_type == ET_DYN)
 				load_addr = -vaddr;
 

From 3bef1b7242e0a344177ba95ddafb3d2c67693ab2 Mon Sep 17 00:00:00 2001
From: Nirmoy Das <nirmoy.das@amd.com>
Date: Thu, 2 Sep 2021 12:29:17 +0200
Subject: [PATCH 0680/1750] debugfs: debugfs_create_file_size(): use IS_ERR to
 check for error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit af505cad9567f7a500d34bf183696d570d7f6810 upstream.

debugfs_create_file() returns encoded error so use IS_ERR for checking
return value.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Nirmoy Das <nirmoy.das@amd.com>
Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL")
Cc: stable <stable@vger.kernel.org>
References: https://gitlab.freedesktop.org/drm/amd/-/issues/1686
Link: https://lore.kernel.org/r/20210902102917.2233-1-nirmoy.das@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/debugfs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 720d65f224f0..848e0aaa8da5 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -524,7 +524,7 @@ void debugfs_create_file_size(const char *name, umode_t mode,
 {
 	struct dentry *de = debugfs_create_file(name, mode, parent, data, fops);
 
-	if (de)
+	if (!IS_ERR(de))
 		d_inode(de)->i_size = file_size;
 }
 EXPORT_SYMBOL_GPL(debugfs_create_file_size);

From 5f6a309a699675680df15d9b6d389114515b4426 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 17 Sep 2021 13:46:17 +0200
Subject: [PATCH 0681/1750] ipack: ipoctal: fix stack information leak

commit a89936cce87d60766a75732a9e7e25c51164f47c upstream.

The tty driver name is used also after registering the driver and must
specifically not be allocated on the stack to avoid leaking information
to user space (or triggering an oops).

Drivers should not try to encode topology information in the tty device
name but this one snuck in through staging without anyone noticing and
another driver has since copied this malpractice.

Fixing the ABI is a separate issue, but this at least plugs the security
hole.

Fixes: ba4dc61fe8c5 ("Staging: ipack: add support for IP-OCTAL mezzanine board")
Cc: stable@vger.kernel.org      # 3.5
Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210917114622.5412-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ipack/devices/ipoctal.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index d480a514c983..ced928afc13c 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -266,7 +266,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
 	int res;
 	int i;
 	struct tty_driver *tty;
-	char name[20];
 	struct ipoctal_channel *channel;
 	struct ipack_region *region;
 	void __iomem *addr;
@@ -357,8 +356,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
 	/* Fill struct tty_driver with ipoctal data */
 	tty->owner = THIS_MODULE;
 	tty->driver_name = KBUILD_MODNAME;
-	sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
-	tty->name = name;
+	tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot);
+	if (!tty->name) {
+		res = -ENOMEM;
+		goto err_put_driver;
+	}
 	tty->major = 0;
 
 	tty->minor_start = 0;
@@ -374,8 +376,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
 	res = tty_register_driver(tty);
 	if (res) {
 		dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n");
-		put_tty_driver(tty);
-		return res;
+		goto err_free_name;
 	}
 
 	/* Save struct tty_driver for use it when uninstalling the device */
@@ -412,6 +413,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
 				       ipoctal_irq_handler, ipoctal);
 
 	return 0;
+
+err_free_name:
+	kfree(tty->name);
+err_put_driver:
+	put_tty_driver(tty);
+
+	return res;
 }
 
 static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel,
@@ -700,6 +708,7 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
 	}
 
 	tty_unregister_driver(ipoctal->tty_drv);
+	kfree(ipoctal->tty_drv->name);
 	put_tty_driver(ipoctal->tty_drv);
 	kfree(ipoctal);
 }

From f46e5db92fa2c28724724a39f1f51e8ca6a78de9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 17 Sep 2021 13:46:18 +0200
Subject: [PATCH 0682/1750] ipack: ipoctal: fix tty registration race

commit 65c001df517a7bf9be8621b53d43c89f426ce8d6 upstream.

Make sure to set the tty class-device driver data before registering the
tty to avoid having a racing open() dereference a NULL pointer.

Fixes: 9c1d784afc6f ("Staging: ipack/devices/ipoctal: Get rid of ipoctal_list.")
Cc: stable@vger.kernel.org      # 3.7
Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210917114622.5412-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ipack/devices/ipoctal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index ced928afc13c..84488dc34942 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -395,13 +395,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
 		spin_lock_init(&channel->lock);
 		channel->pointer_read = 0;
 		channel->pointer_write = 0;
-		tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL);
+		tty_dev = tty_port_register_device_attr(&channel->tty_port, tty,
+							i, NULL, channel, NULL);
 		if (IS_ERR(tty_dev)) {
 			dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n");
 			tty_port_destroy(&channel->tty_port);
 			continue;
 		}
-		dev_set_drvdata(tty_dev, channel);
 	}
 
 	/*

From 67d1df661088b70382cd2499945ad80333c16ba1 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 17 Sep 2021 13:46:19 +0200
Subject: [PATCH 0683/1750] ipack: ipoctal: fix tty-registration error handling

commit cd20d59291d1790dc74248476e928f57fc455189 upstream.

Registration of the ipoctal tty devices is unlikely to fail, but if it
ever does, make sure not to deregister a never registered tty device
(and dereference a NULL pointer) when the driver is later unbound.

Fixes: 2afb41d9d30d ("Staging: ipack/devices/ipoctal: Check tty_register_device return value.")
Cc: stable@vger.kernel.org      # 3.7
Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210917114622.5412-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ipack/devices/ipoctal.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index 84488dc34942..4dd924994bb9 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -35,6 +35,7 @@ struct ipoctal_channel {
 	unsigned int			pointer_read;
 	unsigned int			pointer_write;
 	struct tty_port			tty_port;
+	bool				tty_registered;
 	union scc2698_channel __iomem	*regs;
 	union scc2698_block __iomem	*block_regs;
 	unsigned int			board_id;
@@ -399,9 +400,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
 							i, NULL, channel, NULL);
 		if (IS_ERR(tty_dev)) {
 			dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n");
+			tty_port_free_xmit_buf(&channel->tty_port);
 			tty_port_destroy(&channel->tty_port);
 			continue;
 		}
+		channel->tty_registered = true;
 	}
 
 	/*
@@ -702,6 +705,10 @@ static void __ipoctal_remove(struct ipoctal *ipoctal)
 
 	for (i = 0; i < NR_CHANNELS; i++) {
 		struct ipoctal_channel *channel = &ipoctal->channel[i];
+
+		if (!channel->tty_registered)
+			continue;
+
 		tty_unregister_device(ipoctal->tty_drv, i);
 		tty_port_free_xmit_buf(&channel->tty_port);
 		tty_port_destroy(&channel->tty_port);

From 843efca98e6a24a917585247883d7cc34e9fe077 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 17 Sep 2021 13:46:20 +0200
Subject: [PATCH 0684/1750] ipack: ipoctal: fix missing allocation-failure
 check

commit 445c8132727728dc297492a7d9fc074af3e94ba3 upstream.

Add the missing error handling when allocating the transmit buffer to
avoid dereferencing a NULL pointer in write() should the allocation
ever fail.

Fixes: ba4dc61fe8c5 ("Staging: ipack: add support for IP-OCTAL mezzanine board")
Cc: stable@vger.kernel.org      # 3.5
Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210917114622.5412-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ipack/devices/ipoctal.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index 4dd924994bb9..9e6e105e35aa 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -388,7 +388,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr,
 
 		channel = &ipoctal->channel[i];
 		tty_port_init(&channel->tty_port);
-		tty_port_alloc_xmit_buf(&channel->tty_port);
+		res = tty_port_alloc_xmit_buf(&channel->tty_port);
+		if (res)
+			continue;
 		channel->tty_port.ops = &ipoctal_tty_port_ops;
 
 		ipoctal_reset_stats(&channel->stats);

From 7cea848678470daadbfdaa6a112b823c290f900c Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 17 Sep 2021 13:46:21 +0200
Subject: [PATCH 0685/1750] ipack: ipoctal: fix module reference leak

commit bb8a4fcb2136508224c596a7e665bdba1d7c3c27 upstream.

A reference to the carrier module was taken on every open but was only
released once when the final reference to the tty struct was dropped.

Fix this by taking the module reference and initialising the tty driver
data when installing the tty.

Fixes: 82a82340bab6 ("ipoctal: get carrier driver to avoid rmmod")
Cc: stable@vger.kernel.org      # 3.18
Cc: Federico Vaga <federico.vaga@cern.ch>
Acked-by: Samuel Iglesias Gonsalvez <siglesias@igalia.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210917114622.5412-6-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ipack/devices/ipoctal.c | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c
index 9e6e105e35aa..1f7512c991a3 100644
--- a/drivers/ipack/devices/ipoctal.c
+++ b/drivers/ipack/devices/ipoctal.c
@@ -84,22 +84,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty)
 	return 0;
 }
 
-static int ipoctal_open(struct tty_struct *tty, struct file *file)
+static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty)
 {
 	struct ipoctal_channel *channel = dev_get_drvdata(tty->dev);
 	struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index);
-	int err;
-
-	tty->driver_data = channel;
+	int res;
 
 	if (!ipack_get_carrier(ipoctal->dev))
 		return -EBUSY;
 
-	err = tty_port_open(&channel->tty_port, tty, file);
-	if (err)
-		ipack_put_carrier(ipoctal->dev);
+	res = tty_standard_install(driver, tty);
+	if (res)
+		goto err_put_carrier;
 
-	return err;
+	tty->driver_data = channel;
+
+	return 0;
+
+err_put_carrier:
+	ipack_put_carrier(ipoctal->dev);
+
+	return res;
+}
+
+static int ipoctal_open(struct tty_struct *tty, struct file *file)
+{
+	struct ipoctal_channel *channel = tty->driver_data;
+
+	return tty_port_open(&channel->tty_port, tty, file);
 }
 
 static void ipoctal_reset_stats(struct ipoctal_stats *stats)
@@ -665,6 +677,7 @@ static void ipoctal_cleanup(struct tty_struct *tty)
 
 static const struct tty_operations ipoctal_fops = {
 	.ioctl =		NULL,
+	.install =		ipoctal_install,
 	.open =			ipoctal_open,
 	.close =		ipoctal_close,
 	.write =		ipoctal_write_tty,

From d11502fa26913f84883438c55fab0a8cb0d11474 Mon Sep 17 00:00:00 2001
From: Ritesh Harjani <riteshh@linux.ibm.com>
Date: Sat, 5 Jun 2021 10:39:32 +0530
Subject: [PATCH 0686/1750] ext4: fix loff_t overflow in ext4_max_bitmap_size()

commit 75ca6ad408f459f00b09a64f04c774559848c097 upstream.

We should use unsigned long long rather than loff_t to avoid
overflow in ext4_max_bitmap_size() for comparison before returning.
w/o this patch sbi->s_bitmap_maxbytes was becoming a negative
value due to overflow of upper_limit (with has_huge_files as true)

Below is a quick test to trigger it on a 64KB pagesize system.

sudo mkfs.ext4 -b 65536 -O ^has_extents,^64bit /dev/loop2
sudo mount /dev/loop2 /mnt
sudo echo "hello" > /mnt/hello 	-> This will error out with
				"echo: write error: File too large"

Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Link: https://lore.kernel.org/r/594f409e2c543e90fd836b78188dfa5c575065ba.1622867594.git.riteshh@linux.ibm.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/super.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 099e4afa41e5..e5e896b6200a 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3194,17 +3194,17 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files)
  */
 static loff_t ext4_max_bitmap_size(int bits, int has_huge_files)
 {
-	loff_t res = EXT4_NDIR_BLOCKS;
+	unsigned long long upper_limit, res = EXT4_NDIR_BLOCKS;
 	int meta_blocks;
-	loff_t upper_limit;
-	/* This is calculated to be the largest file size for a dense, block
+
+	/*
+	 * This is calculated to be the largest file size for a dense, block
 	 * mapped file such that the file's total number of 512-byte sectors,
 	 * including data and all indirect blocks, does not exceed (2^48 - 1).
 	 *
 	 * __u32 i_blocks_lo and _u16 i_blocks_high represent the total
 	 * number of 512-byte sectors of the file.
 	 */
-
 	if (!has_huge_files) {
 		/*
 		 * !has_huge_files or implies that the inode i_block field
@@ -3247,7 +3247,7 @@ static loff_t ext4_max_bitmap_size(int bits, int has_huge_files)
 	if (res > MAX_LFS_FILESIZE)
 		res = MAX_LFS_FILESIZE;
 
-	return res;
+	return (loff_t)res;
 }
 
 static ext4_fsblk_t descriptor_loc(struct super_block *sb,

From dc0942168ab3e38e3a6e6368fae3ebc4b5f4ce2d Mon Sep 17 00:00:00 2001
From: Hou Tao <houtao1@huawei.com>
Date: Fri, 20 Aug 2021 12:45:05 +0800
Subject: [PATCH 0687/1750] ext4: limit the number of blocks in one ADD_RANGE
 TLV

commit a2c2f0826e2b75560b31daf1cd9a755ab93cf4c6 upstream.

Now EXT4_FC_TAG_ADD_RANGE uses ext4_extent to track the
newly-added blocks, but the limit on the max value of
ee_len field is ignored, and it can lead to BUG_ON as
shown below when running command "fallocate -l 128M file"
on a fast_commit-enabled fs:

  kernel BUG at fs/ext4/ext4_extents.h:199!
  invalid opcode: 0000 [#1] SMP PTI
  CPU: 3 PID: 624 Comm: fallocate Not tainted 5.14.0-rc6+ #1
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
  RIP: 0010:ext4_fc_write_inode_data+0x1f3/0x200
  Call Trace:
   ? ext4_fc_write_inode+0xf2/0x150
   ext4_fc_commit+0x93b/0xa00
   ? ext4_fallocate+0x1ad/0x10d0
   ext4_sync_file+0x157/0x340
   ? ext4_sync_file+0x157/0x340
   vfs_fsync_range+0x49/0x80
   do_fsync+0x3d/0x70
   __x64_sys_fsync+0x14/0x20
   do_syscall_64+0x3b/0xc0
   entry_SYSCALL_64_after_hwframe+0x44/0xae

Simply fixing it by limiting the number of blocks
in one EXT4_FC_TAG_ADD_RANGE TLV.

Fixes: aa75f4d3daae ("ext4: main fast-commit commit path")
Cc: stable@kernel.org
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210820044505.474318-1-houtao1@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/fast_commit.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c
index 53647fa03877..08ca690f928b 100644
--- a/fs/ext4/fast_commit.c
+++ b/fs/ext4/fast_commit.c
@@ -832,6 +832,12 @@ static int ext4_fc_write_inode_data(struct inode *inode, u32 *crc)
 					    sizeof(lrange), (u8 *)&lrange, crc))
 				return -ENOSPC;
 		} else {
+			unsigned int max = (map.m_flags & EXT4_MAP_UNWRITTEN) ?
+				EXT_UNWRITTEN_MAX_LEN : EXT_INIT_MAX_LEN;
+
+			/* Limit the number of blocks in one extent */
+			map.m_len = min(max, map.m_len);
+
 			fc_ext.fc_ino = cpu_to_le32(inode->i_ino);
 			ex = (struct ext4_extent *)&fc_ext.fc_ex;
 			ex->ee_block = cpu_to_le32(map.m_lblk);

From 9ccf35492b084ecbc916761a5c6f42599450f013 Mon Sep 17 00:00:00 2001
From: Jeffle Xu <jefflexu@linux.alibaba.com>
Date: Mon, 23 Aug 2021 14:13:58 +0800
Subject: [PATCH 0688/1750] ext4: fix reserved space counter leakage

commit 6fed83957f21eff11c8496e9f24253b03d2bc1dc upstream.

When ext4_insert_delayed block receives and recovers from an error from
ext4_es_insert_delayed_block(), e.g., ENOMEM, it does not release the
space it has reserved for that block insertion as it should. One effect
of this bug is that s_dirtyclusters_counter is not decremented and
remains incorrectly elevated until the file system has been unmounted.
This can result in premature ENOSPC returns and apparent loss of free
space.

Another effect of this bug is that
/sys/fs/ext4/<dev>/delayed_allocation_blocks can remain non-zero even
after syncfs has been executed on the filesystem.

Besides, add check for s_dirtyclusters_counter when inode is going to be
evicted and freed. s_dirtyclusters_counter can still keep non-zero until
inode is written back in .evict_inode(), and thus the check is delayed
to .destroy_inode().

Fixes: 51865fda28e5 ("ext4: let ext4 maintain extent status tree")
Cc: stable@kernel.org
Suggested-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Jeffle Xu <jefflexu@linux.alibaba.com>
Reviewed-by: Eric Whitney <enwlinux@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210823061358.84473-1-jefflexu@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/inode.c | 5 +++++
 fs/ext4/super.c | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 18a5321b5ef3..63a292db7587 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1641,6 +1641,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
 	int ret;
 	bool allocated = false;
+	bool reserved = false;
 
 	/*
 	 * If the cluster containing lblk is shared with a delayed,
@@ -1657,6 +1658,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
 		ret = ext4_da_reserve_space(inode);
 		if (ret != 0)   /* ENOSPC */
 			goto errout;
+		reserved = true;
 	} else {   /* bigalloc */
 		if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) {
 			if (!ext4_es_scan_clu(inode,
@@ -1669,6 +1671,7 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
 					ret = ext4_da_reserve_space(inode);
 					if (ret != 0)   /* ENOSPC */
 						goto errout;
+					reserved = true;
 				} else {
 					allocated = true;
 				}
@@ -1679,6 +1682,8 @@ static int ext4_insert_delayed_block(struct inode *inode, ext4_lblk_t lblk)
 	}
 
 	ret = ext4_es_insert_delayed_block(inode, lblk, allocated);
+	if (ret && reserved)
+		ext4_da_release_space(inode, 1);
 
 errout:
 	return ret;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index e5e896b6200a..cbeb02429671 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1356,6 +1356,12 @@ static void ext4_destroy_inode(struct inode *inode)
 				true);
 		dump_stack();
 	}
+
+	if (EXT4_I(inode)->i_reserved_data_blocks)
+		ext4_msg(inode->i_sb, KERN_ERR,
+			 "Inode %lu (%p): i_reserved_data_blocks (%u) not cleared!",
+			 inode->i_ino, EXT4_I(inode),
+			 EXT4_I(inode)->i_reserved_data_blocks);
 }
 
 static void init_once(void *foo)

From a63474dbf692dd09b50fed592bc41f6de5f102fc Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Thu, 2 Sep 2021 11:36:01 -0400
Subject: [PATCH 0689/1750] ext4: add error checking to
 ext4_ext_replay_set_iblocks()

commit 1fd95c05d8f742abfe906620780aee4dbe1a2db0 upstream.

If the call to ext4_map_blocks() fails due to an corrupted file
system, ext4_ext_replay_set_iblocks() can get stuck in an infinite
loop.  This could be reproduced by running generic/526 with a file
system that has inline_data and fast_commit enabled.  The system will
repeatedly log to the console:

EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076

and the stack that it gets stuck in is:

   ext4_block_to_path+0xe3/0x130
   ext4_ind_map_blocks+0x93/0x690
   ext4_map_blocks+0x100/0x660
   skip_hole+0x47/0x70
   ext4_ext_replay_set_iblocks+0x223/0x440
   ext4_fc_replay_inode+0x29e/0x3b0
   ext4_fc_replay+0x278/0x550
   do_one_pass+0x646/0xc10
   jbd2_journal_recover+0x14a/0x270
   jbd2_journal_load+0xc4/0x150
   ext4_load_journal+0x1f3/0x490
   ext4_fill_super+0x22d4/0x2c00

With this patch, generic/526 still fails, but system is no longer
locking up in a tight loop.  It's likely the root casue is that
fast_commit replay is corrupting file systems with inline_data, and we
probably need to add better error handling in the fast commit replay
code path beyond what is done here, which essentially just breaks the
infinite loop without reporting the to the higher levels of the code.

Fixes: 8016E29F4362 ("ext4: fast commit recovery path")
Cc: stable@kernel.org
Cc: Harshad Shirwadkar <harshadshirwadkar@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index e00a35530a4e..aa4d74f9d162 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5907,7 +5907,7 @@ void ext4_ext_replay_shrink_inode(struct inode *inode, ext4_lblk_t end)
 }
 
 /* Check if *cur is a hole and if it is, skip it */
-static void skip_hole(struct inode *inode, ext4_lblk_t *cur)
+static int skip_hole(struct inode *inode, ext4_lblk_t *cur)
 {
 	int ret;
 	struct ext4_map_blocks map;
@@ -5916,9 +5916,12 @@ static void skip_hole(struct inode *inode, ext4_lblk_t *cur)
 	map.m_len = ((inode->i_size) >> inode->i_sb->s_blocksize_bits) - *cur;
 
 	ret = ext4_map_blocks(NULL, inode, &map, 0);
+	if (ret < 0)
+		return ret;
 	if (ret != 0)
-		return;
+		return 0;
 	*cur = *cur + map.m_len;
+	return 0;
 }
 
 /* Count number of blocks used by this inode and update i_blocks */
@@ -5967,7 +5970,9 @@ int ext4_ext_replay_set_iblocks(struct inode *inode)
 	 * iblocks by total number of differences found.
 	 */
 	cur = 0;
-	skip_hole(inode, &cur);
+	ret = skip_hole(inode, &cur);
+	if (ret < 0)
+		goto out;
 	path = ext4_find_extent(inode, cur, NULL, 0);
 	if (IS_ERR(path))
 		goto out;
@@ -5986,8 +5991,12 @@ int ext4_ext_replay_set_iblocks(struct inode *inode)
 		}
 		cur = max(cur + 1, le32_to_cpu(ex->ee_block) +
 					ext4_ext_get_actual_len(ex));
-		skip_hole(inode, &cur);
-
+		ret = skip_hole(inode, &cur);
+		if (ret < 0) {
+			ext4_ext_drop_refs(path);
+			kfree(path);
+			break;
+		}
 		path2 = ext4_find_extent(inode, cur, NULL, 0);
 		if (IS_ERR(path2)) {
 			ext4_ext_drop_refs(path);

From 3770e21f60fc29326a7f3febfa8adc9a3c2dde62 Mon Sep 17 00:00:00 2001
From: yangerkun <yangerkun@huawei.com>
Date: Tue, 14 Sep 2021 19:14:15 +0800
Subject: [PATCH 0690/1750] ext4: fix potential infinite loop in
 ext4_dx_readdir()

commit 42cb447410d024e9d54139ae9c21ea132a8c384c upstream.

When ext4_htree_fill_tree() fails, ext4_dx_readdir() can run into an
infinite loop since if info->last_pos != ctx->pos this will reset the
directory scan and reread the failing entry.  For example:

1. a dx_dir which has 3 block, block 0 as dx_root block, block 1/2 as
   leaf block which own the ext4_dir_entry_2
2. block 1 read ok and call_filldir which will fill the dirent and update
   the ctx->pos
3. block 2 read fail, but we has already fill some dirent, so we will
   return back to userspace will a positive return val(see ksys_getdents64)
4. the second ext4_dx_readdir will reset the world since info->last_pos
   != ctx->pos, and will also init the curr_hash which pos to block 1
5. So we will read block1 too, and once block2 still read fail, we can
   only fill one dirent because the hash of the entry in block1(besides
   the last one) won't greater than curr_hash
6. this time, we forget update last_pos too since the read for block2
   will fail, and since we has got the one entry, ksys_getdents64 can
   return success
7. Latter we will trapped in a loop with step 4~6

Cc: stable@kernel.org
Signed-off-by: yangerkun <yangerkun@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210914111415.3921954-1-yangerkun@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/dir.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
index ca50c90adc4c..70a0f5e56f4d 100644
--- a/fs/ext4/dir.c
+++ b/fs/ext4/dir.c
@@ -534,7 +534,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
 	struct dir_private_info *info = file->private_data;
 	struct inode *inode = file_inode(file);
 	struct fname *fname;
-	int	ret;
+	int ret = 0;
 
 	if (!info) {
 		info = ext4_htree_create_dir_info(file, ctx->pos);
@@ -582,7 +582,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
 						   info->curr_minor_hash,
 						   &info->next_hash);
 			if (ret < 0)
-				return ret;
+				goto finished;
 			if (ret == 0) {
 				ctx->pos = ext4_get_htree_eof(file);
 				break;
@@ -613,7 +613,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx)
 	}
 finished:
 	info->last_pos = ctx->pos;
-	return 0;
+	return ret < 0 ? ret : 0;
 }
 
 static int ext4_dir_open(struct inode * inode, struct file * filp)

From a7f4c633ae120562e91a0891101ed44eaa6c6d1e Mon Sep 17 00:00:00 2001
From: Andrej Shadura <andrew.shadura@collabora.co.uk>
Date: Thu, 16 Sep 2021 17:33:11 +0100
Subject: [PATCH 0691/1750] HID: u2fzero: ignore incomplete packets without
 data

commit 22d65765f211cc83186fd8b87521159f354c0da9 upstream.

Since the actual_length calculation is performed unsigned, packets
shorter than 7 bytes (e.g. packets without data or otherwise truncated)
or non-received packets ("zero" bytes) can cause buffer overflow.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=214437
Fixes: 42337b9d4d958("HID: add driver for U2F Zero built-in LED and RNG")
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-u2fzero.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index 95e0807878c7..d70cd3d7f583 100644
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -198,7 +198,9 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data,
 	}
 
 	ret = u2fzero_recv(dev, &req, &resp);
-	if (ret < 0)
+
+	/* ignore errors or packets without data */
+	if (ret < offsetof(struct u2f_hid_msg, init.data))
 		return 0;
 
 	/* only take the minimum amount of data it is safe to take */

From 5c3a90b6ff75c18d9c8e1701b3b9b56580acfc61 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 27 Sep 2021 17:29:24 -0700
Subject: [PATCH 0692/1750] net: udp: annotate data race around
 udp_sk(sk)->corkflag

commit a9f5970767d11eadc805d5283f202612c7ba1f59 upstream.

up->corkflag field can be read or written without any lock.
Annotate accesses to avoid possible syzbot/KCSAN reports.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/udp.c | 10 +++++-----
 net/ipv6/udp.c |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index e73312546c5a..bd7fd9b1f24c 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1035,7 +1035,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 	__be16 dport;
 	u8  tos;
 	int err, is_udplite = IS_UDPLITE(sk);
-	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
+	int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;
 	int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
 	struct sk_buff *skb;
 	struct ip_options_data opt_copy;
@@ -1343,7 +1343,7 @@ int udp_sendpage(struct sock *sk, struct page *page, int offset,
 	}
 
 	up->len += size;
-	if (!(up->corkflag || (flags&MSG_MORE)))
+	if (!(READ_ONCE(up->corkflag) || (flags&MSG_MORE)))
 		ret = udp_push_pending_frames(sk);
 	if (!ret)
 		ret = size;
@@ -2609,9 +2609,9 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
 	switch (optname) {
 	case UDP_CORK:
 		if (val != 0) {
-			up->corkflag = 1;
+			WRITE_ONCE(up->corkflag, 1);
 		} else {
-			up->corkflag = 0;
+			WRITE_ONCE(up->corkflag, 0);
 			lock_sock(sk);
 			push_pending_frames(sk);
 			release_sock(sk);
@@ -2734,7 +2734,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
 
 	switch (optname) {
 	case UDP_CORK:
-		val = up->corkflag;
+		val = READ_ONCE(up->corkflag);
 		break;
 
 	case UDP_ENCAP:
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index a448b6cd4727..1943ae5103eb 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1288,7 +1288,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 	int addr_len = msg->msg_namelen;
 	bool connected = false;
 	int ulen = len;
-	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
+	int corkreq = READ_ONCE(up->corkflag) || msg->msg_flags&MSG_MORE;
 	int err;
 	int is_udplite = IS_UDPLITE(sk);
 	int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);

From 4ad4852b9adf1345561c202569fe88b0af21eabf Mon Sep 17 00:00:00 2001
From: Shuming Fan <shumingf@realtek.com>
Date: Mon, 8 Feb 2021 17:40:42 -0600
Subject: [PATCH 0693/1750] ASoC: dapm: use component prefix when checking
 widget names

commit ae4fc532244b3bb4d86c397418d980b0c6be1dfd upstream.

On a TigerLake SoundWire platform, we see these warnings:

[   27.360086] rt5682 sdw:0:25d:5682:0: ASoC: DAPM unknown pin MICBIAS
[   27.360092] rt5682 sdw:0:25d:5682:0: ASoC: DAPM unknown pin Vref2

This is root-caused to the addition of a component prefix in the
machine driver. The tests in soc-dapm should account for a prefix
instead of reporting an invalid issue.

Reported-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@linux.intel.com>
Signed-off-by: Shuming Fan <shumingf@realtek.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210208234043.59750-2-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Robert Lee <lerobert@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/soc-dapm.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 148c095df27b..f4b380d6aecf 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2528,9 +2528,20 @@ static struct snd_soc_dapm_widget *dapm_find_widget(
 {
 	struct snd_soc_dapm_widget *w;
 	struct snd_soc_dapm_widget *fallback = NULL;
+	char prefixed_pin[80];
+	const char *pin_name;
+	const char *prefix = soc_dapm_prefix(dapm);
+
+	if (prefix) {
+		snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
+			 prefix, pin);
+		pin_name = prefixed_pin;
+	} else {
+		pin_name = pin;
+	}
 
 	for_each_card_widgets(dapm->card, w) {
-		if (!strcmp(w->name, pin)) {
+		if (!strcmp(w->name, pin_name)) {
 			if (w->dapm == dapm)
 				return w;
 			else

From 28f0fdbac0f52c411763a6bbc475b0643a5d8d28 Mon Sep 17 00:00:00 2001
From: Dongliang Mu <mudongliangabcd@gmail.com>
Date: Wed, 21 Jul 2021 16:14:57 +0800
Subject: [PATCH 0694/1750] usb: hso: remove the bailout parameter

commit dcb713d53e2eadf42b878c12a471e74dc6ed3145 upstream.

There are two invocation sites of hso_free_net_device. After
refactoring hso_create_net_device, this parameter is useless.
Remove the bailout in the hso_free_net_device and change the invocation
sites of this function.

Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[Backport this cleanup patch to 5.10 and 5.14 in order to keep the
codebase consistent with the 4.14/4.19/5.4 patchseries]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/hso.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index df8d4c1e5be7..db484215a78c 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2354,7 +2354,7 @@ static int remove_net_device(struct hso_device *hso_dev)
 }
 
 /* Frees our network device */
-static void hso_free_net_device(struct hso_device *hso_dev, bool bailout)
+static void hso_free_net_device(struct hso_device *hso_dev)
 {
 	int i;
 	struct hso_net *hso_net = dev2net(hso_dev);
@@ -2377,7 +2377,7 @@ static void hso_free_net_device(struct hso_device *hso_dev, bool bailout)
 	kfree(hso_net->mux_bulk_tx_buf);
 	hso_net->mux_bulk_tx_buf = NULL;
 
-	if (hso_net->net && !bailout)
+	if (hso_net->net)
 		free_netdev(hso_net->net);
 
 	kfree(hso_dev);
@@ -3137,7 +3137,7 @@ static void hso_free_interface(struct usb_interface *interface)
 				rfkill_unregister(rfk);
 				rfkill_destroy(rfk);
 			}
-			hso_free_net_device(network_table[i], false);
+			hso_free_net_device(network_table[i]);
 		}
 	}
 }

From 17ccc64e4fa5d3673528474bfeda814d95dc600a Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 26 Aug 2021 16:04:27 +0300
Subject: [PATCH 0695/1750] crypto: ccp - fix resource leaks in
 ccp_run_aes_gcm_cmd()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 505d9dcb0f7ddf9d075e729523a33d38642ae680 upstream.

There are three bugs in this code:

1) If we ccp_init_data() fails for &src then we need to free aad.
   Use goto e_aad instead of goto e_ctx.
2) The label to free the &final_wa was named incorrectly as "e_tag" but
   it should have been "e_final_wa".  One error path leaked &final_wa.
3) The &tag was leaked on one error path.  In that case, I added a free
   before the goto because the resource was local to that block.

Fixes: 36cf515b9bbe ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
Reported-by: "minihanshen(沈明航)" <minihanshen@tencent.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: John Allen <john.allen@amd.com>
Tested-by: John Allen <john.allen@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/ccp/ccp-ops.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index d6a8f4e4b14a..c15625e8ff66 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -778,7 +778,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 				    in_place ? DMA_BIDIRECTIONAL
 					     : DMA_TO_DEVICE);
 		if (ret)
-			goto e_ctx;
+			goto e_aad;
 
 		if (in_place) {
 			dst = src;
@@ -863,7 +863,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 	op.u.aes.size = 0;
 	ret = cmd_q->ccp->vdata->perform->aes(&op);
 	if (ret)
-		goto e_dst;
+		goto e_final_wa;
 
 	if (aes->action == CCP_AES_ACTION_ENCRYPT) {
 		/* Put the ciphered tag after the ciphertext. */
@@ -873,17 +873,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
 		ret = ccp_init_dm_workarea(&tag, cmd_q, authsize,
 					   DMA_BIDIRECTIONAL);
 		if (ret)
-			goto e_tag;
+			goto e_final_wa;
 		ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize);
-		if (ret)
-			goto e_tag;
+		if (ret) {
+			ccp_dm_free(&tag);
+			goto e_final_wa;
+		}
 
 		ret = crypto_memneq(tag.address, final_wa.address,
 				    authsize) ? -EBADMSG : 0;
 		ccp_dm_free(&tag);
 	}
 
-e_tag:
+e_final_wa:
 	ccp_dm_free(&final_wa);
 
 e_dst:

From dedfc35a2de2bae9fa3da8210a05bfd515f83fee Mon Sep 17 00:00:00 2001
From: "F.A.Sulaiman" <asha.16@itfac.mrt.ac.lk>
Date: Tue, 24 Aug 2021 20:37:30 +0530
Subject: [PATCH 0696/1750] HID: betop: fix slab-out-of-bounds Write in
 betop_probe

commit 1e4ce418b1cb1a810256b5fb3fd33d22d1325993 upstream.

Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver.
The problem is the driver assumes the device must have an input report but
some malicious devices violate this assumption.

So this patch checks hid_device's input is non empty before it's been used.

Reported-by: syzbot+07efed3bc5a1407bd742@syzkaller.appspotmail.com
Signed-off-by: F.A. SULAIMAN <asha.16@itfac.mrt.ac.lk>
Reviewed-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-betopff.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c
index 0790fbd3fc9a..467d789f9bc2 100644
--- a/drivers/hid/hid-betopff.c
+++ b/drivers/hid/hid-betopff.c
@@ -56,15 +56,22 @@ static int betopff_init(struct hid_device *hid)
 {
 	struct betopff_device *betopff;
 	struct hid_report *report;
-	struct hid_input *hidinput =
-			list_first_entry(&hid->inputs, struct hid_input, list);
+	struct hid_input *hidinput;
 	struct list_head *report_list =
 			&hid->report_enum[HID_OUTPUT_REPORT].report_list;
-	struct input_dev *dev = hidinput->input;
+	struct input_dev *dev;
 	int field_count = 0;
 	int error;
 	int i, j;
 
+	if (list_empty(&hid->inputs)) {
+		hid_err(hid, "no inputs found\n");
+		return -ENODEV;
+	}
+
+	hidinput = list_first_entry(&hid->inputs, struct hid_input, list);
+	dev = hidinput->input;
+
 	if (list_empty(report_list)) {
 		hid_err(hid, "no output reports found\n");
 		return -ENODEV;

From da5b8b9319f044c2ca24f6602c54033931e0c1cc Mon Sep 17 00:00:00 2001
From: Jozsef Kadlecsik <kadlec@netfilter.org>
Date: Mon, 6 Sep 2021 18:26:34 +0200
Subject: [PATCH 0697/1750] netfilter: ipset: Fix oversized kvmalloc() calls

commit 7bbc3d385bd813077acaf0e6fdb2a86a901f5382 upstream.

The commit

commit 7661809d493b426e979f39ab512e3adf41fbcc69
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Jul 14 09:45:49 2021 -0700

    mm: don't allow oversized kvmalloc() calls

limits the max allocatable memory via kvmalloc() to MAX_INT. Apply the
same limit in ipset.

Reported-by: syzbot+3493b1873fb3ea827986@syzkaller.appspotmail.com
Reported-by: syzbot+2b8443c35458a617c904@syzkaller.appspotmail.com
Reported-by: syzbot+ee5cb15f4a0e85e0d54e@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 7cd1d31fb2b8..b0670388da49 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -132,11 +132,11 @@ htable_size(u8 hbits)
 {
 	size_t hsize;
 
-	/* We must fit both into u32 in jhash and size_t */
+	/* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */
 	if (hbits > 31)
 		return 0;
 	hsize = jhash_size(hbits);
-	if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *)
+	if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *)
 	    < hsize)
 		return 0;
 

From 57a269a1b12a3a6fe51f62e1be5e74494bad1d92 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Wed, 14 Jul 2021 09:45:49 -0700
Subject: [PATCH 0698/1750] mm: don't allow oversized kvmalloc() calls

commit 7661809d493b426e979f39ab512e3adf41fbcc69 upstream.

'kvmalloc()' is a convenience function for people who want to do a
kmalloc() but fall back on vmalloc() if there aren't enough physically
contiguous pages, or if the allocation is larger than what kmalloc()
supports.

However, let's make sure it doesn't get _too_ easy to do crazy things
with it.  In particular, don't allow big allocations that could be due
to integer overflow or underflow.  So make sure the allocation size fits
in an 'int', to protect against trivial integer conversion issues.

Acked-by: Willy Tarreau <w@1wt.eu>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/util.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/util.c b/mm/util.c
index d5be67771850..90792e4eaa25 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -581,6 +581,10 @@ void *kvmalloc_node(size_t size, gfp_t flags, int node)
 	if (ret || size <= PAGE_SIZE)
 		return ret;
 
+	/* Don't even allow crazy sizes */
+	if (WARN_ON_ONCE(size > INT_MAX))
+		return NULL;
+
 	return __vmalloc_node(size, 1, flags, node,
 			__builtin_return_address(0));
 }

From f7ac4d24e1610b92689946fa88177673f1e88a3f Mon Sep 17 00:00:00 2001
From: Anirudh Rayabharam <mail@anirudhrb.com>
Date: Thu, 24 Jun 2021 00:10:29 +0530
Subject: [PATCH 0699/1750] HID: usbhid: free raw_report buffers in usbhid_stop

commit f7744fa16b96da57187dc8e5634152d3b63d72de upstream.

Free the unsent raw_report buffers when the device is removed.

Fixes a memory leak reported by syzbot at:
https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47

Reported-by: syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com
Tested-by: syzbot+47b26cd837ececfc666d@syzkaller.appspotmail.com
Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/usbhid/hid-core.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 8d4ac4b9fb9d..009a0469d54f 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -503,7 +503,7 @@ static void hid_ctrl(struct urb *urb)
 
 	if (unplug) {
 		usbhid->ctrltail = usbhid->ctrlhead;
-	} else {
+	} else if (usbhid->ctrlhead != usbhid->ctrltail) {
 		usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1);
 
 		if (usbhid->ctrlhead != usbhid->ctrltail &&
@@ -1221,9 +1221,20 @@ static void usbhid_stop(struct hid_device *hid)
 	mutex_lock(&usbhid->mutex);
 
 	clear_bit(HID_STARTED, &usbhid->iofl);
+
 	spin_lock_irq(&usbhid->lock);	/* Sync with error and led handlers */
 	set_bit(HID_DISCONNECTED, &usbhid->iofl);
+	while (usbhid->ctrltail != usbhid->ctrlhead) {
+		if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) {
+			kfree(usbhid->ctrl[usbhid->ctrltail].raw_report);
+			usbhid->ctrl[usbhid->ctrltail].raw_report = NULL;
+		}
+
+		usbhid->ctrltail = (usbhid->ctrltail + 1) &
+			(HID_CONTROL_FIFO_SIZE - 1);
+	}
 	spin_unlock_irq(&usbhid->lock);
+
 	usb_kill_urb(usbhid->urbin);
 	usb_kill_urb(usbhid->urbout);
 	usb_kill_urb(usbhid->urbctrl);

From deb2949417677649e2413266d7ce8c2ff73952b4 Mon Sep 17 00:00:00 2001
From: Haimin Zhang <tcs_kernel@tencent.com>
Date: Fri, 3 Sep 2021 10:37:06 +0800
Subject: [PATCH 0700/1750] KVM: x86: Handle SRCU initialization failure during
 page track init

commit eb7511bf9182292ef1df1082d23039e856d1ddfb upstream.

Check the return of init_srcu_struct(), which can fail due to OOM, when
initializing the page track mechanism.  Lack of checking leads to a NULL
pointer deref found by a modified syzkaller.

Reported-by: TCS Robot <tcs_robot@tencent.com>
Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
Message-Id: <1630636626-12262-1-git-send-email-tcs_kernel@tencent.com>
[Move the call towards the beginning of kvm_arch_init_vm. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/kvm_page_track.h | 2 +-
 arch/x86/kvm/mmu/page_track.c         | 4 ++--
 arch/x86/kvm/x86.c                    | 7 ++++++-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/arch/x86/include/asm/kvm_page_track.h b/arch/x86/include/asm/kvm_page_track.h
index 87bd6025d91d..6a5f3acf2b33 100644
--- a/arch/x86/include/asm/kvm_page_track.h
+++ b/arch/x86/include/asm/kvm_page_track.h
@@ -46,7 +46,7 @@ struct kvm_page_track_notifier_node {
 			    struct kvm_page_track_notifier_node *node);
 };
 
-void kvm_page_track_init(struct kvm *kvm);
+int kvm_page_track_init(struct kvm *kvm);
 void kvm_page_track_cleanup(struct kvm *kvm);
 
 void kvm_page_track_free_memslot(struct kvm_memory_slot *slot);
diff --git a/arch/x86/kvm/mmu/page_track.c b/arch/x86/kvm/mmu/page_track.c
index 8443a675715b..81cf4babbd0b 100644
--- a/arch/x86/kvm/mmu/page_track.c
+++ b/arch/x86/kvm/mmu/page_track.c
@@ -163,13 +163,13 @@ void kvm_page_track_cleanup(struct kvm *kvm)
 	cleanup_srcu_struct(&head->track_srcu);
 }
 
-void kvm_page_track_init(struct kvm *kvm)
+int kvm_page_track_init(struct kvm *kvm)
 {
 	struct kvm_page_track_notifier_head *head;
 
 	head = &kvm->arch.track_notifier_head;
-	init_srcu_struct(&head->track_srcu);
 	INIT_HLIST_HEAD(&head->track_notifier_list);
+	return init_srcu_struct(&head->track_srcu);
 }
 
 /*
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 75c59ad27e9f..d65da3b5837b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10392,9 +10392,15 @@ void kvm_arch_free_vm(struct kvm *kvm)
 
 int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 {
+	int ret;
+
 	if (type)
 		return -EINVAL;
 
+	ret = kvm_page_track_init(kvm);
+	if (ret)
+		return ret;
+
 	INIT_HLIST_HEAD(&kvm->arch.mask_notifier_list);
 	INIT_LIST_HEAD(&kvm->arch.active_mmu_pages);
 	INIT_LIST_HEAD(&kvm->arch.zapped_obsolete_pages);
@@ -10421,7 +10427,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type)
 	INIT_DELAYED_WORK(&kvm->arch.kvmclock_sync_work, kvmclock_sync_fn);
 
 	kvm_hv_init_vm(kvm);
-	kvm_page_track_init(kvm);
 	kvm_mmu_init_vm(kvm);
 
 	return kvm_x86_ops.vm_init(kvm);

From e2d192301a0df8160d1555b66ae8611e8050e424 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 17 Sep 2021 15:15:56 -0700
Subject: [PATCH 0701/1750] netfilter: conntrack: serialize hash resizes and
 cleanups

commit e9edc188fc76499b0b9bd60364084037f6d03773 upstream.

Syzbot was able to trigger the following warning [1]

No repro found by syzbot yet but I was able to trigger similar issue
by having 2 scripts running in parallel, changing conntrack hash sizes,
and:

for j in `seq 1 1000` ; do unshare -n /bin/true >/dev/null ; done

It would take more than 5 minutes for net_namespace structures
to be cleaned up.

This is because nf_ct_iterate_cleanup() has to restart everytime
a resize happened.

By adding a mutex, we can serialize hash resizes and cleanups
and also make get_next_corpse() faster by skipping over empty
buckets.

Even without resizes in the picture, this patch considerably
speeds up network namespace dismantles.

[1]
INFO: task syz-executor.0:8312 can't die for more than 144 seconds.
task:syz-executor.0  state:R  running task     stack:25672 pid: 8312 ppid:  6573 flags:0x00004006
Call Trace:
 context_switch kernel/sched/core.c:4955 [inline]
 __schedule+0x940/0x26f0 kernel/sched/core.c:6236
 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6408
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
 __local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 get_next_corpse net/netfilter/nf_conntrack_core.c:2252 [inline]
 nf_ct_iterate_cleanup+0x15a/0x450 net/netfilter/nf_conntrack_core.c:2275
 nf_conntrack_cleanup_net_list+0x14c/0x4f0 net/netfilter/nf_conntrack_core.c:2469
 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171
 setup_net+0x639/0xa30 net/core/net_namespace.c:349
 copy_net_ns+0x319/0x760 net/core/net_namespace.c:470
 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x445/0x920 kernel/fork.c:3128
 __do_sys_unshare kernel/fork.c:3202 [inline]
 __se_sys_unshare kernel/fork.c:3200 [inline]
 __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3200
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f63da68e739
RSP: 002b:00007f63d7c05188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f63da792f80 RCX: 00007f63da68e739
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f63da6e8cc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f63da792f80
R13: 00007fff50b75d3f R14: 00007f63d7c05300 R15: 0000000000022000

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8b980020 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446
2 locks held by kworker/u4:2/153:
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
 #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268
 #1: ffffc9000140fdb0 ((kfence_timer).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272
1 lock held by systemd-udevd/2970:
1 lock held by in:imklog/6258:
 #0: ffff88807f970ff0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990
3 locks held by kworker/1:6/8158:
1 lock held by syz-executor.0/8312:
2 locks held by kworker/u4:13/9320:
1 lock held by syz-executor.5/10178:
1 lock held by syz-executor.4/10217:

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_conntrack_core.c | 70 ++++++++++++++++---------------
 1 file changed, 37 insertions(+), 33 deletions(-)

diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 54430a34d2f6..6a66e9945935 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -75,6 +75,9 @@ static __read_mostly struct kmem_cache *nf_conntrack_cachep;
 static DEFINE_SPINLOCK(nf_conntrack_locks_all_lock);
 static __read_mostly bool nf_conntrack_locks_all;
 
+/* serialize hash resizes and nf_ct_iterate_cleanup */
+static DEFINE_MUTEX(nf_conntrack_mutex);
+
 #define GC_SCAN_INTERVAL	(120u * HZ)
 #define GC_SCAN_MAX_DURATION	msecs_to_jiffies(10)
 
@@ -2173,28 +2176,31 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
 	spinlock_t *lockp;
 
 	for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
+		struct hlist_nulls_head *hslot = &nf_conntrack_hash[*bucket];
+
+		if (hlist_nulls_empty(hslot))
+			continue;
+
 		lockp = &nf_conntrack_locks[*bucket % CONNTRACK_LOCKS];
 		local_bh_disable();
 		nf_conntrack_lock(lockp);
-		if (*bucket < nf_conntrack_htable_size) {
-			hlist_nulls_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnnode) {
-				if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY)
-					continue;
-				/* All nf_conn objects are added to hash table twice, one
-				 * for original direction tuple, once for the reply tuple.
-				 *
-				 * Exception: In the IPS_NAT_CLASH case, only the reply
-				 * tuple is added (the original tuple already existed for
-				 * a different object).
-				 *
-				 * We only need to call the iterator once for each
-				 * conntrack, so we just use the 'reply' direction
-				 * tuple while iterating.
-				 */
-				ct = nf_ct_tuplehash_to_ctrack(h);
-				if (iter(ct, data))
-					goto found;
-			}
+		hlist_nulls_for_each_entry(h, n, hslot, hnnode) {
+			if (NF_CT_DIRECTION(h) != IP_CT_DIR_REPLY)
+				continue;
+			/* All nf_conn objects are added to hash table twice, one
+			 * for original direction tuple, once for the reply tuple.
+			 *
+			 * Exception: In the IPS_NAT_CLASH case, only the reply
+			 * tuple is added (the original tuple already existed for
+			 * a different object).
+			 *
+			 * We only need to call the iterator once for each
+			 * conntrack, so we just use the 'reply' direction
+			 * tuple while iterating.
+			 */
+			ct = nf_ct_tuplehash_to_ctrack(h);
+			if (iter(ct, data))
+				goto found;
 		}
 		spin_unlock(lockp);
 		local_bh_enable();
@@ -2212,26 +2218,20 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
 static void nf_ct_iterate_cleanup(int (*iter)(struct nf_conn *i, void *data),
 				  void *data, u32 portid, int report)
 {
-	unsigned int bucket = 0, sequence;
+	unsigned int bucket = 0;
 	struct nf_conn *ct;
 
 	might_sleep();
 
-	for (;;) {
-		sequence = read_seqcount_begin(&nf_conntrack_generation);
+	mutex_lock(&nf_conntrack_mutex);
+	while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
+		/* Time to push up daises... */
 
-		while ((ct = get_next_corpse(iter, data, &bucket)) != NULL) {
-			/* Time to push up daises... */
-
-			nf_ct_delete(ct, portid, report);
-			nf_ct_put(ct);
-			cond_resched();
-		}
-
-		if (!read_seqcount_retry(&nf_conntrack_generation, sequence))
-			break;
-		bucket = 0;
+		nf_ct_delete(ct, portid, report);
+		nf_ct_put(ct);
+		cond_resched();
 	}
+	mutex_unlock(&nf_conntrack_mutex);
 }
 
 struct iter_data {
@@ -2461,8 +2461,10 @@ int nf_conntrack_hash_resize(unsigned int hashsize)
 	if (!hash)
 		return -ENOMEM;
 
+	mutex_lock(&nf_conntrack_mutex);
 	old_size = nf_conntrack_htable_size;
 	if (old_size == hashsize) {
+		mutex_unlock(&nf_conntrack_mutex);
 		kvfree(hash);
 		return 0;
 	}
@@ -2498,6 +2500,8 @@ int nf_conntrack_hash_resize(unsigned int hashsize)
 	nf_conntrack_all_unlock();
 	local_bh_enable();
 
+	mutex_unlock(&nf_conntrack_mutex);
+
 	synchronize_net();
 	kvfree(old_hash);
 	return 0;

From 96f439a7eda6e80b1f45a97da7d3020b259b04a4 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 13 Sep 2021 20:38:52 +0200
Subject: [PATCH 0702/1750] netfilter: nf_tables: Fix oversized kvmalloc()
 calls

commit 45928afe94a094bcda9af858b96673d59bc4a0e9 upstream.

The commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls")
limits the max allocatable memory via kvmalloc() to MAX_INT.

Reported-by: syzbot+cd43695a64bcd21b8596@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/nf_tables_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index c605a3e713e7..b781ba97c474 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4265,7 +4265,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
 	if (ops->privsize != NULL)
 		size = ops->privsize(nla, &desc);
 	alloc_size = sizeof(*set) + size + udlen;
-	if (alloc_size < size)
+	if (alloc_size < size || alloc_size > INT_MAX)
 		return -ENOMEM;
 	set = kvzalloc(alloc_size, GFP_KERNEL);
 	if (!set)

From 5cd40b137cba45a5a3d0b9a8554f779a3e0e93b4 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 6 Oct 2021 15:56:04 +0200
Subject: [PATCH 0703/1750] Linux 5.10.71

Link: https://lore.kernel.org/r/20211004125034.579439135@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20211005083301.812942169@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: SSalvatore Bonaccorso <carnil@debian.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 4a9541a18618..1637ff7c1b75 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 70
+SUBLEVEL = 71
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 627dc3c79c3b3df5d2d3588bb8fde54ae01ca02d Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Thu, 7 Oct 2021 15:45:28 +0200
Subject: [PATCH 0704/1750] ANDROID: Fix up KABI breakage in 5.10.71 in struct
 sock

Commit 35306eb23814 ("af_unix: fix races in sk_peer_pid and sk_peer_cred
accesses") was backported to 5.10.71 and it adds a new field to struct
sock.  We want to keep this commit, so rework it using the reserved
fields we have set up for this very issue.

However, putting a spinlock_t into a 64bit value breaks when building
with some debugging options enabled, so we have to disable them when
doing build testing for the allmodconfig builds.  In order to do that,
the following config options are forced off:
	DEBUG_SPINLOCK
	DEBUG_LOCK_ALLOC
	LOCK_STAT
	DEBUG_WW_MUTEX_SLOWPATH
	DEBUG_LOCK_ALLOC
	PROVE_LOCKING

We only really want to disable DEBUG_SPINLOCK and DEBUG_LOCK_ALLOC as
those affect the size of spinlock_t, but the other options need to be
disabled as well because they try to force on the locking debug config
options when selected.

Note, this does not affect any device's behavior, those options are only
being disabled for the test systems when doing allmodconfig builds.
They are not enabled in the normal GKI builds, so all is fine there.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I23df70a6bcbbc9d773e790cdf0377c1c67cdf682
---
 build.config.allmodconfig | 6 ++++++
 include/net/sock.h        | 3 +--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/build.config.allmodconfig b/build.config.allmodconfig
index a48f8d420208..3e563fe1c89f 100644
--- a/build.config.allmodconfig
+++ b/build.config.allmodconfig
@@ -8,6 +8,12 @@ function update_config() {
          -d TEST_KMOD  \
          -d CPU_BIG_ENDIAN \
          -d DYNAMIC_FTRACE \
+         -d DEBUG_SPINLOCK \
+         -d DEBUG_LOCK_ALLOC \
+         -d LOCK_STAT \
+         -d DEBUG_WW_MUTEX_SLOWPATH \
+         -d DEBUG_LOCK_ALLOC \
+         -d PROVE_LOCKING \
          -e UNWINDER_FRAME_POINTER \
 
     (cd ${OUT_DIR} && \
diff --git a/include/net/sock.h b/include/net/sock.h
index 2032afc8a75b..a55ab1b481f5 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -481,7 +481,6 @@ struct sock {
 	u32			sk_ack_backlog;
 	u32			sk_max_ack_backlog;
 	kuid_t			sk_uid;
-	spinlock_t		sk_peer_lock;
 	struct pid		*sk_peer_pid;
 	const struct cred	*sk_peer_cred;
 
@@ -525,7 +524,7 @@ struct sock {
 #endif
 	struct rcu_head		sk_rcu;
 
-	ANDROID_KABI_RESERVE(1);
+	ANDROID_KABI_USE(1, spinlock_t sk_peer_lock);
 	ANDROID_KABI_RESERVE(2);
 	ANDROID_KABI_RESERVE(3);
 	ANDROID_KABI_RESERVE(4);

From 2ababcd8c2ababe7f11032b928b9e8ab35af5e8c Mon Sep 17 00:00:00 2001
From: Tobias Schramm <t.schramm@manjaro.org>
Date: Fri, 27 Aug 2021 07:03:57 +0200
Subject: [PATCH 0705/1750] spi: rockchip: handle zero length transfers without
 timing out

[ Upstream commit 5457773ef99f25fcc4b238ac76b68e28273250f4 ]

Previously zero length transfers submitted to the Rokchip SPI driver would
time out in the SPI layer. This happens because the SPI peripheral does
not trigger a transfer completion interrupt for zero length transfers.

Fix that by completing zero length transfers immediately at start of
transfer.

Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
Link: https://lore.kernel.org/r/20210827050357.165409-1-t.schramm@manjaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-rockchip.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index 0aab37cd64e7..624273d0e727 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -582,6 +582,12 @@ static int rockchip_spi_transfer_one(
 	int ret;
 	bool use_dma;
 
+	/* Zero length transfers won't trigger an interrupt on completion */
+	if (!xfer->len) {
+		spi_finalize_current_transfer(ctlr);
+		return 1;
+	}
+
 	WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
 		(readl_relaxed(rs->regs + ROCKCHIP_SPI_SR) & SR_BUSY));
 

From e5611503249fd0cfa0c8262ee18cca39865ed972 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 5 Sep 2021 15:02:09 +0200
Subject: [PATCH 0706/1750] platform/x86: touchscreen_dmi: Add info for the
 Chuwi HiBook (CWI514) tablet

[ Upstream commit 3bf1669b0e033c885ebcb1ddc2334088dd125f2d ]

Add touchscreen info for the Chuwi HiBook (CWI514) tablet. This includes
info for getting the firmware directly from the UEFI, so that the user does
not need to manually install the firmware in /lib/firmware/silead.

This change will make the touchscreen on these devices work OOTB,
without requiring any manual setup.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210905130210.32810-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/touchscreen_dmi.c | 37 ++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
index 99260915122c..4f5d53b585db 100644
--- a/drivers/platform/x86/touchscreen_dmi.c
+++ b/drivers/platform/x86/touchscreen_dmi.c
@@ -141,6 +141,33 @@ static const struct ts_dmi_data chuwi_hi10_pro_data = {
 	.properties     = chuwi_hi10_pro_props,
 };
 
+static const struct property_entry chuwi_hibook_props[] = {
+	PROPERTY_ENTRY_U32("touchscreen-min-x", 30),
+	PROPERTY_ENTRY_U32("touchscreen-min-y", 4),
+	PROPERTY_ENTRY_U32("touchscreen-size-x", 1892),
+	PROPERTY_ENTRY_U32("touchscreen-size-y", 1276),
+	PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"),
+	PROPERTY_ENTRY_BOOL("touchscreen-swapped-x-y"),
+	PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-chuwi-hibook.fw"),
+	PROPERTY_ENTRY_U32("silead,max-fingers", 10),
+	PROPERTY_ENTRY_BOOL("silead,home-button"),
+	{ }
+};
+
+static const struct ts_dmi_data chuwi_hibook_data = {
+	.embedded_fw = {
+		.name	= "silead/gsl1680-chuwi-hibook.fw",
+		.prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 },
+		.length	= 40392,
+		.sha256	= { 0xf7, 0xc0, 0xe8, 0x5a, 0x6c, 0xf2, 0xeb, 0x8d,
+			    0x12, 0xc4, 0x45, 0xbf, 0x55, 0x13, 0x4c, 0x1a,
+			    0x13, 0x04, 0x31, 0x08, 0x65, 0x73, 0xf7, 0xa8,
+			    0x1b, 0x7d, 0x59, 0xc9, 0xe6, 0x97, 0xf7, 0x38 },
+	},
+	.acpi_name      = "MSSL0017:00",
+	.properties     = chuwi_hibook_props,
+};
+
 static const struct property_entry chuwi_vi8_props[] = {
 	PROPERTY_ENTRY_U32("touchscreen-min-x", 4),
 	PROPERTY_ENTRY_U32("touchscreen-min-y", 6),
@@ -936,6 +963,16 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
 			DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
 		},
 	},
+	{
+		/* Chuwi HiBook (CWI514) */
+		.driver_data = (void *)&chuwi_hibook_data,
+		.matches = {
+			DMI_MATCH(DMI_BOARD_VENDOR, "Hampoo"),
+			DMI_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
+			/* Above matches are too generic, add bios-date match */
+			DMI_MATCH(DMI_BIOS_DATE, "05/07/2016"),
+		},
+	},
 	{
 		/* Chuwi Vi8 (CWI506) */
 		.driver_data = (void *)&chuwi_vi8_data,

From f986cf270284e0dff977d95b33deebb590708583 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 5 Sep 2021 15:02:10 +0200
Subject: [PATCH 0707/1750] platform/x86: touchscreen_dmi: Update info for the
 Chuwi Hi10 Plus (CWI527) tablet

[ Upstream commit 196159d278ae3b49e7bbb7c76822e6008fd89b97 ]

Add info for getting the firmware directly from the UEFI for the Chuwi Hi10
Plus (CWI527), so that the user does not need to manually install the
firmware in /lib/firmware/silead.

This change will make the touchscreen on these devices work OOTB,
without requiring any manual setup.

Also tweak the min and width/height values a bit for more accurate position
reporting.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210905130210.32810-2-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/touchscreen_dmi.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
index 4f5d53b585db..59b7e90cd587 100644
--- a/drivers/platform/x86/touchscreen_dmi.c
+++ b/drivers/platform/x86/touchscreen_dmi.c
@@ -100,10 +100,10 @@ static const struct ts_dmi_data chuwi_hi10_air_data = {
 };
 
 static const struct property_entry chuwi_hi10_plus_props[] = {
-	PROPERTY_ENTRY_U32("touchscreen-min-x", 0),
-	PROPERTY_ENTRY_U32("touchscreen-min-y", 5),
-	PROPERTY_ENTRY_U32("touchscreen-size-x", 1914),
-	PROPERTY_ENTRY_U32("touchscreen-size-y", 1283),
+	PROPERTY_ENTRY_U32("touchscreen-min-x", 12),
+	PROPERTY_ENTRY_U32("touchscreen-min-y", 10),
+	PROPERTY_ENTRY_U32("touchscreen-size-x", 1908),
+	PROPERTY_ENTRY_U32("touchscreen-size-y", 1270),
 	PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-chuwi-hi10plus.fw"),
 	PROPERTY_ENTRY_U32("silead,max-fingers", 10),
 	PROPERTY_ENTRY_BOOL("silead,home-button"),
@@ -111,6 +111,15 @@ static const struct property_entry chuwi_hi10_plus_props[] = {
 };
 
 static const struct ts_dmi_data chuwi_hi10_plus_data = {
+	.embedded_fw = {
+		.name	= "silead/gsl1680-chuwi-hi10plus.fw",
+		.prefix = { 0xf0, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00 },
+		.length	= 34056,
+		.sha256	= { 0xfd, 0x0a, 0x08, 0x08, 0x3c, 0xa6, 0x34, 0x4e,
+			    0x2c, 0x49, 0x9c, 0xcd, 0x7d, 0x44, 0x9d, 0x38,
+			    0x10, 0x68, 0xb5, 0xbd, 0xb7, 0x2a, 0x63, 0xb5,
+			    0x67, 0x0b, 0x96, 0xbd, 0x89, 0x67, 0x85, 0x09 },
+	},
 	.acpi_name      = "MSSL0017:00",
 	.properties     = chuwi_hi10_plus_props,
 };

From 83050cc23909ae7fe788af2ff67cfe314fb714cd Mon Sep 17 00:00:00 2001
From: Dai Ngo <dai.ngo@oracle.com>
Date: Thu, 16 Sep 2021 14:22:12 -0400
Subject: [PATCH 0708/1750] nfsd: back channel stuck in
 SEQ4_STATUS_CB_PATH_DOWN

[ Upstream commit 02579b2ff8b0becfb51d85a975908ac4ab15fba8 ]

When the back channel enters SEQ4_STATUS_CB_PATH_DOWN state, the client
recovers by sending BIND_CONN_TO_SESSION but the server fails to recover
the back channel and leaves it as NFSD4_CB_DOWN.

Fix by enhancing nfsd4_bind_conn_to_session to probe the back channel
by calling nfsd4_probe_callback.

Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfs4state.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 0313390fa4b4..1cdf7e0a5c22 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -3512,7 +3512,7 @@ static struct nfsd4_conn *__nfsd4_find_conn(struct svc_xprt *xpt, struct nfsd4_s
 }
 
 static __be32 nfsd4_match_existing_connection(struct svc_rqst *rqst,
-				struct nfsd4_session *session, u32 req)
+		struct nfsd4_session *session, u32 req, struct nfsd4_conn **conn)
 {
 	struct nfs4_client *clp = session->se_client;
 	struct svc_xprt *xpt = rqst->rq_xprt;
@@ -3535,6 +3535,8 @@ static __be32 nfsd4_match_existing_connection(struct svc_rqst *rqst,
 	else
 		status = nfserr_inval;
 	spin_unlock(&clp->cl_lock);
+	if (status == nfs_ok && conn)
+		*conn = c;
 	return status;
 }
 
@@ -3559,8 +3561,16 @@ __be32 nfsd4_bind_conn_to_session(struct svc_rqst *rqstp,
 	status = nfserr_wrong_cred;
 	if (!nfsd4_mach_creds_match(session->se_client, rqstp))
 		goto out;
-	status = nfsd4_match_existing_connection(rqstp, session, bcts->dir);
-	if (status == nfs_ok || status == nfserr_inval)
+	status = nfsd4_match_existing_connection(rqstp, session,
+			bcts->dir, &conn);
+	if (status == nfs_ok) {
+		if (bcts->dir == NFS4_CDFC4_FORE_OR_BOTH ||
+				bcts->dir == NFS4_CDFC4_BACK)
+			conn->cn_flags |= NFS4_CDFC4_BACK;
+		nfsd4_probe_callback(session->se_client);
+		goto out;
+	}
+	if (status == nfserr_inval)
 		goto out;
 	status = nfsd4_map_bcts_dir(&bcts->dir);
 	if (status)

From 50628b06e604401138c767b7b57600cbaae1597b Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Tue, 17 Aug 2021 07:55:40 +0800
Subject: [PATCH 0709/1750] btrfs: replace BUG_ON() in btrfs_csum_one_bio()
 with proper error handling

[ Upstream commit bbc9a6eb5eec03dcafee266b19f56295e3b2aa8f ]

There is a BUG_ON() in btrfs_csum_one_bio() to catch code logic error.
It has indeed caught several bugs during subpage development.
But the BUG_ON() itself will bring down the whole system which is
an overkill.

Replace it with a WARN() and exit gracefully, so that it won't crash the
whole system while we can still catch the code logic error.

Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/file-item.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
index 48a2ea6d7092..2de1d8247494 100644
--- a/fs/btrfs/file-item.c
+++ b/fs/btrfs/file-item.c
@@ -568,7 +568,18 @@ blk_status_t btrfs_csum_one_bio(struct btrfs_inode *inode, struct bio *bio,
 
 		if (!ordered) {
 			ordered = btrfs_lookup_ordered_extent(inode, offset);
-			BUG_ON(!ordered); /* Logic error */
+			/*
+			 * The bio range is not covered by any ordered extent,
+			 * must be a code logic error.
+			 */
+			if (unlikely(!ordered)) {
+				WARN(1, KERN_WARNING
+			"no ordered extent for root %llu ino %llu offset %llu\n",
+				     inode->root->root_key.objectid,
+				     btrfs_ino(inode), offset);
+				kvfree(sums);
+				return BLK_STS_IOERR;
+			}
 		}
 
 		nr_sectors = BTRFS_BYTES_TO_BLKS(fs_info,

From 63c89930d4b5f6205b4f4f13498a37cee86d80fa Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Wed, 8 Sep 2021 19:05:44 +0100
Subject: [PATCH 0710/1750] btrfs: fix mount failure due to past and transient
 device flush error

[ Upstream commit 6b225baababf1e3d41a4250e802cbd193e1343fb ]

When we get an error flushing one device, during a super block commit, we
record the error in the device structure, in the field 'last_flush_error'.
This is used to later check if we should error out the super block commit,
depending on whether the number of flush errors is greater than or equals
to the maximum tolerated device failures for a raid profile.

However if we get a transient device flush error, unmount the filesystem
and later try to mount it, we can fail the mount because we treat that
past error as critical and consider the device is missing. Even if it's
very likely that the error will happen again, as it's probably due to a
hardware related problem, there may be cases where the error might not
happen again. One example is during testing, and a test case like the
new generic/648 from fstests always triggers this. The test cases
generic/019 and generic/475 also trigger this scenario, but very
sporadically.

When this happens we get an error like this:

  $ mount /dev/sdc /mnt
  mount: /mnt wrong fs type, bad option, bad superblock on /dev/sdc, missing codepage or helper program, or other error.

  $ dmesg
  (...)
  [12918.886926] BTRFS warning (device sdc): chunk 13631488 missing 1 devices, max tolerance is 0 for writable mount
  [12918.888293] BTRFS warning (device sdc): writable mount is not allowed due to too many missing devices
  [12918.890853] BTRFS error (device sdc): open_ctree failed

The failure happens because when btrfs_check_rw_degradable() is called at
mount time, or at remount from RO to RW time, is sees a non zero value in
a device's ->last_flush_error attribute, and therefore considers that the
device is 'missing'.

Fix this by setting a device's ->last_flush_error to zero when we close a
device, making sure the error is not seen on the next mount attempt. We
only need to track flush errors during the current mount, so that we never
commit a super block if such errors happened.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index d8b8764f5bd1..593e0c6d6b44 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1147,6 +1147,19 @@ static void btrfs_close_one_device(struct btrfs_device *device)
 	atomic_set(&device->dev_stats_ccnt, 0);
 	extent_io_tree_release(&device->alloc_state);
 
+	/*
+	 * Reset the flush error record. We might have a transient flush error
+	 * in this mount, and if so we aborted the current transaction and set
+	 * the fs to an error state, guaranteeing no super blocks can be further
+	 * committed. However that error might be transient and if we unmount the
+	 * filesystem and mount it again, we should allow the mount to succeed
+	 * (btrfs_check_rw_degradable() should not fail) - if after mounting the
+	 * filesystem again we still get flush errors, then we will again abort
+	 * any transaction and set the error state, guaranteeing no commits of
+	 * unsafe super blocks.
+	 */
+	device->last_flush_error = 0;
+
 	/* Verify the device is back in a pristine state  */
 	ASSERT(!test_bit(BTRFS_DEV_STATE_FLUSH_SENT, &device->dev_state));
 	ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state));

From a41938d07201d0e7793f5aade5574a49f32ae82f Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Fri, 17 Sep 2021 16:34:32 +0300
Subject: [PATCH 0711/1750] net: mdio: introduce a shutdown method to mdio
 device drivers

[ Upstream commit cf9579976f724ad517cc15b7caadea728c7e245c ]

MDIO-attached devices might have interrupts and other things that might
need quiesced when we kexec into a new kernel. Things are even more
creepy when those interrupt lines are shared, and in that case it is
absolutely mandatory to disable all interrupt sources.

Moreover, MDIO devices might be DSA switches, and DSA needs its own
shutdown method to unlink from the DSA master, which is a new
requirement that appeared after commit 2f1e8ea726e9 ("net: dsa: link
interfaces with the DSA master to get rid of lockdep warnings").

So introduce a ->shutdown method in the MDIO device driver structure.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mdio_device.c | 11 +++++++++++
 include/linux/mdio.h          |  3 +++
 2 files changed, 14 insertions(+)

diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c
index 0837319a52d7..797c41f5590e 100644
--- a/drivers/net/phy/mdio_device.c
+++ b/drivers/net/phy/mdio_device.c
@@ -179,6 +179,16 @@ static int mdio_remove(struct device *dev)
 	return 0;
 }
 
+static void mdio_shutdown(struct device *dev)
+{
+	struct mdio_device *mdiodev = to_mdio_device(dev);
+	struct device_driver *drv = mdiodev->dev.driver;
+	struct mdio_driver *mdiodrv = to_mdio_driver(drv);
+
+	if (mdiodrv->shutdown)
+		mdiodrv->shutdown(mdiodev);
+}
+
 /**
  * mdio_driver_register - register an mdio_driver with the MDIO layer
  * @drv: new mdio_driver to register
@@ -193,6 +203,7 @@ int mdio_driver_register(struct mdio_driver *drv)
 	mdiodrv->driver.bus = &mdio_bus_type;
 	mdiodrv->driver.probe = mdio_probe;
 	mdiodrv->driver.remove = mdio_remove;
+	mdiodrv->driver.shutdown = mdio_shutdown;
 
 	retval = driver_register(&mdiodrv->driver);
 	if (retval) {
diff --git a/include/linux/mdio.h b/include/linux/mdio.h
index dbd69b3d170b..de5fb4b333ce 100644
--- a/include/linux/mdio.h
+++ b/include/linux/mdio.h
@@ -72,6 +72,9 @@ struct mdio_driver {
 
 	/* Clears up any memory if needed */
 	void (*remove)(struct mdio_device *mdiodev);
+
+	/* Quiesces the device on system shutdown, turns off interrupts etc */
+	void (*shutdown)(struct mdio_device *mdiodev);
 };
 #define to_mdio_driver(d)						\
 	container_of(to_mdio_common_driver(d), struct mdio_driver, mdiodrv)

From fdfb3bc87381e46b43bb521dfa8b02628b38a955 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Fri, 17 Sep 2021 08:27:10 +0200
Subject: [PATCH 0712/1750] xen-netback: correct success/error reporting for
 the SKB-with-fraglist case

[ Upstream commit 3ede7f84c7c21f93c5eac611d60eba3f2c765e0f ]

When re-entering the main loop of xenvif_tx_check_gop() a 2nd time, the
special considerations for the head of the SKB no longer apply. Don't
mistakenly report ERROR to the frontend for the first entry in the list,
even if - from all I can tell - this shouldn't matter much as the overall
transmit will need to be considered failed anyway.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/xen-netback/netback.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 986b56970961..b0cbc7fead74 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -499,7 +499,7 @@ static int xenvif_tx_check_gop(struct xenvif_queue *queue,
 				 * the header's copy failed, and they are
 				 * sharing a slot, send an error
 				 */
-				if (i == 0 && sharedslot)
+				if (i == 0 && !first_shinfo && sharedslot)
 					xenvif_idx_release(queue, pending_idx,
 							   XEN_NETIF_RSP_ERROR);
 				else

From b114f2d18e0f97e2776ccfd877f88b3f30ba54a9 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 20 Sep 2021 10:56:32 -0700
Subject: [PATCH 0713/1750] sparc64: fix pci_iounmap() when CONFIG_PCI is not
 set

[ Upstream commit d8b1e10a2b8efaf71d151aa756052fbf2f3b6d57 ]

Guenter reported [1] that the pci_iounmap() changes remain problematic,
with sparc64 allnoconfig and tinyconfig still not building due to the
header file changes and confusion with the arch-specific pci_iounmap()
implementation.

I'm pretty convinced that sparc should just use GENERIC_IOMAP instead of
doing its own thing, since it turns out that the sparc64 version of
pci_iounmap() is somewhat buggy (see [2]).  But in the meantime, this
just fixes the build by avoiding the trivial re-definition of the empty
case.

Link: https://lore.kernel.org/lkml/20210920134424.GA346531@roeck-us.net/ [1]
Link: https://lore.kernel.org/lkml/CAHk-=wgheheFx9myQyy5osh79BAazvmvYURAtub2gQtMvLrhqQ@mail.gmail.com/ [2]
Reported-by: Guenter Roeck <linux@roeck-us.net>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/lib/iomap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/sparc/lib/iomap.c b/arch/sparc/lib/iomap.c
index c9da9f139694..f3a8cd491ce0 100644
--- a/arch/sparc/lib/iomap.c
+++ b/arch/sparc/lib/iomap.c
@@ -19,8 +19,10 @@ void ioport_unmap(void __iomem *addr)
 EXPORT_SYMBOL(ioport_map);
 EXPORT_SYMBOL(ioport_unmap);
 
+#ifdef CONFIG_PCI
 void pci_iounmap(struct pci_dev *dev, void __iomem * addr)
 {
 	/* nothing to do */
 }
 EXPORT_SYMBOL(pci_iounmap);
+#endif

From 76c7063c7405f30758876af25cfc5e9e39b7bc6e Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 21 Sep 2021 23:32:33 +0300
Subject: [PATCH 0714/1750] ext2: fix sleeping in atomic bugs on error

[ Upstream commit 372d1f3e1bfede719864d0d1fbf3146b1e638c88 ]

The ext2_error() function syncs the filesystem so it sleeps.  The caller
is holding a spinlock so it's not allowed to sleep.

   ext2_statfs() <- disables preempt
   -> ext2_count_free_blocks()
      -> ext2_get_group_desc()

Fix this by using WARN() to print an error message and a stack trace
instead of using ext2_error().

Link: https://lore.kernel.org/r/20210921203233.GA16529@kili
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext2/balloc.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 1f3f4326bf3c..c17ccc19b938 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -48,10 +48,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
 	struct ext2_sb_info *sbi = EXT2_SB(sb);
 
 	if (block_group >= sbi->s_groups_count) {
-		ext2_error (sb, "ext2_get_group_desc",
-			    "block_group >= groups_count - "
-			    "block_group = %d, groups_count = %lu",
-			    block_group, sbi->s_groups_count);
+		WARN(1, "block_group >= groups_count - "
+		     "block_group = %d, groups_count = %lu",
+		     block_group, sbi->s_groups_count);
 
 		return NULL;
 	}
@@ -59,10 +58,9 @@ struct ext2_group_desc * ext2_get_group_desc(struct super_block * sb,
 	group_desc = block_group >> EXT2_DESC_PER_BLOCK_BITS(sb);
 	offset = block_group & (EXT2_DESC_PER_BLOCK(sb) - 1);
 	if (!sbi->s_group_desc[group_desc]) {
-		ext2_error (sb, "ext2_get_group_desc",
-			    "Group descriptor not loaded - "
-			    "block_group = %d, group_desc = %lu, desc = %lu",
-			     block_group, group_desc, offset);
+		WARN(1, "Group descriptor not loaded - "
+		     "block_group = %d, group_desc = %lu, desc = %lu",
+		      block_group, group_desc, offset);
 		return NULL;
 	}
 

From 60df9f55562a57173a11b6c7011eee40dfa48157 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Mon, 6 Sep 2021 17:01:12 +0800
Subject: [PATCH 0715/1750] scsi: sd: Free scsi_disk device via put_device()

[ Upstream commit 265dfe8ebbabae7959060bd1c3f75c2473b697ed ]

After a device is initialized via device_initialize() it should be freed
via put_device(). sd_probe() currently gets this wrong, fix it up.

Link: https://lore.kernel.org/r/20210906090112.531442-1-ming.lei@redhat.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/sd.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f0c0935d7909..56e291708587 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -3443,15 +3443,16 @@ static int sd_probe(struct device *dev)
 	}
 
 	device_initialize(&sdkp->dev);
-	sdkp->dev.parent = dev;
+	sdkp->dev.parent = get_device(dev);
 	sdkp->dev.class = &sd_disk_class;
 	dev_set_name(&sdkp->dev, "%s", dev_name(dev));
 
 	error = device_add(&sdkp->dev);
-	if (error)
-		goto out_free_index;
+	if (error) {
+		put_device(&sdkp->dev);
+		goto out;
+	}
 
-	get_device(dev);
 	dev_set_drvdata(dev, sdkp);
 
 	gd->major = sd_major((index & 0xf0) >> 4);

From ed6574d4846936a063940c2c7a552d0bce52dc49 Mon Sep 17 00:00:00 2001
From: Faizel K B <faizel.kb@dicortech.com>
Date: Thu, 2 Sep 2021 17:14:44 +0530
Subject: [PATCH 0716/1750] usb: testusb: Fix for showing the connection speed

[ Upstream commit f81c08f897adafd2ed43f86f00207ff929f0b2eb ]

testusb' application which uses 'usbtest' driver reports 'unknown speed'
from the function 'find_testdev'. The variable 'entry->speed' was not
updated from  the application. The IOCTL mentioned in the FIXME comment can
only report whether the connection is low speed or not. Speed is read using
the IOCTL USBDEVFS_GET_SPEED which reports the proper speed grade.  The
call is implemented in the function 'handle_testdev' where the file
descriptor was availble locally. Sample output is given below where 'high
speed' is printed as the connected speed.

sudo ./testusb -a
high speed      /dev/bus/usb/001/011    0
/dev/bus/usb/001/011 test 0,    0.000015 secs
/dev/bus/usb/001/011 test 1,    0.194208 secs
/dev/bus/usb/001/011 test 2,    0.077289 secs
/dev/bus/usb/001/011 test 3,    0.170604 secs
/dev/bus/usb/001/011 test 4,    0.108335 secs
/dev/bus/usb/001/011 test 5,    2.788076 secs
/dev/bus/usb/001/011 test 6,    2.594610 secs
/dev/bus/usb/001/011 test 7,    2.905459 secs
/dev/bus/usb/001/011 test 8,    2.795193 secs
/dev/bus/usb/001/011 test 9,    8.372651 secs
/dev/bus/usb/001/011 test 10,    6.919731 secs
/dev/bus/usb/001/011 test 11,   16.372687 secs
/dev/bus/usb/001/011 test 12,   16.375233 secs
/dev/bus/usb/001/011 test 13,    2.977457 secs
/dev/bus/usb/001/011 test 14 --> 22 (Invalid argument)
/dev/bus/usb/001/011 test 17,    0.148826 secs
/dev/bus/usb/001/011 test 18,    0.068718 secs
/dev/bus/usb/001/011 test 19,    0.125992 secs
/dev/bus/usb/001/011 test 20,    0.127477 secs
/dev/bus/usb/001/011 test 21 --> 22 (Invalid argument)
/dev/bus/usb/001/011 test 24,    4.133763 secs
/dev/bus/usb/001/011 test 27,    2.140066 secs
/dev/bus/usb/001/011 test 28,    2.120713 secs
/dev/bus/usb/001/011 test 29,    0.507762 secs

Signed-off-by: Faizel K B <faizel.kb@dicortech.com>
Link: https://lore.kernel.org/r/20210902114444.15106-1-faizel.kb@dicortech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/usb/testusb.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/tools/usb/testusb.c b/tools/usb/testusb.c
index ee8208b2f946..69c3ead25313 100644
--- a/tools/usb/testusb.c
+++ b/tools/usb/testusb.c
@@ -265,12 +265,6 @@ static int find_testdev(const char *name, const struct stat *sb, int flag)
 	}
 
 	entry->ifnum = ifnum;
-
-	/* FIXME update USBDEVFS_CONNECTINFO so it tells about high speed etc */
-
-	fprintf(stderr, "%s speed\t%s\t%u\n",
-		speed(entry->speed), entry->name, entry->ifnum);
-
 	entry->next = testdevs;
 	testdevs = entry;
 	return 0;
@@ -299,6 +293,14 @@ static void *handle_testdev (void *arg)
 		return 0;
 	}
 
+	status  =  ioctl(fd, USBDEVFS_GET_SPEED, NULL);
+	if (status < 0)
+		fprintf(stderr, "USBDEVFS_GET_SPEED failed %d\n", status);
+	else
+		dev->speed = status;
+	fprintf(stderr, "%s speed\t%s\t%u\n",
+			speed(dev->speed), dev->name, dev->ifnum);
+
 restart:
 	for (i = 0; i < TEST_CASES; i++) {
 		if (dev->test != -1 && dev->test != i)

From 2754fa3b73df7d0ae042f3ed6cfd9df9042f6262 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 31 Aug 2021 16:42:36 +0800
Subject: [PATCH 0717/1750] usb: dwc2: check return value after calling
 platform_get_resource()

[ Upstream commit 856e6e8e0f9300befa87dde09edb578555c99a82 ]

It will cause null-ptr-deref if platform_get_resource() returns NULL,
we need check the return value.

Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210831084236.1359677-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/hcd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
index 6af1dcbc3656..30919f741b7f 100644
--- a/drivers/usb/dwc2/hcd.c
+++ b/drivers/usb/dwc2/hcd.c
@@ -5074,6 +5074,10 @@ int dwc2_hcd_init(struct dwc2_hsotg *hsotg)
 	hcd->has_tt = 1;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res) {
+		retval = -EINVAL;
+		goto error1;
+	}
 	hcd->rsrc_start = res->start;
 	hcd->rsrc_len = resource_size(res);
 

From 6a4aaf1d84f75fc86961d5982f2b43d1897de1d3 Mon Sep 17 00:00:00 2001
From: Oded Gabbay <ogabbay@kernel.org>
Date: Sun, 12 Sep 2021 10:25:49 +0300
Subject: [PATCH 0718/1750] habanalabs/gaudi: fix LBW RR configuration

[ Upstream commit 0a5ff77bf0a94468d541735f919a633f167787e9 ]

Couple of fixes to the LBW RR configuration:

1. Add missing configuration of the SM RR registers in the DMA_IF.
2. Remove HBW range that doesn't belong.
3. Add entire gap + DBG area, from end of TPC7 to end of entire
   DBG space.

Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../misc/habanalabs/gaudi/gaudi_security.c    | 115 ++++++++++--------
 1 file changed, 67 insertions(+), 48 deletions(-)

diff --git a/drivers/misc/habanalabs/gaudi/gaudi_security.c b/drivers/misc/habanalabs/gaudi/gaudi_security.c
index 2d7add0e5bcc..9343a81d3122 100644
--- a/drivers/misc/habanalabs/gaudi/gaudi_security.c
+++ b/drivers/misc/habanalabs/gaudi/gaudi_security.c
@@ -8,16 +8,21 @@
 #include "gaudiP.h"
 #include "../include/gaudi/asic_reg/gaudi_regs.h"
 
-#define GAUDI_NUMBER_OF_RR_REGS		24
-#define GAUDI_NUMBER_OF_LBW_RANGES	12
+#define GAUDI_NUMBER_OF_LBW_RR_REGS	28
+#define GAUDI_NUMBER_OF_HBW_RR_REGS	24
+#define GAUDI_NUMBER_OF_LBW_RANGES	10
 
-static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
+	mmDMA_IF_W_S_SOB_HIT_WPROT,
 	mmDMA_IF_W_S_DMA0_HIT_WPROT,
 	mmDMA_IF_W_S_DMA1_HIT_WPROT,
+	mmDMA_IF_E_S_SOB_HIT_WPROT,
 	mmDMA_IF_E_S_DMA0_HIT_WPROT,
 	mmDMA_IF_E_S_DMA1_HIT_WPROT,
+	mmDMA_IF_W_N_SOB_HIT_WPROT,
 	mmDMA_IF_W_N_DMA0_HIT_WPROT,
 	mmDMA_IF_W_N_DMA1_HIT_WPROT,
+	mmDMA_IF_E_N_SOB_HIT_WPROT,
 	mmDMA_IF_E_N_DMA0_HIT_WPROT,
 	mmDMA_IF_E_N_DMA1_HIT_WPROT,
 	mmSIF_RTR_0_LBW_RANGE_PROT_HIT_AW,
@@ -38,13 +43,17 @@ static u64 gaudi_rr_lbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_7_LBW_RANGE_PROT_HIT_AW,
 };
 
-static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
+	mmDMA_IF_W_S_SOB_HIT_RPROT,
 	mmDMA_IF_W_S_DMA0_HIT_RPROT,
 	mmDMA_IF_W_S_DMA1_HIT_RPROT,
+	mmDMA_IF_E_S_SOB_HIT_RPROT,
 	mmDMA_IF_E_S_DMA0_HIT_RPROT,
 	mmDMA_IF_E_S_DMA1_HIT_RPROT,
+	mmDMA_IF_W_N_SOB_HIT_RPROT,
 	mmDMA_IF_W_N_DMA0_HIT_RPROT,
 	mmDMA_IF_W_N_DMA1_HIT_RPROT,
+	mmDMA_IF_E_N_SOB_HIT_RPROT,
 	mmDMA_IF_E_N_DMA0_HIT_RPROT,
 	mmDMA_IF_E_N_DMA1_HIT_RPROT,
 	mmSIF_RTR_0_LBW_RANGE_PROT_HIT_AR,
@@ -65,13 +74,17 @@ static u64 gaudi_rr_lbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_7_LBW_RANGE_PROT_HIT_AR,
 };
 
-static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
+	mmDMA_IF_W_S_SOB_MIN_WPROT_0,
 	mmDMA_IF_W_S_DMA0_MIN_WPROT_0,
 	mmDMA_IF_W_S_DMA1_MIN_WPROT_0,
+	mmDMA_IF_E_S_SOB_MIN_WPROT_0,
 	mmDMA_IF_E_S_DMA0_MIN_WPROT_0,
 	mmDMA_IF_E_S_DMA1_MIN_WPROT_0,
+	mmDMA_IF_W_N_SOB_MIN_WPROT_0,
 	mmDMA_IF_W_N_DMA0_MIN_WPROT_0,
 	mmDMA_IF_W_N_DMA1_MIN_WPROT_0,
+	mmDMA_IF_E_N_SOB_MIN_WPROT_0,
 	mmDMA_IF_E_N_DMA0_MIN_WPROT_0,
 	mmDMA_IF_E_N_DMA1_MIN_WPROT_0,
 	mmSIF_RTR_0_LBW_RANGE_PROT_MIN_AW_0,
@@ -92,13 +105,17 @@ static u64 gaudi_rr_lbw_min_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_7_LBW_RANGE_PROT_MIN_AW_0,
 };
 
-static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
+	mmDMA_IF_W_S_SOB_MAX_WPROT_0,
 	mmDMA_IF_W_S_DMA0_MAX_WPROT_0,
 	mmDMA_IF_W_S_DMA1_MAX_WPROT_0,
+	mmDMA_IF_E_S_SOB_MAX_WPROT_0,
 	mmDMA_IF_E_S_DMA0_MAX_WPROT_0,
 	mmDMA_IF_E_S_DMA1_MAX_WPROT_0,
+	mmDMA_IF_W_N_SOB_MAX_WPROT_0,
 	mmDMA_IF_W_N_DMA0_MAX_WPROT_0,
 	mmDMA_IF_W_N_DMA1_MAX_WPROT_0,
+	mmDMA_IF_E_N_SOB_MAX_WPROT_0,
 	mmDMA_IF_E_N_DMA0_MAX_WPROT_0,
 	mmDMA_IF_E_N_DMA1_MAX_WPROT_0,
 	mmSIF_RTR_0_LBW_RANGE_PROT_MAX_AW_0,
@@ -119,13 +136,17 @@ static u64 gaudi_rr_lbw_max_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_7_LBW_RANGE_PROT_MAX_AW_0,
 };
 
-static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
+	mmDMA_IF_W_S_SOB_MIN_RPROT_0,
 	mmDMA_IF_W_S_DMA0_MIN_RPROT_0,
 	mmDMA_IF_W_S_DMA1_MIN_RPROT_0,
+	mmDMA_IF_E_S_SOB_MIN_RPROT_0,
 	mmDMA_IF_E_S_DMA0_MIN_RPROT_0,
 	mmDMA_IF_E_S_DMA1_MIN_RPROT_0,
+	mmDMA_IF_W_N_SOB_MIN_RPROT_0,
 	mmDMA_IF_W_N_DMA0_MIN_RPROT_0,
 	mmDMA_IF_W_N_DMA1_MIN_RPROT_0,
+	mmDMA_IF_E_N_SOB_MIN_RPROT_0,
 	mmDMA_IF_E_N_DMA0_MIN_RPROT_0,
 	mmDMA_IF_E_N_DMA1_MIN_RPROT_0,
 	mmSIF_RTR_0_LBW_RANGE_PROT_MIN_AR_0,
@@ -146,13 +167,17 @@ static u64 gaudi_rr_lbw_min_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_7_LBW_RANGE_PROT_MIN_AR_0,
 };
 
-static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_LBW_RR_REGS] = {
+	mmDMA_IF_W_S_SOB_MAX_RPROT_0,
 	mmDMA_IF_W_S_DMA0_MAX_RPROT_0,
 	mmDMA_IF_W_S_DMA1_MAX_RPROT_0,
+	mmDMA_IF_E_S_SOB_MAX_RPROT_0,
 	mmDMA_IF_E_S_DMA0_MAX_RPROT_0,
 	mmDMA_IF_E_S_DMA1_MAX_RPROT_0,
+	mmDMA_IF_W_N_SOB_MAX_RPROT_0,
 	mmDMA_IF_W_N_DMA0_MAX_RPROT_0,
 	mmDMA_IF_W_N_DMA1_MAX_RPROT_0,
+	mmDMA_IF_E_N_SOB_MAX_RPROT_0,
 	mmDMA_IF_E_N_DMA0_MAX_RPROT_0,
 	mmDMA_IF_E_N_DMA1_MAX_RPROT_0,
 	mmSIF_RTR_0_LBW_RANGE_PROT_MAX_AR_0,
@@ -173,7 +198,7 @@ static u64 gaudi_rr_lbw_max_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_7_LBW_RANGE_PROT_MAX_AR_0,
 };
 
-static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_HIT_AW,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_HIT_AW,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_HIT_AW,
@@ -200,7 +225,7 @@ static u64 gaudi_rr_hbw_hit_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_HIT_AW
 };
 
-static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_HIT_AR,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_HIT_AR,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_HIT_AR,
@@ -227,7 +252,7 @@ static u64 gaudi_rr_hbw_hit_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_HIT_AR
 };
 
-static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AW_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_LOW_AW_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AW_0,
@@ -254,7 +279,7 @@ static u64 gaudi_rr_hbw_base_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_LOW_AW_0
 };
 
-static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AW_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_HIGH_AW_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AW_0,
@@ -281,7 +306,7 @@ static u64 gaudi_rr_hbw_base_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_HIGH_AW_0
 };
 
-static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AW_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_LOW_AW_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AW_0,
@@ -308,7 +333,7 @@ static u64 gaudi_rr_hbw_mask_low_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_LOW_AW_0
 };
 
-static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AW_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_HIGH_AW_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AW_0,
@@ -335,7 +360,7 @@ static u64 gaudi_rr_hbw_mask_high_aw_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_HIGH_AW_0
 };
 
-static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AR_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_LOW_AR_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_LOW_AR_0,
@@ -362,7 +387,7 @@ static u64 gaudi_rr_hbw_base_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_LOW_AR_0
 };
 
-static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AR_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_BASE_HIGH_AR_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_BASE_HIGH_AR_0,
@@ -389,7 +414,7 @@ static u64 gaudi_rr_hbw_base_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_BASE_HIGH_AR_0
 };
 
-static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AR_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_LOW_AR_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_LOW_AR_0,
@@ -416,7 +441,7 @@ static u64 gaudi_rr_hbw_mask_low_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
 	mmNIF_RTR_CTRL_7_RANGE_SEC_MASK_LOW_AR_0
 };
 
-static u64 gaudi_rr_hbw_mask_high_ar_regs[GAUDI_NUMBER_OF_RR_REGS] = {
+static u64 gaudi_rr_hbw_mask_high_ar_regs[GAUDI_NUMBER_OF_HBW_RR_REGS] = {
 	mmDMA_IF_W_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AR_0,
 	mmDMA_IF_W_S_DOWN_CH1_RANGE_SEC_MASK_HIGH_AR_0,
 	mmDMA_IF_E_S_DOWN_CH0_RANGE_SEC_MASK_HIGH_AR_0,
@@ -8870,50 +8895,44 @@ static void gaudi_init_range_registers_lbw(struct hl_device *hdev)
 	u32 lbw_rng_end[GAUDI_NUMBER_OF_LBW_RANGES];
 	int i, j;
 
-	lbw_rng_start[0]  = (0xFBFE0000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[0]    = (0xFBFFF000 & 0x3FFFFFF) + 1;
+	lbw_rng_start[0]  = (0xFC0E8000 & 0x3FFFFFF) - 1; /* 0x000E7FFF */
+	lbw_rng_end[0]    = (0xFC11FFFF & 0x3FFFFFF) + 1; /* 0x00120000 */
 
-	lbw_rng_start[1]  = (0xFC0E8000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[1]    = (0xFC120000 & 0x3FFFFFF) + 1;
+	lbw_rng_start[1]  = (0xFC1E8000 & 0x3FFFFFF) - 1; /* 0x001E7FFF */
+	lbw_rng_end[1]    = (0xFC48FFFF & 0x3FFFFFF) + 1; /* 0x00490000 */
 
-	lbw_rng_start[2]  = (0xFC1E8000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[2]    = (0xFC48FFFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[2]  = (0xFC600000 & 0x3FFFFFF) - 1; /* 0x005FFFFF */
+	lbw_rng_end[2]    = (0xFCC48FFF & 0x3FFFFFF) + 1; /* 0x00C49000 */
 
-	lbw_rng_start[3]  = (0xFC600000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[3]    = (0xFCC48FFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[3]  = (0xFCC4A000 & 0x3FFFFFF) - 1; /* 0x00C49FFF */
+	lbw_rng_end[3]    = (0xFCCDFFFF & 0x3FFFFFF) + 1; /* 0x00CE0000 */
 
-	lbw_rng_start[4]  = (0xFCC4A000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[4]    = (0xFCCDFFFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[4]  = (0xFCCE4000 & 0x3FFFFFF) - 1; /* 0x00CE3FFF */
+	lbw_rng_end[4]    = (0xFCD1FFFF & 0x3FFFFFF) + 1; /* 0x00D20000 */
 
-	lbw_rng_start[5]  = (0xFCCE4000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[5]    = (0xFCD1FFFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[5]  = (0xFCD24000 & 0x3FFFFFF) - 1; /* 0x00D23FFF */
+	lbw_rng_end[5]    = (0xFCD5FFFF & 0x3FFFFFF) + 1; /* 0x00D60000 */
 
-	lbw_rng_start[6]  = (0xFCD24000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[6]    = (0xFCD5FFFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[6]  = (0xFCD64000 & 0x3FFFFFF) - 1; /* 0x00D63FFF */
+	lbw_rng_end[6]    = (0xFCD9FFFF & 0x3FFFFFF) + 1; /* 0x00DA0000 */
 
-	lbw_rng_start[7]  = (0xFCD64000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[7]    = (0xFCD9FFFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[7]  = (0xFCDA4000 & 0x3FFFFFF) - 1; /* 0x00DA3FFF */
+	lbw_rng_end[7]    = (0xFCDDFFFF & 0x3FFFFFF) + 1; /* 0x00DE0000 */
 
-	lbw_rng_start[8]  = (0xFCDA4000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[8]    = (0xFCDDFFFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[8]  = (0xFCDE4000 & 0x3FFFFFF) - 1; /* 0x00DE3FFF */
+	lbw_rng_end[8]    = (0xFCE05FFF & 0x3FFFFFF) + 1; /* 0x00E06000 */
 
-	lbw_rng_start[9]  = (0xFCDE4000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[9]    = (0xFCE05FFF & 0x3FFFFFF) + 1;
+	lbw_rng_start[9]  = (0xFCFC9000 & 0x3FFFFFF) - 1; /* 0x00FC8FFF */
+	lbw_rng_end[9]    = (0xFFFFFFFE & 0x3FFFFFF) + 1; /* 0x03FFFFFF */
 
-	lbw_rng_start[10]  = (0xFEC43000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[10]    = (0xFEC43FFF & 0x3FFFFFF) + 1;
-
-	lbw_rng_start[11] = (0xFE484000 & 0x3FFFFFF) - 1;
-	lbw_rng_end[11]   = (0xFE484FFF & 0x3FFFFFF) + 1;
-
-	for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
+	for (i = 0 ; i < GAUDI_NUMBER_OF_LBW_RR_REGS ; i++) {
 		WREG32(gaudi_rr_lbw_hit_aw_regs[i],
 				(1 << GAUDI_NUMBER_OF_LBW_RANGES) - 1);
 		WREG32(gaudi_rr_lbw_hit_ar_regs[i],
 				(1 << GAUDI_NUMBER_OF_LBW_RANGES) - 1);
 	}
 
-	for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++)
+	for (i = 0 ; i < GAUDI_NUMBER_OF_LBW_RR_REGS ; i++)
 		for (j = 0 ; j < GAUDI_NUMBER_OF_LBW_RANGES ; j++) {
 			WREG32(gaudi_rr_lbw_min_aw_regs[i] + (j << 2),
 							lbw_rng_start[j]);
@@ -8960,12 +8979,12 @@ static void gaudi_init_range_registers_hbw(struct hl_device *hdev)
 	 * 6th range is the host
 	 */
 
-	for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
+	for (i = 0 ; i < GAUDI_NUMBER_OF_HBW_RR_REGS ; i++) {
 		WREG32(gaudi_rr_hbw_hit_aw_regs[i], 0x1F);
 		WREG32(gaudi_rr_hbw_hit_ar_regs[i], 0x1D);
 	}
 
-	for (i = 0 ; i < GAUDI_NUMBER_OF_RR_REGS ; i++) {
+	for (i = 0 ; i < GAUDI_NUMBER_OF_HBW_RR_REGS ; i++) {
 		WREG32(gaudi_rr_hbw_base_low_aw_regs[i], dram_addr_lo);
 		WREG32(gaudi_rr_hbw_base_low_ar_regs[i], dram_addr_lo);
 

From bcc4b4de63a44130608d9cb68aa8707c130163d2 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@cn.fujitsu.com>
Date: Wed, 15 Sep 2021 21:45:54 +0800
Subject: [PATCH 0719/1750] selftests: be sure to make khdr before other
 targets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 8914a7a247e065438a0ec86a58c1c359223d2c9e ]

LKP/0Day reported some building errors about kvm, and errors message
are not always same:
- lib/x86_64/processor.c:1083:31: error: ‘KVM_CAP_NESTED_STATE’ undeclared
(first use in this function); did you mean ‘KVM_CAP_PIT_STATE2’?
- lib/test_util.c:189:30: error: ‘MAP_HUGE_16KB’ undeclared (first use
in this function); did you mean ‘MAP_HUGE_16GB’?

Although kvm relies on the khdr, they still be built in parallel when -j
is specified. In this case, it will cause compiling errors.

Here we mark target khdr as NOTPARALLEL to make it be always built
first.

CC: Philip Li <philip.li@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/lib.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index 0af84ad48aa7..b7217b5251f5 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -48,6 +48,7 @@ ARCH		?= $(SUBARCH)
 # When local build is done, headers are installed in the default
 # INSTALL_HDR_PATH usr/include.
 .PHONY: khdr
+.NOTPARALLEL:
 khdr:
 ifndef KSFT_KHDR_INSTALL_DONE
 ifeq (1,$(DEFAULT_INSTALL_HDR_PATH))

From c4506403e1f32fc41a83a693a0a8f9f0bc13e171 Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Wed, 15 Sep 2021 15:28:06 -0600
Subject: [PATCH 0720/1750] selftests:kvm: fix get_warnings_count() ignoring
 fscanf() return warn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 39a71f712d8a13728febd8f3cb3f6db7e1fa7221 ]

Fix get_warnings_count() to check fscanf() return value to get rid
of the following warning:

x86_64/mmio_warning_test.c: In function ‘get_warnings_count’:
x86_64/mmio_warning_test.c:85:2: warning: ignoring return value of ‘fscanf’ declared with attribute ‘warn_unused_result’ [-Wunused-result]
   85 |  fscanf(f, "%d", &warnings);
      |  ^~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/x86_64/mmio_warning_test.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
index e6480fd5c4bd..8039e1eff938 100644
--- a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
+++ b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
@@ -82,7 +82,8 @@ int get_warnings_count(void)
 	FILE *f;
 
 	f = popen("dmesg | grep \"WARNING:\" | wc -l", "r");
-	fscanf(f, "%d", &warnings);
+	if (fscanf(f, "%d", &warnings) < 1)
+		warnings = 0;
 	fclose(f);
 
 	return warnings;

From c251d023ed22732fa9b0c367240afe1187b4fa6f Mon Sep 17 00:00:00 2001
From: Daniel Wagner <dwagner@suse.de>
Date: Tue, 14 Sep 2021 11:20:06 +0200
Subject: [PATCH 0721/1750] nvme-fc: update hardware queues before using them

[ Upstream commit 555f66d0f8a38537456acc77043d0e4469fcbe8e ]

In case the number of hardware queues changes, we need to update the
tagset and the mapping of ctx to hctx first.

If we try to create and connect the I/O queues first, this operation
will fail (target will reject the connect call due to the wrong number
of queues) and hence we bail out of the recreate function. Then we
will to try the very same operation again, thus we don't make any
progress.

Signed-off-by: Daniel Wagner <dwagner@suse.de>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/fc.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index a0bcec33b020..86c6862e71a1 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2952,14 +2952,6 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
 	if (ctrl->ctrl.queue_count == 1)
 		return 0;
 
-	ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
-	if (ret)
-		goto out_free_io_queues;
-
-	ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
-	if (ret)
-		goto out_delete_hw_queues;
-
 	if (prior_ioq_cnt != nr_io_queues) {
 		dev_info(ctrl->ctrl.device,
 			"reconnect: revising io queue count from %d to %d\n",
@@ -2969,6 +2961,14 @@ nvme_fc_recreate_io_queues(struct nvme_fc_ctrl *ctrl)
 		nvme_unfreeze(&ctrl->ctrl);
 	}
 
+	ret = nvme_fc_create_hw_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
+	if (ret)
+		goto out_free_io_queues;
+
+	ret = nvme_fc_connect_io_queues(ctrl, ctrl->ctrl.sqsize + 1);
+	if (ret)
+		goto out_delete_hw_queues;
+
 	return 0;
 
 out_delete_hw_queues:

From 7a670cfb0f4cba692a2cc0caa60810986ceeab3d Mon Sep 17 00:00:00 2001
From: James Smart <jsmart2021@gmail.com>
Date: Tue, 14 Sep 2021 11:20:07 +0200
Subject: [PATCH 0722/1750] nvme-fc: avoid race between time out and tear down

[ Upstream commit e5445dae29d25d7b03e0a10d3d4277a1d0c8119b ]

To avoid race between time out and tear down, in tear down process,
first we quiesce the queue, and then delete the timer and cancel
the time out work for the queue.

This patch merges the admin and io sync ops into the queue teardown logic
as shown in the RDMA patch 3017013dcc "nvme-rdma: avoid race between time
out and tear down". There is no teardown_lock in nvme-fc.

Signed-off-by: James Smart <jsmart2021@gmail.com>
Tested-by: Daniel Wagner <dwagner@suse.de>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/fc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 86c6862e71a1..906cab35afe7 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -2486,6 +2486,7 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues)
 	 */
 	if (ctrl->ctrl.queue_count > 1) {
 		nvme_stop_queues(&ctrl->ctrl);
+		nvme_sync_io_queues(&ctrl->ctrl);
 		blk_mq_tagset_busy_iter(&ctrl->tag_set,
 				nvme_fc_terminate_exchange, &ctrl->ctrl);
 		blk_mq_tagset_wait_completed_request(&ctrl->tag_set);
@@ -2509,6 +2510,7 @@ __nvme_fc_abort_outstanding_ios(struct nvme_fc_ctrl *ctrl, bool start_queues)
 	 * clean up the admin queue. Same thing as above.
 	 */
 	blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
+	blk_sync_queue(ctrl->ctrl.admin_q);
 	blk_mq_tagset_busy_iter(&ctrl->admin_tag_set,
 				nvme_fc_terminate_exchange, &ctrl->ctrl);
 	blk_mq_tagset_wait_completed_request(&ctrl->admin_tag_set);

From 2e28f7dd3743bf8f386fa72b96e5da2898039df5 Mon Sep 17 00:00:00 2001
From: Ansuel Smith <ansuelsmth@gmail.com>
Date: Tue, 7 Sep 2021 23:25:42 +0200
Subject: [PATCH 0723/1750] thermal/drivers/tsens: Fix wrong check for tzd in
 irq handlers

[ Upstream commit cf96921876dcee4d6ac07b9de470368a075ba9ad ]

Some devices can have some thermal sensors disabled from the
factory. The current two irq handler functions check all the sensor by
default and the check if the sensor was actually registered is
wrong. The tzd is actually never set if the registration fails hence
the IS_ERR check is wrong.

Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210907212543.20220-1-ansuelsmth@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/thermal/qcom/tsens.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/thermal/qcom/tsens.c b/drivers/thermal/qcom/tsens.c
index 3c4c0516e58a..cb4f4b522446 100644
--- a/drivers/thermal/qcom/tsens.c
+++ b/drivers/thermal/qcom/tsens.c
@@ -415,7 +415,7 @@ static irqreturn_t tsens_critical_irq_thread(int irq, void *data)
 		const struct tsens_sensor *s = &priv->sensor[i];
 		u32 hw_id = s->hw_id;
 
-		if (IS_ERR(s->tzd))
+		if (!s->tzd)
 			continue;
 		if (!tsens_threshold_violated(priv, hw_id, &d))
 			continue;
@@ -465,7 +465,7 @@ static irqreturn_t tsens_irq_thread(int irq, void *data)
 		const struct tsens_sensor *s = &priv->sensor[i];
 		u32 hw_id = s->hw_id;
 
-		if (IS_ERR(s->tzd))
+		if (!s->tzd)
 			continue;
 		if (!tsens_threshold_violated(priv, hw_id, &d))
 			continue;

From 8724a2a0e6d95242fd9e5c5dcffbd55ab4194b66 Mon Sep 17 00:00:00 2001
From: Wen Xiong <wenxiong@linux.ibm.com>
Date: Thu, 16 Sep 2021 22:24:21 -0500
Subject: [PATCH 0724/1750] scsi: ses: Retry failed Send/Receive Diagnostic
 commands

[ Upstream commit fbdac19e642899455b4e64c63aafe2325df7aafa ]

Setting SCSI logging level with error=3, we saw some errors from enclosues:

[108017.360833] ses 0:0:9:0: tag#641 Done: NEEDS_RETRY Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s
[108017.360838] ses 0:0:9:0: tag#641 CDB: Receive Diagnostic 1c 01 01 00 20 00
[108017.427778] ses 0:0:9:0: Power-on or device reset occurred
[108017.427784] ses 0:0:9:0: tag#641 Done: SUCCESS Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
[108017.427788] ses 0:0:9:0: tag#641 CDB: Receive Diagnostic 1c 01 01 00 20 00
[108017.427791] ses 0:0:9:0: tag#641 Sense Key : Unit Attention [current]
[108017.427793] ses 0:0:9:0: tag#641 Add. Sense: Bus device reset function occurred
[108017.427801] ses 0:0:9:0: Failed to get diagnostic page 0x1
[108017.427804] ses 0:0:9:0: Failed to bind enclosure -19
[108017.427895] ses 0:0:10:0: Attached Enclosure device
[108017.427942] ses 0:0:10:0: Attached scsi generic sg18 type 13

Retry if the Send/Receive Diagnostic commands complete with a transient
error status (NOT_READY or UNIT_ATTENTION with ASC 0x29).

Link: https://lore.kernel.org/r/1631849061-10210-2-git-send-email-wenxiong@linux.ibm.com
Reviewed-by: Brian King <brking@linux.ibm.com>
Reviewed-by: James Bottomley <jejb@linux.ibm.com>
Signed-off-by: Wen Xiong <wenxiong@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ses.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index c2afba2a5414..43e682297fd5 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -87,9 +87,16 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
 		0
 	};
 	unsigned char recv_page_code;
+	unsigned int retries = SES_RETRIES;
+	struct scsi_sense_hdr sshdr;
+
+	do {
+		ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+				       &sshdr, SES_TIMEOUT, 1, NULL);
+	} while (ret > 0 && --retries && scsi_sense_valid(&sshdr) &&
+		 (sshdr.sense_key == NOT_READY ||
+		  (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
 
-	ret =  scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
-				NULL, SES_TIMEOUT, SES_RETRIES, NULL);
 	if (unlikely(ret))
 		return ret;
 
@@ -121,9 +128,16 @@ static int ses_send_diag(struct scsi_device *sdev, int page_code,
 		bufflen & 0xff,
 		0
 	};
+	struct scsi_sense_hdr sshdr;
+	unsigned int retries = SES_RETRIES;
+
+	do {
+		result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, bufflen,
+					  &sshdr, SES_TIMEOUT, 1, NULL);
+	} while (result > 0 && --retries && scsi_sense_valid(&sshdr) &&
+		 (sshdr.sense_key == NOT_READY ||
+		  (sshdr.sense_key == UNIT_ATTENTION && sshdr.asc == 0x29)));
 
-	result = scsi_execute_req(sdev, cmd, DMA_TO_DEVICE, buf, bufflen,
-				  NULL, SES_TIMEOUT, SES_RETRIES, NULL);
 	if (result)
 		sdev_printk(KERN_ERR, sdev, "SEND DIAGNOSTIC result: %8x\n",
 			    result);

From a7be240d1703784be96d23715a0b716a0d2fcc34 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Fri, 10 Sep 2021 18:29:25 +0100
Subject: [PATCH 0725/1750] irqchip/gic: Work around broken Renesas integration

[ Upstream commit b78f26926b17cc289e4f16b63363abe0aa2e8efc ]

Geert reported that the GIC driver locks up on a Renesas system
since 005c34ae4b44f085 ("irqchip/gic: Atomically update affinity")
fixed the driver to use writeb_relaxed() instead of writel_relaxed().

As it turns out, the interconnect used on this system mandates
32bit wide accesses for all MMIO transactions, even if the GIC
architecture specifically mandates for some registers to be byte
accessible. Gahhh...

Work around the issue by crudly detecting the offending system,
and falling back to an inefficient RMW+lock implementation.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/CAMuHMdV+Ev47K5NO8XHsanSq5YRMCHn2gWAQyV-q2LpJVy9HiQ@mail.gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic.c | 52 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 6053245a4754..176f5f06432d 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -107,6 +107,8 @@ static DEFINE_RAW_SPINLOCK(cpu_map_lock);
 
 #endif
 
+static DEFINE_STATIC_KEY_FALSE(needs_rmw_access);
+
 /*
  * The GIC mapping of CPU interfaces does not necessarily match
  * the logical CPU numbering.  Let's use a mapping as returned
@@ -777,6 +779,25 @@ static int gic_pm_init(struct gic_chip_data *gic)
 #endif
 
 #ifdef CONFIG_SMP
+static void rmw_writeb(u8 bval, void __iomem *addr)
+{
+	static DEFINE_RAW_SPINLOCK(rmw_lock);
+	unsigned long offset = (unsigned long)addr & 3UL;
+	unsigned long shift = offset * 8;
+	unsigned long flags;
+	u32 val;
+
+	raw_spin_lock_irqsave(&rmw_lock, flags);
+
+	addr -= offset;
+	val = readl_relaxed(addr);
+	val &= ~GENMASK(shift + 7, shift);
+	val |= bval << shift;
+	writel_relaxed(val, addr);
+
+	raw_spin_unlock_irqrestore(&rmw_lock, flags);
+}
+
 static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 			    bool force)
 {
@@ -791,7 +812,10 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 	if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids)
 		return -EINVAL;
 
-	writeb_relaxed(gic_cpu_map[cpu], reg);
+	if (static_branch_unlikely(&needs_rmw_access))
+		rmw_writeb(gic_cpu_map[cpu], reg);
+	else
+		writeb_relaxed(gic_cpu_map[cpu], reg);
 	irq_data_update_effective_affinity(d, cpumask_of(cpu));
 
 	return IRQ_SET_MASK_OK_DONE;
@@ -1384,6 +1408,30 @@ static bool gic_check_eoimode(struct device_node *node, void __iomem **base)
 	return true;
 }
 
+static bool gic_enable_rmw_access(void *data)
+{
+	/*
+	 * The EMEV2 class of machines has a broken interconnect, and
+	 * locks up on accesses that are less than 32bit. So far, only
+	 * the affinity setting requires it.
+	 */
+	if (of_machine_is_compatible("renesas,emev2")) {
+		static_branch_enable(&needs_rmw_access);
+		return true;
+	}
+
+	return false;
+}
+
+static const struct gic_quirk gic_quirks[] = {
+	{
+		.desc		= "broken byte access",
+		.compatible	= "arm,pl390",
+		.init		= gic_enable_rmw_access,
+	},
+	{ },
+};
+
 static int gic_of_setup(struct gic_chip_data *gic, struct device_node *node)
 {
 	if (!gic || !node)
@@ -1400,6 +1448,8 @@ static int gic_of_setup(struct gic_chip_data *gic, struct device_node *node)
 	if (of_property_read_u32(node, "cpu-offset", &gic->percpu_offset))
 		gic->percpu_offset = 0;
 
+	gic_enable_of_quirks(node, gic_quirks, gic);
+
 	return 0;
 
 error:

From 84778fd66d3d48638d34512a4b496955ff6b0b86 Mon Sep 17 00:00:00 2001
From: Steve French <stfrench@microsoft.com>
Date: Thu, 23 Sep 2021 16:00:31 -0500
Subject: [PATCH 0726/1750] smb3: correct smb3 ACL security descriptor

[ Upstream commit b06d893ef2492245d0319b4136edb4c346b687a3 ]

Address warning:

        fs/smbfs_client/smb2pdu.c:2425 create_sd_buf()
        warn: struct type mismatch 'smb3_acl vs cifs_acl'

Pointed out by Dan Carpenter via smatch code analysis tool

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/smb2pdu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index ca5102773b72..88554b640b0d 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -2339,7 +2339,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len)
 	buf->sd.OffsetDacl = cpu_to_le32(ptr - (__u8 *)&buf->sd);
 	/* Ship the ACL for now. we will copy it into buf later. */
 	aclptr = ptr;
-	ptr += sizeof(struct cifs_acl);
+	ptr += sizeof(struct smb3_acl);
 
 	/* create one ACE to hold the mode embedded in reserved special SID */
 	acelen = setup_special_mode_ACE((struct cifs_ace *)ptr, (__u64)mode);
@@ -2364,7 +2364,7 @@ create_sd_buf(umode_t mode, bool set_owner, unsigned int *len)
 	acl.AclRevision = ACL_REVISION; /* See 2.4.4.1 of MS-DTYP */
 	acl.AclSize = cpu_to_le16(acl_size);
 	acl.AceCount = cpu_to_le16(ace_count);
-	memcpy(aclptr, &acl, sizeof(struct cifs_acl));
+	memcpy(aclptr, &acl, sizeof(struct smb3_acl));
 
 	buf->ccontext.DataLength = cpu_to_le32(ptr - (__u8 *)&buf->sd);
 	*len = roundup(ptr - (__u8 *)buf, 8);

From 352b02562a3e01a640bf7d242ebf61003cf93c59 Mon Sep 17 00:00:00 2001
From: Changbin Du <changbin.du@gmail.com>
Date: Fri, 24 Sep 2021 15:43:41 -0700
Subject: [PATCH 0727/1750] tools/vm/page-types: remove dependency on opt_file
 for idle page tracking

[ Upstream commit ebaeab2fe87987cef28eb5ab174c42cd28594387 ]

Idle page tracking can also be used for process address space, not only
file mappings.

Without this change, using with '-i' option for process address space
encounters below errors reported.

  $ sudo ./page-types -p $(pidof bash) -i
  mark page idle: Bad file descriptor
  mark page idle: Bad file descriptor
  mark page idle: Bad file descriptor
  mark page idle: Bad file descriptor
  ...

Link: https://lkml.kernel.org/r/20210917032826.10669-1-changbin.du@gmail.com
Signed-off-by: Changbin Du <changbin.du@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/vm/page-types.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index 0517c744b04e..f62f10c988db 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -1331,7 +1331,7 @@ int main(int argc, char *argv[])
 	if (opt_list && opt_list_mapcnt)
 		kpagecount_fd = checked_open(PROC_KPAGECOUNT, O_RDONLY);
 
-	if (opt_mark_idle && opt_file)
+	if (opt_mark_idle)
 		page_idle_fd = checked_open(SYS_KERNEL_MM_PAGE_IDLE, O_RDWR);
 
 	if (opt_list && opt_pid)

From b8add3f47ae7fee564a941aa9ade3eb51ea997f0 Mon Sep 17 00:00:00 2001
From: Oliver Upton <oupton@google.com>
Date: Tue, 21 Sep 2021 17:11:21 +0000
Subject: [PATCH 0728/1750] selftests: KVM: Align SMCCC call with the spec in
 steal_time

[ Upstream commit 01f91acb55be7aac3950b89c458bcea9ef6e4f49 ]

The SMC64 calling convention passes a function identifier in w0 and its
parameters in x1-x17. Given this, there are two deviations in the
SMC64 call performed by the steal_time test: the function identifier is
assigned to a 64 bit register and the parameter is only 32 bits wide.

Align the call with the SMCCC by using a 32 bit register to handle the
function identifier and increasing the parameter width to 64 bits.

Suggested-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Oliver Upton <oupton@google.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-Id: <20210921171121.2148982-3-oupton@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/steal_time.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/kvm/steal_time.c b/tools/testing/selftests/kvm/steal_time.c
index fcc840088c91..7daedee3e7ee 100644
--- a/tools/testing/selftests/kvm/steal_time.c
+++ b/tools/testing/selftests/kvm/steal_time.c
@@ -120,12 +120,12 @@ struct st_time {
 	uint64_t st_time;
 };
 
-static int64_t smccc(uint32_t func, uint32_t arg)
+static int64_t smccc(uint32_t func, uint64_t arg)
 {
 	unsigned long ret;
 
 	asm volatile(
-		"mov	x0, %1\n"
+		"mov	w0, %w1\n"
 		"mov	x1, %2\n"
 		"hvc	#0\n"
 		"mov	%0, x0\n"

From 6d0ff920599960a22ea520afda99eed3096c0e12 Mon Sep 17 00:00:00 2001
From: Sergey Senozhatsky <senozhatsky@chromium.org>
Date: Thu, 2 Sep 2021 12:11:00 +0900
Subject: [PATCH 0729/1750] KVM: do not shrink halt_poll_ns below grow_start

[ Upstream commit ae232ea460888dc5a8b37e840c553b02521fbf18 ]

grow_halt_poll_ns() ignores values between 0 and
halt_poll_ns_grow_start (10000 by default). However,
when we shrink halt_poll_ns we may fall way below
halt_poll_ns_grow_start and endup with halt_poll_ns
values that don't make a lot of sense: like 1 or 9,
or 19.

VCPU1 trace (halt_poll_ns_shrink equals 2):

VCPU1 grow 10000
VCPU1 shrink 5000
VCPU1 shrink 2500
VCPU1 shrink 1250
VCPU1 shrink 625
VCPU1 shrink 312
VCPU1 shrink 156
VCPU1 shrink 78
VCPU1 shrink 39
VCPU1 shrink 19
VCPU1 shrink 9
VCPU1 shrink 4

Mirror what grow_halt_poll_ns() does and set halt_poll_ns
to 0 as soon as new shrink-ed halt_poll_ns value falls
below halt_poll_ns_grow_start.

Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20210902031100.252080-1-senozhatsky@chromium.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 virt/kvm/kvm_main.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 0e4310c415a8..57c0c3b18bde 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -2756,15 +2756,19 @@ static void grow_halt_poll_ns(struct kvm_vcpu *vcpu)
 
 static void shrink_halt_poll_ns(struct kvm_vcpu *vcpu)
 {
-	unsigned int old, val, shrink;
+	unsigned int old, val, shrink, grow_start;
 
 	old = val = vcpu->halt_poll_ns;
 	shrink = READ_ONCE(halt_poll_ns_shrink);
+	grow_start = READ_ONCE(halt_poll_ns_grow_start);
 	if (shrink == 0)
 		val = 0;
 	else
 		val /= shrink;
 
+	if (val < grow_start)
+		val = 0;
+
 	vcpu->halt_poll_ns = val;
 	trace_kvm_halt_poll_ns_shrink(vcpu->vcpu_id, val, old);
 }

From ae34f26d4a8487e37ab9cfdca72f447c1ef49aa5 Mon Sep 17 00:00:00 2001
From: Fares Mehanna <faresx@amazon.de>
Date: Wed, 15 Sep 2021 13:39:50 +0000
Subject: [PATCH 0730/1750] kvm: x86: Add AMD PMU MSRs to msrs_to_save_all[]

[ Upstream commit e1fc1553cd78292ab3521c94c9dd6e3e70e606a1 ]

Intel PMU MSRs is in msrs_to_save_all[], so add AMD PMU MSRs to have a
consistent behavior between Intel and AMD when using KVM_GET_MSRS,
KVM_SET_MSRS or KVM_GET_MSR_INDEX_LIST.

We have to add legacy and new MSRs to handle guests running without
X86_FEATURE_PERFCTR_CORE.

Signed-off-by: Fares Mehanna <faresx@amazon.de>
Message-Id: <20210915133951.22389-1-faresx@amazon.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/x86.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index d65da3b5837b..b885063dc393 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1250,6 +1250,13 @@ static const u32 msrs_to_save_all[] = {
 	MSR_ARCH_PERFMON_EVENTSEL0 + 12, MSR_ARCH_PERFMON_EVENTSEL0 + 13,
 	MSR_ARCH_PERFMON_EVENTSEL0 + 14, MSR_ARCH_PERFMON_EVENTSEL0 + 15,
 	MSR_ARCH_PERFMON_EVENTSEL0 + 16, MSR_ARCH_PERFMON_EVENTSEL0 + 17,
+
+	MSR_K7_EVNTSEL0, MSR_K7_EVNTSEL1, MSR_K7_EVNTSEL2, MSR_K7_EVNTSEL3,
+	MSR_K7_PERFCTR0, MSR_K7_PERFCTR1, MSR_K7_PERFCTR2, MSR_K7_PERFCTR3,
+	MSR_F15H_PERF_CTL0, MSR_F15H_PERF_CTL1, MSR_F15H_PERF_CTL2,
+	MSR_F15H_PERF_CTL3, MSR_F15H_PERF_CTL4, MSR_F15H_PERF_CTL5,
+	MSR_F15H_PERF_CTR0, MSR_F15H_PERF_CTR1, MSR_F15H_PERF_CTR2,
+	MSR_F15H_PERF_CTR3, MSR_F15H_PERF_CTR4, MSR_F15H_PERF_CTR5,
 };
 
 static u32 msrs_to_save[ARRAY_SIZE(msrs_to_save_all)];

From b56475c29bd82589c5cab0c349476206ae7a2e40 Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk@redhat.com>
Date: Tue, 14 Sep 2021 18:48:12 +0300
Subject: [PATCH 0731/1750] KVM: x86: nSVM: restore int_vector in
 svm_clear_vintr

[ Upstream commit aee77e1169c1900fe4248dc186962e745b479d9e ]

In svm_clear_vintr we try to restore the virtual interrupt
injection that might be pending, but we fail to restore
the interrupt vector.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20210914154825.104886-2-mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kvm/svm/svm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 1c23aee3778c..5e1d7396a6b8 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -1497,6 +1497,8 @@ static void svm_clear_vintr(struct vcpu_svm *svm)
 			(svm->nested.ctl.int_ctl & V_TPR_MASK));
 		svm->vmcb->control.int_ctl |= svm->nested.ctl.int_ctl &
 			V_IRQ_INJECTION_BITS_MASK;
+
+		svm->vmcb->control.int_vector = svm->nested.ctl.int_vector;
 	}
 
 	vmcb_mark_dirty(svm->vmcb, VMCB_INTR);

From 02bf504bc32b2b29e0c30d1d55fb0a504962282b Mon Sep 17 00:00:00 2001
From: Anand K Mistry <amistry@google.com>
Date: Wed, 29 Sep 2021 17:04:21 +1000
Subject: [PATCH 0732/1750] perf/x86: Reset destroy callback on event init
 failure

commit 02d029a41dc986e2d5a77ecca45803857b346829 upstream.

perf_init_event tries multiple init callbacks and does not reset the
event state between tries. When x86_pmu_event_init runs, it
unconditionally sets the destroy callback to hw_perf_event_destroy. On
the next init attempt after x86_pmu_event_init, in perf_try_init_event,
if the pmu's capabilities includes PERF_PMU_CAP_NO_EXCLUDE, the destroy
callback will be run. However, if the next init didn't set the destroy
callback, hw_perf_event_destroy will be run (since the callback wasn't
reset).

Looking at other pmu init functions, the common pattern is to only set
the destroy callback on a successful init. Resetting the callback on
failure tries to replicate that pattern.

This was discovered after commit f11dd0d80555 ("perf/x86/amd/ibs: Extend
PERF_PMU_CAP_NO_EXCLUDE to IBS Op") when the second (and only second)
run of the perf tool after a reboot results in 0 samples being
generated. The extra run of hw_perf_event_destroy results in
active_events having an extra decrement on each perf run. The second run
has active_events == 0 and every subsequent run has active_events < 0.
When active_events == 0, the NMI handler will early-out and not record
any samples.

Signed-off-by: Anand K Mistry <amistry@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20210929170405.1.I078b98ee7727f9ae9d6df8262bad7e325e40faf0@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index e6db1a1f22d7..1f5d96ba4866 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2284,6 +2284,7 @@ static int x86_pmu_event_init(struct perf_event *event)
 	if (err) {
 		if (event->destroy)
 			event->destroy(event);
+		event->destroy = NULL;
 	}
 
 	if (READ_ONCE(x86_pmu.attr_rdpmc) &&

From 387aecdab7facf7af40ff1ce8ba2d819b1f11829 Mon Sep 17 00:00:00 2001
From: Kate Hsuan <hpa@redhat.com>
Date: Fri, 3 Sep 2021 17:44:11 +0800
Subject: [PATCH 0733/1750] libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung
 860 and 870 SSD.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7a8526a5cd51cf5f070310c6c37dd7293334ac49 upstream.

Many users are reporting that the Samsung 860 and 870 SSD are having
various issues when combined with AMD/ATI (vendor ID 0x1002)  SATA
controllers and only completely disabling NCQ helps to avoid these
issues.

Always disabling NCQ for Samsung 860/870 SSDs regardless of the host
SATA adapter vendor will cause I/O performance degradation with well
behaved adapters. To limit the performance impact to ATI adapters,
introduce the ATA_HORKAGE_NO_NCQ_ON_ATI flag to force disable NCQ
only for these adapters.

Also, two libata.force parameters (noncqati and ncqati) are introduced
to disable and enable the NCQ for the system which equipped with ATI
SATA adapter and Samsung 860 and 870 SSDs. The user can determine NCQ
function to be enabled or disabled according to the demand.

After verifying the chipset from the user reports, the issue appears
on AMD/ATI SB7x0/SB8x0/SB9x0 SATA Controllers and does not appear on
recent AMD SATA adapters. The vendor ID of ATI should be 0x1002.
Therefore, ATA_HORKAGE_NO_NCQ_ON_AMD was modified to
ATA_HORKAGE_NO_NCQ_ON_ATI.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201693
Signed-off-by: Kate Hsuan <hpa@redhat.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210903094411.58749-1-hpa@redhat.com
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Cc: Krzysztof Olędzki <ole@ans.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/libata-core.c | 34 ++++++++++++++++++++++++++++++++--
 include/linux/libata.h    |  1 +
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 0e6e73b8023f..8916163d508e 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2199,6 +2199,25 @@ static void ata_dev_config_ncq_prio(struct ata_device *dev)
 
 }
 
+static bool ata_dev_check_adapter(struct ata_device *dev,
+				  unsigned short vendor_id)
+{
+	struct pci_dev *pcidev = NULL;
+	struct device *parent_dev = NULL;
+
+	for (parent_dev = dev->tdev.parent; parent_dev != NULL;
+	     parent_dev = parent_dev->parent) {
+		if (dev_is_pci(parent_dev)) {
+			pcidev = to_pci_dev(parent_dev);
+			if (pcidev->vendor == vendor_id)
+				return true;
+			break;
+		}
+	}
+
+	return false;
+}
+
 static int ata_dev_config_ncq(struct ata_device *dev,
 			       char *desc, size_t desc_sz)
 {
@@ -2217,6 +2236,13 @@ static int ata_dev_config_ncq(struct ata_device *dev,
 		snprintf(desc, desc_sz, "NCQ (not used)");
 		return 0;
 	}
+
+	if (dev->horkage & ATA_HORKAGE_NO_NCQ_ON_ATI &&
+	    ata_dev_check_adapter(dev, PCI_VENDOR_ID_ATI)) {
+		snprintf(desc, desc_sz, "NCQ (not used)");
+		return 0;
+	}
+
 	if (ap->flags & ATA_FLAG_NCQ) {
 		hdepth = min(ap->scsi_host->can_queue, ATA_MAX_QUEUE);
 		dev->flags |= ATA_DFLAG_NCQ;
@@ -3951,9 +3977,11 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
 	{ "Samsung SSD 850*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 	{ "Samsung SSD 860*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
-						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+						ATA_HORKAGE_ZERO_AFTER_TRIM |
+						ATA_HORKAGE_NO_NCQ_ON_ATI, },
 	{ "Samsung SSD 870*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
-						ATA_HORKAGE_ZERO_AFTER_TRIM, },
+						ATA_HORKAGE_ZERO_AFTER_TRIM |
+						ATA_HORKAGE_NO_NCQ_ON_ATI, },
 	{ "FCCT*M500*",			NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
 
@@ -6108,6 +6136,8 @@ static int __init ata_parse_force_one(char **cur,
 		{ "ncq",	.horkage_off	= ATA_HORKAGE_NONCQ },
 		{ "noncqtrim",	.horkage_on	= ATA_HORKAGE_NO_NCQ_TRIM },
 		{ "ncqtrim",	.horkage_off	= ATA_HORKAGE_NO_NCQ_TRIM },
+		{ "noncqati",	.horkage_on	= ATA_HORKAGE_NO_NCQ_ON_ATI },
+		{ "ncqati",	.horkage_off	= ATA_HORKAGE_NO_NCQ_ON_ATI },
 		{ "dump_id",	.horkage_on	= ATA_HORKAGE_DUMP_ID },
 		{ "pio0",	.xfer_mask	= 1 << (ATA_SHIFT_PIO + 0) },
 		{ "pio1",	.xfer_mask	= 1 << (ATA_SHIFT_PIO + 1) },
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 5f550eb27f81..57dffa0d5870 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -422,6 +422,7 @@ enum {
 	ATA_HORKAGE_NOTRIM	= (1 << 24),	/* don't use TRIM */
 	ATA_HORKAGE_MAX_SEC_1024 = (1 << 25),	/* Limit max sects to 1024 */
 	ATA_HORKAGE_MAX_TRIM_128M = (1 << 26),	/* Limit max trim size to 128M */
+	ATA_HORKAGE_NO_NCQ_ON_ATI = (1 << 27),	/* Disable NCQ on ATI chipset */
 
 	 /* DMA mask for user DMA control: User visible values; DO NOT
 	    renumber */

From 5aa003b38148d584f20455ecac85c51187d0b71e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 9 Oct 2021 14:40:58 +0200
Subject: [PATCH 0734/1750] Linux 5.10.72

Link: https://lore.kernel.org/r/20211008112716.914501436@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 1637ff7c1b75..48211c8503d4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 71
+SUBLEVEL = 72
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 79f3d20a4562575bff54266ddbc174cfab596eb2 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Mon, 11 Oct 2021 14:10:08 +0200
Subject: [PATCH 0735/1750] ANDROID: ABI: update .xml file with new symbols to
 track

After merging in the 'android12-5.10' branch, there are more symbols to
track so update the .xml file with them.

Functions changes summary: 0 Removed, 0 Changed (2919 filtered out), 18 Added functions
Variables changes summary: 0 Removed, 0 Changed (372 filtered out), 3 Added variables

18 Added functions:

  [A] 'function int __drm_atomic_helper_disable_plane(drm_plane*, drm_plane_state*)'
  [A] 'function int __traceiter_android_vh_iommu_iovad_alloc_iova(void*, device*, iova_domain*, dma_addr_t, size_t)'
  [A] 'function int __traceiter_android_vh_iommu_iovad_free_iova(void*, iova_domain*, dma_addr_t, size_t)'
  [A] 'function void drm_connector_list_update(drm_connector*)'
  [A] 'function dma_buf* drm_gem_dmabuf_export(drm_device*, dma_buf_export_info*)'
  [A] 'function int drm_gem_dmabuf_get_uuid(dma_buf*, uuid_t*)'
  [A] 'function int drm_gem_dumb_map_offset(drm_file*, drm_device*, u32, u64*)'
  [A] 'function int drm_gem_fb_afbc_init(drm_device*, const drm_mode_fb_cmd2*, drm_afbc_framebuffer*)'
  [A] 'function int drm_gem_fb_init_with_funcs(drm_device*, drm_framebuffer*, drm_file*, const drm_mode_fb_cmd2*, const drm_framebuffer_funcs*)'
  [A] 'function int drm_mode_create_tv_properties(drm_device*, unsigned int, const char* const*)'
  [A] 'function void drm_mode_prune_invalid(drm_device*, list_head*, bool)'
  [A] 'function drm_mode_status drm_mode_validate_driver(drm_device*, const drm_display_mode*)'
  [A] 'function drm_mode_status drm_mode_validate_size(const drm_display_mode*, int, int)'
  [A] 'function drm_mode_status drm_mode_validate_ycbcr420(const drm_display_mode*, drm_connector*)'
  [A] 'function unsigned long int drm_prime_get_contiguous_size(sg_table*)'
  [A] 'function drm_property* drm_property_create_object(drm_device*, u32, const char*, uint32_t)'
  [A] 'function void usb_hcd_unmap_urb_for_dma(usb_hcd*, urb*)'
  [A] 'function unsigned int usb_wakeup_enabled_descendants(usb_device*)'

3 Added variables:

  [A] 'tracepoint __tracepoint_android_vh_iommu_iovad_alloc_iova'
  [A] 'tracepoint __tracepoint_android_vh_iommu_iovad_free_iova'
  [A] 'irq_chip dummy_irq_chip'

Fixes: 3cce4e4a1b01 ("Merge branch 'android12-5.10' into `android12-5.10-lts`")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9739ded099e2089c9a530dc0b3b1392622059379
---
 android/abi_gki_aarch64.xml | 1153 ++++++++++++++++++++---------------
 1 file changed, 658 insertions(+), 495 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 95e89e80a46f..fa58e5660f6a 100755
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -83,6 +83,7 @@
       <elf-symbol name='__drm_atomic_helper_crtc_destroy_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3614bb84'/>
       <elf-symbol name='__drm_atomic_helper_crtc_duplicate_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd76e03e0'/>
       <elf-symbol name='__drm_atomic_helper_crtc_reset' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x70405d5d'/>
+      <elf-symbol name='__drm_atomic_helper_disable_plane' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x305442c8'/>
       <elf-symbol name='__drm_atomic_helper_plane_destroy_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x242c00f8'/>
       <elf-symbol name='__drm_atomic_helper_plane_duplicate_state' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xaf878c6b'/>
       <elf-symbol name='__drm_atomic_helper_plane_reset' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb6d5b99e'/>
@@ -412,6 +413,8 @@
       <elf-symbol name='__traceiter_android_vh_include_reserved_zone' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1272155'/>
       <elf-symbol name='__traceiter_android_vh_iommu_alloc_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfc2a81cc'/>
       <elf-symbol name='__traceiter_android_vh_iommu_free_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x364f5d4'/>
+      <elf-symbol name='__traceiter_android_vh_iommu_iovad_alloc_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x55a0de3'/>
+      <elf-symbol name='__traceiter_android_vh_iommu_iovad_free_iova' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x9bd5ae37'/>
       <elf-symbol name='__traceiter_android_vh_iommu_setup_dma_ops' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4272ebae'/>
       <elf-symbol name='__traceiter_android_vh_ipi_stop' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x250fcbba'/>
       <elf-symbol name='__traceiter_android_vh_ipv6_gen_linklocal_addr' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xed05983e'/>
@@ -1773,6 +1776,7 @@
       <elf-symbol name='drm_connector_list_iter_begin' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdd8caed1'/>
       <elf-symbol name='drm_connector_list_iter_end' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x13cee112'/>
       <elf-symbol name='drm_connector_list_iter_next' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd83bd809'/>
+      <elf-symbol name='drm_connector_list_update' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcfab3e71'/>
       <elf-symbol name='drm_connector_register' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x66672bd4'/>
       <elf-symbol name='drm_connector_set_panel_orientation' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf4f3a391'/>
       <elf-symbol name='drm_connector_set_path_property' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbe6ac69c'/>
@@ -1895,15 +1899,20 @@
       <elf-symbol name='drm_gem_cma_prime_vmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfd42093d'/>
       <elf-symbol name='drm_gem_cma_prime_vunmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x919fb23d'/>
       <elf-symbol name='drm_gem_create_mmap_offset' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xfc72ba40'/>
+      <elf-symbol name='drm_gem_dmabuf_export' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x58743d9d'/>
+      <elf-symbol name='drm_gem_dmabuf_get_uuid' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2422bcd8'/>
       <elf-symbol name='drm_gem_dmabuf_mmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4a93f40d'/>
       <elf-symbol name='drm_gem_dmabuf_release' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xceea26f1'/>
       <elf-symbol name='drm_gem_dmabuf_vmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xefd9435'/>
       <elf-symbol name='drm_gem_dmabuf_vunmap' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb90616f5'/>
       <elf-symbol name='drm_gem_dumb_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe0ceca01'/>
+      <elf-symbol name='drm_gem_dumb_map_offset' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x32f24e03'/>
+      <elf-symbol name='drm_gem_fb_afbc_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe9d18edd'/>
       <elf-symbol name='drm_gem_fb_create' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe1b82b43'/>
       <elf-symbol name='drm_gem_fb_create_handle' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x298a991e'/>
       <elf-symbol name='drm_gem_fb_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5bf46d4e'/>
       <elf-symbol name='drm_gem_fb_get_obj' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd89c89c6'/>
+      <elf-symbol name='drm_gem_fb_init_with_funcs' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd00ad1ac'/>
       <elf-symbol name='drm_gem_fb_prepare_fb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x44df1a9c'/>
       <elf-symbol name='drm_gem_free_mmap_offset' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xca14f36c'/>
       <elf-symbol name='drm_gem_get_pages' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x73b1db7d'/>
@@ -1988,6 +1997,7 @@
       <elf-symbol name='drm_mode_create_hdmi_colorspace_property' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x26b42282'/>
       <elf-symbol name='drm_mode_create_scaling_mode_property' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc21fc00d'/>
       <elf-symbol name='drm_mode_create_tile_group' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x973137a8'/>
+      <elf-symbol name='drm_mode_create_tv_properties' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xbfc3dd18'/>
       <elf-symbol name='drm_mode_crtc_set_gamma_size' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x15ced808'/>
       <elf-symbol name='drm_mode_debug_printmodeline' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2ed3c600'/>
       <elf-symbol name='drm_mode_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb1b6f0c8'/>
@@ -2003,9 +2013,13 @@
       <elf-symbol name='drm_mode_object_get' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x113ef8f6'/>
       <elf-symbol name='drm_mode_object_put' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x37c0a8bd'/>
       <elf-symbol name='drm_mode_probed_add' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd7e54fb'/>
+      <elf-symbol name='drm_mode_prune_invalid' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x46fd601d'/>
       <elf-symbol name='drm_mode_set_crtcinfo' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4575a0ca'/>
       <elf-symbol name='drm_mode_set_name' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4a35d30d'/>
       <elf-symbol name='drm_mode_sort' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1421d13'/>
+      <elf-symbol name='drm_mode_validate_driver' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5edc62b1'/>
+      <elf-symbol name='drm_mode_validate_size' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd7a9cf42'/>
+      <elf-symbol name='drm_mode_validate_ycbcr420' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5f7b5871'/>
       <elf-symbol name='drm_mode_vrefresh' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf1b5340a'/>
       <elf-symbol name='drm_modeset_acquire_fini' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3e5c271d'/>
       <elf-symbol name='drm_modeset_acquire_init' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x18f40ec8'/>
@@ -2047,6 +2061,7 @@
       <elf-symbol name='drm_plane_enable_fb_damage_clips' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3e7a9b18'/>
       <elf-symbol name='drm_poll' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7b227ad9'/>
       <elf-symbol name='drm_prime_gem_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7cac31ca'/>
+      <elf-symbol name='drm_prime_get_contiguous_size' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd05fda43'/>
       <elf-symbol name='drm_prime_pages_to_sg' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x79319a20'/>
       <elf-symbol name='drm_prime_sg_to_page_addr_arrays' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xee1e60b3'/>
       <elf-symbol name='drm_printf' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x28779e52'/>
@@ -2057,6 +2072,7 @@
       <elf-symbol name='drm_property_create_blob' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xca6b1aea'/>
       <elf-symbol name='drm_property_create_bool' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xca67675c'/>
       <elf-symbol name='drm_property_create_enum' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3378688'/>
+      <elf-symbol name='drm_property_create_object' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5eb1d4a8'/>
       <elf-symbol name='drm_property_create_range' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x574cd639'/>
       <elf-symbol name='drm_property_create_signed_range' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3c4524d4'/>
       <elf-symbol name='drm_property_destroy' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xf933d35f'/>
@@ -5088,6 +5104,7 @@
       <elf-symbol name='usb_hcd_resume_root_hub' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x5094011a'/>
       <elf-symbol name='usb_hcd_start_port_resume' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x917842be'/>
       <elf-symbol name='usb_hcd_unlink_urb_from_ep' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x2da87985'/>
+      <elf-symbol name='usb_hcd_unmap_urb_for_dma' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe11e3bed'/>
       <elf-symbol name='usb_hub_clear_tt_buffer' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xb839ed8d'/>
       <elf-symbol name='usb_hub_find_child' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x3301cee6'/>
       <elf-symbol name='usb_ifnum_to_if' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x79b60370'/>
@@ -5135,6 +5152,7 @@
       <elf-symbol name='usb_unanchor_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x399a458c'/>
       <elf-symbol name='usb_unpoison_urb' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xc518a377'/>
       <elf-symbol name='usb_unregister_notify' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x811dc334'/>
+      <elf-symbol name='usb_wakeup_enabled_descendants' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xa8576ad'/>
       <elf-symbol name='usb_wakeup_notification' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x84edb62f'/>
       <elf-symbol name='usbnet_change_mtu' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x29b080fc'/>
       <elf-symbol name='usbnet_defer_kevent' type='func-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x983cd249'/>
@@ -5677,6 +5695,8 @@
       <elf-symbol name='__tracepoint_android_vh_include_reserved_zone' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xdf6b3544'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_alloc_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x456fc48'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_free_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xd04c533c'/>
+      <elf-symbol name='__tracepoint_android_vh_iommu_iovad_alloc_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7907ef49'/>
+      <elf-symbol name='__tracepoint_android_vh_iommu_iovad_free_iova' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x86c1e3b3'/>
       <elf-symbol name='__tracepoint_android_vh_iommu_setup_dma_ops' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x95f68a6b'/>
       <elf-symbol name='__tracepoint_android_vh_ipi_stop' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x8064d573'/>
       <elf-symbol name='__tracepoint_android_vh_ipv6_gen_linklocal_addr' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xcd130856'/>
@@ -5879,6 +5899,7 @@
       <elf-symbol name='dma_contiguous_default_area' size='8' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x4fd950ed'/>
       <elf-symbol name='dma_fence_array_ops' size='72' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe03a689d'/>
       <elf-symbol name='drm_gem_cma_vm_ops' size='144' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x7a22aac0'/>
+      <elf-symbol name='dummy_irq_chip' size='288' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x77cb60af'/>
       <elf-symbol name='efi' size='256' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x190a48a9'/>
       <elf-symbol name='efi_tpm_final_log_size' size='4' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0xe9e8faeb'/>
       <elf-symbol name='failure_tracking' size='16' type='object-type' binding='global-binding' visibility='default-visibility' is-defined='yes' crc='0x23f6655a'/>
@@ -9376,174 +9397,174 @@
           <var-decl name='abort_completion' type-id='b50a4934' visibility='default' filepath='include/drm/drm_atomic.h' line='155' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='bpf_prog_aux' size-in-bits='5504' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='782' column='1' id='09d9fab9'>
+      <class-decl name='bpf_prog_aux' size-in-bits='5504' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='784' column='1' id='09d9fab9'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='refcnt' type-id='28ee064c' visibility='default' filepath='include/linux/bpf.h' line='783' column='1'/>
+          <var-decl name='refcnt' type-id='28ee064c' visibility='default' filepath='include/linux/bpf.h' line='785' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='used_map_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='784' column='1'/>
+          <var-decl name='used_map_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='786' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='max_ctx_offset' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='785' column='1'/>
+          <var-decl name='max_ctx_offset' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='787' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='max_pkt_offset' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='786' column='1'/>
+          <var-decl name='max_pkt_offset' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='788' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='max_tp_access' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='787' column='1'/>
+          <var-decl name='max_tp_access' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='789' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='stack_depth' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='788' column='1'/>
+          <var-decl name='stack_depth' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='790' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='789' column='1'/>
+          <var-decl name='id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='791' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='func_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='790' column='1'/>
+          <var-decl name='func_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='792' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='288'>
-          <var-decl name='func_idx' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='791' column='1'/>
+          <var-decl name='func_idx' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='793' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='attach_btf_id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='792' column='1'/>
+          <var-decl name='attach_btf_id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='794' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='ctx_arg_info_size' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='793' column='1'/>
+          <var-decl name='ctx_arg_info_size' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='795' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='max_rdonly_access' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='794' column='1'/>
+          <var-decl name='max_rdonly_access' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='796' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='416'>
-          <var-decl name='max_rdwr_access' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='795' column='1'/>
+          <var-decl name='max_rdwr_access' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='797' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='ctx_arg_info' type-id='2dd1b3d2' visibility='default' filepath='include/linux/bpf.h' line='796' column='1'/>
+          <var-decl name='ctx_arg_info' type-id='2dd1b3d2' visibility='default' filepath='include/linux/bpf.h' line='798' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='dst_mutex' type-id='925167dc' visibility='default' filepath='include/linux/bpf.h' line='797' column='1'/>
+          <var-decl name='dst_mutex' type-id='925167dc' visibility='default' filepath='include/linux/bpf.h' line='799' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='dst_prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='798' column='1'/>
+          <var-decl name='dst_prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='800' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='dst_trampoline' type-id='3014966f' visibility='default' filepath='include/linux/bpf.h' line='799' column='1'/>
+          <var-decl name='dst_trampoline' type-id='3014966f' visibility='default' filepath='include/linux/bpf.h' line='801' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='saved_dst_prog_type' type-id='b80df76a' visibility='default' filepath='include/linux/bpf.h' line='800' column='1'/>
+          <var-decl name='saved_dst_prog_type' type-id='b80df76a' visibility='default' filepath='include/linux/bpf.h' line='802' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1056'>
-          <var-decl name='saved_dst_attach_type' type-id='67ce11ed' visibility='default' filepath='include/linux/bpf.h' line='801' column='1'/>
+          <var-decl name='saved_dst_attach_type' type-id='67ce11ed' visibility='default' filepath='include/linux/bpf.h' line='803' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='verifier_zext' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='802' column='1'/>
+          <var-decl name='verifier_zext' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='804' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1096'>
-          <var-decl name='offload_requested' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='803' column='1'/>
+          <var-decl name='offload_requested' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='805' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1104'>
-          <var-decl name='attach_btf_trace' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='804' column='1'/>
+          <var-decl name='attach_btf_trace' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='806' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1112'>
-          <var-decl name='func_proto_unreliable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='805' column='1'/>
+          <var-decl name='func_proto_unreliable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='807' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1120'>
-          <var-decl name='sleepable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='806' column='1'/>
+          <var-decl name='sleepable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='808' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1128'>
-          <var-decl name='tail_call_reachable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='807' column='1'/>
+          <var-decl name='tail_call_reachable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='809' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='tramp_hlist' type-id='03a4a074' visibility='default' filepath='include/linux/bpf.h' line='808' column='1'/>
+          <var-decl name='tramp_hlist' type-id='03a4a074' visibility='default' filepath='include/linux/bpf.h' line='810' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='attach_func_proto' type-id='28379b39' visibility='default' filepath='include/linux/bpf.h' line='810' column='1'/>
+          <var-decl name='attach_func_proto' type-id='28379b39' visibility='default' filepath='include/linux/bpf.h' line='812' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='attach_func_name' type-id='80f4b756' visibility='default' filepath='include/linux/bpf.h' line='812' column='1'/>
+          <var-decl name='attach_func_name' type-id='80f4b756' visibility='default' filepath='include/linux/bpf.h' line='814' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='func' type-id='50b674cc' visibility='default' filepath='include/linux/bpf.h' line='813' column='1'/>
+          <var-decl name='func' type-id='50b674cc' visibility='default' filepath='include/linux/bpf.h' line='815' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='jit_data' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='814' column='1'/>
+          <var-decl name='jit_data' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='816' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='poke_tab' type-id='02b2042b' visibility='default' filepath='include/linux/bpf.h' line='815' column='1'/>
+          <var-decl name='poke_tab' type-id='02b2042b' visibility='default' filepath='include/linux/bpf.h' line='817' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='size_poke_tab' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='816' column='1'/>
+          <var-decl name='size_poke_tab' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='818' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='ksym' type-id='466449bc' visibility='default' filepath='include/linux/bpf.h' line='817' column='1'/>
+          <var-decl name='ksym' type-id='466449bc' visibility='default' filepath='include/linux/bpf.h' line='819' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3392'>
-          <var-decl name='ops' type-id='330c0db4' visibility='default' filepath='include/linux/bpf.h' line='818' column='1'/>
+          <var-decl name='ops' type-id='330c0db4' visibility='default' filepath='include/linux/bpf.h' line='820' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3456'>
-          <var-decl name='used_maps' type-id='0928d5d6' visibility='default' filepath='include/linux/bpf.h' line='819' column='1'/>
+          <var-decl name='used_maps' type-id='0928d5d6' visibility='default' filepath='include/linux/bpf.h' line='821' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3520'>
-          <var-decl name='used_maps_mutex' type-id='925167dc' visibility='default' filepath='include/linux/bpf.h' line='820' column='1'/>
+          <var-decl name='used_maps_mutex' type-id='925167dc' visibility='default' filepath='include/linux/bpf.h' line='822' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3904'>
-          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='821' column='1'/>
+          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='823' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3968'>
-          <var-decl name='user' type-id='273a7d34' visibility='default' filepath='include/linux/bpf.h' line='822' column='1'/>
+          <var-decl name='user' type-id='273a7d34' visibility='default' filepath='include/linux/bpf.h' line='824' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4032'>
-          <var-decl name='load_time' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='823' column='1'/>
+          <var-decl name='load_time' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='825' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4096'>
-          <var-decl name='cgroup_storage' type-id='f57e9a44' visibility='default' filepath='include/linux/bpf.h' line='824' column='1'/>
+          <var-decl name='cgroup_storage' type-id='f57e9a44' visibility='default' filepath='include/linux/bpf.h' line='826' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4224'>
-          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/linux/bpf.h' line='825' column='1'/>
+          <var-decl name='name' type-id='ac1fa8c0' visibility='default' filepath='include/linux/bpf.h' line='827' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4352'>
-          <var-decl name='security' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='827' column='1'/>
+          <var-decl name='security' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='829' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4416'>
-          <var-decl name='offload' type-id='11f19dd0' visibility='default' filepath='include/linux/bpf.h' line='829' column='1'/>
+          <var-decl name='offload' type-id='11f19dd0' visibility='default' filepath='include/linux/bpf.h' line='831' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4480'>
-          <var-decl name='btf' type-id='a469220f' visibility='default' filepath='include/linux/bpf.h' line='830' column='1'/>
+          <var-decl name='btf' type-id='a469220f' visibility='default' filepath='include/linux/bpf.h' line='832' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4544'>
-          <var-decl name='func_info' type-id='368d43d3' visibility='default' filepath='include/linux/bpf.h' line='831' column='1'/>
+          <var-decl name='func_info' type-id='368d43d3' visibility='default' filepath='include/linux/bpf.h' line='833' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4608'>
-          <var-decl name='func_info_aux' type-id='9ee77e60' visibility='default' filepath='include/linux/bpf.h' line='832' column='1'/>
+          <var-decl name='func_info_aux' type-id='9ee77e60' visibility='default' filepath='include/linux/bpf.h' line='834' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4672'>
-          <var-decl name='linfo' type-id='2fcb9b17' visibility='default' filepath='include/linux/bpf.h' line='839' column='1'/>
+          <var-decl name='linfo' type-id='2fcb9b17' visibility='default' filepath='include/linux/bpf.h' line='841' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4736'>
-          <var-decl name='jited_linfo' type-id='63e171df' visibility='default' filepath='include/linux/bpf.h' line='847' column='1'/>
+          <var-decl name='jited_linfo' type-id='63e171df' visibility='default' filepath='include/linux/bpf.h' line='849' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4800'>
-          <var-decl name='func_info_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='848' column='1'/>
+          <var-decl name='func_info_cnt' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='850' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4832'>
-          <var-decl name='nr_linfo' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='849' column='1'/>
+          <var-decl name='nr_linfo' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='851' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4864'>
-          <var-decl name='linfo_idx' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='854' column='1'/>
+          <var-decl name='linfo_idx' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='856' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4896'>
-          <var-decl name='num_exentries' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='855' column='1'/>
+          <var-decl name='num_exentries' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='857' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4928'>
-          <var-decl name='extable' type-id='7f0eb64c' visibility='default' filepath='include/linux/bpf.h' line='856' column='1'/>
+          <var-decl name='extable' type-id='7f0eb64c' visibility='default' filepath='include/linux/bpf.h' line='858' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4992'>
-          <var-decl name='stats' type-id='fbf2ba3a' visibility='default' filepath='include/linux/bpf.h' line='857' column='1'/>
+          <var-decl name='stats' type-id='fbf2ba3a' visibility='default' filepath='include/linux/bpf.h' line='859' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5056'>
-          <var-decl name='' type-id='b597c0fa' visibility='default' filepath='include/linux/bpf.h' line='858' column='1'/>
+          <var-decl name='' type-id='b597c0fa' visibility='default' filepath='include/linux/bpf.h' line='860' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5440'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='862' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='864' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='57bfbe05' size-in-bits='64' id='09dbca85'/>
@@ -13866,9 +13887,9 @@
       </class-decl>
       <pointer-type-def type-id='bc51cf2c' size-in-bits='64' id='156433b6'/>
       <pointer-type-def type-id='61a50456' size-in-bits='64' id='156888c8'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1' id='156952c4'>
+      <class-decl name='__anonymous_struct__' size-in-bits='64' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='527' column='1' id='156952c4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='drivers/usb/host/xhci.h' line='1935' column='1'/>
+          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='527' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='io_uring_task' size-in-bits='1408' is-struct='yes' visibility='default' filepath='include/linux/io_uring.h' line='25' column='1' id='156a7d89'>
@@ -14884,6 +14905,29 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/usb/typec_altmode.h' line='33' column='1'/>
         </data-member>
       </class-decl>
+      <class-decl name='drm_afbc_framebuffer' size-in-bits='1792' is-struct='yes' visibility='default' filepath='include/drm/drm_framebuffer.h' line='305' column='1' id='17a723bf'>
+        <data-member access='public' layout-offset-in-bits='0'>
+          <var-decl name='base' type-id='a0eb3346' visibility='default' filepath='include/drm/drm_framebuffer.h' line='309' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1600'>
+          <var-decl name='block_width' type-id='19c2251e' visibility='default' filepath='include/drm/drm_framebuffer.h' line='313' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1632'>
+          <var-decl name='block_height' type-id='19c2251e' visibility='default' filepath='include/drm/drm_framebuffer.h' line='317' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1664'>
+          <var-decl name='aligned_width' type-id='19c2251e' visibility='default' filepath='include/drm/drm_framebuffer.h' line='321' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1696'>
+          <var-decl name='aligned_height' type-id='19c2251e' visibility='default' filepath='include/drm/drm_framebuffer.h' line='325' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1728'>
+          <var-decl name='offset' type-id='19c2251e' visibility='default' filepath='include/drm/drm_framebuffer.h' line='329' column='1'/>
+        </data-member>
+        <data-member access='public' layout-offset-in-bits='1760'>
+          <var-decl name='afbc_size' type-id='19c2251e' visibility='default' filepath='include/drm/drm_framebuffer.h' line='333' column='1'/>
+        </data-member>
+      </class-decl>
       <pointer-type-def type-id='32efe300' size-in-bits='64' id='17a94daa'/>
       <pointer-type-def type-id='ee10f079' size-in-bits='64' id='17aa52a9'/>
       <function-type size-in-bits='64' id='17ae78d2'>
@@ -28175,6 +28219,7 @@
         <parameter type-id='1abf108f'/>
         <return type-id='95e97e5e'/>
       </function-type>
+      <pointer-type-def type-id='4da0249b' size-in-bits='64' id='3bc4f0bb'/>
       <class-decl name='drm_gem_object' size-in-bits='2752' is-struct='yes' visibility='default' filepath='include/drm/drm_gem.h' line='184' column='1' id='3bc524c0'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='refcount' type-id='400fb07b' visibility='default' filepath='include/drm/drm_gem.h' line='194' column='1'/>
@@ -32126,24 +32171,24 @@
       </union-decl>
       <pointer-type-def type-id='309421a5' size-in-bits='64' id='465e35b9'/>
       <pointer-type-def type-id='4e0a6ade' size-in-bits='64' id='465f7e18'/>
-      <class-decl name='bpf_ksym' size-in-bits='1728' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='581' column='1' id='466449bc'>
+      <class-decl name='bpf_ksym' size-in-bits='1728' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='583' column='1' id='466449bc'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='start' type-id='7359adad' visibility='default' filepath='include/linux/bpf.h' line='582' column='1'/>
+          <var-decl name='start' type-id='7359adad' visibility='default' filepath='include/linux/bpf.h' line='584' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='end' type-id='7359adad' visibility='default' filepath='include/linux/bpf.h' line='583' column='1'/>
+          <var-decl name='end' type-id='7359adad' visibility='default' filepath='include/linux/bpf.h' line='585' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='name' type-id='e3204322' visibility='default' filepath='include/linux/bpf.h' line='584' column='1'/>
+          <var-decl name='name' type-id='e3204322' visibility='default' filepath='include/linux/bpf.h' line='586' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='lnode' type-id='72f469ec' visibility='default' filepath='include/linux/bpf.h' line='585' column='1'/>
+          <var-decl name='lnode' type-id='72f469ec' visibility='default' filepath='include/linux/bpf.h' line='587' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='tnode' type-id='dc9cc7c7' visibility='default' filepath='include/linux/bpf.h' line='586' column='1'/>
+          <var-decl name='tnode' type-id='dc9cc7c7' visibility='default' filepath='include/linux/bpf.h' line='588' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='prog' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='587' column='1'/>
+          <var-decl name='prog' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='589' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='4666032d'>
@@ -47740,9 +47785,9 @@
           <var-decl name='tail' type-id='a150e667' visibility='default' filepath='include/linux/tty.h' line='95' column='1'/>
         </data-member>
       </class-decl>
-      <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='763' column='1' id='6b217604'>
+      <union-decl name='__anonymous_union__' size-in-bits='128' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='765' column='1' id='6b217604'>
         <data-member access='public'>
-          <var-decl name='tail_call' type-id='d60eb7fb' visibility='default' filepath='include/linux/bpf.h' line='767' column='1'/>
+          <var-decl name='tail_call' type-id='d60eb7fb' visibility='default' filepath='include/linux/bpf.h' line='769' column='1'/>
         </data-member>
       </union-decl>
       <qualified-type-def type-id='1354385d' const='yes' id='6b2a4486'/>
@@ -48982,15 +49027,15 @@
         <parameter type-id='19c2251e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='__anonymous_struct__' size-in-bits='256' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='617' column='1' id='6e530776'>
+      <class-decl name='__anonymous_struct__' size-in-bits='256' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='619' column='1' id='6e530776'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='model' type-id='323174d0' visibility='default' filepath='include/linux/bpf.h' line='618' column='1'/>
+          <var-decl name='model' type-id='323174d0' visibility='default' filepath='include/linux/bpf.h' line='620' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='addr' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='619' column='1'/>
+          <var-decl name='addr' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='621' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='ftrace_managed' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='620' column='1'/>
+          <var-decl name='ftrace_managed' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='622' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='ff_rumble_effect' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/uapi/linux/input.h' line='422' column='1' id='6e5c8c15'>
@@ -49986,162 +50031,162 @@
           <var-decl name='type' type-id='9ff1dafd' visibility='default' filepath='include/linux/quota.h' line='74' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='proto' size-in-bits='3328' is-struct='yes' visibility='default' filepath='include/net/sock.h' line='1140' column='1' id='7203ee09'>
+      <class-decl name='proto' size-in-bits='3328' is-struct='yes' visibility='default' filepath='include/net/sock.h' line='1141' column='1' id='7203ee09'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='close' type-id='09f3a86b' visibility='default' filepath='include/net/sock.h' line='1141' column='1'/>
+          <var-decl name='close' type-id='09f3a86b' visibility='default' filepath='include/net/sock.h' line='1142' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='pre_connect' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1143' column='1'/>
+          <var-decl name='pre_connect' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1144' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='connect' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1146' column='1'/>
+          <var-decl name='connect' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1147' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='disconnect' type-id='95208a5e' visibility='default' filepath='include/net/sock.h' line='1149' column='1'/>
+          <var-decl name='disconnect' type-id='95208a5e' visibility='default' filepath='include/net/sock.h' line='1150' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='accept' type-id='67adf9a9' visibility='default' filepath='include/net/sock.h' line='1151' column='1'/>
+          <var-decl name='accept' type-id='67adf9a9' visibility='default' filepath='include/net/sock.h' line='1152' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='ioctl' type-id='08113f0a' visibility='default' filepath='include/net/sock.h' line='1154' column='1'/>
+          <var-decl name='ioctl' type-id='08113f0a' visibility='default' filepath='include/net/sock.h' line='1155' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='init' type-id='55530c47' visibility='default' filepath='include/net/sock.h' line='1156' column='1'/>
+          <var-decl name='init' type-id='55530c47' visibility='default' filepath='include/net/sock.h' line='1157' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='destroy' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1157' column='1'/>
+          <var-decl name='destroy' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1158' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='shutdown' type-id='e937debf' visibility='default' filepath='include/net/sock.h' line='1158' column='1'/>
+          <var-decl name='shutdown' type-id='e937debf' visibility='default' filepath='include/net/sock.h' line='1159' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='setsockopt' type-id='df9e6665' visibility='default' filepath='include/net/sock.h' line='1159' column='1'/>
+          <var-decl name='setsockopt' type-id='df9e6665' visibility='default' filepath='include/net/sock.h' line='1160' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='getsockopt' type-id='e0fadd76' visibility='default' filepath='include/net/sock.h' line='1162' column='1'/>
+          <var-decl name='getsockopt' type-id='e0fadd76' visibility='default' filepath='include/net/sock.h' line='1163' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='keepalive' type-id='e937debf' visibility='default' filepath='include/net/sock.h' line='1165' column='1'/>
+          <var-decl name='keepalive' type-id='e937debf' visibility='default' filepath='include/net/sock.h' line='1166' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='compat_ioctl' type-id='20da830b' visibility='default' filepath='include/net/sock.h' line='1167' column='1'/>
+          <var-decl name='compat_ioctl' type-id='20da830b' visibility='default' filepath='include/net/sock.h' line='1168' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='sendmsg' type-id='1df08751' visibility='default' filepath='include/net/sock.h' line='1170' column='1'/>
+          <var-decl name='sendmsg' type-id='1df08751' visibility='default' filepath='include/net/sock.h' line='1171' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='recvmsg' type-id='74e71fae' visibility='default' filepath='include/net/sock.h' line='1172' column='1'/>
+          <var-decl name='recvmsg' type-id='74e71fae' visibility='default' filepath='include/net/sock.h' line='1173' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='sendpage' type-id='65399e23' visibility='default' filepath='include/net/sock.h' line='1175' column='1'/>
+          <var-decl name='sendpage' type-id='65399e23' visibility='default' filepath='include/net/sock.h' line='1176' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='bind' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1177' column='1'/>
+          <var-decl name='bind' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1178' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1088'>
-          <var-decl name='bind_add' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1179' column='1'/>
+          <var-decl name='bind_add' type-id='c25ed103' visibility='default' filepath='include/net/sock.h' line='1180' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='backlog_rcv' type-id='a0f5247f' visibility='default' filepath='include/net/sock.h' line='1182' column='1'/>
+          <var-decl name='backlog_rcv' type-id='a0f5247f' visibility='default' filepath='include/net/sock.h' line='1183' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='release_cb' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1185' column='1'/>
+          <var-decl name='release_cb' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1186' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='hash' type-id='55530c47' visibility='default' filepath='include/net/sock.h' line='1188' column='1'/>
+          <var-decl name='hash' type-id='55530c47' visibility='default' filepath='include/net/sock.h' line='1189' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='unhash' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1189' column='1'/>
+          <var-decl name='unhash' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1190' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1408'>
-          <var-decl name='rehash' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1190' column='1'/>
+          <var-decl name='rehash' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1191' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1472'>
-          <var-decl name='get_port' type-id='078de3a3' visibility='default' filepath='include/net/sock.h' line='1191' column='1'/>
+          <var-decl name='get_port' type-id='078de3a3' visibility='default' filepath='include/net/sock.h' line='1192' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1536'>
-          <var-decl name='inuse_idx' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1195' column='1'/>
+          <var-decl name='inuse_idx' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1196' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1600'>
-          <var-decl name='stream_memory_free' type-id='bf751261' visibility='default' filepath='include/net/sock.h' line='1198' column='1'/>
+          <var-decl name='stream_memory_free' type-id='bf751261' visibility='default' filepath='include/net/sock.h' line='1199' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1664'>
-          <var-decl name='stream_memory_read' type-id='3d4d3aba' visibility='default' filepath='include/net/sock.h' line='1199' column='1'/>
+          <var-decl name='stream_memory_read' type-id='3d4d3aba' visibility='default' filepath='include/net/sock.h' line='1200' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1728'>
-          <var-decl name='enter_memory_pressure' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1201' column='1'/>
+          <var-decl name='enter_memory_pressure' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1202' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='leave_memory_pressure' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1202' column='1'/>
+          <var-decl name='leave_memory_pressure' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='1203' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1856'>
-          <var-decl name='memory_allocated' type-id='5403cb36' visibility='default' filepath='include/net/sock.h' line='1203' column='1'/>
+          <var-decl name='memory_allocated' type-id='5403cb36' visibility='default' filepath='include/net/sock.h' line='1204' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='sockets_allocated' type-id='84c6078d' visibility='default' filepath='include/net/sock.h' line='1204' column='1'/>
+          <var-decl name='sockets_allocated' type-id='84c6078d' visibility='default' filepath='include/net/sock.h' line='1205' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='memory_pressure' type-id='1d2c2b85' visibility='default' filepath='include/net/sock.h' line='1211' column='1'/>
+          <var-decl name='memory_pressure' type-id='1d2c2b85' visibility='default' filepath='include/net/sock.h' line='1212' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='sysctl_mem' type-id='3ccc2590' visibility='default' filepath='include/net/sock.h' line='1212' column='1'/>
+          <var-decl name='sysctl_mem' type-id='3ccc2590' visibility='default' filepath='include/net/sock.h' line='1213' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2112'>
-          <var-decl name='sysctl_wmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1214' column='1'/>
+          <var-decl name='sysctl_wmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1215' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2176'>
-          <var-decl name='sysctl_rmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1215' column='1'/>
+          <var-decl name='sysctl_rmem' type-id='7292109c' visibility='default' filepath='include/net/sock.h' line='1216' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2240'>
-          <var-decl name='sysctl_wmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1216' column='1'/>
+          <var-decl name='sysctl_wmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1217' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2272'>
-          <var-decl name='sysctl_rmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1217' column='1'/>
+          <var-decl name='sysctl_rmem_offset' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='1218' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2304'>
-          <var-decl name='max_header' type-id='95e97e5e' visibility='default' filepath='include/net/sock.h' line='1219' column='1'/>
+          <var-decl name='max_header' type-id='95e97e5e' visibility='default' filepath='include/net/sock.h' line='1220' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2336'>
-          <var-decl name='no_autobind' type-id='b50a4934' visibility='default' filepath='include/net/sock.h' line='1220' column='1'/>
+          <var-decl name='no_autobind' type-id='b50a4934' visibility='default' filepath='include/net/sock.h' line='1221' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2368'>
-          <var-decl name='slab' type-id='f3b4aca8' visibility='default' filepath='include/net/sock.h' line='1222' column='1'/>
+          <var-decl name='slab' type-id='f3b4aca8' visibility='default' filepath='include/net/sock.h' line='1223' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2432'>
-          <var-decl name='obj_size' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1223' column='1'/>
+          <var-decl name='obj_size' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1224' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2464'>
-          <var-decl name='slab_flags' type-id='f7fe96cb' visibility='default' filepath='include/net/sock.h' line='1224' column='1'/>
+          <var-decl name='slab_flags' type-id='f7fe96cb' visibility='default' filepath='include/net/sock.h' line='1225' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2496'>
-          <var-decl name='useroffset' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1225' column='1'/>
+          <var-decl name='useroffset' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1226' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2528'>
-          <var-decl name='usersize' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1226' column='1'/>
+          <var-decl name='usersize' type-id='f0981eeb' visibility='default' filepath='include/net/sock.h' line='1227' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2560'>
-          <var-decl name='orphan_count' type-id='84c6078d' visibility='default' filepath='include/net/sock.h' line='1228' column='1'/>
+          <var-decl name='orphan_count' type-id='84c6078d' visibility='default' filepath='include/net/sock.h' line='1229' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2624'>
-          <var-decl name='rsk_prot' type-id='db994912' visibility='default' filepath='include/net/sock.h' line='1230' column='1'/>
+          <var-decl name='rsk_prot' type-id='db994912' visibility='default' filepath='include/net/sock.h' line='1231' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2688'>
-          <var-decl name='twsk_prot' type-id='d68ad8b5' visibility='default' filepath='include/net/sock.h' line='1231' column='1'/>
+          <var-decl name='twsk_prot' type-id='d68ad8b5' visibility='default' filepath='include/net/sock.h' line='1232' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2752'>
-          <var-decl name='h' type-id='adf5bf47' visibility='default' filepath='include/net/sock.h' line='1238' column='1'/>
+          <var-decl name='h' type-id='adf5bf47' visibility='default' filepath='include/net/sock.h' line='1239' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2816'>
-          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/sock.h' line='1240' column='1'/>
+          <var-decl name='owner' type-id='2730d015' visibility='default' filepath='include/net/sock.h' line='1241' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2880'>
-          <var-decl name='name' type-id='16dc656a' visibility='default' filepath='include/net/sock.h' line='1242' column='1'/>
+          <var-decl name='name' type-id='16dc656a' visibility='default' filepath='include/net/sock.h' line='1243' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3136'>
-          <var-decl name='node' type-id='72f469ec' visibility='default' filepath='include/net/sock.h' line='1244' column='1'/>
+          <var-decl name='node' type-id='72f469ec' visibility='default' filepath='include/net/sock.h' line='1245' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3264'>
-          <var-decl name='diag_destroy' type-id='95208a5e' visibility='default' filepath='include/net/sock.h' line='1248' column='1'/>
+          <var-decl name='diag_destroy' type-id='95208a5e' visibility='default' filepath='include/net/sock.h' line='1249' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='trace_buffer' is-struct='yes' visibility='default' is-declaration-only='yes' id='72093c11'/>
@@ -55395,24 +55440,24 @@
         <return type-id='48b5725f'/>
       </function-type>
       <qualified-type-def type-id='f69b84e9' const='yes' id='7ebeca6e'/>
-      <class-decl name='bpf_tramp_image' size-in-bits='2432' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='598' column='1' id='7ec1f60a'>
+      <class-decl name='bpf_tramp_image' size-in-bits='2432' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='600' column='1' id='7ec1f60a'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='image' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='599' column='1'/>
+          <var-decl name='image' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='601' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='ksym' type-id='466449bc' visibility='default' filepath='include/linux/bpf.h' line='600' column='1'/>
+          <var-decl name='ksym' type-id='466449bc' visibility='default' filepath='include/linux/bpf.h' line='602' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1792'>
-          <var-decl name='pcref' type-id='818799b4' visibility='default' filepath='include/linux/bpf.h' line='601' column='1'/>
+          <var-decl name='pcref' type-id='818799b4' visibility='default' filepath='include/linux/bpf.h' line='603' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1920'>
-          <var-decl name='ip_after_call' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='602' column='1'/>
+          <var-decl name='ip_after_call' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='604' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1984'>
-          <var-decl name='ip_epilogue' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='603' column='1'/>
+          <var-decl name='ip_epilogue' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='605' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2048'>
-          <var-decl name='' type-id='ae58df2c' visibility='default' filepath='include/linux/bpf.h' line='604' column='1'/>
+          <var-decl name='' type-id='ae58df2c' visibility='default' filepath='include/linux/bpf.h' line='606' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='7ec379e7'>
@@ -60131,12 +60176,12 @@
           <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/linux/rtc.h' line='147' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='bpf_func_info_aux' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='749' column='1' id='89aea402'>
+      <class-decl name='bpf_func_info_aux' size-in-bits='32' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='751' column='1' id='89aea402'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='linkage' type-id='1dc6a898' visibility='default' filepath='include/linux/bpf.h' line='750' column='1'/>
+          <var-decl name='linkage' type-id='1dc6a898' visibility='default' filepath='include/linux/bpf.h' line='752' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='16'>
-          <var-decl name='unreliable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='751' column='1'/>
+          <var-decl name='unreliable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='753' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='89af975c'>
@@ -64999,9 +65044,9 @@
         <parameter type-id='b50a4934'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <class-decl name='bpf_iter_aux_info' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='1320' column='1' id='952798b4'>
+      <class-decl name='bpf_iter_aux_info' size-in-bits='64' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='1322' column='1' id='952798b4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='map' type-id='00ee50b8' visibility='default' filepath='include/linux/bpf.h' line='1321' column='1'/>
+          <var-decl name='map' type-id='00ee50b8' visibility='default' filepath='include/linux/bpf.h' line='1323' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='48288128' size-in-bits='64' id='952cef4e'/>
@@ -70237,103 +70282,103 @@
           <var-decl name='sk_peer_cred' type-id='bc33861a' visibility='default' filepath='include/net/sock.h' line='485' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4928'>
-          <var-decl name='sk_rcvtimeo' type-id='bd54fe1a' visibility='default' filepath='include/net/sock.h' line='486' column='1'/>
+          <var-decl name='sk_rcvtimeo' type-id='bd54fe1a' visibility='default' filepath='include/net/sock.h' line='487' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='4992'>
-          <var-decl name='sk_stamp' type-id='fbc017ef' visibility='default' filepath='include/net/sock.h' line='487' column='1'/>
+          <var-decl name='sk_stamp' type-id='fbc017ef' visibility='default' filepath='include/net/sock.h' line='488' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5056'>
-          <var-decl name='sk_tsflags' type-id='1dc6a898' visibility='default' filepath='include/net/sock.h' line='491' column='1'/>
+          <var-decl name='sk_tsflags' type-id='1dc6a898' visibility='default' filepath='include/net/sock.h' line='492' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5072'>
-          <var-decl name='sk_shutdown' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='492' column='1'/>
+          <var-decl name='sk_shutdown' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='493' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5088'>
-          <var-decl name='sk_tskey' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='493' column='1'/>
+          <var-decl name='sk_tskey' type-id='19c2251e' visibility='default' filepath='include/net/sock.h' line='494' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5120'>
-          <var-decl name='sk_zckey' type-id='49178f86' visibility='default' filepath='include/net/sock.h' line='494' column='1'/>
+          <var-decl name='sk_zckey' type-id='49178f86' visibility='default' filepath='include/net/sock.h' line='495' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5152'>
-          <var-decl name='sk_clockid' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='496' column='1'/>
+          <var-decl name='sk_clockid' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='497' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='sk_txtime_deadline_mode' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='497' column='1'/>
+          <var-decl name='sk_txtime_deadline_mode' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='498' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='sk_txtime_report_errors' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='498' column='1'/>
+          <var-decl name='sk_txtime_report_errors' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='499' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='sk_txtime_unused' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='499' column='1'/>
+          <var-decl name='sk_txtime_unused' type-id='f9b06939' visibility='default' filepath='include/net/sock.h' line='500' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5184'>
-          <var-decl name='sk_socket' type-id='13103032' visibility='default' filepath='include/net/sock.h' line='501' column='1'/>
+          <var-decl name='sk_socket' type-id='13103032' visibility='default' filepath='include/net/sock.h' line='502' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5248'>
-          <var-decl name='sk_user_data' type-id='eaa32e2f' visibility='default' filepath='include/net/sock.h' line='502' column='1'/>
+          <var-decl name='sk_user_data' type-id='eaa32e2f' visibility='default' filepath='include/net/sock.h' line='503' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5312'>
-          <var-decl name='sk_security' type-id='eaa32e2f' visibility='default' filepath='include/net/sock.h' line='504' column='1'/>
+          <var-decl name='sk_security' type-id='eaa32e2f' visibility='default' filepath='include/net/sock.h' line='505' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5376'>
-          <var-decl name='sk_cgrp_data' type-id='8544f103' visibility='default' filepath='include/net/sock.h' line='506' column='1'/>
+          <var-decl name='sk_cgrp_data' type-id='8544f103' visibility='default' filepath='include/net/sock.h' line='507' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5440'>
-          <var-decl name='sk_memcg' type-id='223696fb' visibility='default' filepath='include/net/sock.h' line='507' column='1'/>
+          <var-decl name='sk_memcg' type-id='223696fb' visibility='default' filepath='include/net/sock.h' line='508' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5504'>
-          <var-decl name='sk_state_change' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='508' column='1'/>
+          <var-decl name='sk_state_change' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='509' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5568'>
-          <var-decl name='sk_data_ready' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='509' column='1'/>
+          <var-decl name='sk_data_ready' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='510' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5632'>
-          <var-decl name='sk_write_space' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='510' column='1'/>
+          <var-decl name='sk_write_space' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='511' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5696'>
-          <var-decl name='sk_error_report' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='511' column='1'/>
+          <var-decl name='sk_error_report' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='512' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5760'>
-          <var-decl name='sk_backlog_rcv' type-id='a0f5247f' visibility='default' filepath='include/net/sock.h' line='512' column='1'/>
+          <var-decl name='sk_backlog_rcv' type-id='a0f5247f' visibility='default' filepath='include/net/sock.h' line='513' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5824'>
-          <var-decl name='sk_destruct' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='519' column='1'/>
+          <var-decl name='sk_destruct' type-id='841969d0' visibility='default' filepath='include/net/sock.h' line='520' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5888'>
-          <var-decl name='sk_reuseport_cb' type-id='1d22b7e5' visibility='default' filepath='include/net/sock.h' line='520' column='1'/>
+          <var-decl name='sk_reuseport_cb' type-id='1d22b7e5' visibility='default' filepath='include/net/sock.h' line='521' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5952'>
-          <var-decl name='sk_bpf_storage' type-id='30c83839' visibility='default' filepath='include/net/sock.h' line='522' column='1'/>
+          <var-decl name='sk_bpf_storage' type-id='30c83839' visibility='default' filepath='include/net/sock.h' line='523' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6016'>
-          <var-decl name='sk_rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/sock.h' line='524' column='1'/>
+          <var-decl name='sk_rcu' type-id='e3d8ce29' visibility='default' filepath='include/net/sock.h' line='525' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6144'>
-          <var-decl name='android_kabi_reserved1' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='526' column='1'/>
+          <var-decl name='' type-id='b3414a3c' visibility='default' filepath='include/net/sock.h' line='527' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6208'>
-          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='527' column='1'/>
+          <var-decl name='android_kabi_reserved2' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='528' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6272'>
-          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='528' column='1'/>
+          <var-decl name='android_kabi_reserved3' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='529' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6336'>
-          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='529' column='1'/>
+          <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='530' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6400'>
-          <var-decl name='android_kabi_reserved5' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='530' column='1'/>
+          <var-decl name='android_kabi_reserved5' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='531' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6464'>
-          <var-decl name='android_kabi_reserved6' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='531' column='1'/>
+          <var-decl name='android_kabi_reserved6' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='532' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6528'>
-          <var-decl name='android_kabi_reserved7' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='532' column='1'/>
+          <var-decl name='android_kabi_reserved7' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='533' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6592'>
-          <var-decl name='android_kabi_reserved8' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='533' column='1'/>
+          <var-decl name='android_kabi_reserved8' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='534' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6656'>
-          <var-decl name='android_oem_data1' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='535' column='1'/>
+          <var-decl name='android_oem_data1' type-id='91ce1af9' visibility='default' filepath='include/net/sock.h' line='536' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='unicode_map' is-struct='yes' visibility='default' is-declaration-only='yes' id='a24978a1'/>
@@ -74695,15 +74740,15 @@
         <parameter type-id='b59d7dce'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='bpf_ctx_arg_aux' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='776' column='1' id='ac12d63f'>
+      <class-decl name='bpf_ctx_arg_aux' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='778' column='1' id='ac12d63f'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='offset' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='777' column='1'/>
+          <var-decl name='offset' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='779' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='reg_type' type-id='e830436a' visibility='default' filepath='include/linux/bpf.h' line='778' column='1'/>
+          <var-decl name='reg_type' type-id='e830436a' visibility='default' filepath='include/linux/bpf.h' line='780' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='btf_id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='779' column='1'/>
+          <var-decl name='btf_id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='781' column='1'/>
         </data-member>
       </class-decl>
       <array-type-def dimensions='1' type-id='a84c031d' size-in-bits='96' id='ac151b64'>
@@ -74775,9 +74820,9 @@
       <pointer-type-def type-id='512ac7cc' size-in-bits='64' id='ac58af12'/>
       <pointer-type-def type-id='b254b8db' size-in-bits='64' id='ac5f2363'/>
       <pointer-type-def type-id='49a0ad34' size-in-bits='64' id='ac6963b2'/>
-      <class-decl name='prot_inuse' size-in-bits='2048' is-struct='yes' visibility='default' filepath='net/core/sock.c' line='3311' column='1' id='ac763c5d'>
+      <class-decl name='prot_inuse' size-in-bits='2048' is-struct='yes' visibility='default' filepath='net/core/sock.c' line='3331' column='1' id='ac763c5d'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='val' type-id='93e41790' visibility='default' filepath='net/core/sock.c' line='3312' column='1'/>
+          <var-decl name='val' type-id='93e41790' visibility='default' filepath='net/core/sock.c' line='3332' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='ac765b39'>
@@ -74800,36 +74845,36 @@
         </data-member>
       </class-decl>
       <typedef-decl name='__kernel_fsid_t' type-id='b55219f8' filepath='include/uapi/asm-generic/posix_types.h' line='81' column='1' id='ac895711'/>
-      <class-decl name='bpf_trampoline' size-in-bits='1408' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='610' column='1' id='ac8c8ac7'>
+      <class-decl name='bpf_trampoline' size-in-bits='1408' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='612' column='1' id='ac8c8ac7'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hlist' type-id='03a4a074' visibility='default' filepath='include/linux/bpf.h' line='612' column='1'/>
+          <var-decl name='hlist' type-id='03a4a074' visibility='default' filepath='include/linux/bpf.h' line='614' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='include/linux/bpf.h' line='614' column='1'/>
+          <var-decl name='mutex' type-id='925167dc' visibility='default' filepath='include/linux/bpf.h' line='616' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='refcnt' type-id='64615833' visibility='default' filepath='include/linux/bpf.h' line='615' column='1'/>
+          <var-decl name='refcnt' type-id='64615833' visibility='default' filepath='include/linux/bpf.h' line='617' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='key' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='616' column='1'/>
+          <var-decl name='key' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='618' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='func' type-id='6e530776' visibility='default' filepath='include/linux/bpf.h' line='621' column='1'/>
+          <var-decl name='func' type-id='6e530776' visibility='default' filepath='include/linux/bpf.h' line='623' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='extension_prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='626' column='1'/>
+          <var-decl name='extension_prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='628' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='progs_hlist' type-id='fc293b5f' visibility='default' filepath='include/linux/bpf.h' line='628' column='1'/>
+          <var-decl name='progs_hlist' type-id='fc293b5f' visibility='default' filepath='include/linux/bpf.h' line='630' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='progs_cnt' type-id='e024279b' visibility='default' filepath='include/linux/bpf.h' line='630' column='1'/>
+          <var-decl name='progs_cnt' type-id='e024279b' visibility='default' filepath='include/linux/bpf.h' line='632' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1280'>
-          <var-decl name='cur_image' type-id='c2123138' visibility='default' filepath='include/linux/bpf.h' line='632' column='1'/>
+          <var-decl name='cur_image' type-id='c2123138' visibility='default' filepath='include/linux/bpf.h' line='634' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1344'>
-          <var-decl name='selector' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='633' column='1'/>
+          <var-decl name='selector' type-id='91ce1af9' visibility='default' filepath='include/linux/bpf.h' line='635' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='ec9f1e6a' size-in-bits='64' id='ac9d10e4'/>
@@ -75179,18 +75224,18 @@
       <qualified-type-def type-id='6119d604' const='yes' id='add714bf'/>
       <pointer-type-def type-id='476ef610' size-in-bits='64' id='addd4a1a'/>
       <pointer-type-def type-id='51bb592e' size-in-bits='64' id='aded214c'/>
-      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='1233' column='1' id='adf5bf47'>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='1234' column='1' id='adf5bf47'>
         <data-member access='public'>
-          <var-decl name='hashinfo' type-id='d7a1e3c2' visibility='default' filepath='include/net/sock.h' line='1234' column='1'/>
+          <var-decl name='hashinfo' type-id='d7a1e3c2' visibility='default' filepath='include/net/sock.h' line='1235' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='udp_table' type-id='115daa23' visibility='default' filepath='include/net/sock.h' line='1235' column='1'/>
+          <var-decl name='udp_table' type-id='115daa23' visibility='default' filepath='include/net/sock.h' line='1236' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='raw_hash' type-id='eb2c56dc' visibility='default' filepath='include/net/sock.h' line='1236' column='1'/>
+          <var-decl name='raw_hash' type-id='eb2c56dc' visibility='default' filepath='include/net/sock.h' line='1237' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='smc_hash' type-id='aa8162a3' visibility='default' filepath='include/net/sock.h' line='1237' column='1'/>
+          <var-decl name='smc_hash' type-id='aa8162a3' visibility='default' filepath='include/net/sock.h' line='1238' column='1'/>
         </data-member>
       </union-decl>
       <qualified-type-def type-id='014e0a24' const='yes' id='adff645d'/>
@@ -75296,12 +75341,12 @@
         <parameter type-id='67bbaeda'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <union-decl name='__anonymous_union__' size-in-bits='384' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='604' column='1' id='ae58df2c'>
+      <union-decl name='__anonymous_union__' size-in-bits='384' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='606' column='1' id='ae58df2c'>
         <data-member access='public'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/bpf.h' line='605' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/bpf.h' line='607' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/bpf.h' line='606' column='1'/>
+          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/bpf.h' line='608' column='1'/>
         </data-member>
       </union-decl>
       <function-type size-in-bits='64' id='ae5a8333'>
@@ -77768,6 +77813,17 @@
           <var-decl name='ptl' type-id='fb4018a0' visibility='default' filepath='include/linux/mm_types.h' line='159' column='1'/>
         </data-member>
       </class-decl>
+      <union-decl name='__anonymous_union__' size-in-bits='64' is-anonymous='yes' visibility='default' filepath='include/net/sock.h' line='527' column='1' id='b3414a3c'>
+        <data-member access='public'>
+          <var-decl name='sk_peer_lock' type-id='fb4018a0' visibility='default' filepath='include/net/sock.h' line='527' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='' type-id='156952c4' visibility='default' filepath='include/net/sock.h' line='527' column='1'/>
+        </data-member>
+        <data-member access='public'>
+          <var-decl name='' type-id='2a125a28' visibility='default' filepath='include/net/sock.h' line='527' column='1'/>
+        </data-member>
+      </union-decl>
       <pointer-type-def type-id='33f6a667' size-in-bits='64' id='b346094b'/>
       <pointer-type-def type-id='1a4194ca' size-in-bits='64' id='b347e5ac'/>
       <class-decl name='__drm_crtcs_state' size-in-bits='448' is-struct='yes' visibility='default' filepath='include/drm/drm_atomic.h' line='163' column='1' id='b35335c8'>
@@ -78783,12 +78839,12 @@
         <parameter type-id='7359adad'/>
         <return type-id='f9409001'/>
       </function-type>
-      <union-decl name='__anonymous_union__' size-in-bits='384' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='858' column='1' id='b597c0fa'>
+      <union-decl name='__anonymous_union__' size-in-bits='384' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='860' column='1' id='b597c0fa'>
         <data-member access='public'>
-          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/bpf.h' line='859' column='1'/>
+          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/bpf.h' line='861' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/bpf.h' line='860' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/bpf.h' line='862' column='1'/>
         </data-member>
       </union-decl>
       <class-decl name='pinctrl_dev' size-in-bits='1664' is-struct='yes' visibility='default' filepath='drivers/pinctrl/core.h' line='42' column='1' id='b5990c25'>
@@ -82979,24 +83035,24 @@
           <var-decl name='driver_tstamp' type-id='40a816ad' visibility='default' filepath='include/sound/pcm.h' line='425' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='bpf_link_ops' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='889' column='1' id='bc84eba7'>
+      <class-decl name='bpf_link_ops' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='891' column='1' id='bc84eba7'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='release' type-id='42861783' visibility='default' filepath='include/linux/bpf.h' line='890' column='1'/>
+          <var-decl name='release' type-id='42861783' visibility='default' filepath='include/linux/bpf.h' line='892' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='dealloc' type-id='42861783' visibility='default' filepath='include/linux/bpf.h' line='891' column='1'/>
+          <var-decl name='dealloc' type-id='42861783' visibility='default' filepath='include/linux/bpf.h' line='893' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='detach' type-id='32271368' visibility='default' filepath='include/linux/bpf.h' line='892' column='1'/>
+          <var-decl name='detach' type-id='32271368' visibility='default' filepath='include/linux/bpf.h' line='894' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='update_prog' type-id='1f1dd1be' visibility='default' filepath='include/linux/bpf.h' line='893' column='1'/>
+          <var-decl name='update_prog' type-id='1f1dd1be' visibility='default' filepath='include/linux/bpf.h' line='895' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='show_fdinfo' type-id='e3a7f506' visibility='default' filepath='include/linux/bpf.h' line='895' column='1'/>
+          <var-decl name='show_fdinfo' type-id='e3a7f506' visibility='default' filepath='include/linux/bpf.h' line='897' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='fill_link_info' type-id='9e2873bb' visibility='default' filepath='include/linux/bpf.h' line='896' column='1'/>
+          <var-decl name='fill_link_info' type-id='9e2873bb' visibility='default' filepath='include/linux/bpf.h' line='898' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='df042c09' size-in-bits='64' id='bc9b7fcd'/>
@@ -87384,6 +87440,7 @@
           <var-decl name='preferred_refresh' type-id='f9b06939' visibility='default' filepath='include/drm/drm_edid.h' line='122' column='1'/>
         </data-member>
       </class-decl>
+      <pointer-type-def type-id='17a723bf' size-in-bits='64' id='c599ec07'/>
       <class-decl name='xfrm_replay_state' size-in-bits='96' is-struct='yes' visibility='default' filepath='include/uapi/linux/xfrm.h' line='84' column='1' id='c59d261e'>
         <data-member access='public' layout-offset-in-bits='0'>
           <var-decl name='oseq' type-id='3f1a6b60' visibility='default' filepath='include/uapi/linux/xfrm.h' line='85' column='1'/>
@@ -87947,12 +88004,12 @@
         <parameter type-id='95e97e5e'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='bpf_prog_array' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='1062' column='1' id='c75c7b06'>
+      <class-decl name='bpf_prog_array' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='1064' column='1' id='c75c7b06'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/bpf.h' line='1063' column='1'/>
+          <var-decl name='rcu' type-id='e3d8ce29' visibility='default' filepath='include/linux/bpf.h' line='1065' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='items' type-id='3f814540' visibility='default' filepath='include/linux/bpf.h' line='1064' column='1'/>
+          <var-decl name='items' type-id='3f814540' visibility='default' filepath='include/linux/bpf.h' line='1066' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='c763c2ea'>
@@ -93073,30 +93130,30 @@
         <return type-id='95e97e5e'/>
       </function-type>
       <qualified-type-def type-id='582de67c' const='yes' id='d4f1de57'/>
-      <class-decl name='bpf_jit_poke_descriptor' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='759' column='1' id='d4f2184b'>
+      <class-decl name='bpf_jit_poke_descriptor' size-in-bits='384' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='761' column='1' id='d4f2184b'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='tailcall_target' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='760' column='1'/>
+          <var-decl name='tailcall_target' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='762' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='tailcall_bypass' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='761' column='1'/>
+          <var-decl name='tailcall_bypass' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='763' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='bypass_addr' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='762' column='1'/>
+          <var-decl name='bypass_addr' type-id='eaa32e2f' visibility='default' filepath='include/linux/bpf.h' line='764' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='' type-id='6b217604' visibility='default' filepath='include/linux/bpf.h' line='763' column='1'/>
+          <var-decl name='' type-id='6b217604' visibility='default' filepath='include/linux/bpf.h' line='765' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='tailcall_target_stable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='769' column='1'/>
+          <var-decl name='tailcall_target_stable' type-id='b50a4934' visibility='default' filepath='include/linux/bpf.h' line='771' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='328'>
-          <var-decl name='adj_off' type-id='f9b06939' visibility='default' filepath='include/linux/bpf.h' line='770' column='1'/>
+          <var-decl name='adj_off' type-id='f9b06939' visibility='default' filepath='include/linux/bpf.h' line='772' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='336'>
-          <var-decl name='reason' type-id='1dc6a898' visibility='default' filepath='include/linux/bpf.h' line='771' column='1'/>
+          <var-decl name='reason' type-id='1dc6a898' visibility='default' filepath='include/linux/bpf.h' line='773' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='352'>
-          <var-decl name='insn_idx' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='772' column='1'/>
+          <var-decl name='insn_idx' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='774' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='a388c264' size-in-bits='64' id='d4f2b9b2'/>
@@ -93790,12 +93847,12 @@
       <pointer-type-def type-id='e2da4ade' size-in-bits='64' id='d5f76b20'/>
       <pointer-type-def type-id='62d1e232' size-in-bits='64' id='d601a214'/>
       <pointer-type-def type-id='c393ee9b' size-in-bits='64' id='d60d5a0f'/>
-      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='764' column='1' id='d60eb7fb'>
+      <class-decl name='__anonymous_struct__' size-in-bits='128' is-struct='yes' is-anonymous='yes' visibility='default' filepath='include/linux/bpf.h' line='766' column='1' id='d60eb7fb'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='map' type-id='00ee50b8' visibility='default' filepath='include/linux/bpf.h' line='765' column='1'/>
+          <var-decl name='map' type-id='00ee50b8' visibility='default' filepath='include/linux/bpf.h' line='767' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='key' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='766' column='1'/>
+          <var-decl name='key' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='768' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='de031042' size-in-bits='64' id='d60f4f10'/>
@@ -99201,24 +99258,24 @@
           <var-decl name='freq1_offset' type-id='1dc6a898' visibility='default' filepath='include/net/cfg80211.h' line='698' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='bpf_link' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='880' column='1' id='e07e9784'>
+      <class-decl name='bpf_link' size-in-bits='640' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='882' column='1' id='e07e9784'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='refcnt' type-id='28ee064c' visibility='default' filepath='include/linux/bpf.h' line='881' column='1'/>
+          <var-decl name='refcnt' type-id='28ee064c' visibility='default' filepath='include/linux/bpf.h' line='883' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='882' column='1'/>
+          <var-decl name='id' type-id='19c2251e' visibility='default' filepath='include/linux/bpf.h' line='884' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='type' type-id='b0467036' visibility='default' filepath='include/linux/bpf.h' line='883' column='1'/>
+          <var-decl name='type' type-id='b0467036' visibility='default' filepath='include/linux/bpf.h' line='885' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='ops' type-id='747013e8' visibility='default' filepath='include/linux/bpf.h' line='884' column='1'/>
+          <var-decl name='ops' type-id='747013e8' visibility='default' filepath='include/linux/bpf.h' line='886' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='885' column='1'/>
+          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='887' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/bpf.h' line='886' column='1'/>
+          <var-decl name='work' type-id='ef9025d0' visibility='default' filepath='include/linux/bpf.h' line='888' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='e093b8f6'>
@@ -108485,12 +108542,12 @@
         <return type-id='48b5725f'/>
       </function-type>
       <qualified-type-def type-id='83b59630' const='yes' id='f67ba3ad'/>
-      <class-decl name='bpf_prog_array_item' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='1057' column='1' id='f67e137c'>
+      <class-decl name='bpf_prog_array_item' size-in-bits='192' is-struct='yes' visibility='default' filepath='include/linux/bpf.h' line='1059' column='1' id='f67e137c'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='1058' column='1'/>
+          <var-decl name='prog' type-id='bdcee7ae' visibility='default' filepath='include/linux/bpf.h' line='1060' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='cgroup_storage' type-id='dcd9fb4c' visibility='default' filepath='include/linux/bpf.h' line='1059' column='1'/>
+          <var-decl name='cgroup_storage' type-id='dcd9fb4c' visibility='default' filepath='include/linux/bpf.h' line='1061' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='f680e13e'>
@@ -113026,6 +113083,11 @@
         <parameter type-id='35078cb9' name='crtc_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='92' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='__drm_atomic_helper_disable_plane' mangled-name='__drm_atomic_helper_disable_plane' filepath='drivers/gpu/drm/drm_atomic.c' line='1379' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_helper_disable_plane'>
+        <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_atomic.c' line='1379' column='1'/>
+        <parameter type-id='d0835005' name='plane_state' filepath='drivers/gpu/drm/drm_atomic.c' line='1380' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='__drm_atomic_helper_plane_destroy_state' mangled-name='__drm_atomic_helper_plane_destroy_state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='348' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__drm_atomic_helper_plane_destroy_state'>
         <parameter type-id='d0835005' name='state' filepath='drivers/gpu/drm/drm_atomic_state_helper.c' line='348' column='1'/>
         <return type-id='48b5725f'/>
@@ -115013,24 +115075,39 @@
         <parameter type-id='1d2c2b85' name='addr' filepath='include/trace/hooks/mm.h' line='64' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_iommu_alloc_iova' mangled-name='__traceiter_android_vh_iommu_alloc_iova' filepath='include/trace/hooks/iommu.h' line='21' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_alloc_iova'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
-        <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
-        <parameter type-id='cf29c9b3' name='iova' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='include/trace/hooks/iommu.h' line='21' column='1'/>
+      <function-decl name='__traceiter_android_vh_iommu_alloc_iova' mangled-name='__traceiter_android_vh_iommu_alloc_iova' filepath='include/trace/hooks/iommu.h' line='19' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_alloc_iova'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='19' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='19' column='1'/>
+        <parameter type-id='cf29c9b3' name='iova' filepath='include/trace/hooks/iommu.h' line='19' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='include/trace/hooks/iommu.h' line='19' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_iommu_free_iova' mangled-name='__traceiter_android_vh_iommu_free_iova' filepath='include/trace/hooks/iommu.h' line='25' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_free_iova'>
+      <function-decl name='__traceiter_android_vh_iommu_free_iova' mangled-name='__traceiter_android_vh_iommu_free_iova' filepath='include/trace/hooks/iommu.h' line='29' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_free_iova'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='29' column='1'/>
+        <parameter type-id='cf29c9b3' name='iova' filepath='include/trace/hooks/iommu.h' line='29' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='include/trace/hooks/iommu.h' line='29' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_iommu_iovad_alloc_iova' mangled-name='__traceiter_android_vh_iommu_iovad_alloc_iova' filepath='include/trace/hooks/iommu.h' line='25' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_iovad_alloc_iova'>
         <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='25' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='25' column='1'/>
+        <parameter type-id='0c2c419d' name='iovad' filepath='include/trace/hooks/iommu.h' line='25' column='1'/>
         <parameter type-id='cf29c9b3' name='iova' filepath='include/trace/hooks/iommu.h' line='25' column='1'/>
         <parameter type-id='b59d7dce' name='size' filepath='include/trace/hooks/iommu.h' line='25' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='__traceiter_android_vh_iommu_setup_dma_ops' mangled-name='__traceiter_android_vh_iommu_setup_dma_ops' filepath='include/trace/hooks/iommu.h' line='17' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_setup_dma_ops'>
-        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='17' column='1'/>
-        <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='17' column='1'/>
-        <parameter type-id='91ce1af9' name='dma_base' filepath='include/trace/hooks/iommu.h' line='17' column='1'/>
-        <parameter type-id='91ce1af9' name='size' filepath='include/trace/hooks/iommu.h' line='17' column='1'/>
+      <function-decl name='__traceiter_android_vh_iommu_iovad_free_iova' mangled-name='__traceiter_android_vh_iommu_iovad_free_iova' filepath='include/trace/hooks/iommu.h' line='33' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_iovad_free_iova'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='33' column='1'/>
+        <parameter type-id='0c2c419d' name='iovad' filepath='include/trace/hooks/iommu.h' line='33' column='1'/>
+        <parameter type-id='cf29c9b3' name='iova' filepath='include/trace/hooks/iommu.h' line='33' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='include/trace/hooks/iommu.h' line='33' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='__traceiter_android_vh_iommu_setup_dma_ops' mangled-name='__traceiter_android_vh_iommu_setup_dma_ops' filepath='include/trace/hooks/iommu.h' line='15' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_iommu_setup_dma_ops'>
+        <parameter type-id='eaa32e2f' name='__data' filepath='include/trace/hooks/iommu.h' line='15' column='1'/>
+        <parameter type-id='fa0b179b' name='dev' filepath='include/trace/hooks/iommu.h' line='15' column='1'/>
+        <parameter type-id='91ce1af9' name='dma_base' filepath='include/trace/hooks/iommu.h' line='15' column='1'/>
+        <parameter type-id='91ce1af9' name='size' filepath='include/trace/hooks/iommu.h' line='15' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__traceiter_android_vh_ipi_stop' mangled-name='__traceiter_android_vh_ipi_stop' filepath='include/trace/hooks/debug.h' line='16' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__traceiter_android_vh_ipi_stop'>
@@ -116033,9 +116110,11 @@
       <var-decl name='__tracepoint_android_vh_gic_resume' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_gic_resume' visibility='default' filepath='include/trace/hooks/gic.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_gic_resume'/>
       <var-decl name='__tracepoint_android_vh_gpio_block_read' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_gpio_block_read' visibility='default' filepath='include/trace/hooks/gpiolib.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_gpio_block_read'/>
       <var-decl name='__tracepoint_android_vh_include_reserved_zone' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_include_reserved_zone' visibility='default' filepath='include/trace/hooks/mm.h' line='64' column='1' elf-symbol-id='__tracepoint_android_vh_include_reserved_zone'/>
-      <var-decl name='__tracepoint_android_vh_iommu_alloc_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_alloc_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='21' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_alloc_iova'/>
-      <var-decl name='__tracepoint_android_vh_iommu_free_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_free_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='25' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_free_iova'/>
-      <var-decl name='__tracepoint_android_vh_iommu_setup_dma_ops' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_setup_dma_ops' visibility='default' filepath='include/trace/hooks/iommu.h' line='17' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_setup_dma_ops'/>
+      <var-decl name='__tracepoint_android_vh_iommu_alloc_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_alloc_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='19' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_alloc_iova'/>
+      <var-decl name='__tracepoint_android_vh_iommu_free_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_free_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='29' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_free_iova'/>
+      <var-decl name='__tracepoint_android_vh_iommu_iovad_alloc_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_iovad_alloc_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='25' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_iovad_alloc_iova'/>
+      <var-decl name='__tracepoint_android_vh_iommu_iovad_free_iova' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_iovad_free_iova' visibility='default' filepath='include/trace/hooks/iommu.h' line='33' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_iovad_free_iova'/>
+      <var-decl name='__tracepoint_android_vh_iommu_setup_dma_ops' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_iommu_setup_dma_ops' visibility='default' filepath='include/trace/hooks/iommu.h' line='15' column='1' elf-symbol-id='__tracepoint_android_vh_iommu_setup_dma_ops'/>
       <var-decl name='__tracepoint_android_vh_ipi_stop' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ipi_stop' visibility='default' filepath='include/trace/hooks/debug.h' line='16' column='1' elf-symbol-id='__tracepoint_android_vh_ipi_stop'/>
       <var-decl name='__tracepoint_android_vh_ipv6_gen_linklocal_addr' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_ipv6_gen_linklocal_addr' visibility='default' filepath='include/trace/hooks/ipv6.h' line='14' column='1' elf-symbol-id='__tracepoint_android_vh_ipv6_gen_linklocal_addr'/>
       <var-decl name='__tracepoint_android_vh_irqtime_account_process_tick' type-id='4ca0c298' mangled-name='__tracepoint_android_vh_irqtime_account_process_tick' visibility='default' filepath='include/trace/hooks/sched.h' line='302' column='1' elf-symbol-id='__tracepoint_android_vh_irqtime_account_process_tick'/>
@@ -122724,6 +122803,10 @@
         <parameter type-id='40a902ec' name='iter' filepath='drivers/gpu/drm/drm_connector.c' line='693' column='1'/>
         <return type-id='4db02c58'/>
       </function-decl>
+      <function-decl name='drm_connector_list_update' mangled-name='drm_connector_list_update' filepath='drivers/gpu/drm/drm_modes.c' line='1338' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_list_update'>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_modes.c' line='1338' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='drm_connector_register' mangled-name='drm_connector_register' filepath='drivers/gpu/drm/drm_connector.c' line='502' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_connector_register'>
         <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_connector.c' line='502' column='1'/>
         <return type-id='95e97e5e'/>
@@ -123353,6 +123436,16 @@
         <parameter type-id='abd62a96' name='obj' filepath='drivers/gpu/drm/drm_gem.c' line='514' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='drm_gem_dmabuf_export' mangled-name='drm_gem_dmabuf_export' filepath='drivers/gpu/drm/drm_prime.c' line='240' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_dmabuf_export'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_prime.c' line='240' column='1'/>
+        <parameter type-id='3bc4f0bb' name='exp_info' filepath='drivers/gpu/drm/drm_prime.c' line='241' column='1'/>
+        <return type-id='5e4f599b'/>
+      </function-decl>
+      <function-decl name='drm_gem_dmabuf_get_uuid' mangled-name='drm_gem_dmabuf_get_uuid' filepath='drivers/gpu/drm/drm_prime.c' line='793' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_dmabuf_get_uuid'>
+        <parameter type-id='5e4f599b' name='dma_buf' filepath='drivers/gpu/drm/drm_prime.c' line='793' column='1'/>
+        <parameter type-id='f1397309' name='uuid' filepath='drivers/gpu/drm/drm_prime.c' line='793' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='drm_gem_dmabuf_mmap' mangled-name='drm_gem_dmabuf_mmap' filepath='drivers/gpu/drm/drm_prime.c' line='771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_dmabuf_mmap'>
         <parameter type-id='5e4f599b' name='dma_buf' filepath='drivers/gpu/drm/drm_prime.c' line='771' column='1'/>
         <parameter type-id='2ae08426' name='vma' filepath='drivers/gpu/drm/drm_prime.c' line='771' column='1'/>
@@ -123377,6 +123470,19 @@
         <parameter type-id='8f92235e' name='handle' filepath='drivers/gpu/drm/drm_gem.c' line='351' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
+      <function-decl name='drm_gem_dumb_map_offset' mangled-name='drm_gem_dumb_map_offset' filepath='drivers/gpu/drm/drm_gem.c' line='312' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_dumb_map_offset'>
+        <parameter type-id='9e99ecc1' name='file' filepath='drivers/gpu/drm/drm_gem.c' line='312' column='1'/>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_gem.c' line='312' column='1'/>
+        <parameter type-id='19c2251e' name='handle' filepath='drivers/gpu/drm/drm_gem.c' line='313' column='1'/>
+        <parameter type-id='3df9fd28' name='offset' filepath='drivers/gpu/drm/drm_gem.c' line='313' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
+      <function-decl name='drm_gem_fb_afbc_init' mangled-name='drm_gem_fb_afbc_init' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='412' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_fb_afbc_init'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='412' column='1'/>
+        <parameter type-id='92ed24a5' name='mode_cmd' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='413' column='1'/>
+        <parameter type-id='c599ec07' name='afbc_fb' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='414' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='drm_gem_fb_create' mangled-name='drm_gem_fb_create' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='264' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_fb_create'>
         <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='264' column='1'/>
         <parameter type-id='9e99ecc1' name='file' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='264' column='1'/>
@@ -123398,6 +123504,14 @@
         <parameter type-id='f0981eeb' name='plane' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='55' column='1'/>
         <return type-id='abd62a96'/>
       </function-decl>
+      <function-decl name='drm_gem_fb_init_with_funcs' mangled-name='drm_gem_fb_init_with_funcs' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='147' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_fb_init_with_funcs'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='147' column='1'/>
+        <parameter type-id='7b332e1c' name='fb' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='148' column='1'/>
+        <parameter type-id='9e99ecc1' name='file' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='149' column='1'/>
+        <parameter type-id='92ed24a5' name='mode_cmd' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='150' column='1'/>
+        <parameter type-id='8e992c3d' name='funcs' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='151' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='drm_gem_fb_prepare_fb' mangled-name='drm_gem_fb_prepare_fb' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='454' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_gem_fb_prepare_fb'>
         <parameter type-id='a6711537' name='plane' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='454' column='1'/>
         <parameter type-id='d0835005' name='state' filepath='drivers/gpu/drm/drm_gem_framebuffer_helper.c' line='455' column='1'/>
@@ -123813,6 +123927,12 @@
         <parameter type-id='80f4b756' name='topology' filepath='drivers/gpu/drm/drm_connector.c' line='2539' column='1'/>
         <return type-id='c6c44b9f'/>
       </function-decl>
+      <function-decl name='drm_mode_create_tv_properties' mangled-name='drm_mode_create_tv_properties' filepath='drivers/gpu/drm/drm_connector.c' line='1504' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_create_tv_properties'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_connector.c' line='1504' column='1'/>
+        <parameter type-id='f0981eeb' name='num_modes' filepath='drivers/gpu/drm/drm_connector.c' line='1505' column='1'/>
+        <parameter type-id='13956559' name='modes' filepath='drivers/gpu/drm/drm_connector.c' line='1506' column='1'/>
+        <return type-id='95e97e5e'/>
+      </function-decl>
       <function-decl name='drm_mode_crtc_set_gamma_size' mangled-name='drm_mode_crtc_set_gamma_size' filepath='drivers/gpu/drm/drm_color_mgmt.c' line='205' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_crtc_set_gamma_size'>
         <parameter type-id='b64ad7cb' name='crtc' filepath='drivers/gpu/drm/drm_color_mgmt.c' line='205' column='1'/>
         <parameter type-id='95e97e5e' name='gamma_size' filepath='drivers/gpu/drm/drm_color_mgmt.c' line='206' column='1'/>
@@ -123891,6 +124011,12 @@
         <parameter type-id='11e02f83' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='108' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='drm_mode_prune_invalid' mangled-name='drm_mode_prune_invalid' filepath='drivers/gpu/drm/drm_modes.c' line='1260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_prune_invalid'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modes.c' line='1260' column='1'/>
+        <parameter type-id='e84b031a' name='mode_list' filepath='drivers/gpu/drm/drm_modes.c' line='1261' column='1'/>
+        <parameter type-id='b50a4934' name='verbose' filepath='drivers/gpu/drm/drm_modes.c' line='1261' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <function-decl name='drm_mode_set_crtcinfo' mangled-name='drm_mode_set_crtcinfo' filepath='drivers/gpu/drm/drm_modes.c' line='814' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_set_crtcinfo'>
         <parameter type-id='11e02f83' name='p' filepath='drivers/gpu/drm/drm_modes.c' line='814' column='1'/>
         <parameter type-id='95e97e5e' name='adjust_flags' filepath='drivers/gpu/drm/drm_modes.c' line='814' column='1'/>
@@ -123904,6 +124030,22 @@
         <parameter type-id='e84b031a' name='mode_list' filepath='drivers/gpu/drm/drm_modes.c' line='1321' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='drm_mode_validate_driver' mangled-name='drm_mode_validate_driver' filepath='drivers/gpu/drm/drm_modes.c' line='1120' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_validate_driver'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_modes.c' line='1120' column='1'/>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='1121' column='1'/>
+        <return type-id='4fb62cb0'/>
+      </function-decl>
+      <function-decl name='drm_mode_validate_size' mangled-name='drm_mode_validate_size' filepath='drivers/gpu/drm/drm_modes.c' line='1151' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_validate_size'>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='1151' column='1'/>
+        <parameter type-id='95e97e5e' name='maxX' filepath='drivers/gpu/drm/drm_modes.c' line='1152' column='1'/>
+        <parameter type-id='95e97e5e' name='maxY' filepath='drivers/gpu/drm/drm_modes.c' line='1152' column='1'/>
+        <return type-id='4fb62cb0'/>
+      </function-decl>
+      <function-decl name='drm_mode_validate_ycbcr420' mangled-name='drm_mode_validate_ycbcr420' filepath='drivers/gpu/drm/drm_modes.c' line='1176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_validate_ycbcr420'>
+        <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='1176' column='1'/>
+        <parameter type-id='4db02c58' name='connector' filepath='drivers/gpu/drm/drm_modes.c' line='1177' column='1'/>
+        <return type-id='4fb62cb0'/>
+      </function-decl>
       <function-decl name='drm_mode_vrefresh' mangled-name='drm_mode_vrefresh' filepath='drivers/gpu/drm/drm_modes.c' line='758' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_mode_vrefresh'>
         <parameter type-id='745b39e8' name='mode' filepath='drivers/gpu/drm/drm_modes.c' line='758' column='1'/>
         <return type-id='95e97e5e'/>
@@ -124105,6 +124247,10 @@
         <parameter type-id='4adb0e6a' name='sg' filepath='drivers/gpu/drm/drm_prime.c' line='1054' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='drm_prime_get_contiguous_size' mangled-name='drm_prime_get_contiguous_size' filepath='drivers/gpu/drm/drm_prime.c' line='867' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_prime_get_contiguous_size'>
+        <parameter type-id='4adb0e6a' name='sgt' filepath='drivers/gpu/drm/drm_prime.c' line='867' column='1'/>
+        <return type-id='7359adad'/>
+      </function-decl>
       <function-decl name='drm_prime_pages_to_sg' mangled-name='drm_prime_pages_to_sg' filepath='drivers/gpu/drm/drm_prime.c' line='830' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_prime_pages_to_sg'>
         <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_prime.c' line='830' column='1'/>
         <parameter type-id='9f93c9da' name='pages' filepath='drivers/gpu/drm/drm_prime.c' line='831' column='1'/>
@@ -124168,6 +124314,13 @@
         <parameter type-id='95e97e5e' name='num_values' filepath='drivers/gpu/drm/drm_property.c' line='165' column='1'/>
         <return type-id='26ea5d4c'/>
       </function-decl>
+      <function-decl name='drm_property_create_object' mangled-name='drm_property_create_object' filepath='drivers/gpu/drm/drm_property.c' line='332' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_object'>
+        <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='332' column='1'/>
+        <parameter type-id='19c2251e' name='flags' filepath='drivers/gpu/drm/drm_property.c' line='333' column='1'/>
+        <parameter type-id='80f4b756' name='name' filepath='drivers/gpu/drm/drm_property.c' line='333' column='1'/>
+        <parameter type-id='8f92235e' name='type' filepath='drivers/gpu/drm/drm_property.c' line='334' column='1'/>
+        <return type-id='26ea5d4c'/>
+      </function-decl>
       <function-decl name='drm_property_create_range' mangled-name='drm_property_create_range' filepath='drivers/gpu/drm/drm_property.c' line='277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='drm_property_create_range'>
         <parameter type-id='8898134d' name='dev' filepath='drivers/gpu/drm/drm_property.c' line='277' column='1'/>
         <parameter type-id='19c2251e' name='flags' filepath='drivers/gpu/drm/drm_property.c' line='278' column='1'/>
@@ -124422,6 +124575,7 @@
         <parameter type-id='141b6427' name='dst' filepath='net/core/dst.c' line='169' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <var-decl name='dummy_irq_chip' type-id='0f5f7920' mangled-name='dummy_irq_chip' visibility='default' filepath='kernel/irq/dummychip.c' line='53' column='1' elf-symbol-id='dummy_irq_chip'/>
       <function-decl name='dump_backtrace' mangled-name='dump_backtrace' filepath='arch/arm64/kernel/stacktrace.c' line='140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='dump_backtrace'>
         <parameter type-id='4616a179' name='regs' filepath='arch/arm64/kernel/stacktrace.c' line='140' column='1'/>
         <parameter type-id='f23e2572' name='tsk' filepath='arch/arm64/kernel/stacktrace.c' line='140' column='1'/>
@@ -128521,8 +128675,8 @@
         <parameter type-id='2aee9912' name='ap' filepath='lib/kasprintf.c' line='15' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='kvfree' mangled-name='kvfree' filepath='mm/util.c' line='604' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree'>
-        <parameter type-id='eaa32e2f' name='addr' filepath='mm/util.c' line='604' column='1'/>
+      <function-decl name='kvfree' mangled-name='kvfree' filepath='mm/util.c' line='608' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree'>
+        <parameter type-id='eaa32e2f' name='addr' filepath='mm/util.c' line='608' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='kvfree_call_rcu' mangled-name='kvfree_call_rcu' filepath='kernel/rcu/tree.c' line='3465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kvfree_call_rcu'>
@@ -128639,9 +128793,9 @@
         <parameter type-id='023b769e' name='head' filepath='lib/llist.c' line='79' column='1'/>
         <return type-id='023b769e'/>
       </function-decl>
-      <function-decl name='lock_sock_nested' mangled-name='lock_sock_nested' filepath='net/core/sock.c' line='3051' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lock_sock_nested'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3051' column='1'/>
-        <parameter type-id='95e97e5e' name='subclass' filepath='net/core/sock.c' line='3051' column='1'/>
+      <function-decl name='lock_sock_nested' mangled-name='lock_sock_nested' filepath='net/core/sock.c' line='3071' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lock_sock_nested'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3071' column='1'/>
+        <parameter type-id='95e97e5e' name='subclass' filepath='net/core/sock.c' line='3071' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='lockref_get' mangled-name='lockref_get' filepath='lib/lockref.c' line='44' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='lockref_get'>
@@ -129982,10 +130136,10 @@
         <parameter type-id='96b07343' name='nfct' filepath='net/netfilter/core.c' line='670' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='nf_ct_delete' mangled-name='nf_ct_delete' filepath='net/netfilter/nf_conntrack_core.c' line='652' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_ct_delete'>
-        <parameter type-id='8c493d8a' name='ct' filepath='net/netfilter/nf_conntrack_core.c' line='652' column='1'/>
-        <parameter type-id='19c2251e' name='portid' filepath='net/netfilter/nf_conntrack_core.c' line='652' column='1'/>
-        <parameter type-id='95e97e5e' name='report' filepath='net/netfilter/nf_conntrack_core.c' line='652' column='1'/>
+      <function-decl name='nf_ct_delete' mangled-name='nf_ct_delete' filepath='net/netfilter/nf_conntrack_core.c' line='655' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_ct_delete'>
+        <parameter type-id='8c493d8a' name='ct' filepath='net/netfilter/nf_conntrack_core.c' line='655' column='1'/>
+        <parameter type-id='19c2251e' name='portid' filepath='net/netfilter/nf_conntrack_core.c' line='655' column='1'/>
+        <parameter type-id='95e97e5e' name='report' filepath='net/netfilter/nf_conntrack_core.c' line='655' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='nf_register_net_hooks' mangled-name='nf_register_net_hooks' filepath='net/netfilter/core.c' line='550' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='nf_register_net_hooks'>
@@ -130992,8 +131146,8 @@
         <parameter type-id='95e97e5e' name='err' filepath='mm/filemap.c' line='1516' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='page_mapping' mangled-name='page_mapping' filepath='mm/util.c' line='682' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_mapping'>
-        <parameter type-id='02f11ed4' name='page' filepath='mm/util.c' line='682' column='1'/>
+      <function-decl name='page_mapping' mangled-name='page_mapping' filepath='mm/util.c' line='686' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_mapping'>
+        <parameter type-id='02f11ed4' name='page' filepath='mm/util.c' line='686' column='1'/>
         <return type-id='f57039f0'/>
       </function-decl>
       <function-decl name='page_reporting_register' mangled-name='page_reporting_register' filepath='mm/page_reporting.c' line='315' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='page_reporting_register'>
@@ -132873,13 +133027,13 @@
         <parameter type-id='d504f73d' name='n' filepath='kernel/profile.c' line='190' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proto_register' mangled-name='proto_register' filepath='net/core/sock.c' line='3468' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_register'>
-        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3468' column='1'/>
-        <parameter type-id='95e97e5e' name='alloc_slab' filepath='net/core/sock.c' line='3468' column='1'/>
+      <function-decl name='proto_register' mangled-name='proto_register' filepath='net/core/sock.c' line='3488' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_register'>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3488' column='1'/>
+        <parameter type-id='95e97e5e' name='alloc_slab' filepath='net/core/sock.c' line='3488' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='proto_unregister' mangled-name='proto_unregister' filepath='net/core/sock.c' line='3532' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_unregister'>
-        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3532' column='1'/>
+      <function-decl name='proto_unregister' mangled-name='proto_unregister' filepath='net/core/sock.c' line='3552' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proto_unregister'>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='3552' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ps2_begin_command' mangled-name='ps2_begin_command' filepath='drivers/input/serio/libps2.c' line='101' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ps2_begin_command'>
@@ -133857,8 +134011,8 @@
         <parameter type-id='95e97e5e' name='nr' filepath='mm/swap.c' line='999' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='release_sock' mangled-name='release_sock' filepath='net/core/sock.c' line='3067' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_sock'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3067' column='1'/>
+      <function-decl name='release_sock' mangled-name='release_sock' filepath='net/core/sock.c' line='3087' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='release_sock'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='3087' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='remap_pfn_range' mangled-name='remap_pfn_range' filepath='mm/memory.c' line='2323' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='remap_pfn_range'>
@@ -135691,16 +135845,16 @@
         <parameter type-id='77e79a4b' name='file' filepath='fs/seq_file.c' line='600' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sk_alloc' mangled-name='sk_alloc' filepath='net/core/sock.c' line='1729' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_alloc'>
-        <parameter type-id='a2bff676' name='net' filepath='net/core/sock.c' line='1729' column='1'/>
-        <parameter type-id='95e97e5e' name='family' filepath='net/core/sock.c' line='1729' column='1'/>
-        <parameter type-id='3eb7c31c' name='priority' filepath='net/core/sock.c' line='1729' column='1'/>
-        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='1730' column='1'/>
-        <parameter type-id='95e97e5e' name='kern' filepath='net/core/sock.c' line='1730' column='1'/>
+      <function-decl name='sk_alloc' mangled-name='sk_alloc' filepath='net/core/sock.c' line='1746' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_alloc'>
+        <parameter type-id='a2bff676' name='net' filepath='net/core/sock.c' line='1746' column='1'/>
+        <parameter type-id='95e97e5e' name='family' filepath='net/core/sock.c' line='1746' column='1'/>
+        <parameter type-id='3eb7c31c' name='priority' filepath='net/core/sock.c' line='1746' column='1'/>
+        <parameter type-id='d2524501' name='prot' filepath='net/core/sock.c' line='1747' column='1'/>
+        <parameter type-id='95e97e5e' name='kern' filepath='net/core/sock.c' line='1747' column='1'/>
         <return type-id='f772df6d'/>
       </function-decl>
-      <function-decl name='sk_free' mangled-name='sk_free' filepath='net/core/sock.c' line='1831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_free'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='1831' column='1'/>
+      <function-decl name='sk_free' mangled-name='sk_free' filepath='net/core/sock.c' line='1849' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sk_free'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='1849' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_add_rx_frag' mangled-name='skb_add_rx_frag' filepath='net/core/skbuff.c' line='557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_add_rx_frag'>
@@ -135800,10 +135954,10 @@
         <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/datagram.c' line='323' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='skb_page_frag_refill' mangled-name='skb_page_frag_refill' filepath='net/core/sock.c' line='2452' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_page_frag_refill'>
-        <parameter type-id='f0981eeb' name='sz' filepath='net/core/sock.c' line='2452' column='1'/>
-        <parameter type-id='a8d434b7' name='pfrag' filepath='net/core/sock.c' line='2452' column='1'/>
-        <parameter type-id='3eb7c31c' name='gfp' filepath='net/core/sock.c' line='2452' column='1'/>
+      <function-decl name='skb_page_frag_refill' mangled-name='skb_page_frag_refill' filepath='net/core/sock.c' line='2470' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_page_frag_refill'>
+        <parameter type-id='f0981eeb' name='sz' filepath='net/core/sock.c' line='2470' column='1'/>
+        <parameter type-id='a8d434b7' name='pfrag' filepath='net/core/sock.c' line='2470' column='1'/>
+        <parameter type-id='3eb7c31c' name='gfp' filepath='net/core/sock.c' line='2470' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='skb_partial_csum_set' mangled-name='skb_partial_csum_set' filepath='net/core/skbuff.c' line='4824' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_partial_csum_set'>
@@ -135858,9 +136012,9 @@
         <parameter type-id='7292109c' name='err' filepath='net/core/datagram.c' line='313' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
-      <function-decl name='skb_set_owner_w' mangled-name='skb_set_owner_w' filepath='net/core/sock.c' line='2070' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_set_owner_w'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2070' column='1'/>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2070' column='1'/>
+      <function-decl name='skb_set_owner_w' mangled-name='skb_set_owner_w' filepath='net/core/sock.c' line='2088' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_set_owner_w'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2088' column='1'/>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2088' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='skb_store_bits' mangled-name='skb_store_bits' filepath='net/core/skbuff.c' line='2567' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='skb_store_bits'>
@@ -136609,71 +136763,71 @@
         <parameter type-id='95e97e5e' name='tristate' filepath='sound/soc/soc-dai.c' line='284' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_add_routes' mangled-name='snd_soc_dapm_add_routes' filepath='sound/soc/soc-dapm.c' line='3068' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_add_routes'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3068' column='1'/>
-        <parameter type-id='8f3d28b8' name='route' filepath='sound/soc/soc-dapm.c' line='3069' column='1'/>
-        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3069' column='1'/>
+      <function-decl name='snd_soc_dapm_add_routes' mangled-name='snd_soc_dapm_add_routes' filepath='sound/soc/soc-dapm.c' line='3079' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_add_routes'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3079' column='1'/>
+        <parameter type-id='8f3d28b8' name='route' filepath='sound/soc/soc-dapm.c' line='3080' column='1'/>
+        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3080' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_del_routes' mangled-name='snd_soc_dapm_del_routes' filepath='sound/soc/soc-dapm.c' line='3099' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_del_routes'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3099' column='1'/>
-        <parameter type-id='8f3d28b8' name='route' filepath='sound/soc/soc-dapm.c' line='3100' column='1'/>
-        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3100' column='1'/>
+      <function-decl name='snd_soc_dapm_del_routes' mangled-name='snd_soc_dapm_del_routes' filepath='sound/soc/soc-dapm.c' line='3110' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_del_routes'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3110' column='1'/>
+        <parameter type-id='8f3d28b8' name='route' filepath='sound/soc/soc-dapm.c' line='3111' column='1'/>
+        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3111' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_disable_pin' mangled-name='snd_soc_dapm_disable_pin' filepath='sound/soc/soc-dapm.c' line='4630' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_disable_pin'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4630' column='1'/>
-        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4631' column='1'/>
+      <function-decl name='snd_soc_dapm_disable_pin' mangled-name='snd_soc_dapm_disable_pin' filepath='sound/soc/soc-dapm.c' line='4641' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_disable_pin'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4641' column='1'/>
+        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4642' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_disable_pin_unlocked' mangled-name='snd_soc_dapm_disable_pin_unlocked' filepath='sound/soc/soc-dapm.c' line='4613' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_disable_pin_unlocked'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4613' column='1'/>
-        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4614' column='1'/>
+      <function-decl name='snd_soc_dapm_disable_pin_unlocked' mangled-name='snd_soc_dapm_disable_pin_unlocked' filepath='sound/soc/soc-dapm.c' line='4624' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_disable_pin_unlocked'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4624' column='1'/>
+        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4625' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_enable_pin' mangled-name='snd_soc_dapm_enable_pin' filepath='sound/soc/soc-dapm.c' line='4519' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_enable_pin'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4519' column='1'/>
-        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4519' column='1'/>
+      <function-decl name='snd_soc_dapm_enable_pin' mangled-name='snd_soc_dapm_enable_pin' filepath='sound/soc/soc-dapm.c' line='4530' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_enable_pin'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4530' column='1'/>
+        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4530' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_force_enable_pin' mangled-name='snd_soc_dapm_force_enable_pin' filepath='sound/soc/soc-dapm.c' line='4586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_force_enable_pin'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4586' column='1'/>
-        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4587' column='1'/>
+      <function-decl name='snd_soc_dapm_force_enable_pin' mangled-name='snd_soc_dapm_force_enable_pin' filepath='sound/soc/soc-dapm.c' line='4597' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_force_enable_pin'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4597' column='1'/>
+        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4598' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_force_enable_pin_unlocked' mangled-name='snd_soc_dapm_force_enable_pin_unlocked' filepath='sound/soc/soc-dapm.c' line='4547' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_force_enable_pin_unlocked'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4547' column='1'/>
-        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4548' column='1'/>
+      <function-decl name='snd_soc_dapm_force_enable_pin_unlocked' mangled-name='snd_soc_dapm_force_enable_pin_unlocked' filepath='sound/soc/soc-dapm.c' line='4558' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_force_enable_pin_unlocked'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4558' column='1'/>
+        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4559' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_get_enum_double' mangled-name='snd_soc_dapm_get_enum_double' filepath='sound/soc/soc-dapm.c' line='3428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_enum_double'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3428' column='1'/>
-        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3429' column='1'/>
+      <function-decl name='snd_soc_dapm_get_enum_double' mangled-name='snd_soc_dapm_get_enum_double' filepath='sound/soc/soc-dapm.c' line='3439' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_enum_double'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3439' column='1'/>
+        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3440' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_get_pin_status' mangled-name='snd_soc_dapm_get_pin_status' filepath='sound/soc/soc-dapm.c' line='4705' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_pin_status'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4705' column='1'/>
-        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4706' column='1'/>
+      <function-decl name='snd_soc_dapm_get_pin_status' mangled-name='snd_soc_dapm_get_pin_status' filepath='sound/soc/soc-dapm.c' line='4716' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_pin_status'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4716' column='1'/>
+        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4717' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_get_pin_switch' mangled-name='snd_soc_dapm_get_pin_switch' filepath='sound/soc/soc-dapm.c' line='3546' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_pin_switch'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3546' column='1'/>
-        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3547' column='1'/>
+      <function-decl name='snd_soc_dapm_get_pin_switch' mangled-name='snd_soc_dapm_get_pin_switch' filepath='sound/soc/soc-dapm.c' line='3557' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_pin_switch'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3557' column='1'/>
+        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3558' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_get_volsw' mangled-name='snd_soc_dapm_get_volsw' filepath='sound/soc/soc-dapm.c' line='3277' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_volsw'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3277' column='1'/>
-        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3278' column='1'/>
+      <function-decl name='snd_soc_dapm_get_volsw' mangled-name='snd_soc_dapm_get_volsw' filepath='sound/soc/soc-dapm.c' line='3288' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_get_volsw'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3288' column='1'/>
+        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3289' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_ignore_suspend' mangled-name='snd_soc_dapm_ignore_suspend' filepath='sound/soc/soc-dapm.c' line='4728' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_ignore_suspend'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4728' column='1'/>
-        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4729' column='1'/>
+      <function-decl name='snd_soc_dapm_ignore_suspend' mangled-name='snd_soc_dapm_ignore_suspend' filepath='sound/soc/soc-dapm.c' line='4739' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_ignore_suspend'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='4739' column='1'/>
+        <parameter type-id='80f4b756' name='pin' filepath='sound/soc/soc-dapm.c' line='4740' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_info_pin_switch' mangled-name='snd_soc_dapm_info_pin_switch' filepath='sound/soc/soc-dapm.c' line='3528' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_info_pin_switch'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3528' column='1'/>
-        <parameter type-id='0e291009' name='uinfo' filepath='sound/soc/soc-dapm.c' line='3529' column='1'/>
+      <function-decl name='snd_soc_dapm_info_pin_switch' mangled-name='snd_soc_dapm_info_pin_switch' filepath='sound/soc/soc-dapm.c' line='3539' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_info_pin_switch'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3539' column='1'/>
+        <parameter type-id='0e291009' name='uinfo' filepath='sound/soc/soc-dapm.c' line='3540' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_dapm_kcontrol_dapm' mangled-name='snd_soc_dapm_kcontrol_dapm' filepath='sound/soc/soc-dapm.c' line='591' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_kcontrol_dapm'>
@@ -136699,48 +136853,48 @@
         <parameter type-id='33146de3' name='update' filepath='sound/soc/soc-dapm.c' line='2300' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_new_control' mangled-name='snd_soc_dapm_new_control' filepath='sound/soc/soc-dapm.c' line='3748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_control'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3748' column='1'/>
-        <parameter type-id='dae78f89' name='widget' filepath='sound/soc/soc-dapm.c' line='3749' column='1'/>
+      <function-decl name='snd_soc_dapm_new_control' mangled-name='snd_soc_dapm_new_control' filepath='sound/soc/soc-dapm.c' line='3759' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_control'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3759' column='1'/>
+        <parameter type-id='dae78f89' name='widget' filepath='sound/soc/soc-dapm.c' line='3760' column='1'/>
         <return type-id='810606ec'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_new_controls' mangled-name='snd_soc_dapm_new_controls' filepath='sound/soc/soc-dapm.c' line='3771' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_controls'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3771' column='1'/>
-        <parameter type-id='dae78f89' name='widget' filepath='sound/soc/soc-dapm.c' line='3772' column='1'/>
-        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3773' column='1'/>
+      <function-decl name='snd_soc_dapm_new_controls' mangled-name='snd_soc_dapm_new_controls' filepath='sound/soc/soc-dapm.c' line='3782' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_controls'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3782' column='1'/>
+        <parameter type-id='dae78f89' name='widget' filepath='sound/soc/soc-dapm.c' line='3783' column='1'/>
+        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3784' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_new_widgets' mangled-name='snd_soc_dapm_new_widgets' filepath='sound/soc/soc-dapm.c' line='3203' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_widgets'>
-        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-dapm.c' line='3203' column='1'/>
+      <function-decl name='snd_soc_dapm_new_widgets' mangled-name='snd_soc_dapm_new_widgets' filepath='sound/soc/soc-dapm.c' line='3214' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_new_widgets'>
+        <parameter type-id='3059cd0b' name='card' filepath='sound/soc/soc-dapm.c' line='3214' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_put_enum_double' mangled-name='snd_soc_dapm_put_enum_double' filepath='sound/soc/soc-dapm.c' line='3465' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_put_enum_double'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3465' column='1'/>
-        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3466' column='1'/>
+      <function-decl name='snd_soc_dapm_put_enum_double' mangled-name='snd_soc_dapm_put_enum_double' filepath='sound/soc/soc-dapm.c' line='3476' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_put_enum_double'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3476' column='1'/>
+        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3477' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_put_pin_switch' mangled-name='snd_soc_dapm_put_pin_switch' filepath='sound/soc/soc-dapm.c' line='3569' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_put_pin_switch'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3569' column='1'/>
-        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3570' column='1'/>
+      <function-decl name='snd_soc_dapm_put_pin_switch' mangled-name='snd_soc_dapm_put_pin_switch' filepath='sound/soc/soc-dapm.c' line='3580' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_put_pin_switch'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3580' column='1'/>
+        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3581' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_put_volsw' mangled-name='snd_soc_dapm_put_volsw' filepath='sound/soc/soc-dapm.c' line='3336' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_put_volsw'>
-        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3336' column='1'/>
-        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3337' column='1'/>
+      <function-decl name='snd_soc_dapm_put_volsw' mangled-name='snd_soc_dapm_put_volsw' filepath='sound/soc/soc-dapm.c' line='3347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_put_volsw'>
+        <parameter type-id='7a5054b7' name='kcontrol' filepath='sound/soc/soc-dapm.c' line='3347' column='1'/>
+        <parameter type-id='144a5d4c' name='ucontrol' filepath='sound/soc/soc-dapm.c' line='3348' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_sync' mangled-name='snd_soc_dapm_sync' filepath='sound/soc/soc-dapm.c' line='2605' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_sync'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='2605' column='1'/>
+      <function-decl name='snd_soc_dapm_sync' mangled-name='snd_soc_dapm_sync' filepath='sound/soc/soc-dapm.c' line='2616' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_sync'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='2616' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_sync_unlocked' mangled-name='snd_soc_dapm_sync_unlocked' filepath='sound/soc/soc-dapm.c' line='2583' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_sync_unlocked'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='2583' column='1'/>
+      <function-decl name='snd_soc_dapm_sync_unlocked' mangled-name='snd_soc_dapm_sync_unlocked' filepath='sound/soc/soc-dapm.c' line='2594' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_sync_unlocked'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='2594' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='snd_soc_dapm_weak_routes' mangled-name='snd_soc_dapm_weak_routes' filepath='sound/soc/soc-dapm.c' line='3176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_weak_routes'>
-        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3176' column='1'/>
-        <parameter type-id='8f3d28b8' name='route' filepath='sound/soc/soc-dapm.c' line='3177' column='1'/>
-        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3177' column='1'/>
+      <function-decl name='snd_soc_dapm_weak_routes' mangled-name='snd_soc_dapm_weak_routes' filepath='sound/soc/soc-dapm.c' line='3187' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dapm_weak_routes'>
+        <parameter type-id='70d004a5' name='dapm' filepath='sound/soc/soc-dapm.c' line='3187' column='1'/>
+        <parameter type-id='8f3d28b8' name='route' filepath='sound/soc/soc-dapm.c' line='3188' column='1'/>
+        <parameter type-id='95e97e5e' name='num' filepath='sound/soc/soc-dapm.c' line='3188' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='snd_soc_dpcm_get_substream' mangled-name='snd_soc_dpcm_get_substream' filepath='sound/soc/soc-pcm.c' line='2912' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='snd_soc_dpcm_get_substream'>
@@ -137036,11 +137190,11 @@
         <parameter type-id='97eb1967' name='soc_dev' filepath='drivers/base/soc.c' line='172' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_alloc_send_skb' mangled-name='sock_alloc_send_skb' filepath='net/core/sock.c' line='2351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_alloc_send_skb'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2351' column='1'/>
-        <parameter type-id='7359adad' name='size' filepath='net/core/sock.c' line='2351' column='1'/>
-        <parameter type-id='95e97e5e' name='noblock' filepath='net/core/sock.c' line='2352' column='1'/>
-        <parameter type-id='7292109c' name='errcode' filepath='net/core/sock.c' line='2352' column='1'/>
+      <function-decl name='sock_alloc_send_skb' mangled-name='sock_alloc_send_skb' filepath='net/core/sock.c' line='2369' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_alloc_send_skb'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2369' column='1'/>
+        <parameter type-id='7359adad' name='size' filepath='net/core/sock.c' line='2369' column='1'/>
+        <parameter type-id='95e97e5e' name='noblock' filepath='net/core/sock.c' line='2370' column='1'/>
+        <parameter type-id='7292109c' name='errcode' filepath='net/core/sock.c' line='2370' column='1'/>
         <return type-id='0fbf3cfd'/>
       </function-decl>
       <function-decl name='sock_create_kern' mangled-name='sock_create_kern' filepath='net/socket.c' line='1484' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_create_kern'>
@@ -137051,60 +137205,60 @@
         <parameter type-id='1a7bb5c8' name='res' filepath='net/socket.c' line='1484' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_efree' mangled-name='sock_efree' filepath='net/core/sock.c' line='2140' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_efree'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2140' column='1'/>
+      <function-decl name='sock_efree' mangled-name='sock_efree' filepath='net/core/sock.c' line='2158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_efree'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2158' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_gettstamp' mangled-name='sock_gettstamp' filepath='net/core/sock.c' line='3122' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_gettstamp'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='3122' column='1'/>
-        <parameter type-id='eaa32e2f' name='userstamp' filepath='net/core/sock.c' line='3122' column='1'/>
-        <parameter type-id='b50a4934' name='timeval' filepath='net/core/sock.c' line='3123' column='1'/>
-        <parameter type-id='b50a4934' name='time32' filepath='net/core/sock.c' line='3123' column='1'/>
+      <function-decl name='sock_gettstamp' mangled-name='sock_gettstamp' filepath='net/core/sock.c' line='3142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_gettstamp'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='3142' column='1'/>
+        <parameter type-id='eaa32e2f' name='userstamp' filepath='net/core/sock.c' line='3142' column='1'/>
+        <parameter type-id='b50a4934' name='timeval' filepath='net/core/sock.c' line='3143' column='1'/>
+        <parameter type-id='b50a4934' name='time32' filepath='net/core/sock.c' line='3143' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_i_uid' mangled-name='sock_i_uid' filepath='net/core/sock.c' line='2158' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_i_uid'>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2158' column='1'/>
+      <function-decl name='sock_i_uid' mangled-name='sock_i_uid' filepath='net/core/sock.c' line='2176' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_i_uid'>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2176' column='1'/>
         <return type-id='d80b72e6'/>
       </function-decl>
-      <function-decl name='sock_init_data' mangled-name='sock_init_data' filepath='net/core/sock.c' line='2970' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_init_data'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2970' column='1'/>
-        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2970' column='1'/>
+      <function-decl name='sock_init_data' mangled-name='sock_init_data' filepath='net/core/sock.c' line='2988' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_init_data'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2988' column='1'/>
+        <parameter type-id='f772df6d' name='sk' filepath='net/core/sock.c' line='2988' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_no_accept' mangled-name='sock_no_accept' filepath='net/core/sock.c' line='2754' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_accept'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2754' column='1'/>
-        <parameter type-id='13103032' name='newsock' filepath='net/core/sock.c' line='2754' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2754' column='1'/>
-        <parameter type-id='b50a4934' name='kern' filepath='net/core/sock.c' line='2755' column='1'/>
+      <function-decl name='sock_no_accept' mangled-name='sock_no_accept' filepath='net/core/sock.c' line='2772' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_accept'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2772' column='1'/>
+        <parameter type-id='13103032' name='newsock' filepath='net/core/sock.c' line='2772' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2772' column='1'/>
+        <parameter type-id='b50a4934' name='kern' filepath='net/core/sock.c' line='2773' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_listen' mangled-name='sock_no_listen' filepath='net/core/sock.c' line='2774' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_listen'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2774' column='1'/>
-        <parameter type-id='95e97e5e' name='backlog' filepath='net/core/sock.c' line='2774' column='1'/>
+      <function-decl name='sock_no_listen' mangled-name='sock_no_listen' filepath='net/core/sock.c' line='2792' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_listen'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2792' column='1'/>
+        <parameter type-id='95e97e5e' name='backlog' filepath='net/core/sock.c' line='2792' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_mmap' mangled-name='sock_no_mmap' filepath='net/core/sock.c' line='2805' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_mmap'>
-        <parameter type-id='77e79a4b' name='file' filepath='net/core/sock.c' line='2805' column='1'/>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2805' column='1'/>
-        <parameter type-id='2ae08426' name='vma' filepath='net/core/sock.c' line='2805' column='1'/>
+      <function-decl name='sock_no_mmap' mangled-name='sock_no_mmap' filepath='net/core/sock.c' line='2823' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_mmap'>
+        <parameter type-id='77e79a4b' name='file' filepath='net/core/sock.c' line='2823' column='1'/>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2823' column='1'/>
+        <parameter type-id='2ae08426' name='vma' filepath='net/core/sock.c' line='2823' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_sendpage' mangled-name='sock_no_sendpage' filepath='net/core/sock.c' line='2833' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_sendpage'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2833' column='1'/>
-        <parameter type-id='02f11ed4' name='page' filepath='net/core/sock.c' line='2833' column='1'/>
-        <parameter type-id='95e97e5e' name='offset' filepath='net/core/sock.c' line='2833' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='net/core/sock.c' line='2833' column='1'/>
-        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2833' column='1'/>
+      <function-decl name='sock_no_sendpage' mangled-name='sock_no_sendpage' filepath='net/core/sock.c' line='2851' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_sendpage'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2851' column='1'/>
+        <parameter type-id='02f11ed4' name='page' filepath='net/core/sock.c' line='2851' column='1'/>
+        <parameter type-id='95e97e5e' name='offset' filepath='net/core/sock.c' line='2851' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='net/core/sock.c' line='2851' column='1'/>
+        <parameter type-id='95e97e5e' name='flags' filepath='net/core/sock.c' line='2851' column='1'/>
         <return type-id='79a0948f'/>
       </function-decl>
-      <function-decl name='sock_no_shutdown' mangled-name='sock_no_shutdown' filepath='net/core/sock.c' line='2780' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_shutdown'>
-        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2780' column='1'/>
-        <parameter type-id='95e97e5e' name='how' filepath='net/core/sock.c' line='2780' column='1'/>
+      <function-decl name='sock_no_shutdown' mangled-name='sock_no_shutdown' filepath='net/core/sock.c' line='2798' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_shutdown'>
+        <parameter type-id='13103032' name='sock' filepath='net/core/sock.c' line='2798' column='1'/>
+        <parameter type-id='95e97e5e' name='how' filepath='net/core/sock.c' line='2798' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='sock_no_socketpair' mangled-name='sock_no_socketpair' filepath='net/core/sock.c' line='2748' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_socketpair'>
-        <parameter type-id='13103032' name='sock1' filepath='net/core/sock.c' line='2748' column='1'/>
-        <parameter type-id='13103032' name='sock2' filepath='net/core/sock.c' line='2748' column='1'/>
+      <function-decl name='sock_no_socketpair' mangled-name='sock_no_socketpair' filepath='net/core/sock.c' line='2766' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_no_socketpair'>
+        <parameter type-id='13103032' name='sock1' filepath='net/core/sock.c' line='2766' column='1'/>
+        <parameter type-id='13103032' name='sock2' filepath='net/core/sock.c' line='2766' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='sock_queue_rcv_skb' mangled-name='sock_queue_rcv_skb' filepath='net/core/sock.c' line='475' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_queue_rcv_skb'>
@@ -137132,8 +137286,8 @@
         <parameter type-id='95e97e5e' name='family' filepath='net/socket.c' line='3012' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='sock_wfree' mangled-name='sock_wfree' filepath='net/core/sock.c' line='2036' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_wfree'>
-        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2036' column='1'/>
+      <function-decl name='sock_wfree' mangled-name='sock_wfree' filepath='net/core/sock.c' line='2054' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='sock_wfree'>
+        <parameter type-id='0fbf3cfd' name='skb' filepath='net/core/sock.c' line='2054' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='softnet_data' type-id='035aa62d' mangled-name='softnet_data' visibility='default' filepath='net/core/dev.c' line='403' column='1' elf-symbol-id='softnet_data'/>
@@ -138811,48 +138965,48 @@
         <parameter type-id='78a133c2' name='dst' filepath='net/ipv4/udp.c' line='807' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_alloc_host' mangled-name='ufshcd_alloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9303' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_alloc_host'>
-        <parameter type-id='fa0b179b' name='dev' filepath='drivers/scsi/ufs/ufshcd.c' line='9303' column='1'/>
-        <parameter type-id='f38ff799' name='hba_handle' filepath='drivers/scsi/ufs/ufshcd.c' line='9303' column='1'/>
+      <function-decl name='ufshcd_alloc_host' mangled-name='ufshcd_alloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9211' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_alloc_host'>
+        <parameter type-id='fa0b179b' name='dev' filepath='drivers/scsi/ufs/ufshcd.c' line='9211' column='1'/>
+        <parameter type-id='f38ff799' name='hba_handle' filepath='drivers/scsi/ufs/ufshcd.c' line='9211' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_auto_hibern8_update' mangled-name='ufshcd_auto_hibern8_update' filepath='drivers/scsi/ufs/ufshcd.c' line='4148' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_auto_hibern8_update'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4148' column='1'/>
-        <parameter type-id='19c2251e' name='ahit' filepath='drivers/scsi/ufs/ufshcd.c' line='4148' column='1'/>
+      <function-decl name='ufshcd_auto_hibern8_update' mangled-name='ufshcd_auto_hibern8_update' filepath='drivers/scsi/ufs/ufshcd.c' line='4144' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_auto_hibern8_update'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4144' column='1'/>
+        <parameter type-id='19c2251e' name='ahit' filepath='drivers/scsi/ufs/ufshcd.c' line='4144' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_bkops_ctrl' mangled-name='ufshcd_bkops_ctrl' filepath='drivers/scsi/ufs/ufshcd.c' line='5482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_bkops_ctrl'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5482' column='1'/>
-        <parameter type-id='462d2624' name='status' filepath='drivers/scsi/ufs/ufshcd.c' line='5483' column='1'/>
+      <function-decl name='ufshcd_bkops_ctrl' mangled-name='ufshcd_bkops_ctrl' filepath='drivers/scsi/ufs/ufshcd.c' line='5478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_bkops_ctrl'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='5478' column='1'/>
+        <parameter type-id='462d2624' name='status' filepath='drivers/scsi/ufs/ufshcd.c' line='5479' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_config_pwr_mode' mangled-name='ufshcd_config_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4357' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_config_pwr_mode'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4357' column='1'/>
-        <parameter type-id='35f4156d' name='desired_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4358' column='1'/>
+      <function-decl name='ufshcd_config_pwr_mode' mangled-name='ufshcd_config_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4353' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_config_pwr_mode'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4353' column='1'/>
+        <parameter type-id='35f4156d' name='desired_pwr_mode' filepath='drivers/scsi/ufs/ufshcd.c' line='4354' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_dealloc_host' mangled-name='ufshcd_dealloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9275' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dealloc_host'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9275' column='1'/>
+      <function-decl name='ufshcd_dealloc_host' mangled-name='ufshcd_dealloc_host' filepath='drivers/scsi/ufs/ufshcd.c' line='9183' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dealloc_host'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9183' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_delay_us' mangled-name='ufshcd_delay_us' filepath='drivers/scsi/ufs/ufshcd.c' line='588' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_delay_us'>
-        <parameter type-id='7359adad' name='us' filepath='drivers/scsi/ufs/ufshcd.c' line='588' column='1'/>
-        <parameter type-id='7359adad' name='tolerance' filepath='drivers/scsi/ufs/ufshcd.c' line='588' column='1'/>
+      <function-decl name='ufshcd_delay_us' mangled-name='ufshcd_delay_us' filepath='drivers/scsi/ufs/ufshcd.c' line='586' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_delay_us'>
+        <parameter type-id='7359adad' name='us' filepath='drivers/scsi/ufs/ufshcd.c' line='586' column='1'/>
+        <parameter type-id='7359adad' name='tolerance' filepath='drivers/scsi/ufs/ufshcd.c' line='586' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_dme_get_attr' mangled-name='ufshcd_dme_get_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_get_attr'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1'/>
-        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3865' column='1'/>
-        <parameter type-id='f9409001' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3866' column='1'/>
-        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3866' column='1'/>
+      <function-decl name='ufshcd_dme_get_attr' mangled-name='ufshcd_dme_get_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3863' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_get_attr'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3863' column='1'/>
+        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3863' column='1'/>
+        <parameter type-id='f9409001' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3864' column='1'/>
+        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3864' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_dme_set_attr' mangled-name='ufshcd_dme_set_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_set_attr'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1'/>
-        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3821' column='1'/>
-        <parameter type-id='f9b06939' name='attr_set' filepath='drivers/scsi/ufs/ufshcd.c' line='3822' column='1'/>
-        <parameter type-id='19c2251e' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3822' column='1'/>
-        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3822' column='1'/>
+      <function-decl name='ufshcd_dme_set_attr' mangled-name='ufshcd_dme_set_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3819' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dme_set_attr'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3819' column='1'/>
+        <parameter type-id='19c2251e' name='attr_sel' filepath='drivers/scsi/ufs/ufshcd.c' line='3819' column='1'/>
+        <parameter type-id='f9b06939' name='attr_set' filepath='drivers/scsi/ufs/ufshcd.c' line='3820' column='1'/>
+        <parameter type-id='19c2251e' name='mib_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3820' column='1'/>
+        <parameter type-id='f9b06939' name='peer' filepath='drivers/scsi/ufs/ufshcd.c' line='3820' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='ufshcd_dump_regs' mangled-name='ufshcd_dump_regs' filepath='drivers/scsi/ufs/ufshcd.c' line='103' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_dump_regs'>
@@ -138862,13 +139016,13 @@
         <parameter type-id='80f4b756' name='prefix' filepath='drivers/scsi/ufs/ufshcd.c' line='104' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_fixup_dev_quirks' mangled-name='ufshcd_fixup_dev_quirks' filepath='drivers/scsi/ufs/ufshcd.c' line='7430' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_fixup_dev_quirks'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='7430' column='1'/>
-        <parameter type-id='c5251c27' name='fixups' filepath='drivers/scsi/ufs/ufshcd.c' line='7430' column='1'/>
+      <function-decl name='ufshcd_fixup_dev_quirks' mangled-name='ufshcd_fixup_dev_quirks' filepath='drivers/scsi/ufs/ufshcd.c' line='7425' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_fixup_dev_quirks'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='7425' column='1'/>
+        <parameter type-id='c5251c27' name='fixups' filepath='drivers/scsi/ufs/ufshcd.c' line='7425' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_get_local_unipro_ver' mangled-name='ufshcd_get_local_unipro_ver' filepath='drivers/scsi/ufs/ufshcd.c' line='902' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_get_local_unipro_ver'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='902' column='1'/>
+      <function-decl name='ufshcd_get_local_unipro_ver' mangled-name='ufshcd_get_local_unipro_ver' filepath='drivers/scsi/ufs/ufshcd.c' line='900' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_get_local_unipro_ver'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='900' column='1'/>
         <return type-id='19c2251e'/>
       </function-decl>
       <function-decl name='ufshcd_get_pwr_dev_param' mangled-name='ufshcd_get_pwr_dev_param' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='252' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_get_pwr_dev_param'>
@@ -138877,31 +139031,31 @@
         <parameter type-id='35f4156d' name='agreed_pwr' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='254' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_hba_enable' mangled-name='ufshcd_hba_enable' filepath='drivers/scsi/ufs/ufshcd.c' line='4568' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_enable'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4568' column='1'/>
+      <function-decl name='ufshcd_hba_enable' mangled-name='ufshcd_hba_enable' filepath='drivers/scsi/ufs/ufshcd.c' line='4564' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_enable'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4564' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_hba_stop' mangled-name='ufshcd_hba_stop' filepath='drivers/scsi/ufs/ufshcd.c' line='4482' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_stop'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4482' column='1'/>
+      <function-decl name='ufshcd_hba_stop' mangled-name='ufshcd_hba_stop' filepath='drivers/scsi/ufs/ufshcd.c' line='4478' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hba_stop'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4478' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_hold' mangled-name='ufshcd_hold' filepath='drivers/scsi/ufs/ufshcd.c' line='1653' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hold'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1653' column='1'/>
-        <parameter type-id='b50a4934' name='async' filepath='drivers/scsi/ufs/ufshcd.c' line='1653' column='1'/>
+      <function-decl name='ufshcd_hold' mangled-name='ufshcd_hold' filepath='drivers/scsi/ufs/ufshcd.c' line='1651' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_hold'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1651' column='1'/>
+        <parameter type-id='b50a4934' name='async' filepath='drivers/scsi/ufs/ufshcd.c' line='1651' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_link_recovery' mangled-name='ufshcd_link_recovery' filepath='drivers/scsi/ufs/ufshcd.c' line='4066' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_link_recovery'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4066' column='1'/>
+      <function-decl name='ufshcd_link_recovery' mangled-name='ufshcd_link_recovery' filepath='drivers/scsi/ufs/ufshcd.c' line='4064' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_link_recovery'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4064' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_make_hba_operational' mangled-name='ufshcd_make_hba_operational' filepath='drivers/scsi/ufs/ufshcd.c' line='4432' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_make_hba_operational'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4432' column='1'/>
+      <function-decl name='ufshcd_make_hba_operational' mangled-name='ufshcd_make_hba_operational' filepath='drivers/scsi/ufs/ufshcd.c' line='4428' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_make_hba_operational'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4428' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_map_desc_id_to_length' mangled-name='ufshcd_map_desc_id_to_length' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_map_desc_id_to_length'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1'/>
-        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3297' column='1'/>
-        <parameter type-id='7292109c' name='desc_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3298' column='1'/>
+      <function-decl name='ufshcd_map_desc_id_to_length' mangled-name='ufshcd_map_desc_id_to_length' filepath='drivers/scsi/ufs/ufshcd.c' line='3295' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_map_desc_id_to_length'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3295' column='1'/>
+        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3295' column='1'/>
+        <parameter type-id='7292109c' name='desc_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3296' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='ufshcd_pltfrm_init' mangled-name='ufshcd_pltfrm_init' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='347' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_pltfrm_init'>
@@ -138933,91 +139087,91 @@
         <parameter type-id='fa0b179b' name='dev' filepath='drivers/scsi/ufs/ufshcd-pltfrm.c' line='183' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_attr' mangled-name='ufshcd_query_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3104' column='1'/>
-        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
-        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
-        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3105' column='1'/>
+      <function-decl name='ufshcd_query_attr' mangled-name='ufshcd_query_attr' filepath='drivers/scsi/ufs/ufshcd.c' line='3102' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3102' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3102' column='1'/>
+        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3103' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3103' column='1'/>
+        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3103' column='1'/>
+        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3103' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_attr_retry' mangled-name='ufshcd_query_attr_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr_retry'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
-        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
-        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3171' column='1'/>
-        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3172' column='1'/>
+      <function-decl name='ufshcd_query_attr_retry' mangled-name='ufshcd_query_attr_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3168' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_attr_retry'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3168' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3169' column='1'/>
+        <parameter type-id='75eb1735' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3169' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3169' column='1'/>
+        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3169' column='1'/>
+        <parameter type-id='f9409001' name='attr_val' filepath='drivers/scsi/ufs/ufshcd.c' line='3170' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_descriptor_retry' mangled-name='ufshcd_query_descriptor_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3271' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_descriptor_retry'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3271' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3272' column='1'/>
-        <parameter type-id='32c9d5cb' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3273' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3273' column='1'/>
-        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3274' column='1'/>
-        <parameter type-id='8bff8096' name='desc_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3275' column='1'/>
-        <parameter type-id='7292109c' name='buf_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3275' column='1'/>
+      <function-decl name='ufshcd_query_descriptor_retry' mangled-name='ufshcd_query_descriptor_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_descriptor_retry'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3269' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3270' column='1'/>
+        <parameter type-id='32c9d5cb' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3271' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3271' column='1'/>
+        <parameter type-id='f9b06939' name='selector' filepath='drivers/scsi/ufs/ufshcd.c' line='3272' column='1'/>
+        <parameter type-id='8bff8096' name='desc_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3273' column='1'/>
+        <parameter type-id='7292109c' name='buf_len' filepath='drivers/scsi/ufs/ufshcd.c' line='3273' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_flag' mangled-name='ufshcd_query_flag' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3034' column='1'/>
-        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3035' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3035' column='1'/>
-        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='3035' column='1'/>
+      <function-decl name='ufshcd_query_flag' mangled-name='ufshcd_query_flag' filepath='drivers/scsi/ufs/ufshcd.c' line='3032' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3032' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3032' column='1'/>
+        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3033' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3033' column='1'/>
+        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='3033' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_query_flag_retry' mangled-name='ufshcd_query_flag_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag_retry'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3000' column='1'/>
-        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
-        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
-        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
-        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='3001' column='1'/>
+      <function-decl name='ufshcd_query_flag_retry' mangled-name='ufshcd_query_flag_retry' filepath='drivers/scsi/ufs/ufshcd.c' line='2998' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_query_flag_retry'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='2998' column='1'/>
+        <parameter type-id='5f757f13' name='opcode' filepath='drivers/scsi/ufs/ufshcd.c' line='2999' column='1'/>
+        <parameter type-id='92ace17c' name='idn' filepath='drivers/scsi/ufs/ufshcd.c' line='2999' column='1'/>
+        <parameter type-id='f9b06939' name='index' filepath='drivers/scsi/ufs/ufshcd.c' line='2999' column='1'/>
+        <parameter type-id='d8e6b335' name='flag_res' filepath='drivers/scsi/ufs/ufshcd.c' line='2999' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_read_desc_param' mangled-name='ufshcd_read_desc_param' filepath='drivers/scsi/ufs/ufshcd.c' line='3333' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_read_desc_param'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3333' column='1'/>
-        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3334' column='1'/>
-        <parameter type-id='95e97e5e' name='desc_index' filepath='drivers/scsi/ufs/ufshcd.c' line='3335' column='1'/>
-        <parameter type-id='f9b06939' name='param_offset' filepath='drivers/scsi/ufs/ufshcd.c' line='3336' column='1'/>
-        <parameter type-id='8bff8096' name='param_read_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3337' column='1'/>
-        <parameter type-id='f9b06939' name='param_size' filepath='drivers/scsi/ufs/ufshcd.c' line='3338' column='1'/>
+      <function-decl name='ufshcd_read_desc_param' mangled-name='ufshcd_read_desc_param' filepath='drivers/scsi/ufs/ufshcd.c' line='3331' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_read_desc_param'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='3331' column='1'/>
+        <parameter type-id='32c9d5cb' name='desc_id' filepath='drivers/scsi/ufs/ufshcd.c' line='3332' column='1'/>
+        <parameter type-id='95e97e5e' name='desc_index' filepath='drivers/scsi/ufs/ufshcd.c' line='3333' column='1'/>
+        <parameter type-id='f9b06939' name='param_offset' filepath='drivers/scsi/ufs/ufshcd.c' line='3334' column='1'/>
+        <parameter type-id='8bff8096' name='param_read_buf' filepath='drivers/scsi/ufs/ufshcd.c' line='3335' column='1'/>
+        <parameter type-id='f9b06939' name='param_size' filepath='drivers/scsi/ufs/ufshcd.c' line='3336' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_release' mangled-name='ufshcd_release' filepath='drivers/scsi/ufs/ufshcd.c' line='1831' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_release'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1831' column='1'/>
+      <function-decl name='ufshcd_release' mangled-name='ufshcd_release' filepath='drivers/scsi/ufs/ufshcd.c' line='1829' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_release'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='1829' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_remove' mangled-name='ufshcd_remove' filepath='drivers/scsi/ufs/ufshcd.c' line='9255' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_remove'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9255' column='1'/>
+      <function-decl name='ufshcd_remove' mangled-name='ufshcd_remove' filepath='drivers/scsi/ufs/ufshcd.c' line='9163' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_remove'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9163' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ufshcd_shutdown' mangled-name='ufshcd_shutdown' filepath='drivers/scsi/ufs/ufshcd.c' line='9224' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_shutdown'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9224' column='1'/>
+      <function-decl name='ufshcd_shutdown' mangled-name='ufshcd_shutdown' filepath='drivers/scsi/ufs/ufshcd.c' line='9132' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_shutdown'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9132' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_system_resume' mangled-name='ufshcd_system_resume' filepath='drivers/scsi/ufs/ufshcd.c' line='9123' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_resume'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9123' column='1'/>
+      <function-decl name='ufshcd_system_resume' mangled-name='ufshcd_system_resume' filepath='drivers/scsi/ufs/ufshcd.c' line='9031' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_resume'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9031' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_system_suspend' mangled-name='ufshcd_system_suspend' filepath='drivers/scsi/ufs/ufshcd.c' line='9069' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_suspend'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='9069' column='1'/>
+      <function-decl name='ufshcd_system_suspend' mangled-name='ufshcd_system_suspend' filepath='drivers/scsi/ufs/ufshcd.c' line='8977' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_system_suspend'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='8977' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_uic_hibern8_enter' mangled-name='ufshcd_uic_hibern8_enter' filepath='drivers/scsi/ufs/ufshcd.c' line='4097' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_enter'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4097' column='1'/>
+      <function-decl name='ufshcd_uic_hibern8_enter' mangled-name='ufshcd_uic_hibern8_enter' filepath='drivers/scsi/ufs/ufshcd.c' line='4093' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_enter'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4093' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_uic_hibern8_exit' mangled-name='ufshcd_uic_hibern8_exit' filepath='drivers/scsi/ufs/ufshcd.c' line='4121' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_exit'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4121' column='1'/>
+      <function-decl name='ufshcd_uic_hibern8_exit' mangled-name='ufshcd_uic_hibern8_exit' filepath='drivers/scsi/ufs/ufshcd.c' line='4117' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_uic_hibern8_exit'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4117' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ufshcd_update_evt_hist' mangled-name='ufshcd_update_evt_hist' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_update_evt_hist'>
-        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1'/>
-        <parameter type-id='19c2251e' name='id' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1'/>
-        <parameter type-id='19c2251e' name='val' filepath='drivers/scsi/ufs/ufshcd.c' line='4631' column='1'/>
+      <function-decl name='ufshcd_update_evt_hist' mangled-name='ufshcd_update_evt_hist' filepath='drivers/scsi/ufs/ufshcd.c' line='4627' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ufshcd_update_evt_hist'>
+        <parameter type-id='442b8d89' name='hba' filepath='drivers/scsi/ufs/ufshcd.c' line='4627' column='1'/>
+        <parameter type-id='19c2251e' name='id' filepath='drivers/scsi/ufs/ufshcd.c' line='4627' column='1'/>
+        <parameter type-id='19c2251e' name='val' filepath='drivers/scsi/ufs/ufshcd.c' line='4627' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='uio_unregister_device' mangled-name='uio_unregister_device' filepath='drivers/uio/uio.c' line='1042' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='uio_unregister_device'>
@@ -139678,6 +139832,11 @@
         <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1236' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_hcd_unmap_urb_for_dma' mangled-name='usb_hcd_unmap_urb_for_dma' filepath='drivers/usb/core/hcd.c' line='1351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hcd_unmap_urb_for_dma'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/core/hcd.c' line='1351' column='1'/>
+        <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hcd.c' line='1351' column='1'/>
+        <return type-id='48b5725f'/>
+      </function-decl>
       <var-decl name='usb_hcds_loaded' type-id='7359adad' mangled-name='usb_hcds_loaded' visibility='default' filepath='drivers/usb/core/hcd.c' line='81' column='1' elf-symbol-id='usb_hcds_loaded'/>
       <function-decl name='usb_hub_clear_tt_buffer' mangled-name='usb_hub_clear_tt_buffer' filepath='drivers/usb/core/hub.c' line='864' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_hub_clear_tt_buffer'>
         <parameter type-id='ab85b8f2' name='urb' filepath='drivers/usb/core/hub.c' line='864' column='1'/>
@@ -139899,6 +140058,10 @@
         <parameter type-id='d504f73d' name='nb' filepath='drivers/usb/core/notify.c' line='42' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
+      <function-decl name='usb_wakeup_enabled_descendants' mangled-name='usb_wakeup_enabled_descendants' filepath='drivers/usb/core/hub.c' line='3227' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_enabled_descendants'>
+        <parameter type-id='25e60cb2' name='udev' filepath='drivers/usb/core/hub.c' line='3227' column='1'/>
+        <return type-id='f0981eeb'/>
+      </function-decl>
       <function-decl name='usb_wakeup_notification' mangled-name='usb_wakeup_notification' filepath='drivers/usb/core/hub.c' line='695' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='usb_wakeup_notification'>
         <parameter type-id='25e60cb2' name='hdev' filepath='drivers/usb/core/hub.c' line='695' column='1'/>
         <parameter type-id='f0981eeb' name='portnum' filepath='drivers/usb/core/hub.c' line='696' column='1'/>
@@ -141238,7 +141401,7 @@
         <parameter type-id='95e97e5e' name='node' filepath='mm/vmalloc.c' line='1845' column='1'/>
         <return type-id='eaa32e2f'/>
       </function-decl>
-      <function-decl name='vm_memory_committed' mangled-name='vm_memory_committed' filepath='mm/util.c' line='843' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vm_memory_committed'>
+      <function-decl name='vm_memory_committed' mangled-name='vm_memory_committed' filepath='mm/util.c' line='847' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vm_memory_committed'>
         <return type-id='7359adad'/>
       </function-decl>
       <function-decl name='vm_mmap' mangled-name='vm_mmap' filepath='mm/util.c' line='522' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='vm_mmap'>

From 56596148ae7233a5c2959ab413d7329ac5002827 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
Date: Mon, 11 Oct 2021 10:42:27 -0700
Subject: [PATCH 0736/1750] ANDROID: Different fix for KABI breakage in 5.10.71
 in struct sock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This partially reverts commit 627dc3c79c3b ("ANDROID: Fix up KABI
breakage in 5.10.71 in struct sock")

Then fixes things up in such a way that
  BUILD_CONFIG=build/build.config.net_test for kernel_test
still works.

Bug: 202712021
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I40e24d7924fcffc23a2b8cc5ad50049808aa9455
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---
 build.config.allmodconfig | 6 ------
 include/net/sock.h        | 9 +++++++++
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/build.config.allmodconfig b/build.config.allmodconfig
index 3e563fe1c89f..a48f8d420208 100644
--- a/build.config.allmodconfig
+++ b/build.config.allmodconfig
@@ -8,12 +8,6 @@ function update_config() {
          -d TEST_KMOD  \
          -d CPU_BIG_ENDIAN \
          -d DYNAMIC_FTRACE \
-         -d DEBUG_SPINLOCK \
-         -d DEBUG_LOCK_ALLOC \
-         -d LOCK_STAT \
-         -d DEBUG_WW_MUTEX_SLOWPATH \
-         -d DEBUG_LOCK_ALLOC \
-         -d PROVE_LOCKING \
          -e UNWINDER_FRAME_POINTER \
 
     (cd ${OUT_DIR} && \
diff --git a/include/net/sock.h b/include/net/sock.h
index a55ab1b481f5..d50823df426c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -481,6 +481,11 @@ struct sock {
 	u32			sk_ack_backlog;
 	u32			sk_max_ack_backlog;
 	kuid_t			sk_uid;
+#if IS_ENABLED(CONFIG_DEBUG_SPINLOCK) || IS_ENABLED(CONFIG_DEBUG_LOCK_ALLOC)
+	spinlock_t		sk_peer_lock;
+#else
+	/* sk_peer_lock is in the ANDROID_KABI_RESERVE(1) field below */
+#endif
 	struct pid		*sk_peer_pid;
 	const struct cred	*sk_peer_cred;
 
@@ -524,7 +529,11 @@ struct sock {
 #endif
 	struct rcu_head		sk_rcu;
 
+#if IS_ENABLED(CONFIG_DEBUG_SPINLOCK) || IS_ENABLED(CONFIG_DEBUG_LOCK_ALLOC)
+	ANDROID_KABI_RESERVE(1);
+#else
 	ANDROID_KABI_USE(1, spinlock_t sk_peer_lock);
+#endif
 	ANDROID_KABI_RESERVE(2);
 	ANDROID_KABI_RESERVE(3);
 	ANDROID_KABI_RESERVE(4);

From 16d728110bd76d1ebb4aad8bcf36596f7ce11be0 Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Tue, 21 Sep 2021 16:34:42 +0200
Subject: [PATCH 0737/1750] Partially revert "usb: Kconfig: using select for
 USB_COMMON dependency"

commit 4d1aa9112c8e6995ef2c8a76972c9671332ccfea upstream.

This reverts commit cb9c1cfc86926d0e86d19c8e34f6c23458cd3478 for
USB_LED_TRIG.  This config symbol has bool type and enables extra code
in usb_common itself, not a separate driver.  Enabling it should not
force usb_common to be built-in!

Fixes: cb9c1cfc8692 ("usb: Kconfig: using select for USB_COMMON dependency")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Link: https://lore.kernel.org/r/20210921143442.340087-1-carnil@debian.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/common/Kconfig | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/common/Kconfig b/drivers/usb/common/Kconfig
index 5e8a04e3dd3c..b856622431a7 100644
--- a/drivers/usb/common/Kconfig
+++ b/drivers/usb/common/Kconfig
@@ -6,8 +6,7 @@ config USB_COMMON
 
 config USB_LED_TRIG
 	bool "USB LED Triggers"
-	depends on LEDS_CLASS && LEDS_TRIGGERS
-	select USB_COMMON
+	depends on LEDS_CLASS && USB_COMMON && LEDS_TRIGGERS
 	help
 	  This option adds LED triggers for USB host and/or gadget activity.
 

From b3265b88e83b16c7be762fa5fb7e0632bce0002c Mon Sep 17 00:00:00 2001
From: Fabio Estevam <festevam@gmail.com>
Date: Tue, 21 Sep 2021 08:37:54 -0300
Subject: [PATCH 0738/1750] usb: chipidea: ci_hdrc_imx: Also search for 'phys'
 phandle

commit 8253a34bfae3278baca52fc1209b7c29270486ca upstream.

When passing 'phys' in the devicetree to describe the USB PHY phandle
(which is the recommended way according to
Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the
following NULL pointer dereference is observed on i.MX7 and i.MX8MM:

[    1.489344] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098
[    1.498170] Mem abort info:
[    1.500966]   ESR = 0x96000044
[    1.504030]   EC = 0x25: DABT (current EL), IL = 32 bits
[    1.509356]   SET = 0, FnV = 0
[    1.512416]   EA = 0, S1PTW = 0
[    1.515569]   FSC = 0x04: level 0 translation fault
[    1.520458] Data abort info:
[    1.523349]   ISV = 0, ISS = 0x00000044
[    1.527196]   CM = 0, WnR = 1
[    1.530176] [0000000000000098] user address but active_mm is swapper
[    1.536544] Internal error: Oops: 96000044 [#1] PREEMPT SMP
[    1.542125] Modules linked in:
[    1.545190] CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.14.0-dirty #3
[    1.551901] Hardware name: Kontron i.MX8MM N801X S (DT)
[    1.557133] Workqueue: events_unbound deferred_probe_work_func
[    1.562984] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
[    1.568998] pc : imx7d_charger_detection+0x3f0/0x510
[    1.573973] lr : imx7d_charger_detection+0x22c/0x510

This happens because the charger functions check for the phy presence
inside the imx_usbmisc_data structure (data->usb_phy), but the chipidea
core populates the usb_phy passed via 'phys' inside 'struct ci_hdrc'
(ci->usb_phy) instead.

This causes the NULL pointer dereference inside imx7d_charger_detection().

Fix it by also searching for 'phys' in case 'fsl,usbphy' is not found.

Tested on a imx7s-warp board.

Fixes: 746f316b753a ("usb: chipidea: introduce imx7d USB charger detection")
Cc: stable@vger.kernel.org
Reported-by: Heiko Thiery <heiko.thiery@gmail.com>
Tested-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Acked-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Link: https://lore.kernel.org/r/20210921113754.767631-1-festevam@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/chipidea/ci_hdrc_imx.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c
index ee565bdb44d6..b4c6527fe5f6 100644
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -425,11 +425,16 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev)
 	data->phy = devm_usb_get_phy_by_phandle(dev, "fsl,usbphy", 0);
 	if (IS_ERR(data->phy)) {
 		ret = PTR_ERR(data->phy);
-		/* Return -EINVAL if no usbphy is available */
-		if (ret == -ENODEV)
-			data->phy = NULL;
-		else
-			goto err_clk;
+		if (ret == -ENODEV) {
+			data->phy = devm_usb_get_phy_by_phandle(dev, "phys", 0);
+			if (IS_ERR(data->phy)) {
+				ret = PTR_ERR(data->phy);
+				if (ret == -ENODEV)
+					data->phy = NULL;
+				else
+					goto err_clk;
+			}
+		}
 	}
 
 	pdata.usb_phy = data->phy;

From fc8b3e838bdf343e3341df176fa7d8170ea5c691 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 29 Sep 2021 11:09:36 +0200
Subject: [PATCH 0739/1750] USB: cdc-acm: fix racy tty buffer accesses

commit 65a205e6113506e69a503b61d97efec43fc10fd7 upstream.

A recent change that started reporting break events to the line
discipline caused the tty-buffer insertions to no longer be serialised
by inserting events also from the completion handler for the interrupt
endpoint.

Completion calls for distinct endpoints are not guaranteed to be
serialised. For example, in case a host-controller driver uses
bottom-half completion, the interrupt and bulk-in completion handlers
can end up running in parallel on two CPUs (high-and low-prio tasklets,
respectively) thereby breaking the tty layer's single producer
assumption.

Fix this by holding the read lock also when inserting characters from
the bulk endpoint.

Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls")
Cc: stable@vger.kernel.org
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210929090937.7410-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 7748b1335558..80508daf75ac 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -475,11 +475,16 @@ static int acm_submit_read_urbs(struct acm *acm, gfp_t mem_flags)
 
 static void acm_process_read_urb(struct acm *acm, struct urb *urb)
 {
+	unsigned long flags;
+
 	if (!urb->actual_length)
 		return;
 
+	spin_lock_irqsave(&acm->read_lock, flags);
 	tty_insert_flip_string(&acm->port, urb->transfer_buffer,
 			urb->actual_length);
+	spin_unlock_irqrestore(&acm->read_lock, flags);
+
 	tty_flip_buffer_push(&acm->port);
 }
 

From feb3fe702a589ccf95ad5c5312db35462ab80733 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 29 Sep 2021 11:09:37 +0200
Subject: [PATCH 0740/1750] USB: cdc-acm: fix break reporting

commit 58fc1daa4d2e9789b9ffc880907c961ea7c062cc upstream.

A recent change that started reporting break events forgot to push the
event to the line discipline, which meant that a detected break would
not be reported until further characters had been receive (the port
could even have been closed and reopened in between).

Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls")
Cc: stable@vger.kernel.org
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210929090937.7410-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/class/cdc-acm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 80508daf75ac..7950d5b3af42 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -340,6 +340,9 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf)
 			acm->iocount.overrun++;
 		spin_unlock_irqrestore(&acm->read_lock, flags);
 
+		if (newctrl & ACM_CTRL_BRK)
+			tty_flip_buffer_push(&acm->port);
+
 		if (difference)
 			wake_up_all(&acm->wioctl);
 

From 1d4e9f27d20d73dd3f5b65b2febb4ef887b94b9b Mon Sep 17 00:00:00 2001
From: Xu Yang <xu.yang_2@nxp.com>
Date: Tue, 28 Sep 2021 19:16:39 +0800
Subject: [PATCH 0741/1750] usb: typec: tcpm: handle SRC_STARTUP state if cc
 changes

commit 6d91017a295e9790eec02c4e43f020cdb55f5d98 upstream.

TCPM for DRP should do the same action as SRC_ATTACHED when cc changes in
SRC_STARTUP state. Otherwise, TCPM will transition to SRC_UNATTACHED state
which is not satisfied with the Type-C spec.

Per Type-C spec:
DRP port should move to Unattached.SNK instead of Unattached.SRC if sink
removed.

Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging")
cc: <stable@vger.kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://lore.kernel.org/r/20210928111639.3854174-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/tcpm/tcpm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
index 0b08dd3b19eb..291d02042792 100644
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -3922,6 +3922,7 @@ static void _tcpm_cc_change(struct tcpm_port *port, enum typec_cc_status cc1,
 			tcpm_set_state(port, SRC_ATTACH_WAIT, 0);
 		break;
 	case SRC_ATTACHED:
+	case SRC_STARTUP:
 	case SRC_SEND_CAPABILITIES:
 	case SRC_READY:
 		if (tcpm_port_is_disconnected(port) ||

From de1e8bd36ab4ba9a34911802f9c8f029621dcb67 Mon Sep 17 00:00:00 2001
From: Ben Skeggs <bskeggs@redhat.com>
Date: Mon, 6 Sep 2021 10:56:28 +1000
Subject: [PATCH 0742/1750] drm/nouveau/kms/tu102-: delay enabling cursor until
 after assign_windows

commit f732e2e34aa08493fdd762f3daa4e5f16bbf1e45 upstream.

Prevent NVD core channel error code 67 occuring and hanging display,
managed to reproduce on GA102 while testing suspend/resume scenarios.

Required extension of earlier commit to fix interactions with EFI.

Fixes: e78b1b545c6c ("drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences")
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Cc: Lyude Paul <lyude@redhat.com>
Cc: Karol Herbst <kherbst@redhat.com>
Cc: <stable@vger.kernel.org> # v5.12+
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210906005628.11499-2-skeggsb@gmail.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/nouveau/dispnv50/head.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c
index 61826cac3061..be649d14f879 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/head.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/head.c
@@ -51,6 +51,7 @@ nv50_head_flush_clr(struct nv50_head *head,
 void
 nv50_head_flush_set_wndw(struct nv50_head *head, struct nv50_head_atom *asyh)
 {
+	if (asyh->set.curs   ) head->func->curs_set(head, asyh);
 	if (asyh->set.olut   ) {
 		asyh->olut.offset = nv50_lut_load(&head->olut,
 						  asyh->olut.buffer,
@@ -66,7 +67,6 @@ nv50_head_flush_set(struct nv50_head *head, struct nv50_head_atom *asyh)
 	if (asyh->set.view   ) head->func->view    (head, asyh);
 	if (asyh->set.mode   ) head->func->mode    (head, asyh);
 	if (asyh->set.core   ) head->func->core_set(head, asyh);
-	if (asyh->set.curs   ) head->func->curs_set(head, asyh);
 	if (asyh->set.base   ) head->func->base    (head, asyh);
 	if (asyh->set.ovly   ) head->func->ovly    (head, asyh);
 	if (asyh->set.dither ) head->func->dither  (head, asyh);

From 13d17cc717d58034a472353ab0e3a84fb675c678 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Wed, 22 Sep 2021 12:17:48 +0200
Subject: [PATCH 0743/1750] xen/privcmd: fix error handling in mmap-resource
 processing

commit e11423d6721dd63b23fb41ade5e8d0b448b17780 upstream.

xen_pfn_t is the same size as int only on 32-bit builds (and not even
on Arm32). Hence pfns[] can't be used directly to read individual error
values returned from xen_remap_domain_mfn_array(); every other error
indicator would be skipped/ignored on 64-bit.

Fixes: 3ad0876554ca ("xen/privcmd: add IOCTL_PRIVCMD_MMAP_RESOURCE")
Cc: stable@vger.kernel.org
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Link: https://lore.kernel.org/r/aa6d6a67-6889-338a-a910-51e889f792d5@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
---
 drivers/xen/privcmd.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 720a7b7abd46..fe8df32bb612 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -803,11 +803,12 @@ static long privcmd_ioctl_mmap_resource(struct file *file,
 		unsigned int domid =
 			(xdata.flags & XENMEM_rsrc_acq_caller_owned) ?
 			DOMID_SELF : kdata.dom;
-		int num;
+		int num, *errs = (int *)pfns;
 
+		BUILD_BUG_ON(sizeof(*errs) > sizeof(*pfns));
 		num = xen_remap_domain_mfn_array(vma,
 						 kdata.addr & PAGE_MASK,
-						 pfns, kdata.num, (int *)pfns,
+						 pfns, kdata.num, errs,
 						 vma->vm_page_prot,
 						 domid,
 						 vma->vm_private_data);
@@ -817,7 +818,7 @@ static long privcmd_ioctl_mmap_resource(struct file *file,
 			unsigned int i;
 
 			for (i = 0; i < num; i++) {
-				rc = pfns[i];
+				rc = errs[i];
 				if (rc < 0)
 					break;
 			}

From e5cb3680b958ed3eb66504c0865f767d760cc9cd Mon Sep 17 00:00:00 2001
From: Neil Armstrong <narmstrong@baylibre.com>
Date: Tue, 28 Sep 2021 09:36:52 +0200
Subject: [PATCH 0744/1750] mmc: meson-gx: do not use memcpy_to/fromio for
 dram-access-quirk

commit 8a38a4d51c5055d0201542e5ea3c0cb287f6e223 upstream.

The memory at the end of the controller only accepts 32bit read/write
accesses, but the arm64 memcpy_to/fromio implementation only uses 64bit
(which will be split into two 32bit access) and 8bit leading to incomplete
copies to/from this memory when the buffer is not multiple of 8bytes.

Add a local copy using writel/readl accesses to make sure we use the right
memory access width.

The switch to memcpy_to/fromio was done because of 285133040e6c
("arm64: Import latest memcpy()/memmove() implementation"), but using memcpy
worked before since it mainly used 32bit memory acceses.

Fixes: 103a5348c22c ("mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk")
Reported-by: Christian Hewitt <christianshewitt@gmail.com>
Suggested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210928073652.434690-1-narmstrong@baylibre.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/meson-gx-mmc.c | 73 ++++++++++++++++++++++++++-------
 1 file changed, 59 insertions(+), 14 deletions(-)

diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
index d3f40c9a8c6c..b274083a6e63 100644
--- a/drivers/mmc/host/meson-gx-mmc.c
+++ b/drivers/mmc/host/meson-gx-mmc.c
@@ -735,7 +735,7 @@ static void meson_mmc_desc_chain_transfer(struct mmc_host *mmc, u32 cmd_cfg)
 	writel(start, host->regs + SD_EMMC_START);
 }
 
-/* local sg copy to buffer version with _to/fromio usage for dram_access_quirk */
+/* local sg copy for dram_access_quirk */
 static void meson_mmc_copy_buffer(struct meson_host *host, struct mmc_data *data,
 				  size_t buflen, bool to_buffer)
 {
@@ -753,21 +753,27 @@ static void meson_mmc_copy_buffer(struct meson_host *host, struct mmc_data *data
 	sg_miter_start(&miter, sgl, nents, sg_flags);
 
 	while ((offset < buflen) && sg_miter_next(&miter)) {
-		unsigned int len;
+		unsigned int buf_offset = 0;
+		unsigned int len, left;
+		u32 *buf = miter.addr;
 
 		len = min(miter.length, buflen - offset);
+		left = len;
 
-		/* When dram_access_quirk, the bounce buffer is a iomem mapping */
-		if (host->dram_access_quirk) {
-			if (to_buffer)
-				memcpy_toio(host->bounce_iomem_buf + offset, miter.addr, len);
-			else
-				memcpy_fromio(miter.addr, host->bounce_iomem_buf + offset, len);
+		if (to_buffer) {
+			do {
+				writel(*buf++, host->bounce_iomem_buf + offset + buf_offset);
+
+				buf_offset += 4;
+				left -= 4;
+			} while (left);
 		} else {
-			if (to_buffer)
-				memcpy(host->bounce_buf + offset, miter.addr, len);
-			else
-				memcpy(miter.addr, host->bounce_buf + offset, len);
+			do {
+				*buf++ = readl(host->bounce_iomem_buf + offset + buf_offset);
+
+				buf_offset += 4;
+				left -= 4;
+			} while (left);
 		}
 
 		offset += len;
@@ -819,7 +825,11 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd)
 		if (data->flags & MMC_DATA_WRITE) {
 			cmd_cfg |= CMD_CFG_DATA_WR;
 			WARN_ON(xfer_bytes > host->bounce_buf_size);
-			meson_mmc_copy_buffer(host, data, xfer_bytes, true);
+			if (host->dram_access_quirk)
+				meson_mmc_copy_buffer(host, data, xfer_bytes, true);
+			else
+				sg_copy_to_buffer(data->sg, data->sg_len,
+						  host->bounce_buf, xfer_bytes);
 			dma_wmb();
 		}
 
@@ -838,12 +848,43 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd)
 	writel(cmd->arg, host->regs + SD_EMMC_CMD_ARG);
 }
 
+static int meson_mmc_validate_dram_access(struct mmc_host *mmc, struct mmc_data *data)
+{
+	struct scatterlist *sg;
+	int i;
+
+	/* Reject request if any element offset or size is not 32bit aligned */
+	for_each_sg(data->sg, sg, data->sg_len, i) {
+		if (!IS_ALIGNED(sg->offset, sizeof(u32)) ||
+		    !IS_ALIGNED(sg->length, sizeof(u32))) {
+			dev_err(mmc_dev(mmc), "unaligned sg offset %u len %u\n",
+				data->sg->offset, data->sg->length);
+			return -EINVAL;
+		}
+	}
+
+	return 0;
+}
+
 static void meson_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
 {
 	struct meson_host *host = mmc_priv(mmc);
 	bool needs_pre_post_req = mrq->data &&
 			!(mrq->data->host_cookie & SD_EMMC_PRE_REQ_DONE);
 
+	/*
+	 * The memory at the end of the controller used as bounce buffer for
+	 * the dram_access_quirk only accepts 32bit read/write access,
+	 * check the aligment and length of the data before starting the request.
+	 */
+	if (host->dram_access_quirk && mrq->data) {
+		mrq->cmd->error = meson_mmc_validate_dram_access(mmc, mrq->data);
+		if (mrq->cmd->error) {
+			mmc_request_done(mmc, mrq);
+			return;
+		}
+	}
+
 	if (needs_pre_post_req) {
 		meson_mmc_get_transfer_mode(mmc, mrq);
 		if (!meson_mmc_desc_chain_mode(mrq->data))
@@ -988,7 +1029,11 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
 	if (meson_mmc_bounce_buf_read(data)) {
 		xfer_bytes = data->blksz * data->blocks;
 		WARN_ON(xfer_bytes > host->bounce_buf_size);
-		meson_mmc_copy_buffer(host, data, xfer_bytes, false);
+		if (host->dram_access_quirk)
+			meson_mmc_copy_buffer(host, data, xfer_bytes, false);
+		else
+			sg_copy_from_buffer(data->sg, data->sg_len,
+					    host->bounce_buf, xfer_bytes);
 	}
 
 	next_cmd = meson_mmc_get_next_command(cmd);

From 3a0feae5f642258f6a217560a2d8f8a773e79cf0 Mon Sep 17 00:00:00 2001
From: Claudiu Beznea <claudiu.beznea@microchip.com>
Date: Fri, 24 Sep 2021 11:28:50 +0300
Subject: [PATCH 0745/1750] mmc: sdhci-of-at91: wait for calibration done
 before proceed

commit af467fad78f03a42de8b72190f6a595366b870db upstream.

Datasheet specifies that at the end of calibration the SDMMC_CALCR_EN
bit will be cleared. No commands should be send before calibration is
done.

Fixes: dbdea70f71d67 ("mmc: sdhci-of-at91: fix CALCR register being rewritten")
Fixes: 727d836a375ad ("mmc: sdhci-of-at91: add DT property to enable calibration on full reset")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210924082851.2132068-2-claudiu.beznea@microchip.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-of-at91.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 5564d7b23e7c..134ba01d3063 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -11,6 +11,7 @@
 #include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/io.h>
+#include <linux/iopoll.h>
 #include <linux/kernel.h>
 #include <linux/mmc/host.h>
 #include <linux/mmc/slot-gpio.h>
@@ -114,6 +115,7 @@ static void sdhci_at91_reset(struct sdhci_host *host, u8 mask)
 {
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_at91_priv *priv = sdhci_pltfm_priv(pltfm_host);
+	unsigned int tmp;
 
 	sdhci_reset(host, mask);
 
@@ -126,6 +128,10 @@ static void sdhci_at91_reset(struct sdhci_host *host, u8 mask)
 
 		sdhci_writel(host, calcr | SDMMC_CALCR_ALWYSON | SDMMC_CALCR_EN,
 			     SDMMC_CALCR);
+
+		if (read_poll_timeout(sdhci_readl, tmp, !(tmp & SDMMC_CALCR_EN),
+				      10, 20000, false, host, SDMMC_CALCR))
+			dev_err(mmc_dev(host->mmc), "Failed to calibrate\n");
 	}
 }
 

From 1500f0c83670294b786e0cbf62c15da23fae1a26 Mon Sep 17 00:00:00 2001
From: Claudiu Beznea <claudiu.beznea@microchip.com>
Date: Fri, 24 Sep 2021 11:28:51 +0300
Subject: [PATCH 0746/1750] mmc: sdhci-of-at91: replace while loop with
 read_poll_timeout

commit 30d4b990ec644e8bd49ef0a2f074fabc0d189e53 upstream.

Replace while loop with read_poll_timeout().

Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210924082851.2132068-3-claudiu.beznea@microchip.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-of-at91.c | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 134ba01d3063..d1a1c548c515 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -62,7 +62,6 @@ static void sdhci_at91_set_force_card_detect(struct sdhci_host *host)
 static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
 {
 	u16 clk;
-	unsigned long timeout;
 
 	host->mmc->actual_clock = 0;
 
@@ -87,16 +86,11 @@ static void sdhci_at91_set_clock(struct sdhci_host *host, unsigned int clock)
 	sdhci_writew(host, clk, SDHCI_CLOCK_CONTROL);
 
 	/* Wait max 20 ms */
-	timeout = 20;
-	while (!((clk = sdhci_readw(host, SDHCI_CLOCK_CONTROL))
-		& SDHCI_CLOCK_INT_STABLE)) {
-		if (timeout == 0) {
-			pr_err("%s: Internal clock never stabilised.\n",
-			       mmc_hostname(host->mmc));
-			return;
-		}
-		timeout--;
-		mdelay(1);
+	if (read_poll_timeout(sdhci_readw, clk, (clk & SDHCI_CLOCK_INT_STABLE),
+			      1000, 20000, false, host, SDHCI_CLOCK_CONTROL)) {
+		pr_err("%s: Internal clock never stabilised.\n",
+		       mmc_hostname(host->mmc));
+		return;
 	}
 
 	clk |= SDHCI_CLOCK_CARD_EN;

From 9763ffd4da217adfcbdcd519e9f434dfa3952fc3 Mon Sep 17 00:00:00 2001
From: Zheng Liang <zhengliang6@huawei.com>
Date: Fri, 24 Sep 2021 09:16:27 +0800
Subject: [PATCH 0747/1750] ovl: fix missing negative dentry check in
 ovl_rename()

commit a295aef603e109a47af355477326bd41151765b6 upstream.

The following reproducer

  mkdir lower upper work merge
  touch lower/old
  touch lower/new
  mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge
  rm merge/new
  mv merge/old merge/new & unlink upper/new

may result in this race:

PROCESS A:
  rename("merge/old", "merge/new");
  overwrite=true,ovl_lower_positive(old)=true,
  ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE

PROCESS B:
  unlink("upper/new");

PROCESS A:
  lookup newdentry in new_upperdir
  call vfs_rename() with negative newdentry and RENAME_EXCHANGE

Fix by adding the missing check for negative newdentry.

Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
Fixes: e9be9d5e76e3 ("overlay filesystem")
Cc: <stable@vger.kernel.org> # v3.18
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/dir.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 08b595c526d7..16955a307dcd 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -1214,9 +1214,13 @@ static int ovl_rename(struct inode *olddir, struct dentry *old,
 				goto out_dput;
 		}
 	} else {
-		if (!d_is_negative(newdentry) &&
-		    (!new_opaque || !ovl_is_whiteout(newdentry)))
-			goto out_dput;
+		if (!d_is_negative(newdentry)) {
+			if (!new_opaque || !ovl_is_whiteout(newdentry))
+				goto out_dput;
+		} else {
+			if (flags & RENAME_EXCHANGE)
+				goto out_dput;
+		}
 	}
 
 	if (olddentry == trap)

From 1bc2f315a215585f8bc07257542e67373c86e801 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Mon, 27 Sep 2021 11:23:57 +0200
Subject: [PATCH 0748/1750] ovl: fix IOCB_DIRECT if underlying fs doesn't
 support direct IO

commit 1dc1eed46f9fa4cb8a07baa24fb44c96d6dd35c9 upstream.

Normally the check at open time suffices, but e.g loop device does set
IOCB_DIRECT after doing its own checks (which are not sufficent for
overlayfs).

Make sure we don't call the underlying filesystem read/write method with
the IOCB_DIRECT if it's not supported.

Reported-by: Huang Jianan <huangjianan@oppo.com>
Fixes: 16914e6fc7e1 ("ovl: add ovl_read_iter()")
Cc: <stable@vger.kernel.org> # v4.19
Tested-by: Huang Jianan <huangjianan@oppo.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/file.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index 5c5c3972ebd0..f7135777cb4e 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -301,6 +301,12 @@ static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter)
 	if (ret)
 		return ret;
 
+	ret = -EINVAL;
+	if (iocb->ki_flags & IOCB_DIRECT &&
+	    (!real.file->f_mapping->a_ops ||
+	     !real.file->f_mapping->a_ops->direct_IO))
+		goto out_fdput;
+
 	old_cred = ovl_override_creds(file_inode(file)->i_sb);
 	if (is_sync_kiocb(iocb)) {
 		ret = vfs_iter_read(real.file, iter, &iocb->ki_pos,
@@ -325,7 +331,7 @@ static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter)
 out:
 	revert_creds(old_cred);
 	ovl_file_accessed(file);
-
+out_fdput:
 	fdput(real);
 
 	return ret;
@@ -354,6 +360,12 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter)
 	if (ret)
 		goto out_unlock;
 
+	ret = -EINVAL;
+	if (iocb->ki_flags & IOCB_DIRECT &&
+	    (!real.file->f_mapping->a_ops ||
+	     !real.file->f_mapping->a_ops->direct_IO))
+		goto out_fdput;
+
 	if (!ovl_should_sync(OVL_FS(inode->i_sb)))
 		ifl &= ~(IOCB_DSYNC | IOCB_SYNC);
 
@@ -389,6 +401,7 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter)
 	}
 out:
 	revert_creds(old_cred);
+out_fdput:
 	fdput(real);
 
 out_unlock:

From 12d4b179022ac7d07aa263b46159779536b3c6a6 Mon Sep 17 00:00:00 2001
From: Patrick Ho <Patrick.Ho@netapp.com>
Date: Sat, 21 Aug 2021 02:56:26 -0400
Subject: [PATCH 0749/1750] nfsd: fix error handling of
 register_pernet_subsys() in init_nfsd()

commit 1d625050c7c2dd877e108e382b8aaf1ae3cfe1f4 upstream.

init_nfsd() should not unregister pernet subsys if the register fails
but should instead unwind from the last successful operation which is
register_filesystem().

Unregistering a failed register_pernet_subsys() call can result in
a kernel GPF as revealed by programmatically injecting an error in
register_pernet_subsys().

Verified the fix handled failure gracefully with no lingering nfsd
entry in /proc/filesystems.  This change was introduced by the commit
bd5ae9288d64 ("nfsd: register pernet ops last, unregister first"),
the original error handling logic was correct.

Fixes: bd5ae9288d64 ("nfsd: register pernet ops last, unregister first")
Cc: stable@vger.kernel.org
Signed-off-by: Patrick Ho <Patrick.Ho@netapp.com>
Acked-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfsctl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 0759e589ab52..ddf2b375632b 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -1547,7 +1547,7 @@ static int __init init_nfsd(void)
 		goto out_free_all;
 	return 0;
 out_free_all:
-	unregister_pernet_subsys(&nfsd_net_ops);
+	unregister_filesystem(&nfsd_fs_type);
 out_free_exports:
 	remove_proc_entry("fs/nfs/exports", NULL);
 	remove_proc_entry("fs/nfs", NULL);

From 8f174a208c4c7dae73b36db2ca84d06ee901ecb1 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Thu, 30 Sep 2021 15:44:41 -0400
Subject: [PATCH 0750/1750] nfsd4: Handle the NFSv4 READDIR 'dircount' hint
 being zero

commit f2e717d655040d632c9015f19aa4275f8b16e7f2 upstream.

RFC3530 notes that the 'dircount' field may be zero, in which case the
recommendation is to ignore it, and only enforce the 'maxcount' field.
In RFC5661, this recommendation to ignore a zero valued field becomes a
requirement.

Fixes: aee377644146 ("nfsd4: fix rd_dircount enforcement")
Cc: <stable@vger.kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/nfsd/nfs4xdr.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 5f5169b9c2e9..46f825cf53f4 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -3427,15 +3427,18 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
 		goto fail;
 	cd->rd_maxcount -= entry_bytes;
 	/*
-	 * RFC 3530 14.2.24 describes rd_dircount as only a "hint", so
-	 * let's always let through the first entry, at least:
+	 * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and
+	 * notes that it could be zero. If it is zero, then the server
+	 * should enforce only the rd_maxcount value.
 	 */
-	if (!cd->rd_dircount)
-		goto fail;
-	name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
-	if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
-		goto fail;
-	cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
+	if (cd->rd_dircount) {
+		name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
+		if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
+			goto fail;
+		cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
+		if (!cd->rd_dircount)
+			cd->rd_maxcount = 0;
+	}
 
 	cd->cookie_offset = cookie_offset;
 skip_entry:

From 9aac782ab0ab0fd0a8e507a6294359c2f5cf182d Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Fri, 1 Oct 2021 09:59:21 -0400
Subject: [PATCH 0751/1750] SUNRPC: fix sign error causing rpcsec_gss drops

commit 2ba5acfb34957e8a7fe47cd78c77ca88e9cc2b03 upstream.

If sd_max is unsigned, then sd_max - GSS_SEQ_WIN is a very large number
whenever sd_max is less than GSS_SEQ_WIN, and the comparison:

	seq_num <= sd->sd_max - GSS_SEQ_WIN

in gss_check_seq_num is pretty much always true, even when that's
clearly not what was intended.

This was causing pynfs to hang when using krb5, because pynfs uses zero
as the initial gss sequence number.  That's perfectly legal, but this
logic error causes knfsd to drop the rpc in that case.  Out-of-order
sequence IDs in the first GSS_SEQ_WIN (128) calls will also cause this.

Fixes: 10b9d99a3dbb ("SUNRPC: Augment server-side rpcgss tracepoints")
Cc: stable@vger.kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index e22f2d65457d..f5111d62972d 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -643,7 +643,7 @@ static bool gss_check_seq_num(const struct svc_rqst *rqstp, struct rsc *rsci,
 		}
 		__set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win);
 		goto ok;
-	} else if (seq_num <= sd->sd_max - GSS_SEQ_WIN) {
+	} else if (seq_num + GSS_SEQ_WIN <= sd->sd_max) {
 		goto toolow;
 	}
 	if (__test_and_set_bit(seq_num % GSS_SEQ_WIN, sd->sd_win))

From f9a855d1bcb2630db6163de363945c9c84feaa46 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 5 Oct 2021 15:34:33 +0200
Subject: [PATCH 0752/1750] xen/balloon: fix cancelled balloon action
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 319933a80fd4f07122466a77f93e5019d71be74c upstream.

In case a ballooning action is cancelled the new kernel thread handling
the ballooning might end up in a busy loop.

Fix that by handling the cancelled action gracefully.

While at it introduce a short wait for the BP_WAIT case.

Cc: stable@vger.kernel.org
Fixes: 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a workqueue")
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Tested-by: Jason Andryuk <jandryuk@gmail.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Link: https://lore.kernel.org/r/20211005133433.32008-1-jgross@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/xen/balloon.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 15d4b1ef19f8..1911a62a6d9c 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -491,12 +491,12 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
 }
 
 /*
- * Stop waiting if either state is not BP_EAGAIN and ballooning action is
- * needed, or if the credit has changed while state is BP_EAGAIN.
+ * Stop waiting if either state is BP_DONE and ballooning action is
+ * needed, or if the credit has changed while state is not BP_DONE.
  */
 static bool balloon_thread_cond(enum bp_state state, long credit)
 {
-	if (state != BP_EAGAIN)
+	if (state == BP_DONE)
 		credit = 0;
 
 	return current_credit() != credit || kthread_should_stop();
@@ -516,10 +516,19 @@ static int balloon_thread(void *unused)
 
 	set_freezable();
 	for (;;) {
-		if (state == BP_EAGAIN)
-			timeout = balloon_stats.schedule_delay * HZ;
-		else
+		switch (state) {
+		case BP_DONE:
+		case BP_ECANCELED:
 			timeout = 3600 * HZ;
+			break;
+		case BP_EAGAIN:
+			timeout = balloon_stats.schedule_delay * HZ;
+			break;
+		case BP_WAIT:
+			timeout = HZ;
+			break;
+		}
+
 		credit = current_credit();
 
 		wait_event_freezable_timeout(balloon_thread_wq,

From 71d3ce62ac88190c63eb470e86fe76fc7e19bb0f Mon Sep 17 00:00:00 2001
From: Roger Quadros <rogerq@kernel.org>
Date: Thu, 2 Sep 2021 12:58:28 +0300
Subject: [PATCH 0753/1750] ARM: dts: omap3430-sdp: Fix NAND device node

commit 80d680fdccba214e8106dc1aa33de5207ad75394 upstream.

Nand is on CS1 so reg properties first field should be 1 not 0.

Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes")
Cc: stable@vger.kernel.org # v4.6+
Signed-off-by: Roger Quadros <rogerq@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/omap3430-sdp.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/omap3430-sdp.dts b/arch/arm/boot/dts/omap3430-sdp.dts
index c5b903718414..7d530ae3483b 100644
--- a/arch/arm/boot/dts/omap3430-sdp.dts
+++ b/arch/arm/boot/dts/omap3430-sdp.dts
@@ -101,7 +101,7 @@ partition@280000 {
 
 	nand@1,0 {
 		compatible = "ti,omap2-nand";
-		reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
+		reg = <1 0 4>; /* CS1, offset 0, IO size 4 */
 		interrupt-parent = <&gpmc>;
 		interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
 			     <1 IRQ_TYPE_NONE>;	/* termcount */

From ac06fe40e8896c96786b47857ddc50738a103f6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20Vok=C3=A1=C4=8D?= <michal.vokac@ysoft.com>
Date: Wed, 18 Aug 2021 09:02:08 +0200
Subject: [PATCH 0754/1750] ARM: dts: imx6dl-yapp4: Fix lp5562 LED driver probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 9b663b34c94a78f39fa2c7a8271b1f828b546e16 upstream.

Since the LED multicolor framework support was added in commit
92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx")
LEDs on this platform stopped working.

Author of the framework attempted to accommodate this DT to the
framework in commit b86d3d21cd4c ("ARM: dts: imx6dl-yapp4: Add reg property
to the lp5562 channel node") but that is not sufficient. A color property
is now required even if the multicolor framework is not used, otherwise
the driver probe fails:

  lp5562: probe of 1-0030 failed with error -22

Add the color property to fix this.

Fixes: 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx")
Cc: <stable@vger.kernel.org>
Cc: linux-leds@vger.kernel.org
Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
index 9148a01ed6d9..ebc0892e37c7 100644
--- a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+++ b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
@@ -5,6 +5,7 @@
 #include <dt-bindings/gpio/gpio.h>
 #include <dt-bindings/interrupt-controller/irq.h>
 #include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
 #include <dt-bindings/pwm/pwm.h>
 
 / {
@@ -275,6 +276,7 @@ chan@0 {
 			led-cur = /bits/ 8 <0x20>;
 			max-cur = /bits/ 8 <0x60>;
 			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
 		};
 
 		chan@1 {
@@ -282,6 +284,7 @@ chan@1 {
 			led-cur = /bits/ 8 <0x20>;
 			max-cur = /bits/ 8 <0x60>;
 			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
 		};
 
 		chan@2 {
@@ -289,6 +292,7 @@ chan@2 {
 			led-cur = /bits/ 8 <0x20>;
 			max-cur = /bits/ 8 <0x60>;
 			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
 		};
 
 		chan@3 {
@@ -296,6 +300,7 @@ chan@3 {
 			led-cur = /bits/ 8 <0x0>;
 			max-cur = /bits/ 8 <0x0>;
 			reg = <3>;
+			color = <LED_COLOR_ID_WHITE>;
 		};
 	};
 

From 05287407dedf5275ce2e98eb5cd0dd03922eb3cd Mon Sep 17 00:00:00 2001
From: David Heidelberg <david@ixit.cz>
Date: Wed, 18 Aug 2021 08:53:17 +0200
Subject: [PATCH 0755/1750] ARM: dts: qcom: apq8064: use compatible which
 contains chipid

commit f5c03f131dae3f06d08464e6157dd461200f78d9 upstream.

Also resolves these kernel warnings for APQ8064:
adreno 4300000.adreno-3xx: Using legacy qcom,chipid binding!
adreno 4300000.adreno-3xx: Use compatible qcom,adreno-320.2 instead.

Tested on Nexus 7 2013, no functional changes.

Cc: <stable@vger.kernel.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20210818065317.19822-1-david@ixit.cz
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/qcom-apq8064.dtsi | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
index e36d590e8373..01ea4590ffce 100644
--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
@@ -1148,7 +1148,7 @@ tcsr: syscon@1a400000 {
 		};
 
 		gpu: adreno-3xx@4300000 {
-			compatible = "qcom,adreno-3xx";
+			compatible = "qcom,adreno-320.2", "qcom,adreno";
 			reg = <0x04300000 0x20000>;
 			reg-names = "kgsl_3d0_reg_memory";
 			interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
@@ -1163,7 +1163,6 @@ gpu: adreno-3xx@4300000 {
 			    <&mmcc GFX3D_AHB_CLK>,
 			    <&mmcc GFX3D_AXI_CLK>,
 			    <&mmcc MMSS_IMEM_AHB_CLK>;
-			qcom,chipid = <0x03020002>;
 
 			iommus = <&gfx3d 0
 				  &gfx3d 1

From 427faa29e06f0709476ea1bd59758f997ec8b64e Mon Sep 17 00:00:00 2001
From: Alexandre Ghiti <alex@ghiti.fr>
Date: Sat, 18 Sep 2021 18:02:21 +0200
Subject: [PATCH 0756/1750] riscv: Flush current cpu icache before other cpus

commit bb8958d5dc79acbd071397abb57b8756375fe1ce upstream.

On SiFive Unmatched, I recently fell onto the following BUG when booting:

[    0.000000] ftrace: allocating 36610 entries in 144 pages
[    0.000000] Oops - illegal instruction [#1]
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.13.1+ #5
[    0.000000] Hardware name: SiFive HiFive Unmatched A00 (DT)
[    0.000000] epc : riscv_cpuid_to_hartid_mask+0x6/0xae
[    0.000000]  ra : __sbi_rfence_v02+0xc8/0x10a
[    0.000000] epc : ffffffff80007240 ra : ffffffff80009964 sp : ffffffff81803e10
[    0.000000]  gp : ffffffff81a1ea70 tp : ffffffff8180f500 t0 : ffffffe07fe30000
[    0.000000]  t1 : 0000000000000004 t2 : 0000000000000000 s0 : ffffffff81803e60
[    0.000000]  s1 : 0000000000000000 a0 : ffffffff81a22238 a1 : ffffffff81803e10
[    0.000000]  a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000
[    0.000000]  a5 : 0000000000000000 a6 : ffffffff8000989c a7 : 0000000052464e43
[    0.000000]  s2 : ffffffff81a220c8 s3 : 0000000000000000 s4 : 0000000000000000
[    0.000000]  s5 : 0000000000000000 s6 : 0000000200000100 s7 : 0000000000000001
[    0.000000]  s8 : ffffffe07fe04040 s9 : ffffffff81a22c80 s10: 0000000000001000
[    0.000000]  s11: 0000000000000004 t3 : 0000000000000001 t4 : 0000000000000008
[    0.000000]  t5 : ffffffcf04000808 t6 : ffffffe3ffddf188
[    0.000000] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000002
[    0.000000] [<ffffffff80007240>] riscv_cpuid_to_hartid_mask+0x6/0xae
[    0.000000] [<ffffffff80009474>] sbi_remote_fence_i+0x1e/0x26
[    0.000000] [<ffffffff8000b8f4>] flush_icache_all+0x12/0x1a
[    0.000000] [<ffffffff8000666c>] patch_text_nosync+0x26/0x32
[    0.000000] [<ffffffff8000884e>] ftrace_init_nop+0x52/0x8c
[    0.000000] [<ffffffff800f051e>] ftrace_process_locs.isra.0+0x29c/0x360
[    0.000000] [<ffffffff80a0e3c6>] ftrace_init+0x80/0x130
[    0.000000] [<ffffffff80a00f8c>] start_kernel+0x5c4/0x8f6
[    0.000000] ---[ end trace f67eb9af4d8d492b ]---
[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---

While ftrace is looping over a list of addresses to patch, it always failed
when patching the same function: riscv_cpuid_to_hartid_mask. Looking at the
backtrace, the illegal instruction is encountered in this same function.
However, patch_text_nosync, after patching the instructions, calls
flush_icache_range. But looking at what happens in this function:

flush_icache_range -> flush_icache_all
                   -> sbi_remote_fence_i
                   -> __sbi_rfence_v02
                   -> riscv_cpuid_to_hartid_mask

The icache and dcache of the current cpu are never synchronized between the
patching of riscv_cpuid_to_hartid_mask and calling this same function.

So fix this by flushing the current cpu's icache before asking for the other
cpus to do the same.

Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
Fixes: fab957c11efe ("RISC-V: Atomic and Locking Code")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/riscv/mm/cacheflush.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/riscv/mm/cacheflush.c b/arch/riscv/mm/cacheflush.c
index 094118663285..89f81067e09e 100644
--- a/arch/riscv/mm/cacheflush.c
+++ b/arch/riscv/mm/cacheflush.c
@@ -16,6 +16,8 @@ static void ipi_remote_fence_i(void *info)
 
 void flush_icache_all(void)
 {
+	local_flush_icache_all();
+
 	if (IS_ENABLED(CONFIG_RISCV_SBI))
 		sbi_remote_fence_i(NULL);
 	else

From ab8073794be3316ae6928225dd795c657eb8b05a Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Sun, 15 Aug 2021 12:18:52 -0700
Subject: [PATCH 0757/1750] bus: ti-sysc: Add break in switch statement in
 sysc_init_soc()

[ Upstream commit e879f855e590b40fe3c79f2fbd8f65ca3c724120 ]

After commit a6d90e9f2232 ("bus: ti-sysc: AM3: RNG is GP only"), clang
with -Wimplicit-fallthrough enabled warns:

drivers/bus/ti-sysc.c:2958:3: warning: unannotated fall-through between
switch labels [-Wimplicit-fallthrough]
                default:
                ^
drivers/bus/ti-sysc.c:2958:3: note: insert 'break;' to avoid
fall-through
                default:
                ^
                break;
1 warning generated.

Clang's version of this warning is a little bit more pedantic than
GCC's. Add the missing break to satisfy it to match what has been done
all over the kernel tree.

Fixes: a6d90e9f2232 ("bus: ti-sysc: AM3: RNG is GP only")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/ti-sysc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 159b57c6dc4d..d2b7338c073f 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -2922,6 +2922,7 @@ static int sysc_init_soc(struct sysc *ddata)
 			break;
 		case SOC_AM3:
 			sysc_add_disabled(0x48310000);  /* rng */
+			break;
 		default:
 			break;
 		};

From 25ac88e601ebc7c44a5aa0a5fa094e59e53eaaae Mon Sep 17 00:00:00 2001
From: Antonio Martorana <amartora@codeaurora.org>
Date: Mon, 16 Aug 2021 17:24:39 -0700
Subject: [PATCH 0758/1750] soc: qcom: socinfo: Fixed argument passed to
 platform_set_data()

[ Upstream commit 9c5a4ec69bbf5951f84ada9e0db9c6c50de61808 ]

Set qcom_socinfo pointer as data being stored instead of pointer
to soc_device structure. Aligns with future calls to platform_get_data()
which expects qcom_socinfo pointer.

Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver")
Signed-off-by: Antonio Martorana <amartora@codeaurora.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/1629159879-95777-1-git-send-email-amartora@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/socinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
index e0620416e574..60c82dcaa8d1 100644
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -521,7 +521,7 @@ static int qcom_socinfo_probe(struct platform_device *pdev)
 	/* Feed the soc specific unique data into entropy pool */
 	add_device_randomness(info, item_size);
 
-	platform_set_drvdata(pdev, qs->soc_dev);
+	platform_set_drvdata(pdev, qs);
 
 	return 0;
 }

From d89a313a573953074e57fc42170dd32a315659c1 Mon Sep 17 00:00:00 2001
From: Marijn Suijten <marijn.suijten@somainline.org>
Date: Sun, 29 Aug 2021 22:30:25 +0200
Subject: [PATCH 0759/1750] ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI
 PLL reference

[ Upstream commit f1db21c315f4b4f8c3fbea56aac500673132d317 ]

The 28NM DSI PLL driver for msm8960 calculates with a 27MHz reference
clock and should hence use PXO, not CXO which runs at 19.2MHz.

Note that none of the DSI PHY/PLL drivers currently use this "ref"
clock; they all rely on (sometimes inexistant) global clock names and
usually function normally without a parent clock.  This discrepancy will
be corrected in a future patch, for which this change needs to be in
place first.

Fixes: 6969d1d9c615 ("ARM: dts: qcom-apq8064: Set 'cxo_board' as ref clock of the DSI PHY")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Link: https://lore.kernel.org/r/20210829203027.276143-2-marijn.suijten@somainline.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/qcom-apq8064.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
index 01ea4590ffce..72c4a9fc41a2 100644
--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
@@ -198,7 +198,7 @@ cxo_board: cxo_board {
 			clock-frequency = <19200000>;
 		};
 
-		pxo_board {
+		pxo_board: pxo_board {
 			compatible = "fixed-clock";
 			#clock-cells = <0>;
 			clock-frequency = <27000000>;
@@ -1305,7 +1305,7 @@ dsi0_phy: dsi-phy@4700200 {
 			reg-names = "dsi_pll", "dsi_phy", "dsi_phy_regulator";
 			clock-names = "iface_clk", "ref";
 			clocks = <&mmcc DSI_M_AHB_CLK>,
-				 <&cxo_board>;
+				 <&pxo_board>;
 		};
 
 

From 14f52004bda51ce7695abada3470752a73fa6b60 Mon Sep 17 00:00:00 2001
From: Claudiu Beznea <claudiu.beznea@microchip.com>
Date: Mon, 23 Aug 2021 16:19:12 +0300
Subject: [PATCH 0760/1750] ARM: at91: pm: do not panic if ram controllers are
 not enabled

[ Upstream commit 1605de1b3ca66e3eddbca4b3c353c13c26476fe2 ]

In case PM is enabled but there is no RAM controller information
in DT the code will panic. Avoid such scenarios by not initializing
platform specific PM code in case RAM controller is not provided
via DT.

Reported-by: Eugen Hristev <eugen.hristev@microchip.com>
Fixes: 827de1f123ba0 ("ARM: at91: remove at91_dt_initialize and machine init_early()")
Fixes: 892e1f4a3ae58 ("ARM: at91: pm: add sama7g5 ddr phy controller")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20210823131915.23857-2-claudiu.beznea@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-at91/pm.c | 58 +++++++++++++++++++++++++++++++++--------
 1 file changed, 47 insertions(+), 11 deletions(-)

diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 120f9aa6fff3..3f015cb6ec2b 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -517,18 +517,22 @@ static const struct of_device_id ramc_ids[] __initconst = {
 	{ /*sentinel*/ }
 };
 
-static __init void at91_dt_ramc(void)
+static __init int at91_dt_ramc(void)
 {
 	struct device_node *np;
 	const struct of_device_id *of_id;
 	int idx = 0;
 	void *standby = NULL;
 	const struct ramc_info *ramc;
+	int ret;
 
 	for_each_matching_node_and_match(np, ramc_ids, &of_id) {
 		soc_pm.data.ramc[idx] = of_iomap(np, 0);
-		if (!soc_pm.data.ramc[idx])
-			panic(pr_fmt("unable to map ramc[%d] cpu registers\n"), idx);
+		if (!soc_pm.data.ramc[idx]) {
+			pr_err("unable to map ramc[%d] cpu registers\n", idx);
+			ret = -ENOMEM;
+			goto unmap_ramc;
+		}
 
 		ramc = of_id->data;
 		if (!standby)
@@ -538,15 +542,26 @@ static __init void at91_dt_ramc(void)
 		idx++;
 	}
 
-	if (!idx)
-		panic(pr_fmt("unable to find compatible ram controller node in dtb\n"));
+	if (!idx) {
+		pr_err("unable to find compatible ram controller node in dtb\n");
+		ret = -ENODEV;
+		goto unmap_ramc;
+	}
 
 	if (!standby) {
 		pr_warn("ramc no standby function available\n");
-		return;
+		return 0;
 	}
 
 	at91_cpuidle_device.dev.platform_data = standby;
+
+	return 0;
+
+unmap_ramc:
+	while (idx)
+		iounmap(soc_pm.data.ramc[--idx]);
+
+	return ret;
 }
 
 static void at91rm9200_idle(void)
@@ -869,6 +884,8 @@ static void __init at91_pm_init(void (*pm_idle)(void))
 
 void __init at91rm9200_pm_init(void)
 {
+	int ret;
+
 	if (!IS_ENABLED(CONFIG_SOC_AT91RM9200))
 		return;
 
@@ -880,7 +897,9 @@ void __init at91rm9200_pm_init(void)
 	soc_pm.data.standby_mode = AT91_PM_STANDBY;
 	soc_pm.data.suspend_mode = AT91_PM_ULP0;
 
-	at91_dt_ramc();
+	ret = at91_dt_ramc();
+	if (ret)
+		return;
 
 	/*
 	 * AT91RM9200 SDRAM low-power mode cannot be used with self-refresh.
@@ -895,13 +914,17 @@ void __init sam9x60_pm_init(void)
 	static const int modes[] __initconst = {
 		AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST, AT91_PM_ULP1,
 	};
+	int ret;
 
 	if (!IS_ENABLED(CONFIG_SOC_SAM9X60))
 		return;
 
 	at91_pm_modes_validate(modes, ARRAY_SIZE(modes));
 	at91_pm_modes_init();
-	at91_dt_ramc();
+	ret = at91_dt_ramc();
+	if (ret)
+		return;
+
 	at91_pm_init(NULL);
 
 	soc_pm.ws_ids = sam9x60_ws_ids;
@@ -910,6 +933,8 @@ void __init sam9x60_pm_init(void)
 
 void __init at91sam9_pm_init(void)
 {
+	int ret;
+
 	if (!IS_ENABLED(CONFIG_SOC_AT91SAM9))
 		return;
 
@@ -921,7 +946,10 @@ void __init at91sam9_pm_init(void)
 	soc_pm.data.standby_mode = AT91_PM_STANDBY;
 	soc_pm.data.suspend_mode = AT91_PM_ULP0;
 
-	at91_dt_ramc();
+	ret = at91_dt_ramc();
+	if (ret)
+		return;
+
 	at91_pm_init(at91sam9_idle);
 }
 
@@ -930,12 +958,16 @@ void __init sama5_pm_init(void)
 	static const int modes[] __initconst = {
 		AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST,
 	};
+	int ret;
 
 	if (!IS_ENABLED(CONFIG_SOC_SAMA5))
 		return;
 
 	at91_pm_modes_validate(modes, ARRAY_SIZE(modes));
-	at91_dt_ramc();
+	ret = at91_dt_ramc();
+	if (ret)
+		return;
+
 	at91_pm_init(NULL);
 }
 
@@ -945,13 +977,17 @@ void __init sama5d2_pm_init(void)
 		AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST, AT91_PM_ULP1,
 		AT91_PM_BACKUP,
 	};
+	int ret;
 
 	if (!IS_ENABLED(CONFIG_SOC_SAMA5D2))
 		return;
 
 	at91_pm_modes_validate(modes, ARRAY_SIZE(modes));
 	at91_pm_modes_init();
-	at91_dt_ramc();
+	ret = at91_dt_ramc();
+	if (ret)
+		return;
+
 	at91_pm_init(NULL);
 
 	soc_pm.ws_ids = sama5d2_ws_ids;

From 8f977e97b2b9284b76af46ccf64ce6ceecf60144 Mon Sep 17 00:00:00 2001
From: Shawn Guo <shawn.guo@linaro.org>
Date: Sat, 28 Aug 2021 15:02:02 +0800
Subject: [PATCH 0761/1750] soc: qcom: mdt_loader: Drop PT_LOAD check on hash
 segment

[ Upstream commit 833d51d7c66d6708abbc02398892b96b950167b9 ]

PT_LOAD type denotes that the segment should be loaded into the final
firmware memory region.  Hash segment is not one such, because it's only
needed for PAS init and shouldn't be in the final firmware memory region.
That's why mdt_phdr_valid() explicitly reject non PT_LOAD segment and
hash segment.  This actually makes the hash segment type check in
qcom_mdt_read_metadata() unnecessary and redundant.  For a hash segment,
it won't be loaded into firmware memory region anyway, due to the
QCOM_MDT_TYPE_HASH check in mdt_phdr_valid(), even if it has a PT_LOAD
type for some reason (misusing or abusing?).

Some firmware files on Sony phones are such examples, e.g WCNSS firmware
of Sony Xperia M4 Aqua phone.  The type of hash segment is just PT_LOAD.
Drop the unnecessary hash segment type check in qcom_mdt_read_metadata()
to fix firmware loading failure on these phones, while hash segment is
still kept away from the final firmware memory region.

Fixes: 498b98e93900 ("soc: qcom: mdt_loader: Support loading non-split images")
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210828070202.7033-1-shawn.guo@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/mdt_loader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
index eba7f76f9d61..6034cd8992b0 100644
--- a/drivers/soc/qcom/mdt_loader.c
+++ b/drivers/soc/qcom/mdt_loader.c
@@ -98,7 +98,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)
 	if (ehdr->e_phnum < 2)
 		return ERR_PTR(-EINVAL);
 
-	if (phdrs[0].p_type == PT_LOAD || phdrs[1].p_type == PT_LOAD)
+	if (phdrs[0].p_type == PT_LOAD)
 		return ERR_PTR(-EINVAL);
 
 	if ((phdrs[1].p_flags & QCOM_MDT_TYPE_MASK) != QCOM_MDT_TYPE_HASH)

From 2ba34cf0c16cbe381c9625b8133648036600012f Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Sun, 5 Sep 2021 02:00:48 +0200
Subject: [PATCH 0762/1750] ARM: dts: imx: Add missing pinctrl-names for panel
 on M53Menlo

[ Upstream commit c8c1efe14a4aadcfe93a158b1272e48298d2de15 ]

The panel already contains pinctrl-0 phandle, but it is missing
the default pinctrl-names property, so the pin configuration is
ignored. Fill in the missing pinctrl-names property, so the pin
configuration is applied.

Fixes: d81765d693db6 ("ARM: dts: imx53: Update LCD panel node on M53Menlo")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: NXP Linux Team <linux-imx@nxp.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx53-m53menlo.dts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
index d3082b9774e4..48adcfd32cea 100644
--- a/arch/arm/boot/dts/imx53-m53menlo.dts
+++ b/arch/arm/boot/dts/imx53-m53menlo.dts
@@ -56,6 +56,7 @@ eth {
 	panel {
 		compatible = "edt,etm0700g0dh6";
 		pinctrl-0 = <&pinctrl_display_gpio>;
+		pinctrl-names = "default";
 		enable-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>;
 
 		port {

From 9e99ad4194a503bba830a148a8447b39a46299c0 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Sun, 5 Sep 2021 02:01:37 +0200
Subject: [PATCH 0763/1750] ARM: dts: imx: Fix USB host power regulator
 polarity on M53Menlo

[ Upstream commit 5c187e2eb3f92daa38cb3d4ab45e1107ea34108e ]

The MIC2025 switch input signal nEN is active low, describe it as such
in the DT. The previous change to this regulator polarity was incorrectly
influenced by broken quirks in gpiolib-of.c, which is now long fixed. So
fix this regulator polarity setting here once and for all.

Fixes: 3c3601cd6a6d3 ("ARM: dts: imx53: Update USB configuration on M53Menlo")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: Fabio Estevam <festevam@gmail.com>
Cc: NXP Linux Team <linux-imx@nxp.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx53-m53menlo.dts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts
index 48adcfd32cea..4f88e96d81dd 100644
--- a/arch/arm/boot/dts/imx53-m53menlo.dts
+++ b/arch/arm/boot/dts/imx53-m53menlo.dts
@@ -77,8 +77,7 @@ reg_usbh1_vbus: regulator-usbh1-vbus {
 		regulator-name = "vbus";
 		regulator-min-microvolt = <5000000>;
 		regulator-max-microvolt = <5000000>;
-		gpio = <&gpio1 2 GPIO_ACTIVE_HIGH>;
-		enable-active-high;
+		gpio = <&gpio1 2 0>;
 	};
 };
 

From d9b838ae390e6867c62fd7330ddcc540350825d3 Mon Sep 17 00:00:00 2001
From: Fabio Estevam <festevam@gmail.com>
Date: Tue, 14 Sep 2021 14:17:15 -0300
Subject: [PATCH 0764/1750] ARM: dts: imx6qdl-pico: Fix Ethernet support

[ Upstream commit 450e7fe9b1b3c90eeed74a2fe0eeb13a7b57f3da ]

Currently, it is no longer possible to retrieve a DHCP address
on the imx6qdl-pico board.

This issue has been exposed by commit f5d9aa79dfdf ("ARM: imx6q:
remove clk-out fixup for the Atheros AR8031 and AR8035 PHYs").

Fix it by describing the qca,clk-out-frequency property as suggested
by the commit above.

Fixes: 98670a0bb0ef14bbb3 ("ARM: dts: imx6qdl: Add imx6qdl-pico support")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6qdl-pico.dtsi | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/arm/boot/dts/imx6qdl-pico.dtsi b/arch/arm/boot/dts/imx6qdl-pico.dtsi
index 5de4ccb97916..f7a56d6b160c 100644
--- a/arch/arm/boot/dts/imx6qdl-pico.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-pico.dtsi
@@ -176,7 +176,18 @@ &fec {
 	pinctrl-0 = <&pinctrl_enet>;
 	phy-mode = "rgmii-id";
 	phy-reset-gpios = <&gpio1 26 GPIO_ACTIVE_LOW>;
+	phy-handle = <&phy>;
 	status = "okay";
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy: ethernet-phy@1 {
+			reg = <1>;
+			qca,clk-out-frequency = <125000000>;
+		};
+	};
 };
 
 &hdmi {

From 8aef3824e9469445e748d00b89a9f18bb77cab03 Mon Sep 17 00:00:00 2001
From: Long Li <longli@microsoft.com>
Date: Mon, 30 Aug 2021 16:13:27 -0700
Subject: [PATCH 0765/1750] PCI: hv: Fix sleep while in non-sleep context when
 removing child devices from the bus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 41608b64b10b80fe00dd253cd8326ec8ad85930f ]

In hv_pci_bus_exit, the code is holding a spinlock while calling
pci_destroy_slot(), which takes a mutex.

This is not safe for spinlock. Fix this by moving the children to be
deleted to a list on the stack, and removing them after spinlock is
released.

Fixes: 94d22763207a ("PCI: hv: Fix a race condition when removing the device")

Cc: "K. Y. Srinivasan" <kys@microsoft.com>
Cc: Haiyang Zhang <haiyangz@microsoft.com>
Cc: Stephen Hemminger <sthemmin@microsoft.com>
Cc: Wei Liu <wei.liu@kernel.org>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Rob Herring <robh@kernel.org>
Cc: "Krzysztof Wilczyński" <kw@linux.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Michael Kelley <mikelley@microsoft.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/linux-hyperv/20210823152130.GA21501@kili/
Signed-off-by: Long Li <longli@microsoft.com>
Reviewed-by: Wei Liu <wei.liu@kernel.org>
Link: https://lore.kernel.org/r/1630365207-20616-1-git-send-email-longli@linuxonhyperv.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pci-hyperv.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c
index 44e15f0e3a2e..ad3e3cde1c20 100644
--- a/drivers/pci/controller/pci-hyperv.c
+++ b/drivers/pci/controller/pci-hyperv.c
@@ -3259,9 +3259,17 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs)
 		return 0;
 
 	if (!keep_devs) {
-		/* Delete any children which might still exist. */
+		struct list_head removed;
+
+		/* Move all present children to the list on stack */
+		INIT_LIST_HEAD(&removed);
 		spin_lock_irqsave(&hbus->device_list_lock, flags);
-		list_for_each_entry_safe(hpdev, tmp, &hbus->children, list_entry) {
+		list_for_each_entry_safe(hpdev, tmp, &hbus->children, list_entry)
+			list_move_tail(&hpdev->list_entry, &removed);
+		spin_unlock_irqrestore(&hbus->device_list_lock, flags);
+
+		/* Remove all children in the list */
+		list_for_each_entry_safe(hpdev, tmp, &removed, list_entry) {
 			list_del(&hpdev->list_entry);
 			if (hpdev->pci_slot)
 				pci_destroy_slot(hpdev->pci_slot);
@@ -3269,7 +3277,6 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs)
 			put_pcichild(hpdev);
 			put_pcichild(hpdev);
 		}
-		spin_unlock_irqrestore(&hbus->device_list_lock, flags);
 	}
 
 	ret = hv_send_resources_released(hdev);

From fbca14abc11154683c9ebf534e6f23846a5318f4 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 20 Sep 2021 14:23:44 +0200
Subject: [PATCH 0766/1750] ath5k: fix building with LEDS=m

[ Upstream commit fb8c3a3c52400512fc8b3b61150057b888c30b0d ]

Randconfig builds still show a failure for the ath5k driver,
similar to the one that was fixed for ath9k earlier:

WARNING: unmet direct dependencies detected for MAC80211_LEDS
  Depends on [n]: NET [=y] && WIRELESS [=y] && MAC80211 [=y] && (LEDS_CLASS [=m]=y || LEDS_CLASS [=m]=MAC80211 [=y])
  Selected by [m]:
  - ATH5K [=m] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && (PCI [=y] || ATH25) && MAC80211 [=y]
net/mac80211/led.c: In function 'ieee80211_alloc_led_names':
net/mac80211/led.c:34:22: error: 'struct led_trigger' has no member named 'name'
   34 |         local->rx_led.name = kasprintf(GFP_KERNEL, "%srx",
      |                      ^

Copying the same logic from my ath9k patch makes this one work
as well, stubbing out the calls to the LED subsystem.

Fixes: b64acb28da83 ("ath9k: fix build error with LEDS_CLASS=m")
Fixes: 72cdab808714 ("ath9k: Do not select MAC80211_LEDS by default")
Fixes: 3a078876caee ("ath5k: convert LED code to use mac80211 triggers")
Link: https://lore.kernel.org/all/20210722105501.1000781-1-arnd@kernel.org/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210920122359.353810-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath5k/Kconfig |  4 +---
 drivers/net/wireless/ath/ath5k/led.c   | 10 ++++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig
index f35cd8de228e..6914b37bb0fb 100644
--- a/drivers/net/wireless/ath/ath5k/Kconfig
+++ b/drivers/net/wireless/ath/ath5k/Kconfig
@@ -3,9 +3,7 @@ config ATH5K
 	tristate "Atheros 5xxx wireless cards support"
 	depends on (PCI || ATH25) && MAC80211
 	select ATH_COMMON
-	select MAC80211_LEDS
-	select LEDS_CLASS
-	select NEW_LEDS
+	select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211
 	select ATH5K_AHB if ATH25
 	select ATH5K_PCI if !ATH25
 	help
diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c
index 6a2a16856763..33e9928af363 100644
--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -89,7 +89,8 @@ static const struct pci_device_id ath5k_led_devices[] = {
 
 void ath5k_led_enable(struct ath5k_hw *ah)
 {
-	if (test_bit(ATH_STAT_LEDSOFT, ah->status)) {
+	if (IS_ENABLED(CONFIG_MAC80211_LEDS) &&
+	    test_bit(ATH_STAT_LEDSOFT, ah->status)) {
 		ath5k_hw_set_gpio_output(ah, ah->led_pin);
 		ath5k_led_off(ah);
 	}
@@ -104,7 +105,8 @@ static void ath5k_led_on(struct ath5k_hw *ah)
 
 void ath5k_led_off(struct ath5k_hw *ah)
 {
-	if (!test_bit(ATH_STAT_LEDSOFT, ah->status))
+	if (!IS_ENABLED(CONFIG_MAC80211_LEDS) ||
+	    !test_bit(ATH_STAT_LEDSOFT, ah->status))
 		return;
 	ath5k_hw_set_gpio(ah, ah->led_pin, !ah->led_on);
 }
@@ -146,7 +148,7 @@ ath5k_register_led(struct ath5k_hw *ah, struct ath5k_led *led,
 static void
 ath5k_unregister_led(struct ath5k_led *led)
 {
-	if (!led->ah)
+	if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !led->ah)
 		return;
 	led_classdev_unregister(&led->led_dev);
 	ath5k_led_off(led->ah);
@@ -169,7 +171,7 @@ int ath5k_init_leds(struct ath5k_hw *ah)
 	char name[ATH5K_LED_MAX_NAME_LEN + 1];
 	const struct pci_device_id *match;
 
-	if (!ah->pdev)
+	if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !ah->pdev)
 		return 0;
 
 #ifdef CONFIG_ATH5K_AHB

From 997bec509a83aeb7f02a795c26ed0280f9a9ceab Mon Sep 17 00:00:00 2001
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date: Thu, 16 Sep 2021 18:13:39 +0300
Subject: [PATCH 0767/1750] arm64: dts: qcom: pm8150: use qcom,pm8998-pon
 binding

[ Upstream commit a153d317168aa3d61a204fadc85bac3995381d33 ]

Change pm8150 to use the qcom,pm8998-pon compatible string for the pon
in order to pass reboot mode properly.

Fixes: 5101f22a5c37 ("arm64: dts: qcom: pm8150: Add base dts file")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210916151341.1797512-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/pm8150.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/pm8150.dtsi b/arch/arm64/boot/dts/qcom/pm8150.dtsi
index 1b6406927509..82edcd74ce98 100644
--- a/arch/arm64/boot/dts/qcom/pm8150.dtsi
+++ b/arch/arm64/boot/dts/qcom/pm8150.dtsi
@@ -48,7 +48,7 @@ pm8150_0: pmic@0 {
 		#size-cells = <0>;
 
 		pon: power-on@800 {
-			compatible = "qcom,pm8916-pon";
+			compatible = "qcom,pm8998-pon";
 			reg = <0x0800>;
 			pwrkey {
 				compatible = "qcom,pm8941-pwrkey";

From 3d288ed98314f31607832ba759f5fb1b90cd9e98 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Fri, 24 Sep 2021 20:29:51 -0700
Subject: [PATCH 0768/1750] xtensa: use CONFIG_USE_OF instead of CONFIG_OF
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d67ed2510d28a1eb33171010d35cf52178cfcbdd ]

CONFIG_OF can be set by a randconfig or by a user -- without setting the
early flattree option (OF_EARLY_FLATTREE).  This causes build errors.
However, if randconfig or a user sets USE_OF in the Xtensa config,
the right kconfig symbols are set to fix the build.

Fixes these build errors:

../arch/xtensa/kernel/setup.c:67:19: error: ‘__dtb_start’ undeclared here (not in a function); did you mean ‘dtb_start’?
   67 | void *dtb_start = __dtb_start;
      |                   ^~~~~~~~~~~
../arch/xtensa/kernel/setup.c: In function 'xtensa_dt_io_area':
../arch/xtensa/kernel/setup.c:201:14: error: implicit declaration of function 'of_flat_dt_is_compatible'; did you mean 'of_machine_is_compatible'? [-Werror=implicit-function-declaration]
  201 |         if (!of_flat_dt_is_compatible(node, "simple-bus"))
../arch/xtensa/kernel/setup.c:204:18: error: implicit declaration of function 'of_get_flat_dt_prop' [-Werror=implicit-function-declaration]
  204 |         ranges = of_get_flat_dt_prop(node, "ranges", &len);
../arch/xtensa/kernel/setup.c:204:16: error: assignment to 'const __be32 *' {aka 'const unsigned int *'} from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
  204 |         ranges = of_get_flat_dt_prop(node, "ranges", &len);
      |                ^
../arch/xtensa/kernel/setup.c: In function 'early_init_devtree':
../arch/xtensa/kernel/setup.c:228:9: error: implicit declaration of function 'early_init_dt_scan'; did you mean 'early_init_devtree'? [-Werror=implicit-function-declaration]
  228 |         early_init_dt_scan(params);
../arch/xtensa/kernel/setup.c:229:9: error: implicit declaration of function 'of_scan_flat_dt' [-Werror=implicit-function-declaration]
  229 |         of_scan_flat_dt(xtensa_dt_io_area, NULL);

xtensa-elf-ld: arch/xtensa/mm/mmu.o:(.text+0x0): undefined reference to `xtensa_kio_paddr'

Fixes: da844a81779e ("xtensa: add device trees support")
Fixes: 6cb971114f63 ("xtensa: remap io area defined in device tree")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/include/asm/kmem_layout.h |  2 +-
 arch/xtensa/kernel/setup.c            | 12 ++++++------
 arch/xtensa/mm/mmu.c                  |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/xtensa/include/asm/kmem_layout.h b/arch/xtensa/include/asm/kmem_layout.h
index 7cbf68ca7106..6fc05cba61a2 100644
--- a/arch/xtensa/include/asm/kmem_layout.h
+++ b/arch/xtensa/include/asm/kmem_layout.h
@@ -78,7 +78,7 @@
 #endif
 #define XCHAL_KIO_SIZE			0x10000000
 
-#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_OF)
+#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_USE_OF)
 #define XCHAL_KIO_PADDR			xtensa_get_kio_paddr()
 #ifndef __ASSEMBLY__
 extern unsigned long xtensa_kio_paddr;
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index ed184106e4cf..ee9082a142fe 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -63,7 +63,7 @@ extern unsigned long initrd_end;
 extern int initrd_below_start_ok;
 #endif
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 void *dtb_start = __dtb_start;
 #endif
 
@@ -125,7 +125,7 @@ __tagtable(BP_TAG_INITRD, parse_tag_initrd);
 
 #endif /* CONFIG_BLK_DEV_INITRD */
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 
 static int __init parse_tag_fdt(const bp_tag_t *tag)
 {
@@ -135,7 +135,7 @@ static int __init parse_tag_fdt(const bp_tag_t *tag)
 
 __tagtable(BP_TAG_FDT, parse_tag_fdt);
 
-#endif /* CONFIG_OF */
+#endif /* CONFIG_USE_OF */
 
 static int __init parse_tag_cmdline(const bp_tag_t* tag)
 {
@@ -183,7 +183,7 @@ static int __init parse_bootparam(const bp_tag_t *tag)
 }
 #endif
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 
 #if !XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY
 unsigned long xtensa_kio_paddr = XCHAL_KIO_DEFAULT_PADDR;
@@ -232,7 +232,7 @@ void __init early_init_devtree(void *params)
 		strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
 }
 
-#endif /* CONFIG_OF */
+#endif /* CONFIG_USE_OF */
 
 /*
  * Initialize architecture. (Early stage)
@@ -253,7 +253,7 @@ void __init init_arch(bp_tag_t *bp_start)
 	if (bp_start)
 		parse_bootparam(bp_start);
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 	early_init_devtree(dtb_start);
 #endif
 
diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c
index fd2193df8a14..511bb92518f2 100644
--- a/arch/xtensa/mm/mmu.c
+++ b/arch/xtensa/mm/mmu.c
@@ -100,7 +100,7 @@ void init_mmu(void)
 
 void init_kio(void)
 {
-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF)
+#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_USE_OF)
 	/*
 	 * Update the IO area mapping in case xtensa_kio_paddr has changed
 	 */

From 6b0132f73094d1f8d77ab20e02d7d2bf59c3496c Mon Sep 17 00:00:00 2001
From: Max Filippov <jcmvbkbc@gmail.com>
Date: Mon, 27 Sep 2021 09:46:33 -0700
Subject: [PATCH 0769/1750] xtensa: call irqchip_init only when CONFIG_USE_OF
 is selected

[ Upstream commit 6489f8d0e1d93a3603d8dad8125797559e4cf2a2 ]

During boot time kernel configured with OF=y but USE_OF=n displays the
following warnings and hangs shortly after starting userspace:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at kernel/irq/irqdomain.c:695 irq_create_mapping_affinity+0x29/0xc0
irq_create_mapping_affinity(, 6) called with NULL domain
CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.0-rc3-00001-gd67ed2510d28 #30
Call Trace:
  __warn+0x69/0xc4
  warn_slowpath_fmt+0x6c/0x94
  irq_create_mapping_affinity+0x29/0xc0
  local_timer_setup+0x40/0x88
  time_init+0xb1/0xe8
  start_kernel+0x31d/0x3f4
  _startup+0x13b/0x13b
---[ end trace 1e6630e1c5eda35b ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at arch/xtensa/kernel/time.c:141 local_timer_setup+0x58/0x88
error: can't map timer irq
CPU: 0 PID: 0 Comm: swapper Tainted: G        W         5.15.0-rc3-00001-gd67ed2510d28 #30
Call Trace:
  __warn+0x69/0xc4
  warn_slowpath_fmt+0x6c/0x94
  local_timer_setup+0x58/0x88
  time_init+0xb1/0xe8
  start_kernel+0x31d/0x3f4
  _startup+0x13b/0x13b
---[ end trace 1e6630e1c5eda35c ]---
Failed to request irq 0 (timer)

Fix that by calling irqchip_init only when CONFIG_USE_OF is selected and
calling legacy interrupt controller init otherwise.

Fixes: da844a81779e ("xtensa: add device trees support")
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/kernel/irq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
index a48bf2d10ac2..80cc9770a8d2 100644
--- a/arch/xtensa/kernel/irq.c
+++ b/arch/xtensa/kernel/irq.c
@@ -145,7 +145,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq)
 
 void __init init_IRQ(void)
 {
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 	irqchip_init();
 #else
 #ifdef CONFIG_HAVE_SMP

From 29a19eaeb29d57f4576cf57ccac5a2740f1384db Mon Sep 17 00:00:00 2001
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Date: Fri, 24 Sep 2021 15:21:54 +0300
Subject: [PATCH 0770/1750] iwlwifi: pcie: add configuration of a Wi-Fi adapter
 on Dell XPS 15

[ Upstream commit fe5c735d0d47b495be6753d6aea4f8f78c909a0a ]

There is a Killer AX1650 2x2 Wi-Fi 6 and Bluetooth 5.1 wireless adapter
found on Dell XPS 15 (9510) laptop, its configuration was present on
Linux v5.7, however accidentally it has been removed from the list of
supported devices, let's add it back.

The problem is manifested on driver initialization:

  Intel(R) Wireless WiFi driver for Linux
  iwlwifi 0000:00:14.3: enabling device (0000 -> 0002)
  iwlwifi: No config found for PCI dev 43f0/1651, rev=0x354, rfid=0x10a100
  iwlwifi: probe of 0000:00:14.3 failed with error -22

Bug: https://bugzilla.kernel.org/show_bug.cgi?id=213939
Fixes: 3f910a25839b ("iwlwifi: pcie: convert all AX101 devices to the device tables")
Cc: Julien Wajsberg <felash@gmail.com>
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Acked-by: Luca Coelho <luca@coelho.fi>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210924122154.2376577-1-vladimir.zapolskiy@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
index 90b12e201795..4e43efd5d1ea 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -635,6 +635,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {
 	IWL_DEV_INFO(0x43F0, 0x0074, iwl_ax201_cfg_qu_hr, NULL),
 	IWL_DEV_INFO(0x43F0, 0x0078, iwl_ax201_cfg_qu_hr, NULL),
 	IWL_DEV_INFO(0x43F0, 0x007C, iwl_ax201_cfg_qu_hr, NULL),
+	IWL_DEV_INFO(0x43F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650s_name),
+	IWL_DEV_INFO(0x43F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650i_name),
 	IWL_DEV_INFO(0x43F0, 0x2074, iwl_ax201_cfg_qu_hr, NULL),
 	IWL_DEV_INFO(0x43F0, 0x4070, iwl_ax201_cfg_qu_hr, NULL),
 	IWL_DEV_INFO(0xA0F0, 0x0070, iwl_ax201_cfg_qu_hr, NULL),

From 1d8f4447e8c442f8d2aeabfd3653957015043179 Mon Sep 17 00:00:00 2001
From: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Date: Tue, 28 Sep 2021 11:13:10 +0200
Subject: [PATCH 0771/1750] bpf, arm: Fix register clobbering in div/mod
 implementation

[ Upstream commit 79e3445b38e0cab94264a3894c0c3d57c930b97e ]

On ARM CPUs that lack div/mod instructions, ALU32 BPF_DIV and BPF_MOD are
implemented using a call to a helper function. Before, the emitted code
for those function calls failed to preserve caller-saved ARM registers.
Since some of those registers happen to be mapped to BPF registers, it
resulted in eBPF register values being overwritten.

This patch emits code to push and pop the remaining caller-saved ARM
registers r2-r3 into the stack during the div/mod function call. ARM
registers r0-r1 are used as arguments and return value, and those were
already saved and restored correctly.

Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler")
Signed-off-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/net/bpf_jit_32.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index ce8b04326352..1214e39aad5e 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -36,6 +36,10 @@
  *                        +-----+
  *                        |RSVD | JIT scratchpad
  * current ARM_SP =>      +-----+ <= (BPF_FP - STACK_SIZE + SCRATCH_SIZE)
+ *                        | ... | caller-saved registers
+ *                        +-----+
+ *                        | ... | arguments passed on stack
+ * ARM_SP during call =>  +-----|
  *                        |     |
  *                        | ... | Function call stack
  *                        |     |
@@ -63,6 +67,12 @@
  *
  * When popping registers off the stack at the end of a BPF function, we
  * reference them via the current ARM_FP register.
+ *
+ * Some eBPF operations are implemented via a call to a helper function.
+ * Such calls are "invisible" in the eBPF code, so it is up to the calling
+ * program to preserve any caller-saved ARM registers during the call. The
+ * JIT emits code to push and pop those registers onto the stack, immediately
+ * above the callee stack frame.
  */
 #define CALLEE_MASK	(1 << ARM_R4 | 1 << ARM_R5 | 1 << ARM_R6 | \
 			 1 << ARM_R7 | 1 << ARM_R8 | 1 << ARM_R9 | \
@@ -70,6 +80,8 @@
 #define CALLEE_PUSH_MASK (CALLEE_MASK | 1 << ARM_LR)
 #define CALLEE_POP_MASK  (CALLEE_MASK | 1 << ARM_PC)
 
+#define CALLER_MASK	(1 << ARM_R0 | 1 << ARM_R1 | 1 << ARM_R2 | 1 << ARM_R3)
+
 enum {
 	/* Stack layout - these are offsets from (top of stack - 4) */
 	BPF_R2_HI,
@@ -464,6 +476,7 @@ static inline int epilogue_offset(const struct jit_ctx *ctx)
 
 static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)
 {
+	const int exclude_mask = BIT(ARM_R0) | BIT(ARM_R1);
 	const s8 *tmp = bpf2a32[TMP_REG_1];
 
 #if __LINUX_ARM_ARCH__ == 7
@@ -495,11 +508,17 @@ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op)
 		emit(ARM_MOV_R(ARM_R0, rm), ctx);
 	}
 
+	/* Push caller-saved registers on stack */
+	emit(ARM_PUSH(CALLER_MASK & ~exclude_mask), ctx);
+
 	/* Call appropriate function */
 	emit_mov_i(ARM_IP, op == BPF_DIV ?
 		   (u32)jit_udiv32 : (u32)jit_mod32, ctx);
 	emit_blx_r(ARM_IP, ctx);
 
+	/* Restore caller-saved registers from stack */
+	emit(ARM_POP(CALLER_MASK & ~exclude_mask), ctx);
+
 	/* Save return value */
 	if (rd != ARM_R0)
 		emit(ARM_MOV_R(rd, ARM_R0), ctx);

From d5f4b27c3cfcf8be787035d61cf254b747257ac7 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Thu, 30 Sep 2021 11:30:03 +0300
Subject: [PATCH 0772/1750] soc: ti: omap-prm: Fix external abort for am335x
 pruss

[ Upstream commit b232537074fcaf0c2837abbb217429c097bb7598 ]

Starting with v5.15-rc1, we may now see some am335x beaglebone black
device produce the following error on pruss probe:

Unhandled fault: external abort on non-linefetch (0x1008) at 0xe0326000

This has started with the enabling of pruss for am335x in the dts files.

Turns out the is caused by the PRM reset handling not waiting for the
reset bit to clear. To fix the issue, let's always wait for the reset
bit to clear, even if there is a separate reset status register.

We attempted to fix a similar issue for dra7 iva with a udelay() in
commit effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset
deassert for dra7 iva"). There is no longer a need for the udelay()
for dra7 iva reset either with the check added for reset bit clearing.

Cc: Drew Fustini <pdp7pdp7@gmail.com>
Cc: Grygorii Strashko <grygorii.strashko@ti.com>
Cc: "H. Nikolaus Schaller" <hns@goldelico.com>
Cc: Robert Nelson <robertcnelson@gmail.com>
Cc: Yongqin Liu <yongqin.liu@linaro.org>
Fixes: effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva")
Reported-by: Matti Vaittinen <mazziesaccount@gmail.com>
Tested-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/ti/omap_prm.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c
index fb067b5e4a97..4a782bfd753c 100644
--- a/drivers/soc/ti/omap_prm.c
+++ b/drivers/soc/ti/omap_prm.c
@@ -509,26 +509,29 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev,
 	writel_relaxed(v, reset->prm->base + reset->prm->data->rstctrl);
 	spin_unlock_irqrestore(&reset->lock, flags);
 
-	if (!has_rstst)
-		goto exit;
-
-	/* wait for the status to be set */
+	/* wait for the reset bit to clear */
 	ret = readl_relaxed_poll_timeout_atomic(reset->prm->base +
-						 reset->prm->data->rstst,
-						 v, v & BIT(st_bit), 1,
-						 OMAP_RESET_MAX_WAIT);
+						reset->prm->data->rstctrl,
+						v, !(v & BIT(id)), 1,
+						OMAP_RESET_MAX_WAIT);
 	if (ret)
 		pr_err("%s: timedout waiting for %s:%lu\n", __func__,
 		       reset->prm->data->name, id);
 
-exit:
-	if (reset->clkdm) {
-		/* At least dra7 iva needs a delay before clkdm idle */
-		if (has_rstst)
-			udelay(1);
-		pdata->clkdm_allow_idle(reset->clkdm);
+	/* wait for the status to be set */
+	if (has_rstst) {
+		ret = readl_relaxed_poll_timeout_atomic(reset->prm->base +
+						 reset->prm->data->rstst,
+						 v, v & BIT(st_bit), 1,
+						 OMAP_RESET_MAX_WAIT);
+		if (ret)
+			pr_err("%s: timedout waiting for %s:%lu\n", __func__,
+			       reset->prm->data->name, id);
 	}
 
+	if (reset->clkdm)
+		pdata->clkdm_allow_idle(reset->clkdm);
+
 	return ret;
 }
 

From 064faa8e8a9b50f5010c5aa5740e06d477677a89 Mon Sep 17 00:00:00 2001
From: Tatsuhiko Yasumatsu <th.yasumatsu@gmail.com>
Date: Thu, 30 Sep 2021 22:55:45 +0900
Subject: [PATCH 0773/1750] bpf: Fix integer overflow in
 prealloc_elems_and_freelist()

[ Upstream commit 30e29a9a2bc6a4888335a6ede968b75cd329657a ]

In prealloc_elems_and_freelist(), the multiplication to calculate the
size passed to bpf_map_area_alloc() could lead to an integer overflow.
As a result, out-of-bounds write could occur in pcpu_freelist_populate()
as reported by KASAN:

[...]
[   16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100
[   16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78
[   16.970038]
[   16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1
[   16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[   16.972026] Call Trace:
[   16.972306]  dump_stack_lvl+0x34/0x44
[   16.972687]  print_address_description.constprop.0+0x21/0x140
[   16.973297]  ? pcpu_freelist_populate+0xd9/0x100
[   16.973777]  ? pcpu_freelist_populate+0xd9/0x100
[   16.974257]  kasan_report.cold+0x7f/0x11b
[   16.974681]  ? pcpu_freelist_populate+0xd9/0x100
[   16.975190]  pcpu_freelist_populate+0xd9/0x100
[   16.975669]  stack_map_alloc+0x209/0x2a0
[   16.976106]  __sys_bpf+0xd83/0x2ce0
[...]

The possibility of this overflow was originally discussed in [0], but
was overlooked.

Fix the integer overflow by changing elem_size to u64 from u32.

  [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/

Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation")
Signed-off-by: Tatsuhiko Yasumatsu <th.yasumatsu@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/stackmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index ebf60848d5eb..4477873ac3a0 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -64,7 +64,8 @@ static inline int stack_map_data_size(struct bpf_map *map)
 
 static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
 {
-	u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
+	u64 elem_size = sizeof(struct stack_map_bucket) +
+			(u64)smap->map.value_size;
 	int err;
 
 	smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries,

From d70cb6c77ad983f37a401fd29017da4546c57093 Mon Sep 17 00:00:00 2001
From: Raed Salem <raeds@nvidia.com>
Date: Thu, 26 Aug 2021 17:07:17 +0300
Subject: [PATCH 0774/1750] net/mlx5e: IPSEC RX, enable checksum complete

[ Upstream commit f9a10440f0b1f33faa792af26f4e9823a9b8b6a4 ]

Currently in Rx data path IPsec crypto offloaded packets uses
csum_none flag, so checksum is handled by the stack, this naturally
have some performance/cpu utilization impact on such flows. As Nvidia
NIC starting from ConnectX6DX provides checksum complete value out of
the box also for such flows there is no sense in taking csum_none path,
furthermore the stack (xfrm) have the method to handle checksum complete
corrections for such flows i.e. IPsec trailer removal and consequently
checksum value adjustment.

Because of the above and in addition the ConnectX6DX is the first HW
which supports IPsec crypto offload then it is safe to report csum
complete for IPsec offloaded traffic.

Fixes: b2ac7541e377 ("net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload")
Signed-off-by: Raed Salem <raeds@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index f327b78261ec..117a59341453 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -999,14 +999,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev,
 		goto csum_unnecessary;
 
 	if (likely(is_last_ethertype_ip(skb, &network_depth, &proto))) {
-		u8 ipproto = get_ip_proto(skb, network_depth, proto);
-
-		if (unlikely(ipproto == IPPROTO_SCTP))
+		if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP))
 			goto csum_unnecessary;
 
-		if (unlikely(mlx5_ipsec_is_rx_flow(cqe)))
-			goto csum_none;
-
 		stats->csum_complete++;
 		skb->ip_summed = CHECKSUM_COMPLETE;
 		skb->csum = csum_unfold((__force __sum16)cqe->check_sum);

From 6e6f79e39830708f05179cc2d18f552e5cd8c43b Mon Sep 17 00:00:00 2001
From: Moshe Shemesh <moshe@nvidia.com>
Date: Thu, 23 Sep 2021 17:57:47 +0300
Subject: [PATCH 0775/1750] net/mlx5: E-Switch, Fix double allocation of acl
 flow counter

[ Upstream commit a586775f83bd729ad60b56352dbe067f4bb0beee ]

Flow counter is allocated in eswitch legacy acl setting functions
without checking if already allocated by previous setting. Add a check
to avoid such double allocation.

Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes")
Fixes: ea651a86d468 ("net/mlx5: E-Switch, Refactor eswitch egress acl codes")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../mellanox/mlx5/core/esw/acl/egress_lgcy.c         | 12 ++++++++----
 .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c        |  4 +++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c
index 3e19b1721303..b00c7d47833f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c
@@ -79,12 +79,16 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw,
 	int dest_num = 0;
 	int err = 0;
 
-	if (MLX5_CAP_ESW_EGRESS_ACL(esw->dev, flow_counter)) {
+	if (vport->egress.legacy.drop_counter) {
+		drop_counter = vport->egress.legacy.drop_counter;
+	} else if (MLX5_CAP_ESW_EGRESS_ACL(esw->dev, flow_counter)) {
 		drop_counter = mlx5_fc_create(esw->dev, false);
-		if (IS_ERR(drop_counter))
+		if (IS_ERR(drop_counter)) {
 			esw_warn(esw->dev,
 				 "vport[%d] configure egress drop rule counter err(%ld)\n",
 				 vport->vport, PTR_ERR(drop_counter));
+			drop_counter = NULL;
+		}
 		vport->egress.legacy.drop_counter = drop_counter;
 	}
 
@@ -123,7 +127,7 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw,
 	flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP;
 
 	/* Attach egress drop flow counter */
-	if (!IS_ERR_OR_NULL(drop_counter)) {
+	if (drop_counter) {
 		flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_COUNT;
 		drop_ctr_dst.type = MLX5_FLOW_DESTINATION_TYPE_COUNTER;
 		drop_ctr_dst.counter_id = mlx5_fc_id(drop_counter);
@@ -162,7 +166,7 @@ void esw_acl_egress_lgcy_cleanup(struct mlx5_eswitch *esw,
 	esw_acl_egress_table_destroy(vport);
 
 clean_drop_counter:
-	if (!IS_ERR_OR_NULL(vport->egress.legacy.drop_counter)) {
+	if (vport->egress.legacy.drop_counter) {
 		mlx5_fc_destroy(esw->dev, vport->egress.legacy.drop_counter);
 		vport->egress.legacy.drop_counter = NULL;
 	}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
index d64fad2823e7..45570d0a58d2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c
@@ -160,7 +160,9 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw,
 
 	esw_acl_ingress_lgcy_rules_destroy(vport);
 
-	if (MLX5_CAP_ESW_INGRESS_ACL(esw->dev, flow_counter)) {
+	if (vport->ingress.legacy.drop_counter) {
+		counter = vport->ingress.legacy.drop_counter;
+	} else if (MLX5_CAP_ESW_INGRESS_ACL(esw->dev, flow_counter)) {
 		counter = mlx5_fc_create(esw->dev, false);
 		if (IS_ERR(counter)) {
 			esw_warn(esw->dev,

From 0d2dd40a7be61b89a7c99dae8ee96389d27b413a Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 30 Sep 2021 20:50:28 +0300
Subject: [PATCH 0776/1750] phy: mdio: fix memory leak

[ Upstream commit ca6e11c337daf7925ff8a2aac8e84490a8691905 ]

Syzbot reported memory leak in MDIO bus interface, the problem was in
wrong state logic.

MDIOBUS_ALLOCATED indicates 2 states:
	1. Bus is only allocated
	2. Bus allocated and __mdiobus_register() fails, but
	   device_register() was called

In case of device_register() has been called we should call put_device()
to correctly free the memory allocated for this device, but mdiobus_free()
calls just kfree(dev) in case of MDIOBUS_ALLOCATED state

To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED
_before_ calling device_register(), because put_device() should be
called even in case of device_register() failure.

Link: https://lore.kernel.org/netdev/YVMRWNDZDUOvQjHL@shell.armlinux.org.uk/
Fixes: 46abc02175b3 ("phylib: give mdio buses a device tree presence")
Reported-and-tested-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/eceae1429fbf8fa5c73dd2a0d39d525aa905074d.1633024062.git.paskripkin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/mdio_bus.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index b848439fa837..2645ca35103c 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -534,6 +534,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 	bus->dev.groups = NULL;
 	dev_set_name(&bus->dev, "%s", bus->id);
 
+	/* We need to set state to MDIOBUS_UNREGISTERED to correctly release
+	 * the device in mdiobus_free()
+	 *
+	 * State will be updated later in this function in case of success
+	 */
+	bus->state = MDIOBUS_UNREGISTERED;
+
 	err = device_register(&bus->dev);
 	if (err) {
 		pr_err("mii_bus %s failed to register\n", bus->id);

From acff2d182c0768a713cee77442caeb07668bd68f Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 30 Sep 2021 14:22:39 -0700
Subject: [PATCH 0777/1750] net_sched: fix NULL deref in fifo_set_limit()

[ Upstream commit 560ee196fe9e5037e5015e2cdb14b3aecb1cd7dc ]

syzbot reported another NULL deref in fifo_set_limit() [1]

I could repro the issue with :

unshare -n
tc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit
tc qd replace dev lo parent 1:0 pfifo_fast
tc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit

pfifo_fast does not have a change() operation.
Make fifo_set_limit() more robust about this.

[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000
RBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910
R13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800
FS:  00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 fifo_set_limit net/sched/sch_fifo.c:242 [inline]
 fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227
 tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418
 qdisc_change net/sched/sch_api.c:1332 [inline]
 tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634
 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2463
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: fb0305ce1b03 ("net-sched: consolidate default fifo qdisc setup")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Link: https://lore.kernel.org/r/20210930212239.3430364-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_fifo.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index a579a4131d22..e1040421b797 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -233,6 +233,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit)
 	if (strncmp(q->ops->id + 1, "fifo", 4) != 0)
 		return 0;
 
+	if (!q->ops->change)
+		return 0;
+
 	nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
 	if (nla) {
 		nla->nla_type = RTM_NEWQDISC;

From 442ea65d0ccb375588ee24027085ba121c9e0653 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Sat, 2 Oct 2021 11:04:09 +0200
Subject: [PATCH 0778/1750] powerpc/fsl/dts: Fix phy-connection-type for
 fm1mac3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit eed183abc0d3b8adb64fd1363b7cea7986cd58d6 ]

Property phy-connection-type contains invalid value "sgmii-2500" per scheme
defined in file ethernet-controller.yaml.

Correct phy-connection-type value should be "2500base-x".

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 84e0f1c13806 ("powerpc/mpc85xx: Add MDIO bus muxing support to the board device tree(s)")
Acked-by: Scott Wood <oss@buserror.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/boot/dts/fsl/t1023rdb.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/boot/dts/fsl/t1023rdb.dts b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
index 5ba6fbfca274..f82f85c65964 100644
--- a/arch/powerpc/boot/dts/fsl/t1023rdb.dts
+++ b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
@@ -154,7 +154,7 @@ fm1mac2: ethernet@e2000 {
 
 			fm1mac3: ethernet@e4000 {
 				phy-handle = <&sgmii_aqr_phy3>;
-				phy-connection-type = "sgmii-2500";
+				phy-connection-type = "2500base-x";
 				sleep = <&rcpm 0x20000000>;
 			};
 

From 95ba03fb4cb12fb72f6c3d28a1d0388ad4ad9290 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Fri, 1 Oct 2021 19:20:33 +0300
Subject: [PATCH 0779/1750] ptp_pch: Load module automatically if ID matches

[ Upstream commit 7cd8b1542a7ba0720c5a0a85ed414a122015228b ]

The driver can't be loaded automatically because it misses
module alias to be provided. Add corresponding MODULE_DEVICE_TABLE()
call to the driver.

Fixes: 863d08ece9bf ("supports eg20t ptp clock")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ptp/ptp_pch.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c
index ce10ecd41ba0..9492ed09518f 100644
--- a/drivers/ptp/ptp_pch.c
+++ b/drivers/ptp/ptp_pch.c
@@ -651,6 +651,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = {
 	 },
 	{0}
 };
+MODULE_DEVICE_TABLE(pci, pch_ieee1588_pcidev_id);
 
 static SIMPLE_DEV_PM_OPS(pch_pm_ops, pch_suspend, pch_resume);
 

From 10afd15972630267b01393ae1e133ee48ba814c7 Mon Sep 17 00:00:00 2001
From: Michael Walle <michael@walle.cc>
Date: Thu, 1 Oct 2020 11:11:30 +0200
Subject: [PATCH 0780/1750] arm64: dts: ls1028a: add missing CAN nodes

[ Upstream commit 04fa4f03e3533f51b4db19cb487435f5862a0514 ]

The LS1028A has two FlexCAN controller. These are compatible with
the ones from the LX2160A. Add the nodes.

The first controller was tested on the Kontron sl28 board.

Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
index 5f42904d53ab..580690057601 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi
@@ -386,6 +386,24 @@ esdhc1: mmc@2150000 {
 			status = "disabled";
 		};
 
+		can0: can@2180000 {
+			compatible = "fsl,ls1028ar1-flexcan", "fsl,lx2160ar1-flexcan";
+			reg = <0x0 0x2180000 0x0 0x10000>;
+			interrupts = <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&sysclk>, <&clockgen 4 1>;
+			clock-names = "ipg", "per";
+			status = "disabled";
+		};
+
+		can1: can@2190000 {
+			compatible = "fsl,ls1028ar1-flexcan", "fsl,lx2160ar1-flexcan";
+			reg = <0x0 0x2190000 0x0 0x10000>;
+			interrupts = <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&sysclk>, <&clockgen 4 1>;
+			clock-names = "ipg", "per";
+			status = "disabled";
+		};
+
 		duart0: serial@21c0500 {
 			compatible = "fsl,ns16550", "ns16550a";
 			reg = <0x00 0x21c0500 0x0 0x100>;

From 2b0035d1058a8535f99e57f55f6045bda08f81c6 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Fri, 24 Sep 2021 14:35:12 +0200
Subject: [PATCH 0781/1750] dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg
 value

[ Upstream commit b2d70c0dbf2731a37d1c7bcc86ab2387954d5f56 ]

make dtbs_check:

    arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dt.yaml: bridge@2c: reg:0:0: 45 was expected

According to the datasheet, the I2C address can be either 0x2c or 0x2d,
depending on the ADDR control input.

Fixes: e3896e6dddf0b821 ("dt-bindings: drm/bridge: Document sn65dsi86 bridge bindings")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Link: https://lore.kernel.org/r/08f73c2aa0d4e580303357dfae107d084d962835.1632486753.git.geert+renesas@glider.be
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../devicetree/bindings/display/bridge/ti,sn65dsi86.yaml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml b/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml
index f8622bd0f61e..f0e0345da498 100644
--- a/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml
+++ b/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml
@@ -18,7 +18,7 @@ properties:
     const: ti,sn65dsi86
 
   reg:
-    const: 0x2d
+    enum: [ 0x2c, 0x2d ]
 
   enable-gpios:
     maxItems: 1

From cb8880680bdfde95aa4836807d81400f0a449117 Mon Sep 17 00:00:00 2001
From: Oleksij Rempel <o.rempel@pengutronix.de>
Date: Tue, 28 Sep 2021 15:49:40 +0200
Subject: [PATCH 0782/1750] ARM: imx6: disable the GIC CPU interface before
 calling stby-poweroff sequence

[ Upstream commit 783f3db030563f7bcdfe2d26428af98ea1699a8e ]

Any pending interrupt can prevent entering standby based power off state.
To avoid it, disable the GIC CPU interface.

Fixes: 8148d2136002 ("ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-imx/pm-imx6.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index 40c74b4c4d73..e24409c1f5d3 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -9,6 +9,7 @@
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/genalloc.h>
+#include <linux/irqchip/arm-gic.h>
 #include <linux/mfd/syscon.h>
 #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
 #include <linux/of.h>
@@ -618,6 +619,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
 
 static void imx6_pm_stby_poweroff(void)
 {
+	gic_cpu_if_down(0);
 	imx6_set_lpm(STOP_POWER_OFF);
 	imx6q_suspend_finish(0);
 

From c480d15190eba5a552aa66570dceeaba4863048b Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 4 Oct 2021 18:05:07 -0700
Subject: [PATCH 0783/1750] net: bridge: use nla_total_size_64bit() in
 br_get_linkxstats_size()

[ Upstream commit dbe0b88064494b7bb6a9b2aa7e085b14a3112d44 ]

bridge_fill_linkxstats() is using nla_reserve_64bit().

We must use nla_total_size_64bit() instead of nla_total_size()
for corresponding data structure.

Fixes: 1080ab95e3c7 ("net: bridge: add support for IGMP/MLD stats and export them via netlink")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Nikolay Aleksandrov <nikolay@nvidia.com>
Cc: Vivien Didelot <vivien.didelot@gmail.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/br_netlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 73f71c22f4c0..bfe6ab1914c8 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1590,7 +1590,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr)
 	}
 
 	return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) +
-	       nla_total_size(sizeof(struct br_mcast_stats)) +
+	       nla_total_size_64bit(sizeof(struct br_mcast_stats)) +
 	       nla_total_size(0);
 }
 

From 60955b65bd6a7dca624dd36c9a77b3326a6851a6 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 4 Oct 2021 18:05:08 -0700
Subject: [PATCH 0784/1750] net: bridge: fix under estimation in
 br_get_linkxstats_size()

[ Upstream commit 0854a0513321cf70bea5fa483ebcaa983cc7c62e ]

Commit de1799667b00 ("net: bridge: add STP xstats")
added an additional nla_reserve_64bit() in br_fill_linkxstats(),
but forgot to update br_get_linkxstats_size() accordingly.

This can trigger the following in rtnl_stats_get()

	WARN_ON(err == -EMSGSIZE);

Fixes: de1799667b00 ("net: bridge: add STP xstats")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Vivien Didelot <vivien.didelot@gmail.com>
Cc: Nikolay Aleksandrov <nikolay@nvidia.com>
Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bridge/br_netlink.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index bfe6ab1914c8..31b00ba5dcc8 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -1591,6 +1591,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr)
 
 	return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) +
 	       nla_total_size_64bit(sizeof(struct br_mcast_stats)) +
+	       (p ? nla_total_size_64bit(sizeof(p->stp_xstats)) : 0) +
 	       nla_total_size(0);
 }
 

From 3ec73ffeef54596c32aff0e73fe60971b9c8b866 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 4 Oct 2021 12:55:22 -0700
Subject: [PATCH 0785/1750] net/sched: sch_taprio: properly cancel timer from
 taprio_destroy()

[ Upstream commit a56d447f196fa9973c568f54c0d76d5391c3b0c0 ]

There is a comment in qdisc_create() about us not calling ops->reset()
in some cases.

err_out4:
	/*
	 * Any broken qdiscs that would require a ops->reset() here?
	 * The qdisc was never in action so it shouldn't be necessary.
	 */

As taprio sets a timer before actually receiving a packet, we need
to cancel it from ops->destroy, just in case ops->reset has not
been called.

syzbot reported:

ODEBUG: free active (active state 0) object type: hrtimer hint: advance_sched+0x0/0x9a0 arch/x86/include/asm/atomic64_64.h:22
WARNING: CPU: 0 PID: 8441 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505
Modules linked in:
CPU: 0 PID: 8441 Comm: syz-executor813 Not tainted 5.14.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 d3 e3 89 4c 89 ee 48 c7 c7 e0 c7 e3 89 e8 5b 86 11 05 <0f> 0b 83 05 85 03 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3
RSP: 0018:ffffc9000130f330 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffff88802baeb880 RSI: ffffffff815d87b5 RDI: fffff52000261e58
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815d25ee R11: 0000000000000000 R12: ffffffff898dd020
R13: ffffffff89e3ce20 R14: ffffffff81653630 R15: dffffc0000000000
FS:  0000000000f0d300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffb64b3e000 CR3: 0000000036557000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __debug_check_no_obj_freed lib/debugobjects.c:987 [inline]
 debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1018
 slab_free_hook mm/slub.c:1603 [inline]
 slab_free_freelist_hook+0x171/0x240 mm/slub.c:1653
 slab_free mm/slub.c:3213 [inline]
 kfree+0xe4/0x540 mm/slub.c:4267
 qdisc_create+0xbcf/0x1320 net/sched/sch_api.c:1299
 tc_modify_qdisc+0x4c8/0x1a60 net/sched/sch_api.c:1663
 rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:724
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2403
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2457
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80

Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Davide Caratti <dcaratti@redhat.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Acked-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_taprio.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index cb5e5220da55..93899559ba6d 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -1630,6 +1630,10 @@ static void taprio_destroy(struct Qdisc *sch)
 	list_del(&q->taprio_list);
 	spin_unlock(&taprio_list_lock);
 
+	/* Note that taprio_reset() might not be called if an error
+	 * happens in qdisc_create(), after taprio_init() has been called.
+	 */
+	hrtimer_cancel(&q->advance_timer);
 
 	taprio_disable_offload(dev, q, NULL);
 

From 144715fbab1be6a2fbb0062ae2a33da6eeee7935 Mon Sep 17 00:00:00 2001
From: Sean Anderson <sean.anderson@seco.com>
Date: Mon, 4 Oct 2021 17:50:02 -0400
Subject: [PATCH 0786/1750] net: sfp: Fix typo in state machine debug string

[ Upstream commit 25a9da6641f1f66006e93ddbefee13a437efa8c0 ]

The string should be "tx_disable" to match the state enum.

Fixes: 4005a7cb4f55 ("net: phy: sftp: print debug message with text, not numbers")
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/sfp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 2fff62695455..32c34c728c7a 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -133,7 +133,7 @@ static const char * const sm_state_strings[] = {
 	[SFP_S_LINK_UP] = "link_up",
 	[SFP_S_TX_FAULT] = "tx_fault",
 	[SFP_S_REINIT] = "reinit",
-	[SFP_S_TX_DISABLE] = "rx_disable",
+	[SFP_S_TX_DISABLE] = "tx_disable",
 };
 
 static const char *sm_state_to_str(unsigned short sm_state)

From 628b31d96711ebacca39a961ee676861ec2d63d0 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 4 Oct 2021 14:24:15 -0700
Subject: [PATCH 0787/1750] netlink: annotate data races around nlk->bound

[ Upstream commit 7707a4d01a648e4c655101a469c956cb11273655 ]

While existing code is correct, KCSAN is reporting
a data-race in netlink_insert / netlink_sendmsg [1]

It is correct to read nlk->bound without a lock, as netlink_autobind()
will acquire all needed locks.

[1]
BUG: KCSAN: data-race in netlink_insert / netlink_sendmsg

write to 0xffff8881031c8b30 of 1 bytes by task 18752 on cpu 0:
 netlink_insert+0x5cc/0x7f0 net/netlink/af_netlink.c:597
 netlink_autobind+0xa9/0x150 net/netlink/af_netlink.c:842
 netlink_sendmsg+0x479/0x7c0 net/netlink/af_netlink.c:1892
 sock_sendmsg_nosec net/socket.c:703 [inline]
 sock_sendmsg net/socket.c:723 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392
 ___sys_sendmsg net/socket.c:2446 [inline]
 __sys_sendmsg+0x1ed/0x270 net/socket.c:2475
 __do_sys_sendmsg net/socket.c:2484 [inline]
 __se_sys_sendmsg net/socket.c:2482 [inline]
 __x64_sys_sendmsg+0x42/0x50 net/socket.c:2482
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff8881031c8b30 of 1 bytes by task 18751 on cpu 1:
 netlink_sendmsg+0x270/0x7c0 net/netlink/af_netlink.c:1891
 sock_sendmsg_nosec net/socket.c:703 [inline]
 sock_sendmsg net/socket.c:723 [inline]
 __sys_sendto+0x2a8/0x370 net/socket.c:2019
 __do_sys_sendto net/socket.c:2031 [inline]
 __se_sys_sendto net/socket.c:2027 [inline]
 __x64_sys_sendto+0x74/0x90 net/socket.c:2027
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 18751 Comm: syz-executor.0 Not tainted 5.14.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Fixes: da314c9923fe ("netlink: Replace rhash_portid with bound")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netlink/af_netlink.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8434da3c0487..0886267ea81e 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -586,7 +586,10 @@ static int netlink_insert(struct sock *sk, u32 portid)
 
 	/* We need to ensure that the socket is hashed and visible. */
 	smp_wmb();
-	nlk_sk(sk)->bound = portid;
+	/* Paired with lockless reads from netlink_bind(),
+	 * netlink_connect() and netlink_sendmsg().
+	 */
+	WRITE_ONCE(nlk_sk(sk)->bound, portid);
 
 err:
 	release_sock(sk);
@@ -1004,7 +1007,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
 	if (nlk->ngroups < BITS_PER_LONG)
 		groups &= (1UL << nlk->ngroups) - 1;
 
-	bound = nlk->bound;
+	/* Paired with WRITE_ONCE() in netlink_insert() */
+	bound = READ_ONCE(nlk->bound);
 	if (bound) {
 		/* Ensure nlk->portid is up-to-date. */
 		smp_rmb();
@@ -1090,8 +1094,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
 
 	/* No need for barriers here as we return to user-space without
 	 * using any of the bound attributes.
+	 * Paired with WRITE_ONCE() in netlink_insert().
 	 */
-	if (!nlk->bound)
+	if (!READ_ONCE(nlk->bound))
 		err = netlink_autobind(sock);
 
 	if (err == 0) {
@@ -1880,7 +1885,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
 		dst_group = nlk->dst_group;
 	}
 
-	if (!nlk->bound) {
+	/* Paired with WRITE_ONCE() in netlink_insert() */
+	if (!READ_ONCE(nlk->bound)) {
 		err = netlink_autobind(sock);
 		if (err)
 			goto out;

From 40a84fcae2bf3003cc4f84ea8d6040838031f7ff Mon Sep 17 00:00:00 2001
From: John Garry <john.garry@huawei.com>
Date: Thu, 22 Oct 2020 19:02:26 +0800
Subject: [PATCH 0788/1750] perf jevents: Tidy error handling

[ Upstream commit fa1b41a74d1136cbdd6960f36d7b9c7aa35c8139 ]

There is much duplication in the error handling for directory transvering
for prcessing JSONs.

Factor out the common code to tidy a bit.

Signed-off-by: John Garry <john.garry@huawei.com>
Reviewed-By: Kajol Jain<kjain@linux.ibm.com>
Link: https://lore.kernel.org/r/1603364547-197086-2-git-send-email-john.garry@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/pmu-events/jevents.c | 87 ++++++++++++++-------------------
 1 file changed, 37 insertions(+), 50 deletions(-)

diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
index dcfdf6a322dc..c679a79aef51 100644
--- a/tools/perf/pmu-events/jevents.c
+++ b/tools/perf/pmu-events/jevents.c
@@ -1100,12 +1100,13 @@ static int process_one_file(const char *fpath, const struct stat *sb,
  */
 int main(int argc, char *argv[])
 {
-	int rc, ret = 0;
+	int rc, ret = 0, empty_map = 0;
 	int maxfds;
 	char ldirname[PATH_MAX];
 	const char *arch;
 	const char *output_file;
 	const char *start_dirname;
+	char *err_string_ext = "";
 	struct stat stbuf;
 
 	prog = basename(argv[0]);
@@ -1133,7 +1134,8 @@ int main(int argc, char *argv[])
 	/* If architecture does not have any event lists, bail out */
 	if (stat(ldirname, &stbuf) < 0) {
 		pr_info("%s: Arch %s has no PMU event lists\n", prog, arch);
-		goto empty_map;
+		empty_map = 1;
+		goto err_close_eventsfp;
 	}
 
 	/* Include pmu-events.h first */
@@ -1150,75 +1152,60 @@ int main(int argc, char *argv[])
 	 */
 
 	maxfds = get_maxfds();
-	mapfile = NULL;
 	rc = nftw(ldirname, preprocess_arch_std_files, maxfds, 0);
-	if (rc && verbose) {
-		pr_info("%s: Error preprocessing arch standard files %s\n",
-			prog, ldirname);
-		goto empty_map;
-	} else if (rc < 0) {
-		/* Make build fail */
-		fclose(eventsfp);
-		free_arch_std_events();
-		return 1;
-	} else if (rc) {
-		goto empty_map;
-	}
+	if (rc)
+		goto err_processing_std_arch_event_dir;
 
 	rc = nftw(ldirname, process_one_file, maxfds, 0);
-	if (rc && verbose) {
-		pr_info("%s: Error walking file tree %s\n", prog, ldirname);
-		goto empty_map;
-	} else if (rc < 0) {
-		/* Make build fail */
-		fclose(eventsfp);
-		free_arch_std_events();
-		ret = 1;
-		goto out_free_mapfile;
-	} else if (rc) {
-		goto empty_map;
-	}
+	if (rc)
+		goto err_processing_dir;
 
 	sprintf(ldirname, "%s/test", start_dirname);
 
 	rc = nftw(ldirname, process_one_file, maxfds, 0);
-	if (rc && verbose) {
-		pr_info("%s: Error walking file tree %s rc=%d for test\n",
-			prog, ldirname, rc);
-		goto empty_map;
-	} else if (rc < 0) {
-		/* Make build fail */
-		free_arch_std_events();
-		ret = 1;
-		goto out_free_mapfile;
-	} else if (rc) {
-		goto empty_map;
-	}
+	if (rc)
+		goto err_processing_dir;
 
 	if (close_table)
 		print_events_table_suffix(eventsfp);
 
 	if (!mapfile) {
 		pr_info("%s: No CPU->JSON mapping?\n", prog);
-		goto empty_map;
+		empty_map = 1;
+		goto err_close_eventsfp;
 	}
 
-	if (process_mapfile(eventsfp, mapfile)) {
+	rc = process_mapfile(eventsfp, mapfile);
+	fclose(eventsfp);
+	if (rc) {
 		pr_info("%s: Error processing mapfile %s\n", prog, mapfile);
 		/* Make build fail */
-		fclose(eventsfp);
-		free_arch_std_events();
 		ret = 1;
+		goto err_out;
 	}
 
-
-	goto out_free_mapfile;
-
-empty_map:
-	fclose(eventsfp);
-	create_empty_mapping(output_file);
 	free_arch_std_events();
-out_free_mapfile:
+	free(mapfile);
+	return 0;
+
+err_processing_std_arch_event_dir:
+	err_string_ext = " for std arch event";
+err_processing_dir:
+	if (verbose) {
+		pr_info("%s: Error walking file tree %s%s\n", prog, ldirname,
+			err_string_ext);
+		empty_map = 1;
+	} else if (rc < 0) {
+		ret = 1;
+	} else {
+		empty_map = 1;
+	}
+err_close_eventsfp:
+	fclose(eventsfp);
+	if (empty_map)
+		create_empty_mapping(output_file);
+err_out:
+	free_arch_std_events();
 	free(mapfile);
 	return ret;
 }

From 18d2568cc7ffb05537a503bd2852d414e51b4fe9 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Wed, 8 Sep 2021 08:49:36 +0300
Subject: [PATCH 0789/1750] bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for
 errata i893

[ Upstream commit b13a270ace2e4c70653aa1d1d0394c553905802f ]

Commit 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for
CLKDM_NOAUTO") should have also added the quirk for dra7 dcan1 in
addition to dcan2 for errata i893 handling.

Let's also pass the quirk flag for legacy mode booting for if "ti,hwmods"
dts property is used with related dcan hwmod data. This should be only
needed if anybody needs to git bisect earlier stable trees though.

Fixes: 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-omap2/omap_hwmod.c | 2 ++
 drivers/bus/ti-sysc.c            | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 83d595ebcf1f..9443f129859b 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -3618,6 +3618,8 @@ int omap_hwmod_init_module(struct device *dev,
 		oh->flags |= HWMOD_SWSUP_SIDLE_ACT;
 	if (data->cfg->quirks & SYSC_QUIRK_SWSUP_MSTANDBY)
 		oh->flags |= HWMOD_SWSUP_MSTANDBY;
+	if (data->cfg->quirks & SYSC_QUIRK_CLKDM_NOAUTO)
+		oh->flags |= HWMOD_CLKDM_NOAUTO;
 
 	error = omap_hwmod_check_module(dev, oh, data, sysc_fields,
 					rev_offs, sysc_offs, syss_offs,
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index d2b7338c073f..02341fd66e8d 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -1464,6 +1464,9 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
 	/* Quirks that need to be set based on detected module */
 	SYSC_QUIRK("aess", 0, 0, 0x10, -ENODEV, 0x40000000, 0xffffffff,
 		   SYSC_MODULE_QUIRK_AESS),
+	/* Errata i893 handling for dra7 dcan1 and 2 */
+	SYSC_QUIRK("dcan", 0x4ae3c000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff,
+		   SYSC_QUIRK_CLKDM_NOAUTO),
 	SYSC_QUIRK("dcan", 0x48480000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff,
 		   SYSC_QUIRK_CLKDM_NOAUTO),
 	SYSC_QUIRK("dss", 0x4832a000, 0, 0x10, 0x14, 0x00000020, 0xffffffff,

From d2ccbaaa6615332e4c28c6f99f54876414de1d1f Mon Sep 17 00:00:00 2001
From: Jernej Skrabec <jernej.skrabec@gmail.com>
Date: Wed, 15 Sep 2021 19:58:36 +0200
Subject: [PATCH 0790/1750] drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup

[ Upstream commit c64c8e04a12ed3e2238761e26cda78e72550dc98 ]

Recent rework, which made HDMI PHY driver a platform device, inadvertely
reversed clock setup order. HW is very touchy about it. Proper way is to
handle controllers resets and clocks first and HDMI PHYs second.

Currently, without this fix, first mode set completely fails (nothing on
HDMI monitor) on H3 era PHYs. On H6, it still somehow work.

Move HDMI PHY reset & clocks handling to sun8i_hdmi_phy_init() which
will assure that code is executed after controllers reset & clocks are
handled. Additionally, add sun8i_hdmi_phy_deinit() which will deinit
them at controllers driver unload.

Tested on A64, H3, H6 and R40.

Fixes: 9bf3797796f5 ("drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device")
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20210915175836.3158839-1-jernej.skrabec@gmail.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c  |  7 +-
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h  |  4 +-
 drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 97 ++++++++++++++------------
 3 files changed, 61 insertions(+), 47 deletions(-)

diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
index f75fb157f2ff..016b877051da 100644
--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
@@ -216,11 +216,13 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master,
 		goto err_disable_clk_tmds;
 	}
 
+	ret = sun8i_hdmi_phy_init(hdmi->phy);
+	if (ret)
+		goto err_disable_clk_tmds;
+
 	drm_encoder_helper_add(encoder, &sun8i_dw_hdmi_encoder_helper_funcs);
 	drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS);
 
-	sun8i_hdmi_phy_init(hdmi->phy);
-
 	plat_data->mode_valid = hdmi->quirks->mode_valid;
 	plat_data->use_drm_infoframe = hdmi->quirks->use_drm_infoframe;
 	sun8i_hdmi_phy_set_ops(hdmi->phy, plat_data);
@@ -262,6 +264,7 @@ static void sun8i_dw_hdmi_unbind(struct device *dev, struct device *master,
 	struct sun8i_dw_hdmi *hdmi = dev_get_drvdata(dev);
 
 	dw_hdmi_unbind(hdmi->hdmi);
+	sun8i_hdmi_phy_deinit(hdmi->phy);
 	clk_disable_unprepare(hdmi->clk_tmds);
 	reset_control_assert(hdmi->rst_ctrl);
 	gpiod_set_value(hdmi->ddc_en, 0);
diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
index 74f6ed0e2570..bffe1b9cd3dc 100644
--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
+++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h
@@ -169,6 +169,7 @@ struct sun8i_hdmi_phy {
 	struct clk			*clk_phy;
 	struct clk			*clk_pll0;
 	struct clk			*clk_pll1;
+	struct device			*dev;
 	unsigned int			rcal;
 	struct regmap			*regs;
 	struct reset_control		*rst_phy;
@@ -205,7 +206,8 @@ encoder_to_sun8i_dw_hdmi(struct drm_encoder *encoder)
 
 int sun8i_hdmi_phy_get(struct sun8i_dw_hdmi *hdmi, struct device_node *node);
 
-void sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy);
+int sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy);
+void sun8i_hdmi_phy_deinit(struct sun8i_hdmi_phy *phy);
 void sun8i_hdmi_phy_set_ops(struct sun8i_hdmi_phy *phy,
 			    struct dw_hdmi_plat_data *plat_data);
 
diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
index c9239708d398..b64d93da651d 100644
--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
+++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c
@@ -506,9 +506,60 @@ static void sun8i_hdmi_phy_init_h3(struct sun8i_hdmi_phy *phy)
 	phy->rcal = (val & SUN8I_HDMI_PHY_ANA_STS_RCAL_MASK) >> 2;
 }
 
-void sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy)
+int sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy)
 {
+	int ret;
+
+	ret = reset_control_deassert(phy->rst_phy);
+	if (ret) {
+		dev_err(phy->dev, "Cannot deassert phy reset control: %d\n", ret);
+		return ret;
+	}
+
+	ret = clk_prepare_enable(phy->clk_bus);
+	if (ret) {
+		dev_err(phy->dev, "Cannot enable bus clock: %d\n", ret);
+		goto err_assert_rst_phy;
+	}
+
+	ret = clk_prepare_enable(phy->clk_mod);
+	if (ret) {
+		dev_err(phy->dev, "Cannot enable mod clock: %d\n", ret);
+		goto err_disable_clk_bus;
+	}
+
+	if (phy->variant->has_phy_clk) {
+		ret = sun8i_phy_clk_create(phy, phy->dev,
+					   phy->variant->has_second_pll);
+		if (ret) {
+			dev_err(phy->dev, "Couldn't create the PHY clock\n");
+			goto err_disable_clk_mod;
+		}
+
+		clk_prepare_enable(phy->clk_phy);
+	}
+
 	phy->variant->phy_init(phy);
+
+	return 0;
+
+err_disable_clk_mod:
+	clk_disable_unprepare(phy->clk_mod);
+err_disable_clk_bus:
+	clk_disable_unprepare(phy->clk_bus);
+err_assert_rst_phy:
+	reset_control_assert(phy->rst_phy);
+
+	return ret;
+}
+
+void sun8i_hdmi_phy_deinit(struct sun8i_hdmi_phy *phy)
+{
+	clk_disable_unprepare(phy->clk_mod);
+	clk_disable_unprepare(phy->clk_bus);
+	clk_disable_unprepare(phy->clk_phy);
+
+	reset_control_assert(phy->rst_phy);
 }
 
 void sun8i_hdmi_phy_set_ops(struct sun8i_hdmi_phy *phy,
@@ -638,6 +689,7 @@ static int sun8i_hdmi_phy_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	phy->variant = (struct sun8i_hdmi_phy_variant *)match->data;
+	phy->dev = dev;
 
 	ret = of_address_to_resource(node, 0, &res);
 	if (ret) {
@@ -696,47 +748,10 @@ static int sun8i_hdmi_phy_probe(struct platform_device *pdev)
 		goto err_put_clk_pll1;
 	}
 
-	ret = reset_control_deassert(phy->rst_phy);
-	if (ret) {
-		dev_err(dev, "Cannot deassert phy reset control: %d\n", ret);
-		goto err_put_rst_phy;
-	}
-
-	ret = clk_prepare_enable(phy->clk_bus);
-	if (ret) {
-		dev_err(dev, "Cannot enable bus clock: %d\n", ret);
-		goto err_deassert_rst_phy;
-	}
-
-	ret = clk_prepare_enable(phy->clk_mod);
-	if (ret) {
-		dev_err(dev, "Cannot enable mod clock: %d\n", ret);
-		goto err_disable_clk_bus;
-	}
-
-	if (phy->variant->has_phy_clk) {
-		ret = sun8i_phy_clk_create(phy, dev,
-					   phy->variant->has_second_pll);
-		if (ret) {
-			dev_err(dev, "Couldn't create the PHY clock\n");
-			goto err_disable_clk_mod;
-		}
-
-		clk_prepare_enable(phy->clk_phy);
-	}
-
 	platform_set_drvdata(pdev, phy);
 
 	return 0;
 
-err_disable_clk_mod:
-	clk_disable_unprepare(phy->clk_mod);
-err_disable_clk_bus:
-	clk_disable_unprepare(phy->clk_bus);
-err_deassert_rst_phy:
-	reset_control_assert(phy->rst_phy);
-err_put_rst_phy:
-	reset_control_put(phy->rst_phy);
 err_put_clk_pll1:
 	clk_put(phy->clk_pll1);
 err_put_clk_pll0:
@@ -753,12 +768,6 @@ static int sun8i_hdmi_phy_remove(struct platform_device *pdev)
 {
 	struct sun8i_hdmi_phy *phy = platform_get_drvdata(pdev);
 
-	clk_disable_unprepare(phy->clk_mod);
-	clk_disable_unprepare(phy->clk_bus);
-	clk_disable_unprepare(phy->clk_phy);
-
-	reset_control_assert(phy->rst_phy);
-
 	reset_control_put(phy->rst_phy);
 
 	clk_put(phy->clk_pll0);

From 008224cdc12628d21a3eb92259fa3aa3ea5b22a1 Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Tue, 21 Sep 2021 22:21:02 +0100
Subject: [PATCH 0791/1750] video: fbdev: gbefb: Only instantiate device when
 built for IP32

[ Upstream commit 11b8e2bb986d23157e82e267fb8cc6b281dfdee9 ]

The gbefb driver not only registers a driver but also the device for that
driver. This is all well and good when run on the IP32 machines that are
supported by the driver but since the driver supports building with
COMPILE_TEST we might also be building on other platforms which do not have
this hardware and will crash instantiating the driver. Add an IS_ENABLED()
check so we compile out the device registration if we don't have the Kconfig
option for the machine enabled.

Fixes: 552ccf6b259d290c0c ("video: fbdev: gbefb: add COMPILE_TEST support")
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210921212102.30803-1-broonie@kernel.org
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/gbefb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/gbefb.c b/drivers/video/fbdev/gbefb.c
index 31270a8986e8..8f8ca1f88fe2 100644
--- a/drivers/video/fbdev/gbefb.c
+++ b/drivers/video/fbdev/gbefb.c
@@ -1269,7 +1269,7 @@ static struct platform_device *gbefb_device;
 static int __init gbefb_init(void)
 {
 	int ret = platform_driver_register(&gbefb_driver);
-	if (!ret) {
+	if (IS_ENABLED(CONFIG_SGI_IP32) && !ret) {
 		gbefb_device = platform_device_alloc("gbefb", 0);
 		if (gbefb_device) {
 			ret = platform_device_add(gbefb_device);

From f86e19d918a85492ad1a01fcdc0ad5ecbdac6f96 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jcline@redhat.com>
Date: Wed, 2 Dec 2020 19:02:20 -0500
Subject: [PATCH 0792/1750] drm/nouveau: avoid a use-after-free when BO init
 fails

[ Upstream commit bcf34aa5082ee2343574bc3f4d1c126030913e54 ]

nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code
back to the caller. On failures, ttm_bo_init() invokes the provided
destructor which should de-initialize and free the memory.

Thus, when nouveau_bo_init() returns an error the gem object has already
been released and the memory freed by nouveau_bo_del_ttm().

Fixes: 019cbd4a4feb ("drm/nouveau: Initialize GEM object before TTM object")
Cc: Thierry Reding <treding@nvidia.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201203000220.18238-1-jcline@redhat.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index c2051380d18c..6504ebec1190 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -196,10 +196,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain,
 	}
 
 	ret = nouveau_bo_init(nvbo, size, align, domain, NULL, NULL);
-	if (ret) {
-		nouveau_bo_ref(NULL, &nvbo);
+	if (ret)
 		return ret;
-	}
 
 	/* we restrict allowed domains on nv50+ to only the types
 	 * that were requested at creation time.  not possibly on

From 65fff0a8efcdca8d84ffe3e23057c3b32403482d Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Sat, 11 Sep 2021 15:50:22 +0800
Subject: [PATCH 0793/1750] drm/nouveau/kms/nv50-: fix file release memory leak

[ Upstream commit 0b3d4945cc7e7ea1acd52cb06dfa83bfe265b6d5 ]

When using single_open() for opening, single_release() should be
called, otherwise the 'op' allocated in single_open() will be leaked.

Fixes: 12885ecbfe62 ("drm/nouveau/kms/nvd9-: Add CRC support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-1-yangyingliang@huawei.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/dispnv50/crc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/nouveau/dispnv50/crc.c b/drivers/gpu/drm/nouveau/dispnv50/crc.c
index b8c31b697797..66f32d965c72 100644
--- a/drivers/gpu/drm/nouveau/dispnv50/crc.c
+++ b/drivers/gpu/drm/nouveau/dispnv50/crc.c
@@ -704,6 +704,7 @@ static const struct file_operations nv50_crc_flip_threshold_fops = {
 	.open = nv50_crc_debugfs_flip_threshold_open,
 	.read = seq_read,
 	.write = nv50_crc_debugfs_flip_threshold_set,
+	.release = single_release,
 };
 
 int nv50_head_crc_late_register(struct nv50_head *head)

From f69556a42043b5444ca712ee889829ba89fdcba8 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Sat, 11 Sep 2021 15:50:23 +0800
Subject: [PATCH 0794/1750] drm/nouveau/debugfs: fix file release memory leak

[ Upstream commit f5a8703a9c418c6fc54eb772712dfe7641e3991c ]

When using single_open() for opening, single_release() should be
called, otherwise the 'op' allocated in single_open() will be leaked.

Fixes: 6e9fc177399f ("drm/nouveau/debugfs: add copy of sysfs pstate interface ported to debugfs")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-2-yangyingliang@huawei.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
index c2bc05eb2e54..1cbe01048b93 100644
--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
+++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
@@ -207,6 +207,7 @@ static const struct file_operations nouveau_pstate_fops = {
 	.open = nouveau_debugfs_pstate_open,
 	.read = seq_read,
 	.write = nouveau_debugfs_pstate_set,
+	.release = single_release,
 };
 
 static struct drm_info_list nouveau_debugfs_list[] = {

From 5d903a694b087f2aec9f18b0e0dedeeebd66f7af Mon Sep 17 00:00:00 2001
From: Catherine Sullivan <csully@google.com>
Date: Tue, 5 Oct 2021 19:42:19 -0700
Subject: [PATCH 0795/1750] gve: Correct available tx qpl check

[ Upstream commit d03477ee10f4bc35d3573cf1823814378ef2dca2 ]

The qpl_map_size is rounded up to a multiple of sizeof(long), but the
number of qpls doesn't have to be.

Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support")
Signed-off-by: Catherine Sullivan <csully@google.com>
Signed-off-by: Jeroen de Borst <jeroendb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h
index f5c80229ea96..cfb174624d4e 100644
--- a/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -472,7 +472,7 @@ struct gve_queue_page_list *gve_assign_rx_qpl(struct gve_priv *priv)
 				    gve_num_tx_qpls(priv));
 
 	/* we are out of rx qpls */
-	if (id == priv->qpl_cfg.qpl_map_size)
+	if (id == gve_num_tx_qpls(priv) + gve_num_rx_qpls(priv))
 		return NULL;
 
 	set_bit(id, priv->qpl_cfg.qpl_id_map);

From 72c2a68f1d833d2793ee63c626c376a054e2dfe4 Mon Sep 17 00:00:00 2001
From: Tao Liu <xliutaox@google.com>
Date: Tue, 5 Oct 2021 19:42:20 -0700
Subject: [PATCH 0796/1750] gve: Avoid freeing NULL pointer

[ Upstream commit 922aa9bcac92b3ab6a423526a8e785b35a60b441 ]

Prevent possible crashes when cleaning up after unsuccessful
initializations.

Fixes: 893ce44df5658 ("gve: Add basic driver framework for Compute Engine Virtual NIC")
Signed-off-by: Tao Liu <xliutaox@google.com>
Signed-off-by: Catherine Sully <csully@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_main.c | 27 ++++++++++++++--------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index 0b714b606ba1..22b2c6a8d08f 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -71,6 +71,9 @@ static int gve_alloc_counter_array(struct gve_priv *priv)
 
 static void gve_free_counter_array(struct gve_priv *priv)
 {
+	if (!priv->counter_array)
+		return;
+
 	dma_free_coherent(&priv->pdev->dev,
 			  priv->num_event_counters *
 			  sizeof(*priv->counter_array),
@@ -131,6 +134,9 @@ static int gve_alloc_stats_report(struct gve_priv *priv)
 
 static void gve_free_stats_report(struct gve_priv *priv)
 {
+	if (!priv->stats_report)
+		return;
+
 	del_timer_sync(&priv->stats_report_timer);
 	dma_free_coherent(&priv->pdev->dev, priv->stats_report_len,
 			  priv->stats_report, priv->stats_report_bus);
@@ -301,18 +307,19 @@ static void gve_free_notify_blocks(struct gve_priv *priv)
 {
 	int i;
 
-	if (priv->msix_vectors) {
-		/* Free the irqs */
-		for (i = 0; i < priv->num_ntfy_blks; i++) {
-			struct gve_notify_block *block = &priv->ntfy_blocks[i];
-			int msix_idx = i;
+	if (!priv->msix_vectors)
+		return;
 
-			irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector,
-					      NULL);
-			free_irq(priv->msix_vectors[msix_idx].vector, block);
-		}
-		free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);
+	/* Free the irqs */
+	for (i = 0; i < priv->num_ntfy_blks; i++) {
+		struct gve_notify_block *block = &priv->ntfy_blocks[i];
+		int msix_idx = i;
+
+		irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector,
+				      NULL);
+		free_irq(priv->msix_vectors[msix_idx].vector, block);
 	}
+	free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);
 	dma_free_coherent(&priv->pdev->dev,
 			  priv->num_ntfy_blks * sizeof(*priv->ntfy_blocks),
 			  priv->ntfy_blocks, priv->ntfy_block_bus);

From 9a043022522e7966f87c39fd6248cbf8fc617046 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 5 Oct 2021 14:04:17 -0700
Subject: [PATCH 0797/1750] rtnetlink: fix if_nlmsg_stats_size() under
 estimation

[ Upstream commit d34367991933d28bd7331f67a759be9a8c474014 ]

rtnl_fill_statsinfo() is filling skb with one mandatory if_stats_msg structure.

nlmsg_put(skb, pid, seq, type, sizeof(struct if_stats_msg), flags);

But if_nlmsg_stats_size() never considered the needed storage.

This bug did not show up because alloc_skb(X) allocates skb with
extra tailroom, because of added alignments. This could very well
be changed in the future to have deterministic behavior.

Fixes: 10c9ead9f3c6 ("rtnetlink: add new RTM_GETSTATS message to dump link stats")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Acked-by: Roopa Prabhu <roopa@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/rtnetlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 7266571d5c7e..27ffa83ffeb3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -5257,7 +5257,7 @@ static int rtnl_fill_statsinfo(struct sk_buff *skb, struct net_device *dev,
 static size_t if_nlmsg_stats_size(const struct net_device *dev,
 				  u32 filter_mask)
 {
-	size_t size = 0;
+	size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg));
 
 	if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0))
 		size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64));

From 35f6ddd934e6a2c9eb52a8bdf8fae72529c9a282 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 5 Oct 2021 17:30:30 -0700
Subject: [PATCH 0798/1750] gve: fix gve_get_stats()

[ Upstream commit 2f57d4975fa027eabd35fdf23a49f8222ef3abf2 ]

gve_get_stats() can report wrong numbers if/when u64_stats_fetch_retry()
returns true.

What is needed here is to sample values in temporary variables,
and only use them after each loop is ended.

Fixes: f5cedc84a30d ("gve: Add transmit and receive support")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Catherine Sullivan <csully@google.com>
Cc: Sagi Shahar <sagis@google.com>
Cc: Jon Olson <jonolson@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Cc: Luigi Rizzo <lrizzo@google.com>
Cc: Jeroen de Borst <jeroendb@google.com>
Cc: Tao Liu <xliutaox@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_main.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index 22b2c6a8d08f..b658bf9b5399 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -30,6 +30,7 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
 {
 	struct gve_priv *priv = netdev_priv(dev);
 	unsigned int start;
+	u64 packets, bytes;
 	int ring;
 
 	if (priv->rx) {
@@ -37,10 +38,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
 			do {
 				start =
 				  u64_stats_fetch_begin(&priv->rx[ring].statss);
-				s->rx_packets += priv->rx[ring].rpackets;
-				s->rx_bytes += priv->rx[ring].rbytes;
+				packets = priv->rx[ring].rpackets;
+				bytes = priv->rx[ring].rbytes;
 			} while (u64_stats_fetch_retry(&priv->rx[ring].statss,
 						       start));
+			s->rx_packets += packets;
+			s->rx_bytes += bytes;
 		}
 	}
 	if (priv->tx) {
@@ -48,10 +51,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s)
 			do {
 				start =
 				  u64_stats_fetch_begin(&priv->tx[ring].statss);
-				s->tx_packets += priv->tx[ring].pkt_done;
-				s->tx_bytes += priv->tx[ring].bytes_done;
+				packets = priv->tx[ring].pkt_done;
+				bytes = priv->tx[ring].bytes_done;
 			} while (u64_stats_fetch_retry(&priv->tx[ring].statss,
 						       start));
+			s->tx_packets += packets;
+			s->tx_bytes += bytes;
 		}
 	}
 }

From d3a07ca78acecae90a7c8b1af7a26cbfc59ba2c8 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 5 Oct 2021 18:01:38 -0700
Subject: [PATCH 0799/1750] gve: report 64bit tx_bytes counter from
 gve_handle_report_stats()

[ Upstream commit 17c37d748f2b122a95b6d0524d410302ff89a2b1 ]

Each tx queue maintains a 64bit counter for bytes, there is
no reason to truncate this to 32bit (or this has not been
documented)

Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yangchun Fu <yangchun@google.com>
Cc: Kuo Zhao <kuozhao@google.com>
Cc: David Awogbemila <awogbemila@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_main.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index b658bf9b5399..fd52218f4884 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -987,9 +987,10 @@ static void gve_handle_reset(struct gve_priv *priv)
 
 void gve_handle_report_stats(struct gve_priv *priv)
 {
-	int idx, stats_idx = 0, tx_bytes;
-	unsigned int start = 0;
 	struct stats *stats = priv->stats_report->stats;
+	int idx, stats_idx = 0;
+	unsigned int start = 0;
+	u64 tx_bytes;
 
 	if (!gve_get_report_stats(priv))
 		return;

From 2dc768a98c9b83f33a2bc98a275bf4b352d946f1 Mon Sep 17 00:00:00 2001
From: Jiri Benc <jbenc@redhat.com>
Date: Tue, 14 Sep 2021 10:54:42 +0200
Subject: [PATCH 0800/1750] i40e: fix endless loop under rtnl

[ Upstream commit 857b6c6f665cca9828396d9743faf37fd09e9ac3 ]

The loop in i40e_get_capabilities can never end. The problem is that
although i40e_aq_discover_capabilities returns with an error if there's
a firmware problem, the returned error is not checked. There is a check for
pf->hw.aq.asq_last_status but that value is set to I40E_AQ_RC_OK on most
firmware problems.

When i40e_aq_discover_capabilities encounters a firmware problem, it will
encounter the same problem on its next invocation. As the result, the loop
becomes endless. We hit this with I40E_ERR_ADMIN_QUEUE_TIMEOUT but looking
at the code, it can happen with a range of other firmware errors.

I don't know what the correct behavior should be: whether the firmware
should be retried a few times, or whether pf->hw.aq.asq_last_status should
be always set to the encountered firmware error (but then it would be
pointless and can be just replaced by the i40e_aq_discover_capabilities
return value). However, the current behavior with an endless loop under the
rtnl mutex(!) is unacceptable and Intel has not submitted a fix, although we
explained the bug to them 7 months ago.

This may not be the best possible fix but it's better than hanging the whole
system on a firmware bug.

Fixes: 56a62fc86895 ("i40e: init code and hardware support")
Tested-by: Stefan Assmann <sassmann@redhat.com>
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Dave Switzer <david.switzer@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index bc648ce0743c..0a1eea0846e6 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -9662,7 +9662,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf,
 		if (pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOMEM) {
 			/* retry with a larger buffer */
 			buf_len = data_size;
-		} else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK) {
+		} else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK || err) {
 			dev_info(&pf->pdev->dev,
 				 "capability discovery failed, err %s aq_err %s\n",
 				 i40e_stat_str(&pf->hw, err),

From 97aeed72af4f83ae51534f0a2473ff52f8d66236 Mon Sep 17 00:00:00 2001
From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
Date: Fri, 24 Sep 2021 11:40:41 +0200
Subject: [PATCH 0801/1750] i40e: Fix freeing of uninitialized misc IRQ vector

[ Upstream commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e ]

When VSI set up failed in i40e_probe() as part of PF switch set up
driver was trying to free misc IRQ vectors in
i40e_clear_interrupt_scheme and produced a kernel Oops:

   Trying to free already-free IRQ 266
   WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300
   Workqueue: events work_for_cpu_fn
   RIP: 0010:__free_irq+0x9a/0x300
   Call Trace:
   ? synchronize_irq+0x3a/0xa0
   free_irq+0x2e/0x60
   i40e_clear_interrupt_scheme+0x53/0x190 [i40e]
   i40e_probe.part.108+0x134b/0x1a40 [i40e]
   ? kmem_cache_alloc+0x158/0x1c0
   ? acpi_ut_update_ref_count.part.1+0x8e/0x345
   ? acpi_ut_update_object_reference+0x15e/0x1e2
   ? strstr+0x21/0x70
   ? irq_get_irq_data+0xa/0x20
   ? mp_check_pin_attr+0x13/0xc0
   ? irq_get_irq_data+0xa/0x20
   ? mp_map_pin_to_irq+0xd3/0x2f0
   ? acpi_register_gsi_ioapic+0x93/0x170
   ? pci_conf1_read+0xa4/0x100
   ? pci_bus_read_config_word+0x49/0x70
   ? do_pci_enable_device+0xcc/0x100
   local_pci_probe+0x41/0x90
   work_for_cpu_fn+0x16/0x20
   process_one_work+0x1a7/0x360
   worker_thread+0x1cf/0x390
   ? create_worker+0x1a0/0x1a0
   kthread+0x112/0x130
   ? kthread_flush_work_fn+0x10/0x10
   ret_from_fork+0x1f/0x40

The problem is that at that point misc IRQ vectors
were not allocated yet and we get a call trace
that driver is trying to free already free IRQ vectors.

Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED
PF state before calling i40e_free_misc_vector. This state is set only if
misc IRQ vectors were properly initialized.

Fixes: c17401a1dd21 ("i40e: use separate state bit for miscellaneous IRQ setup")
Reported-by: PJ Waskiewicz <pwaskiewicz@jumptrading.com>
Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
Signed-off-by: Mateusz Palczewski <mateusz.palczewski@intel.com>
Tested-by: Dave Switzer <david.switzer@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 0a1eea0846e6..52c2d6fdeb7a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4839,7 +4839,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf)
 {
 	int i;
 
-	i40e_free_misc_vector(pf);
+	if (test_bit(__I40E_MISC_IRQ_REQUESTED, pf->state))
+		i40e_free_misc_vector(pf);
 
 	i40e_put_lump(pf->irq_pile, pf->iwarp_base_vector,
 		      I40E_IWARP_IRQ_PILE_ID);

From 985cca1ad11ed9c84b3922c6f05aef2d11e13e76 Mon Sep 17 00:00:00 2001
From: Mike Manning <mvrmanning@gmail.com>
Date: Tue, 5 Oct 2021 14:03:42 +0100
Subject: [PATCH 0802/1750] net: prefer socket bound to interface when not in
 VRF

[ Upstream commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a ]

The commit 6da5b0f027a8 ("net: ensure unbound datagram socket to be
chosen when not in a VRF") modified compute_score() so that a device
match is always made, not just in the case of an l3mdev skb, then
increments the score also for unbound sockets. This ensures that
sockets bound to an l3mdev are never selected when not in a VRF.
But as unbound and bound sockets are now scored equally, this results
in the last opened socket being selected if there are matches in the
default VRF for an unbound socket and a socket bound to a dev that is
not an l3mdev. However, handling prior to this commit was to always
select the bound socket in this case. Reinstate this handling by
incrementing the score only for bound sockets. The required isolation
due to choosing between an unbound socket and a socket bound to an
l3mdev remains in place due to the device match always being made.
The same approach is taken for compute_score() for stream sockets.

Fixes: 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF")
Fixes: e78190581aff ("net: ensure unbound stream socket to be chosen when not in a VRF")
Signed-off-by: Mike Manning <mmanning@vyatta.att-mail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/cf0a8523-b362-1edf-ee78-eef63cbbb428@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/inet_hashtables.c  | 4 +++-
 net/ipv4/udp.c              | 3 ++-
 net/ipv6/inet6_hashtables.c | 2 +-
 net/ipv6/udp.c              | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 45fb450b4522..f3fd5c911ed0 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -242,8 +242,10 @@ static inline int compute_score(struct sock *sk, struct net *net,
 
 		if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
 			return -1;
+		score =  sk->sk_bound_dev_if ? 2 : 1;
 
-		score = sk->sk_family == PF_INET ? 2 : 1;
+		if (sk->sk_family == PF_INET)
+			score++;
 		if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
 			score++;
 	}
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index bd7fd9b1f24c..655f0d8a13d3 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -390,7 +390,8 @@ static int compute_score(struct sock *sk, struct net *net,
 					dif, sdif);
 	if (!dev_match)
 		return -1;
-	score += 4;
+	if (sk->sk_bound_dev_if)
+		score += 4;
 
 	if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
 		score++;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 55c290d55605..67c9114835c8 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -106,7 +106,7 @@ static inline int compute_score(struct sock *sk, struct net *net,
 		if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif))
 			return -1;
 
-		score = 1;
+		score =  sk->sk_bound_dev_if ? 2 : 1;
 		if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
 			score++;
 	}
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1943ae5103eb..bae6b51a9bd4 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -133,7 +133,8 @@ static int compute_score(struct sock *sk, struct net *net,
 	dev_match = udp_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif);
 	if (!dev_match)
 		return -1;
-	score++;
+	if (sk->sk_bound_dev_if)
+		score++;
 
 	if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id())
 		score++;

From 87990a60b45ff820e6ffb10d2f779892f400f7b5 Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik@ozlabs.ru>
Date: Thu, 30 Sep 2021 13:44:54 +1000
Subject: [PATCH 0803/1750] powerpc/iommu: Report the correct most efficient
 DMA mask for PCI devices

[ Upstream commit 23c216b335d1fbd716076e8263b54a714ea3cf0e ]

According to dma-api.rst, the dma_get_required_mask() helper should return
"the mask that the platform requires to operate efficiently". Which in
the case of PPC64 means the bypass mask and not a mask from an IOMMU table
which is shorter and slower to use due to map/unmap operations (especially
expensive on "pseries").

However the existing implementation ignores the possibility of bypassing
and returns the IOMMU table mask on the pseries platform which makes some
drivers (mpt3sas is one example) choose 32bit DMA even though bypass is
supported. The powernv platform sort of handles it by having a bigger
default window with a mask >=40 but it only works as drivers choose
63/64bit if the required mask is >32 which is rather pointless.

This reintroduces the bypass capability check to let drivers make
a better choice of the DMA mask.

Fixes: f1565c24b596 ("powerpc: use the generic dma_ops_bypass mode")
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210930034454.95794-1-aik@ozlabs.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/dma-iommu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/powerpc/kernel/dma-iommu.c b/arch/powerpc/kernel/dma-iommu.c
index a1c744194018..9ac0651795cf 100644
--- a/arch/powerpc/kernel/dma-iommu.c
+++ b/arch/powerpc/kernel/dma-iommu.c
@@ -117,6 +117,15 @@ u64 dma_iommu_get_required_mask(struct device *dev)
 	struct iommu_table *tbl = get_iommu_table_base(dev);
 	u64 mask;
 
+	if (dev_is_pci(dev)) {
+		u64 bypass_mask = dma_direct_get_required_mask(dev);
+
+		if (dma_iommu_dma_supported(dev, bypass_mask)) {
+			dev_info(dev, "%s: returning bypass mask 0x%llx\n", __func__, bypass_mask);
+			return bypass_mask;
+		}
+	}
+
 	if (!tbl)
 		return 0;
 

From f86de018fd7a24ee07372d55ffa7824f0c674a95 Mon Sep 17 00:00:00 2001
From: Jamie Iles <quic_jiles@quicinc.com>
Date: Wed, 22 Sep 2021 17:57:18 +0100
Subject: [PATCH 0804/1750] i2c: acpi: fix resource leak in reconfiguration
 device addition

[ Upstream commit 6558b646ce1c2a872fe1c2c7cb116f05a2c1950f ]

acpi_i2c_find_adapter_by_handle() calls bus_find_device() which takes a
reference on the adapter which is never released which will result in a
reference count leak and render the adapter unremovable.  Make sure to
put the adapter after creating the client in the same manner that we do
for OF.

Fixes: 525e6fabeae2 ("i2c / ACPI: add support for ACPI reconfigure notifications")
Signed-off-by: Jamie Iles <quic_jiles@quicinc.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
[wsa: fixed title]
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/i2c-core-acpi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
index 37c510d9347a..4b136d871074 100644
--- a/drivers/i2c/i2c-core-acpi.c
+++ b/drivers/i2c/i2c-core-acpi.c
@@ -426,6 +426,7 @@ static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value,
 			break;
 
 		i2c_acpi_register_device(adapter, adev, &info);
+		put_device(&adapter->dev);
 		break;
 	case ACPI_RECONFIG_DEVICE_REMOVE:
 		if (!acpi_device_enumerated(adev))

From de834e12b96d90d7edd1374c9b12a62baa8cdb9b Mon Sep 17 00:00:00 2001
From: Kewei Xu <kewei.xu@mediatek.com>
Date: Fri, 17 Sep 2021 18:14:14 +0800
Subject: [PATCH 0805/1750] i2c: mediatek: Add OFFSET_EXT_CONF setting back

[ Upstream commit 3bce7703c7ba648bd9e174dc1413f422b7998833 ]

In the commit be5ce0e97cc7 ("i2c: mediatek: Add i2c ac-timing adjust
support"), we miss setting OFFSET_EXT_CONF register if
i2c->dev_comp->timing_adjust is false, now add it back.

Fixes: be5ce0e97cc7 ("i2c: mediatek: Add i2c ac-timing adjust support")
Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
Reviewed-by: Qii Wang <qii.wang@mediatek.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-mt65xx.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 1a5f1ccd1d2f..0af2784cbd0d 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -41,6 +41,8 @@
 #define I2C_HANDSHAKE_RST		0x0020
 #define I2C_FIFO_ADDR_CLR		0x0001
 #define I2C_DELAY_LEN			0x0002
+#define I2C_ST_START_CON		0x8001
+#define I2C_FS_START_CON		0x1800
 #define I2C_TIME_CLR_VALUE		0x0000
 #define I2C_TIME_DEFAULT_VALUE		0x0003
 #define I2C_WRRD_TRANAC_VALUE		0x0002
@@ -479,6 +481,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
 {
 	u16 control_reg;
 	u16 intr_stat_reg;
+	u16 ext_conf_val;
 
 	mtk_i2c_writew(i2c, I2C_CHN_CLR_FLAG, OFFSET_START);
 	intr_stat_reg = mtk_i2c_readw(i2c, OFFSET_INTR_STAT);
@@ -517,8 +520,13 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
 	if (i2c->dev_comp->ltiming_adjust)
 		mtk_i2c_writew(i2c, i2c->ltiming_reg, OFFSET_LTIMING);
 
+	if (i2c->speed_hz <= I2C_MAX_STANDARD_MODE_FREQ)
+		ext_conf_val = I2C_ST_START_CON;
+	else
+		ext_conf_val = I2C_FS_START_CON;
+
 	if (i2c->dev_comp->timing_adjust) {
-		mtk_i2c_writew(i2c, i2c->ac_timing.ext, OFFSET_EXT_CONF);
+		ext_conf_val = i2c->ac_timing.ext;
 		mtk_i2c_writew(i2c, i2c->ac_timing.inter_clk_div,
 			       OFFSET_CLOCK_DIV);
 		mtk_i2c_writew(i2c, I2C_SCL_MIS_COMP_VALUE,
@@ -543,6 +551,7 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c)
 				       OFFSET_HS_STA_STO_AC_TIMING);
 		}
 	}
+	mtk_i2c_writew(i2c, ext_conf_val, OFFSET_EXT_CONF);
 
 	/* If use i2c pin from PMIC mt6397 side, need set PATH_DIR first */
 	if (i2c->have_pmic)

From 2c152d9da8fed3cade515eb5249fab805c87d831 Mon Sep 17 00:00:00 2001
From: Tong Tiangen <tongtiangen@huawei.com>
Date: Wed, 1 Sep 2021 02:46:21 +0000
Subject: [PATCH 0806/1750] riscv/vdso: make arch_setup_additional_pages wait
 for mmap_sem for write killable

[ Upstream commit 8bb0ab3ae7a4dbe6cf32deb830cf2bdbf5736867 ]

riscv architectures relying on mmap_sem for write in their
arch_setup_additional_pages. If the waiting task gets killed by the oom
killer it would block oom_reaper from asynchronous address space reclaim
and reduce the chances of timely OOM resolving.  Wait for the lock in
the killable mode and return with EINTR if the task got killed while
waiting.

Signed-off-by: Tong Tiangen <tongtiangen@huawei.com>
Reviewed-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code")
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/kernel/vdso.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/kernel/vdso.c b/arch/riscv/kernel/vdso.c
index 3f1d35e7c98a..73d45931a053 100644
--- a/arch/riscv/kernel/vdso.c
+++ b/arch/riscv/kernel/vdso.c
@@ -65,7 +65,9 @@ int arch_setup_additional_pages(struct linux_binprm *bprm,
 
 	vdso_len = (vdso_pages + 1) << PAGE_SHIFT;
 
-	mmap_write_lock(mm);
+	if (mmap_write_lock_killable(mm))
+		return -EINTR;
+
 	vdso_base = get_unmapped_area(NULL, 0, vdso_len, 0, 0);
 	if (IS_ERR_VALUE(vdso_base)) {
 		ret = vdso_base;

From 29fdb11ca88d3c490a3d56f0dc77eb9444d086be Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Mon, 27 Sep 2021 15:06:14 +0800
Subject: [PATCH 0807/1750] bpf, s390: Fix potential memory leak about jit_data

[ Upstream commit 686cb8b9f6b46787f035afe8fbd132a74e6b1bdd ]

Make sure to free jit_data through kfree() in the error path.

Fixes: 1c8f9b91c456 ("bpf: s390: add JIT support for multi-function programs")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/net/bpf_jit_comp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 8d9047d2d1e1..cd0cbdafedbd 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1775,7 +1775,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
 	jit.addrs = kvcalloc(fp->len + 1, sizeof(*jit.addrs), GFP_KERNEL);
 	if (jit.addrs == NULL) {
 		fp = orig_fp;
-		goto out;
+		goto free_addrs;
 	}
 	/*
 	 * Three initial passes:

From a4037dded56bb82eb4fbb37b5bdbf18a55e2bb96 Mon Sep 17 00:00:00 2001
From: Palmer Dabbelt <palmerdabbelt@google.com>
Date: Sat, 2 Oct 2021 17:21:20 -0700
Subject: [PATCH 0808/1750] RISC-V: Include clone3() on rv32

[ Upstream commit 59a4e0d5511ba61353ea9a4efdb1b86c23ecf134 ]

As far as I can tell this should be enabled on rv32 as well, I'm not
sure why it's rv64-only.  checksyscalls is complaining about our lack of
clone3() on rv32.

Fixes: 56ac5e213933 ("riscv: enable sys_clone3 syscall for rv64")
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/riscv/include/uapi/asm/unistd.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/include/uapi/asm/unistd.h b/arch/riscv/include/uapi/asm/unistd.h
index 4b989ae15d59..8062996c2dfd 100644
--- a/arch/riscv/include/uapi/asm/unistd.h
+++ b/arch/riscv/include/uapi/asm/unistd.h
@@ -18,9 +18,10 @@
 #ifdef __LP64__
 #define __ARCH_WANT_NEW_STAT
 #define __ARCH_WANT_SET_GET_RLIMIT
-#define __ARCH_WANT_SYS_CLONE3
 #endif /* __LP64__ */
 
+#define __ARCH_WANT_SYS_CLONE3
+
 #include <asm-generic/unistd.h>
 
 /*

From 18a2a2cafcf93ece4bde3a4f0b76324a7bfc0872 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Wed, 6 Oct 2021 01:55:23 +0530
Subject: [PATCH 0809/1750] powerpc/bpf: Fix BPF_SUB when imm == 0x80000000

[ Upstream commit 5855c4c1f415ca3ba1046e77c0b3d3dfc96c9025 ]

We aren't handling subtraction involving an immediate value of
0x80000000 properly. Fix the same.

Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
[mpe: Fold in fix from Naveen to use imm <= 32768]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/fc4b1276eb10761fd7ce0814c8dd089da2815251.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/net/bpf_jit_comp64.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 658ca2bab13c..0752967f351b 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -347,18 +347,25 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 			EMIT(PPC_RAW_SUB(dst_reg, dst_reg, src_reg));
 			goto bpf_alu32_trunc;
 		case BPF_ALU | BPF_ADD | BPF_K: /* (u32) dst += (u32) imm */
-		case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */
 		case BPF_ALU64 | BPF_ADD | BPF_K: /* dst += imm */
+			if (!imm) {
+				goto bpf_alu32_trunc;
+			} else if (imm >= -32768 && imm < 32768) {
+				EMIT(PPC_RAW_ADDI(dst_reg, dst_reg, IMM_L(imm)));
+			} else {
+				PPC_LI32(b2p[TMP_REG_1], imm);
+				EMIT(PPC_RAW_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]));
+			}
+			goto bpf_alu32_trunc;
+		case BPF_ALU | BPF_SUB | BPF_K: /* (u32) dst -= (u32) imm */
 		case BPF_ALU64 | BPF_SUB | BPF_K: /* dst -= imm */
-			if (BPF_OP(code) == BPF_SUB)
-				imm = -imm;
-			if (imm) {
-				if (imm >= -32768 && imm < 32768)
-					EMIT(PPC_RAW_ADDI(dst_reg, dst_reg, IMM_L(imm)));
-				else {
-					PPC_LI32(b2p[TMP_REG_1], imm);
-					EMIT(PPC_RAW_ADD(dst_reg, dst_reg, b2p[TMP_REG_1]));
-				}
+			if (!imm) {
+				goto bpf_alu32_trunc;
+			} else if (imm > -32768 && imm <= 32768) {
+				EMIT(PPC_RAW_ADDI(dst_reg, dst_reg, IMM_L(-imm)));
+			} else {
+				PPC_LI32(b2p[TMP_REG_1], imm);
+				EMIT(PPC_RAW_SUB(dst_reg, dst_reg, b2p[TMP_REG_1]));
 			}
 			goto bpf_alu32_trunc;
 		case BPF_ALU | BPF_MUL | BPF_X: /* (u32) dst *= (u32) src */

From 411b38fe68ba20a8bbe724b0939762c3f16e16ca Mon Sep 17 00:00:00 2001
From: Nicholas Piggin <npiggin@gmail.com>
Date: Tue, 5 Oct 2021 00:56:38 +1000
Subject: [PATCH 0810/1750] powerpc/64s: fix program check interrupt emergency
 stack path

[ Upstream commit 3e607dc4df180b72a38e75030cb0f94d12808712 ]

Emergency stack path was jumping into a 3: label inside the
__GEN_COMMON_BODY macro for the normal path after it had finished,
rather than jumping over it. By a small miracle this is the correct
place to build up a new interrupt frame with the existing stack
pointer, so things basically worked okay with an added weird looking
700 trap frame on top (which had the wrong ->nip so it didn't decode
bug messages either).

Fix this by avoiding using numeric labels when jumping over non-trivial
macros.

Before:

 LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
 Modules linked in:
 CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637
 NIP:  7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0
 REGS: c0000000fffb3a50 TRAP: 0700   Not tainted
 MSR:  9000000000021031 <SF,HV,ME,IR,DR,LE>  CR: 00000700  XER: 20040000
 CFAR: c0000000000098b0 IRQMASK: 0
 GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000
 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299
 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8
 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001
 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8
 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158
 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300
 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80
 NIP [7265677368657265] 0x7265677368657265
 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10
 Call Trace:
 [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable)
 --- interrupt: 700 at decrementer_common_virt+0xb8/0x230
 NIP:  c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0
 REGS: c0000000fffb3d60 TRAP: 0700   Not tainted
 MSR:  9000000000021031 <SF,HV,ME,IR,DR,LE>  CR: 22424282  XER: 20040000
 CFAR: c0000000000098b0 IRQMASK: 0
 GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000
 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299
 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8
 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001
 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8
 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158
 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300
 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80
 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230
 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10
 --- interrupt: 700
 Instruction dump:
 XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
 XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
 ---[ end trace 6d28218e0cc3c949 ]---

After:

 ------------[ cut here ]------------
 kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491!
 Oops: Exception in kernel mode, sig: 5 [#1]
 LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
 Modules linked in:
 CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638
 NIP:  c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0
 REGS: c0000000fffb3d60 TRAP: 0700   Not tainted
 MSR:  9000000000021031 <SF,HV,ME,IR,DR,LE>  CR: 24482227  XER: 00040000
 CFAR: c0000000000098b0 IRQMASK: 0
 GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868
 GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009
 GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c
 GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00
 GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90
 GPR20: 00000000100eed90 0000000010000000 000000001000a49c 00000000100f1430
 GPR24: c000000001271868 0000000002000000 0000000000000215 0000000000000300
 GPR28: c000000001271800 0000000042000000 00000000100f0d29 c000000080647860
 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230
 LR [c00000000006bf04] ___do_page_fault+0x234/0xb10
 Call Trace:
 Instruction dump:
 4182000c 39400001 48000008 894d0932 714a0001 39400008 408225fc 718a4000
 7c2a0b78 3821fcf0 41c20008 e82d0910 <0981fcf0> f92101a0 f9610170 f9810178
 ---[ end trace a5dbd1f5ea4ccc51 ]---

Fixes: 0a882e28468f4 ("powerpc/64s/exception: remove bad stack branch")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211004145642.1331214-2-npiggin@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/exceptions-64s.S | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 9d3b468bd2d7..10df278dc3fb 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1715,27 +1715,30 @@ EXC_COMMON_BEGIN(program_check_common)
 	 */
 
 	andi.	r10,r12,MSR_PR
-	bne	2f			/* If userspace, go normal path */
+	bne	.Lnormal_stack		/* If userspace, go normal path */
 
 	andis.	r10,r12,(SRR1_PROGTM)@h
-	bne	1f			/* If TM, emergency		*/
+	bne	.Lemergency_stack	/* If TM, emergency		*/
 
 	cmpdi	r1,-INT_FRAME_SIZE	/* check if r1 is in userspace	*/
-	blt	2f			/* normal path if not		*/
+	blt	.Lnormal_stack		/* normal path if not		*/
 
 	/* Use the emergency stack					*/
-1:	andi.	r10,r12,MSR_PR		/* Set CR0 correctly for label	*/
+.Lemergency_stack:
+	andi.	r10,r12,MSR_PR		/* Set CR0 correctly for label	*/
 					/* 3 in EXCEPTION_PROLOG_COMMON	*/
 	mr	r10,r1			/* Save r1			*/
 	ld	r1,PACAEMERGSP(r13)	/* Use emergency stack		*/
 	subi	r1,r1,INT_FRAME_SIZE	/* alloc stack frame		*/
 	__ISTACK(program_check)=0
 	__GEN_COMMON_BODY program_check
-	b 3f
-2:
+	b .Ldo_program_check
+
+.Lnormal_stack:
 	__ISTACK(program_check)=1
 	__GEN_COMMON_BODY program_check
-3:
+
+.Ldo_program_check:
 	addi	r3,r1,STACK_FRAME_OVERHEAD
 	bl	program_check_exception
 	REST_NVGPRS(r1) /* instruction emulation may change GPRs */

From f73ca4961d51304a8f1418a6b6b9d9c77ea95041 Mon Sep 17 00:00:00 2001
From: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Date: Mon, 20 Sep 2021 22:03:26 +0530
Subject: [PATCH 0811/1750] pseries/eeh: Fix the kdump kernel crash during
 eeh_pseries_init

[ Upstream commit eb8257a12192f43ffd41bd90932c39dade958042 ]

On pseries LPAR when an empty slot is assigned to partition OR in single
LPAR mode, kdump kernel crashes during issuing PHB reset.

In the kdump scenario, we traverse all PHBs and issue reset using the
pe_config_addr of the first child device present under each PHB. However
the code assumes that none of the PHB slots can be empty and uses
list_first_entry() to get the first child device under the PHB. Since
list_first_entry() expects the list to be non-empty, it returns an
invalid pci_dn entry and ends up accessing NULL phb pointer under
pci_dn->phb causing kdump kernel crash.

This patch fixes the below kdump kernel crash by skipping empty slots:

  audit: initializing netlink subsys (disabled)
  thermal_sys: Registered thermal governor 'fair_share'
  thermal_sys: Registered thermal governor 'step_wise'
  cpuidle: using governor menu
  pstore: Registered nvram as persistent store backend
  Issue PHB reset ...
  audit: type=2000 audit(1631267818.000:1): state=initialized audit_enabled=0 res=1
  BUG: Kernel NULL pointer dereference on read at 0x00000268
  Faulting instruction address: 0xc000000008101fb0
  Oops: Kernel access of bad area, sig: 7 [#1]
  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
  Modules linked in:
  CPU: 7 PID: 1 Comm: swapper/7 Not tainted 5.14.0 #1
  NIP:  c000000008101fb0 LR: c000000009284ccc CTR: c000000008029d70
  REGS: c00000001161b840 TRAP: 0300   Not tainted  (5.14.0)
  MSR:  8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE>  CR: 28000224  XER: 20040002
  CFAR: c000000008101f0c DAR: 0000000000000268 DSISR: 00080000 IRQMASK: 0
  ...
  NIP pseries_eeh_get_pe_config_addr+0x100/0x1b0
  LR  __machine_initcall_pseries_eeh_pseries_init+0x2cc/0x350
  Call Trace:
    0xc00000001161bb80 (unreliable)
    __machine_initcall_pseries_eeh_pseries_init+0x2cc/0x350
    do_one_initcall+0x60/0x2d0
    kernel_init_freeable+0x350/0x3f8
    kernel_init+0x3c/0x17c
    ret_from_kernel_thread+0x5c/0x64

Fixes: 5a090f7c363fd ("powerpc/pseries: PCIE PHB reset")
Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
[mpe: Tweak wording and trim oops]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/163215558252.413351.8600189949820258982.stgit@jupiter
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/pseries/eeh_pseries.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
index cf024fa37bda..7ed38ebd0c7b 100644
--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
+++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
@@ -868,6 +868,10 @@ static int __init eeh_pseries_init(void)
 	if (is_kdump_kernel() || reset_devices) {
 		pr_info("Issue PHB reset ...\n");
 		list_for_each_entry(phb, &hose_list, list_node) {
+			// Skip if the slot is empty
+			if (list_empty(&PCI_DN(phb->dn)->child_list))
+				continue;
+
 			pdn = list_first_entry(&PCI_DN(phb->dn)->child_list, struct pci_dn, list);
 			config_addr = pseries_eeh_get_pe_config_addr(pdn);
 

From d7c36115fb8177e58a8aa99e79e7e076f6f07395 Mon Sep 17 00:00:00 2001
From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Date: Tue, 3 Aug 2021 13:35:24 +0200
Subject: [PATCH 0812/1750] x86/platform/olpc: Correct ifdef symbol to intended
 CONFIG_OLPC_XO15_SCI

commit 4758fd801f919b8b9acad78d2e49a195ec2be46b upstream.

The refactoring in the commit in Fixes introduced an ifdef
CONFIG_OLPC_XO1_5_SCI, however the config symbol is actually called
"CONFIG_OLPC_XO15_SCI".

Fortunately, ./scripts/checkkconfigsymbols.py warns:

OLPC_XO1_5_SCI
Referencing files: arch/x86/platform/olpc/olpc.c

Correct this ifdef condition to the intended config symbol.

Fixes: ec9964b48033 ("Platform: OLPC: Move EC-specific functionality out from x86")
Suggested-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20210803113531.30720-3-lukas.bulwahn@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/platform/olpc/olpc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/platform/olpc/olpc.c b/arch/x86/platform/olpc/olpc.c
index ee2beda590d0..1d4a00e767ec 100644
--- a/arch/x86/platform/olpc/olpc.c
+++ b/arch/x86/platform/olpc/olpc.c
@@ -274,7 +274,7 @@ static struct olpc_ec_driver ec_xo1_driver = {
 
 static struct olpc_ec_driver ec_xo1_5_driver = {
 	.ec_cmd = olpc_xo1_ec_cmd,
-#ifdef CONFIG_OLPC_XO1_5_SCI
+#ifdef CONFIG_OLPC_XO15_SCI
 	/*
 	 * XO-1.5 EC wakeups are available when olpc-xo15-sci driver is
 	 * compiled in

From df121cf550032175454e325d816af27b89cf0447 Mon Sep 17 00:00:00 2001
From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Date: Tue, 3 Aug 2021 13:35:25 +0200
Subject: [PATCH 0813/1750] x86/Kconfig: Correct reference to MWINCHIP3D

commit 225bac2dc5d192e55f2c50123ee539b1edf8a411 upstream.

Commit in Fixes intended to exclude the Winchip series and referred to
CONFIG_WINCHIP3D, but the config symbol is called CONFIG_MWINCHIP3D.

Hence, scripts/checkkconfigsymbols.py warns:

WINCHIP3D
Referencing files: arch/x86/Kconfig

Correct the reference to the intended config symbol.

Fixes: 69b8d3fcabdc ("x86/Kconfig: Exclude i586-class CPUs lacking PAE support from the HIGHMEM64G Kconfig group")
Suggested-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20210803113531.30720-4-lukas.bulwahn@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index f3c8a8110f60..4201d0cf5f83 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1415,7 +1415,7 @@ config HIGHMEM4G
 
 config HIGHMEM64G
 	bool "64GB"
-	depends on !M486SX && !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !WINCHIP3D && !MK6
+	depends on !M486SX && !M486 && !M586 && !M586TSC && !M586MMX && !MGEODE_LX && !MGEODEGX1 && !MCYRIXIII && !MELAN && !MWINCHIPC6 && !MWINCHIP3D && !MK6
 	select X86_PAE
 	help
 	  Select this if you have a 32-bit processor and more than 4

From 5d637bc6f98ae7f980f4773608f997f222176ef5 Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Thu, 30 Sep 2021 23:42:01 -0500
Subject: [PATCH 0814/1750] x86/sev: Return an error on a returned non-zero
 SW_EXITINFO1[31:0]

commit 06f2ac3d4219bbbfd93d79e01966a42053084f11 upstream.

After returning from a VMGEXIT NAE event, SW_EXITINFO1[31:0] is checked
for a value of 1, which indicates an error and that SW_EXITINFO2
contains exception information. However, future versions of the GHCB
specification may define new values for SW_EXITINFO1[31:0], so really
any non-zero value should be treated as an error.

Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org> # 5.10+
Link: https://lkml.kernel.org/r/efc772af831e9e7f517f0439b13b41f56bad8784.1633063321.git.thomas.lendacky@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/sev-es-shared.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kernel/sev-es-shared.c b/arch/x86/kernel/sev-es-shared.c
index ecb20b17b7df..82db4014deb2 100644
--- a/arch/x86/kernel/sev-es-shared.c
+++ b/arch/x86/kernel/sev-es-shared.c
@@ -130,6 +130,8 @@ static enum es_result sev_es_ghcb_hv_call(struct ghcb *ghcb,
 		} else {
 			ret = ES_VMM_ERROR;
 		}
+	} else if (ghcb->save.sw_exit_info_1 & 0xffffffff) {
+		ret = ES_VMM_ERROR;
 	} else {
 		ret = ES_OK;
 	}

From 6bfe1f6fc8769c728d4de87aa8e30ec36e706a9d Mon Sep 17 00:00:00 2001
From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Date: Tue, 3 Aug 2021 13:35:23 +0200
Subject: [PATCH 0815/1750] x86/entry: Correct reference to intended
 CONFIG_64_BIT

commit 2c861f2b859385e9eaa6e464a8a7435b5a6bf564 upstream.

Commit in Fixes adds a condition with IS_ENABLED(CONFIG_64_BIT),
but the intended config item is called CONFIG_64BIT, as defined in
arch/x86/Kconfig.

Fortunately, scripts/checkkconfigsymbols.py warns:

64_BIT
Referencing files: arch/x86/include/asm/entry-common.h

Correct the reference to the intended config symbol.

Fixes: 662a0221893a ("x86/entry: Fix AC assertion")
Suggested-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20210803113531.30720-2-lukas.bulwahn@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/entry-common.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/entry-common.h b/arch/x86/include/asm/entry-common.h
index 6fe54b2813c1..4a382fb6a9ef 100644
--- a/arch/x86/include/asm/entry-common.h
+++ b/arch/x86/include/asm/entry-common.h
@@ -24,7 +24,7 @@ static __always_inline void arch_check_user_regs(struct pt_regs *regs)
 		 * For !SMAP hardware we patch out CLAC on entry.
 		 */
 		if (boot_cpu_has(X86_FEATURE_SMAP) ||
-		    (IS_ENABLED(CONFIG_64_BIT) && boot_cpu_has(X86_FEATURE_XENPV)))
+		    (IS_ENABLED(CONFIG_64BIT) && boot_cpu_has(X86_FEATURE_XENPV)))
 			mask |= X86_EFLAGS_AC;
 
 		WARN_ON_ONCE(flags & mask);

From f2447f6587b8ffe42ba04d14ce67d429a1163e5e Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Mon, 4 Oct 2021 00:34:23 +0200
Subject: [PATCH 0816/1750] x86/entry: Clear X86_FEATURE_SMAP when
 CONFIG_X86_SMAP=n

commit 3958b9c34c2729597e182cc606cc43942fd19f7c upstream.

Commit

  3c73b81a9164 ("x86/entry, selftests: Further improve user entry sanity checks")

added a warning if AC is set when in the kernel.

Commit

  662a0221893a3d ("x86/entry: Fix AC assertion")

changed the warning to only fire if the CPU supports SMAP.

However, the warning can still trigger on a machine that supports SMAP
but where it's disabled in the kernel config and when running the
syscall_nt selftest, for example:

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 49 at irqentry_enter_from_user_mode
  CPU: 0 PID: 49 Comm: init Tainted: G                T 5.15.0-rc4+ #98 e6202628ee053b4f310759978284bd8bb0ce6905
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
  RIP: 0010:irqentry_enter_from_user_mode
  ...
  Call Trace:
   ? irqentry_enter
   ? exc_general_protection
   ? asm_exc_general_protection
   ? asm_exc_general_protectio

IS_ENABLED(CONFIG_X86_SMAP) could be added to the warning condition, but
even this would not be enough in case SMAP is disabled at boot time with
the "nosmap" parameter.

To be consistent with "nosmap" behaviour, clear X86_FEATURE_SMAP when
!CONFIG_X86_SMAP.

Found using entry-fuzz + satrandconfig.

 [ bp: Massage commit message. ]

Fixes: 3c73b81a9164 ("x86/entry, selftests: Further improve user entry sanity checks")
Fixes: 662a0221893a ("x86/entry: Fix AC assertion")
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20211003223423.8666-1-vegard.nossum@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/common.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 25148ebd3634..ec21f5e9ffd0 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -320,6 +320,7 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
 #ifdef CONFIG_X86_SMAP
 		cr4_set_bits(X86_CR4_SMAP);
 #else
+		clear_cpu_cap(c, X86_FEATURE_SMAP);
 		cr4_clear_bits(X86_CR4_SMAP);
 #endif
 	}

From 825c00c2ee143eff1d869605c318270686f689e0 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 30 Sep 2021 19:21:39 +0200
Subject: [PATCH 0817/1750] x86/hpet: Use another crystalball to evaluate HPET
 usability

commit 6e3cd95234dc1eda488f4f487c281bac8fef4d9b upstream.

On recent Intel systems the HPET stops working when the system reaches PC10
idle state.

The approach of adding PCI ids to the early quirks to disable HPET on
these systems is a whack a mole game which makes no sense.

Check for PC10 instead and force disable HPET if supported. The check is
overbroad as it does not take ACPI, intel_idle enablement and command
line parameters into account. That's fine as long as there is at least
PMTIMER available to calibrate the TSC frequency. The decision can be
overruled by adding "hpet=force" on the kernel command line.

Remove the related early PCI quirks for affected Ice Cake and Coffin Lake
systems as they are not longer required. That should also cover all
other systems, i.e. Tiger Rag and newer generations, which are most
likely affected by this as well.

Fixes: Yet another hardware trainwreck
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Rafael J. Wysocki <rafael@kernel.org>
Cc: stable@vger.kernel.org
Cc: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/early-quirks.c |  6 ---
 arch/x86/kernel/hpet.c         | 81 ++++++++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index a4b5af03dcc1..0c6d1dc59fa2 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -711,12 +711,6 @@ static struct chipset early_qrk[] __initdata = {
 	 */
 	{ PCI_VENDOR_ID_INTEL, 0x0f00,
 		PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
-	{ PCI_VENDOR_ID_INTEL, 0x3e20,
-		PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
-	{ PCI_VENDOR_ID_INTEL, 0x3ec4,
-		PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
-	{ PCI_VENDOR_ID_INTEL, 0x8a12,
-		PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
 	{ PCI_VENDOR_ID_BROADCOM, 0x4331,
 	  PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset},
 	{}
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 7a50f0b62a70..4ab7a9757e52 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -9,6 +9,7 @@
 
 #include <asm/hpet.h>
 #include <asm/time.h>
+#include <asm/mwait.h>
 
 #undef  pr_fmt
 #define pr_fmt(fmt) "hpet: " fmt
@@ -806,6 +807,83 @@ static bool __init hpet_counting(void)
 	return false;
 }
 
+static bool __init mwait_pc10_supported(void)
+{
+	unsigned int eax, ebx, ecx, mwait_substates;
+
+	if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL)
+		return false;
+
+	if (!cpu_feature_enabled(X86_FEATURE_MWAIT))
+		return false;
+
+	if (boot_cpu_data.cpuid_level < CPUID_MWAIT_LEAF)
+		return false;
+
+	cpuid(CPUID_MWAIT_LEAF, &eax, &ebx, &ecx, &mwait_substates);
+
+	return (ecx & CPUID5_ECX_EXTENSIONS_SUPPORTED) &&
+	       (ecx & CPUID5_ECX_INTERRUPT_BREAK) &&
+	       (mwait_substates & (0xF << 28));
+}
+
+/*
+ * Check whether the system supports PC10. If so force disable HPET as that
+ * stops counting in PC10. This check is overbroad as it does not take any
+ * of the following into account:
+ *
+ *	- ACPI tables
+ *	- Enablement of intel_idle
+ *	- Command line arguments which limit intel_idle C-state support
+ *
+ * That's perfectly fine. HPET is a piece of hardware designed by committee
+ * and the only reasons why it is still in use on modern systems is the
+ * fact that it is impossible to reliably query TSC and CPU frequency via
+ * CPUID or firmware.
+ *
+ * If HPET is functional it is useful for calibrating TSC, but this can be
+ * done via PMTIMER as well which seems to be the last remaining timer on
+ * X86/INTEL platforms that has not been completely wreckaged by feature
+ * creep.
+ *
+ * In theory HPET support should be removed altogether, but there are older
+ * systems out there which depend on it because TSC and APIC timer are
+ * dysfunctional in deeper C-states.
+ *
+ * It's only 20 years now that hardware people have been asked to provide
+ * reliable and discoverable facilities which can be used for timekeeping
+ * and per CPU timer interrupts.
+ *
+ * The probability that this problem is going to be solved in the
+ * forseeable future is close to zero, so the kernel has to be cluttered
+ * with heuristics to keep up with the ever growing amount of hardware and
+ * firmware trainwrecks. Hopefully some day hardware people will understand
+ * that the approach of "This can be fixed in software" is not sustainable.
+ * Hope dies last...
+ */
+static bool __init hpet_is_pc10_damaged(void)
+{
+	unsigned long long pcfg;
+
+	/* Check whether PC10 substates are supported */
+	if (!mwait_pc10_supported())
+		return false;
+
+	/* Check whether PC10 is enabled in PKG C-state limit */
+	rdmsrl(MSR_PKG_CST_CONFIG_CONTROL, pcfg);
+	if ((pcfg & 0xF) < 8)
+		return false;
+
+	if (hpet_force_user) {
+		pr_warn("HPET force enabled via command line, but dysfunctional in PC10.\n");
+		return false;
+	}
+
+	pr_info("HPET dysfunctional in PC10. Force disabled.\n");
+	boot_hpet_disable = true;
+	return true;
+}
+
 /**
  * hpet_enable - Try to setup the HPET timer. Returns 1 on success.
  */
@@ -819,6 +897,9 @@ int __init hpet_enable(void)
 	if (!is_hpet_capable())
 		return 0;
 
+	if (hpet_is_pc10_damaged())
+		return 0;
+
 	hpet_set_mapping();
 	if (!hpet_virt_address)
 		return 0;

From 0268aa579b1f741b12300bc7f084ffe990cfde5f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 13 Oct 2021 10:04:30 +0200
Subject: [PATCH 0818/1750] Linux 5.10.73

Link: https://lore.kernel.org/r/20211011134508.362906295@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20211011153306.939942789@linuxfoundation.org
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20211012093348.134236881@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 48211c8503d4..3f62cea9afc0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 72
+SUBLEVEL = 73
 EXTRAVERSION =
 NAME = Dare mighty things
 

From d7a15e1e4fd7db751739d04141390fa6699fd870 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Fri, 16 Jul 2021 20:20:21 +0800
Subject: [PATCH 0819/1750] ext4: check and update i_disksize properly

[ Upstream commit 4df031ff5876d94b48dd9ee486ba5522382a06b2 ]

After commit 3da40c7b0898 ("ext4: only call ext4_truncate when size <=
isize"), i_disksize could always be updated to i_size in ext4_setattr(),
and we could sure that i_disksize <= i_size since holding inode lock and
if i_disksize < i_size there are delalloc writes pending in the range
upto i_size. If the end of the current write is <= i_size, there's no
need to touch i_disksize since writeback will push i_disksize upto
i_size eventually. So we can switch to check i_size instead of
i_disksize in ext4_da_write_end() when write to the end of the file.
we also could remove ext4_mark_inode_dirty() together because we defer
inode dirtying to generic_write_end() or ext4_da_write_inline_data_end().

Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210716122024.1105856-2-yi.zhang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inode.c | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 63a292db7587..f0dcc09e220b 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3090,35 +3090,37 @@ static int ext4_da_write_end(struct file *file,
 	end = start + copied - 1;
 
 	/*
-	 * generic_write_end() will run mark_inode_dirty() if i_size
-	 * changes.  So let's piggyback the i_disksize mark_inode_dirty
-	 * into that.
+	 * Since we are holding inode lock, we are sure i_disksize <=
+	 * i_size. We also know that if i_disksize < i_size, there are
+	 * delalloc writes pending in the range upto i_size. If the end of
+	 * the current write is <= i_size, there's no need to touch
+	 * i_disksize since writeback will push i_disksize upto i_size
+	 * eventually. If the end of the current write is > i_size and
+	 * inside an allocated block (ext4_da_should_update_i_disksize()
+	 * check), we need to update i_disksize here as neither
+	 * ext4_writepage() nor certain ext4_writepages() paths not
+	 * allocating blocks update i_disksize.
+	 *
+	 * Note that we defer inode dirtying to generic_write_end() /
+	 * ext4_da_write_inline_data_end().
 	 */
 	new_i_size = pos + copied;
-	if (copied && new_i_size > EXT4_I(inode)->i_disksize) {
+	if (copied && new_i_size > inode->i_size) {
 		if (ext4_has_inline_data(inode) ||
-		    ext4_da_should_update_i_disksize(page, end)) {
+		    ext4_da_should_update_i_disksize(page, end))
 			ext4_update_i_disksize(inode, new_i_size);
-			/* We need to mark inode dirty even if
-			 * new_i_size is less that inode->i_size
-			 * bu greater than i_disksize.(hint delalloc)
-			 */
-			ret = ext4_mark_inode_dirty(handle, inode);
-		}
 	}
 
 	if (write_mode != CONVERT_INLINE_DATA &&
 	    ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) &&
 	    ext4_has_inline_data(inode))
-		ret2 = ext4_da_write_inline_data_end(inode, pos, len, copied,
+		ret = ext4_da_write_inline_data_end(inode, pos, len, copied,
 						     page);
 	else
-		ret2 = generic_write_end(file, mapping, pos, len, copied,
+		ret = generic_write_end(file, mapping, pos, len, copied,
 							page, fsdata);
 
-	copied = ret2;
-	if (ret2 < 0)
-		ret = ret2;
+	copied = ret;
 	ret2 = ext4_journal_stop(handle);
 	if (unlikely(ret2 && !ret))
 		ret = ret2;

From 14cbfeeee41b83167bc308f01983618cc5851b53 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Fri, 16 Jul 2021 20:20:22 +0800
Subject: [PATCH 0820/1750] ext4: correct the error path of
 ext4_write_inline_data_end()

[ Upstream commit 55ce2f649b9e88111270333a8127e23f4f8f42d7 ]

Current error path of ext4_write_inline_data_end() is not correct.

Firstly, it should pass out the error value if ext4_get_inode_loc()
return fail, or else it could trigger infinite loop if we inject error
here. And then it's better to add inode to orphan list if it return fail
in ext4_journal_stop(), otherwise we could not restore inline xattr
entry after power failure. Finally, we need to reset the 'ret' value if
ext4_write_inline_data_end() return success in ext4_write_end() and
ext4_journalled_write_end(), otherwise we could not get the error return
value of ext4_journal_stop().

Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210716122024.1105856-3-yi.zhang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ext4/inline.c | 15 +++++----------
 fs/ext4/inode.c  |  7 +++++--
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
index 0f7b53d5edea..a96b688a0410 100644
--- a/fs/ext4/inline.c
+++ b/fs/ext4/inline.c
@@ -733,18 +733,13 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
 	void *kaddr;
 	struct ext4_iloc iloc;
 
-	if (unlikely(copied < len)) {
-		if (!PageUptodate(page)) {
-			copied = 0;
-			goto out;
-		}
-	}
+	if (unlikely(copied < len) && !PageUptodate(page))
+		return 0;
 
 	ret = ext4_get_inode_loc(inode, &iloc);
 	if (ret) {
 		ext4_std_error(inode->i_sb, ret);
-		copied = 0;
-		goto out;
+		return ret;
 	}
 
 	ext4_write_lock_xattr(inode, &no_expand);
@@ -757,7 +752,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
 	(void) ext4_find_inline_data_nolock(inode);
 
 	kaddr = kmap_atomic(page);
-	ext4_write_inline_data(inode, &iloc, kaddr, pos, len);
+	ext4_write_inline_data(inode, &iloc, kaddr, pos, copied);
 	kunmap_atomic(kaddr);
 	SetPageUptodate(page);
 	/* clear page dirty so that writepages wouldn't work for us. */
@@ -766,7 +761,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len,
 	ext4_write_unlock_xattr(inode, &no_expand);
 	brelse(iloc.bh);
 	mark_inode_dirty(inode);
-out:
+
 	return copied;
 }
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index f0dcc09e220b..317aa1b90fb9 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1296,6 +1296,7 @@ static int ext4_write_end(struct file *file,
 			goto errout;
 		}
 		copied = ret;
+		ret = 0;
 	} else
 		copied = block_write_end(file, mapping, pos,
 					 len, copied, page, fsdata);
@@ -1322,13 +1323,14 @@ static int ext4_write_end(struct file *file,
 	if (i_size_changed || inline_data)
 		ret = ext4_mark_inode_dirty(handle, inode);
 
+errout:
 	if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode))
 		/* if we have allocated more blocks and copied
 		 * less. We will have blocks allocated outside
 		 * inode->i_size. So truncate them
 		 */
 		ext4_orphan_add(handle, inode);
-errout:
+
 	ret2 = ext4_journal_stop(handle);
 	if (!ret)
 		ret = ret2;
@@ -1411,6 +1413,7 @@ static int ext4_journalled_write_end(struct file *file,
 			goto errout;
 		}
 		copied = ret;
+		ret = 0;
 	} else if (unlikely(copied < len) && !PageUptodate(page)) {
 		copied = 0;
 		ext4_journalled_zero_new_buffers(handle, page, from, to);
@@ -1440,6 +1443,7 @@ static int ext4_journalled_write_end(struct file *file,
 			ret = ret2;
 	}
 
+errout:
 	if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode))
 		/* if we have allocated more blocks and copied
 		 * less. We will have blocks allocated outside
@@ -1447,7 +1451,6 @@ static int ext4_journalled_write_end(struct file *file,
 		 */
 		ext4_orphan_add(handle, inode);
 
-errout:
 	ret2 = ext4_journal_stop(handle);
 	if (!ret)
 		ret = ret2;

From 0bcfa99e8faeef75567e6d3a5ac9680d28240b21 Mon Sep 17 00:00:00 2001
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Date: Tue, 7 Sep 2021 13:44:36 -0500
Subject: [PATCH 0821/1750] ASoC: Intel: sof_sdw: tag SoundWire BEs as
 non-atomic

[ Upstream commit 58eafe1ff52ee1ce255759fc15729519af180cbb ]

The SoundWire BEs make use of 'stream' functions for .prepare and
.trigger. These functions will in turn force a Bank Switch, which
implies a wait operation.

Mark SoundWire BEs as nonatomic for consistency, but keep all other
types of BEs as is. The initialization of .nonatomic is done outside
of the create_sdw_dailink helper to avoid adding more parameters to
deal with a single exception to the rule that BEs are atomic.

Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Bard Liao <bard.liao@intel.com>
Link: https://lore.kernel.org/r/20210907184436.33152-1-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/boards/sof_sdw.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
index 2770e8179983..25548555d8d7 100644
--- a/sound/soc/intel/boards/sof_sdw.c
+++ b/sound/soc/intel/boards/sof_sdw.c
@@ -847,6 +847,11 @@ static int create_sdw_dailink(struct device *dev, int *be_index,
 			      cpus + *cpu_id, cpu_dai_num,
 			      codecs, codec_num,
 			      NULL, &sdw_ops);
+		/*
+		 * SoundWire DAILINKs use 'stream' functions and Bank Switch operations
+		 * based on wait_for_completion(), tag them as 'nonatomic'.
+		 */
+		dai_links[*be_index].nonatomic = true;
 
 		ret = set_codec_init_func(link, dai_links + (*be_index)++,
 					  playback, group_id);

From ddf026d6ae9aa6ba188800c9e3f2e79ec1597a67 Mon Sep 17 00:00:00 2001
From: Mizuho Mori <morimolymoly@gmail.com>
Date: Thu, 29 Jul 2021 20:03:25 +0900
Subject: [PATCH 0822/1750] HID: apple: Fix logical maximum and usage maximum
 of Magic Keyboard JIS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 67fd71ba16a37c663d139f5ba5296f344d80d072 ]

Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong.

Below is a report descriptor.

0x05, 0x01,         /*  Usage Page (Desktop),                           */
0x09, 0x06,         /*  Usage (Keyboard),                               */
0xA1, 0x01,         /*  Collection (Application),                       */
0x85, 0x01,         /*      Report ID (1),                              */
0x05, 0x07,         /*      Usage Page (Keyboard),                      */
0x15, 0x00,         /*      Logical Minimum (0),                        */
0x25, 0x01,         /*      Logical Maximum (1),                        */
0x19, 0xE0,         /*      Usage Minimum (KB Leftcontrol),             */
0x29, 0xE7,         /*      Usage Maximum (KB Right GUI),               */
0x75, 0x01,         /*      Report Size (1),                            */
0x95, 0x08,         /*      Report Count (8),                           */
0x81, 0x02,         /*      Input (Variable),                           */
0x95, 0x05,         /*      Report Count (5),                           */
0x75, 0x01,         /*      Report Size (1),                            */
0x05, 0x08,         /*      Usage Page (LED),                           */
0x19, 0x01,         /*      Usage Minimum (01h),                        */
0x29, 0x05,         /*      Usage Maximum (05h),                        */
0x91, 0x02,         /*      Output (Variable),                          */
0x95, 0x01,         /*      Report Count (1),                           */
0x75, 0x03,         /*      Report Size (3),                            */
0x91, 0x03,         /*      Output (Constant, Variable),                */
0x95, 0x08,         /*      Report Count (8),                           */
0x75, 0x01,         /*      Report Size (1),                            */
0x15, 0x00,         /*      Logical Minimum (0),                        */
0x25, 0x01,         /*      Logical Maximum (1),                        */

here is a report descriptor which is parsed one in kernel.
see sys/kernel/debug/hid/<dev>/rdesc

05 01 09 06 a1 01 85 01 05 07
15 00 25 01 19 e0 29 e7 75 01
95 08 81 02 95 05 75 01 05 08
19 01 29 05 91 02 95 01 75 03
91 03 95 08 75 01 15 00 25 01
06 00 ff 09 03 81 03 95 06 75
08 15 00 25 [65] 05 07 19 00 29
[65] 81 00 95 01 75 01 15 00 25
01 05 0c 09 b8 81 02 95 01 75
01 06 01 ff 09 03 81 02 95 01
75 06 81 03 06 02 ff 09 55 85
55 15 00 26 ff 00 75 08 95 40
b1 a2 c0 06 00 ff 09 14 a1 01
85 90 05 84 75 01 95 03 15 00
25 01 09 61 05 85 09 44 09 46
81 02 95 05 81 01 75 08 95 01
15 00 26 ff 00 09 65 81 02 c0
00

Position 64(Logical Maximum) and 70(Usage Maximum) are 101.
Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support.
position 117 is also 101 but not related(it is Usage 65h).

There are no difference of product id between JIS and ANSI.
They are same 0x0267.

Signed-off-by: Mizuho Mori <morimolymoly@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-apple.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
index 6b8f0d004d34..5c1d33cda863 100644
--- a/drivers/hid/hid-apple.c
+++ b/drivers/hid/hid-apple.c
@@ -322,12 +322,19 @@ static int apple_event(struct hid_device *hdev, struct hid_field *field,
 
 /*
  * MacBook JIS keyboard has wrong logical maximum
+ * Magic Keyboard JIS has wrong logical maximum
  */
 static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,
 		unsigned int *rsize)
 {
 	struct apple_sc *asc = hid_get_drvdata(hdev);
 
+	if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) {
+		hid_info(hdev,
+			 "fixing up Magic Keyboard JIS report descriptor\n");
+		rdesc[64] = rdesc[70] = 0xe7;
+	}
+
 	if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 &&
 			rdesc[53] == 0x65 && rdesc[59] == 0x65) {
 		hid_info(hdev,

From ddc4ba737bcb31c227192af4e194ec0f01516700 Mon Sep 17 00:00:00 2001
From: Jeremy Sowden <jeremy@azazel.net>
Date: Sun, 12 Sep 2021 22:24:33 +0100
Subject: [PATCH 0823/1750] netfilter: ip6_tables: zero-initialize fragment
 offset

[ Upstream commit 310e2d43c3ad429c1fba4b175806cf1f55ed73a6 ]

ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is
specified (`-p tcp`, for example).  However, if the flag is not set,
`ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which
case the fragment offset is left uninitialized and a garbage value is
passed to each matcher.

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/netfilter/ip6_tables.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index eb2b5404806c..d36168baf677 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -273,6 +273,7 @@ ip6t_do_table(struct sk_buff *skb,
 	 * things we don't know, ie. tcp syn flag or ports).  If the
 	 * rule is also a fragment-specific rule, non-fragments won't
 	 * match it. */
+	acpar.fragoff = 0;
 	acpar.hotdrop = false;
 	acpar.state   = state;
 

From f6952b1e22c2de8f23d59f944b0f17cb2733a846 Mon Sep 17 00:00:00 2001
From: Joshua-Dickens <Joshua@Joshua-Dickens.com>
Date: Tue, 14 Sep 2021 13:28:25 -0400
Subject: [PATCH 0824/1750] HID: wacom: Add new Intuos BT
 (CTL-4100WL/CTL-6100WL) device IDs

[ Upstream commit 0c8fbaa553077630e8eae45bd9676cfc01836aeb ]

Add the new PIDs to wacom_wac.c to support the new models in the Intuos series.

[jkosina@suse.cz: fix changelog]
Signed-off-by: Joshua Dickens <joshua.dickens@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/wacom_wac.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 4228ddc3df0e..b2719cf37aa5 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -4715,6 +4715,12 @@ static const struct wacom_features wacom_features_0x393 =
 	{ "Wacom Intuos Pro S", 31920, 19950, 8191, 63,
 	  INTUOSP2S_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 7,
 	  .touch_max = 10 };
+static const struct wacom_features wacom_features_0x3c6 =
+	{ "Wacom Intuos BT S", 15200, 9500, 4095, 63,
+	  INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 };
+static const struct wacom_features wacom_features_0x3c8 =
+	{ "Wacom Intuos BT M", 21600, 13500, 4095, 63,
+	  INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 };
 
 static const struct wacom_features wacom_features_HID_ANY_ID =
 	{ "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID };
@@ -4888,6 +4894,8 @@ const struct hid_device_id wacom_ids[] = {
 	{ USB_DEVICE_WACOM(0x37A) },
 	{ USB_DEVICE_WACOM(0x37B) },
 	{ BT_DEVICE_WACOM(0x393) },
+	{ BT_DEVICE_WACOM(0x3c6) },
+	{ BT_DEVICE_WACOM(0x3c8) },
 	{ USB_DEVICE_WACOM(0x4001) },
 	{ USB_DEVICE_WACOM(0x4004) },
 	{ USB_DEVICE_WACOM(0x5000) },

From bcb647c1e15d3ddd8ab94d556aa38d77448b40d9 Mon Sep 17 00:00:00 2001
From: Marc Herbert <marc.herbert@intel.com>
Date: Thu, 16 Sep 2021 11:50:08 +0300
Subject: [PATCH 0825/1750] ASoC: SOF: loader: release_firmware() on load
 failure to avoid batching

[ Upstream commit 8a8e1813ffc35111fc0b6db49968ceb0e1615ced ]

Invoke release_firmware() when the firmware fails to boot in
sof_probe_continue().

The request_firmware() framework must be informed of failures in
sof_probe_continue() otherwise its internal "batching"
feature (different from caching) cached the firmware image
forever. Attempts to correct the file in /lib/firmware/ were then
silently and confusingly ignored until the next reboot. Unloading the
drivers did not help because from their disconnected perspective the
firmware had failed so there was nothing to release.

Also leverage the new snd_sof_fw_unload() function to simplify the
snd_sof_device_remove() function.

Signed-off-by: Marc Herbert <marc.herbert@intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20210916085008.28929-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/core.c   | 4 +---
 sound/soc/sof/loader.c | 2 ++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c
index adc7c37145d6..feced9077dfe 100644
--- a/sound/soc/sof/core.c
+++ b/sound/soc/sof/core.c
@@ -354,7 +354,6 @@ int snd_sof_device_remove(struct device *dev)
 			dev_warn(dev, "error: %d failed to prepare DSP for device removal",
 				 ret);
 
-		snd_sof_fw_unload(sdev);
 		snd_sof_ipc_free(sdev);
 		snd_sof_free_debug(sdev);
 		snd_sof_free_trace(sdev);
@@ -377,8 +376,7 @@ int snd_sof_device_remove(struct device *dev)
 		snd_sof_remove(sdev);
 
 	/* release firmware */
-	release_firmware(pdata->fw);
-	pdata->fw = NULL;
+	snd_sof_fw_unload(sdev);
 
 	return 0;
 }
diff --git a/sound/soc/sof/loader.c b/sound/soc/sof/loader.c
index ba9ed66f98bc..2d5c3fc93bc5 100644
--- a/sound/soc/sof/loader.c
+++ b/sound/soc/sof/loader.c
@@ -830,5 +830,7 @@ EXPORT_SYMBOL(snd_sof_run_firmware);
 void snd_sof_fw_unload(struct snd_sof_dev *sdev)
 {
 	/* TODO: support module unloading at runtime */
+	release_firmware(sdev->pdata->fw);
+	sdev->pdata->fw = NULL;
 }
 EXPORT_SYMBOL(snd_sof_fw_unload);

From 5182d6db80bb2f08a7d700c5c4b8c3d0db58411c Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 15 Sep 2021 16:46:38 +0200
Subject: [PATCH 0826/1750] netfilter: nf_nat_masquerade: make async
 masq_inet6_event handling generic

[ Upstream commit 30db406923b9285a9bac06a6af5e74bd6d0f1d06 ]

masq_inet6_event is called asynchronously from system work queue,
because the inet6 notifier is atomic and nf_iterate_cleanup can sleep.

The ipv4 and device notifiers call nf_iterate_cleanup directly.

This is legal, but these notifiers are called with RTNL mutex held.
A large conntrack table with many devices coming and going will have severe
impact on the system usability, with 'ip a' blocking for several seconds.

This change places the defer code into a helper and makes it more
generic so ipv4 and ifdown notifiers can be converted to defer the
cleanup walk as well in a follow patch.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_nat_masquerade.c | 122 ++++++++++++++++++------------
 1 file changed, 75 insertions(+), 47 deletions(-)

diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c
index 8e8a65d46345..415919a6ac1a 100644
--- a/net/netfilter/nf_nat_masquerade.c
+++ b/net/netfilter/nf_nat_masquerade.c
@@ -9,8 +9,19 @@
 
 #include <net/netfilter/nf_nat_masquerade.h>
 
+struct masq_dev_work {
+	struct work_struct work;
+	struct net *net;
+	union nf_inet_addr addr;
+	int ifindex;
+	int (*iter)(struct nf_conn *i, void *data);
+};
+
+#define MAX_MASQ_WORKER_COUNT	16
+
 static DEFINE_MUTEX(masq_mutex);
 static unsigned int masq_refcnt __read_mostly;
+static atomic_t masq_worker_count __read_mostly;
 
 unsigned int
 nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
@@ -63,6 +74,63 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);
 
+static void iterate_cleanup_work(struct work_struct *work)
+{
+	struct masq_dev_work *w;
+
+	w = container_of(work, struct masq_dev_work, work);
+
+	nf_ct_iterate_cleanup_net(w->net, w->iter, (void *)w, 0, 0);
+
+	put_net(w->net);
+	kfree(w);
+	atomic_dec(&masq_worker_count);
+	module_put(THIS_MODULE);
+}
+
+/* Iterate conntrack table in the background and remove conntrack entries
+ * that use the device/address being removed.
+ *
+ * In case too many work items have been queued already or memory allocation
+ * fails iteration is skipped, conntrack entries will time out eventually.
+ */
+static void nf_nat_masq_schedule(struct net *net, union nf_inet_addr *addr,
+				 int ifindex,
+				 int (*iter)(struct nf_conn *i, void *data),
+				 gfp_t gfp_flags)
+{
+	struct masq_dev_work *w;
+
+	if (atomic_read(&masq_worker_count) > MAX_MASQ_WORKER_COUNT)
+		return;
+
+	net = maybe_get_net(net);
+	if (!net)
+		return;
+
+	if (!try_module_get(THIS_MODULE))
+		goto err_module;
+
+	w = kzalloc(sizeof(*w), gfp_flags);
+	if (w) {
+		/* We can overshoot MAX_MASQ_WORKER_COUNT, no big deal */
+		atomic_inc(&masq_worker_count);
+
+		INIT_WORK(&w->work, iterate_cleanup_work);
+		w->ifindex = ifindex;
+		w->net = net;
+		w->iter = iter;
+		if (addr)
+			w->addr = *addr;
+		schedule_work(&w->work);
+		return;
+	}
+
+	module_put(THIS_MODULE);
+ err_module:
+	put_net(net);
+}
+
 static int device_cmp(struct nf_conn *i, void *ifindex)
 {
 	const struct nf_conn_nat *nat = nfct_nat(i);
@@ -136,8 +204,6 @@ static struct notifier_block masq_inet_notifier = {
 };
 
 #if IS_ENABLED(CONFIG_IPV6)
-static atomic_t v6_worker_count __read_mostly;
-
 static int
 nat_ipv6_dev_get_saddr(struct net *net, const struct net_device *dev,
 		       const struct in6_addr *daddr, unsigned int srcprefs,
@@ -187,13 +253,6 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6);
 
-struct masq_dev_work {
-	struct work_struct work;
-	struct net *net;
-	struct in6_addr addr;
-	int ifindex;
-};
-
 static int inet6_cmp(struct nf_conn *ct, void *work)
 {
 	struct masq_dev_work *w = (struct masq_dev_work *)work;
@@ -204,21 +263,7 @@ static int inet6_cmp(struct nf_conn *ct, void *work)
 
 	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 
-	return ipv6_addr_equal(&w->addr, &tuple->dst.u3.in6);
-}
-
-static void iterate_cleanup_work(struct work_struct *work)
-{
-	struct masq_dev_work *w;
-
-	w = container_of(work, struct masq_dev_work, work);
-
-	nf_ct_iterate_cleanup_net(w->net, inet6_cmp, (void *)w, 0, 0);
-
-	put_net(w->net);
-	kfree(w);
-	atomic_dec(&v6_worker_count);
-	module_put(THIS_MODULE);
+	return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3);
 }
 
 /* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep).
@@ -233,36 +278,19 @@ static int masq_inet6_event(struct notifier_block *this,
 {
 	struct inet6_ifaddr *ifa = ptr;
 	const struct net_device *dev;
-	struct masq_dev_work *w;
-	struct net *net;
+	union nf_inet_addr addr;
 
-	if (event != NETDEV_DOWN || atomic_read(&v6_worker_count) >= 16)
+	if (event != NETDEV_DOWN)
 		return NOTIFY_DONE;
 
 	dev = ifa->idev->dev;
-	net = maybe_get_net(dev_net(dev));
-	if (!net)
-		return NOTIFY_DONE;
 
-	if (!try_module_get(THIS_MODULE))
-		goto err_module;
+	memset(&addr, 0, sizeof(addr));
 
-	w = kmalloc(sizeof(*w), GFP_ATOMIC);
-	if (w) {
-		atomic_inc(&v6_worker_count);
+	addr.in6 = ifa->addr;
 
-		INIT_WORK(&w->work, iterate_cleanup_work);
-		w->ifindex = dev->ifindex;
-		w->net = net;
-		w->addr = ifa->addr;
-		schedule_work(&w->work);
-
-		return NOTIFY_DONE;
-	}
-
-	module_put(THIS_MODULE);
- err_module:
-	put_net(net);
+	nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet6_cmp,
+			     GFP_ATOMIC);
 	return NOTIFY_DONE;
 }
 

From 9ec9a975ea374f8290265ad1e4447df73ffb0ecc Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 15 Sep 2021 16:46:39 +0200
Subject: [PATCH 0827/1750] netfilter: nf_nat_masquerade: defer conntrack walk
 to work queue

[ Upstream commit 7970a19b71044bf4dc2c1becc200275bdf1884d4 ]

The ipv4 and device notifiers are called with RTNL mutex held.
The table walk can take some time, better not block other RTNL users.

'ip a' has been reported to block for up to 20 seconds when conntrack table
has many entries and device down events are frequent (e.g., PPP).

Reported-and-tested-by: Martin Zaharinov <micron10@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_nat_masquerade.c | 50 +++++++++++++++----------------
 1 file changed, 24 insertions(+), 26 deletions(-)

diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c
index 415919a6ac1a..acd73f717a08 100644
--- a/net/netfilter/nf_nat_masquerade.c
+++ b/net/netfilter/nf_nat_masquerade.c
@@ -131,13 +131,14 @@ static void nf_nat_masq_schedule(struct net *net, union nf_inet_addr *addr,
 	put_net(net);
 }
 
-static int device_cmp(struct nf_conn *i, void *ifindex)
+static int device_cmp(struct nf_conn *i, void *arg)
 {
 	const struct nf_conn_nat *nat = nfct_nat(i);
+	const struct masq_dev_work *w = arg;
 
 	if (!nat)
 		return 0;
-	return nat->masq_index == (int)(long)ifindex;
+	return nat->masq_index == w->ifindex;
 }
 
 static int masq_device_event(struct notifier_block *this,
@@ -153,8 +154,8 @@ static int masq_device_event(struct notifier_block *this,
 		 * and forget them.
 		 */
 
-		nf_ct_iterate_cleanup_net(net, device_cmp,
-					  (void *)(long)dev->ifindex, 0, 0);
+		nf_nat_masq_schedule(net, NULL, dev->ifindex,
+				     device_cmp, GFP_KERNEL);
 	}
 
 	return NOTIFY_DONE;
@@ -162,35 +163,45 @@ static int masq_device_event(struct notifier_block *this,
 
 static int inet_cmp(struct nf_conn *ct, void *ptr)
 {
-	struct in_ifaddr *ifa = (struct in_ifaddr *)ptr;
-	struct net_device *dev = ifa->ifa_dev->dev;
 	struct nf_conntrack_tuple *tuple;
+	struct masq_dev_work *w = ptr;
 
-	if (!device_cmp(ct, (void *)(long)dev->ifindex))
+	if (!device_cmp(ct, ptr))
 		return 0;
 
 	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 
-	return ifa->ifa_address == tuple->dst.u3.ip;
+	return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3);
 }
 
 static int masq_inet_event(struct notifier_block *this,
 			   unsigned long event,
 			   void *ptr)
 {
-	struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
-	struct net *net = dev_net(idev->dev);
+	const struct in_ifaddr *ifa = ptr;
+	const struct in_device *idev;
+	const struct net_device *dev;
+	union nf_inet_addr addr;
+
+	if (event != NETDEV_DOWN)
+		return NOTIFY_DONE;
 
 	/* The masq_dev_notifier will catch the case of the device going
 	 * down.  So if the inetdev is dead and being destroyed we have
 	 * no work to do.  Otherwise this is an individual address removal
 	 * and we have to perform the flush.
 	 */
+	idev = ifa->ifa_dev;
 	if (idev->dead)
 		return NOTIFY_DONE;
 
-	if (event == NETDEV_DOWN)
-		nf_ct_iterate_cleanup_net(net, inet_cmp, ptr, 0, 0);
+	memset(&addr, 0, sizeof(addr));
+
+	addr.ip = ifa->ifa_address;
+
+	dev = idev->dev;
+	nf_nat_masq_schedule(dev_net(idev->dev), &addr, dev->ifindex,
+			     inet_cmp, GFP_KERNEL);
 
 	return NOTIFY_DONE;
 }
@@ -253,19 +264,6 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range,
 }
 EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6);
 
-static int inet6_cmp(struct nf_conn *ct, void *work)
-{
-	struct masq_dev_work *w = (struct masq_dev_work *)work;
-	struct nf_conntrack_tuple *tuple;
-
-	if (!device_cmp(ct, (void *)(long)w->ifindex))
-		return 0;
-
-	tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
-
-	return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3);
-}
-
 /* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep).
  *
  * Defer it to the system workqueue.
@@ -289,7 +287,7 @@ static int masq_inet6_event(struct notifier_block *this,
 
 	addr.in6 = ifa->addr;
 
-	nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet6_cmp,
+	nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet_cmp,
 			     GFP_ATOMIC);
 	return NOTIFY_DONE;
 }

From 977aee58142a19ccf9ef8fe56f1430e2ef99931f Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Fri, 27 Aug 2021 22:42:30 +0800
Subject: [PATCH 0828/1750] mac80211: Drop frames from invalid MAC address in
 ad-hoc mode

[ Upstream commit a6555f844549cd190eb060daef595f94d3de1582 ]

WARNING: CPU: 1 PID: 9 at net/mac80211/sta_info.c:554
sta_info_insert_rcu+0x121/0x12a0
Modules linked in:
CPU: 1 PID: 9 Comm: kworker/u8:1 Not tainted 5.14.0-rc7+ #253
Workqueue: phy3 ieee80211_iface_work
RIP: 0010:sta_info_insert_rcu+0x121/0x12a0
...
Call Trace:
 ieee80211_ibss_finish_sta+0xbc/0x170
 ieee80211_ibss_work+0x13f/0x7d0
 ieee80211_iface_work+0x37a/0x500
 process_one_work+0x357/0x850
 worker_thread+0x41/0x4d0

If an Ad-Hoc node receives packets with invalid source MAC address,
it hits a WARN_ON in sta_info_insert_check(), this can spam the log.

Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Link: https://lore.kernel.org/r/20210827144230.39944-1-yuehaibing@huawei.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/rx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 38b5695c2a0c..b7979c0bffd0 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -4064,7 +4064,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
 		if (!bssid)
 			return false;
 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
-		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
+		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
+		    !is_valid_ether_addr(hdr->addr2))
 			return false;
 		if (ieee80211_is_beacon(hdr->frame_control))
 			return true;

From 194e8a4f0acd8a9d2915fd5fb8249e2797393078 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sun, 25 Jul 2021 17:19:00 +0000
Subject: [PATCH 0829/1750] m68k: Handle arrivals of multiple signals correctly

[ Upstream commit 4bb0bd81ce5e97092dfda6a106d414b703ec0ee8 ]

When we have several pending signals, have entered with the kernel
with large exception frame *and* have already built at least one
sigframe, regs->stkadj is going to be non-zero and regs->format/sr/pc
are going to be junk - the real values are in shifted exception stack
frame we'd built when putting together the first sigframe.

If that happens, subsequent sigframes are going to be garbage.
Not hard to fix - just need to find the "adjusted" frame first
and look for format/vector/sr/pc in it.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Michael Schmitz <schmitzmic@gmail.com>
Tested-by: Finn Thain <fthain@linux-m68k.org>
Link: https://lore.kernel.org/r/YP2dBIAPTaVvHiZ6@zeniv-ca.linux.org.uk
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/kernel/signal.c | 88 +++++++++++++++++++--------------------
 1 file changed, 42 insertions(+), 46 deletions(-)

diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c
index 46f91e0f6a08..fd916844a683 100644
--- a/arch/m68k/kernel/signal.c
+++ b/arch/m68k/kernel/signal.c
@@ -447,7 +447,7 @@ static inline void save_fpu_state(struct sigcontext *sc, struct pt_regs *regs)
 
 	if (CPU_IS_060 ? sc->sc_fpstate[2] : sc->sc_fpstate[0]) {
 		fpu_version = sc->sc_fpstate[0];
-		if (CPU_IS_020_OR_030 &&
+		if (CPU_IS_020_OR_030 && !regs->stkadj &&
 		    regs->vector >= (VEC_FPBRUC * 4) &&
 		    regs->vector <= (VEC_FPNAN * 4)) {
 			/* Clear pending exception in 68882 idle frame */
@@ -510,7 +510,7 @@ static inline int rt_save_fpu_state(struct ucontext __user *uc, struct pt_regs *
 		if (!(CPU_IS_060 || CPU_IS_COLDFIRE))
 			context_size = fpstate[1];
 		fpu_version = fpstate[0];
-		if (CPU_IS_020_OR_030 &&
+		if (CPU_IS_020_OR_030 && !regs->stkadj &&
 		    regs->vector >= (VEC_FPBRUC * 4) &&
 		    regs->vector <= (VEC_FPNAN * 4)) {
 			/* Clear pending exception in 68882 idle frame */
@@ -828,18 +828,24 @@ asmlinkage int do_rt_sigreturn(struct pt_regs *regs, struct switch_stack *sw)
 	return 0;
 }
 
+static inline struct pt_regs *rte_regs(struct pt_regs *regs)
+{
+	return (void *)regs + regs->stkadj;
+}
+
 static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
 			     unsigned long mask)
 {
+	struct pt_regs *tregs = rte_regs(regs);
 	sc->sc_mask = mask;
 	sc->sc_usp = rdusp();
 	sc->sc_d0 = regs->d0;
 	sc->sc_d1 = regs->d1;
 	sc->sc_a0 = regs->a0;
 	sc->sc_a1 = regs->a1;
-	sc->sc_sr = regs->sr;
-	sc->sc_pc = regs->pc;
-	sc->sc_formatvec = regs->format << 12 | regs->vector;
+	sc->sc_sr = tregs->sr;
+	sc->sc_pc = tregs->pc;
+	sc->sc_formatvec = tregs->format << 12 | tregs->vector;
 	save_a5_state(sc, regs);
 	save_fpu_state(sc, regs);
 }
@@ -847,6 +853,7 @@ static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs,
 static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *regs)
 {
 	struct switch_stack *sw = (struct switch_stack *)regs - 1;
+	struct pt_regs *tregs = rte_regs(regs);
 	greg_t __user *gregs = uc->uc_mcontext.gregs;
 	int err = 0;
 
@@ -867,9 +874,9 @@ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *
 	err |= __put_user(sw->a5, &gregs[13]);
 	err |= __put_user(sw->a6, &gregs[14]);
 	err |= __put_user(rdusp(), &gregs[15]);
-	err |= __put_user(regs->pc, &gregs[16]);
-	err |= __put_user(regs->sr, &gregs[17]);
-	err |= __put_user((regs->format << 12) | regs->vector, &uc->uc_formatvec);
+	err |= __put_user(tregs->pc, &gregs[16]);
+	err |= __put_user(tregs->sr, &gregs[17]);
+	err |= __put_user((tregs->format << 12) | tregs->vector, &uc->uc_formatvec);
 	err |= rt_save_fpu_state(uc, regs);
 	return err;
 }
@@ -886,13 +893,14 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
 			struct pt_regs *regs)
 {
 	struct sigframe __user *frame;
-	int fsize = frame_extra_sizes(regs->format);
+	struct pt_regs *tregs = rte_regs(regs);
+	int fsize = frame_extra_sizes(tregs->format);
 	struct sigcontext context;
 	int err = 0, sig = ksig->sig;
 
 	if (fsize < 0) {
 		pr_debug("setup_frame: Unknown frame format %#x\n",
-			 regs->format);
+			 tregs->format);
 		return -EFAULT;
 	}
 
@@ -903,7 +911,7 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
 
 	err |= __put_user(sig, &frame->sig);
 
-	err |= __put_user(regs->vector, &frame->code);
+	err |= __put_user(tregs->vector, &frame->code);
 	err |= __put_user(&frame->sc, &frame->psc);
 
 	if (_NSIG_WORDS > 1)
@@ -929,34 +937,28 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set,
 
 	push_cache ((unsigned long) &frame->retcode);
 
-	/*
-	 * Set up registers for signal handler.  All the state we are about
-	 * to destroy is successfully copied to sigframe.
-	 */
-	wrusp ((unsigned long) frame);
-	regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
-	adjustformat(regs);
-
 	/*
 	 * This is subtle; if we build more than one sigframe, all but the
 	 * first one will see frame format 0 and have fsize == 0, so we won't
 	 * screw stkadj.
 	 */
-	if (fsize)
+	if (fsize) {
 		regs->stkadj = fsize;
-
-	/* Prepare to skip over the extra stuff in the exception frame.  */
-	if (regs->stkadj) {
-		struct pt_regs *tregs =
-			(struct pt_regs *)((ulong)regs + regs->stkadj);
+		tregs = rte_regs(regs);
 		pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
-		/* This must be copied with decreasing addresses to
-                   handle overlaps.  */
 		tregs->vector = 0;
 		tregs->format = 0;
-		tregs->pc = regs->pc;
 		tregs->sr = regs->sr;
 	}
+
+	/*
+	 * Set up registers for signal handler.  All the state we are about
+	 * to destroy is successfully copied to sigframe.
+	 */
+	wrusp ((unsigned long) frame);
+	tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
+	adjustformat(regs);
+
 	return 0;
 }
 
@@ -964,7 +966,8 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
 			   struct pt_regs *regs)
 {
 	struct rt_sigframe __user *frame;
-	int fsize = frame_extra_sizes(regs->format);
+	struct pt_regs *tregs = rte_regs(regs);
+	int fsize = frame_extra_sizes(tregs->format);
 	int err = 0, sig = ksig->sig;
 
 	if (fsize < 0) {
@@ -1014,34 +1017,27 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
 
 	push_cache ((unsigned long) &frame->retcode);
 
-	/*
-	 * Set up registers for signal handler.  All the state we are about
-	 * to destroy is successfully copied to sigframe.
-	 */
-	wrusp ((unsigned long) frame);
-	regs->pc = (unsigned long) ksig->ka.sa.sa_handler;
-	adjustformat(regs);
-
 	/*
 	 * This is subtle; if we build more than one sigframe, all but the
 	 * first one will see frame format 0 and have fsize == 0, so we won't
 	 * screw stkadj.
 	 */
-	if (fsize)
+	if (fsize) {
 		regs->stkadj = fsize;
-
-	/* Prepare to skip over the extra stuff in the exception frame.  */
-	if (regs->stkadj) {
-		struct pt_regs *tregs =
-			(struct pt_regs *)((ulong)regs + regs->stkadj);
+		tregs = rte_regs(regs);
 		pr_debug("Performing stackadjust=%04lx\n", regs->stkadj);
-		/* This must be copied with decreasing addresses to
-                   handle overlaps.  */
 		tregs->vector = 0;
 		tregs->format = 0;
-		tregs->pc = regs->pc;
 		tregs->sr = regs->sr;
 	}
+
+	/*
+	 * Set up registers for signal handler.  All the state we are about
+	 * to destroy is successfully copied to sigframe.
+	 */
+	wrusp ((unsigned long) frame);
+	tregs->pc = (unsigned long) ksig->ka.sa.sa_handler;
+	adjustformat(regs);
 	return 0;
 }
 

From 3d68c7b0ab5b5b9fd7a2a8b13114ac0336e23a30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Thu, 23 Sep 2021 22:11:13 +0200
Subject: [PATCH 0830/1750] hwmon: (ltc2947) Properly handle errors when
 looking for the external clock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6f7d70467121f790b36af2d84bc02b5c236bf5e6 ]

The return value of devm_clk_get should in general be propagated to
upper layer. In this case the clk is optional, use the appropriate
wrapper instead of interpreting all errors as "The optional clk is not
available".

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20210923201113.398932-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/ltc2947-core.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/ltc2947-core.c b/drivers/hwmon/ltc2947-core.c
index bb3f7749a0b0..5423466de697 100644
--- a/drivers/hwmon/ltc2947-core.c
+++ b/drivers/hwmon/ltc2947-core.c
@@ -989,8 +989,12 @@ static int ltc2947_setup(struct ltc2947_data *st)
 		return ret;
 
 	/* check external clock presence */
-	extclk = devm_clk_get(st->dev, NULL);
-	if (!IS_ERR(extclk)) {
+	extclk = devm_clk_get_optional(st->dev, NULL);
+	if (IS_ERR(extclk))
+		return dev_err_probe(st->dev, PTR_ERR(extclk),
+				     "Failed to get external clock\n");
+
+	if (extclk) {
 		unsigned long rate_hz;
 		u8 pre = 0, div, tbctl;
 		u64 aux;

From bda06aff03a1fe0530a8245ef0988e5ba01ea915 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E8=B4=87?= <yun.wang@linux.alibaba.com>
Date: Fri, 24 Sep 2021 10:35:58 +0800
Subject: [PATCH 0831/1750] net: prevent user from passing illegal stab size

[ Upstream commit b193e15ac69d56f35e1d8e2b5d16cbd47764d053 ]

We observed below report when playing with netlink sock:

  UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10
  shift exponent 249 is too large for 32-bit type
  CPU: 0 PID: 685 Comm: a.out Not tainted
  Call Trace:
   dump_stack_lvl+0x8d/0xcf
   ubsan_epilogue+0xa/0x4e
   __ubsan_handle_shift_out_of_bounds+0x161/0x182
   __qdisc_calculate_pkt_len+0xf0/0x190
   __dev_queue_xmit+0x2ed/0x15b0

it seems like kernel won't check the stab log value passing from
user, and will use the insane value later to calculate pkt_len.

This patch just add a check on the size/cell_log to avoid insane
calculation.

Reported-by: Abaci <abaci@linux.alibaba.com>
Signed-off-by: Michael Wang <yun.wang@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/pkt_sched.h | 1 +
 net/sched/sch_api.c     | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 2be90a54a404..7e58b4470570 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -11,6 +11,7 @@
 #include <uapi/linux/pkt_sched.h>
 
 #define DEFAULT_TX_QUEUE_LEN	1000
+#define STAB_SIZE_LOG_MAX	30
 
 struct qdisc_walker {
 	int	stop;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 54a8c363bcdd..7b24582a8a16 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -513,6 +513,12 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt,
 		return stab;
 	}
 
+	if (s->size_log > STAB_SIZE_LOG_MAX ||
+	    s->cell_log > STAB_SIZE_LOG_MAX) {
+		NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table");
+		return ERR_PTR(-EINVAL);
+	}
+
 	stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
 	if (!stab)
 		return ERR_PTR(-ENOMEM);

From 42c871d38e3d3c2272ead31a846ad58eef66d690 Mon Sep 17 00:00:00 2001
From: MichelleJin <shjy180909@gmail.com>
Date: Mon, 27 Sep 2021 03:34:57 +0000
Subject: [PATCH 0832/1750] mac80211: check return value of rhashtable_init

[ Upstream commit 111461d573741c17eafad029ac93474fa9adcce0 ]

When rhashtable_init() fails, it returns -EINVAL.
However, since error return value of rhashtable_init is not checked,
it can cause use of uninitialized pointers.
So, fix unhandled errors of rhashtable_init.

Signed-off-by: MichelleJin <shjy180909@gmail.com>
Link: https://lore.kernel.org/r/20210927033457.1020967-4-shjy180909@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/mesh_pathtbl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 620ecf922408..870c8eafef92 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -60,7 +60,10 @@ static struct mesh_table *mesh_table_alloc(void)
 	atomic_set(&newtbl->entries,  0);
 	spin_lock_init(&newtbl->gates_lock);
 	spin_lock_init(&newtbl->walk_lock);
-	rhashtable_init(&newtbl->rhead, &mesh_rht_params);
+	if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) {
+		kfree(newtbl);
+		return NULL;
+	}
 
 	return newtbl;
 }

From db868b45324d0473db165f43a9d3730413993080 Mon Sep 17 00:00:00 2001
From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Mon, 27 Sep 2021 11:26:21 -0700
Subject: [PATCH 0833/1750] vboxfs: fix broken legacy mount signature checking

[ Upstream commit 9b3b353ef330e20bc2d99bf3165cc044cff26a09 ]

Commit 9d682ea6bcc7 ("vboxsf: Fix the check for the old binary
mount-arguments struct") was meant to fix a build error due to sign
mismatch in 'char' and the use of character constants, but it just moved
the error elsewhere, in that on some architectures characters and signed
and on others they are unsigned, and that's just how the C standard
works.

The proper fix is a simple "don't do that then".  The code was just
being silly and odd, and it should never have cared about signed vs
unsigned characters in the first place, since what it is testing is not
four "characters", but four bytes.

And the way to compare four bytes is by using "memcmp()".

Which compilers will know to just turn into a single 32-bit compare with
a constant, as long as you don't have crazy debug options enabled.

Link: https://lore.kernel.org/lkml/20210927094123.576521-1-arnd@kernel.org/
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/vboxsf/super.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/fs/vboxsf/super.c b/fs/vboxsf/super.c
index d7816c01a4f6..c578e772cbd5 100644
--- a/fs/vboxsf/super.c
+++ b/fs/vboxsf/super.c
@@ -21,10 +21,7 @@
 
 #define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */
 
-#define VBSF_MOUNT_SIGNATURE_BYTE_0 ('\000')
-#define VBSF_MOUNT_SIGNATURE_BYTE_1 ('\377')
-#define VBSF_MOUNT_SIGNATURE_BYTE_2 ('\376')
-#define VBSF_MOUNT_SIGNATURE_BYTE_3 ('\375')
+static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375";
 
 static int follow_symlinks;
 module_param(follow_symlinks, int, 0444);
@@ -386,12 +383,7 @@ static int vboxsf_setup(void)
 
 static int vboxsf_parse_monolithic(struct fs_context *fc, void *data)
 {
-	unsigned char *options = data;
-
-	if (options && options[0] == VBSF_MOUNT_SIGNATURE_BYTE_0 &&
-		       options[1] == VBSF_MOUNT_SIGNATURE_BYTE_1 &&
-		       options[2] == VBSF_MOUNT_SIGNATURE_BYTE_2 &&
-		       options[3] == VBSF_MOUNT_SIGNATURE_BYTE_3) {
+	if (data && !memcmp(data, VBSF_MOUNT_SIGNATURE, 4)) {
 		vbg_err("vboxsf: Old binary mount data not supported, remove obsolete mount.vboxsf and/or update your VBoxService.\n");
 		return -EINVAL;
 	}

From a5ba615fbeb30e9c9df62e25997c5d2011c1a400 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Mon, 27 Sep 2021 14:48:23 -0700
Subject: [PATCH 0834/1750] net: sun: SUNVNET_COMMON should depend on INET

[ Upstream commit 103bde372f084206c6972be543ecc247ebbff9f3 ]

When CONFIG_INET is not set, there are failing references to IPv4
functions, so make this driver depend on INET.

Fixes these build errors:

sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_start_xmit_common':
sunvnet_common.c:(.text+0x1a68): undefined reference to `__icmp_send'
sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_poll_common':
sunvnet_common.c:(.text+0x358c): undefined reference to `ip_send_check'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Aaron Young <aaron.young@oracle.com>
Cc: Rashmi Narasimhan <rashmi.narasimhan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sun/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/sun/Kconfig b/drivers/net/ethernet/sun/Kconfig
index 309de38a7530..b0d3f9a2950c 100644
--- a/drivers/net/ethernet/sun/Kconfig
+++ b/drivers/net/ethernet/sun/Kconfig
@@ -73,6 +73,7 @@ config CASSINI
 config SUNVNET_COMMON
 	tristate "Common routines to support Sun Virtual Networking"
 	depends on SUN_LDOMS
+	depends on INET
 	default m
 
 config SUNVNET

From 621ddffb70db824eabd63d18ac635180fe9500f9 Mon Sep 17 00:00:00 2001
From: Leslie Shi <Yuliang.Shi@amd.com>
Date: Thu, 23 Sep 2021 16:05:31 +0800
Subject: [PATCH 0835/1750] drm/amdgpu: fix gart.bo pin_count leak
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 66805763a97f8f7bdf742fc0851d85c02ed9411f ]

gmc_v{9,10}_0_gart_disable() isn't called matched with
correspoding gart_enbale function in SRIOV case. This will
lead to gart.bo pin_count leak on driver unload.

Cc: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Leslie Shi <Yuliang.Shi@amd.com>
Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 3 ++-
 drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
index dbc8b76b9b78..150fa5258fb6 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c
@@ -1018,6 +1018,8 @@ static int gmc_v10_0_hw_fini(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+	gmc_v10_0_gart_disable(adev);
+
 	if (amdgpu_sriov_vf(adev)) {
 		/* full access mode, so don't touch any GMC register */
 		DRM_DEBUG("For SRIOV client, shouldn't do anything.\n");
@@ -1026,7 +1028,6 @@ static int gmc_v10_0_hw_fini(void *handle)
 
 	amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
 	amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
-	gmc_v10_0_gart_disable(adev);
 
 	return 0;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index 3ebbddb63705..3a864041968f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -1677,6 +1677,8 @@ static int gmc_v9_0_hw_fini(void *handle)
 {
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+	gmc_v9_0_gart_disable(adev);
+
 	if (amdgpu_sriov_vf(adev)) {
 		/* full access mode, so don't touch any GMC register */
 		DRM_DEBUG("For SRIOV client, shouldn't do anything.\n");
@@ -1685,7 +1687,6 @@ static int gmc_v9_0_hw_fini(void *handle)
 
 	amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0);
 	amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0);
-	gmc_v9_0_gart_disable(adev);
 
 	return 0;
 }

From d993d1e1c4113cebe32cf56f3b4c5b9fb405274c Mon Sep 17 00:00:00 2001
From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Date: Fri, 24 Sep 2021 17:51:53 +0800
Subject: [PATCH 0836/1750] scsi: ses: Fix unsigned comparison with less than
 zero

[ Upstream commit dd689ed5aa905daf4ba4c99319a52aad6ea0a796 ]

Fix the following coccicheck warning:

./drivers/scsi/ses.c:137:10-16: WARNING: Unsigned expression compared
with zero: result > 0.

Link: https://lore.kernel.org/r/1632477113-90378-1-git-send-email-jiapeng.chong@linux.alibaba.com
Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ses.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 43e682297fd5..0a1734f34587 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -118,7 +118,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
 static int ses_send_diag(struct scsi_device *sdev, int page_code,
 			 void *buf, int bufflen)
 {
-	u32 result;
+	int result;
 
 	unsigned char cmd[] = {
 		SEND_DIAGNOSTIC,

From 57c7ca3d5592d153dd5459894ffb63f2a40ac17c Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Sat, 25 Sep 2021 00:03:30 +0100
Subject: [PATCH 0837/1750] scsi: virtio_scsi: Fix spelling mistake "Unsupport"
 -> "Unsupported"

[ Upstream commit cced4c0ec7c06f5230a2958907a409c849762293 ]

There are a couple of spelling mistakes in pr_info and pr_err messages.
Fix them.

Link: https://lore.kernel.org/r/20210924230330.143785-1-colin.king@canonical.com
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/virtio_scsi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index b9c86a7e3b97..6dac58ae6120 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -302,7 +302,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi,
 		}
 		break;
 	default:
-		pr_info("Unsupport virtio scsi event reason %x\n", event->reason);
+		pr_info("Unsupported virtio scsi event reason %x\n", event->reason);
 	}
 }
 
@@ -394,7 +394,7 @@ static void virtscsi_handle_event(struct work_struct *work)
 		virtscsi_handle_param_change(vscsi, event);
 		break;
 	default:
-		pr_err("Unsupport virtio scsi event %x\n", event->event);
+		pr_err("Unsupported virtio scsi event %x\n", event->event);
 	}
 	virtscsi_kick_event(vscsi, event_node);
 }

From bdae2a08343613782be6c5be97b6c3a1ebccbfff Mon Sep 17 00:00:00 2001
From: Song Liu <songliubraving@fb.com>
Date: Wed, 29 Sep 2021 12:43:13 -0700
Subject: [PATCH 0838/1750] perf/core: fix userpage->time_enabled of inactive
 events

[ Upstream commit f792565326825ed806626da50c6f9a928f1079c1 ]

Users of rdpmc rely on the mmapped user page to calculate accurate
time_enabled. Currently, userpage->time_enabled is only updated when the
event is added to the pmu. As a result, inactive event (due to counter
multiplexing) does not have accurate userpage->time_enabled. This can
be reproduced with something like:

   /* open 20 task perf_event "cycles", to create multiplexing */

   fd = perf_event_open();  /* open task perf_event "cycles" */
   userpage = mmap(fd);     /* use mmap and rdmpc */

   while (true) {
     time_enabled_mmap = xxx; /* use logic in perf_event_mmap_page */
     time_enabled_read = read(fd).time_enabled;
     if (time_enabled_mmap > time_enabled_read)
         BUG();
   }

Fix this by updating userpage for inactive events in merge_sched_in.

Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reported-and-tested-by: Lucian Grijincu <lucian@fb.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20210929194313.2398474-1-songliubraving@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/perf_event.h |  4 +++-
 kernel/events/core.c       | 34 ++++++++++++++++++++++++++++++----
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 072ac6c1ef2b..c095e713cf08 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -682,7 +682,9 @@ struct perf_event {
 	/*
 	 * timestamp shadows the actual context timing but it can
 	 * be safely used in NMI interrupt context. It reflects the
-	 * context time as it was when the event was last scheduled in.
+	 * context time as it was when the event was last scheduled in,
+	 * or when ctx_sched_in failed to schedule the event because we
+	 * run out of PMC.
 	 *
 	 * ctx_time already accounts for ctx->timestamp. Therefore to
 	 * compute ctx_time for a sample, simply add perf_clock().
diff --git a/kernel/events/core.c b/kernel/events/core.c
index c677f934353a..c81151926171 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3695,6 +3695,29 @@ static noinline int visit_groups_merge(struct perf_cpu_context *cpuctx,
 	return 0;
 }
 
+static inline bool event_update_userpage(struct perf_event *event)
+{
+	if (likely(!atomic_read(&event->mmap_count)))
+		return false;
+
+	perf_event_update_time(event);
+	perf_set_shadow_time(event, event->ctx);
+	perf_event_update_userpage(event);
+
+	return true;
+}
+
+static inline void group_update_userpage(struct perf_event *group_event)
+{
+	struct perf_event *event;
+
+	if (!event_update_userpage(group_event))
+		return;
+
+	for_each_sibling_event(event, group_event)
+		event_update_userpage(event);
+}
+
 static int merge_sched_in(struct perf_event *event, void *data)
 {
 	struct perf_event_context *ctx = event->ctx;
@@ -3713,14 +3736,15 @@ static int merge_sched_in(struct perf_event *event, void *data)
 	}
 
 	if (event->state == PERF_EVENT_STATE_INACTIVE) {
+		*can_add_hw = 0;
 		if (event->attr.pinned) {
 			perf_cgroup_event_disable(event, ctx);
 			perf_event_set_state(event, PERF_EVENT_STATE_ERROR);
+		} else {
+			ctx->rotate_necessary = 1;
+			perf_mux_hrtimer_restart(cpuctx);
+			group_update_userpage(event);
 		}
-
-		*can_add_hw = 0;
-		ctx->rotate_necessary = 1;
-		perf_mux_hrtimer_restart(cpuctx);
 	}
 
 	return 0;
@@ -6239,6 +6263,8 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)
 
 		ring_buffer_attach(event, rb);
 
+		perf_event_update_time(event);
+		perf_set_shadow_time(event, event->ctx);
 		perf_event_init_userpage(event);
 		perf_event_update_userpage(event);
 	} else {

From bb893f075431e97dd72cde0721957a73d26578a8 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Mon, 20 Sep 2021 15:31:11 +0200
Subject: [PATCH 0839/1750] sched: Always inline is_percpu_thread()

[ Upstream commit 83d40a61046f73103b4e5d8f1310261487ff63b0 ]

  vmlinux.o: warning: objtool: check_preemption_disabled()+0x81: call to is_percpu_thread() leaves .noinstr.text section

Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20210928084218.063371959@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sched.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 29c7ccd5ae42..b85b26d9ccef 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1589,7 +1589,7 @@ extern struct pid *cad_pid;
 #define tsk_used_math(p)			((p)->flags & PF_USED_MATH)
 #define used_math()				tsk_used_math(current)
 
-static inline bool is_percpu_thread(void)
+static __always_inline bool is_percpu_thread(void)
 {
 #ifdef CONFIG_SMP
 	return (current->flags & PF_NO_SETAFFINITY) &&

From 42b49f012b6a8c5b012a666971dab6ce38725dff Mon Sep 17 00:00:00 2001
From: Brandon Wyman <bjwyman@gmail.com>
Date: Tue, 28 Sep 2021 20:50:51 +0000
Subject: [PATCH 0840/1750] hwmon: (pmbus/ibm-cffps) max_power_out swap changes

[ Upstream commit f067d5585cda2de1e47dde914a8a4f151659e0ad ]

The bytes for max_power_out from the ibm-cffps devices differ in byte
order for some power supplies.

The Witherspoon power supply returns the bytes in MSB/LSB order.

The Rainier power supply returns the bytes in LSB/MSB order.

The Witherspoon power supply uses version cffps1. The Rainier power
supply should use version cffps2. If version is cffps1, swap the bytes
before output to max_power_out.

Tested:
    Witherspoon before: 3148. Witherspoon after: 3148.
    Rainier before: 53255. Rainier after: 2000.

Signed-off-by: Brandon Wyman <bjwyman@gmail.com>
Reviewed-by: Eddie James <eajames@linux.ibm.com>
Link: https://lore.kernel.org/r/20210928205051.1222815-1-bjwyman@gmail.com
[groeck: Replaced yoda programming]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/ibm-cffps.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/pmbus/ibm-cffps.c b/drivers/hwmon/pmbus/ibm-cffps.c
index 79bc2032dcb2..da261d32450d 100644
--- a/drivers/hwmon/pmbus/ibm-cffps.c
+++ b/drivers/hwmon/pmbus/ibm-cffps.c
@@ -171,8 +171,14 @@ static ssize_t ibm_cffps_debugfs_read(struct file *file, char __user *buf,
 		cmd = CFFPS_SN_CMD;
 		break;
 	case CFFPS_DEBUGFS_MAX_POWER_OUT:
-		rc = i2c_smbus_read_word_swapped(psu->client,
-						 CFFPS_MAX_POWER_OUT_CMD);
+		if (psu->version == cffps1) {
+			rc = i2c_smbus_read_word_swapped(psu->client,
+					CFFPS_MAX_POWER_OUT_CMD);
+		} else {
+			rc = i2c_smbus_read_word_data(psu->client,
+					CFFPS_MAX_POWER_OUT_CMD);
+		}
+
 		if (rc < 0)
 			return rc;
 

From 77434fe5a077f05f0851931d6a71d1098b6004f8 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 17 Oct 2021 10:43:34 +0200
Subject: [PATCH 0841/1750] Linux 5.10.74

Link: https://lore.kernel.org/r/20211014145207.979449962@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 3f62cea9afc0..84d540aed24c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 73
+SUBLEVEL = 74
 EXTRAVERSION =
 NAME = Dare mighty things
 

From f077d699c1d2aa05c8d5982bd646b040353f052c Mon Sep 17 00:00:00 2001
From: Jonas Hahnfeld <hahnjo@hahnjo.de>
Date: Tue, 12 Oct 2021 22:09:07 +0200
Subject: [PATCH 0842/1750] ALSA: usb-audio: Add quirk for VF0770

commit 48827e1d6af58f219e89c7ec08dccbca28c7694e upstream.

The device advertises 8 formats, but only a rate of 48kHz is honored
by the hardware and 24 bits give chopped audio, so only report the
one working combination. This fixes out-of-the-box audio experience
with PipeWire which otherwise attempts to choose S24_3LE (while
PulseAudio defaulted to S16_LE).

Signed-off-by: Jonas Hahnfeld <hahnjo@hahnjo.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211012200906.3492-1-hahnjo@hahnjo.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks-table.h | 42 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 5728bf722c88..7c649cd38049 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -77,6 +77,48 @@
 /* E-Mu 0204 USB */
 { USB_DEVICE_VENDOR_SPEC(0x041e, 0x3f19) },
 
+/*
+ * Creative Technology, Ltd Live! Cam Sync HD [VF0770]
+ * The device advertises 8 formats, but only a rate of 48kHz is honored by the
+ * hardware and 24 bits give chopped audio, so only report the one working
+ * combination.
+ */
+{
+	USB_DEVICE(0x041e, 0x4095),
+	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+		.ifnum = QUIRK_ANY_INTERFACE,
+		.type = QUIRK_COMPOSITE,
+		.data = &(const struct snd_usb_audio_quirk[]) {
+			{
+				.ifnum = 2,
+				.type = QUIRK_AUDIO_STANDARD_MIXER,
+			},
+			{
+				.ifnum = 3,
+				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
+				.data = &(const struct audioformat) {
+					.formats = SNDRV_PCM_FMTBIT_S16_LE,
+					.channels = 2,
+					.fmt_bits = 16,
+					.iface = 3,
+					.altsetting = 4,
+					.altset_idx = 4,
+					.endpoint = 0x82,
+					.ep_attr = 0x05,
+					.rates = SNDRV_PCM_RATE_48000,
+					.rate_min = 48000,
+					.rate_max = 48000,
+					.nr_rates = 1,
+					.rate_table = (unsigned int[]) { 48000 },
+				},
+			},
+			{
+				.ifnum = -1
+			},
+		},
+	},
+},
+
 /*
  * HP Wireless Audio
  * When not ignored, causes instability issues for some users, forcing them to

From 4aab156d302c92b68c2b7e254a398c32ec33238c Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Sun, 10 Oct 2021 09:55:46 +0200
Subject: [PATCH 0843/1750] ALSA: pcm: Workaround for a wrong offset in
 SYNC_PTR compat ioctl

commit 228af5a4fa3a8293bd8b7ac5cf59548ee29627bf upstream.

Michael Forney reported an incorrect padding type that was defined in
the commit 80fe7430c708 ("ALSA: add new 32-bit layout for
snd_pcm_mmap_status/control") for PCM control mmap data.
His analysis is correct, and this caused the misplacements of PCM
control data on 32bit arch and 32bit compat mode.

The bug is that the __pad2 definition in __snd_pcm_mmap_control64
struct was wrongly with __pad_before_uframe, which should have been
__pad_after_uframe instead.  This struct is used in SYNC_PTR ioctl and
control mmap.  Basically this bug leads to two problems:

- The offset of avail_min field becomes wrong, it's placed right after
  appl_ptr without padding on little-endian

- When appl_ptr and avail_min are read as 64bit values in kernel side,
  the values become either zero or corrupted (mixed up)

One good news is that, because both user-space and kernel
misunderstand the wrong offset, at least, 32bit application running on
32bit kernel works as is.  Also, 64bit applications are unaffected
because the padding size is zero.  The remaining problem is the 32bit
compat mode; as mentioned in the above, avail_min is placed right
after appl_ptr on little-endian archs, 64bit kernel reads bogus values
for appl_ptr updates, which may lead to streaming bugs like jumping,
XRUN or whatever unexpected.
(However, we haven't heard any serious bug reports due to this over
years, so practically seen, it's fairly safe to assume that the impact
by this bug is limited.)

Ideally speaking, we should correct the wrong mmap status control
definition.  But this would cause again incompatibility with the
existing binaries, and fixing it (e.g. by renumbering ioctls) would be
really messy.

So, as of this patch, we only correct the behavior of 32bit compat
mode and keep the rest as is.  Namely, the SYNC_PTR ioctl is now
handled differently in compat mode to read/write the 32bit values at
the right offsets.  The control mmap of 32bit apps on 64bit kernels
has been already disabled (which is likely rather an overlook, but
this worked fine at this time :), so covering SYNC_PTR ioctl should
suffice as a fallback.

Fixes: 80fe7430c708 ("ALSA: add new 32-bit layout for snd_pcm_mmap_status/control")
Reported-by: Michael Forney <mforney@mforney.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@vger.kernel.org>
Cc: Rich Felker <dalias@libc.org>
Link: https://lore.kernel.org/r/29QBMJU8DE71E.2YZSH8IHT5HMH@mforney.org
Link: https://lore.kernel.org/r/20211010075546.23220-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/pcm_compat.c | 72 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 71 insertions(+), 1 deletion(-)

diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
index 590a46a9e78d..a226d8f24028 100644
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -466,6 +466,76 @@ static int snd_pcm_ioctl_sync_ptr_x32(struct snd_pcm_substream *substream,
 }
 #endif /* CONFIG_X86_X32 */
 
+#ifdef __BIG_ENDIAN
+typedef char __pad_before_u32[4];
+typedef char __pad_after_u32[0];
+#else
+typedef char __pad_before_u32[0];
+typedef char __pad_after_u32[4];
+#endif
+
+/* PCM 2.0.15 API definition had a bug in mmap control; it puts the avail_min
+ * at the wrong offset due to a typo in padding type.
+ * The bug hits only 32bit.
+ * A workaround for incorrect read/write is needed only in 32bit compat mode.
+ */
+struct __snd_pcm_mmap_control64_buggy {
+	__pad_before_u32 __pad1;
+	__u32 appl_ptr;
+	__pad_before_u32 __pad2;	/* SiC! here is the bug */
+	__pad_before_u32 __pad3;
+	__u32 avail_min;
+	__pad_after_uframe __pad4;
+};
+
+static int snd_pcm_ioctl_sync_ptr_buggy(struct snd_pcm_substream *substream,
+					struct snd_pcm_sync_ptr __user *_sync_ptr)
+{
+	struct snd_pcm_runtime *runtime = substream->runtime;
+	struct snd_pcm_sync_ptr sync_ptr;
+	struct __snd_pcm_mmap_control64_buggy *sync_cp;
+	volatile struct snd_pcm_mmap_status *status;
+	volatile struct snd_pcm_mmap_control *control;
+	int err;
+
+	memset(&sync_ptr, 0, sizeof(sync_ptr));
+	sync_cp = (struct __snd_pcm_mmap_control64_buggy *)&sync_ptr.c.control;
+	if (get_user(sync_ptr.flags, (unsigned __user *)&(_sync_ptr->flags)))
+		return -EFAULT;
+	if (copy_from_user(sync_cp, &(_sync_ptr->c.control), sizeof(*sync_cp)))
+		return -EFAULT;
+	status = runtime->status;
+	control = runtime->control;
+	if (sync_ptr.flags & SNDRV_PCM_SYNC_PTR_HWSYNC) {
+		err = snd_pcm_hwsync(substream);
+		if (err < 0)
+			return err;
+	}
+	snd_pcm_stream_lock_irq(substream);
+	if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_APPL)) {
+		err = pcm_lib_apply_appl_ptr(substream, sync_cp->appl_ptr);
+		if (err < 0) {
+			snd_pcm_stream_unlock_irq(substream);
+			return err;
+		}
+	} else {
+		sync_cp->appl_ptr = control->appl_ptr;
+	}
+	if (!(sync_ptr.flags & SNDRV_PCM_SYNC_PTR_AVAIL_MIN))
+		control->avail_min = sync_cp->avail_min;
+	else
+		sync_cp->avail_min = control->avail_min;
+	sync_ptr.s.status.state = status->state;
+	sync_ptr.s.status.hw_ptr = status->hw_ptr;
+	sync_ptr.s.status.tstamp = status->tstamp;
+	sync_ptr.s.status.suspended_state = status->suspended_state;
+	sync_ptr.s.status.audio_tstamp = status->audio_tstamp;
+	snd_pcm_stream_unlock_irq(substream);
+	if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr)))
+		return -EFAULT;
+	return 0;
+}
+
 /*
  */
 enum {
@@ -535,7 +605,7 @@ static long snd_pcm_ioctl_compat(struct file *file, unsigned int cmd, unsigned l
 		if (in_x32_syscall())
 			return snd_pcm_ioctl_sync_ptr_x32(substream, argp);
 #endif /* CONFIG_X86_X32 */
-		return snd_pcm_common_ioctl(file, substream, cmd, argp);
+		return snd_pcm_ioctl_sync_ptr_buggy(substream, argp);
 	case SNDRV_PCM_IOCTL_HW_REFINE32:
 		return snd_pcm_ioctl_hw_params_compat(substream, 1, argp);
 	case SNDRV_PCM_IOCTL_HW_PARAMS32:

From 7680631ac7ab14b5061b475605f469d87952e1b1 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 30 Sep 2021 13:41:14 +0200
Subject: [PATCH 0844/1750] ALSA: seq: Fix a potential UAF by wrong
 private_free call order

commit 1f8763c59c4ec6254d629fe77c0a52220bd907aa upstream.

John Keeping reported and posted a patch for a potential UAF in
rawmidi sequencer destruction: the snd_rawmidi_dev_seq_free() may be
called after the associated rawmidi object got already freed.
After a deeper look, it turned out that the bug is rather the
incorrect private_free call order for a snd_seq_device.  The
snd_seq_device private_free gets called at the release callback of the
sequencer device object, while this was rather expected to be executed
at the snd_device call chains that runs at the beginning of the whole
card-free procedure.  It's been broken since the rewrite of
sequencer-device binding (although it hasn't surfaced because the
sequencer device release happens usually right along with the card
device release).

This patch corrects the private_free call to be done in the right
place, at snd_seq_device_dev_free().

Fixes: 7c37ae5c625a ("ALSA: seq: Rewrite sequencer device binding with standard bus")
Reported-and-tested-by: John Keeping <john@metanate.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210930114114.8645-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/seq_device.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/sound/core/seq_device.c b/sound/core/seq_device.c
index 7ed13cb32ef8..f22d3bbfcaa5 100644
--- a/sound/core/seq_device.c
+++ b/sound/core/seq_device.c
@@ -147,6 +147,8 @@ static int snd_seq_device_dev_free(struct snd_device *device)
 	struct snd_seq_device *dev = device->device_data;
 
 	cancel_autoload_drivers();
+	if (dev->private_free)
+		dev->private_free(dev);
 	put_device(&dev->dev);
 	return 0;
 }
@@ -174,11 +176,7 @@ static int snd_seq_device_dev_disconnect(struct snd_device *device)
 
 static void snd_seq_dev_release(struct device *dev)
 {
-	struct snd_seq_device *sdev = to_seq_dev(dev);
-
-	if (sdev->private_free)
-		sdev->private_free(sdev);
-	kfree(sdev);
+	kfree(to_seq_dev(dev));
 }
 
 /*

From 9bb1659ac594a1cc657cef2880a544ecf8dce2d2 Mon Sep 17 00:00:00 2001
From: John Liu <johnliu55tw@gmail.com>
Date: Thu, 30 Sep 2021 13:53:16 +0200
Subject: [PATCH 0845/1750] ALSA: hda/realtek: Enable 4-speaker output for Dell
 Precision 5560 laptop

commit eb676622846b34a751e2ff9b5910a5322a4e0000 upstream.

The Dell Precision 5560 laptop appears to use the 4-speakers-on-ALC289
audio just like its sibling product XPS 9510, so it requires the same
quirk to enable woofer output. Tested on my Dell Precision 5560.

Signed-off-by: John Liu <johnliu55tw@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210930115316.659-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 9f37adb2b4d0..3513f690a9e3 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8391,6 +8391,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1028, 0x0a30, "Dell", ALC236_FIXUP_DELL_AIO_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1028, 0x0a58, "Dell", ALC255_FIXUP_DELL_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1028, 0x0a61, "Dell XPS 15 9510", ALC289_FIXUP_DUAL_SPK),
+	SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),

From c6e5290e6cc163add96010de8ecfbfdc35efbed6 Mon Sep 17 00:00:00 2001
From: Chris Chiu <chris.chiu@canonical.com>
Date: Fri, 1 Oct 2021 14:28:56 +0800
Subject: [PATCH 0846/1750] ALSA: hda - Enable headphone mic on Dell Latitude
 laptops with ALC3254

commit 2b987fe84429361c7f189568c476d1bd00d2ff7e upstream.

The headphone mic is not working on Dell Latitude laptops with ALC3254.
The codec vendor id is 0x10ec0295 and share the same pincfg as defined
in ALC295_STANDARD_PINS. So the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE will
be applied per alc269_pin_fixup_tbl[] but actually the headphone mic is
using NID 0x1b instead of 0x1a. The ALC269_FIXUP_DELL4_MIC_NO_PRESENCE
need to be applied instead.

Use ALC269_FIXUP_DELL4_MIC_NO_PRESENCE for particular models before
a generic fixup comes out.

Signed-off-by: Chris Chiu <chris.chiu@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211001062856.1037901-1-chris.chiu@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3513f690a9e3..3261ad8f3b76 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8392,6 +8392,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1028, 0x0a58, "Dell", ALC255_FIXUP_DELL_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1028, 0x0a61, "Dell XPS 15 9510", ALC289_FIXUP_DUAL_SPK),
 	SND_PCI_QUIRK(0x1028, 0x0a62, "Dell Precision 5560", ALC289_FIXUP_DUAL_SPK),
+	SND_PCI_QUIRK(0x1028, 0x0a9d, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1028, 0x0a9e, "Dell Latitude 5430", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),

From 8a5f01f4b01c4984544d96abc20591052dc86c90 Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse@tuxedocomputers.com>
Date: Fri, 1 Oct 2021 15:31:10 +0200
Subject: [PATCH 0847/1750] ALSA: hda/realtek: Complete partial device name to
 avoid ambiguity

commit 1f8d398e1cd8813f8ec16d55c086e8270a9c18ab upstream.

The string "Clevo X170" is not enough to unambiguously identify the correct
device.

Fixing it so another Clevo barebone name starting with "X170" can be added
without causing confusion.

Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211001133111.428249-2-wse@tuxedocomputers.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3261ad8f3b76..c21d0e95906f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2549,7 +2549,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),

From 1e10c6bf15d26ec8df8d45a13b5da58d6d9a6b53 Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse@tuxedocomputers.com>
Date: Fri, 1 Oct 2021 15:31:11 +0200
Subject: [PATCH 0848/1750] ALSA: hda/realtek: Add quirk for Clevo X170KM-G

commit cc03069a397005da24f6783835c274d5aedf6043 upstream.

This applies a SND_PCI_QUIRK(...) to the Clevo X170KM-G barebone. This
fixes the issue of the devices internal Speaker not working.

Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211001133111.428249-3-wse@tuxedocomputers.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c21d0e95906f..71c9c7d89dfb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2550,6 +2550,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),
 	SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x950a, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),

From 0fa256509b9f71e6936b6782418510120aac1bf7 Mon Sep 17 00:00:00 2001
From: Kailang Yang <kailang@realtek.com>
Date: Tue, 5 Oct 2021 14:35:14 +0800
Subject: [PATCH 0849/1750] ALSA: hda/realtek - ALC236 headset MIC recording
 issue

commit 5aec98913095ed3b4424ed6c5fdeb6964e9734da upstream.

In power save mode, the recording voice from headset mic will 2s more delay.
Add this patch will solve this issue.

[ minor coding style fix by tiwai ]

Signed-off-by: Kailang Yang <kailang@realtek.com>
Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/ccb0cdd5bbd7486eabbd8d987d384cb0@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 71c9c7d89dfb..43fa079bbb7c 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -527,6 +527,8 @@ static void alc_shutup_pins(struct hda_codec *codec)
 	struct alc_spec *spec = codec->spec;
 
 	switch (codec->core.vendor_id) {
+	case 0x10ec0236:
+	case 0x10ec0256:
 	case 0x10ec0283:
 	case 0x10ec0286:
 	case 0x10ec0288:
@@ -3532,7 +3534,8 @@ static void alc256_shutup(struct hda_codec *codec)
 	/* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
 	 * when booting with headset plugged. So skip setting it for the codec alc257
 	 */
-	if (codec->core.vendor_id != 0x10ec0257)
+	if (spec->codec_variant != ALC269_TYPE_ALC257 &&
+	    spec->codec_variant != ALC269_TYPE_ALC256)
 		alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
 
 	if (!spec->no_shutup_pins)

From 554a5027f53698c537e83562716fedd7151b7edd Mon Sep 17 00:00:00 2001
From: Werner Sembach <wse@tuxedocomputers.com>
Date: Wed, 6 Oct 2021 15:04:15 +0200
Subject: [PATCH 0850/1750] ALSA: hda/realtek: Add quirk for TongFang PHxTxX1

commit dd6dd6e3c791db7fdbc5433ec7e450717aa3a0ce upstream.

This applies a SND_PCI_QUIRK(...) to the TongFang PHxTxX1 barebone. This
fixes the issue of the internal Microphone not working after booting
another OS.

When booting a certain another OS this barebone keeps some coeff settings
even after a cold shutdown. These coeffs prevent the microphone detection
from working in Linux, making the Laptop think that there is always an
external microphone plugged-in and therefore preventing the use of the
internal one.

The relevant indexes and values where gathered by naively diff-ing and
reading a working and a non-working coeff dump.

Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211006130415.538243-1-wse@tuxedocomputers.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 43fa079bbb7c..daa1383e549b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6399,6 +6399,24 @@ static void alc287_fixup_legion_15imhg05_speakers(struct hda_codec *codec,
 /* for alc285_fixup_ideapad_s740_coef() */
 #include "ideapad_s740_helper.c"
 
+static void alc256_fixup_tongfang_reset_persistent_settings(struct hda_codec *codec,
+							    const struct hda_fixup *fix,
+							    int action)
+{
+	/*
+	* A certain other OS sets these coeffs to different values. On at least one TongFang
+	* barebone these settings might survive even a cold reboot. So to restore a clean slate the
+	* values are explicitly reset to default here. Without this, the external microphone is
+	* always in a plugged-in state, while the internal microphone is always in an unplugged
+	* state, breaking the ability to use the internal microphone.
+	*/
+	alc_write_coef_idx(codec, 0x24, 0x0000);
+	alc_write_coef_idx(codec, 0x26, 0x0000);
+	alc_write_coef_idx(codec, 0x29, 0x3000);
+	alc_write_coef_idx(codec, 0x37, 0xfe05);
+	alc_write_coef_idx(codec, 0x45, 0x5089);
+}
+
 enum {
 	ALC269_FIXUP_GPIO2,
 	ALC269_FIXUP_SONY_VAIO,
@@ -6612,7 +6630,8 @@ enum {
 	ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS,
 	ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE,
 	ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
-	ALC287_FIXUP_13S_GEN2_SPEAKERS
+	ALC287_FIXUP_13S_GEN2_SPEAKERS,
+	ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -8304,6 +8323,10 @@ static const struct hda_fixup alc269_fixups[] = {
 		.chained = true,
 		.chain_id = ALC269_FIXUP_HEADSET_MODE,
 	},
+	[ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc256_fixup_tongfang_reset_persistent_settings,
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8733,6 +8756,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
 	SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
 	SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
+	SND_PCI_QUIRK(0x1d05, 0x1132, "TongFang PHxTxX1", ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS),
 	SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),

From 1099953b32c6eb71ea03fa5793cad4fe7fa514df Mon Sep 17 00:00:00 2001
From: Cameron Berkenpas <cam@neo-zeon.de>
Date: Sun, 10 Oct 2021 15:54:11 -0700
Subject: [PATCH 0851/1750] ALSA: hda/realtek: Fix for quirk to enable speaker
 output on the Lenovo 13s Gen2

commit 023a062f238129e8a542b5163c4350ceb076283e upstream.

The previous patch's HDA verb initialization for the Lenovo 13s
sequence was slightly off. This updated verb sequence has been tested
and confirmed working.

Fixes: ad7cc2d41b7a ("ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.")
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208555
Cc: <stable@vger.kernel.org>
Signed-off-by: Cameron Berkenpas <cam@neo-zeon.de>
Link: https://lore.kernel.org/r/20211010225410.23423-1-cam@neo-zeon.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index daa1383e549b..6c6a379ebabb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8306,7 +8306,7 @@ static const struct hda_fixup alc269_fixups[] = {
 		.v.verbs = (const struct hda_verb[]) {
 			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x24 },
 			{ 0x20, AC_VERB_SET_PROC_COEF, 0x41 },
-			{ 0x20, AC_VERB_SET_PROC_COEF, 0xb020 },
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x26 },
 			{ 0x20, AC_VERB_SET_PROC_COEF, 0x2 },
 			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },
 			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0 },

From c3bf276fd7c8e75749dd4d7e8ad01b633634fb35 Mon Sep 17 00:00:00 2001
From: Hui Wang <hui.wang@canonical.com>
Date: Tue, 12 Oct 2021 19:47:48 +0800
Subject: [PATCH 0852/1750] ALSA: hda/realtek: Fix the mic type detection issue
 for ASUS G551JW

commit a3fd1a986e499a06ac5ef95c3a39aa4611e7444c upstream.

We need to define the codec pin 0x1b to be the mic, but somehow
the mic doesn't support hot plugging detection, and Windows also has
this issue, so we set it to phantom headset-mic.

Also the determine_headset_type() often returns the omtp type by a
mistake when we plug a ctia headset, this makes the mic can't record
sound at all. Because most of the headset are ctia type nowadays and
some machines have the fixed ctia type audio jack, it is possible this
machine has the fixed ctia jack too. Here we set this mic jack to
fixed ctia type, this could avoid the mic type detection mistake and
make the ctia headset work stable.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214537
Reported-and-tested-by: msd <msd.mmq@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Link: https://lore.kernel.org/r/20211012114748.5238-1-hui.wang@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 6c6a379ebabb..c36239cea474 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -10129,6 +10129,9 @@ enum {
 	ALC671_FIXUP_HP_HEADSET_MIC2,
 	ALC662_FIXUP_ACER_X2660G_HEADSET_MODE,
 	ALC662_FIXUP_ACER_NITRO_HEADSET_MODE,
+	ALC668_FIXUP_ASUS_NO_HEADSET_MIC,
+	ALC668_FIXUP_HEADSET_MIC,
+	ALC668_FIXUP_MIC_DET_COEF,
 };
 
 static const struct hda_fixup alc662_fixups[] = {
@@ -10512,6 +10515,29 @@ static const struct hda_fixup alc662_fixups[] = {
 		.chained = true,
 		.chain_id = ALC662_FIXUP_USI_FUNC
 	},
+	[ALC668_FIXUP_ASUS_NO_HEADSET_MIC] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x1b, 0x04a1112c },
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC668_FIXUP_HEADSET_MIC
+	},
+	[ALC668_FIXUP_HEADSET_MIC] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc269_fixup_headset_mic,
+		.chained = true,
+		.chain_id = ALC668_FIXUP_MIC_DET_COEF
+	},
+	[ALC668_FIXUP_MIC_DET_COEF] = {
+		.type = HDA_FIXUP_VERBS,
+		.v.verbs = (const struct hda_verb[]) {
+			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x15 },
+			{ 0x20, AC_VERB_SET_PROC_COEF, 0x0d60 },
+			{}
+		},
+	},
 };
 
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -10547,6 +10573,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
 	SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
 	SND_PCI_QUIRK(0x1043, 0x17bd, "ASUS N751", ALC668_FIXUP_ASUS_Nx51),
+	SND_PCI_QUIRK(0x1043, 0x185d, "ASUS G551JW", ALC668_FIXUP_ASUS_NO_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x1963, "ASUS X71SL", ALC662_FIXUP_ASUS_MODE8),
 	SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
 	SND_PCI_QUIRK(0x1043, 0x1bf3, "ASUS N76VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),

From 7ef43c0f68fb6d5c00c7ac32538b2e988d6a38e2 Mon Sep 17 00:00:00 2001
From: Steven Rostedt <rostedt@goodmis.org>
Date: Thu, 14 Oct 2021 14:35:07 -0400
Subject: [PATCH 0853/1750] nds32/ftrace: Fix Error: invalid operands (*UND*
 and *UND* sections) for `^'

commit be358af1191b1b2fedebd8f3421cafdc8edacc7d upstream.

I received a build failure for a new patch I'm working on the nds32
architecture, and when I went to test it, I couldn't get to my build error,
because it failed to build with a bunch of:

  Error: invalid operands (*UND* and *UND* sections) for `^'

issues with various files. Those files were temporary asm files that looked
like:  kernel/.tmp_mc_fork.s

I decided to look deeper, and found that the "mc" portion of that name
stood for "mcount", and was created by the recordmcount.pl script. One that
I wrote over a decade ago. Once I knew the source of the problem, I was
able to investigate it further.

The way the recordmcount.pl script works (BTW, there's a C version that
simply modifies the ELF object) is by doing an "objdump" on the object
file. Looks for all the calls to "mcount", and creates an offset of those
locations from some global variable it can use (usually a global function
name, found with <.*>:). Creates a asm file that is a table of references
to these locations, using the found variable/function. Compiles it and
links it back into the original object file. This asm file is called
".tmp_mc_<object_base_name>.s".

The problem here is that the objdump produced by the nds32 object file,
contains things that look like:

 0000159a <.L3^B1>:
    159a:       c6 00           beqz38 $r6, 159a <.L3^B1>
                        159a: R_NDS32_9_PCREL_RELA      .text+0x159e
    159c:       84 d2           movi55 $r6, #-14
    159e:       80 06           mov55 $r0, $r6
    15a0:       ec 3c           addi10.sp #0x3c

Where ".L3^B1 is somehow selected as the "global" variable to index off of.

Then the assembly file that holds the mcount locations looks like this:

        .section __mcount_loc,"a",@progbits
        .align 2
        .long .L3^B1 + -5522
        .long .L3^B1 + -5384
        .long .L3^B1 + -5270
        .long .L3^B1 + -5098
        .long .L3^B1 + -4970
        .long .L3^B1 + -4758
        .long .L3^B1 + -4122
        [...]

And when it is compiled back to an object to link to the original object,
the compile fails on the "^" symbol.

Simple solution for now, is to have the perl script ignore using function
symbols that have an "^" in the name.

Link: https://lkml.kernel.org/r/20211014143507.4ad2c0f7@gandalf.local.home

Cc: stable@vger.kernel.org
Acked-by: Greentime Hu <green.hu@gmail.com>
Fixes: fbf58a52ac088 ("nds32/ftrace: Add RECORD_MCOUNT support")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/recordmcount.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index 4f84657f55c2..f459ae883a0a 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -222,7 +222,7 @@ if ($arch =~ /(x86(_64)?)|(i386)/) {
 $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\S+)";
 $weak_regex = "^[0-9a-fA-F]+\\s+([wW])\\s+(\\S+)";
 $section_regex = "Disassembly of section\\s+(\\S+):";
-$function_regex = "^([0-9a-fA-F]+)\\s+<(.*?)>:";
+$function_regex = "^([0-9a-fA-F]+)\\s+<([^^]*?)>:";
 $mcount_regex = "^\\s*([0-9a-fA-F]+):.*\\s(mcount|__fentry__)\$";
 $section_type = '@progbits';
 $mcount_adjust = 0;

From faba7916cdc0da11c7402538fe95642b43c7b73b Mon Sep 17 00:00:00 2001
From: Roberto Sassu <roberto.sassu@huawei.com>
Date: Tue, 5 Oct 2021 14:08:36 +0200
Subject: [PATCH 0854/1750] s390: fix strrchr() implementation

commit 8e0ab8e26b72a80e991c66a8abc16e6c856abe3d upstream.

Fix two problems found in the strrchr() implementation for s390
architectures: evaluate empty strings (return the string address instead of
NULL, if '\0' is passed as second argument); evaluate the first character
of non-empty strings (the current implementation stops at the second).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Heiko Carstens <hca@linux.ibm.com> (incorrect behavior with empty strings)
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Link: https://lore.kernel.org/r/20211005120836.60630-1-roberto.sassu@huawei.com
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/lib/string.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/arch/s390/lib/string.c b/arch/s390/lib/string.c
index 93b3209b94a2..db4e539d8c7f 100644
--- a/arch/s390/lib/string.c
+++ b/arch/s390/lib/string.c
@@ -246,14 +246,13 @@ EXPORT_SYMBOL(strcmp);
 #ifdef __HAVE_ARCH_STRRCHR
 char *strrchr(const char *s, int c)
 {
-       size_t len = __strend(s) - s;
+	ssize_t len = __strend(s) - s;
 
-       if (len)
-	       do {
-		       if (s[len] == (char) c)
-			       return (char *) s + len;
-	       } while (--len > 0);
-       return NULL;
+	do {
+		if (s[len] == (char)c)
+			return (char *)s + len;
+	} while (--len >= 0);
+	return NULL;
 }
 EXPORT_SYMBOL(strrchr);
 #endif

From e3c37135c9ca9d7a31a8fbb6520947d5406c44c1 Mon Sep 17 00:00:00 2001
From: Dinh Nguyen <dinguyen@kernel.org>
Date: Thu, 16 Sep 2021 17:51:26 -0500
Subject: [PATCH 0855/1750] clk: socfpga: agilex: fix duplicate s2f_user0_clk

commit 09540fa337196be20e9f0241652364f09275d374 upstream.

Remove the duplicate s2f_user0_clk and the unused s2f_usr0_mux define.

Fixes: f817c132db67 ("clk: socfpga: agilex: fix up s2f_user0_clk representation")
Cc: stable@vger.kernel.org
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20210916225126.1427700-1-dinguyen@kernel.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/socfpga/clk-agilex.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/clk/socfpga/clk-agilex.c b/drivers/clk/socfpga/clk-agilex.c
index 7182afb4258a..225636c2b569 100644
--- a/drivers/clk/socfpga/clk-agilex.c
+++ b/drivers/clk/socfpga/clk-agilex.c
@@ -165,13 +165,6 @@ static const struct clk_parent_data mpu_mux[] = {
 	  .name = "boot_clk", },
 };
 
-static const struct clk_parent_data s2f_usr0_mux[] = {
-	{ .fw_name = "f2s-free-clk",
-	  .name = "f2s-free-clk", },
-	{ .fw_name = "boot_clk",
-	  .name = "boot_clk", },
-};
-
 static const struct clk_parent_data emac_mux[] = {
 	{ .fw_name = "emaca_free_clk",
 	  .name = "emaca_free_clk", },
@@ -299,8 +292,6 @@ static const struct stratix10_gate_clock agilex_gate_clks[] = {
 	  4, 0x44, 28, 1, 0, 0, 0},
 	{ AGILEX_CS_TIMER_CLK, "cs_timer_clk", NULL, noc_mux, ARRAY_SIZE(noc_mux), 0, 0x24,
 	  5, 0, 0, 0, 0x30, 1, 0},
-	{ AGILEX_S2F_USER0_CLK, "s2f_user0_clk", NULL, s2f_usr0_mux, ARRAY_SIZE(s2f_usr0_mux), 0, 0x24,
-	  6, 0, 0, 0, 0, 0, 0},
 	{ AGILEX_EMAC0_CLK, "emac0_clk", NULL, emac_mux, ARRAY_SIZE(emac_mux), 0, 0x7C,
 	  0, 0, 0, 0, 0x94, 26, 0},
 	{ AGILEX_EMAC1_CLK, "emac1_clk", NULL, emac_mux, ARRAY_SIZE(emac_mux), 0, 0x7C,

From 5dab6e8f141a305030b37d9e6fcbe7c27b3513ab Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Fri, 24 Sep 2021 00:35:42 +0000
Subject: [PATCH 0856/1750] csky: don't let sigreturn play with priveleged bits
 of status register

commit fbd63c08cdcca5fb1315aca3172b3c9c272cfb4f upstream.

csky restore_sigcontext() blindly overwrites regs->sr with the value
it finds in sigcontext.  Attacker can store whatever they want in there,
which includes things like S-bit.  Userland shouldn't be able to set
that, or anything other than C flag (bit 0).

Do the same thing other architectures with protected bits in flags
register do - preserve everything that shouldn't be settable in
user mode, picking the rest from the value saved is sigcontext.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Guo Ren <guoren@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/csky/kernel/signal.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/csky/kernel/signal.c b/arch/csky/kernel/signal.c
index 8b068cf37447..0ca49b5e3dd3 100644
--- a/arch/csky/kernel/signal.c
+++ b/arch/csky/kernel/signal.c
@@ -52,10 +52,14 @@ static long restore_sigcontext(struct pt_regs *regs,
 	struct sigcontext __user *sc)
 {
 	int err = 0;
+	unsigned long sr = regs->sr;
 
 	/* sc_pt_regs is structured the same as the start of pt_regs */
 	err |= __copy_from_user(regs, &sc->sc_pt_regs, sizeof(struct pt_regs));
 
+	/* BIT(0) of regs->sr is Condition Code/Carry bit */
+	regs->sr = (sr & ~1) | (regs->sr & 1);
+
 	/* Restore the floating-point state. */
 	err |= restore_fpu_state(sc);
 

From 0c97008859cad117568b3b5cc073993025b59a57 Mon Sep 17 00:00:00 2001
From: Guo Ren <guoren@linux.alibaba.com>
Date: Fri, 24 Sep 2021 15:33:38 +0800
Subject: [PATCH 0857/1750] csky: Fixup regs.sr broken in ptrace

commit af89ebaa64de726ca0a39bbb0bf0c81a1f43ad50 upstream.

gpr_get() return the entire pt_regs (include sr) to userspace, if we
don't restore the C bit in gpr_set, it may break the ALU result in
that context. So the C flag bit is part of gpr context, that's why
riscv totally remove the C bit in the ISA. That makes sr reg clear
from userspace to supervisor privilege.

Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/csky/kernel/ptrace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/csky/kernel/ptrace.c b/arch/csky/kernel/ptrace.c
index a4cf2e2ac15a..ac07695bc541 100644
--- a/arch/csky/kernel/ptrace.c
+++ b/arch/csky/kernel/ptrace.c
@@ -98,7 +98,8 @@ static int gpr_set(struct task_struct *target,
 	if (ret)
 		return ret;
 
-	regs.sr = task_pt_regs(target)->sr;
+	/* BIT(0) of regs.sr is Condition Code/Carry bit */
+	regs.sr = (regs.sr & BIT(0)) | (task_pt_regs(target)->sr & ~BIT(0));
 #ifdef CONFIG_CPU_HAS_HILO
 	regs.dcsr = task_pt_regs(target)->dcsr;
 #endif

From a31c33aa80a550b3848024533bda215a0aa52e0b Mon Sep 17 00:00:00 2001
From: Mike Kravetz <mike.kravetz@oracle.com>
Date: Tue, 5 Oct 2021 13:25:29 -0700
Subject: [PATCH 0858/1750] arm64/hugetlb: fix CMA gigantic page order for
 non-4K PAGE_SIZE

commit 2e5809a4ddb15969503e43b06662a9a725f613ea upstream.

For non-4K PAGE_SIZE configs, the largest gigantic huge page size is
CONT_PMD_SHIFT order. On arm64 with 64K PAGE_SIZE, the gigantic page is
16G. Therefore, one should be able to specify 'hugetlb_cma=16G' on the
kernel command line so that one gigantic page can be allocated from CMA.
However, when adding such an option the following message is produced:

hugetlb_cma: cma area should be at least 8796093022208 MiB

This is because the calculation for non-4K gigantic page order is
incorrect in the arm64 specific routine arm64_hugetlb_cma_reserve().

Fixes: abb7962adc80 ("arm64/hugetlb: Reserve CMA areas for gigantic pages on 16K and 64K configs")
Cc: <stable@vger.kernel.org> # 5.9.x
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Link: https://lore.kernel.org/r/20211005202529.213812-1-mike.kravetz@oracle.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/mm/hugetlbpage.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 55ecf6de9ff7..99cd6e718408 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c
@@ -43,7 +43,7 @@ void __init arm64_hugetlb_cma_reserve(void)
 #ifdef CONFIG_ARM64_4K_PAGES
 	order = PUD_SHIFT - PAGE_SHIFT;
 #else
-	order = CONT_PMD_SHIFT + PMD_SHIFT - PAGE_SHIFT;
+	order = CONT_PMD_SHIFT - PAGE_SHIFT;
 #endif
 	/*
 	 * HugeTLB CMA reservation is required for gigantic

From e7e3ed5c92b6b7255f19605b56de2bf7a0f2f7db Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Fri, 17 Sep 2021 02:59:13 +0200
Subject: [PATCH 0859/1750] drm/msm: Avoid potential overflow in
 timeout_to_jiffies()

commit 171316a68d9a8e0d9e28b7cf4c15afc4c6244a4e upstream.

The return type of ktime_divns() is s64. The timeout_to_jiffies() currently
assigns the result of this ktime_divns() to unsigned long, which on 32 bit
systems may overflow. Furthermore, the result of this function is sometimes
also passed to functions which expect signed long, dma_fence_wait_timeout()
is one such example.

Fix this by adjusting the type of remaining_jiffies to s64, so we do not
suffer overflow there, and return a value limited to range of 0..INT_MAX,
which is safe for all usecases of this timeout.

The above overflow can be triggered if userspace passes in too large timeout
value, larger than INT_MAX / HZ seconds. The kernel detects it and complains
about "schedule_timeout: wrong timeout value %lx" and generates a warning
backtrace.

Note that this fixes commit 6cedb8b377bb ("drm/msm: avoid using 'timespec'"),
because the previously used timespec_to_jiffies() function returned unsigned
long instead of s64:
static inline unsigned long timespec_to_jiffies(const struct timespec *value)

Fixes: 6cedb8b377bb ("drm/msm: avoid using 'timespec'")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Jordan Crouse <jcrouse@codeaurora.org>
Cc: Rob Clark <robdclark@chromium.org>
Cc: stable@vger.kernel.org # 5.6+
Acked-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210917005913.157379-1-marex@denx.de
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/msm_drv.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index 0b2686b060c7..d96b254b8aa4 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -543,7 +543,7 @@ static inline int align_pitch(int width, int bpp)
 static inline unsigned long timeout_to_jiffies(const ktime_t *timeout)
 {
 	ktime_t now = ktime_get();
-	unsigned long remaining_jiffies;
+	s64 remaining_jiffies;
 
 	if (ktime_compare(*timeout, now) < 0) {
 		remaining_jiffies = 0;
@@ -552,7 +552,7 @@ static inline unsigned long timeout_to_jiffies(const ktime_t *timeout)
 		remaining_jiffies = ktime_divns(rem, NSEC_PER_SEC / HZ);
 	}
 
-	return remaining_jiffies;
+	return clamp(remaining_jiffies, 0LL, (s64)INT_MAX);
 }
 
 #endif /* __MSM_DRV_H__ */

From 206868a5b6c14adc4098dd3210a2f7510d97a670 Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Tue, 14 Sep 2021 14:57:59 +0800
Subject: [PATCH 0860/1750] btrfs: unlock newly allocated extent buffer after
 error

commit 19ea40dddf1833db868533958ca066f368862211 upstream.

[BUG]
There is a bug report that injected ENOMEM error could leave a tree
block locked while we return to user-space:

  BTRFS info (device loop0): enabling ssd optimizations
  FAULT_INJECTION: forcing a failure.
  name failslab, interval 1, probability 0, space 0, times 0
  CPU: 0 PID: 7579 Comm: syz-executor Not tainted 5.15.0-rc1 #16
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
  rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
  Call Trace:
   __dump_stack lib/dump_stack.c:88 [inline]
   dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106
   fail_dump lib/fault-inject.c:52 [inline]
   should_fail+0x13c/0x160 lib/fault-inject.c:146
   should_failslab+0x5/0x10 mm/slab_common.c:1328
   slab_pre_alloc_hook.constprop.99+0x4e/0xc0 mm/slab.h:494
   slab_alloc_node mm/slub.c:3120 [inline]
   slab_alloc mm/slub.c:3214 [inline]
   kmem_cache_alloc+0x44/0x280 mm/slub.c:3219
   btrfs_alloc_delayed_extent_op fs/btrfs/delayed-ref.h:299 [inline]
   btrfs_alloc_tree_block+0x38c/0x670 fs/btrfs/extent-tree.c:4833
   __btrfs_cow_block+0x16f/0x7d0 fs/btrfs/ctree.c:415
   btrfs_cow_block+0x12a/0x300 fs/btrfs/ctree.c:570
   btrfs_search_slot+0x6b0/0xee0 fs/btrfs/ctree.c:1768
   btrfs_insert_empty_items+0x80/0xf0 fs/btrfs/ctree.c:3905
   btrfs_new_inode+0x311/0xa60 fs/btrfs/inode.c:6530
   btrfs_create+0x12b/0x270 fs/btrfs/inode.c:6783
   lookup_open+0x660/0x780 fs/namei.c:3282
   open_last_lookups fs/namei.c:3352 [inline]
   path_openat+0x465/0xe20 fs/namei.c:3557
   do_filp_open+0xe3/0x170 fs/namei.c:3588
   do_sys_openat2+0x357/0x4a0 fs/open.c:1200
   do_sys_open+0x87/0xd0 fs/open.c:1216
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x34/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  RIP: 0033:0x46ae99
  Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48
  89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d
  01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
  RSP: 002b:00007f46711b9c48 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
  RAX: ffffffffffffffda RBX: 000000000078c0a0 RCX: 000000000046ae99
  RDX: 0000000000000000 RSI: 00000000000000a1 RDI: 0000000020005800
  RBP: 00007f46711b9c80 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000017
  R13: 0000000000000000 R14: 000000000078c0a0 R15: 00007ffc129da6e0

  ================================================
  WARNING: lock held when returning to user space!
  5.15.0-rc1 #16 Not tainted
  ------------------------------------------------
  syz-executor/7579 is leaving the kernel with locks still held!
  1 lock held by syz-executor/7579:
   #0: ffff888104b73da8 (btrfs-tree-01/1){+.+.}-{3:3}, at:
  __btrfs_tree_lock+0x2e/0x1a0 fs/btrfs/locking.c:112

[CAUSE]
In btrfs_alloc_tree_block(), after btrfs_init_new_buffer(), the new
extent buffer @buf is locked, but if later operations like adding
delayed tree ref fail, we just free @buf without unlocking it,
resulting above warning.

[FIX]
Unlock @buf in out_free_buf: label.

Reported-by: Hao Sun <sunhao.th@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/CACkBjsZ9O6Zr0KK1yGn=1rQi6Crh1yeCRdTSBxx9R99L4xdn-Q@mail.gmail.com/
CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/extent-tree.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index c346c46020e5..284294620e9f 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4715,6 +4715,7 @@ struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans,
 out_free_delayed:
 	btrfs_free_delayed_extent_op(extent_op);
 out_free_buf:
+	btrfs_tree_unlock(buf);
 	free_extent_buffer(buf);
 out_free_reserved:
 	btrfs_free_reserved_extent(fs_info, ins.objectid, ins.offset, 0);

From 95d3aba5febea20d185888763e5dbf7966ad8947 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 1 Oct 2021 13:52:31 +0100
Subject: [PATCH 0861/1750] btrfs: deal with errors when replaying dir entry
 during log replay

commit e15ac6413745e3def00e663de00aea5a717311c1 upstream.

At replay_one_one(), we are treating any error returned from
btrfs_lookup_dir_item() or from btrfs_lookup_dir_index_item() as meaning
that there is no existing directory entry in the fs/subvolume tree.
This is not correct since we can get errors such as, for example, -EIO
when reading extent buffers while searching the fs/subvolume's btree.

So fix that and return the error to the caller when it is not -ENOENT.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 7bf3936aceda..ca8fbc7ef473 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1938,7 +1938,14 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
 		ret = -EINVAL;
 		goto out;
 	}
-	if (IS_ERR_OR_NULL(dst_di)) {
+
+	if (dst_di == ERR_PTR(-ENOENT))
+		dst_di = NULL;
+
+	if (IS_ERR(dst_di)) {
+		ret = PTR_ERR(dst_di);
+		goto out;
+	} else if (!dst_di) {
 		/* we need a sequence number to insert, so we only
 		 * do inserts for the BTRFS_DIR_INDEX_KEY types
 		 */

From 4ed68471bc370ad681b85aaf22fbbffe20fb7b12 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 1 Oct 2021 13:52:32 +0100
Subject: [PATCH 0862/1750] btrfs: deal with errors when adding inode reference
 during log replay

commit 52db77791fe24538c8aa2a183248399715f6b380 upstream.

At __inode_add_ref(), we treating any error returned from
btrfs_lookup_dir_item() or from btrfs_lookup_dir_index_item() as meaning
that there is no existing directory entry in the fs/subvolume tree.
This is not correct since we can get errors such as, for example, -EIO
when reading extent buffers while searching the fs/subvolume's btree.

So fix that and return the error to the caller when it is not -ENOENT.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index ca8fbc7ef473..66d275bf76bc 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1137,7 +1137,10 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans,
 	/* look for a conflicting sequence number */
 	di = btrfs_lookup_dir_index_item(trans, root, path, btrfs_ino(dir),
 					 ref_index, name, namelen, 0);
-	if (di && !IS_ERR(di)) {
+	if (IS_ERR(di)) {
+		if (PTR_ERR(di) != -ENOENT)
+			return PTR_ERR(di);
+	} else if (di) {
 		ret = drop_one_dir_item(trans, root, path, dir, di);
 		if (ret)
 			return ret;
@@ -1147,7 +1150,9 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans,
 	/* look for a conflicting name */
 	di = btrfs_lookup_dir_item(trans, root, path, btrfs_ino(dir),
 				   name, namelen, 0);
-	if (di && !IS_ERR(di)) {
+	if (IS_ERR(di)) {
+		return PTR_ERR(di);
+	} else if (di) {
 		ret = drop_one_dir_item(trans, root, path, dir, di);
 		if (ret)
 			return ret;

From 352349aa4948491d0ca2ac0e2af5ccf9b82d0d4c Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 1 Oct 2021 13:48:18 +0100
Subject: [PATCH 0863/1750] btrfs: check for error when looking up inode during
 dir entry replay

commit cfd312695b71df04c3a2597859ff12c470d1e2e4 upstream.

At replay_one_name(), we are treating any error from btrfs_lookup_inode()
as if the inode does not exists. Fix this by checking for an error and
returning it to the caller.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 66d275bf76bc..c3bb5c4375ab 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -1902,8 +1902,8 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
 	struct btrfs_key log_key;
 	struct inode *dir;
 	u8 log_type;
-	int exists;
-	int ret = 0;
+	bool exists;
+	int ret;
 	bool update_size = (key->type == BTRFS_DIR_INDEX_KEY);
 	bool name_added = false;
 
@@ -1923,12 +1923,12 @@ static noinline int replay_one_name(struct btrfs_trans_handle *trans,
 		   name_len);
 
 	btrfs_dir_item_key_to_cpu(eb, di, &log_key);
-	exists = btrfs_lookup_inode(trans, root, path, &log_key, 0);
-	if (exists == 0)
-		exists = 1;
-	else
-		exists = 0;
+	ret = btrfs_lookup_inode(trans, root, path, &log_key, 0);
 	btrfs_release_path(path);
+	if (ret < 0)
+		goto out;
+	exists = (ret == 0);
+	ret = 0;
 
 	if (key->type == BTRFS_DIR_ITEM_KEY) {
 		dst_di = btrfs_lookup_dir_item(trans, root, path, key->objectid,

From 52924879ed450b5c0731c7abd670f2ac57dde93d Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Fri, 1 Oct 2021 13:57:18 -0400
Subject: [PATCH 0864/1750] btrfs: update refs for any root except tree log
 roots

commit d175209be04d7d263fa1a54cde7608c706c9d0d7 upstream.

I hit a stuck relocation on btrfs/061 during my overnight testing.  This
turned out to be because we had left over extent entries in our extent
root for a data reloc inode that no longer existed.  This happened
because in btrfs_drop_extents() we only update refs if we have SHAREABLE
set or we are the tree_root.  This regression was introduced by
aeb935a45581 ("btrfs: don't set SHAREABLE flag for data reloc tree")
where we stopped setting SHAREABLE for the data reloc tree.

The problem here is we actually do want to update extent references for
data extents in the data reloc tree, in fact we only don't want to
update extent references if the file extents are in the log tree.
Update this check to only skip updating references in the case of the
log tree.

This is relatively rare, because you have to be running scrub at the
same time, which is what btrfs/061 does.  The data reloc inode has its
extents pre-allocated, and then we copy the extent into the
pre-allocated chunks.  We theoretically should never be calling
btrfs_drop_extents() on a data reloc inode.  The exception of course is
with scrub, if our pre-allocated extent falls inside of the block group
we are scrubbing, then the block group will be marked read only and we
will be forced to cow that extent.  This means we will call
btrfs_drop_extents() on that range when we COW that file extent.

This isn't really problematic if we do this, the data reloc inode
requires that our extent lengths match exactly with the extent we are
copying, thankfully we validate the extent is correct with
get_new_location(), so if we happen to COW only part of the extent we
won't link it in when we do the relocation, so we are safe from any
other shenanigans that arise because of this interaction with scrub.

Fixes: aeb935a45581 ("btrfs: don't set SHAREABLE flag for data reloc tree")
CC: stable@vger.kernel.org # 5.8+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/file.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 6ab91661cd26..711483d15c4c 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -710,8 +710,7 @@ int __btrfs_drop_extents(struct btrfs_trans_handle *trans,
 	if (start >= inode->disk_i_size && !replace_extent)
 		modify_tree = 0;
 
-	update_refs = (test_bit(BTRFS_ROOT_SHAREABLE, &root->state) ||
-		       root == fs_info->tree_root);
+	update_refs = (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID);
 	while (1) {
 		recow = 0;
 		ret = btrfs_lookup_file_extent(trans, root, path, ino,

From 0e32a2b85c7d92ece86c17dfef390c5ed79c6378 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 5 Oct 2021 16:35:27 -0400
Subject: [PATCH 0865/1750] btrfs: fix abort logic in
 btrfs_replace_file_extents

commit 4afb912f439c4bc4e6a4f3e7547f2e69e354108f upstream.

Error injection testing uncovered a case where we'd end up with a
corrupt file system with a missing extent in the middle of a file.  This
occurs because the if statement to decide if we should abort is wrong.

The only way we would abort in this case is if we got a ret !=
-EOPNOTSUPP and we called from the file clone code.  However the
prealloc code uses this path too.  Instead we need to abort if there is
an error, and the only error we _don't_ abort on is -EOPNOTSUPP and only
if we came from the clone file code.

CC: stable@vger.kernel.org # 5.10+
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/file.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 711483d15c4c..f59ec55e5feb 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2661,14 +2661,16 @@ int btrfs_replace_file_extents(struct inode *inode, struct btrfs_path *path,
 					   1, 0, 0, NULL);
 		if (ret != -ENOSPC) {
 			/*
-			 * When cloning we want to avoid transaction aborts when
-			 * nothing was done and we are attempting to clone parts
-			 * of inline extents, in such cases -EOPNOTSUPP is
-			 * returned by __btrfs_drop_extents() without having
-			 * changed anything in the file.
+			 * The only time we don't want to abort is if we are
+			 * attempting to clone a partial inline extent, in which
+			 * case we'll get EOPNOTSUPP.  However if we aren't
+			 * clone we need to abort no matter what, because if we
+			 * got EOPNOTSUPP via prealloc then we messed up and
+			 * need to abort.
 			 */
-			if (extent_info && !extent_info->is_new_extent &&
-			    ret && ret != -EOPNOTSUPP)
+			if (ret &&
+			    (ret != -EOPNOTSUPP ||
+			     (extent_info && extent_info->is_new_extent)))
 				btrfs_abort_transaction(trans, ret);
 			break;
 		}

From e4f7171c2395fd822585e721c25e1039759ed11d Mon Sep 17 00:00:00 2001
From: James Morse <james.morse@arm.com>
Date: Fri, 17 Sep 2021 16:59:58 +0000
Subject: [PATCH 0866/1750] x86/resctrl: Free the ctrlval arrays when
 domain_setup_mon_state() fails

commit 64e87d4bd3201bf8a4685083ee4daf5c0d001452 upstream.

domain_add_cpu() is called whenever a CPU is brought online. The
earlier call to domain_setup_ctrlval() allocates the control value
arrays.

If domain_setup_mon_state() fails, the control value arrays are not
freed.

Add the missing kfree() calls.

Fixes: 1bd2a63b4f0de ("x86/intel_rdt/mba_sc: Add initialization support")
Fixes: edf6fa1c4a951 ("x86/intel_rdt/cqm: Add RMID (Resource monitoring ID) management")
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20210917165958.28313-1-james.morse@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/resctrl/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/kernel/cpu/resctrl/core.c b/arch/x86/kernel/cpu/resctrl/core.c
index e8b5f1cf1ae8..4ccb9039f595 100644
--- a/arch/x86/kernel/cpu/resctrl/core.c
+++ b/arch/x86/kernel/cpu/resctrl/core.c
@@ -590,6 +590,8 @@ static void domain_add_cpu(int cpu, struct rdt_resource *r)
 	}
 
 	if (r->mon_capable && domain_setup_mon_state(r, d)) {
+		kfree(d->ctrl_val);
+		kfree(d->mbps_val);
 		kfree(d);
 		return;
 	}

From 9f0d6c781cb5ebb03a2ae80d94cfedf2e0d1b4e3 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Fri, 1 Oct 2021 20:36:44 +0300
Subject: [PATCH 0867/1750] mei: me: add Ice Lake-N device id.

commit 75c10c5e7a715550afdd51ef8cfd1d975f48f9e1 upstream.

Add Ice Lake-N device ID.

The device can be found on MacBookPro16,2 [1].

[1]: https://linux-hardware.org/?probe=f1c5cf0c43

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211001173644.16068-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/mei/hw-me-regs.h | 1 +
 drivers/misc/mei/pci-me.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
index cb34925e10f1..67bb6a25fd0a 100644
--- a/drivers/misc/mei/hw-me-regs.h
+++ b/drivers/misc/mei/hw-me-regs.h
@@ -92,6 +92,7 @@
 #define MEI_DEV_ID_CDF        0x18D3  /* Cedar Fork */
 
 #define MEI_DEV_ID_ICP_LP     0x34E0  /* Ice Lake Point LP */
+#define MEI_DEV_ID_ICP_N      0x38E0  /* Ice Lake Point N */
 
 #define MEI_DEV_ID_JSP_N      0x4DE0  /* Jasper Lake Point N */
 
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index c3393b383e59..3a45aaf002ac 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -96,6 +96,7 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 	{MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H_3, MEI_ME_PCH8_ITOUCH_CFG)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+	{MEI_PCI_DEVICE(MEI_DEV_ID_ICP_N, MEI_ME_PCH12_CFG)},
 
 	{MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH15_CFG)},
 	{MEI_PCI_DEVICE(MEI_DEV_ID_TGP_H, MEI_ME_PCH15_SPS_CFG)},

From 0ee66290f00602d91413a3779b0f5ee7e7dd51d9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 8 Oct 2021 12:25:45 +0300
Subject: [PATCH 0868/1750] USB: xhci: dbc: fix tty registration race

commit 880de403777376e50bdf60def359fa50a722006f upstream.

Make sure to allocate resources before registering the tty device to
avoid having a racing open() and write() fail to enable rx or
dereference a NULL pointer when accessing the uninitialised fifo.

Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Cc: stable@vger.kernel.org      # 4.16
Cc: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211008092547.3996295-4-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-dbgtty.c | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c
index ae4e4ab638b5..2a53b2831999 100644
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -408,40 +408,38 @@ static int xhci_dbc_tty_register_device(struct xhci_dbc *dbc)
 		return -EBUSY;
 
 	xhci_dbc_tty_init_port(dbc, port);
-	tty_dev = tty_port_register_device(&port->port,
-					   dbc_tty_driver, 0, NULL);
-	if (IS_ERR(tty_dev)) {
-		ret = PTR_ERR(tty_dev);
-		goto register_fail;
-	}
 
 	ret = kfifo_alloc(&port->write_fifo, DBC_WRITE_BUF_SIZE, GFP_KERNEL);
 	if (ret)
-		goto buf_alloc_fail;
+		goto err_exit_port;
 
 	ret = xhci_dbc_alloc_requests(dbc, BULK_IN, &port->read_pool,
 				      dbc_read_complete);
 	if (ret)
-		goto request_fail;
+		goto err_free_fifo;
 
 	ret = xhci_dbc_alloc_requests(dbc, BULK_OUT, &port->write_pool,
 				      dbc_write_complete);
 	if (ret)
-		goto request_fail;
+		goto err_free_requests;
+
+	tty_dev = tty_port_register_device(&port->port,
+					   dbc_tty_driver, 0, NULL);
+	if (IS_ERR(tty_dev)) {
+		ret = PTR_ERR(tty_dev);
+		goto err_free_requests;
+	}
 
 	port->registered = true;
 
 	return 0;
 
-request_fail:
+err_free_requests:
 	xhci_dbc_free_requests(&port->read_pool);
 	xhci_dbc_free_requests(&port->write_pool);
+err_free_fifo:
 	kfifo_free(&port->write_fifo);
-
-buf_alloc_fail:
-	tty_unregister_device(dbc_tty_driver, 0);
-
-register_fail:
+err_exit_port:
 	xhci_dbc_tty_exit_port(port);
 
 	dev_err(dbc->dev, "can't register tty port, err %d\n", ret);

From dc3e0a20dbb9dbaa22f4a33dea34230f8c663c40 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.com>
Date: Fri, 8 Oct 2021 12:25:43 +0300
Subject: [PATCH 0869/1750] xhci: guard accesses to ep_state in
 xhci_endpoint_reset()

commit a01ba2a3378be85538e0183ae5367c1bc1d5aaf3 upstream.

See https://github.com/raspberrypi/linux/issues/3981

Two read-modify-write cycles on ep->ep_state are not guarded by
xhci->lock. Fix these.

Fixes: f5249461b504 ("xhci: Clear the host side toggle manually when endpoint is soft reset")
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211008092547.3996295-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6389dc99bc9a..0d6dc2e20f2a 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3173,10 +3173,13 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
 		return;
 
 	/* Bail out if toggle is already being cleared by a endpoint reset */
+	spin_lock_irqsave(&xhci->lock, flags);
 	if (ep->ep_state & EP_HARD_CLEAR_TOGGLE) {
 		ep->ep_state &= ~EP_HARD_CLEAR_TOGGLE;
+		spin_unlock_irqrestore(&xhci->lock, flags);
 		return;
 	}
+	spin_unlock_irqrestore(&xhci->lock, flags);
 	/* Only interrupt and bulk ep's use data toggle, USB2 spec 5.5.4-> */
 	if (usb_endpoint_xfer_control(&host_ep->desc) ||
 	    usb_endpoint_xfer_isoc(&host_ep->desc))
@@ -3262,8 +3265,10 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd,
 	xhci_free_command(xhci, cfg_cmd);
 cleanup:
 	xhci_free_command(xhci, stop_cmd);
+	spin_lock_irqsave(&xhci->lock, flags);
 	if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE)
 		ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE;
+	spin_unlock_irqrestore(&xhci->lock, flags);
 }
 
 static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,

From dec944bb7079b37968cf69c8a438f91f15c4cc61 Mon Sep 17 00:00:00 2001
From: Pavankumar Kondeti <pkondeti@codeaurora.org>
Date: Fri, 8 Oct 2021 12:25:46 +0300
Subject: [PATCH 0870/1750] xhci: Fix command ring pointer corruption while
 aborting a command

commit ff0e50d3564f33b7f4b35cadeabd951d66cfc570 upstream.

The command ring pointer is located at [6:63] bits of the command
ring control register (CRCR). All the control bits like command stop,
abort are located at [0:3] bits. While aborting a command, we read the
CRCR and set the abort bit and write to the CRCR. The read will always
give command ring pointer as all zeros. So we essentially write only
the control bits. Since we split the 64 bit write into two 32 bit writes,
there is a possibility of xHC command ring stopped before the upper
dword (all zeros) is written. If that happens, xHC updates the upper
dword of its internal command ring pointer with all zeros. Next time,
when the command ring is restarted, we see xHC memory access failures.
Fix this issue by only writing to the lower dword of CRCR where all
control bits are located.

Cc: stable@vger.kernel.org
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211008092547.3996295-5-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-ring.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index dc2068e3bedb..ec8f2910faf9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -342,16 +342,22 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
 /* Must be called with xhci->lock held, releases and aquires lock back */
 static int xhci_abort_cmd_ring(struct xhci_hcd *xhci, unsigned long flags)
 {
-	u64 temp_64;
+	u32 temp_32;
 	int ret;
 
 	xhci_dbg(xhci, "Abort command ring\n");
 
 	reinit_completion(&xhci->cmd_ring_stop_completion);
 
-	temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
-	xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
-			&xhci->op_regs->cmd_ring);
+	/*
+	 * The control bits like command stop, abort are located in lower
+	 * dword of the command ring control register. Limit the write
+	 * to the lower dword to avoid corrupting the command ring pointer
+	 * in case if the command ring is stopped by the time upper dword
+	 * is written.
+	 */
+	temp_32 = readl(&xhci->op_regs->cmd_ring);
+	writel(temp_32 | CMD_RING_ABORT, &xhci->op_regs->cmd_ring);
 
 	/* Section 4.6.1.2 of xHCI 1.0 spec says software should also time the
 	 * completion of the Command Abort operation. If CRR is not negated in 5

From d40e193abd073d8bf39ae9979633761f032c0a75 Mon Sep 17 00:00:00 2001
From: Nikolay Martynov <mar.kolya@gmail.com>
Date: Fri, 8 Oct 2021 12:25:47 +0300
Subject: [PATCH 0871/1750] xhci: Enable trust tx length quirk for Fresco FL11
 USB controller

commit ea0f69d8211963c4b2cc1998b86779a500adb502 upstream.

Tested on SD5200T TB3 dock which has Fresco Logic FL1100 USB 3.0 Host
Controller.
Before this patch streaming video from USB cam made mouse and keyboard
connected to the same USB bus unusable. Also video was jerky.
With this patch streaming video doesn't have any effect on other
periferals and video is smooth.

Cc: stable@vger.kernel.org
Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211008092547.3996295-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 119d1a8fbb19..2299866dc82f 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -30,6 +30,7 @@
 #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
 #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
 #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009	0x1009
+#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1100	0x1100
 #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400	0x1400
 
 #define PCI_VENDOR_ID_ETRON		0x1b6f
@@ -112,6 +113,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 	/* Look for vendor-specific quirks */
 	if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
 			(pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK ||
+			 pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1100 ||
 			 pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1400)) {
 		if (pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_PDK &&
 				pdev->revision == 0x0) {

From 2c5dd2a8af7704776376c8885d3b78d2442c32ed Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 27 Sep 2021 14:13:57 +0200
Subject: [PATCH 0872/1750] cb710: avoid NULL pointer subtraction

commit 42641042c10c757fe10cc09088cf3f436cec5007 upstream.

clang-14 complains about an unusual way of converting a pointer to
an integer:

drivers/misc/cb710/sgbuf2.c:50:15: error: performing pointer subtraction with a null pointer has undefined behavior [-Werror,-Wnull-pointer-subtraction]
        return ((ptr - NULL) & 3) != 0;

Replace this with a normal cast to uintptr_t.

Fixes: 5f5bac8272be ("mmc: Driver for CB710/720 memory card reader (MMC part)")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210927121408.939246-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/cb710/sgbuf2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/cb710/sgbuf2.c b/drivers/misc/cb710/sgbuf2.c
index e5a4ed3701eb..a798fad5f03c 100644
--- a/drivers/misc/cb710/sgbuf2.c
+++ b/drivers/misc/cb710/sgbuf2.c
@@ -47,7 +47,7 @@ static inline bool needs_unaligned_copy(const void *ptr)
 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
 	return false;
 #else
-	return ((ptr - NULL) & 3) != 0;
+	return ((uintptr_t)ptr & 3) != 0;
 #endif
 }
 

From 5100dc4489ab7497da9c062cb6a781a5ba04d51b Mon Sep 17 00:00:00 2001
From: Ard Biesheuvel <ardb@kernel.org>
Date: Wed, 1 Sep 2021 08:33:19 +0200
Subject: [PATCH 0873/1750] efi/cper: use stack buffer for error record
 decoding

commit b3a72ca80351917cc23f9e24c35f3c3979d3c121 upstream.

Joe reports that using a statically allocated buffer for converting CPER
error records into human readable text is probably a bad idea. Even
though we are not aware of any actual issues, a stack buffer is clearly
a better choice here anyway, so let's move the buffer into the stack
frames of the two functions that refer to it.

Cc: <stable@vger.kernel.org>
Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firmware/efi/cper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
index ea7ca74fc173..232c092c4c97 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -25,8 +25,6 @@
 #include <acpi/ghes.h>
 #include <ras/ras_event.h>
 
-static char rcd_decode_str[CPER_REC_LEN];
-
 /*
  * CPER record ID need to be unique even after reboot, because record
  * ID is used as index for ERST storage, while CPER records from
@@ -313,6 +311,7 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
 				struct cper_mem_err_compact *cmem)
 {
 	const char *ret = trace_seq_buffer_ptr(p);
+	char rcd_decode_str[CPER_REC_LEN];
 
 	if (cper_mem_err_location(cmem, rcd_decode_str))
 		trace_seq_printf(p, "%s", rcd_decode_str);
@@ -327,6 +326,7 @@ static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
 	int len)
 {
 	struct cper_mem_err_compact cmem;
+	char rcd_decode_str[CPER_REC_LEN];
 
 	/* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
 	if (len == sizeof(struct cper_sec_mem_err_old) &&

From 3b42751401424a1c0f39297b7f4317598aa33474 Mon Sep 17 00:00:00 2001
From: Zhang Jianhua <chris.zjh@huawei.com>
Date: Thu, 23 Sep 2021 10:53:40 +0800
Subject: [PATCH 0874/1750] efi: Change down_interruptible() in
 virt_efi_reset_system() to down_trylock()

commit 38fa3206bf441911258e5001ac8b6738693f8d82 upstream.

While reboot the system by sysrq, the following bug will be occur.

BUG: sleeping function called from invalid context at kernel/locking/semaphore.c:90
in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 10052, name: rc.shutdown
CPU: 3 PID: 10052 Comm: rc.shutdown Tainted: G        W O      5.10.0 #1
Call trace:
 dump_backtrace+0x0/0x1c8
 show_stack+0x18/0x28
 dump_stack+0xd0/0x110
 ___might_sleep+0x14c/0x160
 __might_sleep+0x74/0x88
 down_interruptible+0x40/0x118
 virt_efi_reset_system+0x3c/0xd0
 efi_reboot+0xd4/0x11c
 machine_restart+0x60/0x9c
 emergency_restart+0x1c/0x2c
 sysrq_handle_reboot+0x1c/0x2c
 __handle_sysrq+0xd0/0x194
 write_sysrq_trigger+0xbc/0xe4
 proc_reg_write+0xd4/0xf0
 vfs_write+0xa8/0x148
 ksys_write+0x6c/0xd8
 __arm64_sys_write+0x18/0x28
 el0_svc_common.constprop.3+0xe4/0x16c
 do_el0_svc+0x1c/0x2c
 el0_svc+0x20/0x30
 el0_sync_handler+0x80/0x17c
 el0_sync+0x158/0x180

The reason for this problem is that irq has been disabled in
machine_restart() and then it calls down_interruptible() in
virt_efi_reset_system(), which would occur sleep in irq context,
it is dangerous! Commit 99409b935c9a("locking/semaphore: Add
might_sleep() to down_*() family") add might_sleep() in
down_interruptible(), so the bug info is here. down_trylock()
can solve this problem, cause there is no might_sleep.

--------

Cc: <stable@vger.kernel.org>
Signed-off-by: Zhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firmware/efi/runtime-wrappers.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c
index 1410beaef5c3..f3e54f6616f0 100644
--- a/drivers/firmware/efi/runtime-wrappers.c
+++ b/drivers/firmware/efi/runtime-wrappers.c
@@ -414,7 +414,7 @@ static void virt_efi_reset_system(int reset_type,
 				  unsigned long data_size,
 				  efi_char16_t *data)
 {
-	if (down_interruptible(&efi_runtime_lock)) {
+	if (down_trylock(&efi_runtime_lock)) {
 		pr_warn("failed to invoke the reset_system() runtime service:\n"
 			"could not get exclusive access to the firmware\n");
 		return;

From 9d89e287116796bf987cc48f5c8632ef3048f8eb Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 6 Oct 2021 00:16:31 +0200
Subject: [PATCH 0875/1750] usb: musb: dsps: Fix the probe error path

commit c2115b2b16421d93d4993f3fe4c520e91d6fe801 upstream.

Commit 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after
initializing musb") has inverted the calls to
dsps_setup_optional_vbus_irq() and dsps_create_musb_pdev() without
updating correctly the error path. dsps_create_musb_pdev() allocates and
registers a new platform device which must be unregistered and freed
with platform_device_unregister(), and this is missing upon
dsps_setup_optional_vbus_irq() error.

While on the master branch it seems not to trigger any issue, I observed
a kernel crash because of a NULL pointer dereference with a v5.10.70
stable kernel where the patch mentioned above was backported. With this
kernel version, -EPROBE_DEFER is returned the first time
dsps_setup_optional_vbus_irq() is called which triggers the probe to
error out without unregistering the platform device. Unfortunately, on
the Beagle Bone Black Wireless, the platform device still living in the
system is being used by the USB Ethernet gadget driver, which during the
boot phase triggers the crash.

My limited knowledge of the musb world prevents me to revert this commit
which was sent to silence a robot warning which, as far as I understand,
does not make sense. The goal of this patch was to prevent an IRQ to
fire before the platform device being registered. I think this cannot
ever happen due to the fact that enabling the interrupts is done by the
->enable() callback of the platform musb device, and this platform
device must be already registered in order for the core or any other
user to use this callback.

Hence, I decided to fix the error path, which might prevent future
errors on mainline kernels while also fixing older ones.

Fixes: 7c75bde329d7 ("usb: musb: musb_dsps: request_irq() after initializing musb")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/r/20211005221631.1529448-1-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/musb/musb_dsps.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index ce9fc46c9266..b5935834f9d2 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -899,11 +899,13 @@ static int dsps_probe(struct platform_device *pdev)
 	if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) {
 		ret = dsps_setup_optional_vbus_irq(pdev, glue);
 		if (ret)
-			goto err;
+			goto unregister_pdev;
 	}
 
 	return 0;
 
+unregister_pdev:
+	platform_device_unregister(glue->musb);
 err:
 	pm_runtime_disable(&pdev->dev);
 	iounmap(glue->usbss_base);

From 3147f57215887de916811d80acdf3f5671ddf515 Mon Sep 17 00:00:00 2001
From: Michael Cullen <michael@michaelcullen.name>
Date: Fri, 15 Oct 2021 13:17:50 -0700
Subject: [PATCH 0876/1750] Input: xpad - add support for another USB ID of
 Nacon GC-100

commit 3378a07daa6cdd11e042797454c706d1c69f9ca6 upstream.

The Nacon GX100XF is already mapped, but it seems there is a Nacon
GC-100 (identified as NC5136Wht PCGC-100WHITE though I believe other
colours exist) with a different USB ID when in XInput mode.

Signed-off-by: Michael Cullen <michael@michaelcullen.name>
Link: https://lore.kernel.org/r/20211015192051.5196-1-michael@michaelcullen.name
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/xpad.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index e5f1e3cf9179..ba101afcfc27 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -331,6 +331,7 @@ static const struct xpad_device {
 	{ 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
 	{ 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
 	{ 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
+	{ 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
 	{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
 	{ 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX },
 	{ 0x0000, 0x0000, "Generic X-Box pad", 0, XTYPE_UNKNOWN }
@@ -447,6 +448,7 @@ static const struct usb_device_id xpad_table[] = {
 	XPAD_XBOXONE_VENDOR(0x24c6),		/* PowerA Controllers */
 	XPAD_XBOXONE_VENDOR(0x2e24),		/* Hyperkin Duke X-Box One pad */
 	XPAD_XBOX360_VENDOR(0x2f24),		/* GameSir Controllers */
+	XPAD_XBOX360_VENDOR(0x3285),		/* Nacon GC-100 */
 	{ }
 };
 

From d4b77900cffe7ccaefcf7fa3a3a5b06a882b282c Mon Sep 17 00:00:00 2001
From: Aleksander Morgado <aleksander@aleksander.es>
Date: Thu, 7 Oct 2021 14:25:01 +0200
Subject: [PATCH 0877/1750] USB: serial: qcserial: add EM9191 QDL support

commit 11c52d250b34a0862edc29db03fbec23b30db6da upstream.

When the module boots into QDL download mode it exposes the 1199:90d2
ids, which can be mapped to the qcserial driver, and used to run
firmware upgrades (e.g. with the qmi-firmware-update program).

  T:  Bus=01 Lev=03 Prnt=08 Port=03 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
  D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
  P:  Vendor=1199 ProdID=90d2 Rev=00.00
  S:  Manufacturer=Sierra Wireless, Incorporated
  S:  Product=Sierra Wireless EM9191
  S:  SerialNumber=8W0382004102A109
  C:  #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=2mA
  I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=qcserial

Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/qcserial.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 83da8236e3c8..c18bf8164bc2 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -165,6 +165,7 @@ static const struct usb_device_id id_table[] = {
 	{DEVICE_SWI(0x1199, 0x907b)},	/* Sierra Wireless EM74xx */
 	{DEVICE_SWI(0x1199, 0x9090)},	/* Sierra Wireless EM7565 QDL */
 	{DEVICE_SWI(0x1199, 0x9091)},	/* Sierra Wireless EM7565 */
+	{DEVICE_SWI(0x1199, 0x90d2)},	/* Sierra Wireless EM9191 QDL */
 	{DEVICE_SWI(0x413c, 0x81a2)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
 	{DEVICE_SWI(0x413c, 0x81a3)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
 	{DEVICE_SWI(0x413c, 0x81a4)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */

From bf26bc72dc5927b28480f0983c447f789eb89ef7 Mon Sep 17 00:00:00 2001
From: Yu-Tung Chang <mtwget@gmail.com>
Date: Thu, 30 Sep 2021 10:11:12 +0800
Subject: [PATCH 0878/1750] USB: serial: option: add Quectel EC200S-CN module
 support

commit 2263eb7370060bdb0013bc14e1a7c9bf33617a55 upstream.

Add usb product id of the Quectel EC200S-CN module.

usb-devices output for 0x6002:
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=6002 Rev=03.18
S:  Manufacturer=Android
S:  Product=Android
S:  SerialNumber=0000
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
I:  If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:  If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)

Signed-off-by: Yu-Tung Chang <mtwget@gmail.com>
Link: https://lore.kernel.org/r/20210930021112.330396-1-mtwget@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 1e990a8264a5..07ad5b8df22c 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -251,6 +251,7 @@ static void option_instat_callback(struct urb *urb);
 #define QUECTEL_PRODUCT_EP06			0x0306
 #define QUECTEL_PRODUCT_EM12			0x0512
 #define QUECTEL_PRODUCT_RM500Q			0x0800
+#define QUECTEL_PRODUCT_EC200S_CN		0x6002
 #define QUECTEL_PRODUCT_EC200T			0x6026
 
 #define CMOTECH_VENDOR_ID			0x16d8
@@ -1128,6 +1129,7 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
 	  .driver_info = ZLP },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
 
 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },

From ecad614b0c6885761d0decdc1291749a0876dd4f Mon Sep 17 00:00:00 2001
From: Daniele Palmas <dnlplm@gmail.com>
Date: Mon, 4 Oct 2021 12:56:55 +0200
Subject: [PATCH 0879/1750] USB: serial: option: add Telit LE910Cx composition
 0x1204

commit f5a8a07edafed8bede17a95ef8940fe3a57a77d5 upstream.

Add the following Telit LE910Cx composition:

0x1204: tty, adb, mbim, tty, tty, tty, tty

Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Link: https://lore.kernel.org/r/20211004105655.8515-1-dnlplm@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 07ad5b8df22c..2ac8a800ec54 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1229,6 +1229,8 @@ static const struct usb_device_id option_ids[] = {
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff),	/* Telit LE910Cx (RNDIS) */
 	  .driver_info = NCTRL(2) | RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1204, 0xff),	/* Telit LE910Cx (MBIM) */
+	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),

From 3f0ca245a834119536e0d054ae3b5f85cb12628b Mon Sep 17 00:00:00 2001
From: Tomaz Solc <tomaz.solc@tablix.org>
Date: Wed, 6 Oct 2021 14:57:50 +0200
Subject: [PATCH 0880/1750] USB: serial: option: add prod. id for Quectel EG91

commit c184accc4a42c7872dc8e8d0fc97a740dc61fe24 upstream.

Adding support for Quectel EG91 LTE module.

The interface layout is same as for EG95.

usb-devices output:
T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=2c7c ProdID=0191 Rev=03.18
S:  Manufacturer=Android
S:  Product=Android
C:  #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:  If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I:  If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
I:  If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan

Interfaces:

0: Diag
1: GNSS
2: AT-command interface/modem
3: Modem
4: QMI

Signed-off-by: Tomaz Solc <tomaz.solc@tablix.org>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/option.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 2ac8a800ec54..c7356718a7c6 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -246,6 +246,7 @@ static void option_instat_callback(struct urb *urb);
 /* These Quectel products use Quectel's vendor ID */
 #define QUECTEL_PRODUCT_EC21			0x0121
 #define QUECTEL_PRODUCT_EC25			0x0125
+#define QUECTEL_PRODUCT_EG91			0x0191
 #define QUECTEL_PRODUCT_EG95			0x0195
 #define QUECTEL_PRODUCT_BG96			0x0296
 #define QUECTEL_PRODUCT_EP06			0x0306
@@ -1112,6 +1113,9 @@ static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0xff, 0xff),
 	  .driver_info = NUMEP2 },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25, 0xff, 0, 0) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG91, 0xff, 0xff, 0xff),
+	  .driver_info = NUMEP2 },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG91, 0xff, 0, 0) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff),
 	  .driver_info = NUMEP2 },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) },

From 86e3ad8b759d1152d69442a4bb36cfa65448c9e7 Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Date: Wed, 22 Sep 2021 16:43:26 +0100
Subject: [PATCH 0881/1750] misc: fastrpc: Add missing lock before accessing
 find_vma()

commit f9a470db2736b01538ad193c316eb3f26be37d58 upstream.

fastrpc driver is using find_vma() without any protection, as a
result we see below warning due to recent patch 5b78ed24e8ec
("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()")
which added mmap_assert_locked() in find_vma() function.

This bug went un-noticed in previous versions. Fix this issue by adding
required protection while calling find_vma().

CPU: 0 PID: 209746 Comm: benchmark_model Not tainted 5.15.0-rc2-00445-ge14fe2bf817a-dirty #969
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : find_vma+0x64/0xd0
lr : find_vma+0x60/0xd0
sp : ffff8000158ebc40
...

Call trace:
 find_vma+0x64/0xd0
 fastrpc_internal_invoke+0x570/0xda8
 fastrpc_device_ioctl+0x3e0/0x928
 __arm64_sys_ioctl+0xac/0xf0
 invoke_syscall+0x44/0x100
 el0_svc_common.constprop.3+0x70/0xf8
 do_el0_svc+0x24/0x88
 el0_svc+0x3c/0x138
 el0t_64_sync_handler+0x90/0xb8
 el0t_64_sync+0x180/0x184

Fixes: 80f3afd72bd4 ("misc: fastrpc: consider address offset before sending to DSP")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20210922154326.8927-1-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/fastrpc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 273d9c159179..a9c9d86eef4b 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -812,10 +812,12 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx)
 			rpra[i].pv = (u64) ctx->args[i].ptr;
 			pages[i].addr = ctx->maps[i]->phys;
 
+			mmap_read_lock(current->mm);
 			vma = find_vma(current->mm, ctx->args[i].ptr);
 			if (vma)
 				pages[i].addr += ctx->args[i].ptr -
 						 vma->vm_start;
+			mmap_read_unlock(current->mm);
 
 			pg_start = (ctx->args[i].ptr & PAGE_MASK) >> PAGE_SHIFT;
 			pg_end = ((ctx->args[i].ptr + len - 1) & PAGE_MASK) >>

From 92e6e08ca2b056d0474a599527556c4ecc30ebbf Mon Sep 17 00:00:00 2001
From: Halil Pasic <pasic@linux.ibm.com>
Date: Mon, 11 Oct 2021 07:39:21 +0200
Subject: [PATCH 0882/1750] virtio: write back F_VERSION_1 before validate

commit 2f9a174f918e29608564c7a4e8329893ab604fb4 upstream.

The virtio specification virtio-v1.1-cs01 states: "Transitional devices
MUST detect Legacy drivers by detecting that VIRTIO_F_VERSION_1 has not
been acknowledged by the driver."  This is exactly what QEMU as of 6.1
has done relying solely on VIRTIO_F_VERSION_1 for detecting that.

However, the specification also says: "... the driver MAY read (but MUST
NOT write) the device-specific configuration fields to check that it can
support the device ..." before setting FEATURES_OK.

In that case, any transitional device relying solely on
VIRTIO_F_VERSION_1 for detecting legacy drivers will return data in
legacy format.  In particular, this implies that it is in big endian
format for big endian guests. This naturally confuses the driver which
expects little endian in the modern mode.

It is probably a good idea to amend the spec to clarify that
VIRTIO_F_VERSION_1 can only be relied on after the feature negotiation
is complete. Before validate callback existed, config space was only
read after FEATURES_OK. However, we already have two regressions, so
let's address this here as well.

The regressions affect the VIRTIO_NET_F_MTU feature of virtio-net and
the VIRTIO_BLK_F_BLK_SIZE feature of virtio-blk for BE guests when
virtio 1.0 is used on both sides. The latter renders virtio-blk unusable
with DASD backing, because things simply don't work with the default.
See Fixes tags for relevant commits.

For QEMU, we can work around the issue by writing out the feature bits
with VIRTIO_F_VERSION_1 bit set.  We (ab)use the finalize_features
config op for this. This isn't enough to address all vhost devices since
these do not get the features until FEATURES_OK, however it looks like
the affected devices actually never handled the endianness for legacy
mode correctly, so at least that's not a regression.

No devices except virtio net and virtio blk seem to be affected.

Long term the right thing to do is to fix the hypervisors.

Cc: <stable@vger.kernel.org> #v4.11
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Fixes: 82e89ea077b9 ("virtio-blk: Add validation for block size in config space")
Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range")
Reported-by: markver@us.ibm.com
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Link: https://lore.kernel.org/r/20211011053921.1198936-1-pasic@linux.ibm.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/virtio/virtio.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index 84b5dec5d29c..5c53098755a3 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -240,6 +240,17 @@ static int virtio_dev_probe(struct device *_d)
 		driver_features_legacy = driver_features;
 	}
 
+	/*
+	 * Some devices detect legacy solely via F_VERSION_1. Write
+	 * F_VERSION_1 to force LE config space accesses before FEATURES_OK for
+	 * these when needed.
+	 */
+	if (drv->validate && !virtio_legacy_is_little_endian()
+			  && device_features & BIT_ULL(VIRTIO_F_VERSION_1)) {
+		dev->features = BIT_ULL(VIRTIO_F_VERSION_1);
+		dev->config->finalize_features(dev);
+	}
+
 	if (device_features & (1ULL << VIRTIO_F_VERSION_1))
 		dev->features = driver_features & device_features;
 	else

From a7bd0dd3f2ed4630a0250b46e53752d3f38831d7 Mon Sep 17 00:00:00 2001
From: Hans Potsch <hans.potsch@nokia.com>
Date: Wed, 6 Oct 2021 14:13:32 +0200
Subject: [PATCH 0883/1750] EDAC/armada-xp: Fix output of uncorrectable error
 counter

commit d9b7748ffc45250b4d7bcf22404383229bc495f5 upstream.

The number of correctable errors is displayed as uncorrectable
errors because the "SBE" error count is passed to both calls of
edac_mc_handle_error().

Pass the correct uncorrectable error count to the second
edac_mc_handle_error() call when logging uncorrectable errors.

 [ bp: Massage commit message. ]

Fixes: 7f6998a41257 ("ARM: 8888/1: EDAC: Add driver for the Marvell Armada XP SDRAM and L2 cache ECC")
Signed-off-by: Hans Potsch <hans.potsch@nokia.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20211006121332.58788-1-hans.potsch@nokia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/edac/armada_xp_edac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/armada_xp_edac.c b/drivers/edac/armada_xp_edac.c
index e3e757513d1b..b1f46a974b9e 100644
--- a/drivers/edac/armada_xp_edac.c
+++ b/drivers/edac/armada_xp_edac.c
@@ -178,7 +178,7 @@ static void axp_mc_check(struct mem_ctl_info *mci)
 				     "details unavailable (multiple errors)");
 	if (cnt_dbe)
 		edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci,
-				     cnt_sbe, /* error count */
+				     cnt_dbe, /* error count */
 				     0, 0, 0, /* pfn, offset, syndrome */
 				     -1, -1, -1, /* top, mid, low layer */
 				     mci->ctl_name,

From 57e48886401b14cd351423fabfec2cfd18df4f66 Mon Sep 17 00:00:00 2001
From: Stephen Boyd <swboyd@chromium.org>
Date: Wed, 13 Oct 2021 13:45:11 +0100
Subject: [PATCH 0884/1750] nvmem: Fix shift-out-of-bound (UBSAN) with byte
 size cells

commit 5d388fa01fa6eb310ac023a363a6cb216d9d8fe9 upstream.

If a cell has 'nbits' equal to a multiple of BITS_PER_BYTE the logic

 *p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0);

will become undefined behavior because nbits modulo BITS_PER_BYTE is 0, and we
subtract one from that making a large number that is then shifted more than the
number of bits that fit into an unsigned long.

UBSAN reports this problem:

 UBSAN: shift-out-of-bounds in drivers/nvmem/core.c:1386:8
 shift exponent 64 is too large for 64-bit type 'unsigned long'
 CPU: 6 PID: 7 Comm: kworker/u16:0 Not tainted 5.15.0-rc3+ #9
 Hardware name: Google Lazor (rev3+) with KB Backlight (DT)
 Workqueue: events_unbound deferred_probe_work_func
 Call trace:
  dump_backtrace+0x0/0x170
  show_stack+0x24/0x30
  dump_stack_lvl+0x64/0x7c
  dump_stack+0x18/0x38
  ubsan_epilogue+0x10/0x54
  __ubsan_handle_shift_out_of_bounds+0x180/0x194
  __nvmem_cell_read+0x1ec/0x21c
  nvmem_cell_read+0x58/0x94
  nvmem_cell_read_variable_common+0x4c/0xb0
  nvmem_cell_read_variable_le_u32+0x40/0x100
  a6xx_gpu_init+0x170/0x2f4
  adreno_bind+0x174/0x284
  component_bind_all+0xf0/0x264
  msm_drm_bind+0x1d8/0x7a0
  try_to_bring_up_master+0x164/0x1ac
  __component_add+0xbc/0x13c
  component_add+0x20/0x2c
  dp_display_probe+0x340/0x384
  platform_probe+0xc0/0x100
  really_probe+0x110/0x304
  __driver_probe_device+0xb8/0x120
  driver_probe_device+0x4c/0xfc
  __device_attach_driver+0xb0/0x128
  bus_for_each_drv+0x90/0xdc
  __device_attach+0xc8/0x174
  device_initial_probe+0x20/0x2c
  bus_probe_device+0x40/0xa4
  deferred_probe_work_func+0x7c/0xb8
  process_one_work+0x128/0x21c
  process_scheduled_works+0x40/0x54
  worker_thread+0x1ec/0x2a8
  kthread+0x138/0x158
  ret_from_fork+0x10/0x20

Fix it by making sure there are any bits to mask out.

Fixes: 69aba7948cbe ("nvmem: Add a simple NVMEM framework for consumers")
Cc: Douglas Anderson <dianders@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20211013124511.18726-1-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvmem/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index bb8fb2b3711d..6b170083cd24 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1229,7 +1229,8 @@ static void nvmem_shift_read_buffer_in_place(struct nvmem_cell *cell, void *buf)
 		*p-- = 0;
 
 	/* clear msb bits if any leftover in the last byte */
-	*p &= GENMASK((cell->nbits%BITS_PER_BYTE) - 1, 0);
+	if (cell->nbits % BITS_PER_BYTE)
+		*p &= GENMASK((cell->nbits % BITS_PER_BYTE) - 1, 0);
 }
 
 static int __nvmem_cell_read(struct nvmem_device *nvmem,

From 9e46bdfb55a3a2a4f72baa3df6697fc21dcb18bc Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Wed, 6 Oct 2021 19:34:55 +0200
Subject: [PATCH 0885/1750] x86/Kconfig: Do not enable
 AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically

commit 711885906b5c2df90746a51f4cd674f1ab9fbb1d upstream.

This Kconfig option was added initially so that memory encryption is
enabled by default on machines which support it.

However, devices which have DMA masks that are less than the bit
position of the encryption bit, aka C-bit, require the use of an IOMMU
or the use of SWIOTLB.

If the IOMMU is disabled or in passthrough mode, the kernel would switch
to SWIOTLB bounce-buffering for those transfers.

In order to avoid that,

  2cc13bb4f59f ("iommu: Disable passthrough mode when SME is active")

disables the default IOMMU passthrough mode so that devices for which the
default 256K DMA is insufficient, can use the IOMMU instead.

However 2, there are cases where the IOMMU is disabled in the BIOS, etc.
(think the usual hardware folk "oops, I dropped the ball there" cases) or a
driver doesn't properly use the DMA APIs or a device has a firmware or
hardware bug, e.g.:

  ea68573d408f ("drm/amdgpu: Fail to load on RAVEN if SME is active")

However 3, in the above GPU use case, there are APIs like Vulkan and
some OpenGL/OpenCL extensions which are under the assumption that
user-allocated memory can be passed in to the kernel driver and both the
GPU and CPU can do coherent and concurrent access to the same memory.
That cannot work with SWIOTLB bounce buffers, of course.

So, in order for those devices to function, drop the "default y" for the
SME by default active option so that users who want to have SME enabled,
will need to either enable it in their config or use "mem_encrypt=on" on
the kernel command line.

 [ tlendacky: Generalize commit message. ]

Fixes: 7744ccdbc16f ("x86/mm: Add Secure Memory Encryption (SME) support")
Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/8bbacd0e-4580-3194-19d2-a0ecad7df09c@molgen.mpg.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 4201d0cf5f83..c3d9f56c9018 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1534,7 +1534,6 @@ config AMD_MEM_ENCRYPT
 
 config AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT
 	bool "Activate AMD Secure Memory Encryption (SME) by default"
-	default y
 	depends on AMD_MEM_ENCRYPT
 	help
 	  Say yes to have system memory encrypted by default if running on

From ea947267eb6f21f7127e2c94858e2f981344bc44 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
Date: Mon, 11 Oct 2021 09:02:03 +0200
Subject: [PATCH 0886/1750] powerpc/xive: Discard disabled interrupts in
 get_irqchip_state()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 6f779e1d359b8d5801f677c1d49dcfa10bf95674 upstream.

When an interrupt is passed through, the KVM XIVE device calls the
set_vcpu_affinity() handler which raises the P bit to mask the
interrupt and to catch any in-flight interrupts while routing the
interrupt to the guest.

On the guest side, drivers (like some Intels) can request at probe
time some MSIs and call synchronize_irq() to check that there are no
in flight interrupts. This will call the XIVE get_irqchip_state()
handler which will always return true as the interrupt P bit has been
set on the host side and lock the CPU in an infinite loop.

Fix that by discarding disabled interrupts in get_irqchip_state().

Fixes: da15c03b047d ("powerpc/xive: Implement get_irqchip_state method for XIVE to fix shutdown race")
Cc: stable@vger.kernel.org #v5.4+
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Tested-by: seeteena <s1seetee@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211011070203.99726-1-clg@kaod.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/sysdev/xive/common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index 5b0f6b6278e3..6018f73d947d 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -997,7 +997,8 @@ static int xive_get_irqchip_state(struct irq_data *data,
 		 * interrupt to be inactive in that case.
 		 */
 		*state = (pq != XIVE_ESB_INVALID) && !xd->stale_p &&
-			(xd->saved_p || !!(pq & XIVE_ESB_VAL_P));
+			(xd->saved_p || (!!(pq & XIVE_ESB_VAL_P) &&
+			 !irqd_irq_disabled(data)));
 		return 0;
 	default:
 		return -EINVAL;

From b45923f66eb6f5df152411f1872bd01bbc5ec3e8 Mon Sep 17 00:00:00 2001
From: Billy Tsai <billy_tsai@aspeedtech.com>
Date: Tue, 31 Aug 2021 15:14:44 +0800
Subject: [PATCH 0887/1750] iio: adc: aspeed: set driver data when adc probe.

commit eb795cd97365a3d3d9da3926d234a7bc32a3bb15 upstream.

Fix the issue when adc remove will get the null driver data.

Fixed: commit 573803234e72 ("iio: Aspeed ADC")
Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com>
Link: https://lore.kernel.org/r/20210831071458.2334-2-billy_tsai@aspeedtech.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/aspeed_adc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/adc/aspeed_adc.c b/drivers/iio/adc/aspeed_adc.c
index 19efaa41bc34..34ec0c28b2df 100644
--- a/drivers/iio/adc/aspeed_adc.c
+++ b/drivers/iio/adc/aspeed_adc.c
@@ -183,6 +183,7 @@ static int aspeed_adc_probe(struct platform_device *pdev)
 
 	data = iio_priv(indio_dev);
 	data->dev = &pdev->dev;
+	platform_set_drvdata(pdev, indio_dev);
 
 	data->base = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(data->base))

From d5f13bbb51046537b2c2b9868177fb8fe8a6a6e9 Mon Sep 17 00:00:00 2001
From: Saravana Kannan <saravanak@google.com>
Date: Tue, 28 Sep 2021 17:07:33 -0700
Subject: [PATCH 0888/1750] drivers: bus: simple-pm-bus: Add support for
 probing simple bus only devices

commit 98e96cf80045a383fcc47c58dd4e87b3ae587b3e upstream.

fw_devlink could end up creating device links for bus only devices.
However, bus only devices don't get probed and can block probe() or
sync_state() [1] call backs of other devices. To avoid this, probe these
devices using the simple-pm-bus driver.

However, there are instances of devices that are not simple buses (they get
probed by their specific drivers) that also list the "simple-bus" (or other
bus only compatible strings) in their compatible property to automatically
populate their child devices. We still want these devices to get probed by
their specific drivers. So, we make sure this driver only probes devices
that are only buses.

[1] - https://lore.kernel.org/lkml/CAPDyKFo9Bxremkb1dDrr4OcXSpE0keVze94Cm=zrkOVxHHxBmQ@mail.gmail.com/

Fixes: c442a0d18744 ("driver core: Set fw_devlink to "permissive" behavior by default")
Cc: stable <stable@vger.kernel.org>
Cc: Rob Herring <robh+dt@kernel.org>
Tested-by: Saravana Kannan <saravanak@google.com>
Tested-by: Ulf Hansson <ulf.hansson@linaro.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Tested-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Saravana Kannan <saravanak@google.com>
Link: https://lore.kernel.org/r/20210929000735.585237-2-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/bus/simple-pm-bus.c | 39 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/simple-pm-bus.c b/drivers/bus/simple-pm-bus.c
index c5eb46cbf388..244b8f3b38b4 100644
--- a/drivers/bus/simple-pm-bus.c
+++ b/drivers/bus/simple-pm-bus.c
@@ -16,7 +16,33 @@
 
 static int simple_pm_bus_probe(struct platform_device *pdev)
 {
-	struct device_node *np = pdev->dev.of_node;
+	const struct device *dev = &pdev->dev;
+	struct device_node *np = dev->of_node;
+	const struct of_device_id *match;
+
+	/*
+	 * Allow user to use driver_override to bind this driver to a
+	 * transparent bus device which has a different compatible string
+	 * that's not listed in simple_pm_bus_of_match. We don't want to do any
+	 * of the simple-pm-bus tasks for these devices, so return early.
+	 */
+	if (pdev->driver_override)
+		return 0;
+
+	match = of_match_device(dev->driver->of_match_table, dev);
+	/*
+	 * These are transparent bus devices (not simple-pm-bus matches) that
+	 * have their child nodes populated automatically.  So, don't need to
+	 * do anything more. We only match with the device if this driver is
+	 * the most specific match because we don't want to incorrectly bind to
+	 * a device that has a more specific driver.
+	 */
+	if (match && match->data) {
+		if (of_property_match_string(np, "compatible", match->compatible) == 0)
+			return 0;
+		else
+			return -ENODEV;
+	}
 
 	dev_dbg(&pdev->dev, "%s\n", __func__);
 
@@ -30,14 +56,25 @@ static int simple_pm_bus_probe(struct platform_device *pdev)
 
 static int simple_pm_bus_remove(struct platform_device *pdev)
 {
+	const void *data = of_device_get_match_data(&pdev->dev);
+
+	if (pdev->driver_override || data)
+		return 0;
+
 	dev_dbg(&pdev->dev, "%s\n", __func__);
 
 	pm_runtime_disable(&pdev->dev);
 	return 0;
 }
 
+#define ONLY_BUS	((void *) 1) /* Match if the device is only a bus. */
+
 static const struct of_device_id simple_pm_bus_of_match[] = {
 	{ .compatible = "simple-pm-bus", },
+	{ .compatible = "simple-bus",	.data = ONLY_BUS },
+	{ .compatible = "simple-mfd",	.data = ONLY_BUS },
+	{ .compatible = "isa",		.data = ONLY_BUS },
+	{ .compatible = "arm,amba-bus",	.data = ONLY_BUS },
 	{ /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, simple_pm_bus_of_match);

From be8ef91d61663bfcc79f5c0eb33f9a26ab74de73 Mon Sep 17 00:00:00 2001
From: Saravana Kannan <saravanak@google.com>
Date: Wed, 29 Sep 2021 12:05:49 -0700
Subject: [PATCH 0889/1750] driver core: Reject pointless SYNC_STATE_ONLY
 device links

commit f729a592adb6760013c3e48622a5bf256b992452 upstream.

SYNC_STATE_ONLY device links intentionally allow cycles because cyclic
sync_state() dependencies are valid and necessary.

However a SYNC_STATE_ONLY device link where the consumer and the supplier
are the same device is pointless because the device link would be deleted
as soon as the device probes (because it's also the consumer) and won't
affect when the sync_state() callback is called. It's a waste of CPU cycles
and memory to create this device link. So reject any attempts to create
such a device link.

Fixes: 05ef983e0d65 ("driver core: Add device link support for SYNC_STATE_ONLY flag")
Cc: stable <stable@vger.kernel.org>
Reported-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Saravana Kannan <saravanak@google.com>
Link: https://lore.kernel.org/r/20210929190549.860541-1-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index a364fe565007..2bc4db5ffe44 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -549,7 +549,8 @@ struct device_link *device_link_add(struct device *consumer,
 {
 	struct device_link *link;
 
-	if (!consumer || !supplier || flags & ~DL_ADD_VALID_FLAGS ||
+	if (!consumer || !supplier || consumer == supplier ||
+	    flags & ~DL_ADD_VALID_FLAGS ||
 	    (flags & DL_FLAG_STATELESS && flags & DL_MANAGED_LINK_FLAGS) ||
 	    (flags & DL_FLAG_SYNC_STATE_ONLY &&
 	     flags != DL_FLAG_SYNC_STATE_ONLY) ||

From a8177f0576fa8c72024f48775ff3bbb698e8134f Mon Sep 17 00:00:00 2001
From: Alexandru Tachici <alexandru.tachici@analog.com>
Date: Mon, 6 Sep 2021 09:56:28 +0300
Subject: [PATCH 0890/1750] iio: adc: ad7192: Add IRQ flag

commit 89a86da5cb8e0ee153111fb68a719d31582c206b upstream.

IRQ type in ad_sigma_delta_info struct was missing.

In Sigma-Delta devices the SDO line is also used as an interrupt.
Leaving IRQ on level instead of falling might trigger a sample read
when the IRQ is enabled, as the SDO line is already low. Not sure
if SDO line will always immediately go high in ad_sd_buffer_postenable
before the IRQ is enabled.

Also the datasheet seem to explicitly say the falling edge of the SDO
should be used as an interrupt:
>From the AD7192 datasheet: "The DOUT/RDY falling edge can be used
as an interrupt to a processor,"

Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags")
Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210906065630.16325-2-alexandru.tachici@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ad7192.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/adc/ad7192.c b/drivers/iio/adc/ad7192.c
index 1141cc13a124..1b8baba9d4d6 100644
--- a/drivers/iio/adc/ad7192.c
+++ b/drivers/iio/adc/ad7192.c
@@ -293,6 +293,7 @@ static const struct ad_sigma_delta_info ad7192_sigma_delta_info = {
 	.has_registers = true,
 	.addr_shift = 3,
 	.read_mask = BIT(6),
+	.irq_flags = IRQF_TRIGGER_FALLING,
 };
 
 static const struct ad_sd_calib_data ad7192_calib_arr[8] = {

From d078043a1775e6564ae70bf849ce183713d13d5b Mon Sep 17 00:00:00 2001
From: Alexandru Tachici <alexandru.tachici@analog.com>
Date: Mon, 6 Sep 2021 09:56:29 +0300
Subject: [PATCH 0891/1750] iio: adc: ad7780: Fix IRQ flag

commit e081102f3077aa716974ccebec97003c890d5641 upstream.

Correct IRQ flag here is falling.

In Sigma-Delta devices the SDO line is also used as an interrupt.
Leaving IRQ on level instead of falling might trigger a sample read
when the IRQ is enabled, as the SDO line is already low. Not sure
if SDO line will always immediately go high in ad_sd_buffer_postenable
before the IRQ is enabled.

Also the datasheet seem to explicitly say the falling edge of the SDO
should be used as an interrupt:
>From the AD7780 datasheet: " The DOUT/Figure 22 RDY falling edge
can be used as an interrupt to a processor"

Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags")
Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210906065630.16325-3-alexandru.tachici@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ad7780.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ad7780.c b/drivers/iio/adc/ad7780.c
index 42e7e8e595d1..c70048bc791b 100644
--- a/drivers/iio/adc/ad7780.c
+++ b/drivers/iio/adc/ad7780.c
@@ -203,7 +203,7 @@ static const struct ad_sigma_delta_info ad7780_sigma_delta_info = {
 	.set_mode = ad7780_set_mode,
 	.postprocess_sample = ad7780_postprocess_sample,
 	.has_registers = false,
-	.irq_flags = IRQF_TRIGGER_LOW,
+	.irq_flags = IRQF_TRIGGER_FALLING,
 };
 
 #define _AD7780_CHANNEL(_bits, _wordsize, _mask_all)		\

From 4425d059aa2e907c04771bb6550f31973c843262 Mon Sep 17 00:00:00 2001
From: Alexandru Tachici <alexandru.tachici@analog.com>
Date: Mon, 6 Sep 2021 09:56:30 +0300
Subject: [PATCH 0892/1750] iio: adc: ad7793: Fix IRQ flag

commit 1a913270e57a8e7f1e3789802f1f64e6d0654626 upstream.

In Sigma-Delta devices the SDO line is also used as an interrupt.
Leaving IRQ on level instead of falling might trigger a sample read
when the IRQ is enabled, as the SDO line is already low. Not sure
if SDO line will always immediately go high in ad_sd_buffer_postenable
before the IRQ is enabled.

Also the datasheet seem to explicitly say the falling edge of the SDO
should be used as an interrupt:
>From the AD7793 datasheet: " The DOUT/RDY falling edge can be
used as an interrupt to a processor"

Fixes: da4d3d6bb9f6 ("iio: adc: ad-sigma-delta: Allow custom IRQ flags")
Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20210906065630.16325-4-alexandru.tachici@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ad7793.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index 440ef4c7be07..7c9c95c252cf 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -206,7 +206,7 @@ static const struct ad_sigma_delta_info ad7793_sigma_delta_info = {
 	.has_registers = true,
 	.addr_shift = 3,
 	.read_mask = BIT(6),
-	.irq_flags = IRQF_TRIGGER_LOW,
+	.irq_flags = IRQF_TRIGGER_FALLING,
 };
 
 static const struct ad_sd_calib_data ad7793_calib_arr[6] = {

From f931076d32b686014cf31f12cdb2781aa26bff46 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 21 Aug 2021 12:37:24 +0200
Subject: [PATCH 0893/1750] iio: adc128s052: Fix the error handling path of
 'adc128_probe()'

commit bbcf40816b547b3c37af49168950491d20d81ce1 upstream.

A successful 'regulator_enable()' call should be balanced by a
corresponding 'regulator_disable()' call in the error handling path of the
probe, as already done in the remove function.

Update the error handling path accordingly.

Fixes: 913b86468674 ("iio: adc: Add TI ADC128S052")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Alexandru Ardelean <ardeleanalex@gmail.com>
Link: https://lore.kernel.org/r/85189f1cfcf6f5f7b42d8730966f2a074b07b5f5.1629542160.git.christophe.jaillet@wanadoo.fr
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/ti-adc128s052.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/iio/adc/ti-adc128s052.c b/drivers/iio/adc/ti-adc128s052.c
index 3143f35a6509..83c1ae07b3e9 100644
--- a/drivers/iio/adc/ti-adc128s052.c
+++ b/drivers/iio/adc/ti-adc128s052.c
@@ -171,7 +171,13 @@ static int adc128_probe(struct spi_device *spi)
 	mutex_init(&adc->lock);
 
 	ret = iio_device_register(indio_dev);
+	if (ret)
+		goto err_disable_regulator;
 
+	return 0;
+
+err_disable_regulator:
+	regulator_disable(adc->reg);
 	return ret;
 }
 

From 1671cfd31b66fcc90812de0b9d8c8c1e71917ba4 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 18 Aug 2021 13:11:24 +0200
Subject: [PATCH 0894/1750] iio: adc: max1027: Fix wrong shift with 12-bit
 devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 732ae19ee8f58ecaf30cbc1bbbda5cbee6a45043 upstream.

10-bit devices must shift the value twice.
This is not needed anymore on 12-bit devices.

Fixes: ae47d009b508 ("iio: adc: max1027: Introduce 12-bit devices support")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20210818111139.330636-2-miquel.raynal@bootlin.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/max1027.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c
index ca1dff3924ff..110a133cc8d4 100644
--- a/drivers/iio/adc/max1027.c
+++ b/drivers/iio/adc/max1027.c
@@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(of, max1027_adc_dt_ids);
 			.sign = 'u',					\
 			.realbits = depth,				\
 			.storagebits = 16,				\
-			.shift = 2,					\
+			.shift = (depth == 10) ? 2 : 0,			\
 			.endianness = IIO_BE,				\
 		},							\
 	}

From e811506f609a16afe5c4109cbf881aad5917792f Mon Sep 17 00:00:00 2001
From: Hui Liu <hui.liu@mediatek.com>
Date: Sun, 26 Sep 2021 15:30:28 +0800
Subject: [PATCH 0895/1750] iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED

commit c2980c64c7fd4585d684574c92d1624d44961edd upstream.

The previous driver does't apply the necessary scaling to take the
voltage range into account.
We change readback value from raw data to input voltage to fix case
IIO_CHAN_INFO_PROCESSED.

Fixes: ace4cdfe67be ("iio: adc: mt2701: Add Mediatek auxadc driver for mt2701.")
Signed-off-by: Hui Liu <hui.liu@mediatek.com>
Link: https://lore.kernel.org/r/20210926073028.11045-2-hui.liu@mediatek.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/mt6577_auxadc.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/iio/adc/mt6577_auxadc.c b/drivers/iio/adc/mt6577_auxadc.c
index 79c1dd68b909..d4fccd52ef08 100644
--- a/drivers/iio/adc/mt6577_auxadc.c
+++ b/drivers/iio/adc/mt6577_auxadc.c
@@ -82,6 +82,10 @@ static const struct iio_chan_spec mt6577_auxadc_iio_channels[] = {
 	MT6577_AUXADC_CHANNEL(15),
 };
 
+/* For Voltage calculation */
+#define VOLTAGE_FULL_RANGE  1500	/* VA voltage */
+#define AUXADC_PRECISE      4096	/* 12 bits */
+
 static int mt_auxadc_get_cali_data(int rawdata, bool enable_cali)
 {
 	return rawdata;
@@ -191,6 +195,10 @@ static int mt6577_auxadc_read_raw(struct iio_dev *indio_dev,
 		}
 		if (adc_dev->dev_comp->sample_data_cali)
 			*val = mt_auxadc_get_cali_data(*val, true);
+
+		/* Convert adc raw data to voltage: 0 - 1500 mV */
+		*val = *val * VOLTAGE_FULL_RANGE / AUXADC_PRECISE;
+
 		return IIO_VAL_INT;
 
 	default:

From 41e84a4f25b6bd1714679eee4cb99ded68479234 Mon Sep 17 00:00:00 2001
From: Jiri Valek - 2N <valek@2n.cz>
Date: Mon, 20 Sep 2021 14:53:48 +0200
Subject: [PATCH 0896/1750] iio: light: opt3001: Fixed timeout error when 0 lux

commit 26d90b5590579def54382a2fc34cfbe8518a9851 upstream.

Reading from sensor returned timeout error under
zero light conditions.

Signed-off-by: Jiri Valek - 2N <valek@2n.cz>
Fixes: ac663db3678a ("iio: light: opt3001: enable operation w/o IRQ")
Link: https://lore.kernel.org/r/20210920125351.6569-1-valek@2n.cz
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/light/opt3001.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/light/opt3001.c b/drivers/iio/light/opt3001.c
index 2d48d61909a4..ff776259734a 100644
--- a/drivers/iio/light/opt3001.c
+++ b/drivers/iio/light/opt3001.c
@@ -276,6 +276,8 @@ static int opt3001_get_lux(struct opt3001 *opt, int *val, int *val2)
 		ret = wait_event_timeout(opt->result_ready_queue,
 				opt->result_ready,
 				msecs_to_jiffies(OPT3001_RESULT_READY_LONG));
+		if (ret == 0)
+			return -ETIMEDOUT;
 	} else {
 		/* Sleep for result ready time */
 		timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ?
@@ -312,9 +314,7 @@ static int opt3001_get_lux(struct opt3001 *opt, int *val, int *val2)
 		/* Disallow IRQ to access the device while lock is active */
 		opt->ok_to_ignore_lock = false;
 
-	if (ret == 0)
-		return -ETIMEDOUT;
-	else if (ret < 0)
+	if (ret < 0)
 		return ret;
 
 	if (opt->use_irq) {

From abe5b13dd959495c64dd98cf2f16d0510a93d595 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 18 Aug 2021 13:11:25 +0200
Subject: [PATCH 0897/1750] iio: adc: max1027: Fix the number of max1X31
 channels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f0cb5fed37ab37f6a6c5463c5fd39b58a45670c8 upstream.

The macro MAX1X29_CHANNELS() already calls MAX1X27_CHANNELS().
Calling MAX1X27_CHANNELS() before MAX1X29_CHANNELS() in the definition
of MAX1X31_CHANNELS() declares the first 8 channels twice. So drop this
extra call from the MAX1X31 channels list definition.

Fixes: 7af5257d8427 ("iio: adc: max1027: Prepare the introduction of different resolutions")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20210818111139.330636-3-miquel.raynal@bootlin.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/adc/max1027.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/iio/adc/max1027.c b/drivers/iio/adc/max1027.c
index 110a133cc8d4..a08efaaf1a81 100644
--- a/drivers/iio/adc/max1027.c
+++ b/drivers/iio/adc/max1027.c
@@ -142,7 +142,6 @@ MODULE_DEVICE_TABLE(of, max1027_adc_dt_ids);
 	MAX1027_V_CHAN(11, depth)
 
 #define MAX1X31_CHANNELS(depth)			\
-	MAX1X27_CHANNELS(depth),		\
 	MAX1X29_CHANNELS(depth),		\
 	MAX1027_V_CHAN(12, depth),		\
 	MAX1027_V_CHAN(13, depth),		\

From 0fbc3cf7dd9a88240813b305db2adfc84f2e2a02 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Thu, 9 Sep 2021 12:13:36 +0300
Subject: [PATCH 0898/1750] iio: ssp_sensors: add more range checking in
 ssp_parse_dataframe()

commit 8167c9a375ccceed19048ad9d68cb2d02ed276e0 upstream.

The "idx" is validated at the start of the loop but it gets incremented
during the iteration so it needs to be checked again.

Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210909091336.GA26312@kili
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/common/ssp_sensors/ssp_spi.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/common/ssp_sensors/ssp_spi.c b/drivers/iio/common/ssp_sensors/ssp_spi.c
index 4864c38b8d1c..387551eac184 100644
--- a/drivers/iio/common/ssp_sensors/ssp_spi.c
+++ b/drivers/iio/common/ssp_sensors/ssp_spi.c
@@ -273,6 +273,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
 	for (idx = 0; idx < len;) {
 		switch (dataframe[idx++]) {
 		case SSP_MSG2AP_INST_BYPASS_DATA:
+			if (idx >= len)
+				return -EPROTO;
 			sd = dataframe[idx++];
 			if (sd < 0 || sd >= SSP_SENSOR_MAX) {
 				dev_err(SSP_DEV,
@@ -282,10 +284,13 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
 
 			if (indio_devs[sd]) {
 				spd = iio_priv(indio_devs[sd]);
-				if (spd->process_data)
+				if (spd->process_data) {
+					if (idx >= len)
+						return -EPROTO;
 					spd->process_data(indio_devs[sd],
 							  &dataframe[idx],
 							  data->timestamp);
+				}
 			} else {
 				dev_err(SSP_DEV, "no client for frame\n");
 			}
@@ -293,6 +298,8 @@ static int ssp_parse_dataframe(struct ssp_data *data, char *dataframe, int len)
 			idx += ssp_offset_map[sd];
 			break;
 		case SSP_MSG2AP_INST_DEBUG_DATA:
+			if (idx >= len)
+				return -EPROTO;
 			sd = ssp_print_mcu_debug(dataframe, &idx, len);
 			if (sd) {
 				dev_err(SSP_DEV,

From 6c0024bcaadcae57523675d66589a4b37b9281d1 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 14 Sep 2021 13:53:33 +0300
Subject: [PATCH 0899/1750] iio: ssp_sensors: fix error code in
 ssp_print_mcu_debug()

commit 4170d3dd1467e9d78cb9af374b19357dc324b328 upstream.

The ssp_print_mcu_debug() function should return negative error codes on
error.  Returning "length" is meaningless.  This change does not affect
runtime because the callers only care about zero/non-zero.

Reported-by: Jonathan Cameron <jic23@kernel.org>
Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210914105333.GA11657@kili
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/common/ssp_sensors/ssp_spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/common/ssp_sensors/ssp_spi.c b/drivers/iio/common/ssp_sensors/ssp_spi.c
index 387551eac184..769bd9280524 100644
--- a/drivers/iio/common/ssp_sensors/ssp_spi.c
+++ b/drivers/iio/common/ssp_sensors/ssp_spi.c
@@ -137,7 +137,7 @@ static int ssp_print_mcu_debug(char *data_frame, int *data_index,
 	if (length > received_len - *data_index || length <= 0) {
 		ssp_dbg("[SSP]: MSG From MCU-invalid debug length(%d/%d)\n",
 			length, received_len);
-		return length ? length : -EPROTO;
+		return -EPROTO;
 	}
 
 	ssp_dbg("[SSP]: MSG From MCU - %s\n", &data_frame[*data_index]);

From 07f8856824864a659c941f4ccf9ec72ce19e1f01 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 16 Aug 2021 21:39:54 +0300
Subject: [PATCH 0900/1750] iio: dac: ti-dac5571: fix an error code in probe()

commit f7a28df7db84eb3410e9eca37832efa5aed93338 upstream.

If we have an unexpected number of channels then return -EINVAL instead
of returning success.

Fixes: df38a4a72a3b ("iio: dac: add TI DAC5571 family support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20210816183954.GB2068@kili
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/dac/ti-dac5571.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/dac/ti-dac5571.c b/drivers/iio/dac/ti-dac5571.c
index d3295767a079..c0714cb1e164 100644
--- a/drivers/iio/dac/ti-dac5571.c
+++ b/drivers/iio/dac/ti-dac5571.c
@@ -350,6 +350,7 @@ static int dac5571_probe(struct i2c_client *client,
 		data->dac5571_pwrdwn = dac5571_pwrdwn_quad;
 		break;
 	default:
+		ret = -EINVAL;
 		goto err;
 	}
 

From 76644f94595bfeabd2f69259417f4f547dd580f2 Mon Sep 17 00:00:00 2001
From: Sumit Garg <sumit.garg@linaro.org>
Date: Tue, 12 Oct 2021 13:01:16 +0530
Subject: [PATCH 0901/1750] tee: optee: Fix missing devices unregister during
 optee_remove

commit 7f565d0ead264329749c0da488de9c8dfa2f18ce upstream.

When OP-TEE driver is built as a module, OP-TEE client devices
registered on TEE bus during probe should be unregistered during
optee_remove. So implement optee_unregister_devices() accordingly.

Fixes: c3fa24af9244 ("tee: optee: add TEE bus device enumeration support")
Reported-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tee/optee/core.c          |  3 +++
 drivers/tee/optee/device.c        | 22 ++++++++++++++++++++++
 drivers/tee/optee/optee_private.h |  1 +
 3 files changed, 26 insertions(+)

diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
index 823a81d8ff0e..f255a96ae5a4 100644
--- a/drivers/tee/optee/core.c
+++ b/drivers/tee/optee/core.c
@@ -585,6 +585,9 @@ static int optee_remove(struct platform_device *pdev)
 {
 	struct optee *optee = platform_get_drvdata(pdev);
 
+	/* Unregister OP-TEE specific client devices on TEE bus */
+	optee_unregister_devices();
+
 	/*
 	 * Ask OP-TEE to free all cached shared memory objects to decrease
 	 * reference counters and also avoid wild pointers in secure world
diff --git a/drivers/tee/optee/device.c b/drivers/tee/optee/device.c
index 7a897d51969f..031806468af4 100644
--- a/drivers/tee/optee/device.c
+++ b/drivers/tee/optee/device.c
@@ -53,6 +53,13 @@ static int get_devices(struct tee_context *ctx, u32 session,
 	return 0;
 }
 
+static void optee_release_device(struct device *dev)
+{
+	struct tee_client_device *optee_device = to_tee_client_device(dev);
+
+	kfree(optee_device);
+}
+
 static int optee_register_device(const uuid_t *device_uuid)
 {
 	struct tee_client_device *optee_device = NULL;
@@ -63,6 +70,7 @@ static int optee_register_device(const uuid_t *device_uuid)
 		return -ENOMEM;
 
 	optee_device->dev.bus = &tee_bus_type;
+	optee_device->dev.release = optee_release_device;
 	if (dev_set_name(&optee_device->dev, "optee-ta-%pUb", device_uuid)) {
 		kfree(optee_device);
 		return -ENOMEM;
@@ -154,3 +162,17 @@ int optee_enumerate_devices(u32 func)
 {
 	return  __optee_enumerate_devices(func);
 }
+
+static int __optee_unregister_device(struct device *dev, void *data)
+{
+	if (!strncmp(dev_name(dev), "optee-ta", strlen("optee-ta")))
+		device_unregister(dev);
+
+	return 0;
+}
+
+void optee_unregister_devices(void)
+{
+	bus_for_each_dev(&tee_bus_type, NULL, NULL,
+			 __optee_unregister_device);
+}
diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h
index dbdd367be156..f6bb4a763ba9 100644
--- a/drivers/tee/optee/optee_private.h
+++ b/drivers/tee/optee/optee_private.h
@@ -184,6 +184,7 @@ void optee_fill_pages_list(u64 *dst, struct page **pages, int num_pages,
 #define PTA_CMD_GET_DEVICES		0x0
 #define PTA_CMD_GET_DEVICES_SUPP	0x1
 int optee_enumerate_devices(u32 func);
+void optee_unregister_devices(void);
 
 /*
  * Small helpers

From 6e6e3018d3ced1cc1f7115f29221fc5ba793a2a2 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenz@kernel.org>
Date: Tue, 31 Aug 2021 14:58:43 +0200
Subject: [PATCH 0902/1750] ARM: dts: bcm2711-rpi-4-b: Fix usb's unit address

commit 3f32472854614d6f53b09b4812372dba9fc5c7de upstream.

The unit address is supposed to represent '<device>,<function>'. Which
are both 0 for RPi4b's XHCI controller. On top of that although
OpenFirmware states bus number goes in the high part of the last reg
parameter, FDT doesn't seem to care for it[1], so remove it.

[1] https://patchwork.kernel.org/project/linux-arm-kernel/patch/20210830103909.323356-1-nsaenzju@redhat.com/#24414633
Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node")
Suggested-by: Rob Herring <robh@kernel.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20210831125843.1233488-2-nsaenzju@redhat.com
Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 5395e8c2484e..46f105d5c974 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -262,8 +262,8 @@ pci@1,0 {
 
 		reg = <0 0 0 0 0>;
 
-		usb@1,0 {
-			reg = <0x10000 0 0 0 0>;
+		usb@0,0 {
+			reg = <0 0 0 0 0>;
 			resets = <&reset RASPBERRYPI_FIRMWARE_RESET_ID_USB>;
 		};
 	};

From 48613e687e281833ae654514e162c71185c843d3 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 7 Aug 2021 13:06:32 +0200
Subject: [PATCH 0903/1750] ARM: dts: bcm2711: fix MDIO #address- and
 #size-cells

commit 2faff6737a8a684b077264f0aed131526c99eec4 upstream.

The values of #address-cells and #size-cells are swapped. Fix this
and avoid the following DT schema warnings for mdio@e14:

 #address-cells:0:0: 1 was expected
 #size-cells:0:0: 0 was expected

Fixes: be8af7a9e3cc ("ARM: dts: bcm2711-rpi-4: Enable GENET support")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Link: https://lore.kernel.org/r/1628334401-6577-2-git-send-email-stefan.wahren@i2se.com
Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/bcm2711.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi
index 3d040f6e2a20..398ecd7b9b68 100644
--- a/arch/arm/boot/dts/bcm2711.dtsi
+++ b/arch/arm/boot/dts/bcm2711.dtsi
@@ -514,8 +514,8 @@ genet_mdio: mdio@e14 {
 				compatible = "brcm,genet-mdio-v5";
 				reg = <0xe14 0x8>;
 				reg-names = "mdio";
-				#address-cells = <0x0>;
-				#size-cells = <0x1>;
+				#address-cells = <0x1>;
+				#size-cells = <0x0>;
 			};
 		};
 	};

From 6e6082250b53d9125c06e82de8a1948fc345bfc8 Mon Sep 17 00:00:00 2001
From: Stefan Wahren <stefan.wahren@i2se.com>
Date: Sat, 7 Aug 2021 13:06:33 +0200
Subject: [PATCH 0904/1750] ARM: dts: bcm2711-rpi-4-b: fix sd_io_1v8_reg
 regulator states

commit b55ec7528879a822a4d350248daa04bbb27f25fd upstream.

DT schema check complains at sd_io_1v8_reg about the following:

 [1800000, 1, 3300000, 0] is too long
 Additional items are not allowed (3300000, 0 were unexpected)

So fix the states definition.

Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Link: https://lore.kernel.org/r/1628334401-6577-3-git-send-email-stefan.wahren@i2se.com
Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 46f105d5c974..76de029c588a 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -54,8 +54,8 @@ sd_io_1v8_reg: sd_io_1v8_reg {
 		regulator-always-on;
 		regulator-settling-time-us = <5000>;
 		gpios = <&expgpio 4 GPIO_ACTIVE_HIGH>;
-		states = <1800000 0x1
-			  3300000 0x0>;
+		states = <1800000 0x1>,
+			 <3300000 0x0>;
 		status = "okay";
 	};
 

From 2d937cc12c140b2eb20cbb0fc8502d7232f18fe3 Mon Sep 17 00:00:00 2001
From: Nicolas Saenz Julienne <nsaenz@kernel.org>
Date: Tue, 31 Aug 2021 14:58:42 +0200
Subject: [PATCH 0905/1750] ARM: dts: bcm2711-rpi-4-b: Fix pcie0's unit address
 formatting

commit 13dbc954b3c9a9de0ad5b7279e8d3b708d31068b upstream.

dtbs_check currently complains that:

arch/arm/boot/dts/bcm2711-rpi-4-b.dts:220.10-231.4: Warning
(pci_device_reg): /scb/pcie@7d500000/pci@1,0: PCI unit address format
error, expected "0,0"

Unsurprisingly pci@0,0 is the right address, as illustrated by its reg
property:

    &pcie0 {
	    pci@0,0 {
		    /*
		     * As defined in the IEEE Std 1275-1994 document,
		     * reg is a five-cell address encoded as (phys.hi
		     * phys.mid phys.lo size.hi size.lo). phys.hi
		     * should contain the device's BDF as 0b00000000
		     * bbbbbbbb dddddfff 00000000. The other cells
		     * should be zero.
		     */
		    reg = <0 0 0 0 0>;
	    };
    };

The device is clearly 0. So fix it.

Also add a missing 'device_type = "pci"'.

Fixes: 258f92d2f840 ("ARM: dts: bcm2711: Add reset controller to xHCI node")
Suggested-by: Rob Herring <robh@kernel.org>
Reviewed-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20210831125843.1233488-1-nsaenzju@redhat.com
Signed-off-by: Nicolas Saenz Julienne <nsaenz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/bcm2711-rpi-4-b.dts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
index 76de029c588a..167538518a1e 100644
--- a/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
+++ b/arch/arm/boot/dts/bcm2711-rpi-4-b.dts
@@ -255,7 +255,8 @@ phy1: ethernet-phy@1 {
 };
 
 &pcie0 {
-	pci@1,0 {
+	pci@0,0 {
+		device_type = "pci";
 		#address-cells = <3>;
 		#size-cells = <2>;
 		ranges;

From 6fecdb5b54a5d37e5c018307ea9180502c85d158 Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Wed, 6 Oct 2021 23:50:31 -0700
Subject: [PATCH 0906/1750] nvme-pci: Fix abort command id

commit 85f74acf097a63a07f5a7c215db6883e5c35e3ff upstream.

The request tag is no longer the only component of the command id.

Fixes: e7006de6c2380 ("nvme: code command_id with a genctr for use-after-free validation")
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index d79abb88a0c6..1b85349f57af 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1342,7 +1342,7 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
 
 	memset(&cmd, 0, sizeof(cmd));
 	cmd.abort.opcode = nvme_admin_abort_cmd;
-	cmd.abort.cid = req->tag;
+	cmd.abort.cid = nvme_cid(req);
 	cmd.abort.sqid = cpu_to_le16(nvmeq->qid);
 
 	dev_warn(nvmeq->dev->ctrl.device,

From d84a69ac410f6228873d05d35120f6bdddab7fc3 Mon Sep 17 00:00:00 2001
From: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Date: Wed, 13 Oct 2021 17:27:29 -0300
Subject: [PATCH 0907/1750] sctp: account stream padding length for reconf
 chunk

commit a2d859e3fc97e79d907761550dbc03ff1b36479c upstream.

sctp_make_strreset_req() makes repeated calls to sctp_addto_chunk()
which will automatically account for padding on each call. inreq and
outreq are already 4 bytes aligned, but the payload is not and doing
SCTP_PAD4(a + b) (which _sctp_make_chunk() did implicitly here) is
different from SCTP_PAD4(a) + SCTP_PAD4(b) and not enough. It led to
possible attempt to use more buffer than it was allocated and triggered
a BUG_ON.

Cc: Vlad Yasevich <vyasevich@gmail.com>
Cc: Neil Horman <nhorman@tuxdriver.com>
Cc: Greg KH <gregkh@linuxfoundation.org>
Fixes: cc16f00f6529 ("sctp: add support for generating stream reconf ssn reset request chunk")
Reported-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/b97c1f8b0c7ff79ac4ed206fc2c49d3612e0850c.1634156849.git.mleitner@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/sm_make_chunk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index fa0d96320baa..64e0f4864b73 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3651,7 +3651,7 @@ struct sctp_chunk *sctp_make_strreset_req(
 	outlen = (sizeof(outreq) + stream_len) * out;
 	inlen = (sizeof(inreq) + stream_len) * in;
 
-	retval = sctp_make_reconf(asoc, outlen + inlen);
+	retval = sctp_make_reconf(asoc, SCTP_PAD4(outlen) + SCTP_PAD4(inlen));
 	if (!retval)
 		return NULL;
 

From 17a027aafd529bb1f97c6c520a03207b80aab14d Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Fri, 24 Sep 2021 01:46:40 +0300
Subject: [PATCH 0908/1750] gpio: pca953x: Improve bias setting

commit 55a9968c7e139209a9e93d4ca4321731bea5fc95 upstream.

The commit 15add06841a3 ("gpio: pca953x: add ->set_config implementation")
introduced support for bias setting. However this, due to being half-baked,
brought potential issues:
 - the turning bias via disabling makes the pin floating for a while;
 - once enabled, bias can't be disabled.

Fix all these by adding support for bias disabling and move the disabling
part under the corresponding conditional.

While at it, add support for default setting, since it's cheap to add.

Fixes: 15add06841a3 ("gpio: pca953x: add ->set_config implementation")
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpio-pca953x.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index 3a3aeef1017f..a78167b2c9ca 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -558,21 +558,21 @@ static int pca953x_gpio_set_pull_up_down(struct pca953x_chip *chip,
 
 	mutex_lock(&chip->i2c_lock);
 
-	/* Disable pull-up/pull-down */
-	ret = regmap_write_bits(chip->regmap, pull_en_reg, bit, 0);
-	if (ret)
-		goto exit;
-
 	/* Configure pull-up/pull-down */
 	if (config == PIN_CONFIG_BIAS_PULL_UP)
 		ret = regmap_write_bits(chip->regmap, pull_sel_reg, bit, bit);
 	else if (config == PIN_CONFIG_BIAS_PULL_DOWN)
 		ret = regmap_write_bits(chip->regmap, pull_sel_reg, bit, 0);
+	else
+		ret = 0;
 	if (ret)
 		goto exit;
 
-	/* Enable pull-up/pull-down */
-	ret = regmap_write_bits(chip->regmap, pull_en_reg, bit, bit);
+	/* Disable/Enable pull-up/pull-down */
+	if (config == PIN_CONFIG_BIAS_DISABLE)
+		ret = regmap_write_bits(chip->regmap, pull_en_reg, bit, 0);
+	else
+		ret = regmap_write_bits(chip->regmap, pull_en_reg, bit, bit);
 
 exit:
 	mutex_unlock(&chip->i2c_lock);
@@ -586,7 +586,9 @@ static int pca953x_gpio_set_config(struct gpio_chip *gc, unsigned int offset,
 
 	switch (pinconf_to_config_param(config)) {
 	case PIN_CONFIG_BIAS_PULL_UP:
+	case PIN_CONFIG_BIAS_PULL_PIN_DEFAULT:
 	case PIN_CONFIG_BIAS_PULL_DOWN:
+	case PIN_CONFIG_BIAS_DISABLE:
 		return pca953x_gpio_set_pull_up_down(chip, offset, config);
 	default:
 		return -ENOTSUPP;

From 33ca8501051152e7aa3e9ce146360156c8a0dbff Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Tue, 12 Oct 2021 11:34:46 +0200
Subject: [PATCH 0909/1750] net: arc: select CRC32

commit e599ee234ad4fdfe241d937bbabd96e0d8f9d868 upstream.

Fix the following build/link error by adding a dependency on the CRC32
routines:

  ld: drivers/net/ethernet/arc/emac_main.o: in function `arc_emac_set_rx_mode':
  emac_main.c:(.text+0xb11): undefined reference to `crc32_le'

The crc32_le() call comes through the ether_crc_le() call in
arc_emac_set_rx_mode().

[v2: moved the select to ARC_EMAC_CORE; the Makefile is a bit confusing,
but the error comes from emac_main.o, which is part of the arc_emac module,
which in turn is enabled by CONFIG_ARC_EMAC_CORE. Note that arc_emac is
different from emac_arc...]

Fixes: 775dd682e2b0ec ("arc_emac: implement promiscuous mode and multicast filtering")
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Link: https://lore.kernel.org/r/20211012093446.1575-1-vegard.nossum@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/arc/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/arc/Kconfig b/drivers/net/ethernet/arc/Kconfig
index 37a41773dd43..92a79c4ffa2c 100644
--- a/drivers/net/ethernet/arc/Kconfig
+++ b/drivers/net/ethernet/arc/Kconfig
@@ -21,6 +21,7 @@ config ARC_EMAC_CORE
 	depends on ARC || ARCH_ROCKCHIP || COMPILE_TEST
 	select MII
 	select PHYLIB
+	select CRC32
 
 config ARC_EMAC
 	tristate "ARC EMAC support"

From afb0c67dfdb5b84aae5bfc30a32de8623a12dd56 Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Tue, 12 Oct 2021 17:25:09 +0200
Subject: [PATCH 0910/1750] net: korina: select CRC32

commit 427f974d9727ca681085ddcd0530c97ab5811ae0 upstream.

Fix the following build/link error by adding a dependency on the CRC32
routines:

  ld: drivers/net/ethernet/korina.o: in function `korina_multicast_list':
  korina.c:(.text+0x1af): undefined reference to `crc32_le'

Fixes: ef11291bcd5f9 ("Add support the Korina (IDT RC32434) Ethernet MAC")
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Florian fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20211012152509.21771-1-vegard.nossum@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/Kconfig b/drivers/net/ethernet/Kconfig
index de50e8b9e656..fad9a2c77fa7 100644
--- a/drivers/net/ethernet/Kconfig
+++ b/drivers/net/ethernet/Kconfig
@@ -99,6 +99,7 @@ config JME
 config KORINA
 	tristate "Korina (IDT RC32434) Ethernet support"
 	depends on MIKROTIK_RB532
+	select CRC32
 	help
 	  If you have a Mikrotik RouterBoard 500 or IDT RC32434
 	  based system say Y. Otherwise say N.

From 4f7bddf8c5c01cac74373443b13a68e1c6723a94 Mon Sep 17 00:00:00 2001
From: Valentine Fatiev <valentinef@nvidia.com>
Date: Sun, 15 Aug 2021 17:43:19 +0300
Subject: [PATCH 0911/1750] net/mlx5e: Fix memory leak in
 mlx5_core_destroy_cq() error path

commit 94b960b9deffc02fc0747afc01f72cc62ab099e3 upstream.

Prior to this patch in case mlx5_core_destroy_cq() failed it returns
without completing all destroy operations and that leads to memory leak.
Instead, complete the destroy flow before return error.

Also move mlx5_debug_cq_remove() to the beginning of mlx5_core_destroy_cq()
to be symmetrical with mlx5_core_create_cq().

kmemleak complains on:

unreferenced object 0xc000000038625100 (size 64):
  comm "ethtool", pid 28301, jiffies 4298062946 (age 785.380s)
  hex dump (first 32 bytes):
    60 01 48 94 00 00 00 c0 b8 05 34 c3 00 00 00 c0  `.H.......4.....
    02 00 00 00 00 00 00 00 00 db 7d c1 00 00 00 c0  ..........}.....
  backtrace:
    [<000000009e8643cb>] add_res_tree+0xd0/0x270 [mlx5_core]
    [<00000000e7cb8e6c>] mlx5_debug_cq_add+0x5c/0xc0 [mlx5_core]
    [<000000002a12918f>] mlx5_core_create_cq+0x1d0/0x2d0 [mlx5_core]
    [<00000000cef0a696>] mlx5e_create_cq+0x210/0x3f0 [mlx5_core]
    [<000000009c642c26>] mlx5e_open_cq+0xb4/0x130 [mlx5_core]
    [<0000000058dfa578>] mlx5e_ptp_open+0x7f4/0xe10 [mlx5_core]
    [<0000000081839561>] mlx5e_open_channels+0x9cc/0x13e0 [mlx5_core]
    [<0000000009cf05d4>] mlx5e_switch_priv_channels+0xa4/0x230
[mlx5_core]
    [<0000000042bbedd8>] mlx5e_safe_switch_params+0x14c/0x300
[mlx5_core]
    [<0000000004bc9db8>] set_pflag_tx_port_ts+0x9c/0x160 [mlx5_core]
    [<00000000a0553443>] mlx5e_set_priv_flags+0xd0/0x1b0 [mlx5_core]
    [<00000000a8f3d84b>] ethnl_set_privflags+0x234/0x2d0
    [<00000000fd27f27c>] genl_family_rcv_msg_doit+0x108/0x1d0
    [<00000000f495e2bb>] genl_family_rcv_msg+0xe4/0x1f0
    [<00000000646c5c2c>] genl_rcv_msg+0x78/0x120
    [<00000000d53e384e>] netlink_rcv_skb+0x74/0x1a0

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Valentine Fatiev <valentinef@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/cq.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cq.c b/drivers/net/ethernet/mellanox/mlx5/core/cq.c
index 360e093874d4..c74600be570e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cq.c
@@ -154,6 +154,8 @@ int mlx5_core_destroy_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq)
 	u32 in[MLX5_ST_SZ_DW(destroy_cq_in)] = {};
 	int err;
 
+	mlx5_debug_cq_remove(dev, cq);
+
 	mlx5_eq_del_cq(mlx5_get_async_eq(dev), cq);
 	mlx5_eq_del_cq(&cq->eq->core, cq);
 
@@ -161,16 +163,13 @@ int mlx5_core_destroy_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq)
 	MLX5_SET(destroy_cq_in, in, cqn, cq->cqn);
 	MLX5_SET(destroy_cq_in, in, uid, cq->uid);
 	err = mlx5_cmd_exec_in(dev, destroy_cq, in);
-	if (err)
-		return err;
 
 	synchronize_irq(cq->irqn);
 
-	mlx5_debug_cq_remove(dev, cq);
 	mlx5_cq_put(cq);
 	wait_for_completion(&cq->free);
 
-	return 0;
+	return err;
 }
 EXPORT_SYMBOL(mlx5_core_destroy_cq);
 

From 12da46cb6a90541d39267034dd6a94b0335881e4 Mon Sep 17 00:00:00 2001
From: Aya Levin <ayal@nvidia.com>
Date: Sun, 26 Sep 2021 17:55:41 +0300
Subject: [PATCH 0912/1750] net/mlx5e: Mutually exclude RX-FCS and
 RX-port-timestamp

commit 0bc73ad46a76ed6ece4dcacb28858e7b38561e1c upstream.

Due to current HW arch limitations, RX-FCS (scattering FCS frame field
to software) and RX-port-timestamp (improved timestamp accuracy on the
receive side) can't work together.
RX-port-timestamp is not controlled by the user and it is enabled by
default when supported by the HW/FW.
This patch sets RX-port-timestamp opposite to RX-FCS configuration.

Fixes: 102722fc6832 ("net/mlx5e: Add support for RXFCS feature flag")
Signed-off-by: Aya Levin <ayal@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/mellanox/mlx5/core/en_main.c | 57 +++++++++++++++++--
 include/linux/mlx5/mlx5_ifc.h                 | 10 +++-
 2 files changed, 60 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 6974090a7efa..6ec4b96497ff 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3819,20 +3819,67 @@ static int set_feature_rx_all(struct net_device *netdev, bool enable)
 	return mlx5_set_port_fcs(mdev, !enable);
 }
 
+static int mlx5e_set_rx_port_ts(struct mlx5_core_dev *mdev, bool enable)
+{
+	u32 in[MLX5_ST_SZ_DW(pcmr_reg)] = {};
+	bool supported, curr_state;
+	int err;
+
+	if (!MLX5_CAP_GEN(mdev, ports_check))
+		return 0;
+
+	err = mlx5_query_ports_check(mdev, in, sizeof(in));
+	if (err)
+		return err;
+
+	supported = MLX5_GET(pcmr_reg, in, rx_ts_over_crc_cap);
+	curr_state = MLX5_GET(pcmr_reg, in, rx_ts_over_crc);
+
+	if (!supported || enable == curr_state)
+		return 0;
+
+	MLX5_SET(pcmr_reg, in, local_port, 1);
+	MLX5_SET(pcmr_reg, in, rx_ts_over_crc, enable);
+
+	return mlx5_set_ports_check(mdev, in, sizeof(in));
+}
+
 static int set_feature_rx_fcs(struct net_device *netdev, bool enable)
 {
 	struct mlx5e_priv *priv = netdev_priv(netdev);
+	struct mlx5e_channels *chs = &priv->channels;
+	struct mlx5_core_dev *mdev = priv->mdev;
 	int err;
 
 	mutex_lock(&priv->state_lock);
 
-	priv->channels.params.scatter_fcs_en = enable;
-	err = mlx5e_modify_channels_scatter_fcs(&priv->channels, enable);
-	if (err)
-		priv->channels.params.scatter_fcs_en = !enable;
+	if (enable) {
+		err = mlx5e_set_rx_port_ts(mdev, false);
+		if (err)
+			goto out;
 
+		chs->params.scatter_fcs_en = true;
+		err = mlx5e_modify_channels_scatter_fcs(chs, true);
+		if (err) {
+			chs->params.scatter_fcs_en = false;
+			mlx5e_set_rx_port_ts(mdev, true);
+		}
+	} else {
+		chs->params.scatter_fcs_en = false;
+		err = mlx5e_modify_channels_scatter_fcs(chs, false);
+		if (err) {
+			chs->params.scatter_fcs_en = true;
+			goto out;
+		}
+		err = mlx5e_set_rx_port_ts(mdev, true);
+		if (err) {
+			mlx5_core_warn(mdev, "Failed to set RX port timestamp %d\n", err);
+			err = 0;
+		}
+	}
+
+out:
 	mutex_unlock(&priv->state_lock);
-
 	return err;
 }
 
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 70a3664785f8..f5e829e12a76 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -9274,16 +9274,22 @@ struct mlx5_ifc_pcmr_reg_bits {
 	u8         reserved_at_0[0x8];
 	u8         local_port[0x8];
 	u8         reserved_at_10[0x10];
+
 	u8         entropy_force_cap[0x1];
 	u8         entropy_calc_cap[0x1];
 	u8         entropy_gre_calc_cap[0x1];
-	u8         reserved_at_23[0x1b];
+	u8         reserved_at_23[0xf];
+	u8         rx_ts_over_crc_cap[0x1];
+	u8         reserved_at_33[0xb];
 	u8         fcs_cap[0x1];
 	u8         reserved_at_3f[0x1];
+
 	u8         entropy_force[0x1];
 	u8         entropy_calc[0x1];
 	u8         entropy_gre_calc[0x1];
-	u8         reserved_at_43[0x1b];
+	u8         reserved_at_43[0xf];
+	u8         rx_ts_over_crc[0x1];
+	u8         reserved_at_53[0xb];
 	u8         fcs_chk[0x1];
 	u8         reserved_at_5f[0x1];
 };

From 9053c5b4594c96cc8978ba4f34e67f89fea89d52 Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Fri, 8 Oct 2021 12:34:37 +0200
Subject: [PATCH 0913/1750] net: stmmac: fix get_hw_feature() on old hardware

commit 075da584bae2da6a37428d59a477b6bdad430ac3 upstream.

Some old IPs do not provide the hardware feature register.
On these IPs, this register is read 0x00000000.

In old driver version, this feature was handled but a regression came
with the commit f10a6a3541b4 ("stmmac: rework get_hw_feature function").
Indeed, this commit removes the return value in dma->get_hw_feature().
This return value was used to indicate the validity of retrieved
information and used later on in stmmac_hw_init() to override
priv->plat data if this hardware feature were valid.

This patch restores the return code in ->get_hw_feature() in order
to indicate the hardware feature validity and override priv->plat
data only if this hardware feature is valid.

Fixes: f10a6a3541b4 ("stmmac: rework get_hw_feature function")
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c | 13 +++++++++++--
 drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c    |  6 ++++--
 drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c  |  6 ++++--
 drivers/net/ethernet/stmicro/stmmac/hwif.h          |  6 +++---
 4 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
index 2bac49b49f73..fbf2deafe8ba 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_dma.c
@@ -218,11 +218,18 @@ static void dwmac1000_dump_dma_regs(void __iomem *ioaddr, u32 *reg_space)
 				readl(ioaddr + DMA_BUS_MODE + i * 4);
 }
 
-static void dwmac1000_get_hw_feature(void __iomem *ioaddr,
-				     struct dma_features *dma_cap)
+static int dwmac1000_get_hw_feature(void __iomem *ioaddr,
+				    struct dma_features *dma_cap)
 {
 	u32 hw_cap = readl(ioaddr + DMA_HW_FEATURE);
 
+	if (!hw_cap) {
+		/* 0x00000000 is the value read on old hardware that does not
+		 * implement this register
+		 */
+		return -EOPNOTSUPP;
+	}
+
 	dma_cap->mbps_10_100 = (hw_cap & DMA_HW_FEAT_MIISEL);
 	dma_cap->mbps_1000 = (hw_cap & DMA_HW_FEAT_GMIISEL) >> 1;
 	dma_cap->half_duplex = (hw_cap & DMA_HW_FEAT_HDSEL) >> 2;
@@ -252,6 +259,8 @@ static void dwmac1000_get_hw_feature(void __iomem *ioaddr,
 	dma_cap->number_tx_channel = (hw_cap & DMA_HW_FEAT_TXCHCNT) >> 22;
 	/* Alternate (enhanced) DESC mode */
 	dma_cap->enh_desc = (hw_cap & DMA_HW_FEAT_ENHDESSEL) >> 24;
+
+	return 0;
 }
 
 static void dwmac1000_rx_watchdog(void __iomem *ioaddr, u32 riwt,
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
index a7249e4071f1..935510cdc3ff 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
@@ -337,8 +337,8 @@ static void dwmac4_dma_tx_chan_op_mode(void __iomem *ioaddr, int mode,
 	writel(mtl_tx_op, ioaddr +  MTL_CHAN_TX_OP_MODE(channel));
 }
 
-static void dwmac4_get_hw_feature(void __iomem *ioaddr,
-				  struct dma_features *dma_cap)
+static int dwmac4_get_hw_feature(void __iomem *ioaddr,
+				 struct dma_features *dma_cap)
 {
 	u32 hw_cap = readl(ioaddr + GMAC_HW_FEATURE0);
 
@@ -425,6 +425,8 @@ static void dwmac4_get_hw_feature(void __iomem *ioaddr,
 	dma_cap->frpbs = (hw_cap & GMAC_HW_FEAT_FRPBS) >> 11;
 	dma_cap->frpsel = (hw_cap & GMAC_HW_FEAT_FRPSEL) >> 10;
 	dma_cap->dvlan = (hw_cap & GMAC_HW_FEAT_DVLAN) >> 5;
+
+	return 0;
 }
 
 /* Enable/disable TSO feature and set MSS */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
index 77308c5c5d29..a5583d706b9f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
@@ -365,8 +365,8 @@ static int dwxgmac2_dma_interrupt(void __iomem *ioaddr,
 	return ret;
 }
 
-static void dwxgmac2_get_hw_feature(void __iomem *ioaddr,
-				    struct dma_features *dma_cap)
+static int dwxgmac2_get_hw_feature(void __iomem *ioaddr,
+				   struct dma_features *dma_cap)
 {
 	u32 hw_cap;
 
@@ -439,6 +439,8 @@ static void dwxgmac2_get_hw_feature(void __iomem *ioaddr,
 	dma_cap->frpes = (hw_cap & XGMAC_HWFEAT_FRPES) >> 11;
 	dma_cap->frpbs = (hw_cap & XGMAC_HWFEAT_FRPPB) >> 9;
 	dma_cap->frpsel = (hw_cap & XGMAC_HWFEAT_FRPSEL) >> 3;
+
+	return 0;
 }
 
 static void dwxgmac2_rx_watchdog(void __iomem *ioaddr, u32 riwt, u32 nchan)
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index b0b84244ef10..8b7ec2457eba 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -203,8 +203,8 @@ struct stmmac_dma_ops {
 	int (*dma_interrupt) (void __iomem *ioaddr,
 			      struct stmmac_extra_stats *x, u32 chan);
 	/* If supported then get the optional core features */
-	void (*get_hw_feature)(void __iomem *ioaddr,
-			       struct dma_features *dma_cap);
+	int (*get_hw_feature)(void __iomem *ioaddr,
+			      struct dma_features *dma_cap);
 	/* Program the HW RX Watchdog */
 	void (*rx_watchdog)(void __iomem *ioaddr, u32 riwt, u32 number_chan);
 	void (*set_tx_ring_len)(void __iomem *ioaddr, u32 len, u32 chan);
@@ -255,7 +255,7 @@ struct stmmac_dma_ops {
 #define stmmac_dma_interrupt_status(__priv, __args...) \
 	stmmac_do_callback(__priv, dma, dma_interrupt, __args)
 #define stmmac_get_hw_feature(__priv, __args...) \
-	stmmac_do_void_callback(__priv, dma, get_hw_feature, __args)
+	stmmac_do_callback(__priv, dma, get_hw_feature, __args)
 #define stmmac_rx_watchdog(__priv, __args...) \
 	stmmac_do_void_callback(__priv, dma, rx_watchdog, __args)
 #define stmmac_set_tx_ring_len(__priv, __args...) \

From f2e1de075018cf71bcd7d628e9f759cb8540b0c3 Mon Sep 17 00:00:00 2001
From: Arun Ramadoss <arun.ramadoss@microchip.com>
Date: Mon, 11 Oct 2021 21:18:08 +0530
Subject: [PATCH 0914/1750] net: dsa: microchip: Added the condition for
 scheduling ksz_mib_read_work

commit ef1100ef20f29aec4e62abeccdb5bdbebba1e378 upstream.

When the ksz module is installed and removed using rmmod, kernel crashes
with null pointer dereferrence error. During rmmod, ksz_switch_remove
function tries to cancel the mib_read_workqueue using
cancel_delayed_work_sync routine and unregister switch from dsa.

During dsa_unregister_switch it calls ksz_mac_link_down, which in turn
reschedules the workqueue since mib_interval is non-zero.
Due to which queue executed after mib_interval and it tries to access
dp->slave. But the slave is unregistered in the ksz_switch_remove
function. Hence kernel crashes.

To avoid this crash, before canceling the workqueue, resetted the
mib_interval to 0.

v1 -> v2:
-Removed the if condition in ksz_mib_read_work

Fixes: 469b390e1ba3 ("net: dsa: microchip: use delayed_work instead of timer + work")
Signed-off-by: Arun Ramadoss <arun.ramadoss@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/microchip/ksz_common.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 88fa0779e0bc..e3c338624b95 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -460,8 +460,10 @@ EXPORT_SYMBOL(ksz_switch_register);
 void ksz_switch_remove(struct ksz_device *dev)
 {
 	/* timer started */
-	if (dev->mib_read_interval)
+	if (dev->mib_read_interval) {
+		dev->mib_read_interval = 0;
 		cancel_delayed_work_sync(&dev->mib_read);
+	}
 
 	dev->dev_ops->exit(dev);
 	dsa_unregister_switch(dev->ds);

From e19c10d6e07c59c96e90fe053a72683ad8b0397e Mon Sep 17 00:00:00 2001
From: Nanyong Sun <sunnanyong@huawei.com>
Date: Tue, 12 Oct 2021 20:59:01 +0800
Subject: [PATCH 0915/1750] net: encx24j600: check error in
 devm_regmap_init_encx24j600

commit f03dca0c9e2297c84a018e306f8a9cd534ee4287 upstream.

devm_regmap_init may return error which caused by like out of memory,
this will results in null pointer dereference later when reading
or writing register:

general protection fault in encx24j600_spi_probe
KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
CPU: 0 PID: 286 Comm: spi-encx24j600- Not tainted 5.15.0-rc2-00142-g9978db750e31-dirty #11 9c53a778c1306b1b02359f3c2bbedc0222cba652
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:regcache_cache_bypass drivers/base/regmap/regcache.c:540
Code: 54 41 89 f4 55 53 48 89 fb 48 83 ec 08 e8 26 94 a8 fe 48 8d bb a0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 4a 03 00 00 4c 8d ab b0 00 00 00 48 8b ab a0 00
RSP: 0018:ffffc900010476b8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: 0000000000000000
RDX: 0000000000000012 RSI: ffff888002de0000 RDI: 0000000000000094
RBP: ffff888013c9a000 R08: 0000000000000000 R09: fffffbfff3f9cc6a
R10: ffffc900010476e8 R11: fffffbfff3f9cc69 R12: 0000000000000001
R13: 000000000000000a R14: ffff888013c9af54 R15: ffff888013c9ad08
FS:  00007ffa984ab580(0000) GS:ffff88801fe00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a6384136c8 CR3: 000000003bbe6003 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 encx24j600_spi_probe drivers/net/ethernet/microchip/encx24j600.c:459
 spi_probe drivers/spi/spi.c:397
 really_probe drivers/base/dd.c:517
 __driver_probe_device drivers/base/dd.c:751
 driver_probe_device drivers/base/dd.c:782
 __device_attach_driver drivers/base/dd.c:899
 bus_for_each_drv drivers/base/bus.c:427
 __device_attach drivers/base/dd.c:971
 bus_probe_device drivers/base/bus.c:487
 device_add drivers/base/core.c:3364
 __spi_add_device drivers/spi/spi.c:599
 spi_add_device drivers/spi/spi.c:641
 spi_new_device drivers/spi/spi.c:717
 new_device_store+0x18c/0x1f1 [spi_stub 4e02719357f1ff33f5a43d00630982840568e85e]
 dev_attr_store drivers/base/core.c:2074
 sysfs_kf_write fs/sysfs/file.c:139
 kernfs_fop_write_iter fs/kernfs/file.c:300
 new_sync_write fs/read_write.c:508 (discriminator 4)
 vfs_write fs/read_write.c:594
 ksys_write fs/read_write.c:648
 do_syscall_64 arch/x86/entry/common.c:50
 entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:113

Add error check in devm_regmap_init_encx24j600 to avoid this situation.

Fixes: 04fbfce7a222 ("net: Microchip encx24j600 driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Link: https://lore.kernel.org/r/20211012125901.3623144-1-sunnanyong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/encx24j600-regmap.c | 10 ++++++++--
 drivers/net/ethernet/microchip/encx24j600.c        |  5 ++++-
 drivers/net/ethernet/microchip/encx24j600_hw.h     |  4 ++--
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/microchip/encx24j600-regmap.c b/drivers/net/ethernet/microchip/encx24j600-regmap.c
index 796e46a53926..81a8ccca7e5e 100644
--- a/drivers/net/ethernet/microchip/encx24j600-regmap.c
+++ b/drivers/net/ethernet/microchip/encx24j600-regmap.c
@@ -497,13 +497,19 @@ static struct regmap_bus phymap_encx24j600 = {
 	.reg_read = regmap_encx24j600_phy_reg_read,
 };
 
-void devm_regmap_init_encx24j600(struct device *dev,
-				 struct encx24j600_context *ctx)
+int devm_regmap_init_encx24j600(struct device *dev,
+				struct encx24j600_context *ctx)
 {
 	mutex_init(&ctx->mutex);
 	regcfg.lock_arg = ctx;
 	ctx->regmap = devm_regmap_init(dev, &regmap_encx24j600, ctx, &regcfg);
+	if (IS_ERR(ctx->regmap))
+		return PTR_ERR(ctx->regmap);
 	ctx->phymap = devm_regmap_init(dev, &phymap_encx24j600, ctx, &phycfg);
+	if (IS_ERR(ctx->phymap))
+		return PTR_ERR(ctx->phymap);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(devm_regmap_init_encx24j600);
 
diff --git a/drivers/net/ethernet/microchip/encx24j600.c b/drivers/net/ethernet/microchip/encx24j600.c
index 2c0dcd7acf3f..c95e29ae6f20 100644
--- a/drivers/net/ethernet/microchip/encx24j600.c
+++ b/drivers/net/ethernet/microchip/encx24j600.c
@@ -1024,10 +1024,13 @@ static int encx24j600_spi_probe(struct spi_device *spi)
 	priv->speed = SPEED_100;
 
 	priv->ctx.spi = spi;
-	devm_regmap_init_encx24j600(&spi->dev, &priv->ctx);
 	ndev->irq = spi->irq;
 	ndev->netdev_ops = &encx24j600_netdev_ops;
 
+	ret = devm_regmap_init_encx24j600(&spi->dev, &priv->ctx);
+	if (ret)
+		goto out_free;
+
 	mutex_init(&priv->lock);
 
 	/* Reset device and check if it is connected */
diff --git a/drivers/net/ethernet/microchip/encx24j600_hw.h b/drivers/net/ethernet/microchip/encx24j600_hw.h
index f604a260ede7..711147a159aa 100644
--- a/drivers/net/ethernet/microchip/encx24j600_hw.h
+++ b/drivers/net/ethernet/microchip/encx24j600_hw.h
@@ -15,8 +15,8 @@ struct encx24j600_context {
 	int bank;
 };
 
-void devm_regmap_init_encx24j600(struct device *dev,
-				 struct encx24j600_context *ctx);
+int devm_regmap_init_encx24j600(struct device *dev,
+				struct encx24j600_context *ctx);
 
 /* Single-byte instructions */
 #define BANK_SELECT(bank) (0xC0 | ((bank & (BANK_MASK >> BANK_SHIFT)) << 1))

From 84e0f2fc662e8f60688a015e7bf89e57522281c8 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 13 Oct 2021 16:35:49 +0200
Subject: [PATCH 0916/1750] ethernet: s2io: fix setting mac address during
 resume

commit 40507e7aada8422c38aafa0c8a1a09e4623c712a upstream.

After recent cleanups, gcc started warning about a suspicious
memcpy() call during the s2io_io_resume() function:

In function '__dev_addr_set',
    inlined from 'eth_hw_addr_set' at include/linux/etherdevice.h:318:2,
    inlined from 's2io_set_mac_addr' at drivers/net/ethernet/neterion/s2io.c:5205:2,
    inlined from 's2io_io_resume' at drivers/net/ethernet/neterion/s2io.c:8569:7:
arch/x86/include/asm/string_32.h:182:25: error: '__builtin_memcpy' accessing 6 bytes at offsets 0 and 2 overlaps 4 bytes at offset 2 [-Werror=restrict]
  182 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/netdevice.h:4648:9: note: in expansion of macro 'memcpy'
 4648 |         memcpy(dev->dev_addr, addr, len);
      |         ^~~~~~

What apparently happened is that an old cleanup changed the calling
conventions for s2io_set_mac_addr() from taking an ethernet address
as a character array to taking a struct sockaddr, but one of the
callers was not changed at the same time.

Change it to instead call the low-level do_s2io_prog_unicast() function
that still takes the old argument type.

Fixes: 2fd376884558 ("S2io: Added support set_mac_address driver entry point")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211013143613.2049096-1-arnd@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/neterion/s2io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c
index d13d92bf7447..3cae8449fadb 100644
--- a/drivers/net/ethernet/neterion/s2io.c
+++ b/drivers/net/ethernet/neterion/s2io.c
@@ -8555,7 +8555,7 @@ static void s2io_io_resume(struct pci_dev *pdev)
 			return;
 		}
 
-		if (s2io_set_mac_addr(netdev, netdev->dev_addr) == FAILURE) {
+		if (do_s2io_prog_unicast(netdev, netdev->dev_addr) == FAILURE) {
 			s2io_card_down(sp);
 			pr_err("Can't restore mac addr after reset.\n");
 			return;

From ba39f55952a217b83311467c0b911126dad9b37f Mon Sep 17 00:00:00 2001
From: Cindy Lu <lulu@redhat.com>
Date: Wed, 29 Sep 2021 17:09:33 +0800
Subject: [PATCH 0917/1750] vhost-vdpa: Fix the wrong input in config_cb

commit bcef9356fc2e1302daf373c83c826aa27954d128 upstream.

Fix the wrong input in for config_cb. In function vhost_vdpa_config_cb,
the input cb.private was used as struct vhost_vdpa, so the input was
wrong here, fix this issue

Fixes: 776f395004d8 ("vhost_vdpa: Support config interrupt in vdpa")
Signed-off-by: Cindy Lu <lulu@redhat.com>
Link: https://lore.kernel.org/r/20210929090933.20465-1-lulu@redhat.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/vhost/vdpa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index c4d53ff06bf8..fdeb20f2f174 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -325,7 +325,7 @@ static long vhost_vdpa_set_config_call(struct vhost_vdpa *v, u32 __user *argp)
 	struct eventfd_ctx *ctx;
 
 	cb.callback = vhost_vdpa_config_cb;
-	cb.private = v->vdpa;
+	cb.private = v;
 	if (copy_from_user(&fd, argp, sizeof(fd)))
 		return  -EFAULT;
 

From 2f21f06a5e7a1df4ee518b5edafe74ff6d985189 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Wed, 13 Oct 2021 11:49:32 +0800
Subject: [PATCH 0918/1750] nfc: fix error handling of nfc_proto_register()

commit 0911ab31896f0e908540746414a77dd63912748d upstream.

When nfc proto id is using, nfc_proto_register() return -EBUSY error
code, but forgot to unregister proto. Fix it by adding proto_unregister()
in the error handling case.

Fixes: c7fe3b52c128 ("NFC: add NFC socket family")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20211013034932.2833737-1-william.xuanziyang@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/af_nfc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/nfc/af_nfc.c b/net/nfc/af_nfc.c
index 4a9e72073564..581358dcbdf8 100644
--- a/net/nfc/af_nfc.c
+++ b/net/nfc/af_nfc.c
@@ -60,6 +60,9 @@ int nfc_proto_register(const struct nfc_protocol *nfc_proto)
 		proto_tab[nfc_proto->id] = nfc_proto;
 	write_unlock(&proto_tab_lock);
 
+	if (rc)
+		proto_unregister(nfc_proto->proto);
+
 	return rc;
 }
 EXPORT_SYMBOL(nfc_proto_register);

From 3f2960b39f22e26cf8addae93c3f5884d1c183c9 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Wed, 13 Oct 2021 15:50:12 +0800
Subject: [PATCH 0919/1750] NFC: digital: fix possible memory leak in
 digital_tg_listen_mdaa()

commit 58e7dcc9ca29c14e44267a4d0ea61e3229124907 upstream.

'params' is allocated in digital_tg_listen_mdaa(), but not free when
digital_send_cmd() failed, which will cause memory leak. Fix it by
freeing 'params' if digital_send_cmd() return failed.

Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/digital_core.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
index e3599ed4a7a8..9c9caa307cf1 100644
--- a/net/nfc/digital_core.c
+++ b/net/nfc/digital_core.c
@@ -277,6 +277,7 @@ int digital_tg_configure_hw(struct nfc_digital_dev *ddev, int type, int param)
 static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech)
 {
 	struct digital_tg_mdaa_params *params;
+	int rc;
 
 	params = kzalloc(sizeof(*params), GFP_KERNEL);
 	if (!params)
@@ -291,8 +292,12 @@ static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech)
 	get_random_bytes(params->nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2);
 	params->sc = DIGITAL_SENSF_FELICA_SC;
 
-	return digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params,
-				500, digital_tg_recv_atr_req, NULL);
+	rc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params,
+			      500, digital_tg_recv_atr_req, NULL);
+	if (rc)
+		kfree(params);
+
+	return rc;
 }
 
 static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech)

From 50cb95487c265187289810addec5093d4fed8329 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Wed, 13 Oct 2021 15:50:32 +0800
Subject: [PATCH 0920/1750] NFC: digital: fix possible memory leak in
 digital_in_send_sdd_req()

commit 291c932fc3692e4d211a445ba8aa35663831bac7 upstream.

'skb' is allocated in digital_in_send_sdd_req(), but not free when
digital_in_send_cmd() failed, which will cause memory leak. Fix it
by freeing 'skb' if digital_in_send_cmd() return failed.

Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/digital_technology.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index 84d2345c75a3..3adf4589852a 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -465,8 +465,12 @@ static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev,
 	skb_put_u8(skb, sel_cmd);
 	skb_put_u8(skb, DIGITAL_SDD_REQ_SEL_PAR);
 
-	return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res,
-				   target);
+	rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res,
+				 target);
+	if (rc)
+		kfree_skb(skb);
+
+	return rc;
 }
 
 static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg,

From 116932c0e45e8f7f4e485550a60992505e56eb63 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 6 Oct 2021 10:34:19 +0300
Subject: [PATCH 0921/1750] pata_legacy: fix a couple uninitialized variable
 bugs

commit 013923477cb311293df9079332cf8b806ed0e6f2 upstream.

The last byte of "pad" is used without being initialized.

Fixes: 55dba3120fbc ("libata: update ->data_xfer hook for ATAPI")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/pata_legacy.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index 4fd12b20df23..d91ba47f2fc4 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -315,7 +315,8 @@ static unsigned int pdc_data_xfer_vlb(struct ata_queued_cmd *qc,
 			iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
 
 		if (unlikely(slop)) {
-			__le32 pad;
+			__le32 pad = 0;
+
 			if (rw == READ) {
 				pad = cpu_to_le32(ioread32(ap->ioaddr.data_addr));
 				memcpy(buf + buflen - slop, &pad, slop);
@@ -705,7 +706,8 @@ static unsigned int vlb32_data_xfer(struct ata_queued_cmd *qc,
 			ioread32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
 
 		if (unlikely(slop)) {
-			__le32 pad;
+			__le32 pad = 0;
+
 			if (rw == WRITE) {
 				memcpy(&pad, buf + buflen - slop, slop);
 				iowrite32(le32_to_cpu(pad), ap->ioaddr.data_addr);

From 7eef482db72831c3676d2114a1876ad1999cdac7 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Wed, 13 Oct 2021 14:16:31 +0800
Subject: [PATCH 0922/1750] ata: ahci_platform: fix null-ptr-deref in
 ahci_platform_enable_regulators()

commit 776c75010803849c1cc4f11031a2b3960ab05202 upstream.

I got a null-ptr-deref report:

KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
...
RIP: 0010:regulator_enable+0x84/0x260
...
Call Trace:
 ahci_platform_enable_regulators+0xae/0x320
 ahci_platform_enable_resources+0x1a/0x120
 ahci_probe+0x4f/0x1b9
 platform_probe+0x10b/0x280
...
 entry_SYSCALL_64_after_hwframe+0x44/0xae

If devm_regulator_get() in ahci_platform_get_resources() fails,
hpriv->phy_regulator will point to NULL, when enabling or disabling it,
null-ptr-deref will occur.

ahci_probe()
	ahci_platform_get_resources()
		devm_regulator_get(, "phy") // failed, let phy_regulator = NULL
	ahci_platform_enable_resources()
		ahci_platform_enable_regulators()
			regulator_enable(hpriv->phy_regulator) // null-ptr-deref

commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional()
misuse") replaces devm_regulator_get_optional() with devm_regulator_get(),
but PHY regulator omits to delete "hpriv->phy_regulator = NULL;" like AHCI.
Delete it like AHCI regulator to fix this bug.

Fixes: commit 962399bb7fbf ("ata: libahci_platform: Fix regulator_get_optional() misuse")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/libahci_platform.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
index b2f552088291..0910441321f7 100644
--- a/drivers/ata/libahci_platform.c
+++ b/drivers/ata/libahci_platform.c
@@ -440,10 +440,7 @@ struct ahci_host_priv *ahci_platform_get_resources(struct platform_device *pdev,
 	hpriv->phy_regulator = devm_regulator_get(dev, "phy");
 	if (IS_ERR(hpriv->phy_regulator)) {
 		rc = PTR_ERR(hpriv->phy_regulator);
-		if (rc == -EPROBE_DEFER)
-			goto err_out;
-		rc = 0;
-		hpriv->phy_regulator = NULL;
+		goto err_out;
 	}
 
 	if (flags & AHCI_PLATFORM_GET_RESETS) {

From e59d839743b50cb1d3f42a786bea48cc5621d254 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Tue, 12 Oct 2021 20:49:55 +0300
Subject: [PATCH 0923/1750] mlxsw: thermal: Fix out-of-bounds memory accesses

commit 332fdf951df8b870e3da86b122ae304e2aabe88c upstream.

Currently, mlxsw allows cooling states to be set above the maximum
cooling state supported by the driver:

 # cat /sys/class/thermal/thermal_zone2/cdev0/type
 mlxsw_fan
 # cat /sys/class/thermal/thermal_zone2/cdev0/max_state
 10
 # echo 18 > /sys/class/thermal/thermal_zone2/cdev0/cur_state
 # echo $?
 0

This results in out-of-bounds memory accesses when thermal state
transition statistics are enabled (CONFIG_THERMAL_STATISTICS=y), as the
transition table is accessed with a too large index (state) [1].

According to the thermal maintainer, it is the responsibility of the
driver to reject such operations [2].

Therefore, return an error when the state to be set exceeds the maximum
cooling state supported by the driver.

To avoid dead code, as suggested by the thermal maintainer [3],
partially revert commit a421ce088ac8 ("mlxsw: core: Extend cooling
device with cooling levels") that tried to interpret these invalid
cooling states (above the maximum) in a special way. The cooling levels
array is not removed in order to prevent the fans going below 20% PWM,
which would cause them to get stuck at 0% PWM.

[1]
BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x271/0x290
Read of size 4 at addr ffff8881052f7bf8 by task kworker/0:0/5

CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.15.0-rc3-custom-45935-gce1adf704b14 #122
Hardware name: Mellanox Technologies Ltd. "MSN2410-CB2FO"/"SA000874", BIOS 4.6.5 03/08/2016
Workqueue: events_freezable_power_ thermal_zone_device_check
Call Trace:
 dump_stack_lvl+0x8b/0xb3
 print_address_description.constprop.0+0x1f/0x140
 kasan_report.cold+0x7f/0x11b
 thermal_cooling_device_stats_update+0x271/0x290
 __thermal_cdev_update+0x15e/0x4e0
 thermal_cdev_update+0x9f/0xe0
 step_wise_throttle+0x770/0xee0
 thermal_zone_device_update+0x3f6/0xdf0
 process_one_work+0xa42/0x1770
 worker_thread+0x62f/0x13e0
 kthread+0x3ee/0x4e0
 ret_from_fork+0x1f/0x30

Allocated by task 1:
 kasan_save_stack+0x1b/0x40
 __kasan_kmalloc+0x7c/0x90
 thermal_cooling_device_setup_sysfs+0x153/0x2c0
 __thermal_cooling_device_register.part.0+0x25b/0x9c0
 thermal_cooling_device_register+0xb3/0x100
 mlxsw_thermal_init+0x5c5/0x7e0
 __mlxsw_core_bus_device_register+0xcb3/0x19c0
 mlxsw_core_bus_device_register+0x56/0xb0
 mlxsw_pci_probe+0x54f/0x710
 local_pci_probe+0xc6/0x170
 pci_device_probe+0x2b2/0x4d0
 really_probe+0x293/0xd10
 __driver_probe_device+0x2af/0x440
 driver_probe_device+0x51/0x1e0
 __driver_attach+0x21b/0x530
 bus_for_each_dev+0x14c/0x1d0
 bus_add_driver+0x3ac/0x650
 driver_register+0x241/0x3d0
 mlxsw_sp_module_init+0xa2/0x174
 do_one_initcall+0xee/0x5f0
 kernel_init_freeable+0x45a/0x4de
 kernel_init+0x1f/0x210
 ret_from_fork+0x1f/0x30

The buggy address belongs to the object at ffff8881052f7800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 1016 bytes inside of
 1024-byte region [ffff8881052f7800, ffff8881052f7c00)
The buggy address belongs to the page:
page:0000000052355272 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1052f0
head:0000000052355272 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x200000000010200(slab|head|node=0|zone=2)
raw: 0200000000010200 ffffea0005034800 0000000300000003 ffff888100041dc0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881052f7a80: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
 ffff8881052f7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881052f7b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff8881052f7c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881052f7c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

[2] https://lore.kernel.org/linux-pm/9aca37cb-1629-5c67-1895-1fdc45c0244e@linaro.org/
[3] https://lore.kernel.org/linux-pm/af9857f2-578e-de3a-e62b-6baff7e69fd4@linaro.org/

CC: Daniel Lezcano <daniel.lezcano@linaro.org>
Fixes: a50c1e35650b ("mlxsw: core: Implement thermal zone")
Fixes: a421ce088ac8 ("mlxsw: core: Extend cooling device with cooling levels")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Tested-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20211012174955.472928-1-idosch@idosch.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../ethernet/mellanox/mlxsw/core_thermal.c    | 52 ++-----------------
 1 file changed, 5 insertions(+), 47 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
index 42e4437ac3c1..7ec1d0ee9bee 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
@@ -25,16 +25,8 @@
 #define MLXSW_THERMAL_ZONE_MAX_NAME	16
 #define MLXSW_THERMAL_TEMP_SCORE_MAX	GENMASK(31, 0)
 #define MLXSW_THERMAL_MAX_STATE	10
+#define MLXSW_THERMAL_MIN_STATE	2
 #define MLXSW_THERMAL_MAX_DUTY	255
-/* Minimum and maximum fan allowed speed in percent: from 20% to 100%. Values
- * MLXSW_THERMAL_MAX_STATE + x, where x is between 2 and 10 are used for
- * setting fan speed dynamic minimum. For example, if value is set to 14 (40%)
- * cooling levels vector will be set to 4, 4, 4, 4, 4, 5, 6, 7, 8, 9, 10 to
- * introduce PWM speed in percent: 40, 40, 40, 40, 40, 50, 60. 70, 80, 90, 100.
- */
-#define MLXSW_THERMAL_SPEED_MIN		(MLXSW_THERMAL_MAX_STATE + 2)
-#define MLXSW_THERMAL_SPEED_MAX		(MLXSW_THERMAL_MAX_STATE * 2)
-#define MLXSW_THERMAL_SPEED_MIN_LEVEL	2		/* 20% */
 
 /* External cooling devices, allowed for binding to mlxsw thermal zones. */
 static char * const mlxsw_thermal_external_allowed_cdev[] = {
@@ -635,49 +627,16 @@ static int mlxsw_thermal_set_cur_state(struct thermal_cooling_device *cdev,
 	struct mlxsw_thermal *thermal = cdev->devdata;
 	struct device *dev = thermal->bus_info->dev;
 	char mfsc_pl[MLXSW_REG_MFSC_LEN];
-	unsigned long cur_state, i;
 	int idx;
-	u8 duty;
 	int err;
 
+	if (state > MLXSW_THERMAL_MAX_STATE)
+		return -EINVAL;
+
 	idx = mlxsw_get_cooling_device_idx(thermal, cdev);
 	if (idx < 0)
 		return idx;
 
-	/* Verify if this request is for changing allowed fan dynamical
-	 * minimum. If it is - update cooling levels accordingly and update
-	 * state, if current state is below the newly requested minimum state.
-	 * For example, if current state is 5, and minimal state is to be
-	 * changed from 4 to 6, thermal->cooling_levels[0 to 5] will be changed
-	 * all from 4 to 6. And state 5 (thermal->cooling_levels[4]) should be
-	 * overwritten.
-	 */
-	if (state >= MLXSW_THERMAL_SPEED_MIN &&
-	    state <= MLXSW_THERMAL_SPEED_MAX) {
-		state -= MLXSW_THERMAL_MAX_STATE;
-		for (i = 0; i <= MLXSW_THERMAL_MAX_STATE; i++)
-			thermal->cooling_levels[i] = max(state, i);
-
-		mlxsw_reg_mfsc_pack(mfsc_pl, idx, 0);
-		err = mlxsw_reg_query(thermal->core, MLXSW_REG(mfsc), mfsc_pl);
-		if (err)
-			return err;
-
-		duty = mlxsw_reg_mfsc_pwm_duty_cycle_get(mfsc_pl);
-		cur_state = mlxsw_duty_to_state(duty);
-
-		/* If current fan state is lower than requested dynamical
-		 * minimum, increase fan speed up to dynamical minimum.
-		 */
-		if (state < cur_state)
-			return 0;
-
-		state = cur_state;
-	}
-
-	if (state > MLXSW_THERMAL_MAX_STATE)
-		return -EINVAL;
-
 	/* Normalize the state to the valid speed range. */
 	state = thermal->cooling_levels[state];
 	mlxsw_reg_mfsc_pack(mfsc_pl, idx, mlxsw_state_to_duty(state));
@@ -980,8 +939,7 @@ int mlxsw_thermal_init(struct mlxsw_core *core,
 
 	/* Initialize cooling levels per PWM state. */
 	for (i = 0; i < MLXSW_THERMAL_MAX_STATE; i++)
-		thermal->cooling_levels[i] = max(MLXSW_THERMAL_SPEED_MIN_LEVEL,
-						 i);
+		thermal->cooling_levels[i] = max(MLXSW_THERMAL_MIN_STATE, i);
 
 	thermal->polling_delay = bus_info->low_frequency ?
 				 MLXSW_THERMAL_SLOW_POLL_INT :

From c216cebdd245b6d8546950269453d89414eda973 Mon Sep 17 00:00:00 2001
From: Vadim Pasternak <vadimp@nvidia.com>
Date: Mon, 27 Sep 2021 17:22:13 +0300
Subject: [PATCH 0924/1750] platform/mellanox: mlxreg-io: Fix argument base in
 kstrtou32() call

commit 9b024201693e397441668cca0d2df7055fe572eb upstream.

Change kstrtou32() argument 'base' to be zero instead of 'len'.
It works by chance for setting one bit value, but it is not supposed to
work in case value passed to mlxreg_io_attr_store() is greater than 1.

It works for example, for:
echo 1 > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable
But it will fail for:
echo n > /sys/devices/platform/mlxplat/mlxreg-io/hwmon/.../jtag_enable,
where n > 1.

The flow for input buffer conversion is as below:
_kstrtoull(const char *s, unsigned int base, unsigned long long *res)
calls:
rv = _parse_integer(s, base, &_res);

For the second case, where n > 1:
- _parse_integer() converts 's' to 'val'.
  For n=2, 'len' is set to 2 (string buffer is 0x32 0x0a), for n=3
  'len' is set to 3 (string buffer 0x33 0x0a), etcetera.
- 'base' is equal or greater then '2' (length of input buffer).

As a result, _parse_integer() exits with result zero (rv):
	rv = 0;
	while (1) {
		...
		if (val >= base)-> (2 >= 2)
			break;
		...
		rv++;
		...
	}

And _kstrtoull() in their turn will fail:
	if (rv == 0)
		return -EINVAL;

Fixes: 5ec4a8ace06c ("platform/mellanox: Introduce support for Mellanox register access driver")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20210927142214.2613929-2-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/mellanox/mlxreg-io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/mellanox/mlxreg-io.c b/drivers/platform/mellanox/mlxreg-io.c
index 7646708d57e4..a023ec02126b 100644
--- a/drivers/platform/mellanox/mlxreg-io.c
+++ b/drivers/platform/mellanox/mlxreg-io.c
@@ -141,7 +141,7 @@ mlxreg_io_attr_store(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 
 	/* Convert buffer to input value. */
-	ret = kstrtou32(buf, len, &input_val);
+	ret = kstrtou32(buf, 0, &input_val);
 	if (ret)
 		return ret;
 

From d9428f08e1c3b8d4da3d98f27f9eae0412b2cb38 Mon Sep 17 00:00:00 2001
From: Vadim Pasternak <vadimp@nvidia.com>
Date: Mon, 27 Sep 2021 17:22:14 +0300
Subject: [PATCH 0925/1750] platform/mellanox: mlxreg-io: Fix read access of
 n-bytes size attributes

commit db9cc7d6f95e7d89b0ce57e785cfd9d67a7505d8 upstream.

Fix shift argument for function rol32(). It should be provided in bits,
while was provided in bytes.

Fixes: 86148190a7db ("platform/mellanox: mlxreg-io: Add support for complex attributes")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/20210927142214.2613929-3-vadimp@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/mellanox/mlxreg-io.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/mellanox/mlxreg-io.c b/drivers/platform/mellanox/mlxreg-io.c
index a023ec02126b..a916cd89cbbe 100644
--- a/drivers/platform/mellanox/mlxreg-io.c
+++ b/drivers/platform/mellanox/mlxreg-io.c
@@ -98,7 +98,7 @@ mlxreg_io_get_reg(void *regmap, struct mlxreg_core_data *data, u32 in_val,
 			if (ret)
 				goto access_error;
 
-			*regval |= rol32(val, regsize * i);
+			*regval |= rol32(val, regsize * i * 8);
 		}
 	}
 

From a4a37e6516f86dd0e67efafbf0d41840f4669b1f Mon Sep 17 00:00:00 2001
From: Kamal Dasu <kdasu@broadcom.com>
Date: Fri, 8 Oct 2021 16:36:02 -0400
Subject: [PATCH 0926/1750] spi: bcm-qspi: clear MSPI spifie interrupt during
 probe

commit 75b3cb97eb1f05042745c0655a7145b0262d4c5c upstream.

Intermittent Kernel crash has been observed on probe in
bcm_qspi_mspi_l2_isr() handler when the MSPI spifie interrupt bit
has not been cleared before registering for interrupts.
Fix the driver to move SoC specific custom interrupt handling code
before we register IRQ in probe. Also clear MSPI interrupt status
resgiter prior to registering IRQ handlers.

Fixes: cc20a38612db ("spi: iproc-qspi: Add Broadcom iProc SoCs support")
Signed-off-by: Kamal Dasu <kdasu@broadcom.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20211008203603.40915-3-kdasu.kdev@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/spi/spi-bcm-qspi.c | 77 ++++++++++++++++++++++----------------
 1 file changed, 45 insertions(+), 32 deletions(-)

diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index c028446c7460..b4d5930be2a9 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1250,10 +1250,14 @@ static void bcm_qspi_hw_init(struct bcm_qspi *qspi)
 
 static void bcm_qspi_hw_uninit(struct bcm_qspi *qspi)
 {
+	u32 status = bcm_qspi_read(qspi, MSPI, MSPI_MSPI_STATUS);
+
 	bcm_qspi_write(qspi, MSPI, MSPI_SPCR2, 0);
 	if (has_bspi(qspi))
 		bcm_qspi_write(qspi, MSPI, MSPI_WRITE_LOCK, 0);
 
+	/* clear interrupt */
+	bcm_qspi_write(qspi, MSPI, MSPI_MSPI_STATUS, status & ~1);
 }
 
 static const struct spi_controller_mem_ops bcm_qspi_mem_ops = {
@@ -1397,6 +1401,47 @@ int bcm_qspi_probe(struct platform_device *pdev,
 	if (!qspi->dev_ids)
 		return -ENOMEM;
 
+	/*
+	 * Some SoCs integrate spi controller (e.g., its interrupt bits)
+	 * in specific ways
+	 */
+	if (soc_intc) {
+		qspi->soc_intc = soc_intc;
+		soc_intc->bcm_qspi_int_set(soc_intc, MSPI_DONE, true);
+	} else {
+		qspi->soc_intc = NULL;
+	}
+
+	if (qspi->clk) {
+		ret = clk_prepare_enable(qspi->clk);
+		if (ret) {
+			dev_err(dev, "failed to prepare clock\n");
+			goto qspi_probe_err;
+		}
+		qspi->base_clk = clk_get_rate(qspi->clk);
+	} else {
+		qspi->base_clk = MSPI_BASE_FREQ;
+	}
+
+	if (data->has_mspi_rev) {
+		rev = bcm_qspi_read(qspi, MSPI, MSPI_REV);
+		/* some older revs do not have a MSPI_REV register */
+		if ((rev & 0xff) == 0xff)
+			rev = 0;
+	}
+
+	qspi->mspi_maj_rev = (rev >> 4) & 0xf;
+	qspi->mspi_min_rev = rev & 0xf;
+	qspi->mspi_spcr3_sysclk = data->has_spcr3_sysclk;
+
+	qspi->max_speed_hz = qspi->base_clk / (bcm_qspi_spbr_min(qspi) * 2);
+
+	/*
+	 * On SW resets it is possible to have the mask still enabled
+	 * Need to disable the mask and clear the status while we init
+	 */
+	bcm_qspi_hw_uninit(qspi);
+
 	for (val = 0; val < num_irqs; val++) {
 		irq = -1;
 		name = qspi_irq_tab[val].irq_name;
@@ -1433,38 +1478,6 @@ int bcm_qspi_probe(struct platform_device *pdev,
 		goto qspi_probe_err;
 	}
 
-	/*
-	 * Some SoCs integrate spi controller (e.g., its interrupt bits)
-	 * in specific ways
-	 */
-	if (soc_intc) {
-		qspi->soc_intc = soc_intc;
-		soc_intc->bcm_qspi_int_set(soc_intc, MSPI_DONE, true);
-	} else {
-		qspi->soc_intc = NULL;
-	}
-
-	ret = clk_prepare_enable(qspi->clk);
-	if (ret) {
-		dev_err(dev, "failed to prepare clock\n");
-		goto qspi_probe_err;
-	}
-
-	qspi->base_clk = clk_get_rate(qspi->clk);
-
-	if (data->has_mspi_rev) {
-		rev = bcm_qspi_read(qspi, MSPI, MSPI_REV);
-		/* some older revs do not have a MSPI_REV register */
-		if ((rev & 0xff) == 0xff)
-			rev = 0;
-	}
-
-	qspi->mspi_maj_rev = (rev >> 4) & 0xf;
-	qspi->mspi_min_rev = rev & 0xf;
-	qspi->mspi_spcr3_sysclk = data->has_spcr3_sysclk;
-
-	qspi->max_speed_hz = qspi->base_clk / (bcm_qspi_spbr_min(qspi) * 2);
-
 	bcm_qspi_hw_init(qspi);
 	init_completion(&qspi->mspi_done);
 	init_completion(&qspi->bspi_done);

From d0f0e17103972f40b46930afcb7685438028ec0d Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Tue, 12 Oct 2021 13:52:42 +0200
Subject: [PATCH 0927/1750] drm/panel: olimex-lcd-olinuxino: select CRC32

commit a14bc107edd0c108bda2245e50daa22f91c95d20 upstream.

Fix the following build/link error by adding a dependency on the CRC32
routines:

  ld: drivers/gpu/drm/panel/panel-olimex-lcd-olinuxino.o: in function `lcd_olinuxino_probe':
  panel-olimex-lcd-olinuxino.c:(.text+0x303): undefined reference to `crc32_le'

Fixes: 17fd7a9d324fd ("drm/panel: Add support for Olimex LCD-OLinuXino panel")
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211012115242.10325-1-vegard.nossum@oracle.com
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/panel/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/panel/Kconfig b/drivers/gpu/drm/panel/Kconfig
index b9dbedf8f15e..6153972e0127 100644
--- a/drivers/gpu/drm/panel/Kconfig
+++ b/drivers/gpu/drm/panel/Kconfig
@@ -233,6 +233,7 @@ config DRM_PANEL_OLIMEX_LCD_OLINUXINO
 	depends on OF
 	depends on I2C
 	depends on BACKLIGHT_CLASS_DEVICE
+	select CRC32
 	help
 	  The panel is used with different sizes LCDs, from 480x272 to
 	  1280x800, and 24 bit per pixel.

From a7b45024f66f9ec769e8dbb1a51ae83cd05929c7 Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Tue, 5 Oct 2021 19:29:08 -0700
Subject: [PATCH 0928/1750] drm/edid: In connector_bad_edid() cap num_of_ext by
 num_blocks read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 97794170b696856483f74b47bfb6049780d2d3a0 upstream.

In commit e11f5bd8228f ("drm: Add support for DP 1.4 Compliance edid
corruption test") the function connector_bad_edid() started assuming
that the memory for the EDID passed to it was big enough to hold
`edid[0x7e] + 1` blocks of data (1 extra for the base block). It
completely ignored the fact that the function was passed `num_blocks`
which indicated how much memory had been allocated for the EDID.

Let's fix this by adding a bounds check.

This is important for handling the case where there's an error in the
first block of the EDID. In that case we will call
connector_bad_edid() without having re-allocated memory based on
`edid[0x7e]`.

Fixes: e11f5bd8228f ("drm: Add support for DP 1.4 Compliance edid corruption test")
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20211005192905.v2.1.Ib059f9c23c2611cb5a9d760e7d0a700c1295928d@changeid
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/drm_edid.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index b7ddf504e024..add317bd8d55 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -1835,11 +1835,20 @@ static void connector_bad_edid(struct drm_connector *connector,
 			       u8 *edid, int num_blocks)
 {
 	int i;
-	u8 num_of_ext = edid[0x7e];
+	u8 last_block;
+
+	/*
+	 * 0x7e in the EDID is the number of extension blocks. The EDID
+	 * is 1 (base block) + num_ext_blocks big. That means we can think
+	 * of 0x7e in the EDID of the _index_ of the last block in the
+	 * combined chunk of memory.
+	 */
+	last_block = edid[0x7e];
 
 	/* Calculate real checksum for the last edid extension block data */
-	connector->real_edid_checksum =
-		drm_edid_block_checksum(edid + num_of_ext * EDID_LENGTH);
+	if (last_block < num_blocks)
+		connector->real_edid_checksum =
+			drm_edid_block_checksum(edid + last_block * EDID_LENGTH);
 
 	if (connector->bad_edid_counter++ && !drm_debug_enabled(DRM_UT_KMS))
 		return;

From 91a340768b012f5b910a203a805b97a345b3db37 Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 29 Sep 2021 13:18:57 +0100
Subject: [PATCH 0929/1750] drm/msm: Fix null pointer dereference on pointer
 edp

commit 2133c4fc8e1348dcb752f267a143fe2254613b34 upstream.

The initialization of pointer dev dereferences pointer edp before
edp is null checked, so there is a potential null pointer deference
issue. Fix this by only dereferencing edp after edp has been null
checked.

Addresses-Coverity: ("Dereference before null check")
Fixes: ab5b0107ccf3 ("drm/msm: Initial add eDP support in msm drm driver (v5)")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210929121857.213922-1-colin.king@canonical.com
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/edp/edp_ctrl.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/edp/edp_ctrl.c b/drivers/gpu/drm/msm/edp/edp_ctrl.c
index 0d9657cc70db..937b4abb1552 100644
--- a/drivers/gpu/drm/msm/edp/edp_ctrl.c
+++ b/drivers/gpu/drm/msm/edp/edp_ctrl.c
@@ -1116,7 +1116,7 @@ void msm_edp_ctrl_power(struct edp_ctrl *ctrl, bool on)
 int msm_edp_ctrl_init(struct msm_edp *edp)
 {
 	struct edp_ctrl *ctrl = NULL;
-	struct device *dev = &edp->pdev->dev;
+	struct device *dev;
 	int ret;
 
 	if (!edp) {
@@ -1124,6 +1124,7 @@ int msm_edp_ctrl_init(struct msm_edp *edp)
 		return -EINVAL;
 	}
 
+	dev = &edp->pdev->dev;
 	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
 	if (!ctrl)
 		return -ENOMEM;

From abd11864159b17a3fb5786ec7564e5d494691c0a Mon Sep 17 00:00:00 2001
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Date: Sat, 25 Sep 2021 22:28:24 +0300
Subject: [PATCH 0930/1750] drm/msm/mdp5: fix cursor-related warnings

commit c491a0c7bbf3a64732cb8414021429d15ec08eec upstream.

Since f35a2a99100f ("drm/encoder: make encoder control functions
optional") drm_mode_config_validate would print warnings if both cursor
plane and cursor functions are provided. Restore separate set of
drm_crtc_funcs to be used if separate cursor plane is provided.

[    6.556046] ------------[ cut here ]------------
[    6.556071] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_set func
[    6.556091] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:648 drm_mode_config_validate+0x238/0x4d0
[    6.567453] Modules linked in:
[    6.577604] CPU: 1 PID: 76 Comm: kworker/u8:2 Not tainted 5.15.0-rc1-dirty #43
[    6.580557] Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
[    6.587763] Workqueue: events_unbound deferred_probe_work_func
[    6.593926] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    6.599740] pc : drm_mode_config_validate+0x238/0x4d0
[    6.606596] lr : drm_mode_config_validate+0x238/0x4d0
[    6.611804] sp : ffff8000121b3980
[    6.616838] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001
[    6.620140] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8
[    6.627258] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001
[    6.634376] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff
[    6.641494] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c78709
[    6.648613] x14: 0000000000000000 x13: ffff800011a22850 x12: 00000000000009ab
[    6.655730] x11: 0000000000000339 x10: ffff800011a22850 x9 : ffff800011a22850
[    6.662848] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850
[    6.669966] x5 : 000000000000bff4 x4 : 40000000fffff339 x3 : 0000000000000000
[    6.677084] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800
[    6.684205] Call trace:
[    6.691319]  drm_mode_config_validate+0x238/0x4d0
[    6.693577]  drm_dev_register+0x17c/0x210
[    6.698435]  msm_drm_bind+0x4b4/0x694
[    6.702429]  try_to_bring_up_master+0x164/0x1d0
[    6.706075]  __component_add+0xa0/0x170
[    6.710415]  component_add+0x14/0x20
[    6.714234]  msm_hdmi_dev_probe+0x1c/0x2c
[    6.718053]  platform_probe+0x68/0xe0
[    6.721959]  really_probe.part.0+0x9c/0x30c
[    6.725606]  __driver_probe_device+0x98/0x144
[    6.729600]  driver_probe_device+0xc8/0x15c
[    6.734114]  __device_attach_driver+0xb4/0x120
[    6.738106]  bus_for_each_drv+0x78/0xd0
[    6.742619]  __device_attach+0xdc/0x184
[    6.746351]  device_initial_probe+0x14/0x20
[    6.750172]  bus_probe_device+0x9c/0xa4
[    6.754337]  deferred_probe_work_func+0x88/0xc0
[    6.758158]  process_one_work+0x1d0/0x370
[    6.762671]  worker_thread+0x2c8/0x470
[    6.766839]  kthread+0x15c/0x170
[    6.770483]  ret_from_fork+0x10/0x20
[    6.773870] ---[ end trace 5884eb76cd26d274 ]---
[    6.777500] ------------[ cut here ]------------
[    6.782043] [CRTC:93:crtc-0] must not have both a cursor plane and a cursor_move func
[    6.782063] WARNING: CPU: 1 PID: 76 at drivers/gpu/drm/drm_mode_config.c:654 drm_mode_config_validate+0x290/0x4d0
[    6.794362] Modules linked in:
[    6.804600] CPU: 1 PID: 76 Comm: kworker/u8:2 Tainted: G        W         5.15.0-rc1-dirty #43
[    6.807555] Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
[    6.816148] Workqueue: events_unbound deferred_probe_work_func
[    6.822311] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    6.828126] pc : drm_mode_config_validate+0x290/0x4d0
[    6.834981] lr : drm_mode_config_validate+0x290/0x4d0
[    6.840189] sp : ffff8000121b3980
[    6.845223] x29: ffff8000121b3990 x28: 0000000000000000 x27: 0000000000000001
[    6.848525] x26: ffff8000114cde50 x25: ffff8000114cdd40 x24: ffff0000987282d8
[    6.855643] x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000001
[    6.862763] x20: ffff000098728000 x19: ffff000080a39000 x18: ffffffffffffffff
[    6.869879] x17: 3136564e3631564e x16: 0000000000000324 x15: ffff800011c790c2
[    6.876998] x14: 0000000000000000 x13: ffff800011a22850 x12: 0000000000000a2f
[    6.884116] x11: 0000000000000365 x10: ffff800011a22850 x9 : ffff800011a22850
[    6.891234] x8 : 00000000ffffefff x7 : ffff800011a7a850 x6 : ffff800011a7a850
[    6.898351] x5 : 000000000000bff4 x4 : 40000000fffff365 x3 : 0000000000000000
[    6.905470] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008093b800
[    6.912590] Call trace:
[    6.919702]  drm_mode_config_validate+0x290/0x4d0
[    6.921960]  drm_dev_register+0x17c/0x210
[    6.926821]  msm_drm_bind+0x4b4/0x694
[    6.930813]  try_to_bring_up_master+0x164/0x1d0
[    6.934459]  __component_add+0xa0/0x170
[    6.938799]  component_add+0x14/0x20
[    6.942619]  msm_hdmi_dev_probe+0x1c/0x2c
[    6.946438]  platform_probe+0x68/0xe0
[    6.950345]  really_probe.part.0+0x9c/0x30c
[    6.953991]  __driver_probe_device+0x98/0x144
[    6.957984]  driver_probe_device+0xc8/0x15c
[    6.962498]  __device_attach_driver+0xb4/0x120
[    6.966492]  bus_for_each_drv+0x78/0xd0
[    6.971004]  __device_attach+0xdc/0x184
[    6.974737]  device_initial_probe+0x14/0x20
[    6.978556]  bus_probe_device+0x9c/0xa4
[    6.982722]  deferred_probe_work_func+0x88/0xc0
[    6.986543]  process_one_work+0x1d0/0x370
[    6.991057]  worker_thread+0x2c8/0x470
[    6.995223]  kthread+0x15c/0x170
[    6.998869]  ret_from_fork+0x10/0x20
[    7.002255] ---[ end trace 5884eb76cd26d275 ]---

Fixes: aa649e875daf ("drm/msm/mdp5: mdp5_crtc: Restore cursor state only if LM cursors are enabled")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210925192824.3416259-1-dmitry.baryshkov@linaro.org
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
index 7d7668998501..a8fa084dfa49 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c
@@ -1119,6 +1119,20 @@ static void mdp5_crtc_reset(struct drm_crtc *crtc)
 	__drm_atomic_helper_crtc_reset(crtc, &mdp5_cstate->base);
 }
 
+static const struct drm_crtc_funcs mdp5_crtc_no_lm_cursor_funcs = {
+	.set_config = drm_atomic_helper_set_config,
+	.destroy = mdp5_crtc_destroy,
+	.page_flip = drm_atomic_helper_page_flip,
+	.reset = mdp5_crtc_reset,
+	.atomic_duplicate_state = mdp5_crtc_duplicate_state,
+	.atomic_destroy_state = mdp5_crtc_destroy_state,
+	.atomic_print_state = mdp5_crtc_atomic_print_state,
+	.get_vblank_counter = mdp5_crtc_get_vblank_counter,
+	.enable_vblank  = msm_crtc_enable_vblank,
+	.disable_vblank = msm_crtc_disable_vblank,
+	.get_vblank_timestamp = drm_crtc_vblank_helper_get_vblank_timestamp,
+};
+
 static const struct drm_crtc_funcs mdp5_crtc_funcs = {
 	.set_config = drm_atomic_helper_set_config,
 	.destroy = mdp5_crtc_destroy,
@@ -1307,6 +1321,8 @@ struct drm_crtc *mdp5_crtc_init(struct drm_device *dev,
 	mdp5_crtc->lm_cursor_enabled = cursor_plane ? false : true;
 
 	drm_crtc_init_with_planes(dev, crtc, plane, cursor_plane,
+				  cursor_plane ?
+				  &mdp5_crtc_no_lm_cursor_funcs :
 				  &mdp5_crtc_funcs, NULL);
 
 	drm_flip_work_init(&mdp5_crtc->unref_cursor_work,

From b28586fb04f35a2d07ebe62e702525139bb2ce3d Mon Sep 17 00:00:00 2001
From: Rob Clark <robdclark@chromium.org>
Date: Thu, 30 Sep 2021 10:43:20 -0700
Subject: [PATCH 0931/1750] drm/msm/a6xx: Track current ctx by seqno

commit 14eb0cb4e9a7323c8735cf6c681ed8423ce6ae06 upstream.

In theory a context can be destroyed and a new one allocated at the same
address, making the pointer comparision to detect when we don't need to
update the current pagetables invalid.  Instead assign a sequence number
to each context on creation, and use this for the check.

Fixes: 84c31ee16f90 ("drm/msm/a6xx: Add support for per-instance pagetables")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c |  6 +++---
 drivers/gpu/drm/msm/adreno/a6xx_gpu.h | 11 ++++++++++-
 drivers/gpu/drm/msm/msm_drv.c         |  3 +++
 drivers/gpu/drm/msm/msm_drv.h         |  1 +
 4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index 2dcbe02846cd..9e09805575db 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -99,7 +99,7 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,
 	u32 asid;
 	u64 memptr = rbmemptr(ring, ttbr0);
 
-	if (ctx == a6xx_gpu->cur_ctx)
+	if (ctx->seqno == a6xx_gpu->cur_ctx_seqno)
 		return;
 
 	if (msm_iommu_pagetable_params(ctx->aspace->mmu, &ttbr, &asid))
@@ -132,7 +132,7 @@ static void a6xx_set_pagetable(struct a6xx_gpu *a6xx_gpu,
 	OUT_PKT7(ring, CP_EVENT_WRITE, 1);
 	OUT_RING(ring, 0x31);
 
-	a6xx_gpu->cur_ctx = ctx;
+	a6xx_gpu->cur_ctx_seqno = ctx->seqno;
 }
 
 static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit)
@@ -887,7 +887,7 @@ static int a6xx_hw_init(struct msm_gpu *gpu)
 	/* Always come up on rb 0 */
 	a6xx_gpu->cur_ring = gpu->rb[0];
 
-	a6xx_gpu->cur_ctx = NULL;
+	a6xx_gpu->cur_ctx_seqno = 0;
 
 	/* Enable the SQE_to start the CP engine */
 	gpu_write(gpu, REG_A6XX_CP_SQE_CNTL, 1);
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
index 69765a722cae..f923edbd5daa 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.h
@@ -19,7 +19,16 @@ struct a6xx_gpu {
 	uint64_t sqe_iova;
 
 	struct msm_ringbuffer *cur_ring;
-	struct msm_file_private *cur_ctx;
+
+	/**
+	 * cur_ctx_seqno:
+	 *
+	 * The ctx->seqno value of the context with current pgtables
+	 * installed.  Tracked by seqno rather than pointer value to
+	 * avoid dangling pointers, and cases where a ctx can be freed
+	 * and a new one created with the same address.
+	 */
+	int cur_ctx_seqno;
 
 	struct a6xx_gmu gmu;
 
diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index edee4c2a76ce..33e42b2f9cfc 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -581,6 +581,7 @@ static void load_gpu(struct drm_device *dev)
 
 static int context_init(struct drm_device *dev, struct drm_file *file)
 {
+	static atomic_t ident = ATOMIC_INIT(0);
 	struct msm_drm_private *priv = dev->dev_private;
 	struct msm_file_private *ctx;
 
@@ -594,6 +595,8 @@ static int context_init(struct drm_device *dev, struct drm_file *file)
 	ctx->aspace = msm_gpu_create_private_address_space(priv->gpu, current);
 	file->driver_priv = ctx;
 
+	ctx->seqno = atomic_inc_return(&ident);
+
 	return 0;
 }
 
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index d96b254b8aa4..1fe809add8f6 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -58,6 +58,7 @@ struct msm_file_private {
 	int queueid;
 	struct msm_gem_address_space *aspace;
 	struct kref ref;
+	int seqno;
 };
 
 enum msm_mdp_plane_property {

From 2c5658717428ae4f7c0ef8706b45f0d00821d744 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 1 Oct 2021 15:33:08 +0300
Subject: [PATCH 0932/1750] drm/msm/dsi: Fix an error code in
 msm_dsi_modeset_init()

commit 739b4e7756d3301dd673ca517afca46a5f635562 upstream.

Return an error code if msm_dsi_manager_validate_current_config().
Don't return success.

Fixes: 8b03ad30e314 ("drm/msm/dsi: Use one connector for dual DSI mode")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20211001123308.GF2283@kili
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/dsi/dsi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
index 7e364b9c9f9e..1adead764fee 100644
--- a/drivers/gpu/drm/msm/dsi/dsi.c
+++ b/drivers/gpu/drm/msm/dsi/dsi.c
@@ -208,8 +208,10 @@ int msm_dsi_modeset_init(struct msm_dsi *msm_dsi, struct drm_device *dev,
 		goto fail;
 	}
 
-	if (!msm_dsi_manager_validate_current_config(msm_dsi->id))
+	if (!msm_dsi_manager_validate_current_config(msm_dsi->id)) {
+		ret = -EINVAL;
 		goto fail;
+	}
 
 	msm_dsi->encoder = encoder;
 

From c6b2400095ba232b1f2a0a499c2d7847940a9a2e Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 1 Oct 2021 15:34:09 +0300
Subject: [PATCH 0933/1750] drm/msm/dsi: fix off by one in dsi_bus_clk_enable
 error handling

commit c8f01ffc83923a91e8087aaa077de13354a7aa59 upstream.

This disables a lock which wasn't enabled and it does not disable
the first lock in the array.

Fixes: 6e0eb52eba9e ("drm/msm/dsi: Parse bus clocks from a list")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20211001123409.GG2283@kili
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index b17ac6c27554..96b5dcf8e454 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -464,7 +464,7 @@ static int dsi_bus_clk_enable(struct msm_dsi_host *msm_host)
 
 	return 0;
 err:
-	for (; i > 0; i--)
+	while (--i >= 0)
 		clk_disable_unprepare(msm_host->bus_clks[i]);
 
 	return ret;

From 057ee6843bbbe9e7114b6b35b6beab655288df24 Mon Sep 17 00:00:00 2001
From: Jackie Liu <liuyun01@kylinos.cn>
Date: Mon, 23 Aug 2021 17:25:26 +0800
Subject: [PATCH 0934/1750] acpi/arm64: fix next_platform_timer() section
 mismatch error

commit 596143e3aec35c93508d6b7a05ddc999ee209b61 upstream.

Fix modpost Section mismatch error in next_platform_timer().

  [...]
  WARNING: modpost: vmlinux.o(.text.unlikely+0x26e60): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc
  The function next_platform_timer() references
  the variable __initdata acpi_gtdt_desc.
  This is often because next_platform_timer lacks a __initdata
  annotation or the annotation of acpi_gtdt_desc is wrong.

  WARNING: modpost: vmlinux.o(.text.unlikely+0x26e64): Section mismatch in reference from the function next_platform_timer() to the variable .init.data:acpi_gtdt_desc
  The function next_platform_timer() references
  the variable __initdata acpi_gtdt_desc.
  This is often because next_platform_timer lacks a __initdata
  annotation or the annotation of acpi_gtdt_desc is wrong.

  ERROR: modpost: Section mismatches detected.
  Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.
  make[1]: *** [scripts/Makefile.modpost:59: vmlinux.symvers] Error 1
  make[1]: *** Deleting file 'vmlinux.symvers'
  make: *** [Makefile:1176: vmlinux] Error 2
  [...]

Fixes: a712c3ed9b8a ("acpi/arm64: Add memory-mapped timer support in GTDT driver")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Acked-by: Hanjun Guo <guohanjun@huawei.com>
Link: https://lore.kernel.org/r/20210823092526.2407526-1-liu.yun@linux.dev
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/arm64/gtdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/arm64/gtdt.c b/drivers/acpi/arm64/gtdt.c
index 0a0a982f9c28..c0e77c1c8e09 100644
--- a/drivers/acpi/arm64/gtdt.c
+++ b/drivers/acpi/arm64/gtdt.c
@@ -36,7 +36,7 @@ struct acpi_gtdt_descriptor {
 
 static struct acpi_gtdt_descriptor acpi_gtdt_desc __initdata;
 
-static inline void *next_platform_timer(void *platform_timer)
+static inline __init void *next_platform_timer(void *platform_timer)
 {
 	struct acpi_gtdt_header *gh = platform_timer;
 

From fdaff7f9e806fe241de0c4613ab6615000db23e9 Mon Sep 17 00:00:00 2001
From: Prashant Malani <pmalani@chromium.org>
Date: Tue, 28 Sep 2021 03:19:30 -0700
Subject: [PATCH 0935/1750] platform/x86: intel_scu_ipc: Fix busy loop expiry
 time
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 41512e4dc0b84525495e784295092592adb87f1b upstream.

The macro IPC_TIMEOUT is already in jiffies (it is also used like that
elsewhere in the file when calling wait_for_completion_timeout()). Don’t
convert it using helper functions for the purposes of calculating the
busy loop expiry time.

Fixes: e7b7ab3847c9 (“platform/x86: intel_scu_ipc: Sleeping is fine when polling”)
Signed-off-by: Prashant Malani <pmalani@chromium.org>
Cc: Benson Leung <bleung@chromium.org>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://lore.kernel.org/r/20210928101932.2543937-2-pmalani@chromium.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/platform/x86/intel_scu_ipc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index d9cf7f7602b0..425d2064148f 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -232,7 +232,7 @@ static inline u32 ipc_data_readl(struct intel_scu_ipc_dev *scu, u32 offset)
 /* Wait till scu status is busy */
 static inline int busy_loop(struct intel_scu_ipc_dev *scu)
 {
-	unsigned long end = jiffies + msecs_to_jiffies(IPC_TIMEOUT);
+	unsigned long end = jiffies + IPC_TIMEOUT;
 
 	do {
 		u32 status;

From 51f6e72ca656a80fbb76f640a51e1628ec15776f Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Thu, 7 Oct 2021 19:49:57 +0200
Subject: [PATCH 0936/1750] mqprio: Correct stats in mqprio_dump_class_stats().

commit 14132690860e4d06aa3e1c4d7d8e9866ba7756dd upstream.

Introduction of lockless subqueues broke the class statistics.
Before the change stats were accumulated in `bstats' and `qstats'
on the stack which was then copied to struct gnet_dump.

After the change the `bstats' and `qstats' are initialized to 0
and never updated, yet still fed to gnet_dump. The code updates
the global qdisc->cpu_bstats and qdisc->cpu_qstats instead,
clobbering them. Most likely a copy-paste error from the code in
mqprio_dump().

__gnet_stats_copy_basic() and __gnet_stats_copy_queue() accumulate
the values for per-CPU case but for global stats they overwrite
the value, so only stats from the last loop iteration / tc end up
in sch->[bq]stats.

Use the on-stack [bq]stats variables again and add the stats manually
in the global case.

Fixes: ce679e8df7ed2 ("net: sched: add support for TCQ_F_NOLOCK subqueues to sch_mqprio")
Cc: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
https://lore.kernel.org/all/20211007175000.2334713-2-bigeasy@linutronix.de/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sched/sch_mqprio.c | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 8766ab5b8788..5eb3b1b7ae5e 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -529,22 +529,28 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl,
 		for (i = tc.offset; i < tc.offset + tc.count; i++) {
 			struct netdev_queue *q = netdev_get_tx_queue(dev, i);
 			struct Qdisc *qdisc = rtnl_dereference(q->qdisc);
-			struct gnet_stats_basic_cpu __percpu *cpu_bstats = NULL;
-			struct gnet_stats_queue __percpu *cpu_qstats = NULL;
 
 			spin_lock_bh(qdisc_lock(qdisc));
-			if (qdisc_is_percpu_stats(qdisc)) {
-				cpu_bstats = qdisc->cpu_bstats;
-				cpu_qstats = qdisc->cpu_qstats;
-			}
 
-			qlen = qdisc_qlen_sum(qdisc);
-			__gnet_stats_copy_basic(NULL, &sch->bstats,
-						cpu_bstats, &qdisc->bstats);
-			__gnet_stats_copy_queue(&sch->qstats,
-						cpu_qstats,
-						&qdisc->qstats,
-						qlen);
+			if (qdisc_is_percpu_stats(qdisc)) {
+				qlen = qdisc_qlen_sum(qdisc);
+
+				__gnet_stats_copy_basic(NULL, &bstats,
+							qdisc->cpu_bstats,
+							&qdisc->bstats);
+				__gnet_stats_copy_queue(&qstats,
+							qdisc->cpu_qstats,
+							&qdisc->qstats,
+							qlen);
+			} else {
+				qlen		+= qdisc->q.qlen;
+				bstats.bytes	+= qdisc->bstats.bytes;
+				bstats.packets	+= qdisc->bstats.packets;
+				qstats.backlog	+= qdisc->qstats.backlog;
+				qstats.drops	+= qdisc->qstats.drops;
+				qstats.requeues	+= qdisc->qstats.requeues;
+				qstats.overlimits += qdisc->qstats.overlimits;
+			}
 			spin_unlock_bh(qdisc_lock(qdisc));
 		}
 

From ecfd4fa15b06564d5e4f5a03886d28daa4310060 Mon Sep 17 00:00:00 2001
From: chongjiapeng <jiapeng.chong@linux.alibaba.com>
Date: Sat, 9 Oct 2021 16:09:26 +0800
Subject: [PATCH 0937/1750] qed: Fix missing error code in qed_slowpath_start()

commit a5a14ea7b4e55604acb0dc9d88fdb4cb6945bc77 upstream.

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'rc'.

Eliminate the follow smatch warning:

drivers/net/ethernet/qlogic/qed/qed_main.c:1298 qed_slowpath_start()
warn: missing error code 'rc'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Fixes: d51e4af5c209 ("qed: aRFS infrastructure support")
Signed-off-by: chongjiapeng <jiapeng.chong@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qed/qed_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
index 6bb9ec98a12b..41bc31e3f935 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -1295,6 +1295,7 @@ static int qed_slowpath_start(struct qed_dev *cdev,
 			} else {
 				DP_NOTICE(cdev,
 					  "Failed to acquire PTT for aRFS\n");
+				rc = -EINVAL;
 				goto err;
 			}
 		}

From 6da9af2d25318fcb9e64b78de3c977bddc01f476 Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Mon, 11 Oct 2021 17:22:49 +0200
Subject: [PATCH 0938/1750] r8152: select CRC32 and
 CRYPTO/CRYPTO_HASH/CRYPTO_SHA256

commit 9973a43012b6ad1720dbc4d5faf5302c28635b8c upstream.

Fix the following build/link errors by adding a dependency on
CRYPTO, CRYPTO_HASH, CRYPTO_SHA256 and CRC32:

  ld: drivers/net/usb/r8152.o: in function `rtl8152_fw_verify_checksum':
  r8152.c:(.text+0x2b2a): undefined reference to `crypto_alloc_shash'
  ld: r8152.c:(.text+0x2bed): undefined reference to `crypto_shash_digest'
  ld: r8152.c:(.text+0x2c50): undefined reference to `crypto_destroy_tfm'
  ld: drivers/net/usb/r8152.o: in function `_rtl8152_set_rx_mode':
  r8152.c:(.text+0xdcb0): undefined reference to `crc32_le'

Fixes: 9370f2d05a2a1 ("r8152: support request_firmware for RTL8153")
Fixes: ac718b69301c7 ("net/usb: new driver for RTL8152")
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/Kconfig | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index b46993d5f997..4efad42b9aa9 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -99,6 +99,10 @@ config USB_RTL8150
 config USB_RTL8152
 	tristate "Realtek RTL8152/RTL8153 Based USB Ethernet Adapters"
 	select MII
+	select CRC32
+	select CRYPTO
+	select CRYPTO_HASH
+	select CRYPTO_SHA256
 	help
 	  This option adds support for Realtek RTL8152 based USB 2.0
 	  10/100 Ethernet adapters and RTL8153 based USB 3.0 10/100/1000

From 9c546af181bcda53a822522016aeff1f7aaa517b Mon Sep 17 00:00:00 2001
From: Baowen Zheng <baowen.zheng@corigine.com>
Date: Tue, 12 Oct 2021 14:48:50 +0200
Subject: [PATCH 0939/1750] nfp: flow_offload: move flow_indr_dev_register from
 app init to app start

commit 60d950f443a52d950126ad664fbd4a1eb8353dc9 upstream.

In commit 74fc4f828769 ("net: Fix offloading indirect devices dependency
on qdisc order creation"), it adds a process to trigger the callback to
setup the bo callback when the driver regists a callback.

In our current implement, we are not ready to run the callback when nfp
call the function flow_indr_dev_register, then there will be error
message as:

kernel: Oops: 0000 [#1] SMP PTI
kernel: CPU: 0 PID: 14119 Comm: kworker/0:0 Tainted: G
kernel: Workqueue: events work_for_cpu_fn
kernel: RIP: 0010:nfp_flower_indr_setup_tc_cb+0x258/0x410
kernel: RSP: 0018:ffffbc1e02c57bf8 EFLAGS: 00010286
kernel: RAX: 0000000000000000 RBX: ffff9c761fabc000 RCX: 0000000000000001
kernel: RDX: 0000000000000001 RSI: fffffffffffffff0 RDI: ffffffffc0be9ef1
kernel: RBP: ffffbc1e02c57c58 R08: ffffffffc08f33aa R09: ffff9c6db7478800
kernel: R10: 0000009c003f6e00 R11: ffffbc1e02800000 R12: ffffbc1e000d9000
kernel: R13: ffffbc1e000db428 R14: ffff9c6db7478800 R15: ffff9c761e884e80
kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: fffffffffffffff0 CR3: 00000009e260a004 CR4: 00000000007706f0
kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
kernel: PKRU: 55555554
kernel: Call Trace:
kernel: ? flow_indr_dev_register+0xab/0x210
kernel: ? __cond_resched+0x15/0x30
kernel: ? kmem_cache_alloc_trace+0x44/0x4b0
kernel: ? nfp_flower_setup_tc+0x1d0/0x1d0 [nfp]
kernel: flow_indr_dev_register+0x158/0x210
kernel: ? tcf_block_unbind+0xe0/0xe0
kernel: nfp_flower_init+0x40b/0x650 [nfp]
kernel: nfp_net_pci_probe+0x25f/0x960 [nfp]
kernel: ? nfp_rtsym_read_le+0x76/0x130 [nfp]
kernel: nfp_pci_probe+0x6a9/0x820 [nfp]
kernel: local_pci_probe+0x45/0x80

So we need to call flow_indr_dev_register in app start process instead of
init stage.

Fixes: 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation")
Signed-off-by: Baowen Zheng <baowen.zheng@corigine.com>
Signed-off-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Louis Peens <louis.peens@corigine.com>
Link: https://lore.kernel.org/r/20211012124850.13025-1-louis.peens@corigine.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/ethernet/netronome/nfp/flower/main.c  | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.c b/drivers/net/ethernet/netronome/nfp/flower/main.c
index c029950a81e2..ac1dcfa1d179 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/main.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/main.c
@@ -830,10 +830,6 @@ static int nfp_flower_init(struct nfp_app *app)
 	if (err)
 		goto err_cleanup;
 
-	err = flow_indr_dev_register(nfp_flower_indr_setup_tc_cb, app);
-	if (err)
-		goto err_cleanup;
-
 	if (app_priv->flower_ext_feats & NFP_FL_FEATS_VF_RLIM)
 		nfp_flower_qos_init(app);
 
@@ -942,7 +938,20 @@ static int nfp_flower_start(struct nfp_app *app)
 			return err;
 	}
 
-	return nfp_tunnel_config_start(app);
+	err = flow_indr_dev_register(nfp_flower_indr_setup_tc_cb, app);
+	if (err)
+		return err;
+
+	err = nfp_tunnel_config_start(app);
+	if (err)
+		goto err_tunnel_config;
+
+	return 0;
+
+err_tunnel_config:
+	flow_indr_dev_unregister(nfp_flower_indr_setup_tc_cb, app,
+				 nfp_flower_setup_indr_tc_release);
+	return err;
 }
 
 static void nfp_flower_stop(struct nfp_app *app)

From f33890d9bb59cf7100d28a483ef1d35d45299ef4 Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Tue, 12 Oct 2021 14:40:37 +0300
Subject: [PATCH 0940/1750] net: mscc: ocelot: warn when a PTP IRQ is raised
 for an unknown skb

commit 9fde506e0c53b8309f69b18b4b8144c544b4b3b1 upstream.

When skb_match is NULL, it means we received a PTP IRQ for a timestamp
ID that the kernel has no idea about, since there is no skb in the
timestamping queue with that timestamp ID.

This is a grave error and not something to just "continue" over.
So print a big warning in case this happens.

Also, move the check above ocelot_get_hwtimestamp(), there is no point
in reading the full 64-bit current PTP time if we're not going to do
anything with it anyway for this skb.

Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mscc/ocelot.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
index 5bfc7acfd13a..8c45b236649a 100644
--- a/drivers/net/ethernet/mscc/ocelot.c
+++ b/drivers/net/ethernet/mscc/ocelot.c
@@ -594,12 +594,12 @@ void ocelot_get_txtstamp(struct ocelot *ocelot)
 
 		spin_unlock_irqrestore(&port->tx_skbs.lock, flags);
 
+		if (WARN_ON(!skb_match))
+			continue;
+
 		/* Get the h/w timestamp */
 		ocelot_get_hwtimestamp(ocelot, &ts);
 
-		if (unlikely(!skb_match))
-			continue;
-
 		/* Set the timestamp into the skb */
 		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
 		shhwtstamps.hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec);

From 3593fa147c86f996916415359494f8e85075db8b Mon Sep 17 00:00:00 2001
From: Shannon Nelson <snelson@pensando.io>
Date: Fri, 8 Oct 2021 12:38:01 -0700
Subject: [PATCH 0941/1750] ionic: don't remove netdev->dev_addr when syncing
 uc list

commit 5c976a56570f29aaf4a2f9a1bf99789c252183c9 upstream.

Bridging, and possibly other upper stack gizmos, adds the
lower device's netdev->dev_addr to its own uc list, and
then requests it be deleted when the upper bridge device is
removed.  This delete request also happens with the bridging
vlan_filtering is enabled and then disabled.

Bonding has a similar behavior with the uc list, but since it
also uses set_mac to manage netdev->dev_addr, it doesn't have
the same the failure case.

Because we store our netdev->dev_addr in our uc list, we need
to ignore the delete request from dev_uc_sync so as to not
lose the address and all hope of communicating.  Note that
ndo_set_mac_address is expressly changing netdev->dev_addr,
so no limitation is set there.

Fixes: 2a654540be10 ("ionic: Add Rx filter and rx_mode ndo support")
Signed-off-by: Shannon Nelson <snelson@pensando.io>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/pensando/ionic/ionic_lif.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
index 6dc7ce649448..1b44155fa24b 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
@@ -1096,6 +1096,10 @@ static int ionic_ndo_addr_add(struct net_device *netdev, const u8 *addr)
 
 static int ionic_addr_del(struct net_device *netdev, const u8 *addr)
 {
+	/* Don't delete our own address from the uc list */
+	if (ether_addr_equal(addr, netdev->dev_addr))
+		return 0;
+
 	return ionic_lif_addr(netdev_priv(netdev), addr, false, true);
 }
 

From 3e287365216330ba5041f7fa1369460ad716f422 Mon Sep 17 00:00:00 2001
From: Maarten Zanders <maarten.zanders@mind.be>
Date: Mon, 11 Oct 2021 16:27:20 +0200
Subject: [PATCH 0942/1750] net: dsa: mv88e6xxx: don't use PHY_DETECT on
 internal PHY's

commit 4a3e0aeddf091f00974b02627c157843ce382a24 upstream.

mv88e6xxx_port_ppu_updates() interpretes data in the PORT_STS
register incorrectly for internal ports (ie no PPU). In these
cases, the PHY_DETECT bit indicates link status. This results
in forcing the MAC state whenever the PHY link goes down which
is not intended. As a side effect, LED's configured to show
link status stay lit even though the physical link is down.

Add a check in mac_link_down and mac_link_up to see if it
concerns an external port and only then, look at PPU status.

Fixes: 5d5b231da7ac (net: dsa: mv88e6xxx: use PHY_DETECT in mac_link_up/mac_link_down)
Reported-by: Maarten Zanders <m.zanders@televic.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Maarten Zanders <maarten.zanders@mind.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/mv88e6xxx/chip.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 18388ea5ebd9..afc5500ef8ed 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -726,7 +726,11 @@ static void mv88e6xxx_mac_link_down(struct dsa_switch *ds, int port,
 	ops = chip->info->ops;
 
 	mv88e6xxx_reg_lock(chip);
-	if ((!mv88e6xxx_port_ppu_updates(chip, port) ||
+	/* Internal PHYs propagate their configuration directly to the MAC.
+	 * External PHYs depend on whether the PPU is enabled for this port.
+	 */
+	if (((!mv88e6xxx_phy_is_internal(ds, port) &&
+	      !mv88e6xxx_port_ppu_updates(chip, port)) ||
 	     mode == MLO_AN_FIXED) && ops->port_set_link)
 		err = ops->port_set_link(chip, port, LINK_FORCED_DOWN);
 	mv88e6xxx_reg_unlock(chip);
@@ -749,7 +753,12 @@ static void mv88e6xxx_mac_link_up(struct dsa_switch *ds, int port,
 	ops = chip->info->ops;
 
 	mv88e6xxx_reg_lock(chip);
-	if (!mv88e6xxx_port_ppu_updates(chip, port) || mode == MLO_AN_FIXED) {
+	/* Internal PHYs propagate their configuration directly to the MAC.
+	 * External PHYs depend on whether the PPU is enabled for this port.
+	 */
+	if ((!mv88e6xxx_phy_is_internal(ds, port) &&
+	     !mv88e6xxx_port_ppu_updates(chip, port)) ||
+	    mode == MLO_AN_FIXED) {
 		/* FIXME: for an automedia port, should we force the link
 		 * down here - what if the link comes up due to "other" media
 		 * while we're bringing the port up, how is the exclusivity

From 3a9842b42e421f6496a78a42a123639cf6d7ed31 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 20 Oct 2021 11:45:06 +0200
Subject: [PATCH 0943/1750] Linux 5.10.75

Link: https://lore.kernel.org/r/20211018132334.702559133@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 84d540aed24c..74318cf964b8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 74
+SUBLEVEL = 75
 EXTRAVERSION =
 NAME = Dare mighty things
 

From b3b7f831a49b56c258ab8ef08d04045fcfb9b4a7 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Wed, 1 Sep 2021 22:18:18 +0200
Subject: [PATCH 0944/1750] parisc: math-emu: Fix fall-through warnings

commit 6f1fce595b78b775d7fb585c15c2dc3a6994f96e upstream.

Fix lots of fallthrough warnings, e.g.:
arch/parisc/math-emu/fpudispatch.c:323:33: warning: this statement may fall through [-Wimplicit-fallthrough=]

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/math-emu/fpudispatch.c | 56 ++++++++++++++++++++++++++++--
 1 file changed, 53 insertions(+), 3 deletions(-)

diff --git a/arch/parisc/math-emu/fpudispatch.c b/arch/parisc/math-emu/fpudispatch.c
index 7c46969ead9b..01ed133227c2 100644
--- a/arch/parisc/math-emu/fpudispatch.c
+++ b/arch/parisc/math-emu/fpudispatch.c
@@ -310,12 +310,15 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					r1 &= ~3;
 					fpregs[t+3] = fpregs[r1+3];
 					fpregs[t+2] = fpregs[r1+2];
+					fallthrough;
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					fpregs[t] = fpregs[r1];
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 3: /* FABS */
 				switch (fmt) {
 				    case 2: /* illegal */
@@ -325,13 +328,16 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					r1 &= ~3;
 					fpregs[t+3] = fpregs[r1+3];
 					fpregs[t+2] = fpregs[r1+2];
+					fallthrough;
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					/* copy and clear sign bit */
 					fpregs[t] = fpregs[r1] & 0x7fffffff;
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 6: /* FNEG */
 				switch (fmt) {
 				    case 2: /* illegal */
@@ -341,13 +347,16 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					r1 &= ~3;
 					fpregs[t+3] = fpregs[r1+3];
 					fpregs[t+2] = fpregs[r1+2];
+					fallthrough;
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					/* copy and invert sign bit */
 					fpregs[t] = fpregs[r1] ^ 0x80000000;
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 7: /* FNEGABS */
 				switch (fmt) {
 				    case 2: /* illegal */
@@ -357,13 +366,16 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					r1 &= ~3;
 					fpregs[t+3] = fpregs[r1+3];
 					fpregs[t+2] = fpregs[r1+2];
+					fallthrough;
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					/* copy and set sign bit */
 					fpregs[t] = fpregs[r1] | 0x80000000;
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 4: /* FSQRT */
 				switch (fmt) {
 				    case 0:
@@ -376,6 +388,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* quad not implemented */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 			case 5: /* FRND */
 				switch (fmt) {
 				    case 0:
@@ -389,7 +402,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					return(MAJOR_0C_EXCP);
 				}
 		} /* end of switch (subop) */
-
+		BUG();
 	case 1: /* class 1 */
 		df = extru(ir,fpdfpos,2); /* get dest format */
 		if ((df & 2) || (fmt & 2)) {
@@ -419,6 +432,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* dbl/dbl */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 			case 1: /* FCNVXF */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -434,6 +448,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					return(dbl_to_dbl_fcnvxf(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 2: /* FCNVFX */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -449,6 +464,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					return(dbl_to_dbl_fcnvfx(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 3: /* FCNVFXT */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -464,6 +480,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					return(dbl_to_dbl_fcnvfxt(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 5: /* FCNVUF (PA2.0 only) */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -479,6 +496,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					return(dbl_to_dbl_fcnvuf(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 6: /* FCNVFU (PA2.0 only) */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -494,6 +512,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					return(dbl_to_dbl_fcnvfu(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 7: /* FCNVFUT (PA2.0 only) */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -509,10 +528,11 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 					return(dbl_to_dbl_fcnvfut(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 4: /* undefined */
 				return(MAJOR_0C_EXCP);
 		} /* end of switch subop */
-
+		BUG();
 	case 2: /* class 2 */
 		fpu_type_flags=fpregs[FPU_TYPE_FLAG_POS];
 		r2 = extru(ir, fpr2pos, 5) * sizeof(double)/sizeof(u_int);
@@ -590,6 +610,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* quad not implemented */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 			case 1: /* FTEST */
 				switch (fmt) {
 				    case 0:
@@ -609,8 +630,10 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3:
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 		    } /* end of switch subop */
 		} /* end of else for PA1.0 & PA1.1 */
+		BUG();
 	case 3: /* class 3 */
 		r2 = extru(ir,fpr2pos,5) * sizeof(double)/sizeof(u_int);
 		if (r2 == 0)
@@ -633,6 +656,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* quad not implemented */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 			case 1: /* FSUB */
 				switch (fmt) {
 				    case 0:
@@ -645,6 +669,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* quad not implemented */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 			case 2: /* FMPY */
 				switch (fmt) {
 				    case 0:
@@ -657,6 +682,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* quad not implemented */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 			case 3: /* FDIV */
 				switch (fmt) {
 				    case 0:
@@ -669,6 +695,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* quad not implemented */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 			case 4: /* FREM */
 				switch (fmt) {
 				    case 0:
@@ -681,6 +708,7 @@ decode_0c(u_int ir, u_int class, u_int subop, u_int fpregs[])
 				    case 3: /* quad not implemented */
 					return(MAJOR_0C_EXCP);
 				}
+				BUG();
 		} /* end of class 3 switch */
 	} /* end of switch(class) */
 
@@ -736,10 +764,12 @@ u_int fpregs[];
 					return(MAJOR_0E_EXCP);
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					fpregs[t] = fpregs[r1];
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 3: /* FABS */
 				switch (fmt) {
 				    case 2:
@@ -747,10 +777,12 @@ u_int fpregs[];
 					return(MAJOR_0E_EXCP);
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					fpregs[t] = fpregs[r1] & 0x7fffffff;
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 6: /* FNEG */
 				switch (fmt) {
 				    case 2:
@@ -758,10 +790,12 @@ u_int fpregs[];
 					return(MAJOR_0E_EXCP);
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					fpregs[t] = fpregs[r1] ^ 0x80000000;
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 7: /* FNEGABS */
 				switch (fmt) {
 				    case 2:
@@ -769,10 +803,12 @@ u_int fpregs[];
 					return(MAJOR_0E_EXCP);
 				    case 1: /* double */
 					fpregs[t+1] = fpregs[r1+1];
+					fallthrough;
 				    case 0: /* single */
 					fpregs[t] = fpregs[r1] | 0x80000000;
 					return(NOEXCEPTION);
 				}
+				BUG();
 			case 4: /* FSQRT */
 				switch (fmt) {
 				    case 0:
@@ -785,6 +821,7 @@ u_int fpregs[];
 				    case 3:
 					return(MAJOR_0E_EXCP);
 				}
+				BUG();
 			case 5: /* FRMD */
 				switch (fmt) {
 				    case 0:
@@ -798,7 +835,7 @@ u_int fpregs[];
 					return(MAJOR_0E_EXCP);
 				}
 		} /* end of switch (subop */
-	
+		BUG();
 	case 1: /* class 1 */
 		df = extru(ir,fpdfpos,2); /* get dest format */
 		/*
@@ -826,6 +863,7 @@ u_int fpregs[];
 				    case 3: /* dbl/dbl */
 					return(MAJOR_0E_EXCP);
 				}
+				BUG();
 			case 1: /* FCNVXF */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -841,6 +879,7 @@ u_int fpregs[];
 					return(dbl_to_dbl_fcnvxf(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 2: /* FCNVFX */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -856,6 +895,7 @@ u_int fpregs[];
 					return(dbl_to_dbl_fcnvfx(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 3: /* FCNVFXT */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -871,6 +911,7 @@ u_int fpregs[];
 					return(dbl_to_dbl_fcnvfxt(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 5: /* FCNVUF (PA2.0 only) */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -886,6 +927,7 @@ u_int fpregs[];
 					return(dbl_to_dbl_fcnvuf(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 6: /* FCNVFU (PA2.0 only) */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -901,6 +943,7 @@ u_int fpregs[];
 					return(dbl_to_dbl_fcnvfu(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 7: /* FCNVFUT (PA2.0 only) */
 				switch(fmt) {
 				    case 0: /* sgl/sgl */
@@ -916,9 +959,11 @@ u_int fpregs[];
 					return(dbl_to_dbl_fcnvfut(&fpregs[r1],0,
 						&fpregs[t],status));
 				}
+				BUG();
 			case 4: /* undefined */
 				return(MAJOR_0C_EXCP);
 		} /* end of switch subop */
+		BUG();
 	case 2: /* class 2 */
 		/*
 		 * Be careful out there.
@@ -994,6 +1039,7 @@ u_int fpregs[];
 				}
 		    } /* end of switch subop */
 		} /* end of else for PA1.0 & PA1.1 */
+		BUG();
 	case 3: /* class 3 */
 		/*
 		 * Be careful out there.
@@ -1026,6 +1072,7 @@ u_int fpregs[];
 					return(dbl_fadd(&fpregs[r1],&fpregs[r2],
 						&fpregs[t],status));
 				}
+				BUG();
 			case 1: /* FSUB */
 				switch (fmt) {
 				    case 0:
@@ -1035,6 +1082,7 @@ u_int fpregs[];
 					return(dbl_fsub(&fpregs[r1],&fpregs[r2],
 						&fpregs[t],status));
 				}
+				BUG();
 			case 2: /* FMPY or XMPYU */
 				/*
 				 * check for integer multiply (x bit set)
@@ -1071,6 +1119,7 @@ u_int fpregs[];
 					       &fpregs[r2],&fpregs[t],status));
 				    }
 				}
+				BUG();
 			case 3: /* FDIV */
 				switch (fmt) {
 				    case 0:
@@ -1080,6 +1129,7 @@ u_int fpregs[];
 					return(dbl_fdiv(&fpregs[r1],&fpregs[r2],
 						&fpregs[t],status));
 				}
+				BUG();
 			case 4: /* FREM */
 				switch (fmt) {
 				    case 0:

From b6f32897af190d4716412e156ee0abcc16e4f1e5 Mon Sep 17 00:00:00 2001
From: Jonathan Bell <jonathan@raspberrypi.org>
Date: Fri, 8 Oct 2021 12:25:44 +0300
Subject: [PATCH 0945/1750] xhci: add quirk for host controllers that don't
 update endpoint DCS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5255660b208aebfdb71d574f3952cf48392f4306 upstream.

Seen on a VLI VL805 PCIe to USB controller. For non-stream endpoints
at least, if the xHC halts on a particular TRB due to an error then
the DCS field in the Out Endpoint Context maintained by the hardware
is not updated with the current cycle state.

Using the quirk XHCI_EP_CTX_BROKEN_DCS and instead fetch the DCS bit
from the TRB that the xHC stopped on.

[ bjorn: rebased to v5.14-rc2 ]

Link: https://github.com/raspberrypi/linux/issues/3060
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211008092547.3996295-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-pci.c  |  4 +++-
 drivers/usb/host/xhci-ring.c | 26 +++++++++++++++++++++++++-
 drivers/usb/host/xhci.h      |  1 +
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 2299866dc82f..8c65e9476b41 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -276,8 +276,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 			pdev->device == 0x3432)
 		xhci->quirks |= XHCI_BROKEN_STREAMS;
 
-	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483)
+	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
 		xhci->quirks |= XHCI_LPM_SUPPORT;
+		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
+	}
 
 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index ec8f2910faf9..4512c4223392 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -562,7 +562,10 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
 	struct xhci_virt_ep *ep = &dev->eps[ep_index];
 	struct xhci_ring *ep_ring;
 	struct xhci_segment *new_seg;
+	struct xhci_segment *halted_seg = NULL;
 	union xhci_trb *new_deq;
+	union xhci_trb *halted_trb;
+	int index = 0;
 	dma_addr_t addr;
 	u64 hw_dequeue;
 	bool cycle_found = false;
@@ -600,7 +603,28 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
 	hw_dequeue = xhci_get_hw_deq(xhci, dev, ep_index, stream_id);
 	new_seg = ep_ring->deq_seg;
 	new_deq = ep_ring->dequeue;
-	state->new_cycle_state = hw_dequeue & 0x1;
+
+	/*
+	 * Quirk: xHC write-back of the DCS field in the hardware dequeue
+	 * pointer is wrong - use the cycle state of the TRB pointed to by
+	 * the dequeue pointer.
+	 */
+	if (xhci->quirks & XHCI_EP_CTX_BROKEN_DCS &&
+	    !(ep->ep_state & EP_HAS_STREAMS))
+		halted_seg = trb_in_td(xhci, cur_td->start_seg,
+				       cur_td->first_trb, cur_td->last_trb,
+				       hw_dequeue & ~0xf, false);
+	if (halted_seg) {
+		index = ((dma_addr_t)(hw_dequeue & ~0xf) - halted_seg->dma) /
+			 sizeof(*halted_trb);
+		halted_trb = &halted_seg->trbs[index];
+		state->new_cycle_state = halted_trb->generic.field[3] & 0x1;
+		xhci_dbg(xhci, "Endpoint DCS = %d TRB index = %d cycle = %d\n",
+			 (u8)(hw_dequeue & 0x1), index,
+			 state->new_cycle_state);
+	} else {
+		state->new_cycle_state = hw_dequeue & 0x1;
+	}
 	state->stream_id = stream_id;
 
 	/*
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 1c97c8d81154..45584a278336 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1884,6 +1884,7 @@ struct xhci_hcd {
 #define XHCI_DISABLE_SPARSE	BIT_ULL(38)
 #define XHCI_SG_TRB_CACHE_SIZE_QUIRK	BIT_ULL(39)
 #define XHCI_NO_SOFT_RETRY	BIT_ULL(40)
+#define XHCI_EP_CTX_BROKEN_DCS	BIT_ULL(42)
 
 	unsigned int		num_active_eps;
 	unsigned int		limit_active_eps;

From f59da9f7efa73a31b6287bd9b8f03a8d536e524f Mon Sep 17 00:00:00 2001
From: Kamal Mostafa <kamal@canonical.com>
Date: Mon, 18 Oct 2021 10:18:08 -0700
Subject: [PATCH 0946/1750] io_uring: fix splice_fd_in checks backport typo

The linux-5.10.y backport of commit "io_uring: add ->splice_fd_in checks"
includes a typo: "|" where "||" should be. (The original upstream commit
is fine.)

Fixes: 54eb6211b979 ("io_uring: add ->splice_fd_in checks")
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org # v5.10
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 26753d0cb431..0736487165da 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5559,7 +5559,7 @@ static int io_timeout_remove_prep(struct io_kiocb *req,
 		return -EINVAL;
 	if (unlikely(req->flags & (REQ_F_FIXED_FILE | REQ_F_BUFFER_SELECT)))
 		return -EINVAL;
-	if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags |
+	if (sqe->ioprio || sqe->buf_index || sqe->len || sqe->timeout_flags ||
 	    sqe->splice_fd_in)
 		return -EINVAL;
 

From 5489c1bed5b86c07a8fafc2d6dad89e902b70c69 Mon Sep 17 00:00:00 2001
From: Rob Herring <robh@kernel.org>
Date: Thu, 19 Aug 2021 13:42:38 -0500
Subject: [PATCH 0947/1750] arm: dts: vexpress-v2p-ca9: Fix the SMB
 unit-address

[ Upstream commit 2e9edc07df2ec6f835222151fa4e536e9e54856a ]

Based on 'ranges', the 'bus@4000000' node unit-address is off by 1 '0'.

Link: https://lore.kernel.org/r/20210819184239.1192395-5-robh@kernel.org
Cc: Andre Przywara <andre.przywara@arm.com>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Cc: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/vexpress-v2m.dtsi    | 2 +-
 arch/arm/boot/dts/vexpress-v2p-ca9.dts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/vexpress-v2m.dtsi b/arch/arm/boot/dts/vexpress-v2m.dtsi
index 2ac41ed3a57c..659dcf4004b4 100644
--- a/arch/arm/boot/dts/vexpress-v2m.dtsi
+++ b/arch/arm/boot/dts/vexpress-v2m.dtsi
@@ -19,7 +19,7 @@
  */
 
 / {
-	bus@4000000 {
+	bus@40000000 {
 		motherboard {
 			model = "V2M-P1";
 			arm,hbi = <0x190>;
diff --git a/arch/arm/boot/dts/vexpress-v2p-ca9.dts b/arch/arm/boot/dts/vexpress-v2p-ca9.dts
index 4c5847955856..1317f0f58d53 100644
--- a/arch/arm/boot/dts/vexpress-v2p-ca9.dts
+++ b/arch/arm/boot/dts/vexpress-v2p-ca9.dts
@@ -295,7 +295,7 @@ power-vd10-s3 {
 		};
 	};
 
-	smb: bus@4000000 {
+	smb: bus@40000000 {
 		compatible = "simple-bus";
 
 		#address-cells = <2>;

From 85c1827eeee7fa8998fd57ec48b74fcc9ae9cf40 Mon Sep 17 00:00:00 2001
From: Eugen Hristev <eugen.hristev@microchip.com>
Date: Thu, 2 Sep 2021 15:13:58 +0300
Subject: [PATCH 0948/1750] ARM: dts: at91: sama5d2_som1_ek: disable ISC node
 by default

[ Upstream commit 4348cc10da6377a86940beb20ad357933b8f91bb ]

Without a sensor node, the ISC will simply fail to probe, as the
corresponding port node is missing.
It is then logical to disable the node in the devicetree.
If we add a port with a connection to a sensor endpoint, ISC can be enabled.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20210902121358.503589-1-eugen.hristev@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
index 9a18453d7842..0a53f21a8903 100644
--- a/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
+++ b/arch/arm/boot/dts/at91-sama5d27_som1_ek.dts
@@ -71,7 +71,6 @@ apb {
 			isc: isc@f0008000 {
 				pinctrl-names = "default";
 				pinctrl-0 = <&pinctrl_isc_base &pinctrl_isc_data_8bit &pinctrl_isc_data_9_10 &pinctrl_isc_data_11_12>;
-				status = "okay";
 			};
 
 			qspi1: spi@f0024000 {

From a6285b1b2212ac6f9af30980ed3def7a5b37680e Mon Sep 17 00:00:00 2001
From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Date: Mon, 4 Oct 2021 16:22:07 +0900
Subject: [PATCH 0949/1750] block: decode QUEUE_FLAG_HCTX_ACTIVE in debugfs
 output

[ Upstream commit 1dbdd99b511c966be9147ad72991a2856ac76f22 ]

While debugging an issue we've found that $DEBUGFS/block/$disk/state
doesn't decode QUEUE_FLAG_HCTX_ACTIVE but only displays its numerical
value.

Add QUEUE_FLAG(HCTX_ACTIVE) to the blk_queue_flag_name array so it'll get
decoded properly.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Link: https://lore.kernel.org/r/4351076388918075bd80ef07756f9d2ce63be12c.1633332053.git.johannes.thumshirn@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq-debugfs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c
index 4de03da9a624..b5f26082b959 100644
--- a/block/blk-mq-debugfs.c
+++ b/block/blk-mq-debugfs.c
@@ -129,6 +129,7 @@ static const char *const blk_queue_flag_name[] = {
 	QUEUE_FLAG_NAME(PCI_P2PDMA),
 	QUEUE_FLAG_NAME(ZONE_RESETALL),
 	QUEUE_FLAG_NAME(RQ_ALLOC_TIME),
+	QUEUE_FLAG_NAME(HCTX_ACTIVE),
 	QUEUE_FLAG_NAME(NOWAIT),
 };
 #undef QUEUE_FLAG_NAME

From 101e1bcb114743033f0df86adcaa9b8571f93a06 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Thu, 30 Sep 2021 14:16:15 +0200
Subject: [PATCH 0950/1750] xen/x86: prevent PVH type from getting clobbered

[ Upstream commit 9172b5c4a778da1f855b2e3780b1afabb3cfd523 ]

Like xen_start_flags, xen_domain_type gets set before .bss gets cleared.
Hence this variable also needs to be prevented from getting put in .bss,
which is possible because XEN_NATIVE is an enumerator evaluating to
zero. Any use prior to init_hvm_pv_info() setting the variable again
would lead to wrong decisions; one such case is xenboot_console_setup()
when called as a result of "earlyprintk=xen".

Use __ro_after_init as more applicable than either __section(".data") or
__read_mostly.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>

Link: https://lore.kernel.org/r/d301677b-6f22-5ae6-bd36-458e1f323d0b@suse.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/xen/enlighten.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index aa9f50fccc5d..0f68c6da7382 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -51,9 +51,6 @@ DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 DEFINE_PER_CPU(uint32_t, xen_vcpu_id);
 EXPORT_PER_CPU_SYMBOL(xen_vcpu_id);
 
-enum xen_domain_type xen_domain_type = XEN_NATIVE;
-EXPORT_SYMBOL_GPL(xen_domain_type);
-
 unsigned long *machine_to_phys_mapping = (void *)MACH2PHYS_VIRT_START;
 EXPORT_SYMBOL(machine_to_phys_mapping);
 unsigned long  machine_to_phys_nr;
@@ -68,9 +65,11 @@ __read_mostly int xen_have_vector_callback;
 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
 
 /*
- * NB: needs to live in .data because it's used by xen_prepare_pvh which runs
- * before clearing the bss.
+ * NB: These need to live in .data or alike because they're used by
+ * xen_prepare_pvh() which runs before clearing the bss.
  */
+enum xen_domain_type __ro_after_init xen_domain_type = XEN_NATIVE;
+EXPORT_SYMBOL_GPL(xen_domain_type);
 uint32_t xen_start_flags __section(".data") = 0;
 EXPORT_SYMBOL(xen_start_flags);
 

From d8284c981c1cbde04544a5bf378e25c0962d99db Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Fri, 1 Oct 2021 15:40:00 -0400
Subject: [PATCH 0951/1750] drm/amdgpu/display: fix dependencies for
 DRM_AMD_DC_SI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4702b34d1de9582df9dfa0e583ea28fff7de29df ]

Depends on DRM_AMDGPU_SI and DRM_AMD_DC

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/display/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/Kconfig b/drivers/gpu/drm/amd/display/Kconfig
index 3c410d236c49..f3274eb6b341 100644
--- a/drivers/gpu/drm/amd/display/Kconfig
+++ b/drivers/gpu/drm/amd/display/Kconfig
@@ -33,6 +33,8 @@ config DRM_AMD_DC_HDCP
 
 config DRM_AMD_DC_SI
 	bool "AMD DC support for Southern Islands ASICs"
+	depends on DRM_AMDGPU_SI
+	depends on DRM_AMD_DC
 	default n
 	help
 	  Choose this option to enable new AMD DC support for SI asics

From bfef5d826276c59898d7f13303e39f840dd4a49d Mon Sep 17 00:00:00 2001
From: Max Filippov <jcmvbkbc@gmail.com>
Date: Tue, 5 Oct 2021 11:36:01 -0700
Subject: [PATCH 0952/1750] xtensa: xtfpga: use CONFIG_USE_OF instead of
 CONFIG_OF

[ Upstream commit f3d7c2cdf6dc0d5402ec29c3673893b3542c5ad1 ]

Use platform data to initialize xtfpga device drivers when CONFIG_USE_OF
is not selected. This fixes xtfpga networking when CONFIG_USE_OF is not
selected but CONFIG_OF is.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/platforms/xtfpga/setup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index 4f7d6142d41f..59b7f11f2a3e 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -66,7 +66,7 @@ void __init platform_calibrate_ccount(void)
 
 #endif
 
-#ifdef CONFIG_OF
+#ifdef CONFIG_USE_OF
 
 static void __init xtfpga_clk_setup(struct device_node *np)
 {
@@ -284,4 +284,4 @@ static int __init xtavnet_init(void)
  */
 arch_initcall(xtavnet_init);
 
-#endif /* CONFIG_OF */
+#endif /* CONFIG_USE_OF */

From 546c04c857912a60b0724a29315845b1e2379c90 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Sun, 1 Aug 2021 10:36:59 -0700
Subject: [PATCH 0953/1750] xtensa: xtfpga: Try software restart before
 simulating CPU reset

[ Upstream commit 012e974501a270d8dfd4ee2039e1fdf7579c907e ]

Rebooting xtensa images loaded with the '-kernel' option in qemu does
not work. When executing a reboot command, the qemu session either hangs
or experiences an endless sequence of error messages.

  Kernel panic - not syncing: Unrecoverable error in exception handler

Reset code jumps to the CPU restart address, but Linux can not recover
from there because code and data in the kernel init sections have been
discarded and overwritten at this point.

XTFPGA platforms have a means to reset the CPU by writing 0xdead into a
specific FPGA IO address. When used in QEMU the kernel image loaded with
the '-kernel' option gets restored to its original state allowing the
machine to boot successfully.

Use that mechanism to attempt a platform reset. If it does not work,
fall back to the existing mechanism.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/xtensa/platforms/xtfpga/setup.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c
index 59b7f11f2a3e..538e6748e85a 100644
--- a/arch/xtensa/platforms/xtfpga/setup.c
+++ b/arch/xtensa/platforms/xtfpga/setup.c
@@ -51,8 +51,12 @@ void platform_power_off(void)
 
 void platform_restart(void)
 {
-	/* Flush and reset the mmu, simulate a processor reset, and
-	 * jump to the reset vector. */
+	/* Try software reset first. */
+	WRITE_ONCE(*(u32 *)XTFPGA_SWRST_VADDR, 0xdead);
+
+	/* If software reset did not work, flush and reset the mmu,
+	 * simulate a processor reset, and jump to the reset vector.
+	 */
 	cpu_reset();
 	/* control never gets here */
 }

From 0f4308a164a9de4ffaf86b22082dbdfa16bdc601 Mon Sep 17 00:00:00 2001
From: Benjamin Coddington <bcodding@redhat.com>
Date: Wed, 6 Oct 2021 13:20:44 -0400
Subject: [PATCH 0954/1750] NFSD: Keep existing listeners on portlist error

[ Upstream commit c20106944eb679fa3ab7e686fe5f6ba30fbc51e5 ]

If nfsd has existing listening sockets without any processes, then an error
returned from svc_create_xprt() for an additional transport will remove
those existing listeners.  We're seeing this in practice when userspace
attempts to create rpcrdma transports without having the rpcrdma modules
present before creating nfsd kernel processes.  Fix this by checking for
existing sockets before calling nfsd_destroy().

Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfsctl.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index ddf2b375632b..21c4ffda5f94 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -792,7 +792,10 @@ static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cr
 		svc_xprt_put(xprt);
 	}
 out_err:
-	nfsd_destroy(net);
+	if (!list_empty(&nn->nfsd_serv->sv_permsocks))
+		nn->nfsd_serv->sv_nrthreads--;
+	 else
+		nfsd_destroy(net);
 	return err;
 }
 

From 2a670c323055282c9b72794a491d53cef86bbeaf Mon Sep 17 00:00:00 2001
From: Juhee Kang <claudiajkang@gmail.com>
Date: Mon, 4 Oct 2021 21:14:38 +0900
Subject: [PATCH 0955/1750] netfilter: xt_IDLETIMER: fix panic that occurs when
 timer_type has garbage value

[ Upstream commit 902c0b1887522a099aa4e1e6b4b476c2fe5dd13e ]

Currently, when the rule related to IDLETIMER is added, idletimer_tg timer
structure is initialized by kmalloc on executing idletimer_tg_create
function. However, in this process timer->timer_type is not defined to
a specific value. Thus, timer->timer_type has garbage value and it occurs
kernel panic. So, this commit fixes the panic by initializing
timer->timer_type using kzalloc instead of kmalloc.

Test commands:
    # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test
    $ cat /sys/class/xt_idletimer/timers/test
      Killed

Splat looks like:
    BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70
    Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917
    CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014
    Call Trace:
     dump_stack_lvl+0x6e/0x9c
     kasan_report.cold+0x112/0x117
     ? alarm_expires_remaining+0x49/0x70
     __asan_load8+0x86/0xb0
     alarm_expires_remaining+0x49/0x70
     idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d]
     dev_attr_show+0x3c/0x60
     sysfs_kf_seq_show+0x11d/0x1f0
     ? device_remove_bin_file+0x20/0x20
     kernfs_seq_show+0xa4/0xb0
     seq_read_iter+0x29c/0x750
     kernfs_fop_read_iter+0x25a/0x2c0
     ? __fsnotify_parent+0x3d1/0x570
     ? iov_iter_init+0x70/0x90
     new_sync_read+0x2a7/0x3d0
     ? __x64_sys_llseek+0x230/0x230
     ? rw_verify_area+0x81/0x150
     vfs_read+0x17b/0x240
     ksys_read+0xd9/0x180
     ? vfs_write+0x460/0x460
     ? do_syscall_64+0x16/0xc0
     ? lockdep_hardirqs_on+0x79/0x120
     __x64_sys_read+0x43/0x50
     do_syscall_64+0x3b/0xc0
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    RIP: 0033:0x7f0cdc819142
    Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24
    RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
    RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142
    RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003
    RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000
    R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0
    R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000

Fixes: 68983a354a65 ("netfilter: xtables: Add snapshot of hardidletimer target")
Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/xt_IDLETIMER.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 7b2f359bfce4..2f7cf5ecebf4 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -137,7 +137,7 @@ static int idletimer_tg_create(struct idletimer_tg_info *info)
 {
 	int ret;
 
-	info->timer = kmalloc(sizeof(*info->timer), GFP_KERNEL);
+	info->timer = kzalloc(sizeof(*info->timer), GFP_KERNEL);
 	if (!info->timer) {
 		ret = -ENOMEM;
 		goto out;

From 39afed394cc62365d54b02e091668bd68c3a5299 Mon Sep 17 00:00:00 2001
From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Date: Wed, 6 Oct 2021 22:19:43 +0200
Subject: [PATCH 0956/1750] dma-debug: fix sg checks in debug_dma_map_sg()

[ Upstream commit 293d92cbbd2418ca2ba43fed07f1b92e884d1c77 ]

The following warning occurred sporadically on s390:
DMA-API: nvme 0006:00:00.0: device driver maps memory from kernel text or rodata [addr=0000000048cc5e2f] [len=131072]
WARNING: CPU: 4 PID: 825 at kernel/dma/debug.c:1083 check_for_illegal_area+0xa8/0x138

It is a false-positive warning, due to broken logic in debug_dma_map_sg().
check_for_illegal_area() checks for overlay of sg elements with kernel text
or rodata. It is called with sg_dma_len(s) instead of s->length as
parameter. After the call to ->map_sg(), sg_dma_len() will contain the
length of possibly combined sg elements in the DMA address space, and not
the individual sg element length, which would be s->length.

The check will then use the physical start address of an sg element, and
add the DMA length for the overlap check, which could result in the false
warning, because the DMA length can be larger than the actual single sg
element length.

In addition, the call to check_for_illegal_area() happens in the iteration
over mapped_ents, which will not include all individual sg elements if
any of them were combined in ->map_sg().

Fix this by using s->length instead of sg_dma_len(s). Also put the call to
check_for_illegal_area() in a separate loop, iterating over all the
individual sg elements ("nents" instead of "mapped_ents").

While at it, as suggested by Robin Murphy, also move check_for_stack()
inside the new loop, as it is similarly concerned with validating the
individual sg elements.

Link: https://lore.kernel.org/lkml/20210705185252.4074653-1-gerald.schaefer@linux.ibm.com
Fixes: 884d05970bfb ("dma-debug: use sg_dma_len accessor")
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/dma/debug.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c
index 445754529917..10d07ace46c1 100644
--- a/kernel/dma/debug.c
+++ b/kernel/dma/debug.c
@@ -1300,6 +1300,12 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
 	if (unlikely(dma_debug_disabled()))
 		return;
 
+	for_each_sg(sg, s, nents, i) {
+		check_for_stack(dev, sg_page(s), s->offset);
+		if (!PageHighMem(sg_page(s)))
+			check_for_illegal_area(dev, sg_virt(s), s->length);
+	}
+
 	for_each_sg(sg, s, mapped_ents, i) {
 		entry = dma_entry_alloc();
 		if (!entry)
@@ -1315,12 +1321,6 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
 		entry->sg_call_ents   = nents;
 		entry->sg_mapped_ents = mapped_ents;
 
-		check_for_stack(dev, sg_page(s), s->offset);
-
-		if (!PageHighMem(sg_page(s))) {
-			check_for_illegal_area(dev, sg_virt(s), sg_dma_len(s));
-		}
-
 		check_sg_segment(dev, s);
 
 		add_dma_entry(entry);

From 842fce43190cc3611584c178caec8300c7eaf236 Mon Sep 17 00:00:00 2001
From: Shengjiu Wang <shengjiu.wang@nxp.com>
Date: Wed, 13 Oct 2021 13:17:04 +0800
Subject: [PATCH 0957/1750] ASoC: wm8960: Fix clock configuration on slave mode

[ Upstream commit 6b9b546dc00797c74bef491668ce5431ff54e1e2 ]

There is a noise issue for 8kHz sample rate on slave mode.
Compared with master mode, the difference is the DACDIV
setting, after correcting the DACDIV, the noise is gone.

There is no noise issue for 48kHz sample rate, because
the default value of DACDIV is correct for 48kHz.

So wm8960_configure_clocking() should be functional for
ADC and DAC function even if it is slave mode.

In order to be compatible for old use case, just add
condition for checking that sysclk is zero with
slave mode.

Fixes: 0e50b51aa22f ("ASoC: wm8960: Let wm8960 driver configure its bit clock and frame clock")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/1634102224-3922-1-git-send-email-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm8960.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index 9d325555e219..618692e2e0e4 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -742,9 +742,16 @@ static int wm8960_configure_clocking(struct snd_soc_component *component)
 	int i, j, k;
 	int ret;
 
-	if (!(iface1 & (1<<6))) {
-		dev_dbg(component->dev,
-			"Codec is slave mode, no need to configure clock\n");
+	/*
+	 * For Slave mode clocking should still be configured,
+	 * so this if statement should be removed, but some platform
+	 * may not work if the sysclk is not configured, to avoid such
+	 * compatible issue, just add '!wm8960->sysclk' condition in
+	 * this if statement.
+	 */
+	if (!(iface1 & (1 << 6)) && !wm8960->sysclk) {
+		dev_warn(component->dev,
+			 "slave mode, but proceeding with no clock configuration\n");
 		return 0;
 	}
 

From 69ea08c1b539657c0bea27d972f03b393caccc30 Mon Sep 17 00:00:00 2001
From: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Date: Tue, 14 Sep 2021 19:25:05 -0400
Subject: [PATCH 0958/1750] ice: fix getting UDP tunnel entry

[ Upstream commit e4c2efa1393c6f1fbfabf91d1d83fcb4ae691ccb ]

Correct parameters order in call to ice_tunnel_idx_to_entry function.

Entry in sparse port table is correct when the idx is 0. For idx 1 one
correct entry should be skipped, for idx 2 two of them should be skipped
etc. Change if condition to be true when idx is 0, which means that
previous valid entry of this tunnel type were skipped.

Fixes: b20e6c17c468 ("ice: convert to new udp_tunnel infrastructure")
Signed-off-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Tested-by: Gurucharan G <gurucharanx.g@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
index 9095b4d274ad..a81be917f653 100644
--- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
+++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c
@@ -1669,7 +1669,7 @@ static u16 ice_tunnel_idx_to_entry(struct ice_hw *hw, enum ice_tunnel_type type,
 	for (i = 0; i < hw->tnl.count && i < ICE_TUNNEL_MAX_ENTRIES; i++)
 		if (hw->tnl.tbl[i].valid &&
 		    hw->tnl.tbl[i].type == type &&
-		    idx--)
+		    idx-- == 0)
 			return i;
 
 	WARN_ON_ONCE(1);
@@ -1829,7 +1829,7 @@ int ice_udp_tunnel_set_port(struct net_device *netdev, unsigned int table,
 	u16 index;
 
 	tnl_type = ti->type == UDP_TUNNEL_TYPE_VXLAN ? TNL_VXLAN : TNL_GENEVE;
-	index = ice_tunnel_idx_to_entry(&pf->hw, idx, tnl_type);
+	index = ice_tunnel_idx_to_entry(&pf->hw, tnl_type, idx);
 
 	status = ice_create_tunnel(&pf->hw, index, tnl_type, ntohs(ti->port));
 	if (status) {

From 911e01990c70521d3601a03ca15716925afa9ca4 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Tue, 12 Oct 2021 08:18:13 -0400
Subject: [PATCH 0959/1750] netfilter: ip6t_rt: fix rt0_hdr parsing in rt_mt6

[ Upstream commit a482c5e00a9b5a194085bcd372ac36141028becb ]

In rt_mt6(), when it's a nonlinear skb, the 1st skb_header_pointer()
only copies sizeof(struct ipv6_rt_hdr) to _route that rh points to.
The access by ((const struct rt0_hdr *)rh)->reserved will overflow
the buffer. So this access should be moved below the 2nd call to
skb_header_pointer().

Besides, after the 2nd skb_header_pointer(), its return value should
also be checked, othersize, *rp may cause null-pointer-ref.

v1->v2:
  - clean up some old debugging log.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/netfilter/ip6t_rt.c | 48 +++++-------------------------------
 1 file changed, 6 insertions(+), 42 deletions(-)

diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 733c83d38b30..4ad8b2032f1f 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -25,12 +25,7 @@ MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 static inline bool
 segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 {
-	bool r;
-	pr_debug("segsleft_match:%c 0x%x <= 0x%x <= 0x%x\n",
-		 invert ? '!' : ' ', min, id, max);
-	r = (id >= min && id <= max) ^ invert;
-	pr_debug(" result %s\n", r ? "PASS" : "FAILED");
-	return r;
+	return (id >= min && id <= max) ^ invert;
 }
 
 static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
@@ -65,30 +60,6 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 		return false;
 	}
 
-	pr_debug("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
-	pr_debug("TYPE %04X ", rh->type);
-	pr_debug("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
-
-	pr_debug("IPv6 RT segsleft %02X ",
-		 segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
-				rh->segments_left,
-				!!(rtinfo->invflags & IP6T_RT_INV_SGS)));
-	pr_debug("type %02X %02X %02X ",
-		 rtinfo->rt_type, rh->type,
-		 (!(rtinfo->flags & IP6T_RT_TYP) ||
-		  ((rtinfo->rt_type == rh->type) ^
-		   !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
-	pr_debug("len %02X %04X %02X ",
-		 rtinfo->hdrlen, hdrlen,
-		 !(rtinfo->flags & IP6T_RT_LEN) ||
-		  ((rtinfo->hdrlen == hdrlen) ^
-		   !!(rtinfo->invflags & IP6T_RT_INV_LEN)));
-	pr_debug("res %02X %02X %02X ",
-		 rtinfo->flags & IP6T_RT_RES,
-		 ((const struct rt0_hdr *)rh)->reserved,
-		 !((rtinfo->flags & IP6T_RT_RES) &&
-		   (((const struct rt0_hdr *)rh)->reserved)));
-
 	ret = (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
 			      rh->segments_left,
 			      !!(rtinfo->invflags & IP6T_RT_INV_SGS))) &&
@@ -107,22 +78,22 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 						       reserved),
 					sizeof(_reserved),
 					&_reserved);
+		if (!rp) {
+			par->hotdrop = true;
+			return false;
+		}
 
 		ret = (*rp == 0);
 	}
 
-	pr_debug("#%d ", rtinfo->addrnr);
 	if (!(rtinfo->flags & IP6T_RT_FST)) {
 		return ret;
 	} else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
-		pr_debug("Not strict ");
 		if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
-			pr_debug("There isn't enough space\n");
 			return false;
 		} else {
 			unsigned int i = 0;
 
-			pr_debug("#%d ", rtinfo->addrnr);
 			for (temp = 0;
 			     temp < (unsigned int)((hdrlen - 8) / 16);
 			     temp++) {
@@ -138,26 +109,20 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 					return false;
 				}
 
-				if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
-					pr_debug("i=%d temp=%d;\n", i, temp);
+				if (ipv6_addr_equal(ap, &rtinfo->addrs[i]))
 					i++;
-				}
 				if (i == rtinfo->addrnr)
 					break;
 			}
-			pr_debug("i=%d #%d\n", i, rtinfo->addrnr);
 			if (i == rtinfo->addrnr)
 				return ret;
 			else
 				return false;
 		}
 	} else {
-		pr_debug("Strict ");
 		if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
-			pr_debug("There isn't enough space\n");
 			return false;
 		} else {
-			pr_debug("#%d ", rtinfo->addrnr);
 			for (temp = 0; temp < rtinfo->addrnr; temp++) {
 				ap = skb_header_pointer(skb,
 							ptr
@@ -173,7 +138,6 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 				if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
 					break;
 			}
-			pr_debug("temp=%d #%d\n", temp, rtinfo->addrnr);
 			if (temp == rtinfo->addrnr &&
 			    temp == (unsigned int)((hdrlen - 8) / 16))
 				return ret;

From 9c8943812dace238ec49fd62e599aad196a583c6 Mon Sep 17 00:00:00 2001
From: Antoine Tenart <atenart@kernel.org>
Date: Tue, 12 Oct 2021 16:54:37 +0200
Subject: [PATCH 0960/1750] netfilter: ipvs: make global sysctl readonly in
 non-init netns

[ Upstream commit 174c376278949c44aad89c514a6b5db6cee8db59 ]

Because the data pointer of net/ipv4/vs/debug_level is not updated per
netns, it must be marked as read-only in non-init netns.

Fixes: c6d2d445d8de ("IPVS: netns, final patch enabling network name space.")
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index c25097092a06..29ec3ef63edc 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -4090,6 +4090,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs)
 	tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode;
 	tbl[idx++].data = &ipvs->sysctl_schedule_icmp;
 	tbl[idx++].data = &ipvs->sysctl_ignore_tunneled;
+#ifdef CONFIG_IP_VS_DEBUG
+	/* Global sysctls must be ro in non-init netns */
+	if (!net_eq(net, &init_net))
+		tbl[idx++].mode = 0444;
+#endif
 
 	ipvs->sysctl_hdr = register_net_sysctl(net, "net/ipv4/vs", tbl);
 	if (ipvs->sysctl_hdr == NULL) {

From c28bea6b876f6d47e36c949c87de938dc0083858 Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Fri, 15 Oct 2021 15:07:54 +0200
Subject: [PATCH 0961/1750] lan78xx: select CRC32

[ Upstream commit 46393d61a328d7c4e3264252dae891921126c674 ]

Fix the following build/link error by adding a dependency on the CRC32
routines:

  ld: drivers/net/usb/lan78xx.o: in function `lan78xx_set_multicast':
  lan78xx.c:(.text+0x48cf): undefined reference to `crc32_le'

The actual use of crc32_le() comes indirectly through ether_crc().

Fixes: 55d7de9de6c30 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 4efad42b9aa9..867ff2ee8ecf 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -117,6 +117,7 @@ config USB_LAN78XX
 	select PHYLIB
 	select MICROCHIP_PHY
 	select FIXED_PHY
+	select CRC32
 	help
 	  This option adds support for Microchip LAN78XX based USB 2
 	  & USB 3 10/100/1000 Ethernet adapters.

From 38d984e5e845b2c0ec87e396c3f3771b4187990f Mon Sep 17 00:00:00 2001
From: Leonard Crestez <cdleonard@gmail.com>
Date: Fri, 15 Oct 2021 10:26:04 +0300
Subject: [PATCH 0962/1750] tcp: md5: Fix overlap between vrf and non-vrf keys

[ Upstream commit 86f1e3a8489f6a0232c1f3bc2bdb379f5ccdecec ]

With net.ipv4.tcp_l3mdev_accept=1 it is possible for a listen socket to
accept connection from the same client address in different VRFs. It is
also possible to set different MD5 keys for these clients which differ
only in the tcpm_l3index field.

This appears to work when distinguishing between different VRFs but not
between non-VRF and VRF connections. In particular:

 * tcp_md5_do_lookup_exact will match a non-vrf key against a vrf key.
This means that adding a key with l3index != 0 after a key with l3index
== 0 will cause the earlier key to be deleted. Both keys can be present
if the non-vrf key is added later.
 * _tcp_md5_do_lookup can match a non-vrf key before a vrf key. This
casues failures if the passwords differ.

Fix this by making tcp_md5_do_lookup_exact perform an actual exact
comparison on l3index and by making  __tcp_md5_do_lookup perfer
vrf-bound keys above other considerations like prefixlen.

Fixes: dea53bb80e07 ("tcp: Add l3index to tcp_md5sig_key and md5 functions")
Signed-off-by: Leonard Crestez <cdleonard@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_ipv4.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 71395e745bc5..017cd666387f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1022,6 +1022,20 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
 DEFINE_STATIC_KEY_FALSE(tcp_md5_needed);
 EXPORT_SYMBOL(tcp_md5_needed);
 
+static bool better_md5_match(struct tcp_md5sig_key *old, struct tcp_md5sig_key *new)
+{
+	if (!old)
+		return true;
+
+	/* l3index always overrides non-l3index */
+	if (old->l3index && new->l3index == 0)
+		return false;
+	if (old->l3index == 0 && new->l3index)
+		return true;
+
+	return old->prefixlen < new->prefixlen;
+}
+
 /* Find the Key structure for an address.  */
 struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk, int l3index,
 					   const union tcp_md5_addr *addr,
@@ -1059,8 +1073,7 @@ struct tcp_md5sig_key *__tcp_md5_do_lookup(const struct sock *sk, int l3index,
 			match = false;
 		}
 
-		if (match && (!best_match ||
-			      key->prefixlen > best_match->prefixlen))
+		if (match && better_md5_match(best_match, key))
 			best_match = key;
 	}
 	return best_match;
@@ -1090,7 +1103,7 @@ static struct tcp_md5sig_key *tcp_md5_do_lookup_exact(const struct sock *sk,
 				 lockdep_sock_is_held(sk)) {
 		if (key->family != family)
 			continue;
-		if (key->l3index && key->l3index != l3index)
+		if (key->l3index != l3index)
 			continue;
 		if (!memcmp(&key->addr, addr, size) &&
 		    key->prefixlen == prefixlen)

From ef97219d5fecd96b599dc48a9f95c5a50fc434ab Mon Sep 17 00:00:00 2001
From: Stephen Suryaputra <ssuryaextr@gmail.com>
Date: Thu, 14 Oct 2021 09:08:45 -0400
Subject: [PATCH 0963/1750] ipv6: When forwarding count rx stats on the orig
 netdev

[ Upstream commit 0857d6f8c759d95f89d0436f86cdfd189ef99f20 ]

Commit bdb7cc643fc9 ("ipv6: Count interface receive statistics on the
ingress netdev") does not work when ip6_forward() executes on the skbs
with vrf-enslaved netdev. Use IP6CB(skb)->iif to get to the right one.

Add a selftest script to verify.

Fixes: bdb7cc643fc9 ("ipv6: Count interface receive statistics on the ingress netdev")
Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20211014130845.410602-1-ssuryaextr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/ip6_output.c                         |   3 +-
 .../testing/selftests/net/forwarding/Makefile |   1 +
 .../net/forwarding/forwarding.config.sample   |   2 +
 .../net/forwarding/ip6_forward_instats_vrf.sh | 172 ++++++++++++++++++
 tools/testing/selftests/net/forwarding/lib.sh |   8 +
 5 files changed, 185 insertions(+), 1 deletion(-)
 create mode 100755 tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 72a673a43a75..c2f8e69d7d7a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -487,13 +487,14 @@ static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
 
 int ip6_forward(struct sk_buff *skb)
 {
-	struct inet6_dev *idev = __in6_dev_get_safely(skb->dev);
 	struct dst_entry *dst = skb_dst(skb);
 	struct ipv6hdr *hdr = ipv6_hdr(skb);
 	struct inet6_skb_parm *opt = IP6CB(skb);
 	struct net *net = dev_net(dst->dev);
+	struct inet6_dev *idev;
 	u32 mtu;
 
+	idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
 	if (net->ipv6.devconf_all->forwarding == 0)
 		goto error;
 
diff --git a/tools/testing/selftests/net/forwarding/Makefile b/tools/testing/selftests/net/forwarding/Makefile
index 250fbb2d1625..881e680c2e9c 100644
--- a/tools/testing/selftests/net/forwarding/Makefile
+++ b/tools/testing/selftests/net/forwarding/Makefile
@@ -9,6 +9,7 @@ TEST_PROGS = bridge_igmp.sh \
 	gre_inner_v4_multipath.sh \
 	gre_inner_v6_multipath.sh \
 	gre_multipath.sh \
+	ip6_forward_instats_vrf.sh \
 	ip6gre_inner_v4_multipath.sh \
 	ip6gre_inner_v6_multipath.sh \
 	ipip_flat_gre_key.sh \
diff --git a/tools/testing/selftests/net/forwarding/forwarding.config.sample b/tools/testing/selftests/net/forwarding/forwarding.config.sample
index b802c14d2950..e5e2fbeca22e 100644
--- a/tools/testing/selftests/net/forwarding/forwarding.config.sample
+++ b/tools/testing/selftests/net/forwarding/forwarding.config.sample
@@ -39,3 +39,5 @@ NETIF_CREATE=yes
 # Timeout (in seconds) before ping exits regardless of how many packets have
 # been sent or received
 PING_TIMEOUT=5
+# IPv6 traceroute utility name.
+TROUTE6=traceroute6
diff --git a/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
new file mode 100755
index 000000000000..9f5b3e2e5e95
--- /dev/null
+++ b/tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh
@@ -0,0 +1,172 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+# Test ipv6 stats on the incoming if when forwarding with VRF
+
+ALL_TESTS="
+	ipv6_ping
+	ipv6_in_too_big_err
+	ipv6_in_hdr_err
+	ipv6_in_addr_err
+	ipv6_in_discard
+"
+
+NUM_NETIFS=4
+source lib.sh
+
+h1_create()
+{
+	simple_if_init $h1 2001:1:1::2/64
+	ip -6 route add vrf v$h1 2001:1:2::/64 via 2001:1:1::1
+}
+
+h1_destroy()
+{
+	ip -6 route del vrf v$h1 2001:1:2::/64 via 2001:1:1::1
+	simple_if_fini $h1 2001:1:1::2/64
+}
+
+router_create()
+{
+	vrf_create router
+	__simple_if_init $rtr1 router 2001:1:1::1/64
+	__simple_if_init $rtr2 router 2001:1:2::1/64
+	mtu_set $rtr2 1280
+}
+
+router_destroy()
+{
+	mtu_restore $rtr2
+	__simple_if_fini $rtr2 2001:1:2::1/64
+	__simple_if_fini $rtr1 2001:1:1::1/64
+	vrf_destroy router
+}
+
+h2_create()
+{
+	simple_if_init $h2 2001:1:2::2/64
+	ip -6 route add vrf v$h2 2001:1:1::/64 via 2001:1:2::1
+	mtu_set $h2 1280
+}
+
+h2_destroy()
+{
+	mtu_restore $h2
+	ip -6 route del vrf v$h2 2001:1:1::/64 via 2001:1:2::1
+	simple_if_fini $h2 2001:1:2::2/64
+}
+
+setup_prepare()
+{
+	h1=${NETIFS[p1]}
+	rtr1=${NETIFS[p2]}
+
+	rtr2=${NETIFS[p3]}
+	h2=${NETIFS[p4]}
+
+	vrf_prepare
+	h1_create
+	router_create
+	h2_create
+
+	forwarding_enable
+}
+
+cleanup()
+{
+	pre_cleanup
+
+	forwarding_restore
+
+	h2_destroy
+	router_destroy
+	h1_destroy
+	vrf_cleanup
+}
+
+ipv6_in_too_big_err()
+{
+	RET=0
+
+	local t0=$(ipv6_stats_get $rtr1 Ip6InTooBigErrors)
+	local vrf_name=$(master_name_get $h1)
+
+	# Send too big packets
+	ip vrf exec $vrf_name \
+		$PING6 -s 1300 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
+
+	local t1=$(ipv6_stats_get $rtr1 Ip6InTooBigErrors)
+	test "$((t1 - t0))" -ne 0
+	check_err $?
+	log_test "Ip6InTooBigErrors"
+}
+
+ipv6_in_hdr_err()
+{
+	RET=0
+
+	local t0=$(ipv6_stats_get $rtr1 Ip6InHdrErrors)
+	local vrf_name=$(master_name_get $h1)
+
+	# Send packets with hop limit 1, easiest with traceroute6 as some ping6
+	# doesn't allow hop limit to be specified
+	ip vrf exec $vrf_name \
+		$TROUTE6 2001:1:2::2 &> /dev/null
+
+	local t1=$(ipv6_stats_get $rtr1 Ip6InHdrErrors)
+	test "$((t1 - t0))" -ne 0
+	check_err $?
+	log_test "Ip6InHdrErrors"
+}
+
+ipv6_in_addr_err()
+{
+	RET=0
+
+	local t0=$(ipv6_stats_get $rtr1 Ip6InAddrErrors)
+	local vrf_name=$(master_name_get $h1)
+
+	# Disable forwarding temporary while sending the packet
+	sysctl -qw net.ipv6.conf.all.forwarding=0
+	ip vrf exec $vrf_name \
+		$PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
+	sysctl -qw net.ipv6.conf.all.forwarding=1
+
+	local t1=$(ipv6_stats_get $rtr1 Ip6InAddrErrors)
+	test "$((t1 - t0))" -ne 0
+	check_err $?
+	log_test "Ip6InAddrErrors"
+}
+
+ipv6_in_discard()
+{
+	RET=0
+
+	local t0=$(ipv6_stats_get $rtr1 Ip6InDiscards)
+	local vrf_name=$(master_name_get $h1)
+
+	# Add a policy to discard
+	ip xfrm policy add dst 2001:1:2::2/128 dir fwd action block
+	ip vrf exec $vrf_name \
+		$PING6 2001:1:2::2 -c 1 -w $PING_TIMEOUT &> /dev/null
+	ip xfrm policy del dst 2001:1:2::2/128 dir fwd
+
+	local t1=$(ipv6_stats_get $rtr1 Ip6InDiscards)
+	test "$((t1 - t0))" -ne 0
+	check_err $?
+	log_test "Ip6InDiscards"
+}
+ipv6_ping()
+{
+	RET=0
+
+	ping6_test $h1 2001:1:2::2
+}
+
+trap cleanup EXIT
+
+setup_prepare
+setup_wait
+tests_run
+
+exit $EXIT_STATUS
diff --git a/tools/testing/selftests/net/forwarding/lib.sh b/tools/testing/selftests/net/forwarding/lib.sh
index 927f9ba49e08..be6fa808d219 100644
--- a/tools/testing/selftests/net/forwarding/lib.sh
+++ b/tools/testing/selftests/net/forwarding/lib.sh
@@ -674,6 +674,14 @@ qdisc_parent_stats_get()
 	    | jq '.[] | select(.parent == "'"$parent"'") | '"$selector"
 }
 
+ipv6_stats_get()
+{
+	local dev=$1; shift
+	local stat=$1; shift
+
+	cat /proc/net/dev_snmp6/$dev | grep "^$stat" | cut -f2
+}
+
 humanize()
 {
 	local speed=$1; shift

From 6edf99b000d6fb0e2b6a58580c1735453d6f3922 Mon Sep 17 00:00:00 2001
From: Aleksander Jan Bajkowski <olek2@wp.pl>
Date: Sat, 16 Oct 2021 00:10:20 +0200
Subject: [PATCH 0964/1750] net: dsa: lantiq_gswip: fix register definition

[ Upstream commit 66d262804a2276721eac86cf18fcd61046149193 ]

I compared the register definitions with the D-Link DWR-966
GPL sources and found that the PUAFD field definition was
incorrect. This definition is unused and causes no issues.

Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/lantiq_gswip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c
index 95e634cbc4b6..4d23a7aba796 100644
--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
@@ -229,7 +229,7 @@
 #define GSWIP_SDMA_PCTRLp(p)		(0xBC0 + ((p) * 0x6))
 #define  GSWIP_SDMA_PCTRL_EN		BIT(0)	/* SDMA Port Enable */
 #define  GSWIP_SDMA_PCTRL_FCEN		BIT(1)	/* Flow Control Enable */
-#define  GSWIP_SDMA_PCTRL_PAUFWD	BIT(1)	/* Pause Frame Forwarding */
+#define  GSWIP_SDMA_PCTRL_PAUFWD	BIT(3)	/* Pause Frame Forwarding */
 
 #define GSWIP_TABLE_ACTIVE_VLAN		0x01
 #define GSWIP_TABLE_VLAN_MAPPING	0x02

From 81dbd898fb7b93286dc962bb3dde38270c0d5b74 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Mon, 4 Oct 2021 00:56:06 -0700
Subject: [PATCH 0965/1750] NIOS2: irqflags: rename a redefined register name

[ Upstream commit 4cce60f15c04d69eff6ffc539ab09137dbe15070 ]

Both arch/nios2/ and drivers/mmc/host/tmio_mmc.c define a macro
with the name "CTL_STATUS". Change the one in arch/nios2/ to be
"CTL_FSTATUS" (flags status) to eliminate the build warning.

In file included from ../drivers/mmc/host/tmio_mmc.c:22:
drivers/mmc/host/tmio_mmc.h:31: warning: "CTL_STATUS" redefined
   31 | #define CTL_STATUS 0x1c
arch/nios2/include/asm/registers.h:14: note: this is the location of the previous definition
   14 | #define CTL_STATUS      0

Fixes: b31ebd8055ea ("nios2: Nios2 registers")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/nios2/include/asm/irqflags.h  | 4 ++--
 arch/nios2/include/asm/registers.h | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/nios2/include/asm/irqflags.h b/arch/nios2/include/asm/irqflags.h
index b3ec3e510706..25acf27862f9 100644
--- a/arch/nios2/include/asm/irqflags.h
+++ b/arch/nios2/include/asm/irqflags.h
@@ -9,7 +9,7 @@
 
 static inline unsigned long arch_local_save_flags(void)
 {
-	return RDCTL(CTL_STATUS);
+	return RDCTL(CTL_FSTATUS);
 }
 
 /*
@@ -18,7 +18,7 @@ static inline unsigned long arch_local_save_flags(void)
  */
 static inline void arch_local_irq_restore(unsigned long flags)
 {
-	WRCTL(CTL_STATUS, flags);
+	WRCTL(CTL_FSTATUS, flags);
 }
 
 static inline void arch_local_irq_disable(void)
diff --git a/arch/nios2/include/asm/registers.h b/arch/nios2/include/asm/registers.h
index 183c720e454d..95b67dd16f81 100644
--- a/arch/nios2/include/asm/registers.h
+++ b/arch/nios2/include/asm/registers.h
@@ -11,7 +11,7 @@
 #endif
 
 /* control register numbers */
-#define CTL_STATUS	0
+#define CTL_FSTATUS	0
 #define CTL_ESTATUS	1
 #define CTL_BSTATUS	2
 #define CTL_IENABLE	3

From 53770a411559cf7bc0906d1df319cc533d2f4f58 Mon Sep 17 00:00:00 2001
From: Nathan Lynch <nathanl@linux.ibm.com>
Date: Fri, 15 Oct 2021 12:39:02 -0500
Subject: [PATCH 0966/1750] powerpc/smp: do not decrement idle task preempt
 count in CPU offline

[ Upstream commit 787252a10d9422f3058df9a4821f389e5326c440 ]

With PREEMPT_COUNT=y, when a CPU is offlined and then onlined again, we
get:

BUG: scheduling while atomic: swapper/1/0/0x00000000
no locks held by swapper/1/0.
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.15.0-rc2+ #100
Call Trace:
 dump_stack_lvl+0xac/0x108
 __schedule_bug+0xac/0xe0
 __schedule+0xcf8/0x10d0
 schedule_idle+0x3c/0x70
 do_idle+0x2d8/0x4a0
 cpu_startup_entry+0x38/0x40
 start_secondary+0x2ec/0x3a0
 start_secondary_prolog+0x10/0x14

This is because powerpc's arch_cpu_idle_dead() decrements the idle task's
preempt count, for reasons explained in commit a7c2bb8279d2 ("powerpc:
Re-enable preemption before cpu_die()"), specifically "start_secondary()
expects a preempt_count() of 0."

However, since commit 2c669ef6979c ("powerpc/preempt: Don't touch the idle
task's preempt_count during hotplug") and commit f1a0a376ca0c ("sched/core:
Initialize the idle task with preemption disabled"), that justification no
longer holds.

The idle task isn't supposed to re-enable preemption, so remove the
vestigial preempt_enable() from the CPU offline path.

Tested with pseries and powernv in qemu, and pseries on PowerVM.

Fixes: 2c669ef6979c ("powerpc/preempt: Don't touch the idle task's preempt_count during hotplug")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211015173902.2278118-1-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/smp.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 91f274134884..452cbf98bfd7 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -1578,8 +1578,6 @@ void __cpu_die(unsigned int cpu)
 
 void arch_cpu_idle_dead(void)
 {
-	sched_preempt_enable_no_resched();
-
 	/*
 	 * Disable on the down path. This will be re-enabled by
 	 * start_secondary() via start_secondary_resume() below

From 21f61d10435c9c112bc14433fc026b231bdea918 Mon Sep 17 00:00:00 2001
From: Guangbin Huang <huangguangbin2@huawei.com>
Date: Tue, 19 Oct 2021 22:16:29 +0800
Subject: [PATCH 0967/1750] net: hns3: reset DWRR of unused tc to zero

[ Upstream commit b63fcaab959807282e9822e659034edf95fc8bd1 ]

Currently, DWRR of tc will be initialized to a fixed value when this tc
is enabled, but it is not been reset to 0 when this tc is disabled. It
cause a problem that the DWRR of unused tc is not 0 after using tc tool
to add and delete multi-tc parameters.

For examples, after enabling 4 TCs and restoring to 1 TC by follow
tc commands:

$ tc qdisc add dev eth0 root mqprio num_tc 4 map 0 1 2 3 0 1 2 3 queues \
  8@0 8@8 8@16 8@24 hw 1 mode channel
$ tc qdisc del dev eth0 root

Now there is just one TC is enabled for eth0, but the tc info querying by
debugfs is shown as follow:

$ cat /mnt/hns3/0000:7d:00.0/tm/tc_sch_info
enabled tc number: 1
weight_offset: 14
TC    MODE  WEIGHT
0     dwrr    100
1     dwrr    100
2     dwrr    100
3     dwrr    100
4     dwrr      0
5     dwrr      0
6     dwrr      0
7     dwrr      0

This patch fixes it by resetting DWRR of tc to 0 when tc is disabled.

Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index 69d081515c60..71aa6d16fc19 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -671,6 +671,8 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)
 		hdev->tm_info.pg_info[i].tc_bit_map = hdev->hw_tc_map;
 		for (k = 0; k < hdev->tm_info.num_tc; k++)
 			hdev->tm_info.pg_info[i].tc_dwrr[k] = BW_PERCENT;
+		for (; k < HNAE3_MAX_TC; k++)
+			hdev->tm_info.pg_info[i].tc_dwrr[k] = 0;
 	}
 }
 

From 96c013f40c9b524f15fafc653284776902d2dfd8 Mon Sep 17 00:00:00 2001
From: Guangbin Huang <huangguangbin2@huawei.com>
Date: Tue, 19 Oct 2021 22:16:30 +0800
Subject: [PATCH 0968/1750] net: hns3: add limit ets dwrr bandwidth cannot be 0

[ Upstream commit 731797fdffa3d083db536e2fdd07ceb050bb40b1 ]

If ets dwrr bandwidth of tc is set to 0, the hardware will switch to SP
mode. In this case, this tc may occupy all the tx bandwidth if it has
huge traffic, so it violates the purpose of the user setting.

To fix this problem, limit the ets dwrr bandwidth must greater than 0.

Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature")
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
index 28a90ead4795..8e6085753b9f 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
@@ -134,6 +134,15 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
 				*changed = true;
 			break;
 		case IEEE_8021QAZ_TSA_ETS:
+			/* The hardware will switch to sp mode if bandwidth is
+			 * 0, so limit ets bandwidth must be greater than 0.
+			 */
+			if (!ets->tc_tx_bw[i]) {
+				dev_err(&hdev->pdev->dev,
+					"tc%u ets bw cannot be 0\n", i);
+				return -EINVAL;
+			}
+
 			if (hdev->tm_info.tc_info[i].tc_sch_mode !=
 				HCLGE_SCH_MODE_DWRR)
 				*changed = true;

From 32b860d364d2fe3b2a5c2f506d7f7d08afea4994 Mon Sep 17 00:00:00 2001
From: Yunsheng Lin <linyunsheng@huawei.com>
Date: Tue, 19 Oct 2021 22:16:33 +0800
Subject: [PATCH 0969/1750] net: hns3: schedule the polling again when
 allocation fails

[ Upstream commit 68752b24f51a71d4f350a764d890b670f59062c5 ]

Currently when there is a rx page allocation failure, it is
possible that polling may be stopped if there is no more packet
to be reveiced, which may cause queue stall problem under memory
pressure.

This patch makes sure polling is scheduled again when there is
any rx page allocation failure, and polling will try to allocate
receive buffers until it succeeds.

Now the allocation retry is added, it is unnecessary to do the rx
page allocation at the end of rx cleaning, so remove it. And reset
the unused_count to zero after calling hns3_nic_alloc_rx_buffers()
to avoid calling hns3_nic_alloc_rx_buffers() repeatedly under
memory pressure.

Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/hisilicon/hns3/hns3_enet.c   | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 4777db2623cf..e2790deb6dab 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2637,7 +2637,8 @@ static int hns3_desc_unused(struct hns3_enet_ring *ring)
 	return ((ntc >= ntu) ? 0 : ring->desc_num) + ntc - ntu;
 }
 
-static void hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
+/* Return true if there is any allocation failure */
+static bool hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
 				      int cleand_count)
 {
 	struct hns3_desc_cb *desc_cb;
@@ -2662,7 +2663,10 @@ static void hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
 				hns3_rl_err(ring_to_netdev(ring),
 					    "alloc rx buffer failed: %d\n",
 					    ret);
-				break;
+
+				writel(i, ring->tqp->io_base +
+				       HNS3_RING_RX_RING_HEAD_REG);
+				return true;
 			}
 			hns3_replace_buffer(ring, ring->next_to_use, &res_cbs);
 
@@ -2675,6 +2679,7 @@ static void hns3_nic_alloc_rx_buffers(struct hns3_enet_ring *ring,
 	}
 
 	writel(i, ring->tqp->io_base + HNS3_RING_RX_RING_HEAD_REG);
+	return false;
 }
 
 static bool hns3_page_is_reusable(struct page *page)
@@ -3218,6 +3223,7 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
 {
 #define RCB_NOF_ALLOC_RX_BUFF_ONCE 16
 	int unused_count = hns3_desc_unused(ring);
+	bool failure = false;
 	int recv_pkts = 0;
 	int err;
 
@@ -3226,9 +3232,9 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
 	while (recv_pkts < budget) {
 		/* Reuse or realloc buffers */
 		if (unused_count >= RCB_NOF_ALLOC_RX_BUFF_ONCE) {
-			hns3_nic_alloc_rx_buffers(ring, unused_count);
-			unused_count = hns3_desc_unused(ring) -
-					ring->pending_buf;
+			failure = failure ||
+				hns3_nic_alloc_rx_buffers(ring, unused_count);
+			unused_count = 0;
 		}
 
 		/* Poll one pkt */
@@ -3247,11 +3253,7 @@ int hns3_clean_rx_ring(struct hns3_enet_ring *ring, int budget,
 	}
 
 out:
-	/* Make all data has been write before submit */
-	if (unused_count > 0)
-		hns3_nic_alloc_rx_buffers(ring, unused_count);
-
-	return recv_pkts;
+	return failure ? budget : recv_pkts;
 }
 
 static bool hns3_get_new_flow_lvl(struct hns3_enet_ring_group *ring_group)

From 6a72e1d78a2ffd5ae94190434aafa7056891c9a8 Mon Sep 17 00:00:00 2001
From: Yufeng Mo <moyufeng@huawei.com>
Date: Tue, 19 Oct 2021 22:16:34 +0800
Subject: [PATCH 0970/1750] net: hns3: fix vf reset workqueue cannot exit

[ Upstream commit 1385cc81baeb3bd8cbbbcdc1557f038ac1712529 ]

The task of VF reset is performed through the workqueue. It checks the
value of hdev->reset_pending to determine whether to exit the loop.
However, the value of hdev->reset_pending may also be assigned by
the interrupt function hclgevf_misc_irq_handle(), which may cause the
loop fail to exit and keep occupying the workqueue. This loop is not
necessary, so remove it and the workqueue will be rescheduled if the
reset needs to be retried or a new reset occurs.

Fixes: 1cc9bc6e5867 ("net: hns3: split hclgevf_reset() into preparing and rebuilding part")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index 3641d7c31451..a47f23f27a11 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -2160,9 +2160,9 @@ static void hclgevf_reset_service_task(struct hclgevf_dev *hdev)
 		hdev->reset_attempts = 0;
 
 		hdev->last_reset_time = jiffies;
-		while ((hdev->reset_type =
-			hclgevf_get_reset_level(hdev, &hdev->reset_pending))
-		       != HNAE3_NONE_RESET)
+		hdev->reset_type =
+			hclgevf_get_reset_level(hdev, &hdev->reset_pending);
+		if (hdev->reset_type != HNAE3_NONE_RESET)
 			hclgevf_reset(hdev);
 	} else if (test_and_clear_bit(HCLGEVF_RESET_REQUESTED,
 				      &hdev->reset_state)) {

From d36b15e3e7b5937cb1f6ac590a85facc3a320642 Mon Sep 17 00:00:00 2001
From: Peng Li <lipeng321@huawei.com>
Date: Tue, 19 Oct 2021 22:16:35 +0800
Subject: [PATCH 0971/1750] net: hns3: disable sriov before unload hclge layer

[ Upstream commit 0dd8a25f355b4df2d41c08df1716340854c7d4c5 ]

HNS3 driver includes hns3.ko, hnae3.ko and hclge.ko.
hns3.ko includes network stack and pci_driver, hclge.ko includes
HW device action, algo_ops and timer task, hnae3.ko includes some
register function.

When SRIOV is enable and hclge.ko is removed, HW device is unloaded
but VF still exists, PF will not reply VF mbx messages, and cause
errors.

This patch fix it by disable SRIOV before remove hclge.ko.

Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hnae3.c   | 21 +++++++++++++++++++
 drivers/net/ethernet/hisilicon/hns3/hnae3.h   |  1 +
 .../hisilicon/hns3/hns3pf/hclge_main.c        |  1 +
 3 files changed, 23 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.c b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
index eef1b2764d34..67b0bf310daa 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c
@@ -10,6 +10,27 @@ static LIST_HEAD(hnae3_ae_algo_list);
 static LIST_HEAD(hnae3_client_list);
 static LIST_HEAD(hnae3_ae_dev_list);
 
+void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo)
+{
+	const struct pci_device_id *pci_id;
+	struct hnae3_ae_dev *ae_dev;
+
+	if (!ae_algo)
+		return;
+
+	list_for_each_entry(ae_dev, &hnae3_ae_dev_list, node) {
+		if (!hnae3_get_bit(ae_dev->flag, HNAE3_DEV_INITED_B))
+			continue;
+
+		pci_id = pci_match_id(ae_algo->pdev_id_table, ae_dev->pdev);
+		if (!pci_id)
+			continue;
+		if (IS_ENABLED(CONFIG_PCI_IOV))
+			pci_disable_sriov(ae_dev->pdev);
+	}
+}
+EXPORT_SYMBOL(hnae3_unregister_ae_algo_prepare);
+
 /* we are keeping things simple and using single lock for all the
  * list. This is a non-critical code so other updations, if happen
  * in parallel, can wait.
diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
index 912c51e327d6..4a9576a449e1 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
@@ -754,6 +754,7 @@ struct hnae3_handle {
 int hnae3_register_ae_dev(struct hnae3_ae_dev *ae_dev);
 void hnae3_unregister_ae_dev(struct hnae3_ae_dev *ae_dev);
 
+void hnae3_unregister_ae_algo_prepare(struct hnae3_ae_algo *ae_algo);
 void hnae3_unregister_ae_algo(struct hnae3_ae_algo *ae_algo);
 void hnae3_register_ae_algo(struct hnae3_ae_algo *ae_algo);
 
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
index 0e869f449f12..7b94764b4f5d 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
@@ -11518,6 +11518,7 @@ static int hclge_init(void)
 
 static void hclge_exit(void)
 {
+	hnae3_unregister_ae_algo_prepare(&ae_algo);
 	hnae3_unregister_ae_algo(&ae_algo);
 	destroy_workqueue(hclge_wq);
 }

From 29f1bdcaa3ddfc9be22c82fa927a8e35b8132df0 Mon Sep 17 00:00:00 2001
From: Kurt Kanzenbach <kurt@linutronix.de>
Date: Wed, 20 Oct 2021 09:04:33 +0200
Subject: [PATCH 0972/1750] net: stmmac: Fix E2E delay mechanism

[ Upstream commit 3cb958027cb8b78d3ee639ce9af54c2ef1bf964f ]

When utilizing End to End delay mechanism, the following error messages show up:

|root@ehl1:~# ptp4l --tx_timestamp_timeout=50 -H -i eno2 -E -m
|ptp4l[950.573]: selected /dev/ptp3 as PTP clock
|ptp4l[950.586]: port 1: INITIALIZING to LISTENING on INIT_COMPLETE
|ptp4l[950.586]: port 0: INITIALIZING to LISTENING on INIT_COMPLETE
|ptp4l[952.879]: port 1: new foreign master 001395.fffe.4897b4-1
|ptp4l[956.879]: selected best master clock 001395.fffe.4897b4
|ptp4l[956.879]: port 1: assuming the grand master role
|ptp4l[956.879]: port 1: LISTENING to GRAND_MASTER on RS_GRAND_MASTER
|ptp4l[962.017]: port 1: received DELAY_REQ without timestamp
|ptp4l[962.273]: port 1: received DELAY_REQ without timestamp
|ptp4l[963.090]: port 1: received DELAY_REQ without timestamp

Commit f2fb6b6275eb ("net: stmmac: enable timestamp snapshot for required PTP
packets in dwmac v5.10a") already addresses this problem for the dwmac
v5.10. However, same holds true for all dwmacs above version v4.10. Correct the
check accordingly. Afterwards everything works as expected.

Tested on Intel Atom(R) x6414RE Processor.

Fixes: 14f347334bf2 ("net: stmmac: Correctly take timestamp for PTPv2")
Fixes: f2fb6b6275eb ("net: stmmac: enable timestamp snapshot for required PTP packets in dwmac v5.10a")
Suggested-by: Ong Boon Leong <boon.leong.ong@intel.com>
Signed-off-by: Kurt Kanzenbach <kurt@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6133b2fe8a78..0ac61e7ab43c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -605,7 +605,7 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
 			config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
 			ptp_v2 = PTP_TCR_TSVER2ENA;
 			snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
-			if (priv->synopsys_id != DWMAC_CORE_5_10)
+			if (priv->synopsys_id < DWMAC_CORE_4_10)
 				ts_event_en = PTP_TCR_TSEVNTENA;
 			ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
 			ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;

From 6418508a3ac2a85a48d097f478566708a4f43087 Mon Sep 17 00:00:00 2001
From: Sasha Neftin <sasha.neftin@intel.com>
Date: Wed, 22 Sep 2021 09:55:42 +0300
Subject: [PATCH 0973/1750] e1000e: Fix packet loss on Tiger Lake and later

[ Upstream commit 639e298f432fb058a9496ea16863f53b1ce935fe ]

Update the HW MAC initialization flow. Do not gate DMA clock from
the modPHY block. Keeping this clock will prevent dropped packets
sent in burst mode on the Kumeran interface.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=213651
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=213377
Fixes: fb776f5d57ee ("e1000e: Add support for Tiger Lake")
Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Mark Pearson <markpearson@lenovo.com>
Tested-by: Nechama Kraus <nechamax.kraus@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e1000e/ich8lan.c | 11 ++++++++++-
 drivers/net/ethernet/intel/e1000e/ich8lan.h |  3 +++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 854c585de2e1..3cbb8d1ed67f 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -4811,7 +4811,7 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
 static s32 e1000_init_hw_ich8lan(struct e1000_hw *hw)
 {
 	struct e1000_mac_info *mac = &hw->mac;
-	u32 ctrl_ext, txdctl, snoop;
+	u32 ctrl_ext, txdctl, snoop, fflt_dbg;
 	s32 ret_val;
 	u16 i;
 
@@ -4870,6 +4870,15 @@ static s32 e1000_init_hw_ich8lan(struct e1000_hw *hw)
 		snoop = (u32)~(PCIE_NO_SNOOP_ALL);
 	e1000e_set_pcie_no_snoop(hw, snoop);
 
+	/* Enable workaround for packet loss issue on TGP PCH
+	 * Do not gate DMA clock from the modPHY block
+	 */
+	if (mac->type >= e1000_pch_tgp) {
+		fflt_dbg = er32(FFLT_DBG);
+		fflt_dbg |= E1000_FFLT_DBG_DONT_GATE_WAKE_DMA_CLK;
+		ew32(FFLT_DBG, fflt_dbg);
+	}
+
 	ctrl_ext = er32(CTRL_EXT);
 	ctrl_ext |= E1000_CTRL_EXT_RO_DIS;
 	ew32(CTRL_EXT, ctrl_ext);
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index e757896287eb..8f2a8f4ce0ee 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -286,6 +286,9 @@
 /* Proprietary Latency Tolerance Reporting PCI Capability */
 #define E1000_PCI_LTR_CAP_LPT		0xA8
 
+/* Don't gate wake DMA clock */
+#define E1000_FFLT_DBG_DONT_GATE_WAKE_DMA_CLK	0x1000
+
 void e1000e_write_protect_nvm_ich8lan(struct e1000_hw *hw);
 void e1000e_set_kmrn_lock_loss_workaround_ich8lan(struct e1000_hw *hw,
 						  bool state);

From eccd00728b1a0665e69f1895164e81bcb068f11c Mon Sep 17 00:00:00 2001
From: Tony Nguyen <anthony.l.nguyen@intel.com>
Date: Tue, 19 Oct 2021 13:04:16 -0700
Subject: [PATCH 0974/1750] ice: Add missing E810 device ids

[ Upstream commit 7dcf78b870be6418d72bb1c4d4924bf0f5ca5052 ]

As part of support for E810 XXV devices, some device ids were
inadvertently left out. Add those missing ids.

Fixes: 195fb97766da ("ice: add additional E810 device id")
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_common.c | 2 ++
 drivers/net/ethernet/intel/ice/ice_devids.h | 4 ++++
 drivers/net/ethernet/intel/ice/ice_main.c   | 2 ++
 3 files changed, 8 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c
index 2239a5f45e5a..64714757bd4f 100644
--- a/drivers/net/ethernet/intel/ice/ice_common.c
+++ b/drivers/net/ethernet/intel/ice/ice_common.c
@@ -24,6 +24,8 @@ static enum ice_status ice_set_mac_type(struct ice_hw *hw)
 	case ICE_DEV_ID_E810C_BACKPLANE:
 	case ICE_DEV_ID_E810C_QSFP:
 	case ICE_DEV_ID_E810C_SFP:
+	case ICE_DEV_ID_E810_XXV_BACKPLANE:
+	case ICE_DEV_ID_E810_XXV_QSFP:
 	case ICE_DEV_ID_E810_XXV_SFP:
 		hw->mac_type = ICE_MAC_E810;
 		break;
diff --git a/drivers/net/ethernet/intel/ice/ice_devids.h b/drivers/net/ethernet/intel/ice/ice_devids.h
index 9d8194671f6a..ef4392e6e244 100644
--- a/drivers/net/ethernet/intel/ice/ice_devids.h
+++ b/drivers/net/ethernet/intel/ice/ice_devids.h
@@ -21,6 +21,10 @@
 #define ICE_DEV_ID_E810C_QSFP		0x1592
 /* Intel(R) Ethernet Controller E810-C for SFP */
 #define ICE_DEV_ID_E810C_SFP		0x1593
+/* Intel(R) Ethernet Controller E810-XXV for backplane */
+#define ICE_DEV_ID_E810_XXV_BACKPLANE	0x1599
+/* Intel(R) Ethernet Controller E810-XXV for QSFP */
+#define ICE_DEV_ID_E810_XXV_QSFP	0x159A
 /* Intel(R) Ethernet Controller E810-XXV for SFP */
 #define ICE_DEV_ID_E810_XXV_SFP		0x159B
 /* Intel(R) Ethernet Connection E823-C for backplane */
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 5d0dc1f811e0..66d92a0cfef3 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -4773,6 +4773,8 @@ static const struct pci_device_id ice_pci_tbl[] = {
 	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_BACKPLANE), 0 },
 	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_QSFP), 0 },
 	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810C_SFP), 0 },
+	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810_XXV_BACKPLANE), 0 },
+	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810_XXV_QSFP), 0 },
 	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E810_XXV_SFP), 0 },
 	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E823C_BACKPLANE), 0 },
 	{ PCI_VDEVICE(INTEL, ICE_DEV_ID_E823C_QSFP), 0 },

From 00ad7a01540968da214e1fe607aff27b97f9883a Mon Sep 17 00:00:00 2001
From: Dan Johansen <strit@manjaro.org>
Date: Wed, 18 Aug 2021 23:48:18 +0200
Subject: [PATCH 0975/1750] drm/panel: ilitek-ili9881c: Fix sync for Feixin
 K101-IM2BYL02 panel

[ Upstream commit 772970620a839141835eaf2bc507d957b10adcca ]

This adjusts sync values according to the datasheet

Fixes: 1c243751c095 ("drm/panel: ilitek-ili9881c: add support for Feixin K101-IM2BYL02 panel")
Co-developed-by: Marius Gripsgard <marius@ubports.com>
Signed-off-by: Dan Johansen <strit@manjaro.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210818214818.298089-1-strit@manjaro.org
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panel/panel-ilitek-ili9881c.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
index 0145129d7c66..534dd7414d42 100644
--- a/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
+++ b/drivers/gpu/drm/panel/panel-ilitek-ili9881c.c
@@ -590,14 +590,14 @@ static const struct drm_display_mode k101_im2byl02_default_mode = {
 	.clock		= 69700,
 
 	.hdisplay	= 800,
-	.hsync_start	= 800 + 6,
-	.hsync_end	= 800 + 6 + 15,
-	.htotal		= 800 + 6 + 15 + 16,
+	.hsync_start	= 800 + 52,
+	.hsync_end	= 800 + 52 + 8,
+	.htotal		= 800 + 52 + 8 + 48,
 
 	.vdisplay	= 1280,
-	.vsync_start	= 1280 + 8,
-	.vsync_end	= 1280 + 8 + 48,
-	.vtotal		= 1280 + 8 + 48 + 52,
+	.vsync_start	= 1280 + 16,
+	.vsync_end	= 1280 + 16 + 6,
+	.vtotal		= 1280 + 16 + 6 + 15,
 
 	.width_mm	= 135,
 	.height_mm	= 217,

From 4a0928c3ebca08e3919514dd0cef674ecace01ba Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Wed, 20 Oct 2021 19:52:06 +0300
Subject: [PATCH 0976/1750] net: enetc: fix ethtool counter name for PM0_TERR

[ Upstream commit fb8dc5fc8cbdfd62ecd16493848aee2f42ed84d9 ]

There are two counters named "MAC tx frames", one of them is actually
incorrect. The correct name for that counter should be "MAC tx error
frames", which is symmetric to the existing "MAC rx error frames".

Fixes: 16eb4c85c964 ("enetc: Add ethtool statistics")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: <Claudiu Manoil <claudiu.manoil@nxp.com>
Link: https://lore.kernel.org/r/20211020165206.1069889-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
index 89e558135432..9c1690f64a02 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c
@@ -157,7 +157,7 @@ static const struct {
 	{ ENETC_PM0_TFRM,   "MAC tx frames" },
 	{ ENETC_PM0_TFCS,   "MAC tx fcs errors" },
 	{ ENETC_PM0_TVLAN,  "MAC tx VLAN frames" },
-	{ ENETC_PM0_TERR,   "MAC tx frames" },
+	{ ENETC_PM0_TERR,   "MAC tx frame errors" },
 	{ ENETC_PM0_TUCA,   "MAC tx unicast frames" },
 	{ ENETC_PM0_TMCA,   "MAC tx multicast frames" },
 	{ ENETC_PM0_TBCA,   "MAC tx broadcast frames" },

From 4758e92e75cac632ddfb518e17601595b4f1ccac Mon Sep 17 00:00:00 2001
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Date: Fri, 24 Sep 2021 16:55:56 +0900
Subject: [PATCH 0977/1750] can: rcar_can: fix suspend/resume

commit f7c05c3987dcfde9a4e8c2d533db013fabebca0d upstream.

If the driver was not opened, rcar_can_suspend() should not call
clk_disable() because the clock was not enabled.

Fixes: fd1159318e55 ("can: add Renesas R-Car CAN driver")
Link: https://lore.kernel.org/all/20210924075556.223685-1-yoshihiro.shimoda.uh@renesas.com
Cc: stable@vger.kernel.org
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Tested-by: Ayumi Nakamichi <ayumi.nakamichi.kf@renesas.com>
Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu>
Tested-by: Biju Das <biju.das.jz@bp.renesas.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/rcar/rcar_can.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index 48575900adb7..3570a4de0085 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -846,10 +846,12 @@ static int __maybe_unused rcar_can_suspend(struct device *dev)
 	struct rcar_can_priv *priv = netdev_priv(ndev);
 	u16 ctlr;
 
-	if (netif_running(ndev)) {
-		netif_stop_queue(ndev);
-		netif_device_detach(ndev);
-	}
+	if (!netif_running(ndev))
+		return 0;
+
+	netif_stop_queue(ndev);
+	netif_device_detach(ndev);
+
 	ctlr = readw(&priv->regs->ctlr);
 	ctlr |= RCAR_CAN_CTLR_CANM_HALT;
 	writew(ctlr, &priv->regs->ctlr);
@@ -868,6 +870,9 @@ static int __maybe_unused rcar_can_resume(struct device *dev)
 	u16 ctlr;
 	int err;
 
+	if (!netif_running(ndev))
+		return 0;
+
 	err = clk_enable(priv->clk);
 	if (err) {
 		netdev_err(ndev, "clk_enable() failed, error %d\n", err);
@@ -881,10 +886,9 @@ static int __maybe_unused rcar_can_resume(struct device *dev)
 	writew(ctlr, &priv->regs->ctlr);
 	priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
-	if (netif_running(ndev)) {
-		netif_device_attach(ndev);
-		netif_start_queue(ndev);
-	}
+	netif_device_attach(ndev);
+	netif_start_queue(ndev);
+
 	return 0;
 }
 

From 9697ad6395f97208ca620912503a6943ea308ca0 Mon Sep 17 00:00:00 2001
From: Stephane Grosjean <s.grosjean@peak-system.com>
Date: Wed, 29 Sep 2021 16:21:10 +0200
Subject: [PATCH 0978/1750] can: peak_usb: pcan_usb_fd_decode_status(): fix
 back to ERROR_ACTIVE state notification

commit 3d031abc7e7249573148871180c28ecedb5e27df upstream.

This corrects the lack of notification of a return to ERROR_ACTIVE
state for USB - CANFD devices from PEAK-System.

Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters")
Link: https://lore.kernel.org/all/20210929142111.55757-1-s.grosjean@peak-system.com
Cc: stable@vger.kernel.org
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
index d56592283818..301a0f54fc99 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c
@@ -551,11 +551,10 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if,
 	} else if (sm->channel_p_w_b & PUCAN_BUS_WARNING) {
 		new_state = CAN_STATE_ERROR_WARNING;
 	} else {
-		/* no error bit (so, no error skb, back to active state) */
-		dev->can.state = CAN_STATE_ERROR_ACTIVE;
+		/* back to (or still in) ERROR_ACTIVE state */
+		new_state = CAN_STATE_ERROR_ACTIVE;
 		pdev->bec.txerr = 0;
 		pdev->bec.rxerr = 0;
-		return 0;
 	}
 
 	/* state hasn't changed */

From 28f28e4bc3a5e0051faa963f10b778ab38c1db69 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Thu, 14 Oct 2021 06:28:33 +0000
Subject: [PATCH 0979/1750] can: peak_pci: peak_pci_remove(): fix UAF

commit 949fe9b35570361bc6ee2652f89a0561b26eec98 upstream.

When remove the module peek_pci, referencing 'chan' again after
releasing 'dev' will cause UAF.

Fix this by releasing 'dev' later.

The following log reveals it:

[   35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537
[   35.965513 ] Call Trace:
[   35.965718 ]  dump_stack_lvl+0xa8/0xd1
[   35.966028 ]  print_address_description+0x87/0x3b0
[   35.966420 ]  kasan_report+0x172/0x1c0
[   35.966725 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967137 ]  ? trace_irq_enable_rcuidle+0x10/0x170
[   35.967529 ]  ? peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.967945 ]  __asan_report_load8_noabort+0x14/0x20
[   35.968346 ]  peak_pci_remove+0x16f/0x270 [peak_pci]
[   35.968752 ]  pci_device_remove+0xa9/0x250

Fixes: e6d9c80b7ca1 ("can: peak_pci: add support of some new PEAK-System PCI cards")
Link: https://lore.kernel.org/all/1634192913-15639-1-git-send-email-zheyuma97@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/sja1000/peak_pci.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index 4713921bd511..c3fd7cd802a9 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -731,16 +731,15 @@ static void peak_pci_remove(struct pci_dev *pdev)
 		struct net_device *prev_dev = chan->prev_dev;
 
 		dev_info(&pdev->dev, "removing device %s\n", dev->name);
+		/* do that only for first channel */
+		if (!prev_dev && chan->pciec_card)
+			peak_pciec_remove(chan->pciec_card);
 		unregister_sja1000dev(dev);
 		free_sja1000dev(dev);
 		dev = prev_dev;
 
-		if (!dev) {
-			/* do that only for first channel */
-			if (chan->pciec_card)
-				peak_pciec_remove(chan->pciec_card);
+		if (!dev)
 			break;
-		}
 		priv = netdev_priv(dev);
 		chan = priv->priv;
 	}

From 0917fb04069a51c5458a5ca95b7859de88cb61b8 Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Fri, 7 May 2021 11:18:39 +0200
Subject: [PATCH 0980/1750] can: isotp: isotp_sendmsg(): fix return error on FC
 timeout on TX path

commit d674a8f123b4096d85955c7eaabec688f29724c9 upstream.

When the a large chunk of data send and the receiver does not send a
Flow Control frame back in time, the sendmsg() does not return a error
code, but the number of bytes sent corresponding to the size of the
packet.

If a timeout occurs the isotp_tx_timer_handler() is fired, sets
sk->sk_err and calls the sk->sk_error_report() function. It was
wrongly expected that the error would be propagated to user space in
every case. For isotp_sendmsg() blocking on wait_event_interruptible()
this is not the case.

This patch fixes the problem by checking if sk->sk_err is set and
returning the error to user space.

Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://github.com/hartkopp/can-isotp/issues/42
Link: https://github.com/hartkopp/can-isotp/pull/43
Link: https://lore.kernel.org/all/20210507091839.1366379-1-mkl@pengutronix.de
Cc: stable@vger.kernel.org
Reported-by: Sottas Guillaume (LMB) <Guillaume.Sottas@liebherr.com>
Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 5fc28f190677..c3bbbf4bb847 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -953,6 +953,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	if (wait_tx_done) {
 		/* wait for complete transmission of current pdu */
 		wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+
+		if (sk->sk_err)
+			return -sk->sk_err;
 	}
 
 	return size;

From 053bc12df0d6097c1126d0e14fa778a0a8faeb64 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Sat, 9 Oct 2021 15:40:18 +0800
Subject: [PATCH 0981/1750] can: isotp: isotp_sendmsg(): add result check for
 wait_event_interruptible()

commit 9acf636215a6ce9362fe618e7da4913b8bfe84c8 upstream.

Using wait_event_interruptible() to wait for complete transmission,
but do not check the result of wait_event_interruptible() which can be
interrupted. It will result in TX buffer has multiple accessors and
the later process interferes with the previous process.

Following is one of the problems reported by syzbot.

=============================================================
WARNING: CPU: 0 PID: 0 at net/can/isotp.c:840 isotp_tx_timer_handler+0x2e0/0x4c0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.13.0-rc7+ #68
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
RIP: 0010:isotp_tx_timer_handler+0x2e0/0x4c0
Call Trace:
 <IRQ>
 ? isotp_setsockopt+0x390/0x390
 __hrtimer_run_queues+0xb8/0x610
 hrtimer_run_softirq+0x91/0xd0
 ? rcu_read_lock_sched_held+0x4d/0x80
 __do_softirq+0xe8/0x553
 irq_exit_rcu+0xf8/0x100
 sysvec_apic_timer_interrupt+0x9e/0xc0
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20

Add result check for wait_event_interruptible() in isotp_sendmsg()
to avoid multiple accessers for tx buffer.

Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/10ca695732c9dd267c76a3c30f37aefe1ff7e32f.1633764159.git.william.xuanziyang@huawei.com
Cc: stable@vger.kernel.org
Reported-by: syzbot+78bab6958a614b0c80b9@syzkaller.appspotmail.com
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index c3bbbf4bb847..9492009bc4ae 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -863,7 +863,9 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 			return -EAGAIN;
 
 		/* wait for complete transmission of current pdu */
-		wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+		err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
+		if (err)
+			return err;
 	}
 
 	if (!size || size > MAX_MSG_LENGTH)

From ecfccb1c58c9c4585cc112d24cb0f06a88ee3525 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Mon, 6 Sep 2021 17:42:19 +0800
Subject: [PATCH 0982/1750] can: j1939: j1939_tp_rxtimer(): fix errant alert in
 j1939_tp_rxtimer

commit b504a884f6b5a77dac7d580ffa08e482f70d1a30 upstream.

When the session state is J1939_SESSION_DONE, j1939_tp_rxtimer() will
give an alert "rx timeout, send abort", but do nothing actually. Move
the alert into session active judgment condition, it is more
reasonable.

One of the scenarios is that j1939_tp_rxtimer() execute followed by
j1939_xtp_rx_abort_one(). After j1939_xtp_rx_abort_one(), the session
state is J1939_SESSION_DONE, then j1939_tp_rxtimer() give an alert.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/20210906094219.95924-1-william.xuanziyang@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/transport.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index bdc95bd7a851..ea3f1ae61017 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1230,12 +1230,11 @@ static enum hrtimer_restart j1939_tp_rxtimer(struct hrtimer *hrtimer)
 		session->err = -ETIME;
 		j1939_session_deactivate(session);
 	} else {
-		netdev_alert(priv->ndev, "%s: 0x%p: rx timeout, send abort\n",
-			     __func__, session);
-
 		j1939_session_list_lock(session->priv);
 		if (session->state >= J1939_SESSION_ACTIVE &&
 		    session->state < J1939_SESSION_ACTIVE_MAX) {
+			netdev_alert(priv->ndev, "%s: 0x%p: rx timeout, send abort\n",
+				     __func__, session);
 			j1939_session_get(session);
 			hrtimer_start(&session->rxtimer,
 				      ms_to_ktime(J1939_XTP_ABORT_TIMEOUT_MS),

From 864e77771a24c877aaf53aee019f78619cbcd668 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Sun, 26 Sep 2021 18:47:57 +0800
Subject: [PATCH 0983/1750] can: j1939: j1939_netdev_start(): fix UAF for
 rx_kref of j1939_priv

commit d9d52a3ebd284882f5562c88e55991add5d01586 upstream.

It will trigger UAF for rx_kref of j1939_priv as following.

        cpu0                                    cpu1
j1939_sk_bind(socket0, ndev0, ...)
j1939_netdev_start
                                        j1939_sk_bind(socket1, ndev0, ...)
                                        j1939_netdev_start
j1939_priv_set
                                        j1939_priv_get_by_ndev_locked
j1939_jsk_add
.....
j1939_netdev_stop
kref_put_lock(&priv->rx_kref, ...)
                                        kref_get(&priv->rx_kref, ...)
                                        REFCOUNT_WARN("addition on 0;...")

====================================================
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
RIP: 0010:refcount_warn_saturate+0x169/0x1e0
Call Trace:
 j1939_netdev_start+0x68b/0x920
 j1939_sk_bind+0x426/0xeb0
 ? security_socket_bind+0x83/0xb0

The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
protect.

Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com
Cc: stable@vger.kernel.org
Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/main.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
index 6884d18f919c..266c189f1e80 100644
--- a/net/can/j1939/main.c
+++ b/net/can/j1939/main.c
@@ -249,11 +249,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
 	struct j1939_priv *priv, *priv_new;
 	int ret;
 
-	priv = j1939_priv_get_by_ndev(ndev);
+	spin_lock(&j1939_netdev_lock);
+	priv = j1939_priv_get_by_ndev_locked(ndev);
 	if (priv) {
 		kref_get(&priv->rx_kref);
+		spin_unlock(&j1939_netdev_lock);
 		return priv;
 	}
+	spin_unlock(&j1939_netdev_lock);
 
 	priv = j1939_priv_create(ndev);
 	if (!priv)
@@ -269,10 +272,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
 		/* Someone was faster than us, use their priv and roll
 		 * back our's.
 		 */
+		kref_get(&priv_new->rx_kref);
 		spin_unlock(&j1939_netdev_lock);
 		dev_put(ndev);
 		kfree(priv);
-		kref_get(&priv_new->rx_kref);
 		return priv_new;
 	}
 	j1939_priv_set(ndev, priv);

From 5abc9b9d3ca5df054aaabd10f9d99ebf5ffadeef Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Thu, 30 Sep 2021 11:33:20 +0800
Subject: [PATCH 0984/1750] can: j1939: j1939_xtp_rx_dat_one(): cancel session
 if receive TP.DT with error length

commit 379743985ab6cfe2cbd32067cf4ed497baca6d06 upstream.

According to SAE-J1939-21, the data length of TP.DT must be 8 bytes, so
cancel session when receive unexpected TP.DT message.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/1632972800-45091-1-git-send-email-zhangchangzhong@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/transport.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index ea3f1ae61017..0076280cb0b3 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1770,6 +1770,7 @@ static void j1939_xtp_rx_dpo(struct j1939_priv *priv, struct sk_buff *skb,
 static void j1939_xtp_rx_dat_one(struct j1939_session *session,
 				 struct sk_buff *skb)
 {
+	enum j1939_xtp_abort abort = J1939_XTP_ABORT_FAULT;
 	struct j1939_priv *priv = session->priv;
 	struct j1939_sk_buff_cb *skcb;
 	struct sk_buff *se_skb = NULL;
@@ -1784,9 +1785,11 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session,
 
 	skcb = j1939_skb_to_cb(skb);
 	dat = skb->data;
-	if (skb->len <= 1)
+	if (skb->len != 8) {
 		/* makes no sense */
+		abort = J1939_XTP_ABORT_UNEXPECTED_DATA;
 		goto out_session_cancel;
+	}
 
 	switch (session->last_cmd) {
 	case 0xff:
@@ -1884,7 +1887,7 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session,
  out_session_cancel:
 	kfree_skb(se_skb);
 	j1939_session_timers_cancel(session);
-	j1939_session_cancel(session, J1939_XTP_ABORT_FAULT);
+	j1939_session_cancel(session, abort);
 	j1939_session_put(session);
 }
 

From d48db508f9119a98e4bbee76da43364d879aca73 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Thu, 14 Oct 2021 17:26:40 +0800
Subject: [PATCH 0985/1750] can: j1939: j1939_xtp_rx_rts_session_new(): abort
 TP less than 9 bytes

commit a4fbe70c5cb746441d56b28cf88161d9e0e25378 upstream.

The receiver should abort TP if 'total message size' in TP.CM_RTS and
TP.CM_BAM is less than 9 or greater than 1785 [1], but currently the
j1939 stack only checks the upper bound and the receiver will accept
the following broadcast message:

  vcan1  18ECFF00   [8]  20 08 00 02 FF 00 23 01
  vcan1  18EBFF00   [8]  01 00 00 00 00 00 00 00
  vcan1  18EBFF00   [8]  02 00 FF FF FF FF FF FF

This patch adds check for the lower bound and abort illegal TP.

[1] SAE-J1939-82 A.3.4 Row 2 and A.3.6 Row 6.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/1634203601-3460-1-git-send-email-zhangchangzhong@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/j1939-priv.h | 1 +
 net/can/j1939/transport.c  | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/net/can/j1939/j1939-priv.h b/net/can/j1939/j1939-priv.h
index 12369b604ce9..cea712fb2a9e 100644
--- a/net/can/j1939/j1939-priv.h
+++ b/net/can/j1939/j1939-priv.h
@@ -326,6 +326,7 @@ int j1939_session_activate(struct j1939_session *session);
 void j1939_tp_schedule_txtimer(struct j1939_session *session, int msec);
 void j1939_session_timers_cancel(struct j1939_session *session);
 
+#define J1939_MIN_TP_PACKET_SIZE 9
 #define J1939_MAX_TP_PACKET_SIZE (7 * 0xff)
 #define J1939_MAX_ETP_PACKET_SIZE (7 * 0x00ffffff)
 
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index 0076280cb0b3..e59fbbffa31c 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -1596,6 +1596,8 @@ j1939_session *j1939_xtp_rx_rts_session_new(struct j1939_priv *priv,
 			abort = J1939_XTP_ABORT_FAULT;
 		else if (len > priv->tp_max_packet_size)
 			abort = J1939_XTP_ABORT_RESOURCE;
+		else if (len < J1939_MIN_TP_PACKET_SIZE)
+			abort = J1939_XTP_ABORT_FAULT;
 	}
 
 	if (abort != J1939_XTP_NO_ABORT) {

From 603d4bcc0fcdd99339f0b6b675fa14e140161de4 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Thu, 30 Sep 2021 08:33:13 -0400
Subject: [PATCH 0986/1750] ceph: skip existing superblocks that are
 blocklisted or shut down when mounting

commit 98d0a6fb7303a6f4a120b8b8ed05b86ff5db53e8 upstream.

Currently when mounting, we may end up finding an existing superblock
that corresponds to a blocklisted MDS client. This means that the new
mount ends up being unusable.

If we've found an existing superblock with a client that is already
blocklisted, and the client is not configured to recover on its own,
fail the match. Ditto if the superblock has been forcibly unmounted.

While we're in here, also rename "other" to the more conventional "fsc".

Cc: stable@vger.kernel.org
URL: https://bugzilla.redhat.com/show_bug.cgi?id=1901499
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/super.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index 33ba6f0aa55c..f33bfb255db8 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -997,16 +997,16 @@ static int ceph_compare_super(struct super_block *sb, struct fs_context *fc)
 	struct ceph_fs_client *new = fc->s_fs_info;
 	struct ceph_mount_options *fsopt = new->mount_options;
 	struct ceph_options *opt = new->client->options;
-	struct ceph_fs_client *other = ceph_sb_to_client(sb);
+	struct ceph_fs_client *fsc = ceph_sb_to_client(sb);
 
 	dout("ceph_compare_super %p\n", sb);
 
-	if (compare_mount_options(fsopt, opt, other)) {
+	if (compare_mount_options(fsopt, opt, fsc)) {
 		dout("monitor(s)/mount options don't match\n");
 		return 0;
 	}
 	if ((opt->flags & CEPH_OPT_FSID) &&
-	    ceph_fsid_compare(&opt->fsid, &other->client->fsid)) {
+	    ceph_fsid_compare(&opt->fsid, &fsc->client->fsid)) {
 		dout("fsid doesn't match\n");
 		return 0;
 	}
@@ -1014,6 +1014,17 @@ static int ceph_compare_super(struct super_block *sb, struct fs_context *fc)
 		dout("flags differ\n");
 		return 0;
 	}
+
+	if (fsc->blocklisted && !ceph_test_mount_opt(fsc, CLEANRECOVER)) {
+		dout("client is blocklisted (and CLEANRECOVER is not set)\n");
+		return 0;
+	}
+
+	if (fsc->mount_state == CEPH_MOUNT_SHUTDOWN) {
+		dout("client has been forcibly unmounted\n");
+		return 0;
+	}
+
 	return 1;
 }
 

From 1727e8688d2ea6e1eaf3b94621a9981cc73ce3b9 Mon Sep 17 00:00:00 2001
From: Jeff Layton <jlayton@kernel.org>
Date: Thu, 7 Oct 2021 14:19:49 -0400
Subject: [PATCH 0987/1750] ceph: fix handling of "meta" errors

commit 1bd85aa65d0e7b5e4d09240f492f37c569fdd431 upstream.

Currently, we check the wb_err too early for directories, before all of
the unsafe child requests have been waited on. In order to fix that we
need to check the mapping->wb_err later nearer to the end of ceph_fsync.

We also have an overly-complex method for tracking errors after
blocklisting. The errors recorded in cleanup_session_requests go to a
completely separate field in the inode, but we end up reporting them the
same way we would for any other error (in fsync).

There's no real benefit to tracking these errors in two different
places, since the only reporting mechanism for them is in fsync, and
we'd need to advance them both every time.

Given that, we can just remove i_meta_err, and convert the places that
used it to instead just use mapping->wb_err instead. That also fixes
the original problem by ensuring that we do a check_and_advance of the
wb_err at the end of the fsync op.

Cc: stable@vger.kernel.org
URL: https://tracker.ceph.com/issues/52864
Reported-by: Patrick Donnelly <pdonnell@redhat.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ceph/caps.c       | 12 +++---------
 fs/ceph/file.c       |  1 -
 fs/ceph/inode.c      |  2 --
 fs/ceph/mds_client.c | 17 +++++------------
 fs/ceph/super.h      |  3 ---
 5 files changed, 8 insertions(+), 27 deletions(-)

diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 48ea95b81df8..676f55195306 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2334,7 +2334,6 @@ static int unsafe_request_wait(struct inode *inode)
 
 int ceph_fsync(struct file *file, loff_t start, loff_t end, int datasync)
 {
-	struct ceph_file_info *fi = file->private_data;
 	struct inode *inode = file->f_mapping->host;
 	struct ceph_inode_info *ci = ceph_inode(inode);
 	u64 flush_tid;
@@ -2369,14 +2368,9 @@ int ceph_fsync(struct file *file, loff_t start, loff_t end, int datasync)
 	if (err < 0)
 		ret = err;
 
-	if (errseq_check(&ci->i_meta_err, READ_ONCE(fi->meta_err))) {
-		spin_lock(&file->f_lock);
-		err = errseq_check_and_advance(&ci->i_meta_err,
-					       &fi->meta_err);
-		spin_unlock(&file->f_lock);
-		if (err < 0)
-			ret = err;
-	}
+	err = file_check_and_advance_wb_err(file);
+	if (err < 0)
+		ret = err;
 out:
 	dout("fsync %p%s result=%d\n", inode, datasync ? " datasync" : "", ret);
 	return ret;
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index f1895f78ab45..8e6855e7ed83 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -233,7 +233,6 @@ static int ceph_init_file_info(struct inode *inode, struct file *file,
 
 	spin_lock_init(&fi->rw_contexts_lock);
 	INIT_LIST_HEAD(&fi->rw_contexts);
-	fi->meta_err = errseq_sample(&ci->i_meta_err);
 	fi->filp_gen = READ_ONCE(ceph_inode_to_client(inode)->filp_gen);
 
 	return 0;
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 63e781e4f7e4..76be50f6f041 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -529,8 +529,6 @@ struct inode *ceph_alloc_inode(struct super_block *sb)
 
 	ceph_fscache_inode_init(ci);
 
-	ci->i_meta_err = 0;
-
 	return &ci->vfs_inode;
 }
 
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 0f57b7d09457..76e347a8cf08 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1481,7 +1481,6 @@ static void cleanup_session_requests(struct ceph_mds_client *mdsc,
 {
 	struct ceph_mds_request *req;
 	struct rb_node *p;
-	struct ceph_inode_info *ci;
 
 	dout("cleanup_session_requests mds%d\n", session->s_mds);
 	mutex_lock(&mdsc->mutex);
@@ -1490,16 +1489,10 @@ static void cleanup_session_requests(struct ceph_mds_client *mdsc,
 				       struct ceph_mds_request, r_unsafe_item);
 		pr_warn_ratelimited(" dropping unsafe request %llu\n",
 				    req->r_tid);
-		if (req->r_target_inode) {
-			/* dropping unsafe change of inode's attributes */
-			ci = ceph_inode(req->r_target_inode);
-			errseq_set(&ci->i_meta_err, -EIO);
-		}
-		if (req->r_unsafe_dir) {
-			/* dropping unsafe directory operation */
-			ci = ceph_inode(req->r_unsafe_dir);
-			errseq_set(&ci->i_meta_err, -EIO);
-		}
+		if (req->r_target_inode)
+			mapping_set_error(req->r_target_inode->i_mapping, -EIO);
+		if (req->r_unsafe_dir)
+			mapping_set_error(req->r_unsafe_dir->i_mapping, -EIO);
 		__unregister_request(mdsc, req);
 	}
 	/* zero r_attempts, so kick_requests() will re-send requests */
@@ -1668,7 +1661,7 @@ static int remove_session_caps_cb(struct inode *inode, struct ceph_cap *cap,
 		spin_unlock(&mdsc->cap_dirty_lock);
 
 		if (dirty_dropped) {
-			errseq_set(&ci->i_meta_err, -EIO);
+			mapping_set_error(inode->i_mapping, -EIO);
 
 			if (ci->i_wrbuffer_ref_head == 0 &&
 			    ci->i_wr_ref == 0 &&
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index 9362eeb5812d..4db305fd2a02 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -430,8 +430,6 @@ struct ceph_inode_info {
 	struct fscache_cookie *fscache;
 	u32 i_fscache_gen;
 #endif
-	errseq_t i_meta_err;
-
 	struct inode vfs_inode; /* at end */
 };
 
@@ -773,7 +771,6 @@ struct ceph_file_info {
 	spinlock_t rw_contexts_lock;
 	struct list_head rw_contexts;
 
-	errseq_t meta_err;
 	u32 filp_gen;
 	atomic_t num_locks;
 };

From f1b98569e81c37d7e0deada7172f8f60860c1360 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Mon, 18 Oct 2021 15:15:39 -0700
Subject: [PATCH 0988/1750] ocfs2: fix data corruption after conversion from
 inline format

commit 5314454ea3ff6fc746eaf71b9a7ceebed52888fa upstream.

Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in
block_write_full_page()") uncovered a latent bug in ocfs2 conversion
from inline inode format to a normal inode format.

The code in ocfs2_convert_inline_data_to_extents() attempts to zero out
the whole cluster allocated for file data by grabbing, zeroing, and
dirtying all pages covering this cluster.  However these pages are
beyond i_size, thus writeback code generally ignores these dirty pages
and no blocks were ever actually zeroed on the disk.

This oversight was fixed by commit 693c241a5f6a ("ocfs2: No need to zero
pages past i_size.") for standard ocfs2 write path, inline conversion
path was apparently forgotten; the commit log also has a reasoning why
the zeroing actually is not needed.

After commit 6dbf7bb55598, things became worse as writeback code stopped
invalidating buffers on pages beyond i_size and thus these pages end up
with clean PageDirty bit but with buffers attached to these pages being
still dirty.  So when a file is converted from inline format, then
writeback triggers, and then the file is grown so that these pages
become valid, the invalid dirtiness state is preserved,
mark_buffer_dirty() does nothing on these pages (buffers are already
dirty) but page is never written back because it is clean.  So data
written to these pages is lost once pages are reclaimed.

Simple reproducer for the problem is:

  xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" \
    -c "pwrite 4000 2000" ocfs2_file

After unmounting and mounting the fs again, you can observe that end of
'ocfs2_file' has lost its contents.

Fix the problem by not doing the pointless zeroing during conversion
from inline format similarly as in the standard write path.

[akpm@linux-foundation.org: fix whitespace, per Joseph]

Link: https://lkml.kernel.org/r/20210930095405.21433-1-jack@suse.cz
Fixes: 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()")
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Tested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Acked-by: Gang He <ghe@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: "Markov, Andrey" <Markov.Andrey@Dell.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/alloc.c | 46 ++++++++++++----------------------------------
 1 file changed, 12 insertions(+), 34 deletions(-)

diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 78710788c237..a9a6276ff29b 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -7047,7 +7047,7 @@ void ocfs2_set_inode_data_inline(struct inode *inode, struct ocfs2_dinode *di)
 int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 					 struct buffer_head *di_bh)
 {
-	int ret, i, has_data, num_pages = 0;
+	int ret, has_data, num_pages = 0;
 	int need_free = 0;
 	u32 bit_off, num;
 	handle_t *handle;
@@ -7056,26 +7056,17 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
 	struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;
 	struct ocfs2_alloc_context *data_ac = NULL;
-	struct page **pages = NULL;
-	loff_t end = osb->s_clustersize;
+	struct page *page = NULL;
 	struct ocfs2_extent_tree et;
 	int did_quota = 0;
 
 	has_data = i_size_read(inode) ? 1 : 0;
 
 	if (has_data) {
-		pages = kcalloc(ocfs2_pages_per_cluster(osb->sb),
-				sizeof(struct page *), GFP_NOFS);
-		if (pages == NULL) {
-			ret = -ENOMEM;
-			mlog_errno(ret);
-			return ret;
-		}
-
 		ret = ocfs2_reserve_clusters(osb, 1, &data_ac);
 		if (ret) {
 			mlog_errno(ret);
-			goto free_pages;
+			goto out;
 		}
 	}
 
@@ -7095,7 +7086,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 	}
 
 	if (has_data) {
-		unsigned int page_end;
+		unsigned int page_end = min_t(unsigned, PAGE_SIZE,
+							osb->s_clustersize);
 		u64 phys;
 
 		ret = dquot_alloc_space_nodirty(inode,
@@ -7119,15 +7111,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 		 */
 		block = phys = ocfs2_clusters_to_blocks(inode->i_sb, bit_off);
 
-		/*
-		 * Non sparse file systems zero on extend, so no need
-		 * to do that now.
-		 */
-		if (!ocfs2_sparse_alloc(osb) &&
-		    PAGE_SIZE < osb->s_clustersize)
-			end = PAGE_SIZE;
-
-		ret = ocfs2_grab_eof_pages(inode, 0, end, pages, &num_pages);
+		ret = ocfs2_grab_eof_pages(inode, 0, page_end, &page,
+					   &num_pages);
 		if (ret) {
 			mlog_errno(ret);
 			need_free = 1;
@@ -7138,20 +7123,15 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 		 * This should populate the 1st page for us and mark
 		 * it up to date.
 		 */
-		ret = ocfs2_read_inline_data(inode, pages[0], di_bh);
+		ret = ocfs2_read_inline_data(inode, page, di_bh);
 		if (ret) {
 			mlog_errno(ret);
 			need_free = 1;
 			goto out_unlock;
 		}
 
-		page_end = PAGE_SIZE;
-		if (PAGE_SIZE > osb->s_clustersize)
-			page_end = osb->s_clustersize;
-
-		for (i = 0; i < num_pages; i++)
-			ocfs2_map_and_dirty_page(inode, handle, 0, page_end,
-						 pages[i], i > 0, &phys);
+		ocfs2_map_and_dirty_page(inode, handle, 0, page_end, page, 0,
+					 &phys);
 	}
 
 	spin_lock(&oi->ip_lock);
@@ -7182,8 +7162,8 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 	}
 
 out_unlock:
-	if (pages)
-		ocfs2_unlock_and_free_pages(pages, num_pages);
+	if (page)
+		ocfs2_unlock_and_free_pages(&page, num_pages);
 
 out_commit:
 	if (ret < 0 && did_quota)
@@ -7207,8 +7187,6 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode,
 out:
 	if (data_ac)
 		ocfs2_free_alloc_context(data_ac);
-free_pages:
-	kfree(pages);
 	return ret;
 }
 

From 93be0eeea14cf39235e585c8f56df3b3859deaad Mon Sep 17 00:00:00 2001
From: Valentin Vidic <vvidic@valentin-vidic.from.hr>
Date: Mon, 18 Oct 2021 15:15:42 -0700
Subject: [PATCH 0989/1750] ocfs2: mount fails with buffer overflow in strlen

commit b15fa9224e6e1239414525d8d556d824701849fc upstream.

Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an
ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the
trace below.  Problem seems to be that strings for cluster stack and
cluster name are not guaranteed to be null terminated in the disk
representation, while strlcpy assumes that the source string is always
null terminated.  This causes a read outside of the source string
triggering the buffer overflow detection.

  detected buffer overflow in strlen
  ------------[ cut here ]------------
  kernel BUG at lib/string.c:1149!
  invalid opcode: 0000 [#1] SMP PTI
  CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1
    Debian 5.14.6-2
  RIP: 0010:fortify_panic+0xf/0x11
  ...
  Call Trace:
   ocfs2_initialize_super.isra.0.cold+0xc/0x18 [ocfs2]
   ocfs2_fill_super+0x359/0x19b0 [ocfs2]
   mount_bdev+0x185/0x1b0
   legacy_get_tree+0x27/0x40
   vfs_get_tree+0x25/0xb0
   path_mount+0x454/0xa20
   __x64_sys_mount+0x103/0x140
   do_syscall_64+0x3b/0xc0
   entry_SYSCALL_64_after_hwframe+0x44/0xae

Link: https://lkml.kernel.org/r/20210929180654.32460-1-vvidic@valentin-vidic.from.hr
Signed-off-by: Valentin Vidic <vvidic@valentin-vidic.from.hr>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/super.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 2febc76e9de7..435f82892432 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -2171,11 +2171,17 @@ static int ocfs2_initialize_super(struct super_block *sb,
 	}
 
 	if (ocfs2_clusterinfo_valid(osb)) {
+		/*
+		 * ci_stack and ci_cluster in ocfs2_cluster_info may not be null
+		 * terminated, so make sure no overflow happens here by using
+		 * memcpy. Destination strings will always be null terminated
+		 * because osb is allocated using kzalloc.
+		 */
 		osb->osb_stackflags =
 			OCFS2_RAW_SB(di)->s_cluster_info.ci_stackflags;
-		strlcpy(osb->osb_cluster_stack,
+		memcpy(osb->osb_cluster_stack,
 		       OCFS2_RAW_SB(di)->s_cluster_info.ci_stack,
-		       OCFS2_STACK_LABEL_LEN + 1);
+		       OCFS2_STACK_LABEL_LEN);
 		if (strlen(osb->osb_cluster_stack) != OCFS2_STACK_LABEL_LEN) {
 			mlog(ML_ERROR,
 			     "couldn't mount because of an invalid "
@@ -2184,9 +2190,9 @@ static int ocfs2_initialize_super(struct super_block *sb,
 			status = -EINVAL;
 			goto bail;
 		}
-		strlcpy(osb->osb_cluster_name,
+		memcpy(osb->osb_cluster_name,
 			OCFS2_RAW_SB(di)->s_cluster_info.ci_cluster,
-			OCFS2_CLUSTER_NAME_LEN + 1);
+			OCFS2_CLUSTER_NAME_LEN);
 	} else {
 		/* The empty string is identical with classic tools that
 		 * don't know about s_cluster_info. */

From 3cda4bfffd4f755645577aaa9e96a606657b4525 Mon Sep 17 00:00:00 2001
From: Nadav Amit <namit@vmware.com>
Date: Mon, 18 Oct 2021 15:15:25 -0700
Subject: [PATCH 0990/1750] userfaultfd: fix a race between writeprotect and
 exit_mmap()

commit cb185d5f1ebf900f4ae3bf84cee212e6dd035aca upstream.

A race is possible when a process exits, its VMAs are removed by
exit_mmap() and at the same time userfaultfd_writeprotect() is called.

The race was detected by KASAN on a development kernel, but it appears
to be possible on vanilla kernels as well.

Use mmget_not_zero() to prevent the race as done in other userfaultfd
operations.

Link: https://lkml.kernel.org/r/20210921200247.25749-1-namit@vmware.com
Fixes: 63b2d4174c4ad ("userfaultfd: wp: add the writeprotect API to userfaultfd ioctl")
Signed-off-by: Nadav Amit <namit@vmware.com>
Tested-by: Li  Wang <liwang@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/userfaultfd.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 17397c7532f1..aef0da5d6f63 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1794,9 +1794,15 @@ static int userfaultfd_writeprotect(struct userfaultfd_ctx *ctx,
 	if (mode_wp && mode_dontwake)
 		return -EINVAL;
 
-	ret = mwriteprotect_range(ctx->mm, uffdio_wp.range.start,
-				  uffdio_wp.range.len, mode_wp,
-				  &ctx->mmap_changing);
+	if (mmget_not_zero(ctx->mm)) {
+		ret = mwriteprotect_range(ctx->mm, uffdio_wp.range.start,
+					  uffdio_wp.range.len, mode_wp,
+					  &ctx->mmap_changing);
+		mmput(ctx->mm);
+	} else {
+		return -ESRCH;
+	}
+
 	if (ret)
 		return ret;
 

From 895ceeff31b1f5e01ac8d5567d48215bbbcf9d97 Mon Sep 17 00:00:00 2001
From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Date: Mon, 18 Oct 2021 15:16:09 -0700
Subject: [PATCH 0991/1750] elfcore: correct reference to CONFIG_UML

commit b0e901280d9860a0a35055f220e8e457f300f40a upstream.

Commit 6e7b64b9dd6d ("elfcore: fix building with clang") introduces
special handling for two architectures, ia64 and User Mode Linux.
However, the wrong name, i.e., CONFIG_UM, for the intended Kconfig
symbol for User-Mode Linux was used.

Although the directory for User Mode Linux is ./arch/um; the Kconfig
symbol for this architecture is called CONFIG_UML.

Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs:

  UM
  Referencing files: include/linux/elfcore.h
  Similar symbols: UML, NUMA

Correct the name of the config to the intended one.

[akpm@linux-foundation.org: fix um/x86_64, per Catalin]
  Link: https://lkml.kernel.org/r/20211006181119.2851441-1-catalin.marinas@arm.com
  Link: https://lkml.kernel.org/r/YV6pejGzLy5ppEpt@arm.com

Link: https://lkml.kernel.org/r/20211006082209.417-1-lukas.bulwahn@gmail.com
Fixes: 6e7b64b9dd6d ("elfcore: fix building with clang")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Barret Rhoden <brho@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/elfcore.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
index de51c1bef27d..40e93bfa559d 100644
--- a/include/linux/elfcore.h
+++ b/include/linux/elfcore.h
@@ -104,7 +104,7 @@ static inline int elf_core_copy_task_fpregs(struct task_struct *t, struct pt_reg
 #endif
 }
 
-#if defined(CONFIG_UM) || defined(CONFIG_IA64)
+#if (defined(CONFIG_UML) && defined(CONFIG_X86_32)) || defined(CONFIG_IA64)
 /*
  * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out
  * extra segments containing the gate DSO contents.  Dumping its

From b721500c979b71a9f02eb84ca384082722c62d4e Mon Sep 17 00:00:00 2001
From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
Date: Mon, 18 Oct 2021 15:16:12 -0700
Subject: [PATCH 0992/1750] vfs: check fd has read access in
 kernel_read_file_from_fd()

commit 032146cda85566abcd1c4884d9d23e4e30a07e9a upstream.

If we open a file without read access and then pass the fd to a syscall
whose implementation calls kernel_read_file_from_fd(), we get a warning
from __kernel_read():

        if (WARN_ON_ONCE(!(file->f_mode & FMODE_READ)))

This currently affects both finit_module() and kexec_file_load(), but it
could affect other syscalls in the future.

Link: https://lkml.kernel.org/r/20211007220110.600005-1-willy@infradead.org
Fixes: b844f0ecbc56 ("vfs: define kernel_copy_file_from_fd()")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Hao Sun <sunhao.th@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/kernel_read_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/kernel_read_file.c b/fs/kernel_read_file.c
index 90d255fbdd9b..c84d87f558cb 100644
--- a/fs/kernel_read_file.c
+++ b/fs/kernel_read_file.c
@@ -178,7 +178,7 @@ int kernel_read_file_from_fd(int fd, loff_t offset, void **buf,
 	struct fd f = fdget(fd);
 	int ret = -EBADF;
 
-	if (!f.file)
+	if (!f.file || !(f.file->f_mode & FMODE_READ))
 		goto out;
 
 	ret = kernel_read_file(f.file, offset, buf, buf_size, file_size, id);

From 6411397b6d7a84eebdbdf2446c4e6f780f7e25b2 Mon Sep 17 00:00:00 2001
From: Brendan Grieve <brendan@grieve.com.au>
Date: Fri, 15 Oct 2021 10:53:35 +0800
Subject: [PATCH 0993/1750] ALSA: usb-audio: Provide quirk for Sennheiser
 GSP670 Headset

commit 3c414eb65c294719a91a746260085363413f91c1 upstream.

As per discussion at: https://github.com/szszoke/sennheiser-gsp670-pulseaudio-profile/issues/13

The GSP670 has 2 playback and 1 recording device that by default are
detected in an incompatible order for alsa. This may have been done to make
it compatible for the console by the manufacturer and only affects the
latest firmware which uses its own ID.

This quirk will resolve this by reordering the channels.

Signed-off-by: Brendan Grieve <brendan@grieve.com.au>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211015025335.196592-1-brendan@grieve.com.au
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks-table.h | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 7c649cd38049..949c6d129f2a 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3698,6 +3698,38 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
 		}
 	}
 },
+{
+	/*
+	 * Sennheiser GSP670
+	 * Change order of interfaces loaded
+	 */
+	USB_DEVICE(0x1395, 0x0300),
+	.bInterfaceClass = USB_CLASS_PER_INTERFACE,
+	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+		.ifnum = QUIRK_ANY_INTERFACE,
+		.type = QUIRK_COMPOSITE,
+		.data = &(const struct snd_usb_audio_quirk[]) {
+			// Communication
+			{
+				.ifnum = 3,
+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
+			},
+			// Recording
+			{
+				.ifnum = 4,
+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
+			},
+			// Main
+			{
+				.ifnum = 1,
+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
+			},
+			{
+				.ifnum = -1
+			}
+		}
+	}
+},
 
 #undef USB_DEVICE_VENDOR_SPEC
 #undef USB_AUDIO_DEVICE

From a2606acf418efaad368b1f49deb21191bc82837d Mon Sep 17 00:00:00 2001
From: Steven Clarkson <sc@lambdal.com>
Date: Thu, 14 Oct 2021 06:35:54 -0700
Subject: [PATCH 0994/1750] ALSA: hda/realtek: Add quirk for Clevo PC50HS

commit aef454b40288158b850aab13e3d2a8c406779401 upstream.

Apply existing PCI quirk to the Clevo PC50HS and related models to fix
audio output on the built in speakers.

Signed-off-by: Steven Clarkson <sc@lambdal.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211014133554.1326741-1-sc@lambdal.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c36239cea474..f511ae66bc8a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2547,6 +2547,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),

From 0d867a359979b368f8f00de48893d46a43440736 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 6 Oct 2021 16:17:12 +0200
Subject: [PATCH 0995/1750] ASoC: DAPM: Fix missing kctl change notifications

commit 5af82c81b2c49cfb1cad84d9eb6eab0e3d1c4842 upstream.

The put callback of a kcontrol is supposed to return 1 when the value
is changed, and this will be notified to user-space.  However, some
DAPM kcontrols always return 0 (except for errors), hence the
user-space misses the update of a control value.

This patch corrects the behavior by properly returning 1 when the
value gets updated.

Reported-and-tested-by: Hans de Goede <hdegoede@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20211006141712.2439-1-tiwai@suse.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/soc-dapm.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index f4b380d6aecf..08960167d34f 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -2559,6 +2559,7 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
 				const char *pin, int status)
 {
 	struct snd_soc_dapm_widget *w = dapm_find_widget(dapm, pin, true);
+	int ret = 0;
 
 	dapm_assert_locked(dapm);
 
@@ -2571,13 +2572,14 @@ static int snd_soc_dapm_set_pin(struct snd_soc_dapm_context *dapm,
 		dapm_mark_dirty(w, "pin configuration");
 		dapm_widget_invalidate_input_paths(w);
 		dapm_widget_invalidate_output_paths(w);
+		ret = 1;
 	}
 
 	w->connected = status;
 	if (status == 0)
 		w->force = 0;
 
-	return 0;
+	return ret;
 }
 
 /**
@@ -3582,14 +3584,15 @@ int snd_soc_dapm_put_pin_switch(struct snd_kcontrol *kcontrol,
 {
 	struct snd_soc_card *card = snd_kcontrol_chip(kcontrol);
 	const char *pin = (const char *)kcontrol->private_value;
+	int ret;
 
 	if (ucontrol->value.integer.value[0])
-		snd_soc_dapm_enable_pin(&card->dapm, pin);
+		ret = snd_soc_dapm_enable_pin(&card->dapm, pin);
 	else
-		snd_soc_dapm_disable_pin(&card->dapm, pin);
+		ret = snd_soc_dapm_disable_pin(&card->dapm, pin);
 
 	snd_soc_dapm_sync(&card->dapm);
-	return 0;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_dapm_put_pin_switch);
 
@@ -4035,7 +4038,7 @@ static int snd_soc_dapm_dai_link_put(struct snd_kcontrol *kcontrol,
 
 	rtd->params_select = ucontrol->value.enumerated.item[0];
 
-	return 0;
+	return 1;
 }
 
 static void

From 16802fa4c33eb1a8efb23f1e93365190e4047d05 Mon Sep 17 00:00:00 2001
From: Gaosheng Cui <cuigaosheng1@huawei.com>
Date: Sat, 16 Oct 2021 15:23:50 +0800
Subject: [PATCH 0996/1750] audit: fix possible null-pointer dereference in
 audit_filter_rules

commit 6e3ee990c90494561921c756481d0e2125d8b895 upstream.

Fix  possible null-pointer dereference in audit_filter_rules.

audit_filter_rules() error: we previously assumed 'ctx' could be null

Cc: stable@vger.kernel.org
Fixes: bf361231c295 ("audit: add saddr_fam filter field")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/auditsc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 8dba8f0983b5..638f424859ed 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -653,7 +653,7 @@ static int audit_filter_rules(struct task_struct *tsk,
 			result = audit_comparator(audit_loginuid_set(tsk), f->op, f->val);
 			break;
 		case AUDIT_SADDR_FAM:
-			if (ctx->sockaddr)
+			if (ctx && ctx->sockaddr)
 				result = audit_comparator(ctx->sockaddr->ss_family,
 							  f->op, f->val);
 			break;

From 3e16d9d525a7a62c40655b2747be35b674fd4dc5 Mon Sep 17 00:00:00 2001
From: DENG Qingfang <dqfext@gmail.com>
Date: Sat, 16 Oct 2021 14:24:14 +0800
Subject: [PATCH 0997/1750] net: dsa: mt7530: correct ds->num_ports

commit 342afce10d6f61c443c95e244f812d4766f73f53 upstream.

Setting ds->num_ports to DSA_MAX_PORTS made DSA core allocate unnecessary
dsa_port's and call mt7530_port_disable for non-existent ports.

Set it to MT7530_NUM_PORTS to fix that, and dsa_is_user_port check in
port_enable/disable is no longer required.

Cc: stable@vger.kernel.org
Signed-off-by: DENG Qingfang <dqfext@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/mt7530.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 73de09093c35..1f642fdbf214 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -981,9 +981,6 @@ mt7530_port_enable(struct dsa_switch *ds, int port,
 {
 	struct mt7530_priv *priv = ds->priv;
 
-	if (!dsa_is_user_port(ds, port))
-		return 0;
-
 	mutex_lock(&priv->reg_mutex);
 
 	/* Allow the user port gets connected to the cpu port and also
@@ -1006,9 +1003,6 @@ mt7530_port_disable(struct dsa_switch *ds, int port)
 {
 	struct mt7530_priv *priv = ds->priv;
 
-	if (!dsa_is_user_port(ds, port))
-		return;
-
 	mutex_lock(&priv->reg_mutex);
 
 	/* Clear up all port matrix which could be restored in the next
@@ -2593,7 +2587,7 @@ mt7530_probe(struct mdio_device *mdiodev)
 		return -ENOMEM;
 
 	priv->ds->dev = &mdiodev->dev;
-	priv->ds->num_ports = DSA_MAX_PORTS;
+	priv->ds->num_ports = MT7530_NUM_PORTS;
 
 	/* Use medatek,mcm property to distinguish hardware type that would
 	 * casues a little bit differences on power-on sequence.

From 9258f58432c5e83494cf5887a6bf59b6055b612c Mon Sep 17 00:00:00 2001
From: "Christopher M. Riedl" <cmr@codefail.de>
Date: Sat, 6 Feb 2021 01:23:42 -0600
Subject: [PATCH 0998/1750] powerpc64/idle: Fix SP offsets when saving GPRs

commit 73287caa9210ded6066833195f4335f7f688a46b upstream.

The idle entry/exit code saves/restores GPRs in the stack "red zone"
(Protected Zone according to PowerPC64 ELF ABI v2). However, the offset
used for the first GPR is incorrect and overwrites the back chain - the
Protected Zone actually starts below the current SP. In practice this is
probably not an issue, but it's still incorrect so fix it.

Also expand the comments to explain why using the stack "red zone"
instead of creating a new stackframe is appropriate here.

Signed-off-by: Christopher M. Riedl <cmr@codefail.de>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210206072342.5067-1-cmr@codefail.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/idle_book3s.S | 138 ++++++++++++++++--------------
 1 file changed, 73 insertions(+), 65 deletions(-)

diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 22f249b6f58d..f9e6d83e6720 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -52,28 +52,32 @@ _GLOBAL(isa300_idle_stop_mayloss)
 	std	r1,PACAR1(r13)
 	mflr	r4
 	mfcr	r5
-	/* use stack red zone rather than a new frame for saving regs */
-	std	r2,-8*0(r1)
-	std	r14,-8*1(r1)
-	std	r15,-8*2(r1)
-	std	r16,-8*3(r1)
-	std	r17,-8*4(r1)
-	std	r18,-8*5(r1)
-	std	r19,-8*6(r1)
-	std	r20,-8*7(r1)
-	std	r21,-8*8(r1)
-	std	r22,-8*9(r1)
-	std	r23,-8*10(r1)
-	std	r24,-8*11(r1)
-	std	r25,-8*12(r1)
-	std	r26,-8*13(r1)
-	std	r27,-8*14(r1)
-	std	r28,-8*15(r1)
-	std	r29,-8*16(r1)
-	std	r30,-8*17(r1)
-	std	r31,-8*18(r1)
-	std	r4,-8*19(r1)
-	std	r5,-8*20(r1)
+	/*
+	 * Use the stack red zone rather than a new frame for saving regs since
+	 * in the case of no GPR loss the wakeup code branches directly back to
+	 * the caller without deallocating the stack frame first.
+	 */
+	std	r2,-8*1(r1)
+	std	r14,-8*2(r1)
+	std	r15,-8*3(r1)
+	std	r16,-8*4(r1)
+	std	r17,-8*5(r1)
+	std	r18,-8*6(r1)
+	std	r19,-8*7(r1)
+	std	r20,-8*8(r1)
+	std	r21,-8*9(r1)
+	std	r22,-8*10(r1)
+	std	r23,-8*11(r1)
+	std	r24,-8*12(r1)
+	std	r25,-8*13(r1)
+	std	r26,-8*14(r1)
+	std	r27,-8*15(r1)
+	std	r28,-8*16(r1)
+	std	r29,-8*17(r1)
+	std	r30,-8*18(r1)
+	std	r31,-8*19(r1)
+	std	r4,-8*20(r1)
+	std	r5,-8*21(r1)
 	/* 168 bytes */
 	PPC_STOP
 	b	.	/* catch bugs */
@@ -89,8 +93,8 @@ _GLOBAL(isa300_idle_stop_mayloss)
  */
 _GLOBAL(idle_return_gpr_loss)
 	ld	r1,PACAR1(r13)
-	ld	r4,-8*19(r1)
-	ld	r5,-8*20(r1)
+	ld	r4,-8*20(r1)
+	ld	r5,-8*21(r1)
 	mtlr	r4
 	mtcr	r5
 	/*
@@ -98,25 +102,25 @@ _GLOBAL(idle_return_gpr_loss)
 	 * from PACATOC. This could be avoided for that less common case
 	 * if KVM saved its r2.
 	 */
-	ld	r2,-8*0(r1)
-	ld	r14,-8*1(r1)
-	ld	r15,-8*2(r1)
-	ld	r16,-8*3(r1)
-	ld	r17,-8*4(r1)
-	ld	r18,-8*5(r1)
-	ld	r19,-8*6(r1)
-	ld	r20,-8*7(r1)
-	ld	r21,-8*8(r1)
-	ld	r22,-8*9(r1)
-	ld	r23,-8*10(r1)
-	ld	r24,-8*11(r1)
-	ld	r25,-8*12(r1)
-	ld	r26,-8*13(r1)
-	ld	r27,-8*14(r1)
-	ld	r28,-8*15(r1)
-	ld	r29,-8*16(r1)
-	ld	r30,-8*17(r1)
-	ld	r31,-8*18(r1)
+	ld	r2,-8*1(r1)
+	ld	r14,-8*2(r1)
+	ld	r15,-8*3(r1)
+	ld	r16,-8*4(r1)
+	ld	r17,-8*5(r1)
+	ld	r18,-8*6(r1)
+	ld	r19,-8*7(r1)
+	ld	r20,-8*8(r1)
+	ld	r21,-8*9(r1)
+	ld	r22,-8*10(r1)
+	ld	r23,-8*11(r1)
+	ld	r24,-8*12(r1)
+	ld	r25,-8*13(r1)
+	ld	r26,-8*14(r1)
+	ld	r27,-8*15(r1)
+	ld	r28,-8*16(r1)
+	ld	r29,-8*17(r1)
+	ld	r30,-8*18(r1)
+	ld	r31,-8*19(r1)
 	blr
 
 /*
@@ -154,28 +158,32 @@ _GLOBAL(isa206_idle_insn_mayloss)
 	std	r1,PACAR1(r13)
 	mflr	r4
 	mfcr	r5
-	/* use stack red zone rather than a new frame for saving regs */
-	std	r2,-8*0(r1)
-	std	r14,-8*1(r1)
-	std	r15,-8*2(r1)
-	std	r16,-8*3(r1)
-	std	r17,-8*4(r1)
-	std	r18,-8*5(r1)
-	std	r19,-8*6(r1)
-	std	r20,-8*7(r1)
-	std	r21,-8*8(r1)
-	std	r22,-8*9(r1)
-	std	r23,-8*10(r1)
-	std	r24,-8*11(r1)
-	std	r25,-8*12(r1)
-	std	r26,-8*13(r1)
-	std	r27,-8*14(r1)
-	std	r28,-8*15(r1)
-	std	r29,-8*16(r1)
-	std	r30,-8*17(r1)
-	std	r31,-8*18(r1)
-	std	r4,-8*19(r1)
-	std	r5,-8*20(r1)
+	/*
+	 * Use the stack red zone rather than a new frame for saving regs since
+	 * in the case of no GPR loss the wakeup code branches directly back to
+	 * the caller without deallocating the stack frame first.
+	 */
+	std	r2,-8*1(r1)
+	std	r14,-8*2(r1)
+	std	r15,-8*3(r1)
+	std	r16,-8*4(r1)
+	std	r17,-8*5(r1)
+	std	r18,-8*6(r1)
+	std	r19,-8*7(r1)
+	std	r20,-8*8(r1)
+	std	r21,-8*9(r1)
+	std	r22,-8*10(r1)
+	std	r23,-8*11(r1)
+	std	r24,-8*12(r1)
+	std	r25,-8*13(r1)
+	std	r26,-8*14(r1)
+	std	r27,-8*15(r1)
+	std	r28,-8*16(r1)
+	std	r29,-8*17(r1)
+	std	r30,-8*18(r1)
+	std	r31,-8*19(r1)
+	std	r4,-8*20(r1)
+	std	r5,-8*21(r1)
 	cmpwi	r3,PNV_THREAD_NAP
 	bne	1f
 	IDLE_STATE_ENTER_SEQ_NORET(PPC_NAP)

From fbd724c49bead048ae9fc1a5b7bff2fb3e54f855 Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Fri, 15 Oct 2021 23:01:48 +1100
Subject: [PATCH 0999/1750] KVM: PPC: Book3S HV: Fix stack handling in
 idle_kvm_start_guest()

commit 9b4416c5095c20e110c82ae602c254099b83b72f upstream.

In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in
C") kvm_start_guest() became idle_kvm_start_guest(). The old code
allocated a stack frame on the emergency stack, but didn't use the
frame to store anything, and also didn't store anything in its caller's
frame.

idle_kvm_start_guest() on the other hand is written more like a normal C
function, it creates a frame on entry, and also stores CR/LR into its
callers frame (per the ABI). The problem is that there is no caller
frame on the emergency stack.

The emergency stack for a given CPU is allocated with:

  paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;

So emergency_sp actually points to the first address above the emergency
stack allocation for a given CPU, we must not store above it without
first decrementing it to create a frame. This is different to the
regular kernel stack, paca->kstack, which is initialised to point at an
initial frame that is ready to use.

idle_kvm_start_guest() stores the backchain, CR and LR all of which
write outside the allocation for the emergency stack. It then creates a
stack frame and saves the non-volatile registers. Unfortunately the
frame it creates is not large enough to fit the non-volatiles, and so
the saving of the non-volatile registers also writes outside the
emergency stack allocation.

The end result is that we corrupt whatever is at 0-24 bytes, and 112-248
bytes above the emergency stack allocation.

In practice this has gone unnoticed because the memory immediately above
the emergency stack happens to be used for other stack allocations,
either another CPUs mc_emergency_sp or an IRQ stack. See the order of
calls to irqstack_early_init() and emergency_stack_init().

The low addresses of another stack are the top of that stack, and so are
only used if that stack is under extreme pressue, which essentially
never happens in practice - and if it did there's a high likelyhood we'd
crash due to that stack overflowing.

Still, we shouldn't be corrupting someone else's stack, and it is purely
luck that we aren't corrupting something else.

To fix it we save CR/LR into the caller's frame using the existing r1 on
entry, we then create a SWITCH_FRAME_SIZE frame (which has space for
pt_regs) on the emergency stack with the backchain pointing to the
existing stack, and then finally we switch to the new frame on the
emergency stack.

Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211015133929.832061-1-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/book3s_hv_rmhandlers.S | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index 5777b72bb8b6..bde26d8ef341 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -292,13 +292,15 @@ kvm_novcpu_exit:
  * r3 contains the SRR1 wakeup value, SRR1 is trashed.
  */
 _GLOBAL(idle_kvm_start_guest)
-	ld	r4,PACAEMERGSP(r13)
 	mfcr	r5
 	mflr	r0
-	std	r1,0(r4)
-	std	r5,8(r4)
-	std	r0,16(r4)
-	subi	r1,r4,STACK_FRAME_OVERHEAD
+	std	r5, 8(r1)	// Save CR in caller's frame
+	std	r0, 16(r1)	// Save LR in caller's frame
+	// Create frame on emergency stack
+	ld	r4, PACAEMERGSP(r13)
+	stdu	r1, -SWITCH_FRAME_SIZE(r4)
+	// Switch to new frame on emergency stack
+	mr	r1, r4
 	SAVE_NVGPRS(r1)
 
 	/*
@@ -444,10 +446,9 @@ kvm_no_guest:
 	/* set up r3 for return */
 	mfspr	r3,SPRN_SRR1
 	REST_NVGPRS(r1)
-	addi	r1, r1, STACK_FRAME_OVERHEAD
-	ld	r0, 16(r1)
-	ld	r5, 8(r1)
-	ld	r1, 0(r1)
+	ld	r1, 0(r1)	// Switch back to caller stack
+	ld	r0, 16(r1)	// Reload LR
+	ld	r5, 8(r1)	// Reload CR
 	mtlr	r0
 	mtcr	r5
 	blr

From 197ec50b2df12dbfb17929eda643b16117b6f0ca Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Fri, 15 Oct 2021 23:02:08 +1100
Subject: [PATCH 1000/1750] KVM: PPC: Book3S HV: Make idle_kvm_start_guest()
 return 0 if it went to guest

commit cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 upstream.

We call idle_kvm_start_guest() from power7_offline() if the thread has
been requested to enter KVM. We pass it the SRR1 value that was returned
from power7_idle_insn() which tells us what sort of wakeup we're
processing.

Depending on the SRR1 value we pass in, the KVM code might enter the
guest, or it might return to us to do some host action if the wakeup
requires it.

If idle_kvm_start_guest() is able to handle the wakeup, and enter the
guest it is supposed to indicate that by returning a zero SRR1 value to
us.

That was the behaviour prior to commit 10d91611f426 ("powerpc/64s:
Reimplement book3s idle code in C"), however in that commit the
handling of SRR1 was reworked, and the zeroing behaviour was lost.

Returning from idle_kvm_start_guest() without zeroing the SRR1 value can
confuse the host offline code, causing the guest to crash and other
weirdness.

Fixes: 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211015133929.832061-2-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kvm/book3s_hv_rmhandlers.S | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
index bde26d8ef341..db78123166a8 100644
--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S
+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S
@@ -301,6 +301,7 @@ _GLOBAL(idle_kvm_start_guest)
 	stdu	r1, -SWITCH_FRAME_SIZE(r4)
 	// Switch to new frame on emergency stack
 	mr	r1, r4
+	std	r3, 32(r1)	// Save SRR1 wakeup value
 	SAVE_NVGPRS(r1)
 
 	/*
@@ -352,6 +353,10 @@ kvm_unsplit_wakeup:
 
 kvm_secondary_got_guest:
 
+	// About to go to guest, clear saved SRR1
+	li	r0, 0
+	std	r0, 32(r1)
+
 	/* Set HSTATE_DSCR(r13) to something sensible */
 	ld	r6, PACA_DSCR_DEFAULT(r13)
 	std	r6, HSTATE_DSCR(r13)
@@ -443,8 +448,8 @@ kvm_no_guest:
 	mfspr	r4, SPRN_LPCR
 	rlwimi	r4, r3, 0, LPCR_PECE0 | LPCR_PECE1
 	mtspr	SPRN_LPCR, r4
-	/* set up r3 for return */
-	mfspr	r3,SPRN_SRR1
+	// Return SRR1 wakeup value, or 0 if we went into the guest
+	ld	r3, 32(r1)
 	REST_NVGPRS(r1)
 	ld	r1, 0(r1)	// Switch back to caller stack
 	ld	r0, 16(r1)	// Reload LR

From c5c2a80368e97ac179d6a101c99f1e1f36146ec2 Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Wed, 20 Oct 2021 20:48:26 +1100
Subject: [PATCH 1001/1750] powerpc/idle: Don't corrupt back chain when going
 idle

commit 496c5fe25c377ddb7815c4ce8ecfb676f051e9b6 upstream.

In isa206_idle_insn_mayloss() we store various registers into the stack
red zone, which is allowed.

However inside the IDLE_STATE_ENTER_SEQ_NORET macro we save r2 again,
to 0(r1), which corrupts the stack back chain.

We used to do the same in isa206_idle_insn_mayloss() itself, but we
fixed that in 73287caa9210 ("powerpc64/idle: Fix SP offsets when saving
GPRs"), however we missed that the macro also corrupts the back chain.

Corrupting the back chain is bad for debuggability but doesn't
necessarily cause a bug.

However we recently changed the stack handling in some KVM code, and it
now relies on the stack back chain being valid when it returns. The
corruption causes that code to return with r1 pointing somewhere in
kernel data, at some point LR is restored from the stack and we branch
to NULL or somewhere else invalid.

Only affects Power8 hosts running KVM guests, with dynamic_mt_modes
enabled (which it is by default).

The fixes tag below points to the commit that changed the KVM stack
handling, exposing this bug. The actual corruption of the back chain has
always existed since 948cf67c4726 ("powerpc: Add NAP mode support on
Power7 in HV mode").

Fixes: 9b4416c5095c ("KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211020094826.3222052-1-mpe@ellerman.id.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/kernel/idle_book3s.S | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index f9e6d83e6720..b16aecaaa912 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -126,14 +126,16 @@ _GLOBAL(idle_return_gpr_loss)
 /*
  * This is the sequence required to execute idle instructions, as
  * specified in ISA v2.07 (and earlier). MSR[IR] and MSR[DR] must be 0.
- *
- * The 0(r1) slot is used to save r2 in isa206, so use that here.
+ * We have to store a GPR somewhere, ptesync, then reload it, and create
+ * a false dependency on the result of the load. It doesn't matter which
+ * GPR we store, or where we store it. We have already stored r2 to the
+ * stack at -8(r1) in isa206_idle_insn_mayloss, so use that.
  */
 #define IDLE_STATE_ENTER_SEQ_NORET(IDLE_INST)			\
 	/* Magic NAP/SLEEP/WINKLE mode enter sequence */	\
-	std	r2,0(r1);					\
+	std	r2,-8(r1);					\
 	ptesync;						\
-	ld	r2,0(r1);					\
+	ld	r2,-8(r1);					\
 236:	cmpd	cr0,r2,r2;					\
 	bne	236b;						\
 	IDLE_INST;						\

From 48843dd23c7bfcb0f0c3a02926d660f939dc2b9f Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Mon, 18 Oct 2021 15:15:55 -0700
Subject: [PATCH 1002/1750] mm, slub: fix mismatch between reconstructed
 freelist depth and cnt

commit 899447f669da76cc3605665e1a95ee877bc464cc upstream.

If object's reuse is delayed, it will be excluded from the reconstructed
freelist.  But we forgot to adjust the cnt accordingly.  So there will
be a mismatch between reconstructed freelist depth and cnt.  This will
lead to free_debug_processing() complaining about freelist count or a
incorrect slub inuse count.

Link: https://lkml.kernel.org/r/20210916123920.48704-3-linmiaohe@huawei.com
Fixes: c3895391df38 ("kasan, slub: fix handling of kasan_slab_free hook")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Bharata B Rao <bharata@linux.ibm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Faiyaz Mohammed <faiyazm@codeaurora.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Roman Gushchin <guro@fb.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slub.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/mm/slub.c b/mm/slub.c
index f5fc44208bdc..8ea137ca3279 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1543,7 +1543,8 @@ static __always_inline bool slab_free_hook(struct kmem_cache *s, void *x)
 }
 
 static inline bool slab_free_freelist_hook(struct kmem_cache *s,
-					   void **head, void **tail)
+					   void **head, void **tail,
+					   int *cnt)
 {
 
 	void *object;
@@ -1578,6 +1579,12 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
 			*head = object;
 			if (!*tail)
 				*tail = object;
+		} else {
+			/*
+			 * Adjust the reconstructed freelist depth
+			 * accordingly if object's reuse is delayed.
+			 */
+			--(*cnt);
 		}
 	} while (object != old_tail);
 
@@ -3137,7 +3144,7 @@ static __always_inline void slab_free(struct kmem_cache *s, struct page *page,
 	 * With KASAN enabled slab_free_freelist_hook modifies the freelist
 	 * to remove objects, whose reuse must be delayed.
 	 */
-	if (slab_free_freelist_hook(s, &head, &tail))
+	if (slab_free_freelist_hook(s, &head, &tail, &cnt))
 		do_slab_free(s, page, head, tail, cnt, addr);
 }
 

From 568f906340b43120abd6fcc67c37396482f85930 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Mon, 18 Oct 2021 15:15:59 -0700
Subject: [PATCH 1003/1750] mm, slub: fix potential memoryleak in
 kmem_cache_open()

commit 9037c57681d25e4dcc442d940d6dbe24dd31f461 upstream.

In error path, the random_seq of slub cache might be leaked.  Fix this
by using __kmem_cache_release() to release all the relevant resources.

Link: https://lkml.kernel.org/r/20210916123920.48704-4-linmiaohe@huawei.com
Fixes: 210e7a43fa90 ("mm: SLUB freelist randomization")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Bharata B Rao <bharata@linux.ibm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Faiyaz Mohammed <faiyazm@codeaurora.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Roman Gushchin <guro@fb.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index 8ea137ca3279..8470c428b51f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3832,8 +3832,8 @@ static int kmem_cache_open(struct kmem_cache *s, slab_flags_t flags)
 	if (alloc_kmem_cache_cpus(s))
 		return 0;
 
-	free_kmem_cache_nodes(s);
 error:
+	__kmem_cache_release(s);
 	return -EINVAL;
 }
 

From b41fd8f5d2ade45cb8b3e745705a0922e43a019a Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Mon, 18 Oct 2021 15:16:06 -0700
Subject: [PATCH 1004/1750] mm, slub: fix incorrect memcg slab count for bulk
 free

commit 3ddd60268c24bcac9d744404cc277e9dc52fe6b6 upstream.

kmem_cache_free_bulk() will call memcg_slab_free_hook() for all objects
when doing bulk free.  So we shouldn't call memcg_slab_free_hook() again
for bulk free to avoid incorrect memcg slab count.

Link: https://lkml.kernel.org/r/20210916123920.48704-6-linmiaohe@huawei.com
Fixes: d1b2cf6cb84a ("mm: memcg/slab: uncharge during kmem_cache_free_bulk()")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Bharata B Rao <bharata@linux.ibm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Faiyaz Mohammed <faiyazm@codeaurora.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Roman Gushchin <guro@fb.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/slub.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index 8470c428b51f..1384dc906833 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3100,7 +3100,9 @@ static __always_inline void do_slab_free(struct kmem_cache *s,
 	struct kmem_cache_cpu *c;
 	unsigned long tid;
 
-	memcg_slab_free_hook(s, &head, 1);
+	/* memcg_slab_free_hook() is already called for bulk free. */
+	if (!tail)
+		memcg_slab_free_hook(s, &head, 1);
 redo:
 	/*
 	 * Determine the currently cpus per cpu slab.

From 8f042315fcc46b7fc048ba7d7a3e136927e384d4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 20 Oct 2021 06:22:59 -0400
Subject: [PATCH 1005/1750] KVM: nVMX: promptly process interrupts delivered
 while in guest mode

commit 3a25dfa67fe40f3a2690af2c562e0947a78bd6a0 upstream.

Since commit c300ab9f08df ("KVM: x86: Replace late check_nested_events() hack with
more precise fix") there is no longer the certainty that check_nested_events()
tries to inject an external interrupt vmexit to L1 on every call to vcpu_enter_guest.
Therefore, even in that case we need to set KVM_REQ_EVENT.  This ensures
that inject_pending_event() is called, and from there kvm_check_nested_events().

Fixes: c300ab9f08df ("KVM: x86: Replace late check_nested_events() hack with more precise fix")
Cc: stable@vger.kernel.org
Reviewed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/vmx.c | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index e0dba0037a85..f77d98973782 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6316,18 +6316,13 @@ static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
 
 		/*
 		 * If we are running L2 and L1 has a new pending interrupt
-		 * which can be injected, we should re-evaluate
-		 * what should be done with this new L1 interrupt.
-		 * If L1 intercepts external-interrupts, we should
-		 * exit from L2 to L1. Otherwise, interrupt should be
-		 * delivered directly to L2.
+		 * which can be injected, this may cause a vmexit or it may
+		 * be injected into L2.  Either way, this interrupt will be
+		 * processed via KVM_REQ_EVENT, not RVI, because we do not use
+		 * virtual interrupt delivery to inject L1 interrupts into L2.
 		 */
-		if (is_guest_mode(vcpu) && max_irr_updated) {
-			if (nested_exit_on_intr(vcpu))
-				kvm_vcpu_exiting_guest_mode(vcpu);
-			else
-				kvm_make_request(KVM_REQ_EVENT, vcpu);
-		}
+		if (is_guest_mode(vcpu) && max_irr_updated)
+			kvm_make_request(KVM_REQ_EVENT, vcpu);
 	} else {
 		max_irr = kvm_lapic_find_highest_irr(vcpu);
 	}

From 77c0ef979e32b8bc22f36a013bab77cd37e31530 Mon Sep 17 00:00:00 2001
From: Lin Ma <linma@zju.edu.cn>
Date: Thu, 7 Oct 2021 19:44:30 +0200
Subject: [PATCH 1006/1750] nfc: nci: fix the UAF of rf_conn_info object

commit 1b1499a817c90fd1ce9453a2c98d2a01cca0e775 upstream.

The nci_core_conn_close_rsp_packet() function will release the conn_info
with given conn_id. However, it needs to set the rf_conn_info to NULL to
prevent other routines like nci_rf_intf_activated_ntf_packet() to trigger
the UAF.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/nfc/nci/rsp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
index a48297b79f34..b0ed2b47ac43 100644
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c
@@ -277,6 +277,8 @@ static void nci_core_conn_close_rsp_packet(struct nci_dev *ndev,
 							 ndev->cur_conn_id);
 		if (conn_info) {
 			list_del(&conn_info->list);
+			if (conn_info == ndev->rf_conn_info)
+				ndev->rf_conn_info = NULL;
 			devm_kfree(&ndev->nfc_dev->dev, conn_info);
 		}
 	}

From 7f221ccbee4ec662e2292d490a43ce6c314c4594 Mon Sep 17 00:00:00 2001
From: Xiaolong Huang <butterflyhuangxx@gmail.com>
Date: Fri, 8 Oct 2021 14:58:30 +0800
Subject: [PATCH 1007/1750] isdn: cpai: check ctr->cnr to avoid array index out
 of bound

commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d upstream.

The cmtp_add_connection() would add a cmtp session to a controller
and run a kernel thread to process cmtp.

	__module_get(THIS_MODULE);
	session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d",
								session->num);

During this process, the kernel thread would call detach_capi_ctr()
to detach a register controller. if the controller
was not attached yet, detach_capi_ctr() would
trigger an array-index-out-bounds bug.

[   46.866069][ T6479] UBSAN: array-index-out-of-bounds in
drivers/isdn/capi/kcapi.c:483:21
[   46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]'
[   46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted
5.15.0-rc2+ #8
[   46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX,
1996), BIOS 1.14.0-2 04/01/2014
[   46.870107][ T6479] Call Trace:
[   46.870473][ T6479]  dump_stack_lvl+0x57/0x7d
[   46.870974][ T6479]  ubsan_epilogue+0x5/0x40
[   46.871458][ T6479]  __ubsan_handle_out_of_bounds.cold+0x43/0x48
[   46.872135][ T6479]  detach_capi_ctr+0x64/0xc0
[   46.872639][ T6479]  cmtp_session+0x5c8/0x5d0
[   46.873131][ T6479]  ? __init_waitqueue_head+0x60/0x60
[   46.873712][ T6479]  ? cmtp_add_msgpart+0x120/0x120
[   46.874256][ T6479]  kthread+0x147/0x170
[   46.874709][ T6479]  ? set_kthread_struct+0x40/0x40
[   46.875248][ T6479]  ret_from_fork+0x1f/0x30
[   46.875773][ T6479]

Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211008065830.305057-1-butterflyhuangxx@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/isdn/capi/kcapi.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c
index cb0afe897162..7313454e403a 100644
--- a/drivers/isdn/capi/kcapi.c
+++ b/drivers/isdn/capi/kcapi.c
@@ -480,6 +480,11 @@ int detach_capi_ctr(struct capi_ctr *ctr)
 
 	ctr_down(ctr, CAPI_CTR_DETACHED);
 
+	if (ctr->cnr < 1 || ctr->cnr - 1 >= CAPI_MAXCONTR) {
+		err = -EINVAL;
+		goto unlock_out;
+	}
+
 	if (capi_controller[ctr->cnr - 1] != ctr) {
 		err = -EINVAL;
 		goto unlock_out;

From f8a6541345c2d384c1343a2990e16e4c696f47a1 Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@gmail.com>
Date: Tue, 5 Oct 2021 22:54:54 +0200
Subject: [PATCH 1008/1750] netfilter: Kconfig: use 'default y' instead of 'm'
 for bool config option

commit 77076934afdcd46516caf18ed88b2f88025c9ddb upstream.

This option, NF_CONNTRACK_SECMARK, is a bool, so it can never be 'm'.

Fixes: 33b8e77605620 ("[NETFILTER]: Add CONFIG_NETFILTER_ADVANCED option")
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netfilter/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 52370211e46b..6bafd3876aff 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -94,7 +94,7 @@ config NF_CONNTRACK_MARK
 config NF_CONNTRACK_SECMARK
 	bool  'Connection tracking security mark support'
 	depends on NETWORK_SECMARK
-	default m if NETFILTER_ADVANCED=n
+	default y if NETFILTER_ADVANCED=n
 	help
 	  This option enables security markings to be applied to
 	  connections.  Typically they are copied to connections from

From 0e033cb40761e50b9ed437397898cccad40def0b Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Tue, 12 Oct 2021 18:37:09 +0200
Subject: [PATCH 1009/1750] selftests: netfilter: remove stray bash debug line

commit 3e6ed7703dae6838c104d73d3e76e9b79f5c0528 upstream.

This should not be there.

Fixes: 2de03b45236f ("selftests: netfilter: add flowtable test script")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/netfilter/nft_flowtable.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/testing/selftests/netfilter/nft_flowtable.sh b/tools/testing/selftests/netfilter/nft_flowtable.sh
index 431296c0f91c..aefe50e0e4a8 100755
--- a/tools/testing/selftests/netfilter/nft_flowtable.sh
+++ b/tools/testing/selftests/netfilter/nft_flowtable.sh
@@ -199,7 +199,6 @@ fi
 # test basic connectivity
 if ! ip netns exec ns1 ping -c 1 -q 10.0.2.99 > /dev/null; then
   echo "ERROR: ns1 cannot reach ns2" 1>&2
-  bash
   exit 1
 fi
 

From 96835b68d7b39df9b25d5a08a2ffa9cb2562cffa Mon Sep 17 00:00:00 2001
From: Nikolay Aleksandrov <nikolay@nvidia.com>
Date: Fri, 15 Oct 2021 12:05:46 +0300
Subject: [PATCH 1010/1750] net: bridge: mcast: use
 multicast_membership_interval for IGMPv3

commit fac3cb82a54a4b7c49c932f96ef196cf5774344c upstream.

When I added IGMPv3 support I decided to follow the RFC for computing
the GMI dynamically:
" 8.4. Group Membership Interval

   The Group Membership Interval is the amount of time that must pass
   before a multicast router decides there are no more members of a
   group or a particular source on a network.

   This value MUST be ((the Robustness Variable) times (the Query
   Interval)) plus (one Query Response Interval)."

But that actually is inconsistent with how the bridge used to compute it
for IGMPv2, where it was user-configurable that has a correct default value
but it is up to user-space to maintain it. This would make it consistent
with the other timer values which are also maintained correct by the user
instead of being dynamically computed. It also changes back to the previous
user-expected GMI behaviour for IGMPv3 queries which were supported before
IGMPv3 was added. Note that to properly compute it dynamically we would
need to add support for "Robustness Variable" which is currently missing.

Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Fixes: 0436862e417e ("net: bridge: mcast: support for IGMPv3/MLDv2 ALLOW_NEW_SOURCES report")
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_private.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 5e5726048a1a..2b88b17cc8b2 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -931,9 +931,7 @@ static inline unsigned long br_multicast_lmqt(const struct net_bridge *br)
 
 static inline unsigned long br_multicast_gmi(const struct net_bridge *br)
 {
-	/* use the RFC default of 2 for QRV */
-	return 2 * br->multicast_query_interval +
-	       br->multicast_query_response_interval;
+	return br->multicast_membership_interval;
 }
 #else
 static inline int br_multicast_rcv(struct net_bridge *br,

From f40c2281d2c0674d32ba732fee45222d76495472 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Sat, 16 Oct 2021 23:04:46 +0200
Subject: [PATCH 1011/1750] drm: mxsfb: Fix NULL pointer dereference crash on
 unload

commit 3cfc183052c3dbf8eae57b6c1685dab00ed3db4a upstream.

The mxsfb->crtc.funcs may already be NULL when unloading the driver,
in which case calling mxsfb_irq_disable() via drm_irq_uninstall() from
mxsfb_unload() leads to NULL pointer dereference.

Since all we care about is masking the IRQ and mxsfb->base is still
valid, just use that to clear and mask the IRQ.

Fixes: ae1ed00932819 ("drm: mxsfb: Stop using DRM simple display pipeline helper")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Daniel Abrecht <public@danielabrecht.ch>
Cc: Emil Velikov <emil.l.velikov@gmail.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Stefan Agner <stefan@agner.ch>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211016210446.171616-1-marex@denx.de
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/mxsfb/mxsfb_drv.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
index f31e8ef3c258..25e422d2e7f8 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
@@ -268,7 +268,11 @@ static void mxsfb_irq_disable(struct drm_device *drm)
 	struct mxsfb_drm_private *mxsfb = drm->dev_private;
 
 	mxsfb_enable_axi_clk(mxsfb);
-	mxsfb->crtc.funcs->disable_vblank(&mxsfb->crtc);
+
+	/* Disable and clear VBLANK IRQ */
+	writel(CTRL1_CUR_FRAME_DONE_IRQ_EN, mxsfb->base + LCDC_CTRL1 + REG_CLR);
+	writel(CTRL1_CUR_FRAME_DONE_IRQ, mxsfb->base + LCDC_CTRL1 + REG_CLR);
+
 	mxsfb_disable_axi_clk(mxsfb);
 }
 

From 69078a94365a74cfbf113890ca9cc86ba1d1e5c0 Mon Sep 17 00:00:00 2001
From: Yunsheng Lin <linyunsheng@huawei.com>
Date: Tue, 19 Oct 2021 22:16:31 +0800
Subject: [PATCH 1012/1750] net: hns3: fix the max tx size according to user
 manual

commit adfb7b4966c0c4c63a791f202b8b3837b07a9ece upstream.

Currently the max tx size supported by the hw is calculated by
using the max BD num supported by the hw. According to the hw
user manual, the max tx size is fixed value for both non-TSO and
TSO skb.

This patch updates the max tx size according to the manual.

Fixes: 8ae10cfb5089("net: hns3: support tx-scatter-gather-fraglist feature")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 7 ++-----
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 6 ++----
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index e2790deb6dab..568ac6b321fa 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -1283,7 +1283,6 @@ void hns3_shinfo_pack(struct skb_shared_info *shinfo, __u32 *size)
 
 static int hns3_skb_linearize(struct hns3_enet_ring *ring,
 			      struct sk_buff *skb,
-			      u8 max_non_tso_bd_num,
 			      unsigned int bd_num)
 {
 	/* 'bd_num == UINT_MAX' means the skb' fraglist has a
@@ -1300,8 +1299,7 @@ static int hns3_skb_linearize(struct hns3_enet_ring *ring,
 	 * will not help.
 	 */
 	if (skb->len > HNS3_MAX_TSO_SIZE ||
-	    (!skb_is_gso(skb) && skb->len >
-	     HNS3_MAX_NON_TSO_SIZE(max_non_tso_bd_num))) {
+	    (!skb_is_gso(skb) && skb->len > HNS3_MAX_NON_TSO_SIZE)) {
 		u64_stats_update_begin(&ring->syncp);
 		ring->stats.hw_limitation++;
 		u64_stats_update_end(&ring->syncp);
@@ -1336,8 +1334,7 @@ static int hns3_nic_maybe_stop_tx(struct hns3_enet_ring *ring,
 			goto out;
 		}
 
-		if (hns3_skb_linearize(ring, skb, max_non_tso_bd_num,
-				       bd_num))
+		if (hns3_skb_linearize(ring, skb, bd_num))
 			return -ENOMEM;
 
 		bd_num = hns3_tx_bd_count(skb->len);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
index 398686b15a82..a8ad7ccae20e 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -170,11 +170,9 @@ enum hns3_nic_state {
 
 #define HNS3_MAX_BD_SIZE			65535
 #define HNS3_MAX_TSO_BD_NUM			63U
-#define HNS3_MAX_TSO_SIZE \
-	(HNS3_MAX_BD_SIZE * HNS3_MAX_TSO_BD_NUM)
+#define HNS3_MAX_TSO_SIZE			1048576U
+#define HNS3_MAX_NON_TSO_SIZE			9728U
 
-#define HNS3_MAX_NON_TSO_SIZE(max_non_tso_bd_num) \
-	(HNS3_MAX_BD_SIZE * (max_non_tso_bd_num))
 
 #define HNS3_VECTOR_GL0_OFFSET			0x100
 #define HNS3_VECTOR_GL1_OFFSET			0x200

From 81d8e70cdce4f4e1414943ed0f78215b1abb0027 Mon Sep 17 00:00:00 2001
From: Brendan Higgins <brendanhiggins@google.com>
Date: Wed, 29 Sep 2021 14:27:09 -0700
Subject: [PATCH 1013/1750] gcc-plugins/structleak: add makefile var for
 disabling structleak

[ Upstream commit 554afc3b9797511e3245864e32aebeb6abbab1e3 ]

KUnit and structleak don't play nice, so add a makefile variable for
enabling structleak when it complains.

Co-developed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
Reviewed-by: David Gow <davidgow@google.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/Makefile.gcc-plugins | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index 952e46876329..4aad28480035 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -19,6 +19,10 @@ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF)		\
 		+= -fplugin-arg-structleak_plugin-byref
 gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL)	\
 		+= -fplugin-arg-structleak_plugin-byref-all
+ifdef CONFIG_GCC_PLUGIN_STRUCTLEAK
+    DISABLE_STRUCTLEAK_PLUGIN += -fplugin-arg-structleak_plugin-disable
+endif
+export DISABLE_STRUCTLEAK_PLUGIN
 gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK)		\
 		+= -DSTRUCTLEAK_PLUGIN
 

From 369db2a91d5cfa55b04c919af7f5680276996e06 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 6 Oct 2021 16:19:40 +0200
Subject: [PATCH 1014/1750] ALSA: hda: intel: Allow repeatedly probing on codec
 configuration errors

[ Upstream commit c0f1886de7e173865f1a0fa7680a1c07954a987f ]

It seems that a few recent AMD systems show the codec configuration
errors at the early boot, while loading the driver at a later stage
works magically.  Although the root cause of the error isn't clear,
it's certainly not bad to allow retrying the codec probe in such a
case if that helps.

This patch adds the capability for retrying the probe upon codec probe
errors on the certain AMD platforms.  The probe_work is changed to a
delayed work, and at the secondary call, it'll jump to the codec
probing.

Note that, not only adding the re-probing, this includes the behavior
changes in the codec configuration function.  Namely,
snd_hda_codec_configure() won't unregister the codec at errors any
longer.  Instead, its caller, azx_codec_configure() unregisters the
codecs with the probe failures *if* any codec has been successfully
configured.  If all codec probe failed, it doesn't unregister but let
it re-probed -- which is the most case we're seeing and this patch
tries to improve.

Even if the driver doesn't re-probe or give up, it will go to the
"free-all" error path, hence the leftover codecs shall be disabled /
deleted in anyway.

BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1190801
Link: https://lore.kernel.org/r/20211006141940.2897-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/sound/hda_codec.h      |  1 +
 sound/pci/hda/hda_bind.c       | 20 +++++++++++---------
 sound/pci/hda/hda_codec.c      |  1 +
 sound/pci/hda/hda_controller.c | 24 ++++++++++++++++--------
 sound/pci/hda/hda_controller.h |  2 +-
 sound/pci/hda/hda_intel.c      | 29 +++++++++++++++++++++++------
 sound/pci/hda/hda_intel.h      |  4 +++-
 7 files changed, 56 insertions(+), 25 deletions(-)

diff --git a/include/sound/hda_codec.h b/include/sound/hda_codec.h
index 73827b7d17e0..cf530e9fb5f5 100644
--- a/include/sound/hda_codec.h
+++ b/include/sound/hda_codec.h
@@ -225,6 +225,7 @@ struct hda_codec {
 #endif
 
 	/* misc flags */
+	unsigned int configured:1; /* codec was configured */
 	unsigned int in_freeing:1; /* being released */
 	unsigned int registered:1; /* codec was registered */
 	unsigned int display_power_control:1; /* needs display power */
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index 17a25e453f60..4efbcc41fdfb 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -301,29 +301,31 @@ int snd_hda_codec_configure(struct hda_codec *codec)
 {
 	int err;
 
+	if (codec->configured)
+		return 0;
+
 	if (is_generic_config(codec))
 		codec->probe_id = HDA_CODEC_ID_GENERIC;
 	else
 		codec->probe_id = 0;
 
-	err = snd_hdac_device_register(&codec->core);
-	if (err < 0)
-		return err;
+	if (!device_is_registered(&codec->core.dev)) {
+		err = snd_hdac_device_register(&codec->core);
+		if (err < 0)
+			return err;
+	}
 
 	if (!codec->preset)
 		codec_bind_module(codec);
 	if (!codec->preset) {
 		err = codec_bind_generic(codec);
 		if (err < 0) {
-			codec_err(codec, "Unable to bind the codec\n");
-			goto error;
+			codec_dbg(codec, "Unable to bind the codec\n");
+			return err;
 		}
 	}
 
+	codec->configured = 1;
 	return 0;
-
- error:
-	snd_hdac_device_unregister(&codec->core);
-	return err;
 }
 EXPORT_SYMBOL_GPL(snd_hda_codec_configure);
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 4cec1bd77e6f..6dece719be66 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -791,6 +791,7 @@ void snd_hda_codec_cleanup_for_unbind(struct hda_codec *codec)
 	snd_array_free(&codec->nids);
 	remove_conn_list(codec);
 	snd_hdac_regmap_exit(&codec->core);
+	codec->configured = 0;
 }
 EXPORT_SYMBOL_GPL(snd_hda_codec_cleanup_for_unbind);
 
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index b972d59eb1ec..3de7dc34def2 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -25,6 +25,7 @@
 #include <sound/core.h>
 #include <sound/initval.h>
 #include "hda_controller.h"
+#include "hda_local.h"
 
 #define CREATE_TRACE_POINTS
 #include "hda_controller_trace.h"
@@ -1259,17 +1260,24 @@ EXPORT_SYMBOL_GPL(azx_probe_codecs);
 int azx_codec_configure(struct azx *chip)
 {
 	struct hda_codec *codec, *next;
+	int success = 0;
 
-	/* use _safe version here since snd_hda_codec_configure() deregisters
-	 * the device upon error and deletes itself from the bus list.
-	 */
-	list_for_each_codec_safe(codec, next, &chip->bus) {
-		snd_hda_codec_configure(codec);
+	list_for_each_codec(codec, &chip->bus) {
+		if (!snd_hda_codec_configure(codec))
+			success++;
 	}
 
-	if (!azx_bus(chip)->num_codecs)
-		return -ENODEV;
-	return 0;
+	if (success) {
+		/* unregister failed codecs if any codec has been probed */
+		list_for_each_codec_safe(codec, next, &chip->bus) {
+			if (!codec->configured) {
+				codec_err(codec, "Unable to configure, disabling\n");
+				snd_hdac_device_unregister(&codec->core);
+			}
+		}
+	}
+
+	return success ? 0 : -ENODEV;
 }
 EXPORT_SYMBOL_GPL(azx_codec_configure);
 
diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
index 68f9668788ea..324cba13c7ba 100644
--- a/sound/pci/hda/hda_controller.h
+++ b/sound/pci/hda/hda_controller.h
@@ -41,7 +41,7 @@
 /* 24 unused */
 #define AZX_DCAPS_COUNT_LPIB_DELAY  (1 << 25)	/* Take LPIB as delay */
 #define AZX_DCAPS_PM_RUNTIME	(1 << 26)	/* runtime PM support */
-/* 27 unused */
+#define AZX_DCAPS_RETRY_PROBE	(1 << 27)	/* retry probe if no codec is configured */
 #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28)	/* CORBRP clears itself after reset */
 #define AZX_DCAPS_NO_MSI64      (1 << 29)	/* Stick to 32-bit MSIs */
 #define AZX_DCAPS_SEPARATE_STREAM_TAG	(1 << 30) /* capture and playback use separate stream tag */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 4c8b281c3992..8bc27e7c0590 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -341,7 +341,8 @@ enum {
 /* quirks for AMD SB */
 #define AZX_DCAPS_PRESET_AMD_SB \
 	(AZX_DCAPS_NO_TCSEL | AZX_DCAPS_AMD_WORKAROUND |\
-	 AZX_DCAPS_SNOOP_TYPE(ATI) | AZX_DCAPS_PM_RUNTIME)
+	 AZX_DCAPS_SNOOP_TYPE(ATI) | AZX_DCAPS_PM_RUNTIME |\
+	 AZX_DCAPS_RETRY_PROBE)
 
 /* quirks for Nvidia */
 #define AZX_DCAPS_PRESET_NVIDIA \
@@ -1758,7 +1759,7 @@ static void azx_check_snoop_available(struct azx *chip)
 
 static void azx_probe_work(struct work_struct *work)
 {
-	struct hda_intel *hda = container_of(work, struct hda_intel, probe_work);
+	struct hda_intel *hda = container_of(work, struct hda_intel, probe_work.work);
 	azx_probe_continue(&hda->chip);
 }
 
@@ -1867,7 +1868,7 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
 	}
 
 	/* continue probing in work context as may trigger request module */
-	INIT_WORK(&hda->probe_work, azx_probe_work);
+	INIT_DELAYED_WORK(&hda->probe_work, azx_probe_work);
 
 	*rchip = chip;
 
@@ -2202,7 +2203,7 @@ static int azx_probe(struct pci_dev *pci,
 #endif
 
 	if (schedule_probe)
-		schedule_work(&hda->probe_work);
+		schedule_delayed_work(&hda->probe_work, 0);
 
 	dev++;
 	if (chip->disabled)
@@ -2290,6 +2291,11 @@ static int azx_probe_continue(struct azx *chip)
 	int dev = chip->dev_index;
 	int err;
 
+	if (chip->disabled || hda->init_failed)
+		return -EIO;
+	if (hda->probe_retry)
+		goto probe_retry;
+
 	to_hda_bus(bus)->bus_probing = 1;
 	hda->probe_continued = 1;
 
@@ -2351,10 +2357,20 @@ static int azx_probe_continue(struct azx *chip)
 #endif
 	}
 #endif
+
+ probe_retry:
 	if (bus->codec_mask && !(probe_only[dev] & 1)) {
 		err = azx_codec_configure(chip);
-		if (err < 0)
+		if (err) {
+			if ((chip->driver_caps & AZX_DCAPS_RETRY_PROBE) &&
+			    ++hda->probe_retry < 60) {
+				schedule_delayed_work(&hda->probe_work,
+						      msecs_to_jiffies(1000));
+				return 0; /* keep things up */
+			}
+			dev_err(chip->card->dev, "Cannot probe codecs, giving up\n");
 			goto out_free;
+		}
 	}
 
 	err = snd_card_register(chip->card);
@@ -2384,6 +2400,7 @@ static int azx_probe_continue(struct azx *chip)
 		display_power(chip, false);
 	complete_all(&hda->probe_wait);
 	to_hda_bus(bus)->bus_probing = 0;
+	hda->probe_retry = 0;
 	return 0;
 }
 
@@ -2409,7 +2426,7 @@ static void azx_remove(struct pci_dev *pci)
 		 * device during cancel_work_sync() call.
 		 */
 		device_unlock(&pci->dev);
-		cancel_work_sync(&hda->probe_work);
+		cancel_delayed_work_sync(&hda->probe_work);
 		device_lock(&pci->dev);
 
 		snd_card_free(card);
diff --git a/sound/pci/hda/hda_intel.h b/sound/pci/hda/hda_intel.h
index 3fb119f09040..0f39418f9328 100644
--- a/sound/pci/hda/hda_intel.h
+++ b/sound/pci/hda/hda_intel.h
@@ -14,7 +14,7 @@ struct hda_intel {
 
 	/* sync probing */
 	struct completion probe_wait;
-	struct work_struct probe_work;
+	struct delayed_work probe_work;
 
 	/* card list (for power_save trigger) */
 	struct list_head list;
@@ -30,6 +30,8 @@ struct hda_intel {
 	unsigned int freed:1; /* resources already released */
 
 	bool need_i915_power:1; /* the hda controller needs i915 power */
+
+	int probe_retry;	/* being probe-retry */
 };
 
 #endif

From f9d16a4284890bbcfa0888b02a718c1bae8168b3 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Fri, 1 Oct 2021 13:52:30 +0100
Subject: [PATCH 1015/1750] btrfs: deal with errors when checking if a dir
 entry exists during log replay

[ Upstream commit 77a5b9e3d14cbce49ceed2766b2003c034c066dc ]

Currently inode_in_dir() ignores errors returned from
btrfs_lookup_dir_index_item() and from btrfs_lookup_dir_item(), treating
any errors as if the directory entry does not exists in the fs/subvolume
tree, which is obviously not correct, as we can get errors such as -EIO
when reading extent buffers while searching the fs/subvolume's tree.

Fix that by making inode_in_dir() return the errors and making its only
caller, add_inode_ref(), deal with returned errors as well.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/tree-log.c | 47 ++++++++++++++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 18 deletions(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c3bb5c4375ab..3b93a98fd544 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -894,9 +894,11 @@ static noinline int drop_one_dir_item(struct btrfs_trans_handle *trans,
 }
 
 /*
- * helper function to see if a given name and sequence number found
- * in an inode back reference are already in a directory and correctly
- * point to this inode
+ * See if a given name and sequence number found in an inode back reference are
+ * already in a directory and correctly point to this inode.
+ *
+ * Returns: < 0 on error, 0 if the directory entry does not exists and 1 if it
+ * exists.
  */
 static noinline int inode_in_dir(struct btrfs_root *root,
 				 struct btrfs_path *path,
@@ -905,29 +907,35 @@ static noinline int inode_in_dir(struct btrfs_root *root,
 {
 	struct btrfs_dir_item *di;
 	struct btrfs_key location;
-	int match = 0;
+	int ret = 0;
 
 	di = btrfs_lookup_dir_index_item(NULL, root, path, dirid,
 					 index, name, name_len, 0);
-	if (di && !IS_ERR(di)) {
+	if (IS_ERR(di)) {
+		if (PTR_ERR(di) != -ENOENT)
+			ret = PTR_ERR(di);
+		goto out;
+	} else if (di) {
 		btrfs_dir_item_key_to_cpu(path->nodes[0], di, &location);
 		if (location.objectid != objectid)
 			goto out;
-	} else
+	} else {
 		goto out;
-	btrfs_release_path(path);
+	}
 
+	btrfs_release_path(path);
 	di = btrfs_lookup_dir_item(NULL, root, path, dirid, name, name_len, 0);
-	if (di && !IS_ERR(di)) {
-		btrfs_dir_item_key_to_cpu(path->nodes[0], di, &location);
-		if (location.objectid != objectid)
-			goto out;
-	} else
+	if (IS_ERR(di)) {
+		ret = PTR_ERR(di);
 		goto out;
-	match = 1;
+	} else if (di) {
+		btrfs_dir_item_key_to_cpu(path->nodes[0], di, &location);
+		if (location.objectid == objectid)
+			ret = 1;
+	}
 out:
 	btrfs_release_path(path);
-	return match;
+	return ret;
 }
 
 /*
@@ -1477,10 +1485,12 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
 		if (ret)
 			goto out;
 
-		/* if we already have a perfect match, we're done */
-		if (!inode_in_dir(root, path, btrfs_ino(BTRFS_I(dir)),
-					btrfs_ino(BTRFS_I(inode)), ref_index,
-					name, namelen)) {
+		ret = inode_in_dir(root, path, btrfs_ino(BTRFS_I(dir)),
+				   btrfs_ino(BTRFS_I(inode)), ref_index,
+				   name, namelen);
+		if (ret < 0) {
+			goto out;
+		} else if (ret == 0) {
 			/*
 			 * look for a conflicting back reference in the
 			 * metadata. if we find one we have to unlink that name
@@ -1538,6 +1548,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,
 
 			btrfs_update_inode(trans, root, inode);
 		}
+		/* Else, ret == 1, we already have a perfect match, we're done. */
 
 		ref_ptr = (unsigned long)(ref_ptr + ref_struct_size) + namelen;
 		kfree(name);

From 15d3ad79885b91d9bdcaa102027021d447b89ea5 Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Fri, 8 Oct 2021 12:34:39 +0200
Subject: [PATCH 1016/1750] net: stmmac: add support for dwmac 3.40a

[ Upstream commit 9cb1d19f47fafad7dcf7c8564e633440c946cfd7 ]

dwmac 3.40a is an old ip version that can be found on SPEAr3xx soc.

Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c   | 1 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
index fad503820e04..b3365b34cac7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
@@ -71,6 +71,7 @@ static int dwmac_generic_probe(struct platform_device *pdev)
 
 static const struct of_device_id dwmac_generic_match[] = {
 	{ .compatible = "st,spear600-gmac"},
+	{ .compatible = "snps,dwmac-3.40a"},
 	{ .compatible = "snps,dwmac-3.50a"},
 	{ .compatible = "snps,dwmac-3.610"},
 	{ .compatible = "snps,dwmac-3.70a"},
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 53be8fc1d125..48186cd32ce1 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -508,6 +508,14 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
 		plat->pmt = 1;
 	}
 
+	if (of_device_is_compatible(np, "snps,dwmac-3.40a")) {
+		plat->has_gmac = 1;
+		plat->enh_desc = 1;
+		plat->tx_coe = 1;
+		plat->bugged_jumbo = 1;
+		plat->pmt = 1;
+	}
+
 	if (of_device_is_compatible(np, "snps,dwmac-4.00") ||
 	    of_device_is_compatible(np, "snps,dwmac-4.10a") ||
 	    of_device_is_compatible(np, "snps,dwmac-4.20a") ||

From ab4f542b515b694ecb7d7a73a4e7e908528a7cfe Mon Sep 17 00:00:00 2001
From: Herve Codina <herve.codina@bootlin.com>
Date: Fri, 8 Oct 2021 12:34:40 +0200
Subject: [PATCH 1017/1750] ARM: dts: spear3xx: Fix gmac node

[ Upstream commit 6636fec29cdf6665bd219564609e8651f6ddc142 ]

On SPEAr3xx, ethernet driver is not compatible with the SPEAr600
one.
Indeed, SPEAr3xx uses an earlier version of this IP (v3.40) and
needs some driver tuning compare to SPEAr600.

The v3.40 IP support was added to stmmac driver and this patch
fixes this issue and use the correct compatible string for
SPEAr3xx

Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/spear3xx.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/spear3xx.dtsi b/arch/arm/boot/dts/spear3xx.dtsi
index f266b7b03482..cc88ebe7a60c 100644
--- a/arch/arm/boot/dts/spear3xx.dtsi
+++ b/arch/arm/boot/dts/spear3xx.dtsi
@@ -47,7 +47,7 @@ dma@fc400000 {
 		};
 
 		gmac: eth@e0800000 {
-			compatible = "st,spear600-gmac";
+			compatible = "snps,dwmac-3.40a";
 			reg = <0xe0800000 0x8000>;
 			interrupts = <23 22>;
 			interrupt-names = "macirq", "eth_wake_irq";

From 9f591cbdbed3d7822b2bdba89b34a6d7b434317d Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Sat, 9 Oct 2021 11:33:49 +0000
Subject: [PATCH 1018/1750] isdn: mISDN: Fix sleeping function called from
 invalid context

[ Upstream commit 6510e80a0b81b5d814e3aea6297ba42f5e76f73c ]

The driver can call card->isac.release() function from an atomic
context.

Fix this by calling this function after releasing the lock.

The following log reveals it:

[   44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018
[   44.168941 ] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5475, name: modprobe
[   44.169574 ] INFO: lockdep is turned off.
[   44.169899 ] irq event stamp: 0
[   44.170160 ] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[   44.170627 ] hardirqs last disabled at (0): [<ffffffff814209ed>] copy_process+0x132d/0x3e00
[   44.171240 ] softirqs last  enabled at (0): [<ffffffff81420a1a>] copy_process+0x135a/0x3e00
[   44.171852 ] softirqs last disabled at (0): [<0000000000000000>] 0x0
[   44.172318 ] Preemption disabled at:
[   44.172320 ] [<ffffffffa009b0a9>] nj_release+0x69/0x500 [netjet]
[   44.174441 ] Call Trace:
[   44.174630 ]  dump_stack_lvl+0xa8/0xd1
[   44.174912 ]  dump_stack+0x15/0x17
[   44.175166 ]  ___might_sleep+0x3a2/0x510
[   44.175459 ]  ? nj_release+0x69/0x500 [netjet]
[   44.175791 ]  __might_sleep+0x82/0xe0
[   44.176063 ]  ? start_flush_work+0x20/0x7b0
[   44.176375 ]  start_flush_work+0x33/0x7b0
[   44.176672 ]  ? trace_irq_enable_rcuidle+0x85/0x170
[   44.177034 ]  ? kasan_quarantine_put+0xaa/0x1f0
[   44.177372 ]  ? kasan_quarantine_put+0xaa/0x1f0
[   44.177711 ]  __flush_work+0x11a/0x1a0
[   44.177991 ]  ? flush_work+0x20/0x20
[   44.178257 ]  ? lock_release+0x13c/0x8f0
[   44.178550 ]  ? __kasan_check_write+0x14/0x20
[   44.178872 ]  ? do_raw_spin_lock+0x148/0x360
[   44.179187 ]  ? read_lock_is_recursive+0x20/0x20
[   44.179530 ]  ? __kasan_check_read+0x11/0x20
[   44.179846 ]  ? do_raw_spin_unlock+0x55/0x900
[   44.180168 ]  ? ____kasan_slab_free+0x116/0x140
[   44.180505 ]  ? _raw_spin_unlock_irqrestore+0x41/0x60
[   44.180878 ]  ? skb_queue_purge+0x1a3/0x1c0
[   44.181189 ]  ? kfree+0x13e/0x290
[   44.181438 ]  flush_work+0x17/0x20
[   44.181695 ]  mISDN_freedchannel+0xe8/0x100
[   44.182006 ]  isac_release+0x210/0x260 [mISDNipac]
[   44.182366 ]  nj_release+0xf6/0x500 [netjet]
[   44.182685 ]  nj_remove+0x48/0x70 [netjet]
[   44.182989 ]  pci_device_remove+0xa9/0x250

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/netjet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c
index 2a1ddd47a096..a52f275f8263 100644
--- a/drivers/isdn/hardware/mISDN/netjet.c
+++ b/drivers/isdn/hardware/mISDN/netjet.c
@@ -949,8 +949,8 @@ nj_release(struct tiger_hw *card)
 		nj_disable_hwirq(card);
 		mode_tiger(&card->bc[0], ISDN_P_NONE);
 		mode_tiger(&card->bc[1], ISDN_P_NONE);
-		card->isac.release(&card->isac);
 		spin_unlock_irqrestore(&card->lock, flags);
+		card->isac.release(&card->isac);
 		release_region(card->base, card->base_s);
 		card->base_s = 0;
 	}

From 85c8d8c1609df3038801b45989b6ae18ef03c265 Mon Sep 17 00:00:00 2001
From: Prashant Malani <pmalani@chromium.org>
Date: Tue, 28 Sep 2021 03:19:34 -0700
Subject: [PATCH 1019/1750] platform/x86: intel_scu_ipc: Update timeout value
 in comment

[ Upstream commit a0c5814b9933f25ecb6de169483c5b88cf632bca ]

The comment decribing the IPC timeout hadn't been updated when the
actual timeout was changed from 3 to 5 seconds in
commit a7d53dbbc70a ("platform/x86: intel_scu_ipc: Increase virtual
timeout from 3 to 5 seconds") .

Since the value is anyway updated to 10s now, take this opportunity to
update the value in the comment too.

Signed-off-by: Prashant Malani <pmalani@chromium.org>
Cc: Benson Leung <bleung@chromium.org>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://lore.kernel.org/r/20210928101932.2543937-4-pmalani@chromium.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/intel_scu_ipc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/intel_scu_ipc.c b/drivers/platform/x86/intel_scu_ipc.c
index 425d2064148f..69d706039cb2 100644
--- a/drivers/platform/x86/intel_scu_ipc.c
+++ b/drivers/platform/x86/intel_scu_ipc.c
@@ -247,7 +247,7 @@ static inline int busy_loop(struct intel_scu_ipc_dev *scu)
 	return -ETIMEDOUT;
 }
 
-/* Wait till ipc ioc interrupt is received or timeout in 3 HZ */
+/* Wait till ipc ioc interrupt is received or timeout in 10 HZ */
 static inline int ipc_wait_for_interrupt(struct intel_scu_ipc_dev *scu)
 {
 	int status;

From e56a3e7ae3533ae1bf2dc742cf3538e459324340 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Tue, 12 Oct 2021 17:29:35 +0300
Subject: [PATCH 1020/1750] ALSA: hda: avoid write to STATESTS if controller is
 in reset

[ Upstream commit b37a15188eae9d4c49c5bb035e0c8d4058e4d9b3 ]

The snd_hdac_bus_reset_link() contains logic to clear STATESTS register
before performing controller reset. This code dates back to an old
bugfix in commit e8a7f136f5ed ("[ALSA] hda-intel - Improve HD-audio
codec probing robustness"). Originally the code was added to
azx_reset().

The code was moved around in commit a41d122449be ("ALSA: hda - Embed bus
into controller object") and ended up to snd_hdac_bus_reset_link() and
called primarily via snd_hdac_bus_init_chip().

The logic to clear STATESTS is correct when snd_hdac_bus_init_chip() is
called when controller is not in reset. In this case, STATESTS can be
cleared. This can be useful e.g. when forcing a controller reset to retry
codec probe. A normal non-power-on reset will not clear the bits.

However, this old logic is problematic when controller is already in
reset. The HDA specification states that controller must be taken out of
reset before writing to registers other than GCTL.CRST (1.0a spec,
3.3.7). The write to STATESTS in snd_hdac_bus_reset_link() will be lost
if the controller is already in reset per the HDA specification mentioned.

This has been harmless on older hardware. On newer generation of Intel
PCIe based HDA controllers, if configured to report issues, this write
will emit an unsupported request error. If ACPI Platform Error Interface
(APEI) is enabled in kernel, this will end up to kernel log.

Fix the code in snd_hdac_bus_reset_link() to only clear the STATESTS if
the function is called when controller is not in reset. Otherwise
clearing the bits is not possible and should be skipped.

Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Link: https://lore.kernel.org/r/20211012142935.3731820-1-kai.vehmanen@linux.intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/hda/hdac_controller.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
index b98449fd92f3..522d1897659c 100644
--- a/sound/hda/hdac_controller.c
+++ b/sound/hda/hdac_controller.c
@@ -421,8 +421,9 @@ int snd_hdac_bus_reset_link(struct hdac_bus *bus, bool full_reset)
 	if (!full_reset)
 		goto skip_reset;
 
-	/* clear STATESTS */
-	snd_hdac_chip_writew(bus, STATESTS, STATESTS_INT_MASK);
+	/* clear STATESTS if not in reset */
+	if (snd_hdac_chip_readb(bus, GCTL) & AZX_GCTL_RESET)
+		snd_hdac_chip_writew(bus, STATESTS, STATESTS_INT_MASK);
 
 	/* reset controller */
 	snd_hdac_bus_enter_link_reset(bus);

From 7a5a1f09c8b45685a2336d418b5a49439c190e92 Mon Sep 17 00:00:00 2001
From: Shunsuke Nakamura <nakamura.shun@fujitsu.com>
Date: Mon, 11 Oct 2021 17:37:04 +0900
Subject: [PATCH 1021/1750] libperf tests: Fix test_stat_cpu

[ Upstream commit 3ff6d64e68abc231955d216236615918797614ae ]

The `cpu` argument of perf_evsel__read() must specify the cpu index.

perf_cpu_map__for_each_cpu() is for iterating the cpu number (not index)
and is thus not appropriate for use with perf_evsel__read().

So, if there is an offline CPU, the cpu number specified in the argument
may point out of range because the cpu number and the cpu index are
different.

Fix test_stat_cpu().

Testing it:

  # make tests -C tools/lib/perf/
  make: Entering directory '/home/nakamura/kernel_src/linux-5.15-rc4_fix/tools/lib/perf'
  running static:
  - running tests/test-cpumap.c...OK
  - running tests/test-threadmap.c...OK
  - running tests/test-evlist.c...OK
  - running tests/test-evsel.c...OK
  running dynamic:
  - running tests/test-cpumap.c...OK
  - running tests/test-threadmap.c...OK
  - running tests/test-evlist.c...OK
  - running tests/test-evsel.c...OK
  make: Leaving directory '/home/nakamura/kernel_src/linux-5.15-rc4_fix/tools/lib/perf'

Signed-off-by: Shunsuke Nakamura <nakamura.shun@fujitsu.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20211011083704.4108720-1-nakamura.shun@fujitsu.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/perf/tests/test-evlist.c | 6 +++---
 tools/lib/perf/tests/test-evsel.c  | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/tools/lib/perf/tests/test-evlist.c b/tools/lib/perf/tests/test-evlist.c
index bd19cabddaf6..60b5d1801103 100644
--- a/tools/lib/perf/tests/test-evlist.c
+++ b/tools/lib/perf/tests/test-evlist.c
@@ -38,7 +38,7 @@ static int test_stat_cpu(void)
 		.type	= PERF_TYPE_SOFTWARE,
 		.config	= PERF_COUNT_SW_TASK_CLOCK,
 	};
-	int err, cpu, tmp;
+	int err, idx;
 
 	cpus = perf_cpu_map__new(NULL);
 	__T("failed to create cpus", cpus);
@@ -64,10 +64,10 @@ static int test_stat_cpu(void)
 	perf_evlist__for_each_evsel(evlist, evsel) {
 		cpus = perf_evsel__cpus(evsel);
 
-		perf_cpu_map__for_each_cpu(cpu, tmp, cpus) {
+		for (idx = 0; idx < perf_cpu_map__nr(cpus); idx++) {
 			struct perf_counts_values counts = { .val = 0 };
 
-			perf_evsel__read(evsel, cpu, 0, &counts);
+			perf_evsel__read(evsel, idx, 0, &counts);
 			__T("failed to read value for evsel", counts.val != 0);
 		}
 	}
diff --git a/tools/lib/perf/tests/test-evsel.c b/tools/lib/perf/tests/test-evsel.c
index 0ad82d7a2a51..2de98768d844 100644
--- a/tools/lib/perf/tests/test-evsel.c
+++ b/tools/lib/perf/tests/test-evsel.c
@@ -21,7 +21,7 @@ static int test_stat_cpu(void)
 		.type	= PERF_TYPE_SOFTWARE,
 		.config	= PERF_COUNT_SW_CPU_CLOCK,
 	};
-	int err, cpu, tmp;
+	int err, idx;
 
 	cpus = perf_cpu_map__new(NULL);
 	__T("failed to create cpus", cpus);
@@ -32,10 +32,10 @@ static int test_stat_cpu(void)
 	err = perf_evsel__open(evsel, cpus, NULL);
 	__T("failed to open evsel", err == 0);
 
-	perf_cpu_map__for_each_cpu(cpu, tmp, cpus) {
+	for (idx = 0; idx < perf_cpu_map__nr(cpus); idx++) {
 		struct perf_counts_values counts = { .val = 0 };
 
-		perf_evsel__read(evsel, cpu, 0, &counts);
+		perf_evsel__read(evsel, idx, 0, &counts);
 		__T("failed to read value for evsel", counts.val != 0);
 	}
 

From ea9c1f5d8a3add8d47986460513660ff24ef66bb Mon Sep 17 00:00:00 2001
From: Kan Liang <kan.liang@linux.intel.com>
Date: Wed, 6 Oct 2021 13:12:17 -0700
Subject: [PATCH 1022/1750] perf/x86/msr: Add Sapphire Rapids CPU support

[ Upstream commit 71920ea97d6d1d800ee8b51951dc3fda3f5dc698 ]

SMI_COUNT MSR is supported on Sapphire Rapids CPU.

Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/1633551137-192083-1-git-send-email-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/events/msr.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c
index 4be8f9cabd07..ca8ce64df2ce 100644
--- a/arch/x86/events/msr.c
+++ b/arch/x86/events/msr.c
@@ -68,6 +68,7 @@ static bool test_intel(int idx, void *data)
 	case INTEL_FAM6_BROADWELL_D:
 	case INTEL_FAM6_BROADWELL_G:
 	case INTEL_FAM6_BROADWELL_X:
+	case INTEL_FAM6_SAPPHIRERAPIDS_X:
 
 	case INTEL_FAM6_ATOM_SILVERMONT:
 	case INTEL_FAM6_ATOM_SILVERMONT_D:

From 0eb254479685b21ba8e2387a85746cff1b93d10a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
Date: Fri, 15 Oct 2021 21:19:33 -0700
Subject: [PATCH 1023/1750] Input: snvs_pwrkey - add clk handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d997cc1715df7b6c3df798881fb9941acf0079f8 ]

On i.MX7S and i.MX8M* (but not i.MX6*) the pwrkey device has an
associated clock. Accessing the registers requires that this clock is
enabled. Binding the driver on at least i.MX7S and i.MX8MP while not
having the clock enabled results in a complete hang of the machine.
(This usually only happens if snvs_pwrkey is built as a module and the
rtc-snvs driver isn't already bound because at bootup the required clk
is on and only gets disabled when the clk framework disables unused clks
late during boot.)

This completes the fix in commit 135be16d3505 ("ARM: dts: imx7s: add
snvs clock to pwrkey").

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20211013062848.2667192-1-u.kleine-koenig@pengutronix.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/keyboard/snvs_pwrkey.c | 29 ++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/drivers/input/keyboard/snvs_pwrkey.c b/drivers/input/keyboard/snvs_pwrkey.c
index 2f5e3ab5ed63..65286762b02a 100644
--- a/drivers/input/keyboard/snvs_pwrkey.c
+++ b/drivers/input/keyboard/snvs_pwrkey.c
@@ -3,6 +3,7 @@
 // Driver for the IMX SNVS ON/OFF Power Key
 // Copyright (C) 2015 Freescale Semiconductor, Inc. All Rights Reserved.
 
+#include <linux/clk.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/init.h>
@@ -99,6 +100,11 @@ static irqreturn_t imx_snvs_pwrkey_interrupt(int irq, void *dev_id)
 	return IRQ_HANDLED;
 }
 
+static void imx_snvs_pwrkey_disable_clk(void *data)
+{
+	clk_disable_unprepare(data);
+}
+
 static void imx_snvs_pwrkey_act(void *pdata)
 {
 	struct pwrkey_drv_data *pd = pdata;
@@ -111,6 +117,7 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)
 	struct pwrkey_drv_data *pdata;
 	struct input_dev *input;
 	struct device_node *np;
+	struct clk *clk;
 	int error;
 	u32 vid;
 
@@ -134,6 +141,28 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)
 		dev_warn(&pdev->dev, "KEY_POWER without setting in dts\n");
 	}
 
+	clk = devm_clk_get_optional(&pdev->dev, NULL);
+	if (IS_ERR(clk)) {
+		dev_err(&pdev->dev, "Failed to get snvs clock (%pe)\n", clk);
+		return PTR_ERR(clk);
+	}
+
+	error = clk_prepare_enable(clk);
+	if (error) {
+		dev_err(&pdev->dev, "Failed to enable snvs clock (%pe)\n",
+			ERR_PTR(error));
+		return error;
+	}
+
+	error = devm_add_action_or_reset(&pdev->dev,
+					 imx_snvs_pwrkey_disable_clk, clk);
+	if (error) {
+		dev_err(&pdev->dev,
+			"Failed to register clock cleanup handler (%pe)\n",
+			ERR_PTR(error));
+		return error;
+	}
+
 	pdata->wakeup = of_property_read_bool(np, "wakeup-source");
 
 	pdata->irq = platform_get_irq(pdev, 0);

From 90c8e8c0829b78518cf9dc4f6fca286848ce4c5a Mon Sep 17 00:00:00 2001
From: Mike Christie <michael.christie@oracle.com>
Date: Sun, 10 Oct 2021 11:19:04 -0500
Subject: [PATCH 1024/1750] scsi: iscsi: Fix set_param() handling

[ Upstream commit 187a580c9e7895978dcd1e627b9c9e7e3d13ca96 ]

In commit 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and
sync thread") we meant to add a check where before we call ->set_param() we
make sure the iscsi_cls_connection is bound. The problem is that between
versions 4 and 5 of the patch the deletion of the unchecked set_param()
call was dropped so we ended up with 2 calls. As a result we can still hit
a crash where we access the unbound connection on the first call.

This patch removes that first call.

Fixes: 9e67600ed6b8 ("scsi: iscsi: Fix race condition between login and sync thread")
Link: https://lore.kernel.org/r/20211010161904.60471-1-michael.christie@oracle.com
Reviewed-by: Lee Duncan <lduncan@suse.com>
Reviewed-by: Li Feng <fengli@smartx.com>
Signed-off-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_transport_iscsi.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 41772b88610a..3f7fa8de3642 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2907,8 +2907,6 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
 			session->recovery_tmo = value;
 		break;
 	default:
-		err = transport->set_param(conn, ev->u.set_param.param,
-					   data, ev->u.set_param.len);
 		if ((conn->state == ISCSI_CONN_BOUND) ||
 			(conn->state == ISCSI_CONN_UP)) {
 			err = transport->set_param(conn, ev->u.set_param.param,

From 96f0aebf29be25254fa585af43924e34aa21fd9a Mon Sep 17 00:00:00 2001
From: Joy Gu <jgu@purestorage.com>
Date: Tue, 12 Oct 2021 12:18:33 -0700
Subject: [PATCH 1025/1750] scsi: qla2xxx: Fix a memory leak in an error path
 of qla2x00_process_els()

[ Upstream commit 7fb223d0ad801f633c78cbe42b1d1b55f5d163ad ]

Commit 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of
qla2x00_process_els()"), intended to change:

        bsg_job->request->msgcode == FC_BSG_HST_ELS_NOLOGIN

to:

        bsg_job->request->msgcode != FC_BSG_RPT_ELS

but changed it to:

        bsg_job->request->msgcode == FC_BSG_RPT_ELS

instead.

Change the == to a != to avoid leaking the fcport structure or freeing
unallocated memory.

Link: https://lore.kernel.org/r/20211012191834.90306-2-jgu@purestorage.com
Fixes: 8c0eb596baa5 ("[SCSI] qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Joy Gu <jgu@purestorage.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_bsg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index 7fa085969a63..1fd292a6ac88 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -414,7 +414,7 @@ qla2x00_process_els(struct bsg_job *bsg_job)
 	goto done_free_fcport;
 
 done_free_fcport:
-	if (bsg_request->msgcode == FC_BSG_RPT_ELS)
+	if (bsg_request->msgcode != FC_BSG_RPT_ELS)
 		qla2x00_free_fcport(fcport);
 done:
 	return rval;

From 96fe5061291d9e9734abf6bb187ef7532824522d Mon Sep 17 00:00:00 2001
From: Woody Lin <woodylin@google.com>
Date: Tue, 12 Oct 2021 16:35:21 +0800
Subject: [PATCH 1026/1750] sched/scs: Reset the shadow stack when
 idle_task_exit

[ Upstream commit 63acd42c0d4942f74710b11c38602fb14dea7320 ]

Commit f1a0a376ca0c ("sched/core: Initialize the idle task with
preemption disabled") removed the init_idle() call from
idle_thread_get(). This was the sole call-path on hotplug that resets
the Shadow Call Stack (scs) Stack Pointer (sp).

Not resetting the scs-sp leads to scs overflow after enough hotplug
cycles. Therefore add an explicit scs_task_reset() to the hotplug code
to make sure the scs-sp does get reset on hotplug.

Fixes: f1a0a376ca0c ("sched/core: Initialize the idle task with preemption disabled")
Signed-off-by: Woody Lin <woodylin@google.com>
[peterz: Changelog]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lore.kernel.org/r/20211012083521.973587-1-woodylin@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 6db20a66e8e6..e4551d1736fa 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6677,6 +6677,7 @@ void idle_task_exit(void)
 		finish_arch_post_lock_switch();
 	}
 
+	scs_task_reset(current);
 	/* finish_cpu(), as ran on the BP, will clean up the active_mm state */
 }
 

From c58654f344dda734c320ecf81634443a9e1c61c1 Mon Sep 17 00:00:00 2001
From: Yunsheng Lin <linyunsheng@huawei.com>
Date: Tue, 19 Oct 2021 22:16:32 +0800
Subject: [PATCH 1027/1750] net: hns3: fix for miscalculation of rx unused desc

[ Upstream commit 9f9f0f19994b42b3e5e8735d41b9c5136828a76c ]

rx unused desc is the desc that need attatching new buffer
before refilling to hw to receive new packet, the number of
desc need attatching new buffer is calculated using next_to_use
and next_to_clean. when next_to_use == next_to_clean, currently
hns3 driver assumes that all the desc has the buffer attatched,
but 'next_to_use == next_to_clean' also means all the desc need
attatching new buffer if hw has comsumed all the desc and the
driver has not attatched any buffer to the desc yet.

This patch adds 'refill' in desc_cb to indicate whether a new
buffer has been refilled to a desc.

Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 1 +
 2 files changed, 9 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
index 568ac6b321fa..ae7cd73c823b 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
@@ -2421,6 +2421,7 @@ static void hns3_buffer_detach(struct hns3_enet_ring *ring, int i)
 {
 	hns3_unmap_buffer(ring, &ring->desc_cb[i]);
 	ring->desc[i].addr = 0;
+	ring->desc_cb[i].refill = 0;
 }
 
 static void hns3_free_buffer_detach(struct hns3_enet_ring *ring, int i,
@@ -2498,6 +2499,7 @@ static int hns3_alloc_and_attach_buffer(struct hns3_enet_ring *ring, int i)
 		return ret;
 
 	ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma);
+	ring->desc_cb[i].refill = 1;
 
 	return 0;
 }
@@ -2528,12 +2530,14 @@ static void hns3_replace_buffer(struct hns3_enet_ring *ring, int i,
 	hns3_unmap_buffer(ring, &ring->desc_cb[i]);
 	ring->desc_cb[i] = *res_cb;
 	ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma);
+	ring->desc_cb[i].refill = 1;
 	ring->desc[i].rx.bd_base_info = 0;
 }
 
 static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i)
 {
 	ring->desc_cb[i].reuse_flag = 0;
+	ring->desc_cb[i].refill = 1;
 	ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma +
 					 ring->desc_cb[i].page_offset);
 	ring->desc[i].rx.bd_base_info = 0;
@@ -2631,6 +2635,9 @@ static int hns3_desc_unused(struct hns3_enet_ring *ring)
 	int ntc = ring->next_to_clean;
 	int ntu = ring->next_to_use;
 
+	if (unlikely(ntc == ntu && !ring->desc_cb[ntc].refill))
+		return ring->desc_num;
+
 	return ((ntc >= ntu) ? 0 : ring->desc_num) + ntc - ntu;
 }
 
@@ -2907,6 +2914,7 @@ static void hns3_rx_ring_move_fw(struct hns3_enet_ring *ring)
 {
 	ring->desc[ring->next_to_clean].rx.bd_base_info &=
 		cpu_to_le32(~BIT(HNS3_RXD_VLD_B));
+	ring->desc_cb[ring->next_to_clean].refill = 0;
 	ring->next_to_clean += 1;
 
 	if (unlikely(ring->next_to_clean == ring->desc_num))
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
index a8ad7ccae20e..54d02ea4aaa7 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h
@@ -283,6 +283,7 @@ struct hns3_desc_cb {
 	u32 length;     /* length of the buffer */
 
 	u16 reuse_flag;
+	u16 refill;
 
 	/* desc type, used by the ring user to mark the type of the priv data */
 	u16 type;

From 2304dfb548a4ba95faa9ef5f87fa88aad3f08923 Mon Sep 17 00:00:00 2001
From: Dexuan Cui <decui@microsoft.com>
Date: Thu, 7 Oct 2021 21:35:46 -0700
Subject: [PATCH 1028/1750] scsi: core: Fix shost->cmd_per_lun calculation in
 scsi_add_host_with_dma()

commit 50b6cb3516365cb69753b006be2b61c966b70588 upstream.

After commit ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at
can_queue"), a 416-CPU VM running on Hyper-V hangs during boot because the
hv_storvsc driver sets scsi_driver.can_queue to an integer value that
exceeds SHRT_MAX, and hence scsi_add_host_with_dma() sets
shost->cmd_per_lun to a negative "short" value.

Use min_t(int, ...) to work around the issue.

Link: https://lore.kernel.org/r/20211008043546.6006-1-decui@microsoft.com
Fixes: ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at can_queue")
Cc: stable@vger.kernel.org
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: John Garry <john.garry@huawei.com>
Signed-off-by: Dexuan Cui <decui@microsoft.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/hosts.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index da3920a19d53..d664c4650b2d 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -220,7 +220,8 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev,
 		goto fail;
 	}
 
-	shost->cmd_per_lun = min_t(short, shost->cmd_per_lun,
+	/* Use min_t(int, ...) in case shost->can_queue exceeds SHRT_MAX */
+	shost->cmd_per_lun = min_t(int, shost->cmd_per_lun,
 				   shost->can_queue);
 
 	error = scsi_init_sense_cache(shost);

From f18b90e9366f6d01f65de127e3fe56988cd9f8fd Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Sat, 9 Oct 2021 15:40:30 +0800
Subject: [PATCH 1029/1750] can: isotp: isotp_sendmsg(): fix TX buffer
 concurrent access in isotp_sendmsg()

commit 43a08c3bdac4cb42eff8fe5e2278bffe0c5c3daa upstream.

When isotp_sendmsg() concurrent, tx.state of all TX processes can be
ISOTP_IDLE. The conditions so->tx.state != ISOTP_IDLE and
wq_has_sleeper(&so->wait) can not protect TX buffer from being
accessed by multiple TX processes.

We can use cmpxchg() to try to modify tx.state to ISOTP_SENDING firstly.
If the modification of the previous process succeed, the later process
must wait tx.state to ISOTP_IDLE firstly. Thus, we can ensure TX buffer
is accessed by only one process at the same time. And we should also
restore the original tx.state at the subsequent error processes.

Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol")
Link: https://lore.kernel.org/all/c2517874fbdf4188585cf9ddf67a8fa74d5dbde5.1633764159.git.william.xuanziyang@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/isotp.c | 40 +++++++++++++++++++++++++++-------------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/net/can/isotp.c b/net/can/isotp.c
index 9492009bc4ae..8ee580538d87 100644
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -121,7 +121,7 @@ enum {
 struct tpcon {
 	int idx;
 	int len;
-	u8 state;
+	u32 state;
 	u8 bs;
 	u8 sn;
 	u8 ll_dl;
@@ -846,6 +846,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 {
 	struct sock *sk = sock->sk;
 	struct isotp_sock *so = isotp_sk(sk);
+	u32 old_state = so->tx.state;
 	struct sk_buff *skb;
 	struct net_device *dev;
 	struct canfd_frame *cf;
@@ -858,39 +859,45 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 		return -EADDRNOTAVAIL;
 
 	/* we do not support multiple buffers - for now */
-	if (so->tx.state != ISOTP_IDLE || wq_has_sleeper(&so->wait)) {
-		if (msg->msg_flags & MSG_DONTWAIT)
-			return -EAGAIN;
+	if (cmpxchg(&so->tx.state, ISOTP_IDLE, ISOTP_SENDING) != ISOTP_IDLE ||
+	    wq_has_sleeper(&so->wait)) {
+		if (msg->msg_flags & MSG_DONTWAIT) {
+			err = -EAGAIN;
+			goto err_out;
+		}
 
 		/* wait for complete transmission of current pdu */
 		err = wait_event_interruptible(so->wait, so->tx.state == ISOTP_IDLE);
 		if (err)
-			return err;
+			goto err_out;
 	}
 
-	if (!size || size > MAX_MSG_LENGTH)
-		return -EINVAL;
+	if (!size || size > MAX_MSG_LENGTH) {
+		err = -EINVAL;
+		goto err_out;
+	}
 
 	err = memcpy_from_msg(so->tx.buf, msg, size);
 	if (err < 0)
-		return err;
+		goto err_out;
 
 	dev = dev_get_by_index(sock_net(sk), so->ifindex);
-	if (!dev)
-		return -ENXIO;
+	if (!dev) {
+		err = -ENXIO;
+		goto err_out;
+	}
 
 	skb = sock_alloc_send_skb(sk, so->ll.mtu + sizeof(struct can_skb_priv),
 				  msg->msg_flags & MSG_DONTWAIT, &err);
 	if (!skb) {
 		dev_put(dev);
-		return err;
+		goto err_out;
 	}
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
 	can_skb_prv(skb)->skbcnt = 0;
 
-	so->tx.state = ISOTP_SENDING;
 	so->tx.len = size;
 	so->tx.idx = 0;
 
@@ -949,7 +956,7 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	if (err) {
 		pr_notice_once("can-isotp: %s: can_send_ret %d\n",
 			       __func__, err);
-		return err;
+		goto err_out;
 	}
 
 	if (wait_tx_done) {
@@ -961,6 +968,13 @@ static int isotp_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
 	}
 
 	return size;
+
+err_out:
+	so->tx.state = old_state;
+	if (so->tx.state == ISOTP_IDLE)
+		wake_up_interruptible(&so->wait);
+
+	return err;
 }
 
 static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,

From 188907c252188ac7a5ec3efcfa31dae1f47b8a20 Mon Sep 17 00:00:00 2001
From: Niklas Schnelle <schnelle@linux.ibm.com>
Date: Wed, 22 Sep 2021 15:55:12 +0200
Subject: [PATCH 1030/1750] s390/pci: fix zpci_zdev_put() on reserve

commit a46044a92add6a400f4dada7b943b30221f7cc80 upstream.

Since commit 2a671f77ee49 ("s390/pci: fix use after free of zpci_dev")
the reference count of a zpci_dev is incremented between
pcibios_add_device() and pcibios_release_device() which was supposed to
prevent the zpci_dev from being freed while the common PCI code has
access to it. It was missed however that the handling of zPCI
availability events assumed that once zpci_zdev_put() was called no
later availability event would still see the device. With the previously
mentioned commit however this assumption no longer holds and we must
make sure that we only drop the initial long-lived reference the zPCI
subsystem holds exactly once.

Do so by introducing a zpci_device_reserved() function that handles when
a device is reserved. Here we make sure the zpci_dev will not be
considered for further events by removing it from the zpci_list.

This also means that the device actually stays in the
ZPCI_FN_STATE_RESERVED state between the time we know it has been
reserved and the final reference going away. We thus need to consider it
a real state instead of just a conceptual state after the removal. The
final cleanup of PCI resources, removal from zbus, and destruction of
the IOMMU stays in zpci_release_device() to make sure holders of the
reference do see valid data until the release.

Fixes: 2a671f77ee49 ("s390/pci: fix use after free of zpci_dev")
Cc: stable@vger.kernel.org
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/include/asm/pci.h        |  3 ++
 arch/s390/pci/pci.c                | 45 ++++++++++++++++++++++++++----
 arch/s390/pci/pci_event.c          |  4 +--
 drivers/pci/hotplug/s390_pci_hpc.c |  9 +-----
 4 files changed, 46 insertions(+), 15 deletions(-)

diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index a75d94a9bcb2..1226971533fe 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -205,6 +205,9 @@ int zpci_create_device(u32 fid, u32 fh, enum zpci_state state);
 void zpci_remove_device(struct zpci_dev *zdev, bool set_error);
 int zpci_enable_device(struct zpci_dev *);
 int zpci_disable_device(struct zpci_dev *);
+void zpci_device_reserved(struct zpci_dev *zdev);
+bool zpci_is_device_configured(struct zpci_dev *zdev);
+
 int zpci_register_ioat(struct zpci_dev *, u8, u64, u64, u64);
 int zpci_unregister_ioat(struct zpci_dev *, u8);
 void zpci_remove_reserved_devices(void);
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index f5ddbc625c1a..e14e4a3a647a 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -92,7 +92,7 @@ void zpci_remove_reserved_devices(void)
 	spin_unlock(&zpci_list_lock);
 
 	list_for_each_entry_safe(zdev, tmp, &remove, entry)
-		zpci_zdev_put(zdev);
+		zpci_device_reserved(zdev);
 }
 
 int pci_domain_nr(struct pci_bus *bus)
@@ -787,6 +787,39 @@ int zpci_create_device(u32 fid, u32 fh, enum zpci_state state)
 	return rc;
 }
 
+bool zpci_is_device_configured(struct zpci_dev *zdev)
+{
+	enum zpci_state state = zdev->state;
+
+	return state != ZPCI_FN_STATE_RESERVED &&
+		state != ZPCI_FN_STATE_STANDBY;
+}
+
+/**
+ * zpci_device_reserved() - Mark device as resverved
+ * @zdev: the zpci_dev that was reserved
+ *
+ * Handle the case that a given zPCI function was reserved by another system.
+ * After a call to this function the zpci_dev can not be found via
+ * get_zdev_by_fid() anymore but may still be accessible via existing
+ * references though it will not be functional anymore.
+ */
+void zpci_device_reserved(struct zpci_dev *zdev)
+{
+	if (zdev->has_hp_slot)
+		zpci_exit_slot(zdev);
+	/*
+	 * Remove device from zpci_list as it is going away. This also
+	 * makes sure we ignore subsequent zPCI events for this device.
+	 */
+	spin_lock(&zpci_list_lock);
+	list_del(&zdev->entry);
+	spin_unlock(&zpci_list_lock);
+	zdev->state = ZPCI_FN_STATE_RESERVED;
+	zpci_dbg(3, "rsv fid:%x\n", zdev->fid);
+	zpci_zdev_put(zdev);
+}
+
 void zpci_release_device(struct kref *kref)
 {
 	struct zpci_dev *zdev = container_of(kref, struct zpci_dev, kref);
@@ -802,6 +835,12 @@ void zpci_release_device(struct kref *kref)
 	case ZPCI_FN_STATE_STANDBY:
 		if (zdev->has_hp_slot)
 			zpci_exit_slot(zdev);
+		spin_lock(&zpci_list_lock);
+		list_del(&zdev->entry);
+		spin_unlock(&zpci_list_lock);
+		zpci_dbg(3, "rsv fid:%x\n", zdev->fid);
+		fallthrough;
+	case ZPCI_FN_STATE_RESERVED:
 		zpci_cleanup_bus_resources(zdev);
 		zpci_bus_device_unregister(zdev);
 		zpci_destroy_iommu(zdev);
@@ -809,10 +848,6 @@ void zpci_release_device(struct kref *kref)
 	default:
 		break;
 	}
-
-	spin_lock(&zpci_list_lock);
-	list_del(&zdev->entry);
-	spin_unlock(&zpci_list_lock);
 	zpci_dbg(3, "rem fid:%x\n", zdev->fid);
 	kfree(zdev);
 }
diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
index ac0c65cdd69d..b7cfde7e80a8 100644
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -146,7 +146,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
 		zdev->state = ZPCI_FN_STATE_STANDBY;
 		if (!clp_get_state(ccdf->fid, &state) &&
 		    state == ZPCI_FN_STATE_RESERVED) {
-			zpci_zdev_put(zdev);
+			zpci_device_reserved(zdev);
 		}
 		break;
 	case 0x0306: /* 0x308 or 0x302 for multiple devices */
@@ -156,7 +156,7 @@ static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
 	case 0x0308: /* Standby -> Reserved */
 		if (!zdev)
 			break;
-		zpci_zdev_put(zdev);
+		zpci_device_reserved(zdev);
 		break;
 	default:
 		break;
diff --git a/drivers/pci/hotplug/s390_pci_hpc.c b/drivers/pci/hotplug/s390_pci_hpc.c
index a047c421debe..93174f503464 100644
--- a/drivers/pci/hotplug/s390_pci_hpc.c
+++ b/drivers/pci/hotplug/s390_pci_hpc.c
@@ -109,14 +109,7 @@ static int get_power_status(struct hotplug_slot *hotplug_slot, u8 *value)
 	struct zpci_dev *zdev = container_of(hotplug_slot, struct zpci_dev,
 					     hotplug_slot);
 
-	switch (zdev->state) {
-	case ZPCI_FN_STATE_STANDBY:
-		*value = 0;
-		break;
-	default:
-		*value = 1;
-		break;
-	}
+	*value = zpci_is_device_configured(zdev) ? 1 : 0;
 	return 0;
 }
 

From cfe9266213c441b2b7486aa600e151e46a8c38ba Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Mon, 27 Sep 2021 14:39:21 +0200
Subject: [PATCH 1031/1750] bpf, test, cgroup: Use sk_{alloc,free} for test
 cases

commit 435b08ec0094ac1e128afe6cfd0d9311a8c617a7 upstream.

BPF test infra has some hacks in place which kzalloc() a socket and perform
minimum init via sock_net_set() and sock_init_data(). As a result, the sk's
skcd->cgroup is NULL since it didn't go through proper initialization as it
would have been the case from sk_alloc(). Rather than re-adding a NULL test
in sock_cgroup_ptr() just for this, use sk_{alloc,free}() pair for the test
socket. The latter also allows to get rid of the bpf_sk_storage_free() special
case.

Fixes: 8520e224f547 ("bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode")
Fixes: b7a1848e8398 ("bpf: add BPF_PROG_TEST_RUN support for flow dissector")
Fixes: 2cb494a36c98 ("bpf: add tests for direct packet access from CGROUP_SKB")
Reported-by: syzbot+664b58e9a40fbb2cec71@syzkaller.appspotmail.com
Reported-by: syzbot+33f36d0754d4c5c0e102@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: syzbot+664b58e9a40fbb2cec71@syzkaller.appspotmail.com
Tested-by: syzbot+33f36d0754d4c5c0e102@syzkaller.appspotmail.com
Link: https://lore.kernel.org/bpf/20210927123921.21535-2-daniel@iogearbox.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bpf/test_run.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 72d424a5a142..eb684f31fd69 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -481,6 +481,12 @@ static void convert_skb_to___skb(struct sk_buff *skb, struct __sk_buff *__skb)
 	__skb->gso_segs = skb_shinfo(skb)->gso_segs;
 }
 
+static struct proto bpf_dummy_proto = {
+	.name   = "bpf_dummy",
+	.owner  = THIS_MODULE,
+	.obj_size = sizeof(struct sock),
+};
+
 int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
 			  union bpf_attr __user *uattr)
 {
@@ -525,20 +531,19 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
 		break;
 	}
 
-	sk = kzalloc(sizeof(struct sock), GFP_USER);
+	sk = sk_alloc(net, AF_UNSPEC, GFP_USER, &bpf_dummy_proto, 1);
 	if (!sk) {
 		kfree(data);
 		kfree(ctx);
 		return -ENOMEM;
 	}
-	sock_net_set(sk, net);
 	sock_init_data(NULL, sk);
 
 	skb = build_skb(data, 0);
 	if (!skb) {
 		kfree(data);
 		kfree(ctx);
-		kfree(sk);
+		sk_free(sk);
 		return -ENOMEM;
 	}
 	skb->sk = sk;
@@ -611,8 +616,7 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
 	if (dev && dev != net->loopback_dev)
 		dev_put(dev);
 	kfree_skb(skb);
-	bpf_sk_storage_free(sk);
-	kfree(sk);
+	sk_free(sk);
 	kfree(ctx);
 	return ret;
 }

From 3a0dc2e35a5d6546b1db87fe985582dadc64fe7b Mon Sep 17 00:00:00 2001
From: Yanfei Xu <yanfei.xu@windriver.com>
Date: Sun, 26 Sep 2021 12:53:13 +0800
Subject: [PATCH 1032/1750] net: mdiobus: Fix memory leak in __mdiobus_register

commit ab609f25d19858513919369ff3d9a63c02cd9e2e upstream.

Once device_register() failed, we should call put_device() to
decrement reference count for cleanup. Or it will cause memory
leak.

BUG: memory leak
unreferenced object 0xffff888114032e00 (size 256):
  comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff  ................
    08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff  .........ve.....
  backtrace:
    [<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
    [<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
    [<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
    [<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
    [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
    [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
    [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
    [<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
    [<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
    [<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff888116f06900 (size 32):
  comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
  hex dump (first 32 bytes):
    75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00  usb-001:003.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
    [<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
    [<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
    [<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
    [<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
    [<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
    [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
    [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
    [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969

Reported-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com
Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/mdio_bus.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 2645ca35103c..453490be7055 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -544,6 +544,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 	err = device_register(&bus->dev);
 	if (err) {
 		pr_err("mii_bus %s failed to register\n", bus->id);
+		put_device(&bus->dev);
 		return -EINVAL;
 	}
 

From 021b6d11e590bbb2b8f243b699204b48ea3857f4 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Mon, 18 Oct 2021 15:44:12 -0400
Subject: [PATCH 1033/1750] tracing: Have all levels of checks prevent
 recursion

commit ed65df63a39a3f6ed04f7258de8b6789e5021c18 upstream.

While writing an email explaining the "bit = 0" logic for a discussion on
making ftrace_test_recursion_trylock() disable preemption, I discovered a
path that makes the "not do the logic if bit is zero" unsafe.

The recursion logic is done in hot paths like the function tracer. Thus,
any code executed causes noticeable overhead. Thus, tricks are done to try
to limit the amount of code executed. This included the recursion testing
logic.

Having recursion testing is important, as there are many paths that can
end up in an infinite recursion cycle when tracing every function in the
kernel. Thus protection is needed to prevent that from happening.

Because it is OK to recurse due to different running context levels (e.g.
an interrupt preempts a trace, and then a trace occurs in the interrupt
handler), a set of bits are used to know which context one is in (normal,
softirq, irq and NMI). If a recursion occurs in the same level, it is
prevented*.

Then there are infrastructure levels of recursion as well. When more than
one callback is attached to the same function to trace, it calls a loop
function to iterate over all the callbacks. Both the callbacks and the
loop function have recursion protection. The callbacks use the
"ftrace_test_recursion_trylock()" which has a "function" set of context
bits to test, and the loop function calls the internal
trace_test_and_set_recursion() directly, with an "internal" set of bits.

If an architecture does not implement all the features supported by ftrace
then the callbacks are never called directly, and the loop function is
called instead, which will implement the features of ftrace.

Since both the loop function and the callbacks do recursion protection, it
was seemed unnecessary to do it in both locations. Thus, a trick was made
to have the internal set of recursion bits at a more significant bit
location than the function bits. Then, if any of the higher bits were set,
the logic of the function bits could be skipped, as any new recursion
would first have to go through the loop function.

This is true for architectures that do not support all the ftrace
features, because all functions being traced must first go through the
loop function before going to the callbacks. But this is not true for
architectures that support all the ftrace features. That's because the
loop function could be called due to two callbacks attached to the same
function, but then a recursion function inside the callback could be
called that does not share any other callback, and it will be called
directly.

i.e.

 traced_function_1: [ more than one callback tracing it ]
   call loop_func

 loop_func:
   trace_recursion set internal bit
   call callback

 callback:
   trace_recursion [ skipped because internal bit is set, return 0 ]
   call traced_function_2

 traced_function_2: [ only traced by above callback ]
   call callback

 callback:
   trace_recursion [ skipped because internal bit is set, return 0 ]
   call traced_function_2

 [ wash, rinse, repeat, BOOM! out of shampoo! ]

Thus, the "bit == 0 skip" trick is not safe, unless the loop function is
call for all functions.

Since we want to encourage architectures to implement all ftrace features,
having them slow down due to this extra logic may encourage the
maintainers to update to the latest ftrace features. And because this
logic is only safe for them, remove it completely.

 [*] There is on layer of recursion that is allowed, and that is to allow
     for the transition between interrupt context (normal -> softirq ->
     irq -> NMI), because a trace may occur before the context update is
     visible to the trace recursion logic.

Link: https://lore.kernel.org/all/609b565a-ed6e-a1da-f025-166691b5d994@linux.alibaba.com/
Link: https://lkml.kernel.org/r/20211018154412.09fcad3c@gandalf.local.home

Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "James E.J. Bottomley" <James.Bottomley@hansenpartnership.com>
Cc: Helge Deller <deller@gmx.de>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Miroslav Benes <mbenes@suse.cz>
Cc: Joe Lawrence <joe.lawrence@redhat.com>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Jisheng Zhang <jszhang@kernel.org>
Cc: =?utf-8?b?546L6LSH?= <yun.wang@linux.alibaba.com>
Cc: Guo Ren <guoren@kernel.org>
Cc: stable@vger.kernel.org
Fixes: edc15cafcbfa3 ("tracing: Avoid unnecessary multiple recursion checks")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ftrace.c          |  4 +--
 kernel/trace/trace.h           | 61 +++++++++++-----------------------
 kernel/trace/trace_functions.c |  2 +-
 3 files changed, 23 insertions(+), 44 deletions(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 30010614b923..4a5d35dc490b 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -6985,7 +6985,7 @@ __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
 	struct ftrace_ops *op;
 	int bit;
 
-	bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX);
+	bit = trace_test_and_set_recursion(TRACE_LIST_START);
 	if (bit < 0)
 		return;
 
@@ -7060,7 +7060,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
 {
 	int bit;
 
-	bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX);
+	bit = trace_test_and_set_recursion(TRACE_LIST_START);
 	if (bit < 0)
 		return;
 
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 6784b572ce59..15a811d34cd8 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -573,18 +573,6 @@ struct tracer {
  *    then this function calls...
  *   The function callback, which can use the FTRACE bits to
  *    check for recursion.
- *
- * Now if the arch does not support a feature, and it calls
- * the global list function which calls the ftrace callback
- * all three of these steps will do a recursion protection.
- * There's no reason to do one if the previous caller already
- * did. The recursion that we are protecting against will
- * go through the same steps again.
- *
- * To prevent the multiple recursion checks, if a recursion
- * bit is set that is higher than the MAX bit of the current
- * check, then we know that the check was made by the previous
- * caller, and we can skip the current check.
  */
 enum {
 	/* Function recursion bits */
@@ -592,12 +580,14 @@ enum {
 	TRACE_FTRACE_NMI_BIT,
 	TRACE_FTRACE_IRQ_BIT,
 	TRACE_FTRACE_SIRQ_BIT,
+	TRACE_FTRACE_TRANSITION_BIT,
 
-	/* INTERNAL_BITs must be greater than FTRACE_BITs */
+	/* Internal use recursion bits */
 	TRACE_INTERNAL_BIT,
 	TRACE_INTERNAL_NMI_BIT,
 	TRACE_INTERNAL_IRQ_BIT,
 	TRACE_INTERNAL_SIRQ_BIT,
+	TRACE_INTERNAL_TRANSITION_BIT,
 
 	TRACE_BRANCH_BIT,
 /*
@@ -637,12 +627,6 @@ enum {
 	 * function is called to clear it.
 	 */
 	TRACE_GRAPH_NOTRACE_BIT,
-
-	/*
-	 * When transitioning between context, the preempt_count() may
-	 * not be correct. Allow for a single recursion to cover this case.
-	 */
-	TRACE_TRANSITION_BIT,
 };
 
 #define trace_recursion_set(bit)	do { (current)->trace_recursion |= (1<<(bit)); } while (0)
@@ -662,12 +646,18 @@ enum {
 #define TRACE_CONTEXT_BITS	4
 
 #define TRACE_FTRACE_START	TRACE_FTRACE_BIT
-#define TRACE_FTRACE_MAX	((1 << (TRACE_FTRACE_START + TRACE_CONTEXT_BITS)) - 1)
 
 #define TRACE_LIST_START	TRACE_INTERNAL_BIT
-#define TRACE_LIST_MAX		((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1)
 
-#define TRACE_CONTEXT_MASK	TRACE_LIST_MAX
+#define TRACE_CONTEXT_MASK	((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1)
+
+enum {
+	TRACE_CTX_NMI,
+	TRACE_CTX_IRQ,
+	TRACE_CTX_SOFTIRQ,
+	TRACE_CTX_NORMAL,
+	TRACE_CTX_TRANSITION,
+};
 
 static __always_inline int trace_get_context_bit(void)
 {
@@ -675,59 +665,48 @@ static __always_inline int trace_get_context_bit(void)
 
 	if (in_interrupt()) {
 		if (in_nmi())
-			bit = 0;
+			bit = TRACE_CTX_NMI;
 
 		else if (in_irq())
-			bit = 1;
+			bit = TRACE_CTX_IRQ;
 		else
-			bit = 2;
+			bit = TRACE_CTX_SOFTIRQ;
 	} else
-		bit = 3;
+		bit = TRACE_CTX_NORMAL;
 
 	return bit;
 }
 
-static __always_inline int trace_test_and_set_recursion(int start, int max)
+static __always_inline int trace_test_and_set_recursion(int start)
 {
 	unsigned int val = current->trace_recursion;
 	int bit;
 
-	/* A previous recursion check was made */
-	if ((val & TRACE_CONTEXT_MASK) > max)
-		return 0;
-
 	bit = trace_get_context_bit() + start;
 	if (unlikely(val & (1 << bit))) {
 		/*
 		 * It could be that preempt_count has not been updated during
 		 * a switch between contexts. Allow for a single recursion.
 		 */
-		bit = TRACE_TRANSITION_BIT;
+		bit = start + TRACE_CTX_TRANSITION;
 		if (trace_recursion_test(bit))
 			return -1;
 		trace_recursion_set(bit);
 		barrier();
-		return bit + 1;
+		return bit;
 	}
 
-	/* Normal check passed, clear the transition to allow it again */
-	trace_recursion_clear(TRACE_TRANSITION_BIT);
-
 	val |= 1 << bit;
 	current->trace_recursion = val;
 	barrier();
 
-	return bit + 1;
+	return bit;
 }
 
 static __always_inline void trace_clear_recursion(int bit)
 {
 	unsigned int val = current->trace_recursion;
 
-	if (!bit)
-		return;
-
-	bit--;
 	bit = 1 << bit;
 	val &= ~bit;
 
diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c
index 2c2126e1871d..93e20ed642e5 100644
--- a/kernel/trace/trace_functions.c
+++ b/kernel/trace/trace_functions.c
@@ -144,7 +144,7 @@ function_trace_call(unsigned long ip, unsigned long parent_ip,
 	pc = preempt_count();
 	preempt_disable_notrace();
 
-	bit = trace_test_and_set_recursion(TRACE_FTRACE_START, TRACE_FTRACE_MAX);
+	bit = trace_test_and_set_recursion(TRACE_FTRACE_START);
 	if (bit < 0)
 		goto out;
 

From 3a845fa00fd730ae3b48e87b11794c2270a7c9ac Mon Sep 17 00:00:00 2001
From: Sasha Neftin <sasha.neftin@intel.com>
Date: Wed, 22 Sep 2021 09:54:49 +0300
Subject: [PATCH 1034/1750] e1000e: Separate TGP board type from SPT

[ Upstream commit 280db5d420090a24e4e41f9ddcbf37920a598572 ]

We have the same LAN controller on different PCHs. Separate TGP board
type from SPT which will allow for specific fixes to be applied for
TGP platforms.

Suggested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Tested-by: Mark Pearson <markpearson@lenovo.com>
Tested-by: Nechama Kraus <nechamax.kraus@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/e1000e/e1000.h   |  4 ++-
 drivers/net/ethernet/intel/e1000e/ich8lan.c | 20 ++++++++++++++
 drivers/net/ethernet/intel/e1000e/netdev.c  | 29 +++++++++++----------
 3 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index 5b2143f4b1f8..3178efd98006 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -113,7 +113,8 @@ enum e1000_boards {
 	board_pch2lan,
 	board_pch_lpt,
 	board_pch_spt,
-	board_pch_cnp
+	board_pch_cnp,
+	board_pch_tgp
 };
 
 struct e1000_ps_page {
@@ -499,6 +500,7 @@ extern const struct e1000_info e1000_pch2_info;
 extern const struct e1000_info e1000_pch_lpt_info;
 extern const struct e1000_info e1000_pch_spt_info;
 extern const struct e1000_info e1000_pch_cnp_info;
+extern const struct e1000_info e1000_pch_tgp_info;
 extern const struct e1000_info e1000_es2_info;
 
 void e1000e_ptp_init(struct e1000_adapter *adapter);
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 3cbb8d1ed67f..b38b914f9ac6 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -5999,3 +5999,23 @@ const struct e1000_info e1000_pch_cnp_info = {
 	.phy_ops		= &ich8_phy_ops,
 	.nvm_ops		= &spt_nvm_ops,
 };
+
+const struct e1000_info e1000_pch_tgp_info = {
+	.mac			= e1000_pch_tgp,
+	.flags			= FLAG_IS_ICH
+				  | FLAG_HAS_WOL
+				  | FLAG_HAS_HW_TIMESTAMP
+				  | FLAG_HAS_CTRLEXT_ON_LOAD
+				  | FLAG_HAS_AMT
+				  | FLAG_HAS_FLASH
+				  | FLAG_HAS_JUMBO_FRAMES
+				  | FLAG_APME_IN_WUC,
+	.flags2			= FLAG2_HAS_PHY_STATS
+				  | FLAG2_HAS_EEE,
+	.pba			= 26,
+	.max_hw_frame_size	= 9022,
+	.get_variants		= e1000_get_variants_ich8lan,
+	.mac_ops		= &ich8_mac_ops,
+	.phy_ops		= &ich8_phy_ops,
+	.nvm_ops		= &spt_nvm_ops,
+};
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 361b8d0bd78d..d0c4de023112 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -50,6 +50,7 @@ static const struct e1000_info *e1000_info_tbl[] = {
 	[board_pch_lpt]		= &e1000_pch_lpt_info,
 	[board_pch_spt]		= &e1000_pch_spt_info,
 	[board_pch_cnp]		= &e1000_pch_cnp_info,
+	[board_pch_tgp]		= &e1000_pch_tgp_info,
 };
 
 struct e1000_reg_info {
@@ -7837,20 +7838,20 @@ static const struct pci_device_id e1000_pci_tbl[] = {
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_CMP_I219_V11), board_pch_cnp },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_CMP_I219_LM12), board_pch_spt },
 	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_CMP_I219_V12), board_pch_spt },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_LM13), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_V13), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_LM14), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_V14), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_LM15), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_V15), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_LM16), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V16), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_LM17), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V17), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM18), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V18), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM19), board_pch_cnp },
-	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V19), board_pch_cnp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_LM13), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_V13), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_LM14), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_V14), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_LM15), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_TGP_I219_V15), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_LM16), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V16), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_LM17), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_ADP_I219_V17), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM18), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V18), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_LM19), board_pch_tgp },
+	{ PCI_VDEVICE(INTEL, E1000_DEV_ID_PCH_MTP_I219_V19), board_pch_tgp },
 
 	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
 };

From d088db8637bb705a987ca5a497c081089ce3ccb1 Mon Sep 17 00:00:00 2001
From: Lorenz Bauer <lmb@cloudflare.com>
Date: Mon, 25 Oct 2021 17:06:19 +0100
Subject: [PATCH 1035/1750] selftests: bpf: fix backported ASSERT_FALSE

Commit 183d9ebd449c ("selftests/bpf: Fix core_reloc test runner") causes
builds of selftests/bpf to fail on 5.10.y since the branch doesn't have the
ASSERT_FALSE macro yet. Replace ASSERT_FALSE with ASSERT_EQ.

Fixes: 183d9ebd449c ("selftests/bpf: Fix core_reloc test runner")
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/bpf/prog_tests/core_reloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/core_reloc.c b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
index 8b641c306f26..5b52985cb60e 100644
--- a/tools/testing/selftests/bpf/prog_tests/core_reloc.c
+++ b/tools/testing/selftests/bpf/prog_tests/core_reloc.c
@@ -857,7 +857,7 @@ void test_core_reloc(void)
 			goto cleanup;
 		}
 
-		if (!ASSERT_FALSE(test_case->fails, "obj_load_should_fail"))
+		if (!ASSERT_EQ(test_case->fails, false, "obj_load_should_fail"))
 			goto cleanup;
 
 		equal = memcmp(data->out, test_case->output,

From c56c801391c3e138baffa782d31957f679f94c80 Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Wed, 8 Sep 2021 19:25:59 +0100
Subject: [PATCH 1036/1750] ARM: 9122/1: select HAVE_FUTEX_CMPXCHG

commit 9d417cbe36eee7afdd85c2e871685f8dab7c2dba upstream.

tglx notes:
  This function [futex_detect_cmpxchg] is only needed when an
  architecture has to runtime discover whether the CPU supports it or
  not.  ARM has unconditional support for this, so the obvious thing to
  do is the below.

Fixes linkage failure from Clang randconfigs:
kernel/futex.o:(.text.fixup+0x5c): relocation truncated to fit: R_ARM_JUMP24 against `.init.text'
and boot failures for CONFIG_THUMB2_KERNEL.

Link: https://github.com/ClangBuiltLinux/linux/issues/325

Comments from Nick Desaulniers:

 See-also: 03b8c7b623c8 ("futex: Allow architectures to skip
 futex_atomic_cmpxchg_inatomic() test")

Reported-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Cc: stable@vger.kernel.org # v3.14+
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 002e0cf025f5..a0eac00e2c81 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -87,6 +87,7 @@ config ARM
 	select HAVE_FTRACE_MCOUNT_RECORD if !XIP_KERNEL
 	select HAVE_FUNCTION_GRAPH_TRACER if !THUMB2_KERNEL && !CC_IS_CLANG
 	select HAVE_FUNCTION_TRACER if !XIP_KERNEL
+	select HAVE_FUTEX_CMPXCHG if FUTEX
 	select HAVE_GCC_PLUGINS
 	select HAVE_HW_BREAKPOINT if PERF_EVENTS && (CPU_V6 || CPU_V6K || CPU_V7)
 	select HAVE_IDE if PCI || ISA || PCMCIA

From cfa79faf7e1ffa93e76461c7716864377bff76bd Mon Sep 17 00:00:00 2001
From: Fabien Dessenne <fabien.dessenne@foss.st.com>
Date: Fri, 8 Oct 2021 14:25:17 +0200
Subject: [PATCH 1037/1750] pinctrl: stm32: use valid pin identifier in
 stm32_pinctrl_resume()

commit c370bb474016ab9edfdabd7c08a88dd13a71ddbd upstream.

When resuming from low power, the driver attempts to restore the
configuration of some pins. This is done by a call to:
  stm32_pinctrl_restore_gpio_regs(struct stm32_pinctrl *pctl, u32 pin)
where 'pin' must be a valid pin value (i.e. matching some 'groups->pin').
Fix the current implementation which uses some wrong 'pin' value.

Fixes: e2f3cf18c3e2 ("pinctrl: stm32: add suspend/resume management")
Signed-off-by: Fabien Dessenne <fabien.dessenne@foss.st.com>
Link: https://lore.kernel.org/r/20211008122517.617633-1-fabien.dessenne@foss.st.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/stm32/pinctrl-stm32.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
index 3af4430543dc..a5f1f6ba7439 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
@@ -1645,8 +1645,8 @@ int __maybe_unused stm32_pinctrl_resume(struct device *dev)
 	struct stm32_pinctrl_group *g = pctl->groups;
 	int i;
 
-	for (i = g->pin; i < g->pin + pctl->ngroups; i++)
-		stm32_pinctrl_restore_gpio_regs(pctl, i);
+	for (i = 0; i < pctl->ngroups; i++, g++)
+		stm32_pinctrl_restore_gpio_regs(pctl, g->pin);
 
 	return 0;
 }

From 378e85d1aeb5c93db43f2089630ec40c7385bd54 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 27 Oct 2021 09:56:57 +0200
Subject: [PATCH 1038/1750] Linux 5.10.76

Link: https://lore.kernel.org/r/20211025190956.374447057@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 74318cf964b8..605bd943b224 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 75
+SUBLEVEL = 76
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 3ceaa85c331d30752af3b88d280cc1bcaee2eb27 Mon Sep 17 00:00:00 2001
From: Lexi Shao <shaolexi@huawei.com>
Date: Thu, 23 Sep 2021 03:41:25 +0100
Subject: [PATCH 1039/1750] ARM: 9132/1: Fix __get_user_check failure with ARM
 KASAN images

commit df909df0770779f1a5560c2bb641a2809655ef28 upstream.

ARM: kasan: Fix __get_user_check failure with kasan

In macro __get_user_check defined in arch/arm/include/asm/uaccess.h,
error code is store in register int __e(r0). When kasan is
enabled, assigning value to kernel address might trigger kasan check,
which unexpectedly overwrites r0 and causes undefined behavior on arm
kasan images.

One example is failure in do_futex and results in process soft lockup.
Log:
watchdog: BUG: soft lockup - CPU#0 stuck for 62946ms! [rs:main
Q:Reg:1151]
...
(__asan_store4) from (futex_wait_setup+0xf8/0x2b4)
(futex_wait_setup) from (futex_wait+0x138/0x394)
(futex_wait) from (do_futex+0x164/0xe40)
(do_futex) from (sys_futex_time32+0x178/0x230)
(sys_futex_time32) from (ret_fast_syscall+0x0/0x50)

The soft lockup happens in function futex_wait_setup. The reason is
function get_futex_value_locked always return EINVAL, thus pc jump
back to retry label and causes looping.

This line in function get_futex_value_locked
	ret = __get_user(*dest, from);
is expanded to
	*dest = (typeof(*(p))) __r2; ,
in macro __get_user_check. Writing to pointer dest triggers kasan check
and overwrites the return value of __get_user_x function.
The assembly code of get_futex_value_locked in kernel/futex.c:
...
c01f6dc8:       eb0b020e        bl      c04b7608 <__get_user_4>
// "x = (typeof(*(p))) __r2;" triggers kasan check and r0 is overwritten
c01f6dCc:       e1a00007        mov     r0, r7
c01f6dd0:       e1a05002        mov     r5, r2
c01f6dd4:       eb04f1e6        bl      c0333574 <__asan_store4>
c01f6dd8:       e5875000        str     r5, [r7]
// save ret value of __get_user(*dest, from), which is dest address now
c01f6ddc:       e1a05000        mov     r5, r0
...
// checking return value of __get_user failed
c01f6e00:       e3550000        cmp     r5, #0
...
c01f6e0c:       01a00005        moveq   r0, r5
// assign return value to EINVAL
c01f6e10:       13e0000d        mvnne   r0, #13

Return value is the destination address of get_user thus certainly
non-zero, so get_futex_value_locked always return EINVAL.

Fix it by using a tmp vairable to store the error code before the
assignment. This fix has no effects to non-kasan images thanks to compiler
optimization. It only affects cases that overwrite r0 due to kasan check.

This should fix bug discussed in Link:
[1] https://lore.kernel.org/linux-arm-kernel/0ef7c2a5-5d8b-c5e0-63fa-31693fd4495c@gmail.com/

Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM")
Signed-off-by: Lexi Shao <shaolexi@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/include/asm/uaccess.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index a13d90206472..d9db752c51fe 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -200,6 +200,7 @@ extern int __get_user_64t_4(void *);
 		register unsigned long __l asm("r1") = __limit;		\
 		register int __e asm("r0");				\
 		unsigned int __ua_flags = uaccess_save_and_enable();	\
+		int __tmp_e;						\
 		switch (sizeof(*(__p))) {				\
 		case 1:							\
 			if (sizeof((x)) >= 8)				\
@@ -227,9 +228,10 @@ extern int __get_user_64t_4(void *);
 			break;						\
 		default: __e = __get_user_bad(); break;			\
 		}							\
+		__tmp_e = __e;						\
 		uaccess_restore(__ua_flags);				\
 		x = (typeof(*(p))) __r2;				\
-		__e;							\
+		__tmp_e;						\
 	})
 
 #define get_user(x, p)							\

From 6ad8bbc9d301145335c35f29ed7878b61b0ad81f Mon Sep 17 00:00:00 2001
From: Nick Desaulniers <ndesaulniers@google.com>
Date: Mon, 4 Oct 2021 18:03:28 +0100
Subject: [PATCH 1040/1750] ARM: 9133/1: mm: proc-macros: ensure *_tlb_fns are
 4B aligned

commit e6a0c958bdf9b2e1b57501fc9433a461f0a6aadd upstream.

A kernel built with CONFIG_THUMB2_KERNEL=y and using clang as the
assembler could generate non-naturally-aligned v7wbi_tlb_fns which
results in a boot failure. The original commit adding the macro missed
the .align directive on this data.

Link: https://github.com/ClangBuiltLinux/linux/issues/1447
Link: https://lore.kernel.org/all/0699da7b-354f-aecc-a62f-e25693209af4@linaro.org/
Debugged-by: Ard Biesheuvel <ardb@kernel.org>
Debugged-by: Nathan Chancellor <nathan@kernel.org>
Debugged-by: Richard Henderson <richard.henderson@linaro.org>

Fixes: 66a625a88174 ("ARM: mm: proc-macros: Add generic proc/cache/tlb struct definition macros")
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/mm/proc-macros.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
index e2c743aa2eb2..d9f7dfe2a7ed 100644
--- a/arch/arm/mm/proc-macros.S
+++ b/arch/arm/mm/proc-macros.S
@@ -340,6 +340,7 @@ ENTRY(\name\()_cache_fns)
 
 .macro define_tlb_functions name:req, flags_up:req, flags_smp
 	.type	\name\()_tlb_fns, #object
+	.align 2
 ENTRY(\name\()_tlb_fns)
 	.long	\name\()_flush_user_tlb_range
 	.long	\name\()_flush_kern_tlb_range

From 8a6af97c31beefcc0f0836d90b5fea3b303cc6c9 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 18 Oct 2021 15:30:04 +0100
Subject: [PATCH 1041/1750] ARM: 9134/1: remove duplicate memcpy() definition

commit eaf6cc7165c9c5aa3c2f9faa03a98598123d0afb upstream.

Both the decompressor code and the kasan logic try to override
the memcpy() and memmove()  definitions, which leading to a clash
in a KASAN-enabled kernel with XZ decompression:

arch/arm/boot/compressed/decompress.c:50:9: error: 'memmove' macro redefined [-Werror,-Wmacro-redefined]
 #define memmove memmove
        ^
arch/arm/include/asm/string.h:59:9: note: previous definition is here
 #define memmove(dst, src, len) __memmove(dst, src, len)
        ^
arch/arm/boot/compressed/decompress.c:51:9: error: 'memcpy' macro redefined [-Werror,-Wmacro-redefined]
 #define memcpy memcpy
        ^
arch/arm/include/asm/string.h:58:9: note: previous definition is here
 #define memcpy(dst, src, len) __memcpy(dst, src, len)
        ^

Here we want the set of functions from the decompressor, so undefine
the other macros before the override.

Link: https://lore.kernel.org/linux-arm-kernel/CACRpkdZYJogU_SN3H9oeVq=zJkRgRT1gDz3xp59gdqWXxw-B=w@mail.gmail.com/
Link: https://lore.kernel.org/lkml/202105091112.F5rmd4By-lkp@intel.com/

Fixes: d6d51a96c7d6 ("ARM: 9014/2: Replace string mem* functions for KASan")
Fixes: a7f464f3db93 ("ARM: 7001/2: Wire up support for the XZ decompressor")
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/compressed/decompress.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
index aa075d8372ea..74255e819831 100644
--- a/arch/arm/boot/compressed/decompress.c
+++ b/arch/arm/boot/compressed/decompress.c
@@ -47,7 +47,10 @@ extern char * strchrnul(const char *, int);
 #endif
 
 #ifdef CONFIG_KERNEL_XZ
+/* Prevent KASAN override of string helpers in decompressor */
+#undef memmove
 #define memmove memmove
+#undef memcpy
 #define memcpy memcpy
 #include "../../../../lib/decompress_unxz.c"
 #endif

From c06d7d9bfcf6830fdc82ff07fe955d3e48bc0fe9 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 18 Oct 2021 15:30:08 +0100
Subject: [PATCH 1042/1750] ARM: 9138/1: fix link warning with XIP +
 frame-pointer

commit 44cc6412e66b2b84544eaf2e14cf1764301e2a80 upstream.

When frame pointers are used instead of the ARM unwinder,
and the kernel is built using clang with an external assembler
and CONFIG_XIP_KERNEL, every file produces two warnings
like:

arm-linux-gnueabi-ld: warning: orphan section `.ARM.extab' from `net/mac802154/util.o' being placed in section `.ARM.extab'
arm-linux-gnueabi-ld: warning: orphan section `.ARM.exidx' from `net/mac802154/util.o' being placed in section `.ARM.exidx'

The same fix was already merged for the normal (non-XIP)

linker script, with a longer description.

Fixes: c39866f268f8 ("arm/build: Always handle .ARM.exidx and .ARM.extab sections")
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kernel/vmlinux-xip.lds.S | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index 50136828f5b5..e0c00986487f 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -40,6 +40,10 @@ SECTIONS
 		ARM_DISCARD
 		*(.alt.smp.init)
 		*(.pv_table)
+#ifndef CONFIG_ARM_UNWIND
+		*(.ARM.exidx) *(.ARM.exidx.*)
+		*(.ARM.extab) *(.ARM.extab.*)
+#endif
 	}
 
 	. = XIP_VIRT_ADDR(CONFIG_XIP_PHYS_ADDR);

From 15b278f94bbb788974881f5e67d3f12f0f8be7cc Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 18 Oct 2021 15:30:09 +0100
Subject: [PATCH 1043/1750] ARM: 9139/1: kprobes: fix arch_init_kprobes()
 prototype

commit 1f323127cab086e4fd618981b1e5edc396eaf0f4 upstream.

With extra warnings enabled, gcc complains about this function
definition:

arch/arm/probes/kprobes/core.c: In function 'arch_init_kprobes':
arch/arm/probes/kprobes/core.c:465:12: warning: old-style function definition [-Wold-style-definition]
  465 | int __init arch_init_kprobes()

Link: https://lore.kernel.org/all/20201027093057.c685a14b386acacb3c449e3d@kernel.org/

Fixes: 24ba613c9d6c ("ARM kprobes: core code")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/probes/kprobes/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
index a9653117ca0d..e513d8a46776 100644
--- a/arch/arm/probes/kprobes/core.c
+++ b/arch/arm/probes/kprobes/core.c
@@ -462,7 +462,7 @@ static struct undef_hook kprobes_arm_break_hook = {
 
 #endif /* !CONFIG_THUMB2_KERNEL */
 
-int __init arch_init_kprobes()
+int __init arch_init_kprobes(void)
 {
 	arm_probes_decode_init();
 #ifdef CONFIG_THUMB2_KERNEL

From 5a768b4d3e1a3eda23b8c5690645fde2bcff910a Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 18 Oct 2021 15:30:37 +0100
Subject: [PATCH 1044/1750] ARM: 9141/1: only warn about XIP address when not
 compile testing

commit 48ccc8edf5b90622cdc4f8878e0042ab5883e2ca upstream.

In randconfig builds, we sometimes come across this warning:

arm-linux-gnueabi-ld: XIP start address may cause MPU programming issues

While this is helpful for actual systems to figure out why it
fails, the warning does not provide any benefit for build testing,
so guard it in a check for CONFIG_COMPILE_TEST, which is usually
set on randconfig builds.

Fixes: 216218308cfb ("ARM: 8713/1: NOMMU: Support MPU in XIP configuration")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/kernel/vmlinux-xip.lds.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
index e0c00986487f..f14c2360ea0b 100644
--- a/arch/arm/kernel/vmlinux-xip.lds.S
+++ b/arch/arm/kernel/vmlinux-xip.lds.S
@@ -176,7 +176,7 @@ ASSERT((__arch_info_end - __arch_info_begin), "no machine record defined")
 ASSERT((_end - __bss_start) >= 12288, ".bss too small for CONFIG_XIP_DEFLATED_DATA")
 #endif
 
-#ifdef CONFIG_ARM_MPU
+#if defined(CONFIG_ARM_MPU) && !defined(CONFIG_COMPILE_TEST)
 /*
  * Due to PMSAv7 restriction on base address and size we have to
  * enforce minimal alignment restrictions. It was seen that weaker

From 3f2c12ec8a3f992c528c7ad83f7272122dfe8d84 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Thu, 18 Feb 2021 22:32:51 +0000
Subject: [PATCH 1045/1750] io_uring: don't take uring_lock during iowq cancel

commit 792bb6eb862333658bf1bd2260133f0507e2da8d upstream.

[   97.866748] a.out/2890 is trying to acquire lock:
[   97.867829] ffff8881046763e8 (&ctx->uring_lock){+.+.}-{3:3}, at:
io_wq_submit_work+0x155/0x240
[   97.869735]
[   97.869735] but task is already holding lock:
[   97.871033] ffff88810dfe0be8 (&ctx->uring_lock){+.+.}-{3:3}, at:
__x64_sys_io_uring_enter+0x3f0/0x5b0
[   97.873074]
[   97.873074] other info that might help us debug this:
[   97.874520]  Possible unsafe locking scenario:
[   97.874520]
[   97.875845]        CPU0
[   97.876440]        ----
[   97.877048]   lock(&ctx->uring_lock);
[   97.877961]   lock(&ctx->uring_lock);
[   97.878881]
[   97.878881]  *** DEADLOCK ***
[   97.878881]
[   97.880341]  May be due to missing lock nesting notation
[   97.880341]
[   97.881952] 1 lock held by a.out/2890:
[   97.882873]  #0: ffff88810dfe0be8 (&ctx->uring_lock){+.+.}-{3:3}, at:
__x64_sys_io_uring_enter+0x3f0/0x5b0
[   97.885108]
[   97.885108] stack backtrace:
[   97.890457] Call Trace:
[   97.891121]  dump_stack+0xac/0xe3
[   97.891972]  __lock_acquire+0xab6/0x13a0
[   97.892940]  lock_acquire+0x2c3/0x390
[   97.894894]  __mutex_lock+0xae/0x9f0
[   97.901101]  io_wq_submit_work+0x155/0x240
[   97.902112]  io_wq_cancel_cb+0x162/0x490
[   97.904126]  io_async_find_and_cancel+0x3b/0x140
[   97.905247]  io_issue_sqe+0x86d/0x13e0
[   97.909122]  __io_queue_sqe+0x10b/0x550
[   97.913971]  io_queue_sqe+0x235/0x470
[   97.914894]  io_submit_sqes+0xcce/0xf10
[   97.917872]  __x64_sys_io_uring_enter+0x3fb/0x5b0
[   97.921424]  do_syscall_64+0x2d/0x40
[   97.922329]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

While holding uring_lock, e.g. from inline execution, async cancel
request may attempt cancellations through io_wq_submit_work, which may
try to grab a lock. Delay it to task_work, so we do it from a clean
context and don't have to worry about locking.

Cc: <stable@vger.kernel.org> # 5.5+
Fixes: c07e6719511e ("io_uring: hold uring_lock while completing failed polled io in io_wq_submit_work()")
Reported-by: Abaci <abaci@linux.alibaba.com>
Reported-by: Hao Xu <haoxu@linux.alibaba.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[Lee: The first hunk solves a different (double free) issue in v5.10.
      Only the first hunk of the original patch is relevant to v5.10 AND
      the first hunk of the original patch is only relevant to v5.10]
Reported-by: syzbot+59d8a1f4e60c20c066cf@syzkaller.appspotmail.com
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 0736487165da..ee7ceea89934 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2075,7 +2075,9 @@ static void io_req_task_cancel(struct callback_head *cb)
 	struct io_kiocb *req = container_of(cb, struct io_kiocb, task_work);
 	struct io_ring_ctx *ctx = req->ctx;
 
+	mutex_lock(&ctx->uring_lock);
 	__io_req_task_cancel(req, -ECANCELED);
+	mutex_unlock(&ctx->uring_lock);
 	percpu_ref_put(&ctx->refs);
 }
 

From e184a21b5ccc49f3e1c3160bc280a5995e933b04 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Wed, 6 Oct 2021 01:55:22 +0530
Subject: [PATCH 1046/1750] powerpc/bpf: Fix BPF_MOD when imm == 1

commit 8bbc9d822421d9ac8ff9ed26a3713c9afc69d6c8 upstream.

Only ignore the operation if dividing by 1.

Fixes: 156d0e290e969c ("powerpc/ebpf/jit: Implement JIT compiler for extended BPF")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/c674ca18c3046885602caebb326213731c675d06.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/net/bpf_jit_comp64.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 0752967f351b..a2750d6ffd0f 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -415,8 +415,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 		case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
 			if (imm == 0)
 				return -EINVAL;
-			else if (imm == 1)
-				goto bpf_alu32_trunc;
+			if (imm == 1) {
+				if (BPF_OP(code) == BPF_DIV) {
+					goto bpf_alu32_trunc;
+				} else {
+					EMIT(PPC_RAW_LI(dst_reg, 0));
+					break;
+				}
+			}
 
 			PPC_LI32(b2p[TMP_REG_1], imm);
 			switch (BPF_CLASS(code)) {

From d4d9c065988c4c2c7c0cc4be0f7e1c3563e1e779 Mon Sep 17 00:00:00 2001
From: Robin Murphy <robin.murphy@arm.com>
Date: Mon, 12 Jul 2021 15:27:46 +0100
Subject: [PATCH 1047/1750] arm64: Avoid premature usercopy failure

commit 295cf156231ca3f9e3a66bde7fab5e09c41835e0 upstream.

Al reminds us that the usercopy API must only return complete failure
if absolutely nothing could be copied. Currently, if userspace does
something silly like giving us an unaligned pointer to Device memory,
or a size which overruns MTE tag bounds, we may fail to honour that
requirement when faulting on a multi-byte access even though a smaller
access could have succeeded.

Add a mitigation to the fixup routines to fall back to a single-byte
copy if we faulted on a larger access before anything has been written
to the destination, to guarantee making *some* forward progress. We
needn't be too concerned about the overall performance since this should
only occur when callers are doing something a bit dodgy in the first
place. Particularly broken userspace might still be able to trick
generic_perform_write() into an infinite loop by targeting write() at
an mmap() of some read-only device register where the fault-in load
succeeds but any store synchronously aborts such that copy_to_user() is
genuinely unable to make progress, but, well, don't do that...

CC: stable@vger.kernel.org
Reported-by: Chen Huang <chenhuang5@huawei.com>
Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/dc03d5c675731a1f24a62417dba5429ad744234e.1626098433.git.robin.murphy@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Chen Huang <chenhuang5@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/lib/copy_from_user.S | 13 ++++++++++---
 arch/arm64/lib/copy_in_user.S   | 21 ++++++++++++++-------
 arch/arm64/lib/copy_to_user.S   | 14 +++++++++++---
 3 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index 0f8a3a9e3795..957a6d092d7a 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -29,7 +29,7 @@
 	.endm
 
 	.macro ldrh1 reg, ptr, val
-	uao_user_alternative 9998f, ldrh, ldtrh, \reg, \ptr, \val
+	uao_user_alternative 9997f, ldrh, ldtrh, \reg, \ptr, \val
 	.endm
 
 	.macro strh1 reg, ptr, val
@@ -37,7 +37,7 @@
 	.endm
 
 	.macro ldr1 reg, ptr, val
-	uao_user_alternative 9998f, ldr, ldtr, \reg, \ptr, \val
+	uao_user_alternative 9997f, ldr, ldtr, \reg, \ptr, \val
 	.endm
 
 	.macro str1 reg, ptr, val
@@ -45,7 +45,7 @@
 	.endm
 
 	.macro ldp1 reg1, reg2, ptr, val
-	uao_ldp 9998f, \reg1, \reg2, \ptr, \val
+	uao_ldp 9997f, \reg1, \reg2, \ptr, \val
 	.endm
 
 	.macro stp1 reg1, reg2, ptr, val
@@ -53,8 +53,10 @@
 	.endm
 
 end	.req	x5
+srcin	.req	x15
 SYM_FUNC_START(__arch_copy_from_user)
 	add	end, x0, x2
+	mov	srcin, x1
 #include "copy_template.S"
 	mov	x0, #0				// Nothing to copy
 	ret
@@ -63,6 +65,11 @@ EXPORT_SYMBOL(__arch_copy_from_user)
 
 	.section .fixup,"ax"
 	.align	2
+9997:	cmp	dst, dstin
+	b.ne	9998f
+	// Before being absolutely sure we couldn't copy anything, try harder
+USER(9998f, ldtrb tmp1w, [srcin])
+	strb	tmp1w, [dst], #1
 9998:	sub	x0, end, dst			// bytes not copied
 	ret
 	.previous
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index 80e37ada0ee1..35c01da09323 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -30,33 +30,34 @@
 	.endm
 
 	.macro ldrh1 reg, ptr, val
-	uao_user_alternative 9998f, ldrh, ldtrh, \reg, \ptr, \val
+	uao_user_alternative 9997f, ldrh, ldtrh, \reg, \ptr, \val
 	.endm
 
 	.macro strh1 reg, ptr, val
-	uao_user_alternative 9998f, strh, sttrh, \reg, \ptr, \val
+	uao_user_alternative 9997f, strh, sttrh, \reg, \ptr, \val
 	.endm
 
 	.macro ldr1 reg, ptr, val
-	uao_user_alternative 9998f, ldr, ldtr, \reg, \ptr, \val
+	uao_user_alternative 9997f, ldr, ldtr, \reg, \ptr, \val
 	.endm
 
 	.macro str1 reg, ptr, val
-	uao_user_alternative 9998f, str, sttr, \reg, \ptr, \val
+	uao_user_alternative 9997f, str, sttr, \reg, \ptr, \val
 	.endm
 
 	.macro ldp1 reg1, reg2, ptr, val
-	uao_ldp 9998f, \reg1, \reg2, \ptr, \val
+	uao_ldp 9997f, \reg1, \reg2, \ptr, \val
 	.endm
 
 	.macro stp1 reg1, reg2, ptr, val
-	uao_stp 9998f, \reg1, \reg2, \ptr, \val
+	uao_stp 9997f, \reg1, \reg2, \ptr, \val
 	.endm
 
 end	.req	x5
-
+srcin	.req	x15
 SYM_FUNC_START(__arch_copy_in_user)
 	add	end, x0, x2
+	mov	srcin, x1
 #include "copy_template.S"
 	mov	x0, #0
 	ret
@@ -65,6 +66,12 @@ EXPORT_SYMBOL(__arch_copy_in_user)
 
 	.section .fixup,"ax"
 	.align	2
+9997:	cmp	dst, dstin
+	b.ne	9998f
+	// Before being absolutely sure we couldn't copy anything, try harder
+USER(9998f, ldtrb tmp1w, [srcin])
+USER(9998f, sttrb tmp1w, [dst])
+	add	dst, dst, #1
 9998:	sub	x0, end, dst			// bytes not copied
 	ret
 	.previous
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index 4ec59704b8f2..85705350ff35 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -32,7 +32,7 @@
 	.endm
 
 	.macro strh1 reg, ptr, val
-	uao_user_alternative 9998f, strh, sttrh, \reg, \ptr, \val
+	uao_user_alternative 9997f, strh, sttrh, \reg, \ptr, \val
 	.endm
 
 	.macro ldr1 reg, ptr, val
@@ -40,7 +40,7 @@
 	.endm
 
 	.macro str1 reg, ptr, val
-	uao_user_alternative 9998f, str, sttr, \reg, \ptr, \val
+	uao_user_alternative 9997f, str, sttr, \reg, \ptr, \val
 	.endm
 
 	.macro ldp1 reg1, reg2, ptr, val
@@ -48,12 +48,14 @@
 	.endm
 
 	.macro stp1 reg1, reg2, ptr, val
-	uao_stp 9998f, \reg1, \reg2, \ptr, \val
+	uao_stp 9997f, \reg1, \reg2, \ptr, \val
 	.endm
 
 end	.req	x5
+srcin	.req	x15
 SYM_FUNC_START(__arch_copy_to_user)
 	add	end, x0, x2
+	mov	srcin, x1
 #include "copy_template.S"
 	mov	x0, #0
 	ret
@@ -62,6 +64,12 @@ EXPORT_SYMBOL(__arch_copy_to_user)
 
 	.section .fixup,"ax"
 	.align	2
+9997:	cmp	dst, dstin
+	b.ne	9998f
+	// Before being absolutely sure we couldn't copy anything, try harder
+	ldrb	tmp1w, [srcin]
+USER(9998f, sttrb tmp1w, [dst])
+	add	dst, dst, #1
 9998:	sub	x0, end, dst			// bytes not copied
 	ret
 	.previous

From b663890d854403e566169f7e90aed5cd6ff64f6b Mon Sep 17 00:00:00 2001
From: Theodore Ts'o <tytso@mit.edu>
Date: Fri, 2 Jul 2021 12:45:02 -0400
Subject: [PATCH 1048/1750] ext4: fix possible UAF when remounting r/o a
 mmp-protected file system

commit 61bb4a1c417e5b95d9edb4f887f131de32e419cb upstream.

After commit 618f003199c6 ("ext4: fix memory leak in
ext4_fill_super"), after the file system is remounted read-only, there
is a race where the kmmpd thread can exit, causing sbi->s_mmp_tsk to
point at freed memory, which the call to ext4_stop_mmpd() can trip
over.

Fix this by only allowing kmmpd() to exit when it is stopped via
ext4_stop_mmpd().

Link: https://lore.kernel.org/r/20210707002433.3719773-1-tytso@mit.edu
Reported-by: Ye Bin <yebin10@huawei.com>
Bug-Report-Link: <20210629143603.2166962-1-yebin10@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Tadeusz Struk <tadeusz.struk@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/mmp.c   | 31 +++++++++++++++----------------
 fs/ext4/super.c |  6 +++++-
 2 files changed, 20 insertions(+), 17 deletions(-)

diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
index 6cb598b549ca..bc364c119af6 100644
--- a/fs/ext4/mmp.c
+++ b/fs/ext4/mmp.c
@@ -156,7 +156,12 @@ static int kmmpd(void *data)
 	memcpy(mmp->mmp_nodename, init_utsname()->nodename,
 	       sizeof(mmp->mmp_nodename));
 
-	while (!kthread_should_stop()) {
+	while (!kthread_should_stop() && !sb_rdonly(sb)) {
+		if (!ext4_has_feature_mmp(sb)) {
+			ext4_warning(sb, "kmmpd being stopped since MMP feature"
+				     " has been disabled.");
+			goto wait_to_exit;
+		}
 		if (++seq > EXT4_MMP_SEQ_MAX)
 			seq = 1;
 
@@ -177,16 +182,6 @@ static int kmmpd(void *data)
 			failed_writes++;
 		}
 
-		if (!(le32_to_cpu(es->s_feature_incompat) &
-		    EXT4_FEATURE_INCOMPAT_MMP)) {
-			ext4_warning(sb, "kmmpd being stopped since MMP feature"
-				     " has been disabled.");
-			goto exit_thread;
-		}
-
-		if (sb_rdonly(sb))
-			break;
-
 		diff = jiffies - last_update_time;
 		if (diff < mmp_update_interval * HZ)
 			schedule_timeout_interruptible(mmp_update_interval *
@@ -207,7 +202,7 @@ static int kmmpd(void *data)
 				ext4_error_err(sb, -retval,
 					       "error reading MMP data: %d",
 					       retval);
-				goto exit_thread;
+				goto wait_to_exit;
 			}
 
 			mmp_check = (struct mmp_struct *)(bh_check->b_data);
@@ -221,7 +216,7 @@ static int kmmpd(void *data)
 				ext4_error_err(sb, EBUSY, "abort");
 				put_bh(bh_check);
 				retval = -EBUSY;
-				goto exit_thread;
+				goto wait_to_exit;
 			}
 			put_bh(bh_check);
 		}
@@ -244,7 +239,13 @@ static int kmmpd(void *data)
 
 	retval = write_mmp_block(sb, bh);
 
-exit_thread:
+wait_to_exit:
+	while (!kthread_should_stop()) {
+		set_current_state(TASK_INTERRUPTIBLE);
+		if (!kthread_should_stop())
+			schedule();
+	}
+	set_current_state(TASK_RUNNING);
 	return retval;
 }
 
@@ -391,5 +392,3 @@ int ext4_multi_mount_protect(struct super_block *sb,
 	brelse(bh);
 	return 1;
 }
-
-
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index cbeb02429671..953c7e875783 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5932,7 +5932,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
 				 */
 				ext4_mark_recovery_complete(sb, es);
 			}
-			ext4_stop_mmpd(sbi);
 		} else {
 			/* Make sure we can mount this feature set readwrite */
 			if (ext4_has_feature_readonly(sb) ||
@@ -6046,6 +6045,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
 	if (!test_opt(sb, BLOCK_VALIDITY) && sbi->s_system_blks)
 		ext4_release_system_zone(sb);
 
+	if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
+		ext4_stop_mmpd(sbi);
+
 	/*
 	 * Some options can be enabled by ext4 and/or by VFS mount flag
 	 * either way we need to make sure it matches in both *flags and
@@ -6078,6 +6080,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
 	for (i = 0; i < EXT4_MAXQUOTAS; i++)
 		kfree(to_free[i]);
 #endif
+	if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
+		ext4_stop_mmpd(sbi);
 	kfree(orig_data);
 	return err;
 }

From 693ecbe8f799405f8775719deedb1f76265d375a Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Thu, 21 Oct 2021 14:29:44 +0200
Subject: [PATCH 1049/1750] usbnet: sanity check for maxpacket

commit 397430b50a363d8b7bdda00522123f82df6adc5e upstream.

maxpacket of 0 makes no sense and oopses as we need to divide
by it. Give up.

V2: fixed typo in log and stylistic issues

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+76bb1d34ffa0adc03baa@syzkaller.appspotmail.com
Reviewed-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211021122944.21816-1-oneukum@suse.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/usbnet.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 6062dc27870e..d0c8aec1b8da 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1755,6 +1755,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 	if (!dev->rx_urb_size)
 		dev->rx_urb_size = dev->hard_mtu;
 	dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
+	if (dev->maxpacket == 0) {
+		/* that is a broken device */
+		goto out4;
+	}
 
 	/* let userspace know we have a random address */
 	if (ether_addr_equal(net->dev_addr, node_id))

From 017718dfbb6fc7c75e43b1e2554638948d4cb607 Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Tue, 26 Oct 2021 20:40:15 +0800
Subject: [PATCH 1050/1750] usbnet: fix error return code in usbnet_probe()

commit 6f7c88691191e6c52ef2543d6f1da8d360b27a24 upstream.

Return error code if usb_maxpacket() returns 0 in usbnet_probe()

Fixes: 397430b50a36 ("usbnet: sanity check for maxpacket")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Reviewed-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211026124015.3025136-1-wanghai38@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/usbnet.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index d0c8aec1b8da..402390b1a66b 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1757,6 +1757,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 	dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
 	if (dev->maxpacket == 0) {
 		/* that is a broken device */
+		status = -ENODEV;
 		goto out4;
 	}
 

From 01c2881bb0e0a71b87ca425e1b763ac13855aa7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Fri, 8 Oct 2021 22:59:38 +0200
Subject: [PATCH 1051/1750] Revert "pinctrl: bcm: ns: support updated DT
 binding as syscon subnode"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 6dba4bdfd7a30e77b848a45404b224588bf989e5 upstream.

This reverts commit a49d784d5a8272d0f63c448fe8dc69e589db006e.

The updated binding was wrong / invalid and has been reverted. There
isn't any upstream kernel DTS using it and Broadcom isn't known to use
it neither. There is close to zero chance this will cause regression for
anyone.

Actually in-kernel bcm5301x.dtsi still uses the old good binding and so
it's broken since the driver update. This revert fixes it.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20211008205938.29925-3-zajec5@gmail.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/bcm/pinctrl-ns.c | 29 ++++++++++-------------------
 1 file changed, 10 insertions(+), 19 deletions(-)

diff --git a/drivers/pinctrl/bcm/pinctrl-ns.c b/drivers/pinctrl/bcm/pinctrl-ns.c
index e79690bd8b85..d7f8175d2c1c 100644
--- a/drivers/pinctrl/bcm/pinctrl-ns.c
+++ b/drivers/pinctrl/bcm/pinctrl-ns.c
@@ -5,7 +5,6 @@
 
 #include <linux/err.h>
 #include <linux/io.h>
-#include <linux/mfd/syscon.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
@@ -13,7 +12,6 @@
 #include <linux/pinctrl/pinctrl.h>
 #include <linux/pinctrl/pinmux.h>
 #include <linux/platform_device.h>
-#include <linux/regmap.h>
 #include <linux/slab.h>
 
 #define FLAG_BCM4708		BIT(1)
@@ -24,8 +22,7 @@ struct ns_pinctrl {
 	struct device *dev;
 	unsigned int chipset_flag;
 	struct pinctrl_dev *pctldev;
-	struct regmap *regmap;
-	u32 offset;
+	void __iomem *base;
 
 	struct pinctrl_desc pctldesc;
 	struct ns_pinctrl_group *groups;
@@ -232,9 +229,9 @@ static int ns_pinctrl_set_mux(struct pinctrl_dev *pctrl_dev,
 		unset |= BIT(pin_number);
 	}
 
-	regmap_read(ns_pinctrl->regmap, ns_pinctrl->offset, &tmp);
+	tmp = readl(ns_pinctrl->base);
 	tmp &= ~unset;
-	regmap_write(ns_pinctrl->regmap, ns_pinctrl->offset, tmp);
+	writel(tmp, ns_pinctrl->base);
 
 	return 0;
 }
@@ -266,13 +263,13 @@ static const struct of_device_id ns_pinctrl_of_match_table[] = {
 static int ns_pinctrl_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	struct device_node *np = dev->of_node;
 	const struct of_device_id *of_id;
 	struct ns_pinctrl *ns_pinctrl;
 	struct pinctrl_desc *pctldesc;
 	struct pinctrl_pin_desc *pin;
 	struct ns_pinctrl_group *group;
 	struct ns_pinctrl_function *function;
+	struct resource *res;
 	int i;
 
 	ns_pinctrl = devm_kzalloc(dev, sizeof(*ns_pinctrl), GFP_KERNEL);
@@ -290,18 +287,12 @@ static int ns_pinctrl_probe(struct platform_device *pdev)
 		return -EINVAL;
 	ns_pinctrl->chipset_flag = (uintptr_t)of_id->data;
 
-	ns_pinctrl->regmap = syscon_node_to_regmap(of_get_parent(np));
-	if (IS_ERR(ns_pinctrl->regmap)) {
-		int err = PTR_ERR(ns_pinctrl->regmap);
-
-		dev_err(dev, "Failed to map pinctrl regs: %d\n", err);
-
-		return err;
-	}
-
-	if (of_property_read_u32(np, "offset", &ns_pinctrl->offset)) {
-		dev_err(dev, "Failed to get register offset\n");
-		return -ENOENT;
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+					   "cru_gpio_control");
+	ns_pinctrl->base = devm_ioremap_resource(dev, res);
+	if (IS_ERR(ns_pinctrl->base)) {
+		dev_err(dev, "Failed to map pinctrl regs\n");
+		return PTR_ERR(ns_pinctrl->base);
 	}
 
 	memcpy(pctldesc, &ns_pinctrl_desc, sizeof(*pctldesc));

From 9a52798dce738020cef7e89ab3bbe5dee5f69a43 Mon Sep 17 00:00:00 2001
From: Sachi King <nakato@nakato.io>
Date: Sat, 9 Oct 2021 14:32:40 +1100
Subject: [PATCH 1052/1750] pinctrl: amd: disable and mask interrupts on probe

commit 4e5a04be88fe335ad5331f4f8c17f4ebd357e065 upstream.

Some systems such as the Microsoft Surface Laptop 4 leave interrupts
enabled and configured for use in sleep states on boot, which cause
unexpected behaviour such as spurious wakes and failed resumes in
s2idle states.

As interrupts should not be enabled until they are claimed and
explicitly enabled, disabling any interrupts mistakenly left enabled by
firmware should be safe.

Signed-off-by: Sachi King <nakato@nakato.io>
Link: https://lore.kernel.org/r/20211009033240.21543-1-nakato@nakato.io
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/pinctrl-amd.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index ef49402c0623..e20bcc835d6a 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -764,6 +764,34 @@ static const struct pinconf_ops amd_pinconf_ops = {
 	.pin_config_group_set = amd_pinconf_group_set,
 };
 
+static void amd_gpio_irq_init(struct amd_gpio *gpio_dev)
+{
+	struct pinctrl_desc *desc = gpio_dev->pctrl->desc;
+	unsigned long flags;
+	u32 pin_reg, mask;
+	int i;
+
+	mask = BIT(WAKE_CNTRL_OFF_S0I3) | BIT(WAKE_CNTRL_OFF_S3) |
+		BIT(INTERRUPT_MASK_OFF) | BIT(INTERRUPT_ENABLE_OFF) |
+		BIT(WAKE_CNTRL_OFF_S4);
+
+	for (i = 0; i < desc->npins; i++) {
+		int pin = desc->pins[i].number;
+		const struct pin_desc *pd = pin_desc_get(gpio_dev->pctrl, pin);
+
+		if (!pd)
+			continue;
+
+		raw_spin_lock_irqsave(&gpio_dev->lock, flags);
+
+		pin_reg = readl(gpio_dev->base + i * 4);
+		pin_reg &= ~mask;
+		writel(pin_reg, gpio_dev->base + i * 4);
+
+		raw_spin_unlock_irqrestore(&gpio_dev->lock, flags);
+	}
+}
+
 #ifdef CONFIG_PM_SLEEP
 static bool amd_gpio_should_save(struct amd_gpio *gpio_dev, unsigned int pin)
 {
@@ -901,6 +929,9 @@ static int amd_gpio_probe(struct platform_device *pdev)
 		return PTR_ERR(gpio_dev->pctrl);
 	}
 
+	/* Disable and mask interrupts */
+	amd_gpio_irq_init(gpio_dev);
+
 	girq = &gpio_dev->gc.irq;
 	girq->chip = &amd_gpio_irqchip;
 	/* This will let us handle the parent IRQ in the driver */

From 5aa5bab579575452bc59f9626e1cd44b4cfbd373 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Fri, 22 Oct 2021 09:12:26 +0000
Subject: [PATCH 1053/1750] ata: sata_mv: Fix the error handling of
 mv_chip_id()

commit a0023bb9dd9bc439d44604eeec62426a990054cd upstream.

mv_init_host() propagates the value returned by mv_chip_id() which in turn
gets propagated by mv_pci_init_one() and hits local_pci_probe().

During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.

Since this is a bug rather than a recoverable runtime error we should
use dev_alert() instead of dev_err().

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/sata_mv.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index b62446ea5f40..11be88f70690 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -3892,8 +3892,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
 		break;
 
 	default:
-		dev_err(host->dev, "BUG: invalid board index %u\n", board_idx);
-		return 1;
+		dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx);
+		return -EINVAL;
 	}
 
 	hpriv->hp_flags = hp_flags;

From 0b1b3e086b0af2c2faa9938c4db956fe6ce5c965 Mon Sep 17 00:00:00 2001
From: Max VA <maxv@sentinelone.com>
Date: Mon, 25 Oct 2021 17:31:53 +0200
Subject: [PATCH 1054/1750] tipc: fix size validations for the MSG_CRYPTO type

commit fa40d9734a57bcbfa79a280189799f76c88f7bb0 upstream.

The function tipc_crypto_key_rcv is used to parse MSG_CRYPTO messages
to receive keys from other nodes in the cluster in order to decrypt any
further messages from them.
This patch verifies that any supplied sizes in the message body are
valid for the received message.

Fixes: 1ef6f7c9390f ("tipc: add automatic session key exchange")
Signed-off-by: Max VA <maxv@sentinelone.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/crypto.c | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c
index f8e73c4a0093..23b100f36ee4 100644
--- a/net/tipc/crypto.c
+++ b/net/tipc/crypto.c
@@ -2278,43 +2278,53 @@ static bool tipc_crypto_key_rcv(struct tipc_crypto *rx, struct tipc_msg *hdr)
 	u16 key_gen = msg_key_gen(hdr);
 	u16 size = msg_data_sz(hdr);
 	u8 *data = msg_data(hdr);
+	unsigned int keylen;
+
+	/* Verify whether the size can exist in the packet */
+	if (unlikely(size < sizeof(struct tipc_aead_key) + TIPC_AEAD_KEYLEN_MIN)) {
+		pr_debug("%s: message data size is too small\n", rx->name);
+		goto exit;
+	}
+
+	keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME)));
+
+	/* Verify the supplied size values */
+	if (unlikely(size != keylen + sizeof(struct tipc_aead_key) ||
+		     keylen > TIPC_AEAD_KEY_SIZE_MAX)) {
+		pr_debug("%s: invalid MSG_CRYPTO key size\n", rx->name);
+		goto exit;
+	}
 
 	spin_lock(&rx->lock);
 	if (unlikely(rx->skey || (key_gen == rx->key_gen && rx->key.keys))) {
 		pr_err("%s: key existed <%p>, gen %d vs %d\n", rx->name,
 		       rx->skey, key_gen, rx->key_gen);
-		goto exit;
+		goto exit_unlock;
 	}
 
 	/* Allocate memory for the key */
 	skey = kmalloc(size, GFP_ATOMIC);
 	if (unlikely(!skey)) {
 		pr_err("%s: unable to allocate memory for skey\n", rx->name);
-		goto exit;
+		goto exit_unlock;
 	}
 
 	/* Copy key from msg data */
-	skey->keylen = ntohl(*((__be32 *)(data + TIPC_AEAD_ALG_NAME)));
+	skey->keylen = keylen;
 	memcpy(skey->alg_name, data, TIPC_AEAD_ALG_NAME);
 	memcpy(skey->key, data + TIPC_AEAD_ALG_NAME + sizeof(__be32),
 	       skey->keylen);
 
-	/* Sanity check */
-	if (unlikely(size != tipc_aead_key_size(skey))) {
-		kfree(skey);
-		skey = NULL;
-		goto exit;
-	}
-
 	rx->key_gen = key_gen;
 	rx->skey_mode = msg_key_mode(hdr);
 	rx->skey = skey;
 	rx->nokey = 0;
 	mb(); /* for nokey flag */
 
-exit:
+exit_unlock:
 	spin_unlock(&rx->lock);
 
+exit:
 	/* Schedule the key attaching on this crypto */
 	if (likely(skey && queue_delayed_work(tx->wq, &rx->work, 0)))
 		return true;

From 11c0406b4c3379a410876739b39227446598572a Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Mon, 25 Oct 2021 16:49:36 +0200
Subject: [PATCH 1055/1750] nfc: port100: fix using -ERRNO as command type mask

commit 2195f2062e4cc93870da8e71c318ef98a1c51cef upstream.

During probing, the driver tries to get a list (mask) of supported
command types in port100_get_command_type_mask() function.  The value
is u64 and 0 is treated as invalid mask (no commands supported).  The
function however returns also -ERRNO as u64 which will be interpret as
valid command mask.

Return 0 on every error case of port100_get_command_type_mask(), so the
probing will stop.

Cc: <stable@vger.kernel.org>
Fixes: 0347a6ab300a ("NFC: port100: Commands mechanism implementation")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nfc/port100.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index 8e4d355dc3ae..1caebefb25ff 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -1003,11 +1003,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev)
 
 	skb = port100_alloc_skb(dev, 0);
 	if (!skb)
-		return -ENOMEM;
+		return 0;
 
 	resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb);
 	if (IS_ERR(resp))
-		return PTR_ERR(resp);
+		return 0;
 
 	if (resp->len < 8)
 		mask = 0;

From c828115a14eacbf42042770fd68543f134e89efa Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 30 Sep 2021 20:49:42 +0300
Subject: [PATCH 1056/1750] Revert "net: mdiobus: Fix memory leak in
 __mdiobus_register"

commit 10eff1f5788b6ffac212c254e2f3666219576889 upstream.

This reverts commit ab609f25d19858513919369ff3d9a63c02cd9e2e.

This patch is correct in the sense that we _should_ call device_put() in
case of device_register() failure, but the problem in this code is more
vast.

We need to set bus->state to UNMDIOBUS_REGISTERED before calling
device_register() to correctly release the device in mdiobus_free().
This patch prevents us from doing it, since in case of device_register()
failure put_device() will be called 2 times and it will cause UAF or
something else.

Also, Reported-by: tag in revered commit was wrong, since syzbot
reported different leak in same function.

Link: https://lore.kernel.org/netdev/20210928092657.GI2048@kadam/
Acked-by: Yanfei Xu <yanfei.xu@windriver.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/f12fb1faa4eccf0f355788225335eb4309ff2599.1633024062.git.paskripkin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/mdio_bus.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 453490be7055..2645ca35103c 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -544,7 +544,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 	err = device_register(&bus->dev);
 	if (err) {
 		pr_err("mii_bus %s failed to register\n", bus->id);
-		put_device(&bus->dev);
 		return -EINVAL;
 	}
 

From f3dec7e7ace38224f82cf83f0049159d067c2e19 Mon Sep 17 00:00:00 2001
From: Daniel Jordan <daniel.m.jordan@oracle.com>
Date: Wed, 27 Oct 2021 17:59:20 -0400
Subject: [PATCH 1057/1750] net/tls: Fix flipped sign in tls_err_abort() calls

commit da353fac65fede6b8b4cfe207f0d9408e3121105 upstream.

sk->sk_err appears to expect a positive value, a convention that ktls
doesn't always follow and that leads to memory corruption in other code.
For instance,

    [kworker]
    tls_encrypt_done(..., err=<negative error from crypto request>)
      tls_err_abort(.., err)
        sk->sk_err = err;

    [task]
    splice_from_pipe_feed
      ...
        tls_sw_do_sendpage
          if (sk->sk_err) {
            ret = -sk->sk_err;  // ret is positive

    splice_from_pipe_feed (continued)
      ret = actor(...)  // ret is still positive and interpreted as bytes
                        // written, resulting in underflow of buf->len and
                        // sd->len, leading to huge buf->offset and bogus
                        // addresses computed in later calls to actor()

Fix all tls_err_abort() callers to pass a negative error code
consistently and centralize the error-prone sign flip there, throwing in
a warning to catch future misuse and uninlining the function so it
really does only warn once.

Cc: stable@vger.kernel.org
Fixes: c46234ebb4d1e ("tls: RX path for ktls")
Reported-by: syzbot+b187b77c8474f9648fae@syzkaller.appspotmail.com
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/tls.h |  9 ++-------
 net/tls/tls_sw.c  | 17 +++++++++++++----
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/include/net/tls.h b/include/net/tls.h
index 43891b28fc48..745b3bc6ce91 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -359,6 +359,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval,
 		int __user *optlen);
 int tls_sk_attach(struct sock *sk, int optname, char __user *optval,
 		  unsigned int optlen);
+void tls_err_abort(struct sock *sk, int err);
 
 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx);
 void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx);
@@ -467,12 +468,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
 #endif
 }
 
-static inline void tls_err_abort(struct sock *sk, int err)
-{
-	sk->sk_err = err;
-	sk->sk_error_report(sk);
-}
-
 static inline bool tls_bigint_increment(unsigned char *seq, int len)
 {
 	int i;
@@ -513,7 +508,7 @@ static inline void tls_advance_record_sn(struct sock *sk,
 					 struct cipher_context *ctx)
 {
 	if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size))
-		tls_err_abort(sk, EBADMSG);
+		tls_err_abort(sk, -EBADMSG);
 
 	if (prot->version != TLS_1_3_VERSION)
 		tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 15395683b8e2..eda1a5d0ef0c 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -35,6 +35,7 @@
  * SOFTWARE.
  */
 
+#include <linux/bug.h>
 #include <linux/sched/signal.h>
 #include <linux/module.h>
 #include <linux/splice.h>
@@ -43,6 +44,14 @@
 #include <net/strparser.h>
 #include <net/tls.h>
 
+noinline void tls_err_abort(struct sock *sk, int err)
+{
+	WARN_ON_ONCE(err >= 0);
+	/* sk->sk_err should contain a positive error code. */
+	sk->sk_err = -err;
+	sk->sk_error_report(sk);
+}
+
 static int __skb_nsg(struct sk_buff *skb, int offset, int len,
                      unsigned int recursion_level)
 {
@@ -419,7 +428,7 @@ int tls_tx_records(struct sock *sk, int flags)
 
 tx_err:
 	if (rc < 0 && rc != -EAGAIN)
-		tls_err_abort(sk, EBADMSG);
+		tls_err_abort(sk, -EBADMSG);
 
 	return rc;
 }
@@ -764,7 +773,7 @@ static int tls_push_record(struct sock *sk, int flags,
 			       msg_pl->sg.size + prot->tail_size, i);
 	if (rc < 0) {
 		if (rc != -EINPROGRESS) {
-			tls_err_abort(sk, EBADMSG);
+			tls_err_abort(sk, -EBADMSG);
 			if (split) {
 				tls_ctx->pending_open_record_frags = true;
 				tls_merge_open_record(sk, rec, tmp, orig_end);
@@ -1828,7 +1837,7 @@ int tls_sw_recvmsg(struct sock *sk,
 		err = decrypt_skb_update(sk, skb, &msg->msg_iter,
 					 &chunk, &zc, async_capable);
 		if (err < 0 && err != -EINPROGRESS) {
-			tls_err_abort(sk, EBADMSG);
+			tls_err_abort(sk, -EBADMSG);
 			goto recv_end;
 		}
 
@@ -2008,7 +2017,7 @@ ssize_t tls_sw_splice_read(struct socket *sock,  loff_t *ppos,
 		}
 
 		if (err < 0) {
-			tls_err_abort(sk, EBADMSG);
+			tls_err_abort(sk, -EBADMSG);
 			goto splice_read_end;
 		}
 		ctx->decrypted = 1;

From efe934629fff0dc8862e300cffdd9b1012be3333 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 13:56:08 +0200
Subject: [PATCH 1058/1750] mmc: vub300: fix control-message timeouts

commit 8c8171929116cc23f74743d99251eedadf62341a upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Cc: stable@vger.kernel.org      # 3.0
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025115608.5287-1-johan@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/vub300.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
index 4950d10d3a19..97beece62fec 100644
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -576,7 +576,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300)
 				GET_SYSTEM_PORT_STATUS,
 				USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				0x0000, 0x0000, &vub300->system_port_status,
-				sizeof(vub300->system_port_status), HZ);
+				sizeof(vub300->system_port_status), 1000);
 	if (sizeof(vub300->system_port_status) == retval)
 		new_system_port_status(vub300);
 }
@@ -1241,7 +1241,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
 						SET_INTERRUPT_PSEUDOCODE,
 						USB_DIR_OUT | USB_TYPE_VENDOR |
 						USB_RECIP_DEVICE, 0x0000, 0x0000,
-						xfer_buffer, xfer_length, HZ);
+						xfer_buffer, xfer_length, 1000);
 			kfree(xfer_buffer);
 			if (retval < 0)
 				goto copy_error_message;
@@ -1284,7 +1284,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
 						SET_TRANSFER_PSEUDOCODE,
 						USB_DIR_OUT | USB_TYPE_VENDOR |
 						USB_RECIP_DEVICE, 0x0000, 0x0000,
-						xfer_buffer, xfer_length, HZ);
+						xfer_buffer, xfer_length, 1000);
 			kfree(xfer_buffer);
 			if (retval < 0)
 				goto copy_error_message;
@@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
 		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
 				SET_CLOCK_SPEED,
 				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-				0x00, 0x00, buf, buf_array_size, HZ);
+				0x00, 0x00, buf, buf_array_size, 1000);
 	if (retval != 8) {
 		dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
 			" %dkHz failed with retval=%d\n", kHzClock, retval);
@@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
 				SET_SD_POWER,
 				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-				0x0000, 0x0000, NULL, 0, HZ);
+				0x0000, 0x0000, NULL, 0, 1000);
 		/* must wait for the VUB300 u-proc to boot up */
 		msleep(600);
 	} else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
 		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
 				SET_SD_POWER,
 				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-				0x0001, 0x0000, NULL, 0, HZ);
+				0x0001, 0x0000, NULL, 0, 1000);
 		msleep(600);
 		vub300->card_powered = 1;
 	} else if (ios->power_mode == MMC_POWER_ON) {
@@ -2275,14 +2275,14 @@ static int vub300_probe(struct usb_interface *interface,
 				GET_HC_INF0,
 				USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				0x0000, 0x0000, &vub300->hc_info,
-				sizeof(vub300->hc_info), HZ);
+				sizeof(vub300->hc_info), 1000);
 	if (retval < 0)
 		goto error5;
 	retval =
 		usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
 				SET_ROM_WAIT_STATES,
 				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-				firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
+				firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
 	if (retval < 0)
 		goto error5;
 	dev_info(&vub300->udev->dev,
@@ -2297,7 +2297,7 @@ static int vub300_probe(struct usb_interface *interface,
 				GET_SYSTEM_PORT_STATUS,
 				USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				0x0000, 0x0000, &vub300->system_port_status,
-				sizeof(vub300->system_port_status), HZ);
+				sizeof(vub300->system_port_status), 1000);
 	if (retval < 0) {
 		goto error4;
 	} else if (sizeof(vub300->system_port_status) == retval) {

From 44c2bc2a6bbe6da262533c57969b14d1d1679c68 Mon Sep 17 00:00:00 2001
From: Wenbin Mei <wenbin.mei@mediatek.com>
Date: Tue, 26 Oct 2021 15:08:12 +0800
Subject: [PATCH 1059/1750] mmc: cqhci: clear HALT state after CQE enable

commit 92b18252b91de567cd875f2e84722b10ab34ee28 upstream.

While mmc0 enter suspend state, we need halt CQE to send legacy cmd(flush
cache) and disable cqe, for resume back, we enable CQE and not clear HALT
state.
In this case MediaTek mmc host controller will keep the value for HALT
state after CQE disable/enable flow, so the next CQE transfer after resume
will be timeout due to CQE is in HALT state, the log as below:
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: timeout for tag 2
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: ============ CQHCI REGISTER DUMP ===========
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Caps:      0x100020b6 | Version:  0x00000510
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Config:    0x00001103 | Control:  0x00000001
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int stat:  0x00000000 | Int enab: 0x00000006
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Int sig:   0x00000006 | Int Coal: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: TDL base:  0xfd05f000 | TDL up32: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Doorbell:  0x8000203c | TCN:      0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Dev queue: 0x00000000 | Dev Pend: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Task clr:  0x00000000 | SSC1:     0x00001000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: SSC2:      0x00000001 | DCMD rsp: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: RED mask:  0xfdf9a080 | TERRI:    0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: Resp idx:  0x00000000 | Resp arg: 0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQP:     0x00000000 | CRNQDUN:  0x00000000
<4>.(4)[318:kworker/4:1H]mmc0: cqhci: CRNQIS:    0x00000000 | CRNQIE:   0x00000000

This change check HALT state after CQE enable, if CQE is in HALT state, we
will clear it.

Signed-off-by: Wenbin Mei <wenbin.mei@mediatek.com>
Cc: stable@vger.kernel.org
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host")
Link: https://lore.kernel.org/r/20211026070812.9359-1-wenbin.mei@mediatek.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/cqhci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
index 697fe40756bf..7ba4f714106f 100644
--- a/drivers/mmc/host/cqhci.c
+++ b/drivers/mmc/host/cqhci.c
@@ -273,6 +273,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host)
 
 	cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
 
+	if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT)
+		cqhci_writel(cq_host, 0, CQHCI_CTL);
+
 	mmc->cqe_on = true;
 
 	if (cq_host->ops->enable)

From 12a46f72f4994cf17b1dd3d94d11094ea5a15f86 Mon Sep 17 00:00:00 2001
From: Wenbin Mei <wenbin.mei@mediatek.com>
Date: Thu, 28 Oct 2021 10:20:49 +0800
Subject: [PATCH 1060/1750] mmc: mediatek: Move cqhci init behind ungate clock

commit e8a1ff65927080278e6826f797b7c197fb2611a6 upstream.

We must enable clock before cqhci init, because crypto needs read
information from CQHCI registers, otherwise, it will hang in MediaTek mmc
host controller.

Signed-off-by: Wenbin Mei <wenbin.mei@mediatek.com>
Fixes: 88bd652b3c74 ("mmc: mediatek: command queue support")
Cc: stable@vger.kernel.org
Acked-by: Chaotian Jing <chaotian.jing@mediatek.com>
Link: https://lore.kernel.org/r/20211028022049.22129-1-wenbin.mei@mediatek.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/mtk-sd.c | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index dc84e2dff408..fb8b9475b1d0 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -2503,6 +2503,25 @@ static int msdc_drv_probe(struct platform_device *pdev)
 		host->dma_mask = DMA_BIT_MASK(32);
 	mmc_dev(mmc)->dma_mask = &host->dma_mask;
 
+	host->timeout_clks = 3 * 1048576;
+	host->dma.gpd = dma_alloc_coherent(&pdev->dev,
+				2 * sizeof(struct mt_gpdma_desc),
+				&host->dma.gpd_addr, GFP_KERNEL);
+	host->dma.bd = dma_alloc_coherent(&pdev->dev,
+				MAX_BD_NUM * sizeof(struct mt_bdma_desc),
+				&host->dma.bd_addr, GFP_KERNEL);
+	if (!host->dma.gpd || !host->dma.bd) {
+		ret = -ENOMEM;
+		goto release_mem;
+	}
+	msdc_init_gpd_bd(host, &host->dma);
+	INIT_DELAYED_WORK(&host->req_timeout, msdc_request_timeout);
+	spin_lock_init(&host->lock);
+
+	platform_set_drvdata(pdev, mmc);
+	msdc_ungate_clock(host);
+	msdc_init_hw(host);
+
 	if (mmc->caps2 & MMC_CAP2_CQE) {
 		host->cq_host = devm_kzalloc(mmc->parent,
 					     sizeof(*host->cq_host),
@@ -2523,25 +2542,6 @@ static int msdc_drv_probe(struct platform_device *pdev)
 		mmc->max_seg_size = 64 * 1024;
 	}
 
-	host->timeout_clks = 3 * 1048576;
-	host->dma.gpd = dma_alloc_coherent(&pdev->dev,
-				2 * sizeof(struct mt_gpdma_desc),
-				&host->dma.gpd_addr, GFP_KERNEL);
-	host->dma.bd = dma_alloc_coherent(&pdev->dev,
-				MAX_BD_NUM * sizeof(struct mt_bdma_desc),
-				&host->dma.bd_addr, GFP_KERNEL);
-	if (!host->dma.gpd || !host->dma.bd) {
-		ret = -ENOMEM;
-		goto release_mem;
-	}
-	msdc_init_gpd_bd(host, &host->dma);
-	INIT_DELAYED_WORK(&host->req_timeout, msdc_request_timeout);
-	spin_lock_init(&host->lock);
-
-	platform_set_drvdata(pdev, mmc);
-	msdc_ungate_clock(host);
-	msdc_init_hw(host);
-
 	ret = devm_request_irq(&pdev->dev, host->irq, msdc_irq,
 			       IRQF_TRIGGER_NONE, pdev->name, host);
 	if (ret)

From a95a76fc01a0e7b79c02cb73962fea44f6e3c4a0 Mon Sep 17 00:00:00 2001
From: Jaehoon Chung <jh80.chung@samsung.com>
Date: Fri, 22 Oct 2021 17:21:06 +0900
Subject: [PATCH 1061/1750] mmc: dw_mmc: exynos: fix the finding clock sample
 value

commit 697542bceae51f7620af333b065dd09d213629fb upstream.

Even though there are candiates value if can't find best value, it's
returned -EIO. It's not proper behavior.
If there is not best value, use a first candiate value to work eMMC.

Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Christian Hewitt <christianshewitt@gmail.com>
Cc: stable@vger.kernel.org
Fixes: c537a1c5ff63 ("mmc: dw_mmc: exynos: add variable delay tuning sequence")
Link: https://lore.kernel.org/r/20211022082106.1557-1-jh80.chung@samsung.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/dw_mmc-exynos.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
index 0c75810812a0..1f8a3c0ddfe1 100644
--- a/drivers/mmc/host/dw_mmc-exynos.c
+++ b/drivers/mmc/host/dw_mmc-exynos.c
@@ -464,6 +464,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates)
 		}
 	}
 
+	/*
+	 * If there is no cadiates value, then it needs to return -EIO.
+	 * If there are candiates values and don't find bset clk sample value,
+	 * then use a first candiates clock sample value.
+	 */
+	for (i = 0; i < iter; i++) {
+		__c = ror8(candiates, i);
+		if ((__c & 0x1) == 0x1) {
+			loc = i;
+			goto out;
+		}
+	}
 out:
 	return loc;
 }
@@ -494,6 +506,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode)
 		priv->tuned_sample = found;
 	} else {
 		ret = -EIO;
+		dev_warn(&mmc->class_dev,
+			"There is no candiates value about clksmpl!\n");
 	}
 
 	return ret;

From ee3213b117ce93d8df90d43e3eecb89b3c8e6f92 Mon Sep 17 00:00:00 2001
From: Shawn Guo <shawn.guo@linaro.org>
Date: Mon, 4 Oct 2021 10:49:35 +0800
Subject: [PATCH 1062/1750] mmc: sdhci: Map more voltage level to
 SDHCI_POWER_330

commit 4217d07b9fb328751f877d3bd9550122014860a2 upstream.

On Thundercomm TurboX CM2290, the eMMC OCR reports vdd = 23 (3.5 ~ 3.6 V),
which is being treated as an invalid value by sdhci_set_power_noreg().
And thus eMMC is totally broken on the platform.

[    1.436599] ------------[ cut here ]------------
[    1.436606] mmc0: Invalid vdd 0x17
[    1.436640] WARNING: CPU: 2 PID: 69 at drivers/mmc/host/sdhci.c:2048 sdhci_set_power_noreg+0x168/0x2b4
[    1.436655] Modules linked in:
[    1.436662] CPU: 2 PID: 69 Comm: kworker/u8:1 Tainted: G        W         5.15.0-rc1+ #137
[    1.436669] Hardware name: Thundercomm TurboX CM2290 (DT)
[    1.436674] Workqueue: events_unbound async_run_entry_fn
[    1.436685] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    1.436692] pc : sdhci_set_power_noreg+0x168/0x2b4
[    1.436698] lr : sdhci_set_power_noreg+0x168/0x2b4
[    1.436703] sp : ffff800010803a60
[    1.436705] x29: ffff800010803a60 x28: ffff6a9102465f00 x27: ffff6a9101720a70
[    1.436715] x26: ffff6a91014de1c0 x25: ffff6a91014de010 x24: ffff6a91016af280
[    1.436724] x23: ffffaf7b1b276640 x22: 0000000000000000 x21: ffff6a9101720000
[    1.436733] x20: ffff6a9101720370 x19: ffff6a9101720580 x18: 0000000000000020
[    1.436743] x17: 0000000000000000 x16: 0000000000000004 x15: ffffffffffffffff
[    1.436751] x14: 0000000000000000 x13: 00000000fffffffd x12: ffffaf7b1b84b0bc
[    1.436760] x11: ffffaf7b1b720d10 x10: 000000000000000a x9 : ffff800010803a60
[    1.436769] x8 : 000000000000000a x7 : 000000000000000f x6 : 00000000fffff159
[    1.436778] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff
[    1.436787] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff6a9101718d80
[    1.436797] Call trace:
[    1.436800]  sdhci_set_power_noreg+0x168/0x2b4
[    1.436805]  sdhci_set_ios+0xa0/0x7fc
[    1.436811]  mmc_power_up.part.0+0xc4/0x164
[    1.436818]  mmc_start_host+0xa0/0xb0
[    1.436824]  mmc_add_host+0x60/0x90
[    1.436830]  __sdhci_add_host+0x174/0x330
[    1.436836]  sdhci_msm_probe+0x7c0/0x920
[    1.436842]  platform_probe+0x68/0xe0
[    1.436850]  really_probe.part.0+0x9c/0x31c
[    1.436857]  __driver_probe_device+0x98/0x144
[    1.436863]  driver_probe_device+0xc8/0x15c
[    1.436869]  __device_attach_driver+0xb4/0x120
[    1.436875]  bus_for_each_drv+0x78/0xd0
[    1.436881]  __device_attach_async_helper+0xac/0xd0
[    1.436888]  async_run_entry_fn+0x34/0x110
[    1.436895]  process_one_work+0x1d0/0x354
[    1.436903]  worker_thread+0x13c/0x470
[    1.436910]  kthread+0x150/0x160
[    1.436915]  ret_from_fork+0x10/0x20
[    1.436923] ---[ end trace fcfac44cb045c3a8 ]---

Fix the issue by mapping MMC_VDD_35_36 (and MMC_VDD_34_35) to
SDHCI_POWER_330 as well.

Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211004024935.15326-1-shawn.guo@linaro.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index b1e1d327cb8e..07d131fac760 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -2043,6 +2043,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
 			break;
 		case MMC_VDD_32_33:
 		case MMC_VDD_33_34:
+		/*
+		 * 3.4 ~ 3.6V are valid only for those platforms where it's
+		 * known that the voltage range is supported by hardware.
+		 */
+		case MMC_VDD_34_35:
+		case MMC_VDD_35_36:
 			pwr = SDHCI_POWER_330;
 			break;
 		default:

From 01169a43353d4cb895d1957cd70dc553da3f944e Mon Sep 17 00:00:00 2001
From: Haibo Chen <haibo.chen@nxp.com>
Date: Fri, 15 Oct 2021 10:00:36 +0800
Subject: [PATCH 1063/1750] mmc: sdhci-esdhc-imx: clear the buffer_read_ready
 to reset standard tuning circuit

commit 9af372dc70e9fdcbb70939dac75365e7b88580b4 upstream.

To reset standard tuning circuit completely, after clear ESDHC_MIX_CTRL_EXE_TUNE,
also need to clear bit buffer_read_ready, this operation will finally clear the
USDHC IP internal logic flag execute_tuning_with_clr_buf, make sure the following
normal data transfer will not be impacted by standard tuning logic used before.

Find this issue when do quick SD card insert/remove stress test. During standard
tuning prodedure, if remove SD card, USDHC standard tuning logic can't clear the
internal flag execute_tuning_with_clr_buf. Next time when insert SD card, all
data related commands can't get any data related interrupts, include data transfer
complete interrupt, data timeout interrupt, data CRC interrupt, data end bit interrupt.
Always trigger software timeout issue. Even reset the USDHC through bits in register
SYS_CTRL (0x2C, bit28 reset tuning, bit26 reset data, bit 25 reset command, bit 24
reset all) can't recover this. From the user's point of view, USDHC stuck, SD can't
be recognized any more.

Fixes: d9370424c948 ("mmc: sdhci-esdhc-imx: reset tuning circuit when power on mmc card")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1634263236-6111-1-git-send-email-haibo.chen@nxp.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/sdhci-esdhc-imx.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d28809e47962..20cbd71cba9d 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -1157,6 +1157,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
 	u32 ctrl;
+	int ret;
 
 	/* Reset the tuning circuit */
 	if (esdhc_is_usdhc(imx_data)) {
@@ -1169,7 +1170,22 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
 		} else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
 			ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
 			ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
+			ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE;
 			writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
+			/* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */
+			ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS,
+				ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50);
+			if (ret == -ETIMEDOUT)
+				dev_warn(mmc_dev(host->mmc),
+				 "Warning! clear execute tuning bit failed\n");
+			/*
+			 * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the
+			 * usdhc IP internal logic flag execute_tuning_with_clr_buf, which
+			 * will finally make sure the normal data transfer logic correct.
+			 */
+			ctrl = readl(host->ioaddr + SDHCI_INT_STATUS);
+			ctrl |= SDHCI_INT_DATA_AVAIL;
+			writel(ctrl, host->ioaddr + SDHCI_INT_STATUS);
 		}
 	}
 }

From 5043fbd294f5909a080ade0f04b70a4da9e122b7 Mon Sep 17 00:00:00 2001
From: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
Date: Thu, 28 Oct 2021 14:36:17 -0700
Subject: [PATCH 1064/1750] ocfs2: fix race between searching chunks and
 release journal_head from buffer_head

commit 6f1b228529ae49b0f85ab89bcdb6c365df401558 upstream.

Encountered a race between ocfs2_test_bg_bit_allocatable() and
jbd2_journal_put_journal_head() resulting in the below vmcore.

  PID: 106879  TASK: ffff880244ba9c00  CPU: 2   COMMAND: "loop3"
  Call trace:
    panic
    oops_end
    no_context
    __bad_area_nosemaphore
    bad_area_nosemaphore
    __do_page_fault
    do_page_fault
    page_fault
      [exception RIP: ocfs2_block_group_find_clear_bits+316]
    ocfs2_block_group_find_clear_bits [ocfs2]
    ocfs2_cluster_group_search [ocfs2]
    ocfs2_search_chain [ocfs2]
    ocfs2_claim_suballoc_bits [ocfs2]
    __ocfs2_claim_clusters [ocfs2]
    ocfs2_claim_clusters [ocfs2]
    ocfs2_local_alloc_slide_window [ocfs2]
    ocfs2_reserve_local_alloc_bits [ocfs2]
    ocfs2_reserve_clusters_with_limit [ocfs2]
    ocfs2_reserve_clusters [ocfs2]
    ocfs2_lock_refcount_allocators [ocfs2]
    ocfs2_make_clusters_writable [ocfs2]
    ocfs2_replace_cow [ocfs2]
    ocfs2_refcount_cow [ocfs2]
    ocfs2_file_write_iter [ocfs2]
    lo_rw_aio
    loop_queue_work
    kthread_worker_fn
    kthread
    ret_from_fork

When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the
bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and
released the jounal head from the buffer head.  Needed to take bit lock
for the bit 'BH_JournalHead' to fix this race.

Link: https://lkml.kernel.org/r/1634820718-6043-1-git-send-email-gautham.ananthakrishna@oracle.com
Signed-off-by: Gautham Ananthakrishna <gautham.ananthakrishna@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: <rajesh.sivaramasubramaniom@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/suballoc.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index 8c8cf7f4eb34..e7d04adb6cb8 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -1253,7 +1253,7 @@ static int ocfs2_test_bg_bit_allocatable(struct buffer_head *bg_bh,
 {
 	struct ocfs2_group_desc *bg = (struct ocfs2_group_desc *) bg_bh->b_data;
 	struct journal_head *jh;
-	int ret;
+	int ret = 1;
 
 	if (ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap))
 		return 0;
@@ -1261,14 +1261,18 @@ static int ocfs2_test_bg_bit_allocatable(struct buffer_head *bg_bh,
 	if (!buffer_jbd(bg_bh))
 		return 1;
 
-	jh = bh2jh(bg_bh);
-	spin_lock(&jh->b_state_lock);
-	bg = (struct ocfs2_group_desc *) jh->b_committed_data;
-	if (bg)
-		ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
-	else
-		ret = 1;
-	spin_unlock(&jh->b_state_lock);
+	jbd_lock_bh_journal_head(bg_bh);
+	if (buffer_jbd(bg_bh)) {
+		jh = bh2jh(bg_bh);
+		spin_lock(&jh->b_state_lock);
+		bg = (struct ocfs2_group_desc *) jh->b_committed_data;
+		if (bg)
+			ret = !ocfs2_test_bit(nr, (unsigned long *)bg->bg_bitmap);
+		else
+			ret = 1;
+		spin_unlock(&jh->b_state_lock);
+	}
+	jbd_unlock_bh_journal_head(bg_bh);
 
 	return ret;
 }

From db1191a529e45c41bfd7692ccc5157fe90dc4a9c Mon Sep 17 00:00:00 2001
From: Sagi Grimberg <sagi@grimberg.me>
Date: Sun, 24 Oct 2021 10:43:31 +0300
Subject: [PATCH 1065/1750] nvme-tcp: fix H2CData PDU send accounting (again)

commit 25e1f67eda4a19c91dc05c84d6d413c53efb447b upstream.

We should not access request members after the last send, even to
determine if indeed it was the last data payload send. The reason is
that a completion could have arrived and trigger a new execution of the
request which overridden these members. This was fixed by commit
825619b09ad3 ("nvme-tcp: fix possible use-after-completion").

Commit e371af033c56 broke that assumption again to address cases where
multiple r2t pdus are sent per request. To fix it, we need to record the
request data_sent and data_len and after the payload network send we
reference these counters to determine weather we should advance the
request iterator.

Fixes: e371af033c56 ("nvme-tcp: fix incorrect h2cdata pdu offset accounting")
Reported-by: Keith Busch <kbusch@kernel.org>
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/tcp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 05ad6bee085c..f3a7b6c1bdfa 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -910,12 +910,14 @@ static void nvme_tcp_fail_request(struct nvme_tcp_request *req)
 static int nvme_tcp_try_send_data(struct nvme_tcp_request *req)
 {
 	struct nvme_tcp_queue *queue = req->queue;
+	int req_data_len = req->data_len;
 
 	while (true) {
 		struct page *page = nvme_tcp_req_cur_page(req);
 		size_t offset = nvme_tcp_req_cur_offset(req);
 		size_t len = nvme_tcp_req_cur_length(req);
 		bool last = nvme_tcp_pdu_last_send(req, len);
+		int req_data_sent = req->data_sent;
 		int ret, flags = MSG_DONTWAIT;
 
 		if (last && !queue->data_digest && !nvme_tcp_queue_more(queue))
@@ -942,7 +944,7 @@ static int nvme_tcp_try_send_data(struct nvme_tcp_request *req)
 		 * in the request where we don't want to modify it as we may
 		 * compete with the RX path completing the request.
 		 */
-		if (req->data_sent + ret < req->data_len)
+		if (req_data_sent + ret < req_data_len)
 			nvme_tcp_advance_req(req, ret);
 
 		/* fully successful last send in current PDU */

From fa29cec42c2d306cae0d5dbe0d92f0185253e8dc Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Thu, 30 Sep 2021 13:11:21 +0200
Subject: [PATCH 1066/1750] cfg80211: scan: fix RCU in
 cfg80211_add_nontrans_list()

commit a2083eeb119fb9307258baea9b7c243ca9a2e0b6 upstream.

The SSID pointer is pointing to RCU protected data, so we
need to have it under rcu_read_lock() for the entire use.
Fix this.

Cc: stable@vger.kernel.org
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Link: https://lore.kernel.org/r/20210930131120.6ddfc603aa1d.I2137344c4e2426525b1a8e4ce5fca82f8ecbfe7e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/scan.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index fab1f0d50403..fd614a5a00b4 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -418,14 +418,17 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
 	}
 	ssid_len = ssid[1];
 	ssid = ssid + 2;
-	rcu_read_unlock();
 
 	/* check if nontrans_bss is in the list */
 	list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
-		if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len))
+		if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) {
+			rcu_read_unlock();
 			return 0;
+		}
 	}
 
+	rcu_read_unlock();
+
 	/* add to the list */
 	list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
 	return 0;

From 4c22227e39c7a0b4dab55617ee8d34d171fab8d4 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 25 Oct 2021 13:31:12 +0200
Subject: [PATCH 1067/1750] cfg80211: fix management registrations locking

commit 09b1d5dc6ce1c9151777f6c4e128a59457704c97 upstream.

The management registrations locking was broken, the list was
locked for each wdev, but cfg80211_mgmt_registrations_update()
iterated it without holding all the correct spinlocks, causing
list corruption.

Rather than trying to fix it with fine-grained locking, just
move the lock to the wiphy/rdev (still need the list on each
wdev), we already need to hold the wdev lock to change it, so
there's no contention on the lock in any case. This trivially
fixes the bug since we hold one wdev's lock already, and now
will hold the lock that protects all lists.

Cc: stable@vger.kernel.org
Reported-by: Jouni Malinen <j@w1.fi>
Fixes: 6cd536fe62ef ("cfg80211: change internal management frame registration API")
Link: https://lore.kernel.org/r/20211025133111.5cf733eab0f4.I7b0abb0494ab712f74e2efcd24bb31ac33f7eee9@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/cfg80211.h |  2 --
 net/wireless/core.c    |  2 +-
 net/wireless/core.h    |  2 ++
 net/wireless/mlme.c    | 26 ++++++++++++++------------
 4 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 8a1bf2dbadd0..2a819be384a7 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5202,7 +5202,6 @@ struct cfg80211_cqm_config;
  *	netdev and may otherwise be used by driver read-only, will be update
  *	by cfg80211 on change_interface
  * @mgmt_registrations: list of registrations for management frames
- * @mgmt_registrations_lock: lock for the list
  * @mgmt_registrations_need_update: mgmt registrations were updated,
  *	need to propagate the update to the driver
  * @mtx: mutex used to lock data in this struct, may be used by drivers
@@ -5249,7 +5248,6 @@ struct wireless_dev {
 	u32 identifier;
 
 	struct list_head mgmt_registrations;
-	spinlock_t mgmt_registrations_lock;
 	u8 mgmt_registrations_need_update:1;
 
 	struct mutex mtx;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 240282c083aa..3f4554723761 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -501,6 +501,7 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
 	INIT_WORK(&rdev->propagate_cac_done_wk, cfg80211_propagate_cac_done_wk);
 	INIT_WORK(&rdev->mgmt_registrations_update_wk,
 		  cfg80211_mgmt_registrations_update_wk);
+	spin_lock_init(&rdev->mgmt_registrations_lock);
 
 #ifdef CONFIG_CFG80211_DEFAULT_PS
 	rdev->wiphy.flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
@@ -1256,7 +1257,6 @@ void cfg80211_init_wdev(struct wireless_dev *wdev)
 	INIT_LIST_HEAD(&wdev->event_list);
 	spin_lock_init(&wdev->event_lock);
 	INIT_LIST_HEAD(&wdev->mgmt_registrations);
-	spin_lock_init(&wdev->mgmt_registrations_lock);
 	INIT_LIST_HEAD(&wdev->pmsr_list);
 	spin_lock_init(&wdev->pmsr_lock);
 	INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 7df91f940212..a3362a32acb3 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -101,6 +101,8 @@ struct cfg80211_registered_device {
 	struct work_struct propagate_cac_done_wk;
 
 	struct work_struct mgmt_registrations_update_wk;
+	/* lock for all wdev lists */
+	spinlock_t mgmt_registrations_lock;
 
 	/* must be last because of the way we do wiphy_priv(),
 	 * and it should at least be aligned to NETDEV_ALIGN */
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 0ac820780437..6dcfc5a34874 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -448,9 +448,9 @@ static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
 
 	ASSERT_RTNL();
 
-	spin_lock_bh(&wdev->mgmt_registrations_lock);
+	spin_lock_bh(&rdev->mgmt_registrations_lock);
 	if (!wdev->mgmt_registrations_need_update) {
-		spin_unlock_bh(&wdev->mgmt_registrations_lock);
+		spin_unlock_bh(&rdev->mgmt_registrations_lock);
 		return;
 	}
 
@@ -475,7 +475,7 @@ static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
 	rcu_read_unlock();
 
 	wdev->mgmt_registrations_need_update = 0;
-	spin_unlock_bh(&wdev->mgmt_registrations_lock);
+	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 	rdev_update_mgmt_frame_registrations(rdev, wdev, &upd);
 }
@@ -499,6 +499,7 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 				int match_len, bool multicast_rx,
 				struct netlink_ext_ack *extack)
 {
+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 	struct cfg80211_mgmt_registration *reg, *nreg;
 	int err = 0;
 	u16 mgmt_type;
@@ -544,7 +545,7 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 	if (!nreg)
 		return -ENOMEM;
 
-	spin_lock_bh(&wdev->mgmt_registrations_lock);
+	spin_lock_bh(&rdev->mgmt_registrations_lock);
 
 	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 		int mlen = min(match_len, reg->match_len);
@@ -579,7 +580,7 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 		list_add(&nreg->list, &wdev->mgmt_registrations);
 	}
 	wdev->mgmt_registrations_need_update = 1;
-	spin_unlock_bh(&wdev->mgmt_registrations_lock);
+	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 	cfg80211_mgmt_registrations_update(wdev);
 
@@ -587,7 +588,7 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 
  out:
 	kfree(nreg);
-	spin_unlock_bh(&wdev->mgmt_registrations_lock);
+	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 	return err;
 }
@@ -598,7 +599,7 @@ void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 	struct cfg80211_mgmt_registration *reg, *tmp;
 
-	spin_lock_bh(&wdev->mgmt_registrations_lock);
+	spin_lock_bh(&rdev->mgmt_registrations_lock);
 
 	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 		if (reg->nlportid != nlportid)
@@ -611,7 +612,7 @@ void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 		schedule_work(&rdev->mgmt_registrations_update_wk);
 	}
 
-	spin_unlock_bh(&wdev->mgmt_registrations_lock);
+	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 	if (nlportid && rdev->crit_proto_nlportid == nlportid) {
 		rdev->crit_proto_nlportid = 0;
@@ -624,15 +625,16 @@ void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
 
 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 {
+	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
 	struct cfg80211_mgmt_registration *reg, *tmp;
 
-	spin_lock_bh(&wdev->mgmt_registrations_lock);
+	spin_lock_bh(&rdev->mgmt_registrations_lock);
 	list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 		list_del(&reg->list);
 		kfree(reg);
 	}
 	wdev->mgmt_registrations_need_update = 1;
-	spin_unlock_bh(&wdev->mgmt_registrations_lock);
+	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 	cfg80211_mgmt_registrations_update(wdev);
 }
@@ -780,7 +782,7 @@ bool cfg80211_rx_mgmt_khz(struct wireless_dev *wdev, int freq, int sig_dbm,
 	data = buf + ieee80211_hdrlen(mgmt->frame_control);
 	data_len = len - ieee80211_hdrlen(mgmt->frame_control);
 
-	spin_lock_bh(&wdev->mgmt_registrations_lock);
+	spin_lock_bh(&rdev->mgmt_registrations_lock);
 
 	list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 		if (reg->frame_type != ftype)
@@ -804,7 +806,7 @@ bool cfg80211_rx_mgmt_khz(struct wireless_dev *wdev, int freq, int sig_dbm,
 		break;
 	}
 
-	spin_unlock_bh(&wdev->mgmt_registrations_lock);
+	spin_unlock_bh(&rdev->mgmt_registrations_lock);
 
 	trace_cfg80211_return_bool(result);
 	return result;

From 8fb858b74ac517763aa97bd3acaacbe31167ff14 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 26 Oct 2021 12:36:17 +0200
Subject: [PATCH 1068/1750] net: lan78xx: fix division by zero in send path

commit db6c3c064f5d55fa9969f33eafca3cdbefbb3541 upstream.

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in lan78xx_tx_bh() in case a malicious device has
broken descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Cc: stable@vger.kernel.org      # 4.3
Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/lan78xx.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index a5cd42bae962..a4f9912b3636 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3745,6 +3745,12 @@ static int lan78xx_probe(struct usb_interface *intf,
 
 	dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1);
 
+	/* Reject broken descriptors. */
+	if (dev->maxpacket == 0) {
+		ret = -ENODEV;
+		goto out4;
+	}
+
 	/* driver requires remote-wakeup capability during autosuspend. */
 	intf->needs_remote_wakeup = 1;
 

From 69a7fa5cb0de06c8956b040f19a7248c8c8308ca Mon Sep 17 00:00:00 2001
From: Rongwei Wang <rongwei.wang@linux.alibaba.com>
Date: Thu, 28 Oct 2021 14:36:27 -0700
Subject: [PATCH 1069/1750] mm, thp: bail out early in collapse_file for
 writeback page

commit 74c42e1baacf206338b1dd6b6199ac964512b5bb upstream.

Currently collapse_file does not explicitly check PG_writeback, instead,
page_has_private and try_to_release_page are used to filter writeback
pages.  This does not work for xfs with blocksize equal to or larger
than pagesize, because in such case xfs has no page->private.

This makes collapse_file bail out early for writeback page.  Otherwise,
xfs end_page_writeback will panic as follows.

  page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:ffff0003f88c86a8 index:0x0 pfn:0x84ef32
  aops:xfs_address_space_operations [xfs] ino:30000b7 dentry name:"libtest.so"
  flags: 0x57fffe0000008027(locked|referenced|uptodate|active|writeback)
  raw: 57fffe0000008027 ffff80001b48bc28 ffff80001b48bc28 ffff0003f88c86a8
  raw: 0000000000000000 0000000000000000 00000000ffffffff ffff0000c3e9a000
  page dumped because: VM_BUG_ON_PAGE(((unsigned int) page_ref_count(page) + 127u <= 127u))
  page->mem_cgroup:ffff0000c3e9a000
  ------------[ cut here ]------------
  kernel BUG at include/linux/mm.h:1212!
  Internal error: Oops - BUG: 0 [#1] SMP
  Modules linked in:
  BUG: Bad page state in process khugepaged  pfn:84ef32
   xfs(E)
  page:fffffe00201bcc80 refcount:0 mapcount:0 mapping:0 index:0x0 pfn:0x84ef32
   libcrc32c(E) rfkill(E) aes_ce_blk(E) crypto_simd(E) ...
  CPU: 25 PID: 0 Comm: swapper/25 Kdump: loaded Tainted: ...
  pstate: 60400005 (nZCv daif +PAN -UAO -TCO BTYPE=--)
  Call trace:
    end_page_writeback+0x1c0/0x214
    iomap_finish_page_writeback+0x13c/0x204
    iomap_finish_ioend+0xe8/0x19c
    iomap_writepage_end_bio+0x38/0x50
    bio_endio+0x168/0x1ec
    blk_update_request+0x278/0x3f0
    blk_mq_end_request+0x34/0x15c
    virtblk_request_done+0x38/0x74 [virtio_blk]
    blk_done_softirq+0xc4/0x110
    __do_softirq+0x128/0x38c
    __irq_exit_rcu+0x118/0x150
    irq_exit+0x1c/0x30
    __handle_domain_irq+0x8c/0xf0
    gic_handle_irq+0x84/0x108
    el1_irq+0xcc/0x180
    arch_cpu_idle+0x18/0x40
    default_idle_call+0x4c/0x1a0
    cpuidle_idle_call+0x168/0x1e0
    do_idle+0xb4/0x104
    cpu_startup_entry+0x30/0x9c
    secondary_start_kernel+0x104/0x180
  Code: d4210000 b0006161 910c8021 94013f4d (d4210000)
  ---[ end trace 4a88c6a074082f8c ]---
  Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt

Link: https://lkml.kernel.org/r/20211022023052.33114-1-rongwei.wang@linux.alibaba.com
Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
Signed-off-by: Rongwei Wang <rongwei.wang@linux.alibaba.com>
Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
Suggested-by: Yang Shi <shy828301@gmail.com>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Yang Shi <shy828301@gmail.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Song Liu <song@kernel.org>
Cc: William Kucharski <william.kucharski@oracle.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/khugepaged.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index ee8812578563..ff389d970b68 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1758,6 +1758,10 @@ static void collapse_file(struct mm_struct *mm,
 				filemap_flush(mapping);
 				result = SCAN_FAIL;
 				goto xa_unlocked;
+			} else if (PageWriteback(page)) {
+				xas_unlock_irq(&xas);
+				result = SCAN_FAIL;
+				goto xa_unlocked;
 			} else if (trylock_page(page)) {
 				get_page(page);
 				xas_unlock_irq(&xas);
@@ -1793,7 +1797,8 @@ static void collapse_file(struct mm_struct *mm,
 			goto out_unlock;
 		}
 
-		if (!is_shmem && PageDirty(page)) {
+		if (!is_shmem && (PageDirty(page) ||
+				  PageWriteback(page))) {
 			/*
 			 * khugepaged only works on read-only fd, so this
 			 * page is dirty because it hasn't been flushed

From c21b4002214c1c7e7b627b9b53375612f7aab6db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
Date: Wed, 20 Oct 2021 19:19:46 +0200
Subject: [PATCH 1070/1750] drm/ttm: fix memleak in ttm_transfered_destroy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream.

We need to cleanup the fences for ghost objects as well.

Signed-off-by: Christian König <christian.koenig@amd.com>
Reported-by: Erhard F. <erhard_f@mailbox.org>
Tested-by: Erhard F. <erhard_f@mailbox.org>
Reviewed-by: Huang Rui <ray.huang@amd.com>
Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214029
Bug: https://bugzilla.kernel.org/show_bug.cgi?id=214447
CC: <stable@vger.kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211020173211.2247-1-christian.koenig@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/ttm/ttm_bo_util.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index fb2a25f8408f..8fba425a7626 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -322,6 +322,7 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo)
 	struct ttm_transfer_obj *fbo;
 
 	fbo = container_of(bo, struct ttm_transfer_obj, base);
+	dma_resv_fini(&fbo->base.base._resv);
 	ttm_bo_put(fbo->bo);
 	kfree(fbo);
 }

From eb3b6805e3e9d98b2507201fd061a231988ce623 Mon Sep 17 00:00:00 2001
From: Thelford Williams <tdwilliamsiv@gmail.com>
Date: Wed, 13 Oct 2021 16:04:13 -0400
Subject: [PATCH 1071/1750] drm/amdgpu: fix out of bounds write

commit 5afa7898ab7a0ec9c28556a91df714bf3c2f725e upstream.

Size can be any value and is user controlled resulting in overwriting the
40 byte array wr_buf with an arbitrary length of data from buf.

Signed-off-by: Thelford Williams <tdwilliamsiv@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
index fbb65c95464b..e43f82bcb231 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
@@ -264,7 +264,7 @@ static ssize_t dp_link_settings_write(struct file *f, const char __user *buf,
 	if (!wr_buf)
 		return -ENOSPC;
 
-	if (parse_write_buffer_into_params(wr_buf, size,
+	if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
 					   (long *)param, buf,
 					   max_param_num,
 					   &param_nums)) {

From 01599bf7cc2b49c3d2be886cb438647dc25446ed Mon Sep 17 00:00:00 2001
From: Quanyang Wang <quanyang.wang@windriver.com>
Date: Mon, 18 Oct 2021 15:56:23 +0800
Subject: [PATCH 1072/1750] cgroup: Fix memory leak caused by missing
 cgroup_bpf_offline

commit 04f8ef5643bcd8bcde25dfdebef998aea480b2ba upstream.

When enabling CONFIG_CGROUP_BPF, kmemleak can be observed by running
the command as below:

    $mount -t cgroup -o none,name=foo cgroup cgroup/
    $umount cgroup/

unreferenced object 0xc3585c40 (size 64):
  comm "mount", pid 425, jiffies 4294959825 (age 31.990s)
  hex dump (first 32 bytes):
    01 00 00 80 84 8c 28 c0 00 00 00 00 00 00 00 00  ......(.........
    00 00 00 00 00 00 00 00 6c 43 a0 c3 00 00 00 00  ........lC......
  backtrace:
    [<e95a2f9e>] cgroup_bpf_inherit+0x44/0x24c
    [<1f03679c>] cgroup_setup_root+0x174/0x37c
    [<ed4b0ac5>] cgroup1_get_tree+0x2c0/0x4a0
    [<f85b12fd>] vfs_get_tree+0x24/0x108
    [<f55aec5c>] path_mount+0x384/0x988
    [<e2d5e9cd>] do_mount+0x64/0x9c
    [<208c9cfe>] sys_mount+0xfc/0x1f4
    [<06dd06e0>] ret_fast_syscall+0x0/0x48
    [<a8308cb3>] 0xbeb4daa8

This is because that since the commit 2b0d3d3e4fcf ("percpu_ref: reduce
memory footprint of percpu_ref in fast path") root_cgrp->bpf.refcnt.data
is allocated by the function percpu_ref_init in cgroup_bpf_inherit which
is called by cgroup_setup_root when mounting, but not freed along with
root_cgrp when umounting. Adding cgroup_bpf_offline which calls
percpu_ref_kill to cgroup_kill_sb can free root_cgrp->bpf.refcnt.data in
umount path.

This patch also fixes the commit 4bfc0bb2c60e ("bpf: decouple the lifetime
of cgroup_bpf from cgroup itself"). A cgroup_bpf_offline is needed to do a
cleanup that frees the resources which are allocated by cgroup_bpf_inherit
in cgroup_setup_root.

And inside cgroup_bpf_offline, cgroup_get() is at the beginning and
cgroup_put is at the end of cgroup_bpf_release which is called by
cgroup_bpf_offline. So cgroup_bpf_offline can keep the balance of
cgroup's refcount.

Fixes: 2b0d3d3e4fcf ("percpu_ref: reduce memory footprint of percpu_ref in fast path")
Fixes: 4bfc0bb2c60e ("bpf: decouple the lifetime of cgroup_bpf from cgroup itself")
Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20211018075623.26884-1-quanyang.wang@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/cgroup/cgroup.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index c8b811e039cc..60d38e2f69dd 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2147,8 +2147,10 @@ static void cgroup_kill_sb(struct super_block *sb)
 	 * And don't kill the default root.
 	 */
 	if (list_empty(&root->cgrp.self.children) && root != &cgrp_dfl_root &&
-	    !percpu_ref_is_dying(&root->cgrp.self.refcnt))
+	    !percpu_ref_is_dying(&root->cgrp.self.refcnt)) {
+		cgroup_bpf_offline(&root->cgrp);
 		percpu_ref_kill(&root->cgrp.self.refcnt);
+	}
 	cgroup_put(&root->cgrp);
 	kernfs_kill_sb(sb);
 }

From cac6b043cea3e120f4fccec16f7381747cbfdc0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= <bjorn@kernel.org>
Date: Thu, 28 Oct 2021 14:51:15 +0200
Subject: [PATCH 1073/1750] riscv, bpf: Fix potential NULL dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 27de809a3d83a6199664479ebb19712533d6fd9b upstream.

The bpf_jit_binary_free() function requires a non-NULL argument. When
the RISC-V BPF JIT fails to converge in NR_JIT_ITERATIONS steps,
jit_data->header will be NULL, which triggers a NULL
dereference. Avoid this by checking the argument, prior calling the
function.

Fixes: ca6cb5447cec ("riscv, bpf: Factor common RISC-V JIT code")
Signed-off-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20211028125115.514587-1-bjorn@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/riscv/net/bpf_jit_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index 3630d447352c..cbf7d2414886 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -125,7 +125,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
 
 	if (i == NR_JIT_ITERATIONS) {
 		pr_err("bpf-jit: image did not converge in <%d passes!\n", i);
-		bpf_jit_binary_free(jit_data->header);
+		if (jit_data->header)
+			bpf_jit_binary_free(jit_data->header);
 		prog = orig_prog;
 		goto out_offset;
 	}

From 15dec6d8f8642a26d6a272af2d7f9877df8f02b8 Mon Sep 17 00:00:00 2001
From: Liu Jian <liujian56@huawei.com>
Date: Tue, 12 Oct 2021 13:20:19 +0800
Subject: [PATCH 1074/1750] tcp_bpf: Fix one concurrency problem in the
 tcp_bpf_send_verdict function

commit cd9733f5d75c94a32544d6ce5be47e14194cf137 upstream.

With two Msgs, msgA and msgB and a user doing nonblocking sendmsg calls (or
multiple cores) on a single socket 'sk' we could get the following flow.

 msgA, sk                               msgB, sk
 -----------                            ---------------
 tcp_bpf_sendmsg()
 lock(sk)
 psock = sk->psock
                                        tcp_bpf_sendmsg()
                                        lock(sk) ... blocking
tcp_bpf_send_verdict
if (psock->eval == NONE)
   psock->eval = sk_psock_msg_verdict
 ..
 < handle SK_REDIRECT case >
   release_sock(sk)                     < lock dropped so grab here >
   ret = tcp_bpf_sendmsg_redir
                                        psock = sk->psock
                                        tcp_bpf_send_verdict
 lock_sock(sk) ... blocking on B
                                        if (psock->eval == NONE) <- boom.
                                         psock->eval will have msgA state

The problem here is we dropped the lock on msgA and grabbed it with msgB.
Now we have old state in psock and importantly psock->eval has not been
cleared. So msgB will run whatever action was done on A and the verdict
program may never see it.

Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20211012052019.184398-1-liujian56@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_bpf.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index f91ae827d47f..9194070c6725 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -317,6 +317,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
 	bool cork = false, enospc = sk_msg_full(msg);
 	struct sock *sk_redir;
 	u32 tosend, delta = 0;
+	u32 eval = __SK_NONE;
 	int ret;
 
 more_data:
@@ -360,13 +361,24 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
 	case __SK_REDIRECT:
 		sk_redir = psock->sk_redir;
 		sk_msg_apply_bytes(psock, tosend);
+		if (!psock->apply_bytes) {
+			/* Clean up before releasing the sock lock. */
+			eval = psock->eval;
+			psock->eval = __SK_NONE;
+			psock->sk_redir = NULL;
+		}
 		if (psock->cork) {
 			cork = true;
 			psock->cork = NULL;
 		}
 		sk_msg_return(sk, msg, tosend);
 		release_sock(sk);
+
 		ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags);
+
+		if (eval == __SK_REDIRECT)
+			sock_put(sk_redir);
+
 		lock_sock(sk);
 		if (unlikely(ret < 0)) {
 			int free = sk_msg_free_nocharge(sk, msg);

From dd2260ec643d309d8c58ceac3aa77f80db765488 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= <toke@redhat.com>
Date: Tue, 26 Oct 2021 13:00:19 +0200
Subject: [PATCH 1075/1750] bpf: Fix potential race in tail call compatibility
 check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 54713c85f536048e685258f880bf298a74c3620d upstream.

Lorenzo noticed that the code testing for program type compatibility of
tail call maps is potentially racy in that two threads could encounter a
map with an unset type simultaneously and both return true even though they
are inserting incompatible programs.

The race window is quite small, but artificially enlarging it by adding a
usleep_range() inside the check in bpf_prog_array_compatible() makes it
trivial to trigger from userspace with a program that does, essentially:

        map_fd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, 4, 4, 2, 0);
        pid = fork();
        if (pid) {
                key = 0;
                value = xdp_fd;
        } else {
                key = 1;
                value = tc_fd;
        }
        err = bpf_map_update_elem(map_fd, &key, &value, 0);

While the race window is small, it has potentially serious ramifications in
that triggering it would allow a BPF program to tail call to a program of a
different type. So let's get rid of it by protecting the update with a
spinlock. The commit in the Fixes tag is the last commit that touches the
code in question.

v2:
- Use a spinlock instead of an atomic variable and cmpxchg() (Alexei)
v3:
- Put lock and the members it protects into an embedded 'owner' struct (Daniel)

Fixes: 3324b584b6f6 ("ebpf: misc core cleanup")
Reported-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211026110019.363464-1-toke@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/bpf.h   |  7 +++++--
 kernel/bpf/arraymap.c |  1 +
 kernel/bpf/core.c     | 20 +++++++++++++-------
 kernel/bpf/syscall.c  |  6 ++++--
 4 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 0caa448f7b40..1f62a4eec283 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -862,8 +862,11 @@ struct bpf_array_aux {
 	 * stored in the map to make sure that all callers and callees have
 	 * the same prog type and JITed flag.
 	 */
-	enum bpf_prog_type type;
-	bool jited;
+	struct {
+		spinlock_t lock;
+		enum bpf_prog_type type;
+		bool jited;
+	} owner;
 	/* Programs with direct jumps into programs part of this array. */
 	struct list_head poke_progs;
 	struct bpf_map *map;
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index c6c81eceb68f..36c68dcea236 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -1025,6 +1025,7 @@ static struct bpf_map *prog_array_map_alloc(union bpf_attr *attr)
 	INIT_WORK(&aux->work, prog_array_map_clear_deferred);
 	INIT_LIST_HEAD(&aux->poke_progs);
 	mutex_init(&aux->poke_mutex);
+	spin_lock_init(&aux->owner.lock);
 
 	map = array_map_alloc(attr);
 	if (IS_ERR(map)) {
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 2e4a658d65d6..72e4bf0ee546 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1775,20 +1775,26 @@ static unsigned int __bpf_prog_ret0_warn(const void *ctx,
 bool bpf_prog_array_compatible(struct bpf_array *array,
 			       const struct bpf_prog *fp)
 {
+	bool ret;
+
 	if (fp->kprobe_override)
 		return false;
 
-	if (!array->aux->type) {
+	spin_lock(&array->aux->owner.lock);
+
+	if (!array->aux->owner.type) {
 		/* There's no owner yet where we could check for
 		 * compatibility.
 		 */
-		array->aux->type  = fp->type;
-		array->aux->jited = fp->jited;
-		return true;
+		array->aux->owner.type  = fp->type;
+		array->aux->owner.jited = fp->jited;
+		ret = true;
+	} else {
+		ret = array->aux->owner.type  == fp->type &&
+		      array->aux->owner.jited == fp->jited;
 	}
-
-	return array->aux->type  == fp->type &&
-	       array->aux->jited == fp->jited;
+	spin_unlock(&array->aux->owner.lock);
+	return ret;
 }
 
 static int bpf_check_tail_call(const struct bpf_prog *fp)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 9433ab9995cd..9cae74a75d6c 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -535,8 +535,10 @@ static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp)
 
 	if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY) {
 		array = container_of(map, struct bpf_array, map);
-		type  = array->aux->type;
-		jited = array->aux->jited;
+		spin_lock(&array->aux->owner.lock);
+		type  = array->aux->owner.type;
+		jited = array->aux->owner.jited;
+		spin_unlock(&array->aux->owner.lock);
 	}
 
 	seq_printf(m,

From ee4908f909b3761ded2e32c79a6ea5ed20e1fdc6 Mon Sep 17 00:00:00 2001
From: Xu Kuohai <xukuohai@huawei.com>
Date: Tue, 19 Oct 2021 03:29:34 +0000
Subject: [PATCH 1076/1750] bpf: Fix error usage of map_fd and fdget() in
 generic_map_update_batch()

commit fda7a38714f40b635f5502ec4855602c6b33dad2 upstream.

1. The ufd in generic_map_update_batch() should be read from batch.map_fd;
2. A call to fdget() should be followed by a symmetric call to fdput().

Fixes: aa2e93b8e58e ("bpf: Add generic support for update and delete batch ops")
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211019032934.1210517-1-xukuohai@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/syscall.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 9cae74a75d6c..5b6da64da46d 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1309,12 +1309,11 @@ int generic_map_update_batch(struct bpf_map *map,
 	void __user *values = u64_to_user_ptr(attr->batch.values);
 	void __user *keys = u64_to_user_ptr(attr->batch.keys);
 	u32 value_size, cp, max_count;
-	int ufd = attr->map_fd;
+	int ufd = attr->batch.map_fd;
 	void *key, *value;
 	struct fd f;
 	int err = 0;
 
-	f = fdget(ufd);
 	if (attr->batch.elem_flags & ~BPF_F_LOCK)
 		return -EINVAL;
 
@@ -1339,6 +1338,7 @@ int generic_map_update_batch(struct bpf_map *map,
 		return -ENOMEM;
 	}
 
+	f = fdget(ufd); /* bpf_map_do_batch() guarantees ufd is valid */
 	for (cp = 0; cp < max_count; cp++) {
 		err = -EFAULT;
 		if (copy_from_user(key, keys + cp * map->key_size,
@@ -1358,6 +1358,7 @@ int generic_map_update_batch(struct bpf_map *map,
 
 	kfree(value);
 	kfree(key);
+	fdput(f);
 	return err;
 }
 

From c3e17e58f571f34c51aeb17274ed02c2ed5cf780 Mon Sep 17 00:00:00 2001
From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Date: Tue, 12 Oct 2021 13:55:19 -0400
Subject: [PATCH 1077/1750] IB/qib: Protect from buffer overflow in struct
 qib_user_sdma_pkt fields

commit d39bf40e55e666b5905fdbd46a0dced030ce87be upstream.

Overflowing either addrlimit or bytes_togo can allow userspace to trigger
a buffer overflow of kernel memory. Check for overflows in all the places
doing math on user controlled buffers.

Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
Link: https://lore.kernel.org/r/20211012175519.7298.77738.stgit@awfm-01.cornelisnetworks.com
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/qib/qib_user_sdma.c | 33 ++++++++++++++++-------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
index a67599b5a550..ac11943a5ddb 100644
--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
+++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
@@ -602,7 +602,7 @@ static int qib_user_sdma_coalesce(const struct qib_devdata *dd,
 /*
  * How many pages in this iovec element?
  */
-static int qib_user_sdma_num_pages(const struct iovec *iov)
+static size_t qib_user_sdma_num_pages(const struct iovec *iov)
 {
 	const unsigned long addr  = (unsigned long) iov->iov_base;
 	const unsigned long  len  = iov->iov_len;
@@ -658,7 +658,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev,
 static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,
 				   struct qib_user_sdma_queue *pq,
 				   struct qib_user_sdma_pkt *pkt,
-				   unsigned long addr, int tlen, int npages)
+				   unsigned long addr, int tlen, size_t npages)
 {
 	struct page *pages[8];
 	int i, j;
@@ -722,7 +722,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd,
 	unsigned long idx;
 
 	for (idx = 0; idx < niov; idx++) {
-		const int npages = qib_user_sdma_num_pages(iov + idx);
+		const size_t npages = qib_user_sdma_num_pages(iov + idx);
 		const unsigned long addr = (unsigned long) iov[idx].iov_base;
 
 		ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
@@ -824,8 +824,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
 		unsigned pktnw;
 		unsigned pktnwc;
 		int nfrags = 0;
-		int npages = 0;
-		int bytes_togo = 0;
+		size_t npages = 0;
+		size_t bytes_togo = 0;
 		int tiddma = 0;
 		int cfur;
 
@@ -885,7 +885,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
 
 			npages += qib_user_sdma_num_pages(&iov[idx]);
 
-			bytes_togo += slen;
+			if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||
+			    bytes_togo > type_max(typeof(pkt->bytes_togo))) {
+				ret = -EINVAL;
+				goto free_pbc;
+			}
 			pktnwc += slen >> 2;
 			idx++;
 			nfrags++;
@@ -904,8 +908,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
 		}
 
 		if (frag_size) {
-			int tidsmsize, n;
-			size_t pktsize;
+			size_t tidsmsize, n, pktsize, sz, addrlimit;
 
 			n = npages*((2*PAGE_SIZE/frag_size)+1);
 			pktsize = struct_size(pkt, addr, n);
@@ -923,14 +926,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
 			else
 				tidsmsize = 0;
 
-			pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);
+			if (check_add_overflow(pktsize, tidsmsize, &sz)) {
+				ret = -EINVAL;
+				goto free_pbc;
+			}
+			pkt = kmalloc(sz, GFP_KERNEL);
 			if (!pkt) {
 				ret = -ENOMEM;
 				goto free_pbc;
 			}
 			pkt->largepkt = 1;
 			pkt->frag_size = frag_size;
-			pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);
+			if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),
+					       &addrlimit) ||
+			    addrlimit > type_max(typeof(pkt->addrlimit))) {
+				ret = -EINVAL;
+				goto free_pbc;
+			}
+			pkt->addrlimit = addrlimit;
 
 			if (tiddma) {
 				char *tidsm = (char *)pkt + pktsize;

From d98883f6c33e0d960afedcecaa92fc2b61fec383 Mon Sep 17 00:00:00 2001
From: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Date: Wed, 13 Oct 2021 10:18:52 -0400
Subject: [PATCH 1078/1750] IB/hfi1: Fix abba locking issue with sc_disable()

commit 13bac861952a78664907a0f927d3e874e9a59034 upstream.

sc_disable() after having disabled the send context wakes up any waiters
by calling hfi1_qp_wakeup() while holding the waitlock for the sc.

This is contrary to the model for all other calls to hfi1_qp_wakeup()
where the waitlock is dropped and a local is used to drive calls to
hfi1_qp_wakeup().

Fix by moving the sc->piowait into a local list and driving the wakeup
calls from the list.

Fixes: 099a884ba4c0 ("IB/hfi1: Handle wakeup of orphaned QPs for pio")
Link: https://lore.kernel.org/r/20211013141852.128104.2682.stgit@awfm-01.cornelisnetworks.com
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/hfi1/pio.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
index ff864f6f0266..1cd8f80f097a 100644
--- a/drivers/infiniband/hw/hfi1/pio.c
+++ b/drivers/infiniband/hw/hfi1/pio.c
@@ -920,6 +920,7 @@ void sc_disable(struct send_context *sc)
 {
 	u64 reg;
 	struct pio_buf *pbuf;
+	LIST_HEAD(wake_list);
 
 	if (!sc)
 		return;
@@ -954,19 +955,21 @@ void sc_disable(struct send_context *sc)
 	spin_unlock(&sc->release_lock);
 
 	write_seqlock(&sc->waitlock);
-	while (!list_empty(&sc->piowait)) {
+	if (!list_empty(&sc->piowait))
+		list_move(&sc->piowait, &wake_list);
+	write_sequnlock(&sc->waitlock);
+	while (!list_empty(&wake_list)) {
 		struct iowait *wait;
 		struct rvt_qp *qp;
 		struct hfi1_qp_priv *priv;
 
-		wait = list_first_entry(&sc->piowait, struct iowait, list);
+		wait = list_first_entry(&wake_list, struct iowait, list);
 		qp = iowait_to_qp(wait);
 		priv = qp->priv;
 		list_del_init(&priv->s_iowait.list);
 		priv->s_iowait.lock = NULL;
 		hfi1_qp_wakeup(qp, RVT_S_WAIT_PIO | HFI1_S_WAIT_PIO_DRAIN);
 	}
-	write_sequnlock(&sc->waitlock);
 
 	spin_unlock_irq(&sc->alloc_lock);
 }

From 4286c72c5321666b58438e73229ba39e56461bd7 Mon Sep 17 00:00:00 2001
From: Varun Prakash <varun@chelsio.com>
Date: Mon, 25 Oct 2021 22:46:54 +0530
Subject: [PATCH 1079/1750] nvmet-tcp: fix data digest pointer calculation

commit e790de54e94a7a15fb725b34724d41d41cbaa60c upstream.

exp_ddgst is of type __le32, &cmd->exp_ddgst + cmd->offset increases
&cmd->exp_ddgst by 4 * cmd->offset, fix this by type casting
&cmd->exp_ddgst to u8 *.

Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: Varun Prakash <varun@chelsio.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/target/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index dedcb7aaf0d8..5266d534c4b3 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -690,7 +690,7 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd, bool last_in_batch)
 	struct nvmet_tcp_queue *queue = cmd->queue;
 	struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
 	struct kvec iov = {
-		.iov_base = &cmd->exp_ddgst + cmd->offset,
+		.iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset,
 		.iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset
 	};
 	int ret;

From 32f3db20f1261273b3a7ebcd437722c4ca9bff60 Mon Sep 17 00:00:00 2001
From: Varun Prakash <varun@chelsio.com>
Date: Mon, 25 Oct 2021 22:47:30 +0530
Subject: [PATCH 1080/1750] nvme-tcp: fix data digest pointer calculation

commit d89b9f3bbb58e9e378881209756b0723694f22ff upstream.

ddgst is of type __le32, &req->ddgst + req->offset
increases &req->ddgst by 4 * req->offset, fix this by
type casting &req->ddgst to u8 *.

Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver")
Signed-off-by: Varun Prakash <varun@chelsio.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index f3a7b6c1bdfa..afef377424c4 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1040,7 +1040,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)
 	int ret;
 	struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
 	struct kvec iov = {
-		.iov_base = &req->ddgst + req->offset,
+		.iov_base = (u8 *)&req->ddgst + req->offset,
 		.iov_len = NVME_TCP_DIGEST_LENGTH - req->offset
 	};
 

From c63d7f2ca99a2e2a9b62d42bffa0ccec407b91b0 Mon Sep 17 00:00:00 2001
From: Varun Prakash <varun@chelsio.com>
Date: Tue, 26 Oct 2021 19:01:55 +0530
Subject: [PATCH 1081/1750] nvme-tcp: fix possible req->offset corruption

commit ce7723e9cdae4eb3030da082876580f4b2dc0861 upstream.

With commit db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq
context") r2t and response PDU can get processed while send function
is executing.

Current data digest send code uses req->offset after kernel_sendmsg(),
this creates a race condition where req->offset gets reset before it
is used in send function.

This can happen in two cases -
1. Target sends r2t PDU which resets req->offset.
2. Target send response PDU which completes the req and then req is
   used for a new command, nvme_tcp_setup_cmd_pdu() resets req->offset.

Fix this by storing req->offset in a local variable and using
this local variable after kernel_sendmsg().

Fixes: db5ad6b7f8cd ("nvme-tcp: try to send request in queue_rq context")
Signed-off-by: Varun Prakash <varun@chelsio.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/nvme/host/tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index afef377424c4..e99d43989418 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1037,6 +1037,7 @@ static int nvme_tcp_try_send_data_pdu(struct nvme_tcp_request *req)
 static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)
 {
 	struct nvme_tcp_queue *queue = req->queue;
+	size_t offset = req->offset;
 	int ret;
 	struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
 	struct kvec iov = {
@@ -1053,7 +1054,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)
 	if (unlikely(ret <= 0))
 		return ret;
 
-	if (req->offset + ret == NVME_TCP_DIGEST_LENGTH) {
+	if (offset + ret == NVME_TCP_DIGEST_LENGTH) {
 		nvme_tcp_done_send_req(queue);
 		return 1;
 	}

From 24fd8e2f027dc8d4cfaa5b1ec9b83278df22f8dc Mon Sep 17 00:00:00 2001
From: Rakesh Babu <rsaladi2@marvell.com>
Date: Wed, 27 Oct 2021 23:02:33 +0530
Subject: [PATCH 1082/1750] octeontx2-af: Display all enabled PF VF rsrc_alloc
 entries.

commit e77bcdd1f639809950c45234b08647ac6d3ffe7b upstream.

Currently, we are using a fixed buffer size of length 2048 to display
rsrc_alloc output. As a result a maximum of 2048 characters of
rsrc_alloc output is displayed, which may lead sometimes to display only
partial output. This patch fixes this dependency on max limit of buffer
size and displays all PF VF entries.

Each column of the debugfs entry "rsrc_alloc" uses a fixed width of 12
characters to print the list of LFs of each block for a PF/VF. If the
length of list of LFs of a block exceeds this fixed width then the list
gets truncated and displays only a part of the list. This patch fixes
this by using the maximum possible length of list of LFs among all
blocks of all PFs and VFs entries as the width size.

Fixes: f7884097141b ("octeontx2-af: Formatting debugfs entry rsrc_alloc.")
Fixes: 23205e6d06d4 ("octeontx2-af: Dump current resource provisioning status")
Signed-off-by: Rakesh Babu <rsaladi2@marvell.com>
Signed-off-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
Signed-off-by: Sunil Kovvuri Goutham <Sunil.Goutham@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../marvell/octeontx2/af/rvu_debugfs.c        | 138 ++++++++++++++----
 1 file changed, 106 insertions(+), 32 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index bc870bff14df..5205796859f6 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -139,18 +139,85 @@ static const struct file_operations rvu_dbg_##name##_fops = { \
 
 static void print_nix_qsize(struct seq_file *filp, struct rvu_pfvf *pfvf);
 
+static void get_lf_str_list(struct rvu_block block, int pcifunc,
+			    char *lfs)
+{
+	int lf = 0, seq = 0, len = 0, prev_lf = block.lf.max;
+
+	for_each_set_bit(lf, block.lf.bmap, block.lf.max) {
+		if (lf >= block.lf.max)
+			break;
+
+		if (block.fn_map[lf] != pcifunc)
+			continue;
+
+		if (lf == prev_lf + 1) {
+			prev_lf = lf;
+			seq = 1;
+			continue;
+		}
+
+		if (seq)
+			len += sprintf(lfs + len, "-%d,%d", prev_lf, lf);
+		else
+			len += (len ? sprintf(lfs + len, ",%d", lf) :
+				      sprintf(lfs + len, "%d", lf));
+
+		prev_lf = lf;
+		seq = 0;
+	}
+
+	if (seq)
+		len += sprintf(lfs + len, "-%d", prev_lf);
+
+	lfs[len] = '\0';
+}
+
+static int get_max_column_width(struct rvu *rvu)
+{
+	int index, pf, vf, lf_str_size = 12, buf_size = 256;
+	struct rvu_block block;
+	u16 pcifunc;
+	char *buf;
+
+	buf = kzalloc(buf_size, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	for (pf = 0; pf < rvu->hw->total_pfs; pf++) {
+		for (vf = 0; vf <= rvu->hw->total_vfs; vf++) {
+			pcifunc = pf << 10 | vf;
+			if (!pcifunc)
+				continue;
+
+			for (index = 0; index < BLK_COUNT; index++) {
+				block = rvu->hw->block[index];
+				if (!strlen(block.name))
+					continue;
+
+				get_lf_str_list(block, pcifunc, buf);
+				if (lf_str_size <= strlen(buf))
+					lf_str_size = strlen(buf) + 1;
+			}
+		}
+	}
+
+	kfree(buf);
+	return lf_str_size;
+}
+
 /* Dumps current provisioning status of all RVU block LFs */
 static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
 					  char __user *buffer,
 					  size_t count, loff_t *ppos)
 {
-	int index, off = 0, flag = 0, go_back = 0, len = 0;
+	int index, off = 0, flag = 0, len = 0, i = 0;
 	struct rvu *rvu = filp->private_data;
-	int lf, pf, vf, pcifunc;
+	int bytes_not_copied = 0;
 	struct rvu_block block;
-	int bytes_not_copied;
-	int lf_str_size = 12;
+	int pf, vf, pcifunc;
 	int buf_size = 2048;
+	int lf_str_size;
 	char *lfs;
 	char *buf;
 
@@ -162,6 +229,9 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
 	if (!buf)
 		return -ENOSPC;
 
+	/* Get the maximum width of a column */
+	lf_str_size = get_max_column_width(rvu);
+
 	lfs = kzalloc(lf_str_size, GFP_KERNEL);
 	if (!lfs) {
 		kfree(buf);
@@ -175,65 +245,69 @@ static ssize_t rvu_dbg_rsrc_attach_status(struct file *filp,
 					 "%-*s", lf_str_size,
 					 rvu->hw->block[index].name);
 		}
+
 	off += scnprintf(&buf[off], buf_size - 1 - off, "\n");
+	bytes_not_copied = copy_to_user(buffer + (i * off), buf, off);
+	if (bytes_not_copied)
+		goto out;
+
+	i++;
+	*ppos += off;
 	for (pf = 0; pf < rvu->hw->total_pfs; pf++) {
 		for (vf = 0; vf <= rvu->hw->total_vfs; vf++) {
+			off = 0;
+			flag = 0;
 			pcifunc = pf << 10 | vf;
 			if (!pcifunc)
 				continue;
 
 			if (vf) {
 				sprintf(lfs, "PF%d:VF%d", pf, vf - 1);
-				go_back = scnprintf(&buf[off],
-						    buf_size - 1 - off,
-						    "%-*s", lf_str_size, lfs);
+				off = scnprintf(&buf[off],
+						buf_size - 1 - off,
+						"%-*s", lf_str_size, lfs);
 			} else {
 				sprintf(lfs, "PF%d", pf);
-				go_back = scnprintf(&buf[off],
-						    buf_size - 1 - off,
-						    "%-*s", lf_str_size, lfs);
+				off = scnprintf(&buf[off],
+						buf_size - 1 - off,
+						"%-*s", lf_str_size, lfs);
 			}
 
-			off += go_back;
-			for (index = 0; index < BLKTYPE_MAX; index++) {
+			for (index = 0; index < BLK_COUNT; index++) {
 				block = rvu->hw->block[index];
 				if (!strlen(block.name))
 					continue;
 				len = 0;
 				lfs[len] = '\0';
-				for (lf = 0; lf < block.lf.max; lf++) {
-					if (block.fn_map[lf] != pcifunc)
-						continue;
+				get_lf_str_list(block, pcifunc, lfs);
+				if (strlen(lfs))
 					flag = 1;
-					len += sprintf(&lfs[len], "%d,", lf);
-				}
 
-				if (flag)
-					len--;
-				lfs[len] = '\0';
 				off += scnprintf(&buf[off], buf_size - 1 - off,
 						 "%-*s", lf_str_size, lfs);
-				if (!strlen(lfs))
-					go_back += lf_str_size;
 			}
-			if (!flag)
-				off -= go_back;
-			else
-				flag = 0;
-			off--;
-			off +=	scnprintf(&buf[off], buf_size - 1 - off, "\n");
+			if (flag) {
+				off +=	scnprintf(&buf[off],
+						  buf_size - 1 - off, "\n");
+				bytes_not_copied = copy_to_user(buffer +
+								(i * off),
+								buf, off);
+				if (bytes_not_copied)
+					goto out;
+
+				i++;
+				*ppos += off;
+			}
 		}
 	}
 
-	bytes_not_copied = copy_to_user(buffer, buf, off);
+out:
 	kfree(lfs);
 	kfree(buf);
-
 	if (bytes_not_copied)
 		return -EFAULT;
 
-	*ppos = off;
-	return off;
+	return *ppos;
 }
 
 RVU_DEBUG_FOPS(rsrc_status, rsrc_attach_status, NULL);

From 10e40fb2f508f3b6af07c9bdc03595d3309d0e16 Mon Sep 17 00:00:00 2001
From: Patrisious Haddad <phaddad@nvidia.com>
Date: Wed, 6 Oct 2021 12:31:53 +0300
Subject: [PATCH 1083/1750] RDMA/mlx5: Set user priority for DCT

commit 1ab52ac1e9bc9391f592c9fa8340a6e3e9c36286 upstream.

Currently, the driver doesn't set the PCP-based priority for DCT, hence
DCT response packets are transmitted without user priority.

Fix it by setting user provided priority in the eth_prio field in the DCT
context, which in turn sets the value in the transmitted packet.

Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP")
Link: https://lore.kernel.org/r/5fd2d94a13f5742d8803c218927322257d53205c.1633512672.git.leonro@nvidia.com
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/qp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 011477356a1d..7a2bec0ac005 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -4216,6 +4216,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 		MLX5_SET(dctc, dctc, mtu, attr->path_mtu);
 		MLX5_SET(dctc, dctc, my_addr_index, attr->ah_attr.grh.sgid_index);
 		MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit);
+		if (attr->ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE)
+			MLX5_SET(dctc, dctc, eth_prio, attr->ah_attr.sl & 0x7);
 
 		err = mlx5_core_create_dct(dev, &qp->dct.mdct, qp->dct.in,
 					   MLX5_ST_SZ_BYTES(create_dct_in), out,

From 2cf7d935d6ba3fdae254ad6585fe74464de270f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20B=C5=93sch?= <u@pkh.me>
Date: Sun, 5 Sep 2021 02:20:27 +0200
Subject: [PATCH 1084/1750] arm64: dts: allwinner: h5: NanoPI Neo 2: Fix
 ethernet node
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 0764e365dacd0b8f75c1736f9236be280649bd18 upstream.

RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
node.

Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
Signed-off-by: Clément Bœsch <u@pkh.me>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210905002027.171984-1-u@pkh.me
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
index b059e20813bd..e8ab8c2df51a 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
@@ -75,7 +75,7 @@ &emac {
 	pinctrl-0 = <&emac_rgmii_pins>;
 	phy-supply = <&reg_gmac_3v3>;
 	phy-handle = <&ext_rgmii_phy>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 

From e51371bd687e7ff4a2f5f53d97d4388500fb27e1 Mon Sep 17 00:00:00 2001
From: Jim Quinlan <jim2101024@gmail.com>
Date: Tue, 14 Sep 2021 15:11:21 -0700
Subject: [PATCH 1085/1750] reset: brcmstb-rescal: fix incorrect polarity of
 status bit

commit f33eb7f29c16ba78db3221ee02346fd832274cdd upstream.

The readl_poll_timeout() should complete when the status bit
is a 1, not 0.

Fixes: 4cf176e52397 ("reset: Add Broadcom STB RESCAL reset controller")
Signed-off-by: Jim Quinlan <jim2101024@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20210914221122.62315-1-f.fainelli@gmail.com
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/reset/reset-brcmstb-rescal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/reset/reset-brcmstb-rescal.c b/drivers/reset/reset-brcmstb-rescal.c
index b6f074d6a65f..433fa0c40e47 100644
--- a/drivers/reset/reset-brcmstb-rescal.c
+++ b/drivers/reset/reset-brcmstb-rescal.c
@@ -38,7 +38,7 @@ static int brcm_rescal_reset_set(struct reset_controller_dev *rcdev,
 	}
 
 	ret = readl_poll_timeout(base + BRCM_RESCAL_STATUS, reg,
-				 !(reg & BRCM_RESCAL_STATUS_BIT), 100, 1000);
+				 (reg & BRCM_RESCAL_STATUS_BIT), 100, 1000);
 	if (ret) {
 		dev_err(data->dev, "time out on SATA/PCIe rescal\n");
 		return ret;

From 36e911a16b377bde0ad91a8c679069d0d310b1a6 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 12 Oct 2021 10:37:35 +0800
Subject: [PATCH 1086/1750] regmap: Fix possible double-free in
 regcache_rbtree_exit()

commit 55e6d8037805b3400096d621091dfbf713f97e83 upstream.

In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
so 'rbnode->block' points a freed memory, in the error handling path of
regcache_rbtree_init(), 'rbnode->block' will be freed again in
regcache_rbtree_exit(), KASAN will report double-free as follows:

BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
Call Trace:
 slab_free_freelist_hook+0x10d/0x240
 kfree+0xce/0x390
 regcache_rbtree_exit+0x15d/0x1a0
 regcache_rbtree_init+0x224/0x2c0
 regcache_init+0x88d/0x1310
 __regmap_init+0x3151/0x4a80
 __devm_regmap_init+0x7d/0x100
 madera_spi_probe+0x10f/0x333 [madera_spi]
 spi_probe+0x183/0x210
 really_probe+0x285/0xc30

To fix this, moving up the assignment of rbnode->block to immediately after
the reallocation has succeeded so that the data structure stays valid even
if the second reallocation fails.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 3f4ff561bc88b ("regmap: rbtree: Make cache_present bitmap per node")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211012023735.1632786-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/regmap/regcache-rbtree.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index cfa29dc89bbf..fabf87058d80 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
 	if (!blk)
 		return -ENOMEM;
 
+	rbnode->block = blk;
+
 	if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
 		present = krealloc(rbnode->cache_present,
 				   BITS_TO_LONGS(blklen) * sizeof(*present),
 				   GFP_KERNEL);
-		if (!present) {
-			kfree(blk);
+		if (!present)
 			return -ENOMEM;
-		}
 
 		memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
 		       (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
@@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
 	}
 
 	/* update the rbnode block, its size and the base register */
-	rbnode->block = blk;
 	rbnode->blklen = blklen;
 	rbnode->base_reg = base_reg;
 	rbnode->cache_present = present;

From b0a2cd38553c77928ef1646ed1518486b1e70ae8 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Sun, 24 Oct 2021 16:13:56 +0300
Subject: [PATCH 1087/1750] net: batman-adv: fix error handling

commit 6f68cd634856f8ca93bafd623ba5357e0f648c68 upstream.

Syzbot reported ODEBUG warning in batadv_nc_mesh_free(). The problem was
in wrong error handling in batadv_mesh_init().

Before this patch batadv_mesh_init() was calling batadv_mesh_free() in case
of any batadv_*_init() calls failure. This approach may work well, when
there is some kind of indicator, which can tell which parts of batadv are
initialized; but there isn't any.

All written above lead to cleaning up uninitialized fields. Even if we hide
ODEBUG warning by initializing bat_priv->nc.work, syzbot was able to hit
GPF in batadv_nc_purge_paths(), because hash pointer in still NULL. [1]

To fix these bugs we can unwind batadv_*_init() calls one by one.
It is good approach for 2 reasons: 1) It fixes bugs on error handling
path 2) It improves the performance, since we won't call unneeded
batadv_*_free() functions.

So, this patch makes all batadv_*_init() clean up all allocated memory
before returning with an error to no call correspoing batadv_*_free()
and open-codes batadv_mesh_free() with proper order to avoid touching
uninitialized fields.

Link: https://lore.kernel.org/netdev/000000000000c87fbd05cef6bcb0@google.com/ [1]
Reported-and-tested-by: syzbot+28b0702ada0bf7381f58@syzkaller.appspotmail.com
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Acked-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/batman-adv/bridge_loop_avoidance.c | 10 +++--
 net/batman-adv/main.c                  | 56 ++++++++++++++++++--------
 net/batman-adv/network-coding.c        |  4 +-
 net/batman-adv/translation-table.c     |  4 +-
 4 files changed, 53 insertions(+), 21 deletions(-)

diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index ba0027d1f2df..ee9cead76545 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1561,11 +1561,15 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
 		return 0;
 
 	bat_priv->bla.claim_hash = batadv_hash_new(128);
-	bat_priv->bla.backbone_hash = batadv_hash_new(32);
-
-	if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash)
+	if (!bat_priv->bla.claim_hash)
 		return -ENOMEM;
 
+	bat_priv->bla.backbone_hash = batadv_hash_new(32);
+	if (!bat_priv->bla.backbone_hash) {
+		batadv_hash_destroy(bat_priv->bla.claim_hash);
+		return -ENOMEM;
+	}
+
 	batadv_hash_set_lock_class(bat_priv->bla.claim_hash,
 				   &batadv_claim_hash_lock_class_key);
 	batadv_hash_set_lock_class(bat_priv->bla.backbone_hash,
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index 70fee9b42e25..9f267b190779 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -196,29 +196,41 @@ int batadv_mesh_init(struct net_device *soft_iface)
 
 	bat_priv->gw.generation = 0;
 
-	ret = batadv_v_mesh_init(bat_priv);
-	if (ret < 0)
-		goto err;
-
 	ret = batadv_originator_init(bat_priv);
-	if (ret < 0)
-		goto err;
+	if (ret < 0) {
+		atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+		goto err_orig;
+	}
 
 	ret = batadv_tt_init(bat_priv);
-	if (ret < 0)
-		goto err;
+	if (ret < 0) {
+		atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+		goto err_tt;
+	}
+
+	ret = batadv_v_mesh_init(bat_priv);
+	if (ret < 0) {
+		atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+		goto err_v;
+	}
 
 	ret = batadv_bla_init(bat_priv);
-	if (ret < 0)
-		goto err;
+	if (ret < 0) {
+		atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+		goto err_bla;
+	}
 
 	ret = batadv_dat_init(bat_priv);
-	if (ret < 0)
-		goto err;
+	if (ret < 0) {
+		atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+		goto err_dat;
+	}
 
 	ret = batadv_nc_mesh_init(bat_priv);
-	if (ret < 0)
-		goto err;
+	if (ret < 0) {
+		atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
+		goto err_nc;
+	}
 
 	batadv_gw_init(bat_priv);
 	batadv_mcast_init(bat_priv);
@@ -228,8 +240,20 @@ int batadv_mesh_init(struct net_device *soft_iface)
 
 	return 0;
 
-err:
-	batadv_mesh_free(soft_iface);
+err_nc:
+	batadv_dat_free(bat_priv);
+err_dat:
+	batadv_bla_free(bat_priv);
+err_bla:
+	batadv_v_mesh_free(bat_priv);
+err_v:
+	batadv_tt_free(bat_priv);
+err_tt:
+	batadv_originator_free(bat_priv);
+err_orig:
+	batadv_purge_outstanding_packets(bat_priv, NULL);
+	atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
+
 	return ret;
 }
 
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 61ddd6d709a0..35b3e03c0777 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -155,8 +155,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
 				   &batadv_nc_coding_hash_lock_class_key);
 
 	bat_priv->nc.decoding_hash = batadv_hash_new(128);
-	if (!bat_priv->nc.decoding_hash)
+	if (!bat_priv->nc.decoding_hash) {
+		batadv_hash_destroy(bat_priv->nc.coding_hash);
 		goto err;
+	}
 
 	batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
 				   &batadv_nc_decoding_hash_lock_class_key);
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a510f7f86a7d..de946ea8f13c 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -4405,8 +4405,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv)
 		return ret;
 
 	ret = batadv_tt_global_init(bat_priv);
-	if (ret < 0)
+	if (ret < 0) {
+		batadv_tt_local_table_free(bat_priv);
 		return ret;
+	}
 
 	batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1,
 				     batadv_tt_tvlv_unicast_handler_v1,

From aed897e96b191b56109bac700bf3555113e75ea1 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Mon, 25 Oct 2021 02:31:48 -0400
Subject: [PATCH 1088/1750] net-sysfs: initialize uid and gid before calling
 net_ns_get_ownership

commit f7a1e76d0f608961cc2fc681f867a834f2746bce upstream.

Currently in net_ns_get_ownership() it may not be able to set uid or gid
if make_kuid or make_kgid returns an invalid value, and an uninit-value
issue can be triggered by this.

This patch is to fix it by initializing the uid and gid before calling
net_ns_get_ownership(), as it does in kobject_get_ownership()

Fixes: e6dee9f3893c ("net-sysfs: add netdev_change_owner()")
Reported-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/net-sysfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index b4562f9d074c..cc5f760c7825 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1957,9 +1957,9 @@ int netdev_register_kobject(struct net_device *ndev)
 int netdev_change_owner(struct net_device *ndev, const struct net *net_old,
 			const struct net *net_new)
 {
+	kuid_t old_uid = GLOBAL_ROOT_UID, new_uid = GLOBAL_ROOT_UID;
+	kgid_t old_gid = GLOBAL_ROOT_GID, new_gid = GLOBAL_ROOT_GID;
 	struct device *dev = &ndev->dev;
-	kuid_t old_uid, new_uid;
-	kgid_t old_gid, new_gid;
 	int error;
 
 	net_ns_get_ownership(net_old, &old_uid, &old_gid);

From 04121b10cdf0361c0fac761a9264659935878693 Mon Sep 17 00:00:00 2001
From: Janusz Dziedzic <janusz.dziedzic@gmail.com>
Date: Sun, 24 Oct 2021 22:15:46 +0200
Subject: [PATCH 1089/1750] cfg80211: correct bridge/4addr mode check

commit 689a0a9f505f7bffdefe6f17fddb41c8ab6344f6 upstream.

Without the patch we fail:

$ sudo brctl addbr br0
$ sudo brctl addif br0 wlp1s0
$ sudo iw wlp1s0 set 4addr on
command failed: Device or resource busy (-16)

Last command failed but iface was already in 4addr mode.

Fixes: ad4bb6f8883a ("cfg80211: disallow bridging managed/adhoc interfaces")
Signed-off-by: Janusz Dziedzic <janusz.dziedzic@gmail.com>
Link: https://lore.kernel.org/r/20211024201546.614379-1-janusz.dziedzic@gmail.com
[add fixes tag, fix indentation, edit commit log]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/wireless/util.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4fb8d1b14e76..3f8c46bb6d9a 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1028,14 +1028,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 	    !(rdev->wiphy.interface_modes & (1 << ntype)))
 		return -EOPNOTSUPP;
 
-	/* if it's part of a bridge, reject changing type to station/ibss */
-	if (netif_is_bridge_port(dev) &&
-	    (ntype == NL80211_IFTYPE_ADHOC ||
-	     ntype == NL80211_IFTYPE_STATION ||
-	     ntype == NL80211_IFTYPE_P2P_CLIENT))
-		return -EBUSY;
-
 	if (ntype != otype) {
+		/* if it's part of a bridge, reject changing type to station/ibss */
+		if (netif_is_bridge_port(dev) &&
+		    (ntype == NL80211_IFTYPE_ADHOC ||
+		     ntype == NL80211_IFTYPE_STATION ||
+		     ntype == NL80211_IFTYPE_P2P_CLIENT))
+			return -EBUSY;
+
 		dev->ieee80211_ptr->use_4addr = false;
 		dev->ieee80211_ptr->mesh_id_up_len = 0;
 		wdev_lock(dev->ieee80211_ptr);

From 2b7c5eed19d3009dd6cca36853b3a22d7eff9209 Mon Sep 17 00:00:00 2001
From: Michael Chan <michael.chan@broadcom.com>
Date: Mon, 25 Oct 2021 05:05:28 -0400
Subject: [PATCH 1090/1750] net: Prevent infinite while loop in skb_tx_hash()

commit 0c57eeecc559ca6bc18b8c4e2808bc78dbe769b0 upstream.

Drivers call netdev_set_num_tc() and then netdev_set_tc_queue()
to set the queue count and offset for each TC.  So the queue count
and offset for the TCs may be zero for a short period after dev->num_tc
has been set.  If a TX packet is being transmitted at this time in the
code path netdev_pick_tx() -> skb_tx_hash(), skb_tx_hash() may see
nonzero dev->num_tc but zero qcount for the TC.  The while loop that
keeps looping while hash >= qcount will not end.

Fix it by checking the TC's qcount to be nonzero before using it.

Fixes: eadec877ce9c ("net: Add support for subordinate traffic classes to netdev_pick_tx")
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/dev.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/dev.c b/net/core/dev.c
index b9d19fbb1589..6a4e0e3c59fe 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3171,6 +3171,12 @@ static u16 skb_tx_hash(const struct net_device *dev,
 
 		qoffset = sb_dev->tc_to_txq[tc].offset;
 		qcount = sb_dev->tc_to_txq[tc].count;
+		if (unlikely(!qcount)) {
+			net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n",
+					     sb_dev->name, qoffset, tc);
+			qoffset = 0;
+			qcount = dev->real_num_tx_queues;
+		}
 	}
 
 	if (skb_rx_queue_recorded(skb)) {

From 863a423ee07b0d602335b283457c9337ad5a60c4 Mon Sep 17 00:00:00 2001
From: Mark Zhang <markzhang@nvidia.com>
Date: Sun, 24 Oct 2021 09:08:20 +0300
Subject: [PATCH 1091/1750] RDMA/sa_query: Use strscpy_pad instead of memcpy to
 copy a string

commit 64733956ebba7cc629856f4a6ee35a52bc9c023f upstream.

When copying the device name, the length of the data memcpy copied exceeds
the length of the source buffer, which cause the KASAN issue below.  Use
strscpy_pad() instead.

 BUG: KASAN: slab-out-of-bounds in ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
 Read of size 64 at addr ffff88811a10f5e0 by task rping/140263
 CPU: 3 PID: 140263 Comm: rping Not tainted 5.15.0-rc1+ #1
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 Call Trace:
  dump_stack_lvl+0x57/0x7d
  print_address_description.constprop.0+0x1d/0xa0
  kasan_report+0xcb/0x110
  kasan_check_range+0x13d/0x180
  memcpy+0x20/0x60
  ib_nl_set_path_rec_attrs+0x136/0x320 [ib_core]
  ib_nl_make_request+0x1c6/0x380 [ib_core]
  send_mad+0x20a/0x220 [ib_core]
  ib_sa_path_rec_get+0x3e3/0x800 [ib_core]
  cma_query_ib_route+0x29b/0x390 [rdma_cm]
  rdma_resolve_route+0x308/0x3e0 [rdma_cm]
  ucma_resolve_route+0xe1/0x150 [rdma_ucm]
  ucma_write+0x17b/0x1f0 [rdma_ucm]
  vfs_write+0x142/0x4d0
  ksys_write+0x133/0x160
  do_syscall_64+0x43/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f26499aa90f
 Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 5c fd ff ff 48
 RSP: 002b:00007f26495f2dc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
 RAX: ffffffffffffffda RBX: 00000000000007d0 RCX: 00007f26499aa90f
 RDX: 0000000000000010 RSI: 00007f26495f2e00 RDI: 0000000000000003
 RBP: 00005632a8315440 R08: 0000000000000000 R09: 0000000000000001
 R10: 0000000000000000 R11: 0000000000000293 R12: 00007f26495f2e00
 R13: 00005632a83154e0 R14: 00005632a8315440 R15: 00005632a830a810

 Allocated by task 131419:
  kasan_save_stack+0x1b/0x40
  __kasan_kmalloc+0x7c/0x90
  proc_self_get_link+0x8b/0x100
  pick_link+0x4f1/0x5c0
  step_into+0x2eb/0x3d0
  walk_component+0xc8/0x2c0
  link_path_walk+0x3b8/0x580
  path_openat+0x101/0x230
  do_filp_open+0x12e/0x240
  do_sys_openat2+0x115/0x280
  __x64_sys_openat+0xce/0x140
  do_syscall_64+0x43/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 2ca546b92a02 ("IB/sa: Route SA pathrecord query through netlink")
Link: https://lore.kernel.org/r/72ede0f6dab61f7f23df9ac7a70666e07ef314b0.1635055496.git.leonro@nvidia.com
Signed-off-by: Mark Zhang <markzhang@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/core/sa_query.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 8c930bf1df89..de88f472eaad 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -760,8 +760,9 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb,
 
 	/* Construct the family header first */
 	header = skb_put(skb, NLMSG_ALIGN(sizeof(*header)));
-	memcpy(header->device_name, dev_name(&query->port->agent->device->dev),
-	       LS_DEVICE_NAME_MAX);
+	strscpy_pad(header->device_name,
+		    dev_name(&query->port->agent->device->dev),
+		    LS_DEVICE_NAME_MAX);
 	header->port_num = query->port->port_num;
 
 	if ((comp_mask & IB_SA_PATH_REC_REVERSIBLE) &&

From aead02927af3aee16b2644315e47b3356719656b Mon Sep 17 00:00:00 2001
From: Jonas Gorski <jonas.gorski@gmail.com>
Date: Thu, 14 Oct 2021 14:33:42 +0200
Subject: [PATCH 1092/1750] gpio: xgs-iproc: fix parsing of ngpios property

commit 85fe6415c146d5d42ce300c12f1ecf4d4af47d40 upstream.

of_property_read_u32 returns 0 on success, not true, so we need to
invert the check to actually take over the provided ngpio value.

Fixes: 6a41b6c5fc20 ("gpio: Add xgs-iproc driver")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpio/gpio-xgs-iproc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-xgs-iproc.c b/drivers/gpio/gpio-xgs-iproc.c
index ad5489a65d54..dd40277b9d06 100644
--- a/drivers/gpio/gpio-xgs-iproc.c
+++ b/drivers/gpio/gpio-xgs-iproc.c
@@ -224,7 +224,7 @@ static int iproc_gpio_probe(struct platform_device *pdev)
 	}
 
 	chip->gc.label = dev_name(dev);
-	if (of_property_read_u32(dn, "ngpios", &num_gpios))
+	if (!of_property_read_u32(dn, "ngpios", &num_gpios))
 		chip->gc.ngpio = num_gpios;
 
 	irq = platform_get_irq(pdev, 0);

From be98be1a17e9502321889b2142b5cba4aec7e087 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Wed, 20 Oct 2021 12:11:16 -0700
Subject: [PATCH 1093/1750] nios2: Make NIOS2_DTB_SOURCE_BOOL depend on
 !COMPILE_TEST

commit 4a089e95b4d6bb625044d47aed0c442a8f7bd093 upstream.

nios2:allmodconfig builds fail with

make[1]: *** No rule to make target 'arch/nios2/boot/dts/""',
	needed by 'arch/nios2/boot/dts/built-in.a'.  Stop.
make: [Makefile:1868: arch/nios2/boot/dts] Error 2 (ignored)

This is seen with compile tests since those enable NIOS2_DTB_SOURCE_BOOL,
which in turn enables NIOS2_DTB_SOURCE. This causes the build error
because the default value for NIOS2_DTB_SOURCE is an empty string.
Disable NIOS2_DTB_SOURCE_BOOL for compile tests to avoid the error.

Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/nios2/platform/Kconfig.platform | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform
index 9e32fb7f3d4c..e849daff6fd1 100644
--- a/arch/nios2/platform/Kconfig.platform
+++ b/arch/nios2/platform/Kconfig.platform
@@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR
 
 config NIOS2_DTB_SOURCE_BOOL
 	bool "Compile and link device tree into kernel image"
+	depends on !COMPILE_TEST
 	help
 	  This allows you to specify a dts (device tree source) file
 	  which will be compiled and linked into the kernel image.

From e81bed557fe7dedff78ac1a7c098f4375b4981e2 Mon Sep 17 00:00:00 2001
From: Ido Schimmel <idosch@nvidia.com>
Date: Sun, 24 Oct 2021 09:40:14 +0300
Subject: [PATCH 1094/1750] mlxsw: pci: Recycle received packet upon allocation
 failure

commit 759635760a804b0d8ad0cc677b650f1544cae22f upstream.

When the driver fails to allocate a new Rx buffer, it passes an empty Rx
descriptor (contains zero address and size) to the device and marks it
as invalid by setting the skb pointer in the descriptor's metadata to
NULL.

After processing enough Rx descriptors, the driver will try to process
the invalid descriptor, but will return immediately seeing that the skb
pointer is NULL. Since the driver no longer passes new Rx descriptors to
the device, the Rx queue will eventually become full and the device will
start to drop packets.

Fix this by recycling the received packet if allocation of the new
packet failed. This means that allocation is no longer performed at the
end of the Rx routine, but at the start, before tearing down the DMA
mapping of the received packet.

Remove the comment about the descriptor being zeroed as it is no longer
correct. This is OK because we either use the descriptor as-is (when
recycling) or overwrite its address and size fields with that of the
newly allocated Rx buffer.

The issue was discovered when a process ("perf") consumed too much
memory and put the system under memory pressure. It can be reproduced by
injecting slab allocation failures [1]. After the fix, the Rx queue no
longer comes to a halt.

[1]
 # echo 10 > /sys/kernel/debug/failslab/times
 # echo 1000 > /sys/kernel/debug/failslab/interval
 # echo 100 > /sys/kernel/debug/failslab/probability

 FAULT_INJECTION: forcing a failure.
 name failslab, interval 1000, probability 100, space 0, times 8
 [...]
 Call Trace:
  <IRQ>
  dump_stack_lvl+0x34/0x44
  should_fail.cold+0x32/0x37
  should_failslab+0x5/0x10
  kmem_cache_alloc_node+0x23/0x190
  __alloc_skb+0x1f9/0x280
  __netdev_alloc_skb+0x3a/0x150
  mlxsw_pci_rdq_skb_alloc+0x24/0x90
  mlxsw_pci_cq_tasklet+0x3dc/0x1200
  tasklet_action_common.constprop.0+0x9f/0x100
  __do_softirq+0xb5/0x252
  irq_exit_rcu+0x7a/0xa0
  common_interrupt+0x83/0xa0
  </IRQ>
  asm_common_interrupt+0x1e/0x40
 RIP: 0010:cpuidle_enter_state+0xc8/0x340
 [...]
 mlxsw_spectrum2 0000:06:00.0: Failed to alloc skb for RDQ

Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Link: https://lore.kernel.org/r/20211024064014.1060919-1-idosch@idosch.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlxsw/pci.c | 25 +++++++++++------------
 1 file changed, 12 insertions(+), 13 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c
index 641cdd81882b..ffaeda75eec4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -353,13 +353,10 @@ static int mlxsw_pci_rdq_skb_alloc(struct mlxsw_pci *mlxsw_pci,
 	struct sk_buff *skb;
 	int err;
 
-	elem_info->u.rdq.skb = NULL;
 	skb = netdev_alloc_skb_ip_align(NULL, buf_len);
 	if (!skb)
 		return -ENOMEM;
 
-	/* Assume that wqe was previously zeroed. */
-
 	err = mlxsw_pci_wqe_frag_map(mlxsw_pci, wqe, 0, skb->data,
 				     buf_len, DMA_FROM_DEVICE);
 	if (err)
@@ -548,21 +545,26 @@ static void mlxsw_pci_cqe_rdq_handle(struct mlxsw_pci *mlxsw_pci,
 	struct pci_dev *pdev = mlxsw_pci->pdev;
 	struct mlxsw_pci_queue_elem_info *elem_info;
 	struct mlxsw_rx_info rx_info = {};
-	char *wqe;
+	char wqe[MLXSW_PCI_WQE_SIZE];
 	struct sk_buff *skb;
 	u16 byte_count;
 	int err;
 
 	elem_info = mlxsw_pci_queue_elem_info_consumer_get(q);
-	skb = elem_info->u.sdq.skb;
-	if (!skb)
-		return;
-	wqe = elem_info->elem;
-	mlxsw_pci_wqe_frag_unmap(mlxsw_pci, wqe, 0, DMA_FROM_DEVICE);
+	skb = elem_info->u.rdq.skb;
+	memcpy(wqe, elem_info->elem, MLXSW_PCI_WQE_SIZE);
 
 	if (q->consumer_counter++ != consumer_counter_limit)
 		dev_dbg_ratelimited(&pdev->dev, "Consumer counter does not match limit in RDQ\n");
 
+	err = mlxsw_pci_rdq_skb_alloc(mlxsw_pci, elem_info);
+	if (err) {
+		dev_err_ratelimited(&pdev->dev, "Failed to alloc skb for RDQ\n");
+		goto out;
+	}
+
+	mlxsw_pci_wqe_frag_unmap(mlxsw_pci, wqe, 0, DMA_FROM_DEVICE);
+
 	if (mlxsw_pci_cqe_lag_get(cqe_v, cqe)) {
 		rx_info.is_lag = true;
 		rx_info.u.lag_id = mlxsw_pci_cqe_lag_id_get(cqe_v, cqe);
@@ -594,10 +596,7 @@ static void mlxsw_pci_cqe_rdq_handle(struct mlxsw_pci *mlxsw_pci,
 	skb_put(skb, byte_count);
 	mlxsw_core_skb_receive(mlxsw_pci->core, skb, &rx_info);
 
-	memset(wqe, 0, q->elem_size);
-	err = mlxsw_pci_rdq_skb_alloc(mlxsw_pci, elem_info);
-	if (err)
-		dev_dbg_ratelimited(&pdev->dev, "Failed to alloc skb for RDQ\n");
+out:
 	/* Everything is set up, ring doorbell to pass elem to HW */
 	q->producer_counter++;
 	mlxsw_pci_queue_doorbell_producer_ring(mlxsw_pci, q);

From bfa6fbdb4e39b8483fd7ec70c4c82a5105348193 Mon Sep 17 00:00:00 2001
From: Yuiko Oshino <yuiko.oshino@microchip.com>
Date: Fri, 22 Oct 2021 11:13:53 -0400
Subject: [PATCH 1095/1750] net: ethernet: microchip: lan743x: Fix driver crash
 when lan743x_pm_resume fails

commit d6423d2ec39cce2bfca418c81ef51792891576bc upstream.

The driver needs to clean up and return when the initialization fails on resume.

Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 8947c3a62810..79fd031f44eb 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -3066,6 +3066,8 @@ static int lan743x_pm_resume(struct device *dev)
 	if (ret) {
 		netif_err(adapter, probe, adapter->netdev,
 			  "lan743x_hardware_init returned %d\n", ret);
+		lan743x_pci_cleanup(adapter);
+		return ret;
 	}
 
 	/* open netdev when netdev is at running state while resume.

From c2af2092c9bbb33c0131a8aca5b8f6db7c223d08 Mon Sep 17 00:00:00 2001
From: Yuiko Oshino <yuiko.oshino@microchip.com>
Date: Fri, 22 Oct 2021 11:53:43 -0400
Subject: [PATCH 1096/1750] net: ethernet: microchip: lan743x: Fix dma
 allocation failure by using dma_set_mask_and_coherent

commit 95a359c9553342d36d408d35331ff0bfce75272f upstream.

The dma failure was reported in the raspberry pi github (issue #4117).
https://github.com/raspberrypi/linux/issues/4117
The use of dma_set_mask_and_coherent fixes the issue.
Tested on 32/64-bit raspberry pi CM4 and 64-bit ubuntu x86 PC with EVB-LAN7430.

Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 79fd031f44eb..3355e0a5b272 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1770,6 +1770,16 @@ static int lan743x_tx_ring_init(struct lan743x_tx *tx)
 		ret = -EINVAL;
 		goto cleanup;
 	}
+	if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
+				      DMA_BIT_MASK(64))) {
+		if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
+					      DMA_BIT_MASK(32))) {
+			dev_warn(&tx->adapter->pdev->dev,
+				 "lan743x_: No suitable DMA available\n");
+			ret = -ENOMEM;
+			goto cleanup;
+		}
+	}
 	ring_allocation_size = ALIGN(tx->ring_size *
 				     sizeof(struct lan743x_tx_descriptor),
 				     PAGE_SIZE);
@@ -2318,6 +2328,16 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx)
 		ret = -EINVAL;
 		goto cleanup;
 	}
+	if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
+				      DMA_BIT_MASK(64))) {
+		if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
+					      DMA_BIT_MASK(32))) {
+			dev_warn(&rx->adapter->pdev->dev,
+				 "lan743x_: No suitable DMA available\n");
+			ret = -ENOMEM;
+			goto cleanup;
+		}
+	}
 	ring_allocation_size = ALIGN(rx->ring_size *
 				     sizeof(struct lan743x_rx_descriptor),
 				     PAGE_SIZE);

From 44e8c93e1e4960566b34beb85b73f5ab4a6b6e76 Mon Sep 17 00:00:00 2001
From: Trevor Woerner <twoerner@gmail.com>
Date: Sun, 24 Oct 2021 13:50:02 -0400
Subject: [PATCH 1097/1750] net: nxp: lpc_eth.c: avoid hang when bringing
 interface down

commit ace19b992436a257d9a793672e57abc28fe83e2e upstream.

A hard hang is observed whenever the ethernet interface is brought
down. If the PHY is stopped before the LPC core block is reset,
the SoC will hang. Comparing lpc_eth_close() and lpc_eth_open() I
re-arranged the ordering of the functions calls in lpc_eth_close() to
reset the hardware before stopping the PHY.
Fixes: b7370112f519 ("lpc32xx: Added ethernet driver")
Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Acked-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/nxp/lpc_eth.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index d3cbb4215f5c..9e098e40fb1c 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -1015,9 +1015,6 @@ static int lpc_eth_close(struct net_device *ndev)
 	napi_disable(&pldat->napi);
 	netif_stop_queue(ndev);
 
-	if (ndev->phydev)
-		phy_stop(ndev->phydev);
-
 	spin_lock_irqsave(&pldat->lock, flags);
 	__lpc_eth_reset(pldat);
 	netif_carrier_off(ndev);
@@ -1025,6 +1022,8 @@ static int lpc_eth_close(struct net_device *ndev)
 	writel(0, LPC_ENET_MAC2(pldat->net_base));
 	spin_unlock_irqrestore(&pldat->lock, flags);
 
+	if (ndev->phydev)
+		phy_stop(ndev->phydev);
 	clk_disable_unprepare(pldat->clk);
 
 	return 0;

From 58722323d4bc7e7fb9e1e4397551f7a02f2f2757 Mon Sep 17 00:00:00 2001
From: Daniel Jordan <daniel.m.jordan@oracle.com>
Date: Wed, 27 Oct 2021 17:59:21 -0400
Subject: [PATCH 1098/1750] net/tls: Fix flipped sign in async_wait.err
 assignment

commit 1d9d6fd21ad4a28b16ed9ee5432ae738b9dc58aa upstream.

sk->sk_err contains a positive number, yet async_wait.err wants the
opposite.  Fix the missed sign flip, which Jakub caught by inspection.

Fixes: a42055e8d2c3 ("net/tls: Add support for async encryption of records for performance")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_sw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index eda1a5d0ef0c..14cce61160a5 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -459,7 +459,7 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err)
 
 		/* If err is already set on socket, return the same code */
 		if (sk->sk_err) {
-			ctx->async_wait.err = sk->sk_err;
+			ctx->async_wait.err = -sk->sk_err;
 		} else {
 			ctx->async_wait.err = err;
 			tls_err_abort(sk, err);

From 258c5fea44cf09d502b7ce641abe8c01e6821655 Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 24 Oct 2021 21:48:02 +0200
Subject: [PATCH 1099/1750] phy: phy_ethtool_ksettings_get: Lock the phy for
 consistency

commit c10a485c3de5ccbf1fff65a382cebcb2730c6b06 upstream.

The PHY structure should be locked while copying information out if
it, otherwise there is no guarantee of self consistency. Without the
lock the PHY state machine could be updating the structure.

Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support")
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phy.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 28ddaad721ed..56413b299e1b 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -316,6 +316,7 @@ EXPORT_SYMBOL(phy_ethtool_ksettings_set);
 void phy_ethtool_ksettings_get(struct phy_device *phydev,
 			       struct ethtool_link_ksettings *cmd)
 {
+	mutex_lock(&phydev->lock);
 	linkmode_copy(cmd->link_modes.supported, phydev->supported);
 	linkmode_copy(cmd->link_modes.advertising, phydev->advertising);
 	linkmode_copy(cmd->link_modes.lp_advertising, phydev->lp_advertising);
@@ -334,6 +335,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,
 	cmd->base.autoneg = phydev->autoneg;
 	cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl;
 	cmd->base.eth_tp_mdix = phydev->mdix;
+	mutex_unlock(&phydev->lock);
 }
 EXPORT_SYMBOL(phy_ethtool_ksettings_get);
 

From 81780b624d1cdf6920cd28c6c404d58e56972cd8 Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 24 Oct 2021 21:48:03 +0200
Subject: [PATCH 1100/1750] phy: phy_ethtool_ksettings_set: Move after
 phy_start_aneg

commit 64cd92d5e8180c2ded3fdea76862de6f596ae2c9 upstream.

This allows it to make use of a helper which assume the PHY is already
locked.

Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support")
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phy.c | 106 +++++++++++++++++++++---------------------
 1 file changed, 53 insertions(+), 53 deletions(-)

diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 56413b299e1b..13af3a28fe8f 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -260,59 +260,6 @@ static void phy_sanitize_settings(struct phy_device *phydev)
 	}
 }
 
-int phy_ethtool_ksettings_set(struct phy_device *phydev,
-			      const struct ethtool_link_ksettings *cmd)
-{
-	__ETHTOOL_DECLARE_LINK_MODE_MASK(advertising);
-	u8 autoneg = cmd->base.autoneg;
-	u8 duplex = cmd->base.duplex;
-	u32 speed = cmd->base.speed;
-
-	if (cmd->base.phy_address != phydev->mdio.addr)
-		return -EINVAL;
-
-	linkmode_copy(advertising, cmd->link_modes.advertising);
-
-	/* We make sure that we don't pass unsupported values in to the PHY */
-	linkmode_and(advertising, advertising, phydev->supported);
-
-	/* Verify the settings we care about. */
-	if (autoneg != AUTONEG_ENABLE && autoneg != AUTONEG_DISABLE)
-		return -EINVAL;
-
-	if (autoneg == AUTONEG_ENABLE && linkmode_empty(advertising))
-		return -EINVAL;
-
-	if (autoneg == AUTONEG_DISABLE &&
-	    ((speed != SPEED_1000 &&
-	      speed != SPEED_100 &&
-	      speed != SPEED_10) ||
-	     (duplex != DUPLEX_HALF &&
-	      duplex != DUPLEX_FULL)))
-		return -EINVAL;
-
-	phydev->autoneg = autoneg;
-
-	if (autoneg == AUTONEG_DISABLE) {
-		phydev->speed = speed;
-		phydev->duplex = duplex;
-	}
-
-	linkmode_copy(phydev->advertising, advertising);
-
-	linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
-			 phydev->advertising, autoneg == AUTONEG_ENABLE);
-
-	phydev->master_slave_set = cmd->base.master_slave_cfg;
-	phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl;
-
-	/* Restart the PHY */
-	phy_start_aneg(phydev);
-
-	return 0;
-}
-EXPORT_SYMBOL(phy_ethtool_ksettings_set);
-
 void phy_ethtool_ksettings_get(struct phy_device *phydev,
 			       struct ethtool_link_ksettings *cmd)
 {
@@ -818,6 +765,59 @@ static int phy_poll_aneg_done(struct phy_device *phydev)
 	return ret < 0 ? ret : 0;
 }
 
+int phy_ethtool_ksettings_set(struct phy_device *phydev,
+			      const struct ethtool_link_ksettings *cmd)
+{
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(advertising);
+	u8 autoneg = cmd->base.autoneg;
+	u8 duplex = cmd->base.duplex;
+	u32 speed = cmd->base.speed;
+
+	if (cmd->base.phy_address != phydev->mdio.addr)
+		return -EINVAL;
+
+	linkmode_copy(advertising, cmd->link_modes.advertising);
+
+	/* We make sure that we don't pass unsupported values in to the PHY */
+	linkmode_and(advertising, advertising, phydev->supported);
+
+	/* Verify the settings we care about. */
+	if (autoneg != AUTONEG_ENABLE && autoneg != AUTONEG_DISABLE)
+		return -EINVAL;
+
+	if (autoneg == AUTONEG_ENABLE && linkmode_empty(advertising))
+		return -EINVAL;
+
+	if (autoneg == AUTONEG_DISABLE &&
+	    ((speed != SPEED_1000 &&
+	      speed != SPEED_100 &&
+	      speed != SPEED_10) ||
+	     (duplex != DUPLEX_HALF &&
+	      duplex != DUPLEX_FULL)))
+		return -EINVAL;
+
+	phydev->autoneg = autoneg;
+
+	if (autoneg == AUTONEG_DISABLE) {
+		phydev->speed = speed;
+		phydev->duplex = duplex;
+	}
+
+	linkmode_copy(phydev->advertising, advertising);
+
+	linkmode_mod_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+			 phydev->advertising, autoneg == AUTONEG_ENABLE);
+
+	phydev->master_slave_set = cmd->base.master_slave_cfg;
+	phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl;
+
+	/* Restart the PHY */
+	phy_start_aneg(phydev);
+
+	return 0;
+}
+EXPORT_SYMBOL(phy_ethtool_ksettings_set);
+
 /**
  * phy_speed_down - set speed to lowest speed supported by both link partners
  * @phydev: the phy_device struct

From 5b88bb9377ee48bf29c2c184cdabc7036dc4ddd6 Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 24 Oct 2021 21:48:04 +0200
Subject: [PATCH 1101/1750] phy: phy_start_aneg: Add an unlocked version

commit 707293a56f95f8e7e0cfae008010c7933fb68973 upstream.

Split phy_start_aneg into a wrapper which takes the PHY lock, and a
helper doing the real work. This will be needed when
phy_ethtook_ksettings_set takes the lock.

Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support")
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phy.c | 46 ++++++++++++++++++++++++++++++-------------
 1 file changed, 32 insertions(+), 14 deletions(-)

diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 13af3a28fe8f..a84b68e7ce82 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -715,6 +715,37 @@ static int phy_check_link_status(struct phy_device *phydev)
 	return 0;
 }
 
+/**
+ * _phy_start_aneg - start auto-negotiation for this PHY device
+ * @phydev: the phy_device struct
+ *
+ * Description: Sanitizes the settings (if we're not autonegotiating
+ *   them), and then calls the driver's config_aneg function.
+ *   If the PHYCONTROL Layer is operating, we change the state to
+ *   reflect the beginning of Auto-negotiation or forcing.
+ */
+static int _phy_start_aneg(struct phy_device *phydev)
+{
+	int err;
+
+	lockdep_assert_held(&phydev->lock);
+
+	if (!phydev->drv)
+		return -EIO;
+
+	if (AUTONEG_DISABLE == phydev->autoneg)
+		phy_sanitize_settings(phydev);
+
+	err = phy_config_aneg(phydev);
+	if (err < 0)
+		return err;
+
+	if (phy_is_started(phydev))
+		err = phy_check_link_status(phydev);
+
+	return err;
+}
+
 /**
  * phy_start_aneg - start auto-negotiation for this PHY device
  * @phydev: the phy_device struct
@@ -728,21 +759,8 @@ int phy_start_aneg(struct phy_device *phydev)
 {
 	int err;
 
-	if (!phydev->drv)
-		return -EIO;
-
 	mutex_lock(&phydev->lock);
-
-	if (AUTONEG_DISABLE == phydev->autoneg)
-		phy_sanitize_settings(phydev);
-
-	err = phy_config_aneg(phydev);
-	if (err < 0)
-		goto out_unlock;
-
-	if (phy_is_started(phydev))
-		err = phy_check_link_status(phydev);
-out_unlock:
+	err = _phy_start_aneg(phydev);
 	mutex_unlock(&phydev->lock);
 
 	return err;

From 4509000a2515d26faeac5d44bb00d6ccf325ebd2 Mon Sep 17 00:00:00 2001
From: Andrew Lunn <andrew@lunn.ch>
Date: Sun, 24 Oct 2021 21:48:05 +0200
Subject: [PATCH 1102/1750] phy: phy_ethtool_ksettings_set: Lock the PHY while
 changing settings

commit af1a02aa23c37045e6adfcf074cf7dbac167a403 upstream.

There is a race condition where the PHY state machine can change
members of the phydev structure at the same time userspace requests a
change via ethtool. To prevent this, have phy_ethtool_ksettings_set
take the PHY lock.

Fixes: 2d55173e71b0 ("phy: add generic function to support ksetting support")
Reported-by: Walter Stoll <Walter.Stoll@duagon.com>
Suggested-by: Walter Stoll <Walter.Stoll@duagon.com>
Tested-by: Walter Stoll <Walter.Stoll@duagon.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phy.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index a84b68e7ce82..5ee7cde0c2e9 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -814,6 +814,7 @@ int phy_ethtool_ksettings_set(struct phy_device *phydev,
 	      duplex != DUPLEX_FULL)))
 		return -EINVAL;
 
+	mutex_lock(&phydev->lock);
 	phydev->autoneg = autoneg;
 
 	if (autoneg == AUTONEG_DISABLE) {
@@ -830,8 +831,9 @@ int phy_ethtool_ksettings_set(struct phy_device *phydev,
 	phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl;
 
 	/* Restart the PHY */
-	phy_start_aneg(phydev);
+	_phy_start_aneg(phydev);
 
+	mutex_unlock(&phydev->lock);
 	return 0;
 }
 EXPORT_SYMBOL(phy_ethtool_ksettings_set);

From ad111d4435d85fd3eeb2c09692030d89f8862401 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 20 Oct 2021 07:42:41 -0400
Subject: [PATCH 1103/1750] sctp: use init_tag from inithdr for ABORT chunk

[ Upstream commit 4f7019c7eb33967eb87766e0e4602b5576873680 ]

Currently Linux SCTP uses the verification tag of the existing SCTP
asoc when failing to process and sending the packet with the ABORT
chunk. This will result in the peer accepting the ABORT chunk and
removing the SCTP asoc. One could exploit this to terminate a SCTP
asoc.

This patch is to fix it by always using the initiate tag of the
received INIT chunk for the ABORT chunk to be sent.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_statefuns.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index b65bdaa84228..89a86728184d 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -6248,6 +6248,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(
 		 * yet.
 		 */
 		switch (chunk->chunk_hdr->type) {
+		case SCTP_CID_INIT:
 		case SCTP_CID_INIT_ACK:
 		{
 			struct sctp_initack_chunk *initack;

From 8c50693d25e4ab6873b32bc3cea23b382a94d05f Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 20 Oct 2021 07:42:43 -0400
Subject: [PATCH 1104/1750] sctp: fix the processing for INIT_ACK chunk

[ Upstream commit 438b95a7c98f77d51cbf4db021f41b602d750a3f ]

Currently INIT_ACK chunk in non-cookie_echoed state is processed in
sctp_sf_discard_chunk() to send an abort with the existent asoc's
vtag if the chunk length is not valid. But the vtag in the chunk's
sctphdr is not verified, which may be exploited by one to cook a
malicious chunk to terminal a SCTP asoc.

sctp_sf_discard_chunk() also is called in many other places to send
an abort, and most of those have this problem. This patch is to fix
it by sending abort with the existent asoc's vtag only if the vtag
from the chunk's sctphdr is verified in sctp_sf_discard_chunk().

Note on sctp_sf_do_9_1_abort() and sctp_sf_shutdown_pending_abort(),
the chunk length has been verified before sctp_sf_discard_chunk(),
so replace it with sctp_sf_discard(). On sctp_sf_do_asconf_ack() and
sctp_sf_do_asconf(), move the sctp_chunk_length_valid check ahead of
sctp_sf_discard_chunk(), then replace it with sctp_sf_discard().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_statefuns.c | 37 +++++++++++++++++++------------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 89a86728184d..5063f9884367 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2280,7 +2280,7 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort(
 	 */
 	if (SCTP_ADDR_DEL ==
 		    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
-		return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
 	if (!sctp_err_chunk_valid(chunk))
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
@@ -2326,7 +2326,7 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort(
 	 */
 	if (SCTP_ADDR_DEL ==
 		    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
-		return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
 	if (!sctp_err_chunk_valid(chunk))
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
@@ -2596,7 +2596,7 @@ enum sctp_disposition sctp_sf_do_9_1_abort(
 	 */
 	if (SCTP_ADDR_DEL ==
 		    sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
-		return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
 	if (!sctp_err_chunk_valid(chunk))
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
@@ -3745,6 +3745,11 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 	}
 
+	/* Make sure that the ASCONF ADDIP chunk has a valid length.  */
+	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
+		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+						  commands);
+
 	/* ADD-IP: Section 4.1.1
 	 * This chunk MUST be sent in an authenticated way by using
 	 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
@@ -3753,13 +3758,7 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
 	 */
 	if (!asoc->peer.asconf_capable ||
 	    (!net->sctp.addip_noauth && !chunk->auth))
-		return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
-					     commands);
-
-	/* Make sure that the ASCONF ADDIP chunk has a valid length.  */
-	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
-		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
-						  commands);
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
 	hdr = (struct sctp_addiphdr *)chunk->skb->data;
 	serial = ntohl(hdr->serial);
@@ -3888,6 +3887,12 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
 		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 	}
 
+	/* Make sure that the ADDIP chunk has a valid length.  */
+	if (!sctp_chunk_length_valid(asconf_ack,
+				     sizeof(struct sctp_addip_chunk)))
+		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+						  commands);
+
 	/* ADD-IP, Section 4.1.2:
 	 * This chunk MUST be sent in an authenticated way by using
 	 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
@@ -3896,14 +3901,7 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
 	 */
 	if (!asoc->peer.asconf_capable ||
 	    (!net->sctp.addip_noauth && !asconf_ack->auth))
-		return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
-					     commands);
-
-	/* Make sure that the ADDIP chunk has a valid length.  */
-	if (!sctp_chunk_length_valid(asconf_ack,
-				     sizeof(struct sctp_addip_chunk)))
-		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
-						  commands);
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
 
 	addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
 	rcvd_serial = ntohl(addip_hdr->serial);
@@ -4475,6 +4473,9 @@ enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
 {
 	struct sctp_chunk *chunk = arg;
 
+	if (asoc && !sctp_vtag_verify(chunk, asoc))
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
 	/* Make sure that the chunk has a valid length.
 	 * Since we don't know the chunk type, we use a general
 	 * chunkhdr structure to make a comparison.

From dad2486414b5c81697aa5a24383fbb65fad13cae Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 20 Oct 2021 07:42:44 -0400
Subject: [PATCH 1105/1750] sctp: fix the processing for COOKIE_ECHO chunk

[ Upstream commit a64b341b8695e1c744dd972b39868371b4f68f83 ]

1. In closed state: in sctp_sf_do_5_1D_ce():

  When asoc is NULL, making packet for abort will use chunk's vtag
  in sctp_ootb_pkt_new(). But when asoc exists, vtag from the chunk
  should be verified before using peer.i.init_tag to make packet
  for abort in sctp_ootb_pkt_new(), and just discard it if vtag is
  not correct.

2. In the other states: in sctp_sf_do_5_2_4_dupcook():

  asoc always exists, but duplicate cookie_echo's vtag will be
  handled by sctp_tietags_compare() and then take actions, so before
  that we only verify the vtag for the abort sent for invalid chunk
  length.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_statefuns.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 5063f9884367..0cfbf6046bf8 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -697,6 +697,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
 	struct sock *sk;
 	int error = 0;
 
+	if (asoc && !sctp_vtag_verify(chunk, asoc))
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
 	/* If the packet is an OOTB packet which is temporarily on the
 	 * control endpoint, respond with an ABORT.
 	 */
@@ -711,7 +714,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
 	 * in sctp_unpack_cookie().
 	 */
 	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
-		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
+						  commands);
 
 	/* If the endpoint is not listening or if the number of associations
 	 * on the TCP-style socket exceed the max backlog, respond with an
@@ -2141,9 +2145,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
 	 * enough for the chunk header.  Cookie length verification is
 	 * done later.
 	 */
-	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
-		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
-						  commands);
+	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) {
+		if (!sctp_vtag_verify(chunk, asoc))
+			asoc = NULL;
+		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
+	}
 
 	/* "Decode" the chunk.  We have no optional parameters so we
 	 * are in good shape.

From 14c1e02b11c2233343573aff90766ef8472f27e7 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 20 Oct 2021 07:42:45 -0400
Subject: [PATCH 1106/1750] sctp: add vtag check in sctp_sf_violation

[ Upstream commit aa0f697e45286a6b5f0ceca9418acf54b9099d99 ]

sctp_sf_violation() is called when processing HEARTBEAT_ACK chunk
in cookie_wait state, and some other places are also using it.

The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_statefuns.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 0cfbf6046bf8..324c0222d9e6 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4549,6 +4549,9 @@ enum sctp_disposition sctp_sf_violation(struct net *net,
 {
 	struct sctp_chunk *chunk = arg;
 
+	if (!sctp_vtag_verify(chunk, asoc))
+		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
+
 	/* Make sure that the chunk has a valid length. */
 	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
 		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,

From c2442f721972ea7c317fbfd55c902616b3151ad5 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 20 Oct 2021 07:42:46 -0400
Subject: [PATCH 1107/1750] sctp: add vtag check in sctp_sf_do_8_5_1_E_sa

[ Upstream commit ef16b1734f0a176277b7bb9c71a6d977a6ef3998 ]

sctp_sf_do_8_5_1_E_sa() is called when processing SHUTDOWN_ACK chunk
in cookie_wait and cookie_echoed state.

The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.

Note that when fails to verify the vtag from SHUTDOWN-ACK chunk,
SHUTDOWN COMPLETE message will still be sent back to peer, but
with the vtag from SHUTDOWN-ACK chunk, as said in 5) of
rfc4960#section-8.4.

While at it, also remove the unnecessary chunk length check from
sctp_sf_shut_8_4_5(), as it's already done in both places where
it calls sctp_sf_shut_8_4_5().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_statefuns.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 324c0222d9e6..82a76fda226b 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3683,12 +3683,6 @@ static enum sctp_disposition sctp_sf_shut_8_4_5(
 
 	SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
 
-	/* If the chunk length is invalid, we don't want to process
-	 * the reset of the packet.
-	 */
-	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
-		return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
-
 	/* We need to discard the rest of the packet to prevent
 	 * potential bomming attacks from additional bundled chunks.
 	 * This is documented in SCTP Threats ID.
@@ -3716,6 +3710,9 @@ enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
 {
 	struct sctp_chunk *chunk = arg;
 
+	if (!sctp_vtag_verify(chunk, asoc))
+		asoc = NULL;
+
 	/* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
 	if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
 		return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,

From a7112b8eeb14b3db21bc96abc79ca7525d77e129 Mon Sep 17 00:00:00 2001
From: Xin Long <lucien.xin@gmail.com>
Date: Wed, 20 Oct 2021 07:42:47 -0400
Subject: [PATCH 1108/1750] sctp: add vtag check in sctp_sf_ootb

[ Upstream commit 9d02831e517aa36ee6bdb453a0eb47bd49923fe3 ]

sctp_sf_ootb() is called when processing DATA chunk in closed state,
and many other places are also using it.

The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.

When fails to verify the vtag from the chunk, this patch sets asoc
to NULL, so that the abort will be made with the vtag from the
received chunk later.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sctp/sm_statefuns.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 82a76fda226b..096e6be1d8fc 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3568,6 +3568,9 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
 
 	SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
 
+	if (asoc && !sctp_vtag_verify(chunk, asoc))
+		asoc = NULL;
+
 	ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
 	do {
 		/* Report violation if the chunk is less then minimal */

From 727e5deca8027b0dd25eb3b1852134bf965767c3 Mon Sep 17 00:00:00 2001
From: Alexey Denisov <rtgbnm@gmail.com>
Date: Thu, 28 Jan 2021 09:48:59 +0500
Subject: [PATCH 1109/1750] lan743x: fix endianness when accessing descriptors

[ Upstream commit 462512824f902a24de794290dd622e664587da1d ]

TX/RX descriptor ring fields are always little-endian, but conversion
wasn't performed for big-endian CPUs, so the driver failed to work.

This patch makes the driver work on big-endian CPUs. It was tested and
confirmed to work on NXP P1010 processor (PowerPC).

Signed-off-by: Alexey Denisov <rtgbnm@gmail.com>
Link: https://lore.kernel.org/r/20210128044859.280219-1-rtgbnm@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c | 66 +++++++++----------
 drivers/net/ethernet/microchip/lan743x_main.h | 20 +++---
 2 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index 3355e0a5b272..e14dfaafe439 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1280,7 +1280,7 @@ static void lan743x_tx_release_desc(struct lan743x_tx *tx,
 	if (!(buffer_info->flags & TX_BUFFER_INFO_FLAG_ACTIVE))
 		goto done;
 
-	descriptor_type = (descriptor->data0) &
+	descriptor_type = le32_to_cpu(descriptor->data0) &
 			  TX_DESC_DATA0_DTYPE_MASK_;
 	if (descriptor_type == TX_DESC_DATA0_DTYPE_DATA_)
 		goto clean_up_data_descriptor;
@@ -1340,7 +1340,7 @@ static int lan743x_tx_next_index(struct lan743x_tx *tx, int index)
 
 static void lan743x_tx_release_completed_descriptors(struct lan743x_tx *tx)
 {
-	while ((*tx->head_cpu_ptr) != (tx->last_head)) {
+	while (le32_to_cpu(*tx->head_cpu_ptr) != (tx->last_head)) {
 		lan743x_tx_release_desc(tx, tx->last_head, false);
 		tx->last_head = lan743x_tx_next_index(tx, tx->last_head);
 	}
@@ -1426,10 +1426,10 @@ static int lan743x_tx_frame_start(struct lan743x_tx *tx,
 	if (dma_mapping_error(dev, dma_ptr))
 		return -ENOMEM;
 
-	tx_descriptor->data1 = DMA_ADDR_LOW32(dma_ptr);
-	tx_descriptor->data2 = DMA_ADDR_HIGH32(dma_ptr);
-	tx_descriptor->data3 = (frame_length << 16) &
-		TX_DESC_DATA3_FRAME_LENGTH_MSS_MASK_;
+	tx_descriptor->data1 = cpu_to_le32(DMA_ADDR_LOW32(dma_ptr));
+	tx_descriptor->data2 = cpu_to_le32(DMA_ADDR_HIGH32(dma_ptr));
+	tx_descriptor->data3 = cpu_to_le32((frame_length << 16) &
+		TX_DESC_DATA3_FRAME_LENGTH_MSS_MASK_);
 
 	buffer_info->skb = NULL;
 	buffer_info->dma_ptr = dma_ptr;
@@ -1470,7 +1470,7 @@ static void lan743x_tx_frame_add_lso(struct lan743x_tx *tx,
 		tx->frame_data0 |= TX_DESC_DATA0_IOC_;
 	}
 	tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail];
-	tx_descriptor->data0 = tx->frame_data0;
+	tx_descriptor->data0 = cpu_to_le32(tx->frame_data0);
 
 	/* move to next descriptor */
 	tx->frame_tail = lan743x_tx_next_index(tx, tx->frame_tail);
@@ -1514,7 +1514,7 @@ static int lan743x_tx_frame_add_fragment(struct lan743x_tx *tx,
 
 	/* wrap up previous descriptor */
 	tx_descriptor = &tx->ring_cpu_ptr[tx->frame_tail];
-	tx_descriptor->data0 = tx->frame_data0;
+	tx_descriptor->data0 = cpu_to_le32(tx->frame_data0);
 
 	/* move to next descriptor */
 	tx->frame_tail = lan743x_tx_next_index(tx, tx->frame_tail);
@@ -1540,10 +1540,10 @@ static int lan743x_tx_frame_add_fragment(struct lan743x_tx *tx,
 		return -ENOMEM;
 	}
 
-	tx_descriptor->data1 = DMA_ADDR_LOW32(dma_ptr);
-	tx_descriptor->data2 = DMA_ADDR_HIGH32(dma_ptr);
-	tx_descriptor->data3 = (frame_length << 16) &
-			       TX_DESC_DATA3_FRAME_LENGTH_MSS_MASK_;
+	tx_descriptor->data1 = cpu_to_le32(DMA_ADDR_LOW32(dma_ptr));
+	tx_descriptor->data2 = cpu_to_le32(DMA_ADDR_HIGH32(dma_ptr));
+	tx_descriptor->data3 = cpu_to_le32((frame_length << 16) &
+			       TX_DESC_DATA3_FRAME_LENGTH_MSS_MASK_);
 
 	buffer_info->skb = NULL;
 	buffer_info->dma_ptr = dma_ptr;
@@ -1587,7 +1587,7 @@ static void lan743x_tx_frame_end(struct lan743x_tx *tx,
 	if (ignore_sync)
 		buffer_info->flags |= TX_BUFFER_INFO_FLAG_IGNORE_SYNC;
 
-	tx_descriptor->data0 = tx->frame_data0;
+	tx_descriptor->data0 = cpu_to_le32(tx->frame_data0);
 	tx->frame_tail = lan743x_tx_next_index(tx, tx->frame_tail);
 	tx->last_tail = tx->frame_tail;
 
@@ -2004,11 +2004,11 @@ static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index,
 	}
 
 	buffer_info->buffer_length = length;
-	descriptor->data1 = DMA_ADDR_LOW32(buffer_info->dma_ptr);
-	descriptor->data2 = DMA_ADDR_HIGH32(buffer_info->dma_ptr);
+	descriptor->data1 = cpu_to_le32(DMA_ADDR_LOW32(buffer_info->dma_ptr));
+	descriptor->data2 = cpu_to_le32(DMA_ADDR_HIGH32(buffer_info->dma_ptr));
 	descriptor->data3 = 0;
-	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
-			    (length & RX_DESC_DATA0_BUF_LENGTH_MASK_));
+	descriptor->data0 = cpu_to_le32((RX_DESC_DATA0_OWN_ |
+			    (length & RX_DESC_DATA0_BUF_LENGTH_MASK_)));
 	skb_reserve(buffer_info->skb, RX_HEAD_PADDING);
 	lan743x_rx_update_tail(rx, index);
 
@@ -2023,12 +2023,12 @@ static void lan743x_rx_reuse_ring_element(struct lan743x_rx *rx, int index)
 	descriptor = &rx->ring_cpu_ptr[index];
 	buffer_info = &rx->buffer_info[index];
 
-	descriptor->data1 = DMA_ADDR_LOW32(buffer_info->dma_ptr);
-	descriptor->data2 = DMA_ADDR_HIGH32(buffer_info->dma_ptr);
+	descriptor->data1 = cpu_to_le32(DMA_ADDR_LOW32(buffer_info->dma_ptr));
+	descriptor->data2 = cpu_to_le32(DMA_ADDR_HIGH32(buffer_info->dma_ptr));
 	descriptor->data3 = 0;
-	descriptor->data0 = (RX_DESC_DATA0_OWN_ |
+	descriptor->data0 = cpu_to_le32((RX_DESC_DATA0_OWN_ |
 			    ((buffer_info->buffer_length) &
-			    RX_DESC_DATA0_BUF_LENGTH_MASK_));
+			    RX_DESC_DATA0_BUF_LENGTH_MASK_)));
 	lan743x_rx_update_tail(rx, index);
 }
 
@@ -2062,7 +2062,7 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
 {
 	struct skb_shared_hwtstamps *hwtstamps = NULL;
 	int result = RX_PROCESS_RESULT_NOTHING_TO_DO;
-	int current_head_index = *rx->head_cpu_ptr;
+	int current_head_index = le32_to_cpu(*rx->head_cpu_ptr);
 	struct lan743x_rx_buffer_info *buffer_info;
 	struct lan743x_rx_descriptor *descriptor;
 	int extension_index = -1;
@@ -2077,14 +2077,14 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
 
 	if (rx->last_head != current_head_index) {
 		descriptor = &rx->ring_cpu_ptr[rx->last_head];
-		if (descriptor->data0 & RX_DESC_DATA0_OWN_)
+		if (le32_to_cpu(descriptor->data0) & RX_DESC_DATA0_OWN_)
 			goto done;
 
-		if (!(descriptor->data0 & RX_DESC_DATA0_FS_))
+		if (!(le32_to_cpu(descriptor->data0) & RX_DESC_DATA0_FS_))
 			goto done;
 
 		first_index = rx->last_head;
-		if (descriptor->data0 & RX_DESC_DATA0_LS_) {
+		if (le32_to_cpu(descriptor->data0) & RX_DESC_DATA0_LS_) {
 			last_index = rx->last_head;
 		} else {
 			int index;
@@ -2092,10 +2092,10 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
 			index = lan743x_rx_next_index(rx, first_index);
 			while (index != current_head_index) {
 				descriptor = &rx->ring_cpu_ptr[index];
-				if (descriptor->data0 & RX_DESC_DATA0_OWN_)
+				if (le32_to_cpu(descriptor->data0) & RX_DESC_DATA0_OWN_)
 					goto done;
 
-				if (descriptor->data0 & RX_DESC_DATA0_LS_) {
+				if (le32_to_cpu(descriptor->data0) & RX_DESC_DATA0_LS_) {
 					last_index = index;
 					break;
 				}
@@ -2104,17 +2104,17 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
 		}
 		if (last_index >= 0) {
 			descriptor = &rx->ring_cpu_ptr[last_index];
-			if (descriptor->data0 & RX_DESC_DATA0_EXT_) {
+			if (le32_to_cpu(descriptor->data0) & RX_DESC_DATA0_EXT_) {
 				/* extension is expected to follow */
 				int index = lan743x_rx_next_index(rx,
 								  last_index);
 				if (index != current_head_index) {
 					descriptor = &rx->ring_cpu_ptr[index];
-					if (descriptor->data0 &
+					if (le32_to_cpu(descriptor->data0) &
 					    RX_DESC_DATA0_OWN_) {
 						goto done;
 					}
-					if (descriptor->data0 &
+					if (le32_to_cpu(descriptor->data0) &
 					    RX_DESC_DATA0_EXT_) {
 						extension_index = index;
 					} else {
@@ -2166,7 +2166,7 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
 			}
 			buffer_info->skb = NULL;
 			packet_length =	RX_DESC_DATA0_FRAME_LENGTH_GET_
-					(descriptor->data0);
+					(le32_to_cpu(descriptor->data0));
 			skb_put(skb, packet_length - 4);
 			skb->protocol = eth_type_trans(skb,
 						       rx->adapter->netdev);
@@ -2204,8 +2204,8 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
 			descriptor = &rx->ring_cpu_ptr[extension_index];
 			buffer_info = &rx->buffer_info[extension_index];
 
-			ts_sec = descriptor->data1;
-			ts_nsec = (descriptor->data2 &
+			ts_sec = le32_to_cpu(descriptor->data1);
+			ts_nsec = (le32_to_cpu(descriptor->data2) &
 				  RX_DESC_DATA2_TS_NS_MASK_);
 			lan743x_rx_reuse_ring_element(rx, extension_index);
 			real_last_index = extension_index;
diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h
index a536f4a4994d..751f2bc9ce84 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.h
+++ b/drivers/net/ethernet/microchip/lan743x_main.h
@@ -660,7 +660,7 @@ struct lan743x_tx {
 
 	struct lan743x_tx_buffer_info *buffer_info;
 
-	u32		*head_cpu_ptr;
+	__le32		*head_cpu_ptr;
 	dma_addr_t	head_dma_ptr;
 	int		last_head;
 	int		last_tail;
@@ -690,7 +690,7 @@ struct lan743x_rx {
 
 	struct lan743x_rx_buffer_info *buffer_info;
 
-	u32		*head_cpu_ptr;
+	__le32		*head_cpu_ptr;
 	dma_addr_t	head_dma_ptr;
 	u32		last_head;
 	u32		last_tail;
@@ -775,10 +775,10 @@ struct lan743x_adapter {
 #define TX_DESC_DATA3_FRAME_LENGTH_MSS_MASK_	(0x3FFF0000)
 
 struct lan743x_tx_descriptor {
-	u32     data0;
-	u32     data1;
-	u32     data2;
-	u32     data3;
+	__le32     data0;
+	__le32     data1;
+	__le32     data2;
+	__le32     data3;
 } __aligned(DEFAULT_DMA_DESCRIPTOR_SPACING);
 
 #define TX_BUFFER_INFO_FLAG_ACTIVE		BIT(0)
@@ -813,10 +813,10 @@ struct lan743x_tx_buffer_info {
 #define RX_HEAD_PADDING		NET_IP_ALIGN
 
 struct lan743x_rx_descriptor {
-	u32     data0;
-	u32     data1;
-	u32     data2;
-	u32     data3;
+	__le32     data0;
+	__le32     data1;
+	__le32     data2;
+	__le32     data3;
 } __aligned(DEFAULT_DMA_DESCRIPTOR_SPACING);
 
 #define RX_BUFFER_INFO_FLAG_ACTIVE      BIT(0)

From e11a7355fb984dacd09f33ec7954938afa8e6de5 Mon Sep 17 00:00:00 2001
From: Halil Pasic <pasic@linux.ibm.com>
Date: Tue, 19 Oct 2021 19:53:59 +0200
Subject: [PATCH 1110/1750] KVM: s390: clear kicked_mask before sleeping again

[ Upstream commit 9b57e9d5010bbed7c0d9d445085840f7025e6f9a ]

The idea behind kicked mask is that we should not re-kick a vcpu that
is already in the "kick" process, i.e. that was kicked and is
is about to be dispatched if certain conditions are met.

The problem with the current implementation is, that it assumes the
kicked vcpu is going to enter SIE shortly. But under certain
circumstances, the vcpu we just kicked will be deemed non-runnable and
will remain in wait state. This can happen, if the interrupt(s) this
vcpu got kicked to deal with got already cleared (because the interrupts
got delivered to another vcpu). In this case kvm_arch_vcpu_runnable()
would return false, and the vcpu would remain in kvm_vcpu_block(),
but this time with its kicked_mask bit set. So next time around we
wouldn't kick the vcpu form __airqs_kick_single_vcpu(), but would assume
that we just kicked it.

Let us make sure the kicked_mask is cleared before we give up on
re-dispatching the vcpu.

Fixes: 9f30f6216378 ("KVM: s390: add gib_alert_irq_handler()")
Reported-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Link: https://lore.kernel.org/r/20211019175401.3757927-2-pasic@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kvm/kvm-s390.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 7f719b468b44..00f03f363c9b 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -3312,6 +3312,7 @@ int kvm_arch_vcpu_create(struct kvm_vcpu *vcpu)
 
 int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
 {
+	clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.gisa_int.kicked_mask);
 	return kvm_s390_vcpu_has_irq(vcpu, 0);
 }
 

From 8ecddaca7942a54316faf9de8214d12edb49c448 Mon Sep 17 00:00:00 2001
From: Halil Pasic <pasic@linux.ibm.com>
Date: Tue, 19 Oct 2021 19:54:00 +0200
Subject: [PATCH 1111/1750] KVM: s390: preserve deliverable_mask in
 __airqs_kick_single_vcpu

[ Upstream commit 0e9ff65f455dfd0a8aea5e7843678ab6fe097e21 ]

Changing the deliverable mask in __airqs_kick_single_vcpu() is a bug. If
one idle vcpu can't take the interrupts we want to deliver, we should
look for another vcpu that can, instead of saying that we don't want
to deliver these interrupts by clearing the bits from the
deliverable_mask.

Fixes: 9f30f6216378 ("KVM: s390: add gib_alert_irq_handler()")
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Michael Mueller <mimu@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Link: https://lore.kernel.org/r/20211019175401.3757927-3-pasic@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kvm/interrupt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 2bb9996ff09b..e6c4f29fc695 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -3053,13 +3053,14 @@ static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask)
 	int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus);
 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
 	struct kvm_vcpu *vcpu;
+	u8 vcpu_isc_mask;
 
 	for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) {
 		vcpu = kvm_get_vcpu(kvm, vcpu_idx);
 		if (psw_ioint_disabled(vcpu))
 			continue;
-		deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
-		if (deliverable_mask) {
+		vcpu_isc_mask = (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
+		if (deliverable_mask & vcpu_isc_mask) {
 			/* lately kicked but not yet running */
 			if (test_and_set_bit(vcpu_idx, gi->kicked_mask))
 				return;

From acb8832f6a1ca53d0134246c889f6eb4010de6eb Mon Sep 17 00:00:00 2001
From: Chanho Park <chanho61.park@samsung.com>
Date: Mon, 18 Oct 2021 15:28:41 +0900
Subject: [PATCH 1112/1750] scsi: ufs: ufs-exynos: Correct timeout value
 setting registers

[ Upstream commit 282da7cef078a87b6d5e8ceba8b17e428cf0e37c ]

PA_PWRMODEUSERDATA0 -> DL_FC0PROTTIMEOUTVAL
PA_PWRMODEUSERDATA1 -> DL_TC0REPLAYTIMEOUTVAL
PA_PWRMODEUSERDATA2 -> DL_AFC0REQTIMEOUTVAL

Link: https://lore.kernel.org/r/20211018062841.18226-1-chanho61.park@samsung.com
Fixes: a967ddb22d94 ("scsi: ufs: ufs-exynos: Apply vendor-specific values for three timeouts")
Cc: Alim Akhtar <alim.akhtar@samsung.com>
Cc: Kiwoong Kim <kwmad.kim@samsung.com>
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufs-exynos.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/ufs/ufs-exynos.c b/drivers/scsi/ufs/ufs-exynos.c
index 3f4f3d6f48f9..0246ea99df7b 100644
--- a/drivers/scsi/ufs/ufs-exynos.c
+++ b/drivers/scsi/ufs/ufs-exynos.c
@@ -654,9 +654,9 @@ static int exynos_ufs_pre_pwr_mode(struct ufs_hba *hba,
 	}
 
 	/* setting for three timeout values for traffic class #0 */
-	ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA0), 8064);
-	ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA1), 28224);
-	ufshcd_dme_set(hba, UIC_ARG_MIB(PA_PWRMODEUSERDATA2), 20160);
+	ufshcd_dme_set(hba, UIC_ARG_MIB(DL_FC0PROTTIMEOUTVAL), 8064);
+	ufshcd_dme_set(hba, UIC_ARG_MIB(DL_TC0REPLAYTIMEOUTVAL), 28224);
+	ufshcd_dme_set(hba, UIC_ARG_MIB(DL_AFC0REQTIMEOUTVAL), 20160);
 
 	return 0;
 out:

From 7a4cf25d8329477b42b96c0c8c7a68036b4208b5 Mon Sep 17 00:00:00 2001
From: Chen Lu <181250012@smail.nju.edu.cn>
Date: Mon, 18 Oct 2021 13:22:38 +0800
Subject: [PATCH 1113/1750] riscv: fix misalgned trap vector base address

commit 64a19591a2938b170aa736443d5d3bf4c51e1388 upstream.

The trap vector marked by label .Lsecondary_park must align on a
4-byte boundary, as the {m,s}tvec is defined to require 4-byte
alignment.

Signed-off-by: Chen Lu <181250012@smail.nju.edu.cn>
Reviewed-by: Anup Patel <anup.patel@wdc.com>
Fixes: e011995e826f ("RISC-V: Move relocate and few other functions out of __init")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/riscv/kernel/head.S | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index 7e849797c9c3..1a819c18bede 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -175,6 +175,7 @@ setup_trap_vector:
 	csrw CSR_SCRATCH, zero
 	ret
 
+.align 2
 .Lsecondary_park:
 	/* We lack SMP support or have too many harts, so park this hart */
 	wfi

From 6f416815c505ad1e0c2d0f5c7300e18ba16ad281 Mon Sep 17 00:00:00 2001
From: Alexandre Ghiti <alexandre.ghiti@canonical.com>
Date: Fri, 29 Oct 2021 06:59:27 +0200
Subject: [PATCH 1114/1750] riscv: Fix asan-stack clang build

commit 54c5639d8f507ebefa814f574cb6f763033a72a5 upstream.

Nathan reported that because KASAN_SHADOW_OFFSET was not defined in
Kconfig, it prevents asan-stack from getting disabled with clang even
when CONFIG_KASAN_STACK is disabled: fix this by defining the
corresponding config.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Alexandre Ghiti <alexandre.ghiti@canonical.com>
Fixes: 8ad8b72721d0 ("riscv: Add KASAN support")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/riscv/Kconfig             | 6 ++++++
 arch/riscv/include/asm/kasan.h | 3 +--
 arch/riscv/mm/kasan_init.c     | 3 +++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index f7abd118d23d..1b894c327578 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -138,6 +138,12 @@ config PAGE_OFFSET
 	default 0xffffffff80000000 if 64BIT && MAXPHYSMEM_2GB
 	default 0xffffffe000000000 if 64BIT && MAXPHYSMEM_128GB
 
+config KASAN_SHADOW_OFFSET
+	hex
+	depends on KASAN_GENERIC
+	default 0xdfffffc800000000 if 64BIT
+	default 0xffffffff if 32BIT
+
 config ARCH_FLATMEM_ENABLE
 	def_bool y
 
diff --git a/arch/riscv/include/asm/kasan.h b/arch/riscv/include/asm/kasan.h
index b04028c6218c..db10a64e3b98 100644
--- a/arch/riscv/include/asm/kasan.h
+++ b/arch/riscv/include/asm/kasan.h
@@ -14,8 +14,7 @@
 #define KASAN_SHADOW_START	KERN_VIRT_START /* 2^64 - 2^38 */
 #define KASAN_SHADOW_END	(KASAN_SHADOW_START + KASAN_SHADOW_SIZE)
 
-#define KASAN_SHADOW_OFFSET	(KASAN_SHADOW_END - (1ULL << \
-					(64 - KASAN_SHADOW_SCALE_SHIFT)))
+#define KASAN_SHADOW_OFFSET	_AC(CONFIG_KASAN_SHADOW_OFFSET, UL)
 
 void kasan_init(void);
 asmlinkage void kasan_early_init(void);
diff --git a/arch/riscv/mm/kasan_init.c b/arch/riscv/mm/kasan_init.c
index a8a2ffd9114a..883c3be43ea9 100644
--- a/arch/riscv/mm/kasan_init.c
+++ b/arch/riscv/mm/kasan_init.c
@@ -16,6 +16,9 @@ asmlinkage void __init kasan_early_init(void)
 	uintptr_t i;
 	pgd_t *pgd = early_pg_dir + pgd_index(KASAN_SHADOW_START);
 
+	BUILD_BUG_ON(KASAN_SHADOW_OFFSET !=
+		KASAN_SHADOW_END - (1UL << (64 - KASAN_SHADOW_SCALE_SHIFT)));
+
 	for (i = 0; i < PTRS_PER_PTE; ++i)
 		set_pte(kasan_early_shadow_pte + i,
 			mk_pte(virt_to_page(kasan_early_shadow_page),

From fbb91dadb512e8602c68ab6d5a049420aaebc55e Mon Sep 17 00:00:00 2001
From: Song Liu <songliubraving@fb.com>
Date: Sun, 3 Oct 2021 22:32:38 -0700
Subject: [PATCH 1115/1750] perf script: Check session->header.env.arch before
 using it

commit 29c77550eef31b0d72a45b49eeab03b8963264e8 upstream.

When perf.data is not written cleanly, we would like to process existing
data as much as possible (please see f_header.data.size == 0 condition
in perf_session__read_header). However, perf.data with partial data may
crash perf. Specifically, we see crash in 'perf script' for NULL
session->header.env.arch.

Fix this by checking session->header.env.arch before using it to determine
native_arch. Also split the if condition so it is easier to read.

Committer notes:

If it is a pipe, we already assume is a native arch, so no need to check
session->header.env.arch.

Signed-off-by: Song Liu <songliubraving@fb.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: kernel-team@fb.com
Cc: stable@vger.kernel.org
Link: http://lore.kernel.org/lkml/20211004053238.514936-1-songliubraving@fb.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/perf/builtin-script.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 2bb159c10503..1d727387cb20 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -3820,11 +3820,15 @@ int cmd_script(int argc, const char **argv)
 		goto out_delete;
 
 	uname(&uts);
-	if (data.is_pipe ||  /* assume pipe_mode indicates native_arch */
-	    !strcmp(uts.machine, session->header.env.arch) ||
-	    (!strcmp(uts.machine, "x86_64") &&
-	     !strcmp(session->header.env.arch, "i386")))
+	if (data.is_pipe) { /* Assume pipe_mode indicates native_arch */
 		native_arch = true;
+	} else if (session->header.env.arch) {
+		if (!strcmp(uts.machine, session->header.env.arch))
+			native_arch = true;
+		else if (!strcmp(uts.machine, "x86_64") &&
+			 !strcmp(session->header.env.arch, "i386"))
+			native_arch = true;
+	}
 
 	script.session = session;
 	script__setup_sample_type(&script);

From 09df347cfd189774130f8ae8267324b97aaf868e Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 2 Nov 2021 19:48:25 +0100
Subject: [PATCH 1116/1750] Linux 5.10.77

Link: https://lore.kernel.org/r/20211101082511.254155853@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 605bd943b224..a58f49e415dc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 76
+SUBLEVEL = 77
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 76698ea35fd3a66b01a1fbaaca96e3c59e0e9923 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Wed, 3 Nov 2021 10:28:52 +0100
Subject: [PATCH 1117/1750] ANDROID: GKI: fix up abi breakage from "cfg80211:
 fix management registrations locking"

Commit 4c22227e39c7 ("cfg80211: fix management registrations locking")
in 5.10.77, which is commit 09b1d5dc6ce1 ("cfg80211: fix management
registrations locking") upstream, moved the mgmt_registrations_lock out
of struct wireless_dev.  This did not change the structure size, but
caused a CRC change in the structure pointer, which tripped the abi
checker.

So restore the variable, and comment that this is not used anymore.  No
driver should ever be touching this so it is safe.

Note, using a __GENKSYMS__ hack would work, as the overall structure
size remains the same when this variable is removed, BUT the warning
that the field is gone is reported by libabigail correctly, which would
require a .xml update, so it's not worth it.

Bug: 161946584
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ibcfe743833860e6f75611d7ebed1036a77be0a69
---
 include/net/cfg80211.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index bb86217d853e..7abdf1aaf650 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -5305,6 +5305,13 @@ struct wireless_dev {
 	u32 identifier;
 
 	struct list_head mgmt_registrations;
+	/*
+	 * ANDROID: mgmt_registrations_lock was restored to preserve ABI in
+	 * 5.10.77 due to backport of 09b1d5dc6ce1 ("cfg80211: fix management
+	 * registrations locking") but it is not used for anything so do not
+	 * touch this variable!
+	 */
+	spinlock_t mgmt_registrations_lock;
 	u8 mgmt_registrations_need_update:1;
 
 	struct mutex mtx;

From 7b57c38d12aed1b5d92f74748bed25e0d041729f Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Fri, 8 Oct 2021 13:01:18 +0800
Subject: [PATCH 1118/1750] scsi: core: Put LLD module refcnt after SCSI device
 is released

commit f2b85040acec9a928b4eb1b57a989324e8e38d3f upstream.

SCSI host release is triggered when SCSI device is freed. We have to make
sure that the low-level device driver module won't be unloaded before SCSI
host instance is released because shost->hostt is required in the release
handler.

Make sure to put LLD module refcnt after SCSI device is released.

Fixes a kernel panic of 'BUG: unable to handle page fault for address'
reported by Changhui and Yi.

Link: https://lore.kernel.org/r/20211008050118.1440686-1-ming.lei@redhat.com
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reported-by: Changhui Zhong <czhong@redhat.com>
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi.c       | 4 +++-
 drivers/scsi/scsi_sysfs.c | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 24619c3bebd5..6ad834d61d4c 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -545,8 +545,10 @@ EXPORT_SYMBOL(scsi_device_get);
  */
 void scsi_device_put(struct scsi_device *sdev)
 {
-	module_put(sdev->host->hostt->module);
+	struct module *mod = sdev->host->hostt->module;
+
 	put_device(&sdev->sdev_gendev);
+	module_put(mod);
 }
 EXPORT_SYMBOL(scsi_device_put);
 
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 8173b67ec7b0..1378bb1a7371 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -450,9 +450,12 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
 	struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
 	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
 	unsigned long flags;
+	struct module *mod;
 
 	sdev = container_of(work, struct scsi_device, ew.work);
 
+	mod = sdev->host->hostt->module;
+
 	scsi_dh_release_device(sdev);
 
 	parent = sdev->sdev_gendev.parent;
@@ -501,11 +504,17 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
 
 	if (parent)
 		put_device(parent);
+	module_put(mod);
 }
 
 static void scsi_device_dev_release(struct device *dev)
 {
 	struct scsi_device *sdp = to_scsi_device(dev);
+
+	/* Set module pointer as NULL in case of module unloading */
+	if (!try_module_get(sdp->host->hostt->module))
+		sdp->host->hostt->module = NULL;
+
 	execute_in_process_context(scsi_device_dev_release_usercontext,
 				   &sdp->ew);
 }

From 748786564a358945922aa43a5b90710c81ed133e Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Tue, 2 Nov 2021 15:49:30 +0000
Subject: [PATCH 1119/1750] Revert "io_uring: reinforce cancel on flush during
 exit"

This reverts commit 88dbd085a51ec78c83dde79ad63bca8aa4272a9d.

Causes the following Syzkaller reported issue:

BUG: kernel NULL pointer dereference, address: 0000000000000010
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 546 Comm: syz-executor631 Tainted: G    B             5.10.76-syzkaller-01178-g4944ec82ebb9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_atomic_try_cmpxchg syzkaller/managers/android-5-10/kernel/./arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire syzkaller/managers/android-5-10/kernel/./include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock syzkaller/managers/android-5-10/kernel/./include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock_flags syzkaller/managers/android-5-10/kernel/./include/linux/spinlock.h:195 [inline]
RIP: 0010:__raw_spin_lock_irqsave syzkaller/managers/android-5-10/kernel/./include/linux/spinlock_api_smp.h:119 [inline]
RIP: 0010:_raw_spin_lock_irqsave+0x10d/0x210 syzkaller/managers/android-5-10/kernel/kernel/locking/spinlock.c:159
Code: 00 00 00 e8 d5 29 09 fd 4c 89 e7 be 04 00 00 00 e8 c8 29 09 fd 42 8a 04 3b 84 c0 0f 85 be 00 00 00 8b 44 24 40 b9 01 00 00 00 <f0> 41 0f b1 4d 00 75 45 48 c7 44 24 20 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc90000f174e0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 1ffff920001e2ea4 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000f17520
RBP: ffffc90000f175b0 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff520001e2ea5 R11: 0000000000000004 R12: ffffc90000f17520
R13: 0000000000000010 R14: 1ffff920001e2ea0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000000640f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 prepare_to_wait+0x9c/0x290 syzkaller/managers/android-5-10/kernel/kernel/sched/wait.c:248
 io_uring_cancel_files syzkaller/managers/android-5-10/kernel/fs/io_uring.c:8690 [inline]
 io_uring_cancel_task_requests+0x16a9/0x1ed0 syzkaller/managers/android-5-10/kernel/fs/io_uring.c:8760
 io_uring_flush+0x170/0x6d0 syzkaller/managers/android-5-10/kernel/fs/io_uring.c:8923
 filp_close+0xb0/0x150 syzkaller/managers/android-5-10/kernel/fs/open.c:1319
 close_files syzkaller/managers/android-5-10/kernel/fs/file.c:401 [inline]
 put_files_struct+0x1d4/0x350 syzkaller/managers/android-5-10/kernel/fs/file.c:429
 exit_files+0x80/0xa0 syzkaller/managers/android-5-10/kernel/fs/file.c:458
 do_exit+0x6d9/0x23a0 syzkaller/managers/android-5-10/kernel/kernel/exit.c:808
 do_group_exit+0x16a/0x2d0 syzkaller/managers/android-5-10/kernel/kernel/exit.c:910
 get_signal+0x133e/0x1f80 syzkaller/managers/android-5-10/kernel/kernel/signal.c:2790
 arch_do_signal+0x8d/0x620 syzkaller/managers/android-5-10/kernel/arch/x86/kernel/signal.c:805
 exit_to_user_mode_loop syzkaller/managers/android-5-10/kernel/kernel/entry/common.c:161 [inline]
 exit_to_user_mode_prepare+0xaa/0xe0 syzkaller/managers/android-5-10/kernel/kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x24/0x40 syzkaller/managers/android-5-10/kernel/kernel/entry/common.c:266
 do_syscall_64+0x3d/0x70 syzkaller/managers/android-5-10/kernel/arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fc6d1589a89
Code: Unable to access opcode bytes at RIP 0x7fc6d1589a5f.
RSP: 002b:00007ffd2b5da728 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffdfc RBX: 0000000000005193 RCX: 00007fc6d1589a89
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc6d161142c
RBP: 0000000000000032 R08: 00007ffd2b5eb0b8 R09: 0000000000000000
R10: 00007ffd2b5da750 R11: 0000000000000246 R12: 00007fc6d161142c
R13: 00007ffd2b5da750 R14: 00007ffd2b5da770 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000010
---[ end trace fe8044f7dc4d8d65 ]---
RIP: 0010:arch_atomic_try_cmpxchg syzkaller/managers/android-5-10/kernel/./arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire syzkaller/managers/android-5-10/kernel/./include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock syzkaller/managers/android-5-10/kernel/./include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock_flags syzkaller/managers/android-5-10/kernel/./include/linux/spinlock.h:195 [inline]
RIP: 0010:__raw_spin_lock_irqsave syzkaller/managers/android-5-10/kernel/./include/linux/spinlock_api_smp.h:119 [inline]
RIP: 0010:_raw_spin_lock_irqsave+0x10d/0x210 syzkaller/managers/android-5-10/kernel/kernel/locking/spinlock.c:159
Code: 00 00 00 e8 d5 29 09 fd 4c 89 e7 be 04 00 00 00 e8 c8 29 09 fd 42 8a 04 3b 84 c0 0f 85 be 00 00 00 8b 44 24 40 b9 01 00 00 00 <f0> 41 0f b1 4d 00 75 45 48 c7 44 24 20 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc90000f174e0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 1ffff920001e2ea4 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000f17520
RBP: ffffc90000f175b0 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff520001e2ea5 R11: 0000000000000004 R12: ffffc90000f17520
R13: 0000000000000010 R14: 1ffff920001e2ea0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000000640f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	e8 d5 29 09 fd       	callq  0xfd0929dc
   7:	4c 89 e7             	mov    %r12,%rdi
   a:	be 04 00 00 00       	mov    $0x4,%esi
   f:	e8 c8 29 09 fd       	callq  0xfd0929dc
  14:	42 8a 04 3b          	mov    (%rbx,%r15,1),%al
  18:	84 c0                	test   %al,%al
  1a:	0f 85 be 00 00 00    	jne    0xde
  20:	8b 44 24 40          	mov    0x40(%rsp),%eax
  24:	b9 01 00 00 00       	mov    $0x1,%ecx
* 29:	f0 41 0f b1 4d 00    	lock cmpxchg %ecx,0x0(%r13) <-- trapping instruction
  2f:	75 45                	jne    0x76
  31:	48 c7 44 24 20 0e 36 	movq   $0x45e0360e,0x20(%rsp)
  38:	e0 45
  3a:	4b                   	rex.WXB
  3b:	c7                   	.byte 0xc7
  3c:	04 37                	add    $0x37,%al

Link: https://syzkaller.appspot.com/bug?extid=b0003676644cf0d6acc4
Reported-by: syzbot+b0003676644cf0d6acc4@syzkaller.appspotmail.com
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index ee7ceea89934..104dff9c7131 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8759,9 +8759,10 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx,
 	io_cancel_defer_files(ctx, task, files);
 	io_cqring_overflow_flush(ctx, true, task, files);
 
-	io_uring_cancel_files(ctx, task, files);
 	if (!files)
 		__io_uring_cancel_task_requests(ctx, task);
+	else
+		io_uring_cancel_files(ctx, task, files);
 
 	if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) {
 		atomic_dec(&task->io_uring->in_idle);

From 0382fdf9ae78e01e83580fb0603cdb3e20224804 Mon Sep 17 00:00:00 2001
From: Erik Ekman <erik@kryo.se>
Date: Sun, 17 Oct 2021 19:16:57 +0200
Subject: [PATCH 1120/1750] sfc: Fix reading non-legacy supported link modes

commit 041c61488236a5a84789083e3d9f0a51139b6edf upstream.

Everything except the first 32 bits was lost when the pause flags were
added. This makes the 50000baseCR2 mode flag (bit 34) not appear.

I have tested this with a 10G card (SFN5122F-R7) by modifying it to
return a non-legacy link mode (10000baseCR).

Signed-off-by: Erik Ekman <erik@kryo.se>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/sfc/ethtool_common.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ethtool_common.c b/drivers/net/ethernet/sfc/ethtool_common.c
index bf1443539a1a..bd552c7dffcb 100644
--- a/drivers/net/ethernet/sfc/ethtool_common.c
+++ b/drivers/net/ethernet/sfc/ethtool_common.c
@@ -563,20 +563,14 @@ int efx_ethtool_get_link_ksettings(struct net_device *net_dev,
 {
 	struct efx_nic *efx = netdev_priv(net_dev);
 	struct efx_link_state *link_state = &efx->link_state;
-	u32 supported;
 
 	mutex_lock(&efx->mac_lock);
 	efx_mcdi_phy_get_link_ksettings(efx, cmd);
 	mutex_unlock(&efx->mac_lock);
 
 	/* Both MACs support pause frames (bidirectional and respond-only) */
-	ethtool_convert_link_mode_to_legacy_u32(&supported,
-						cmd->link_modes.supported);
-
-	supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
-
-	ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported,
-						supported);
+	ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
+	ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause);
 
 	if (LOOPBACK_INTERNAL(efx)) {
 		cmd->base.speed = link_state->speed;

From b9c85a71e1b4898e978c594a44e881456313a855 Mon Sep 17 00:00:00 2001
From: Eugene Crosser <crosser@average.org>
Date: Mon, 18 Oct 2021 20:22:50 +0200
Subject: [PATCH 1121/1750] vrf: Revert "Reset skb conntrack connection..."

commit 55161e67d44fdd23900be166a81e996abd6e3be9 upstream.

This reverts commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1.

When an interface is enslaved in a VRF, prerouting conntrack hook is
called twice: once in the context of the original input interface, and
once in the context of the VRF interface. If no special precausions are
taken, this leads to creation of two conntrack entries instead of one,
and breaks SNAT.

Commit above was intended to avoid creation of extra conntrack entries
when input interface is enslaved in a VRF. It did so by resetting
conntrack related data associated with the skb when it enters VRF context.

However it breaks netfilter operation. Imagine a use case when conntrack
zone must be assigned based on the original input interface, rather than
VRF interface (that would make original interfaces indistinguishable). One
could create netfilter rules similar to these:

        chain rawprerouting {
                type filter hook prerouting priority raw;
                iif realiface1 ct zone set 1 return
                iif realiface2 ct zone set 2 return
        }

This works before the mentioned commit, but not after: zone assignment
is "forgotten", and any subsequent NAT or filtering that is dependent
on the conntrack zone does not work.

Here is a reproducer script that demonstrates the difference in behaviour.

==========
#!/bin/sh

# This script demonstrates unexpected change of nftables behaviour
# caused by commit 09e856d54bda5f28 ""vrf: Reset skb conntrack
# connection on VRF rcv"
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09e856d54bda5f288ef8437a90ab2b9b3eab83d1
#
# Before the commit, it was possible to assign conntrack zone to a
# packet (or mark it for `notracking`) in the prerouting chanin, raw
# priority, based on the `iif` (interface from which the packet
# arrived).
# After the change, # if the interface is enslaved in a VRF, such
# assignment is lost. Instead, assignment based on the `iif` matching
# the VRF master interface is honored. Thus it is impossible to
# distinguish packets based on the original interface.
#
# This script demonstrates this change of behaviour: conntrack zone 1
# or 2 is assigned depending on the match with the original interface
# or the vrf master interface. It can be observed that conntrack entry
# appears in different zone in the kernel versions before and after
# the commit.

IPIN=172.30.30.1
IPOUT=172.30.30.2
PFXL=30

ip li sh vein >/dev/null 2>&1 && ip li del vein
ip li sh tvrf >/dev/null 2>&1 && ip li del tvrf
nft list table testct >/dev/null 2>&1 && nft delete table testct

ip li add vein type veth peer veout
ip li add tvrf type vrf table 9876
ip li set veout master tvrf
ip li set vein up
ip li set veout up
ip li set tvrf up
/sbin/sysctl -w net.ipv4.conf.veout.accept_local=1
/sbin/sysctl -w net.ipv4.conf.veout.rp_filter=0
ip addr add $IPIN/$PFXL dev vein
ip addr add $IPOUT/$PFXL dev veout

nft -f - <<__END__
table testct {
	chain rawpre {
		type filter hook prerouting priority raw;
		iif { veout, tvrf } meta nftrace set 1
		iif veout ct zone set 1 return
		iif tvrf ct zone set 2 return
		notrack
	}
	chain rawout {
		type filter hook output priority raw;
		notrack
	}
}
__END__

uname -rv
conntrack -F
ping -W 1 -c 1 -I vein $IPOUT
conntrack -L

Signed-off-by: Eugene Crosser <crosser@average.org>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/vrf.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index d406da82b4fb..2746f77745e4 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1313,8 +1313,6 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
 	bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
 	bool is_ndisc = ipv6_ndisc_frame(skb);
 
-	nf_reset_ct(skb);
-
 	/* loopback, multicast & non-ND link-local traffic; do not push through
 	 * packet taps again. Reset pkt_type for upper layers to process skb.
 	 * For strict packets with a source LLA, determine the dst using the
@@ -1371,8 +1369,6 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev,
 	skb->skb_iif = vrf_dev->ifindex;
 	IPCB(skb)->flags |= IPSKB_L3SLAVE;
 
-	nf_reset_ct(skb);
-
 	if (ipv4_is_multicast(ip_hdr(skb)->daddr))
 		goto out;
 

From b93a70bf2b5756dc088d7b7f41dc7d25cc765de8 Mon Sep 17 00:00:00 2001
From: Yuiko Oshino <yuiko.oshino@microchip.com>
Date: Wed, 27 Oct 2021 14:23:02 -0400
Subject: [PATCH 1122/1750] net: ethernet: microchip: lan743x: Fix skb
 allocation failure

commit e8684db191e4164f3f5f3ad7dec04a6734c25f1c upstream.

The driver allocates skb during ndo_open with GFP_ATOMIC which has high chance of failure when there are multiple instances.
GFP_KERNEL is enough while open and use GFP_ATOMIC only from interrupt context.

Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
index e14dfaafe439..3eea8cf076c4 100644
--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1963,13 +1963,13 @@ static int lan743x_rx_next_index(struct lan743x_rx *rx, int index)
 	return ((++index) % rx->ring_size);
 }
 
-static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx)
+static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx, gfp_t gfp)
 {
 	int length = 0;
 
 	length = (LAN743X_MAX_FRAME_SIZE + ETH_HLEN + 4 + RX_HEAD_PADDING);
 	return __netdev_alloc_skb(rx->adapter->netdev,
-				  length, GFP_ATOMIC | GFP_DMA);
+				  length, gfp);
 }
 
 static void lan743x_rx_update_tail(struct lan743x_rx *rx, int index)
@@ -2141,7 +2141,8 @@ static int lan743x_rx_process_packet(struct lan743x_rx *rx)
 			struct sk_buff *new_skb = NULL;
 			int packet_length;
 
-			new_skb = lan743x_rx_allocate_skb(rx);
+			new_skb = lan743x_rx_allocate_skb(rx,
+							  GFP_ATOMIC | GFP_DMA);
 			if (!new_skb) {
 				/* failed to allocate next skb.
 				 * Memory is very low.
@@ -2377,7 +2378,8 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx)
 
 	rx->last_head = 0;
 	for (index = 0; index < rx->ring_size; index++) {
-		struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx);
+		struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx,
+								   GFP_KERNEL);
 
 		ret = lan743x_rx_init_ring_element(rx, index, new_skb);
 		if (ret)

From d7fc85f6104259541ec136199d3bf7c8a736613d Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 7 Jun 2021 17:23:48 +0200
Subject: [PATCH 1123/1750] media: firewire: firedtv-avc: fix a buffer overflow
 in avc_ca_pmt()

commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream.

The bounds checking in avc_ca_pmt() is not strict enough.  It should
be checking "read_pos + 4" because it's reading 5 bytes.  If the
"es_info_length" is non-zero then it reads a 6th byte so there needs to
be an additional check for that.

I also added checks for the "write_pos".  I don't think these are
required because "read_pos" and "write_pos" are tied together so
checking one ought to be enough.  But they make the code easier to
understand for me.  The check on write_pos is:

	if (write_pos + 4 >= sizeof(c->operand) - 4) {

The first "+ 4" is because we're writing 5 bytes and the last " - 4"
is to leave space for the CRC.

The other problem is that "length" can be invalid.  It comes from
"data_length" in fdtv_ca_pmt().

Cc: stable@vger.kernel.org
Reported-by: Luo Likang <luolikang@nsfocus.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/firewire/firedtv-avc.c | 14 +++++++++++---
 drivers/media/firewire/firedtv-ci.c  |  2 ++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/media/firewire/firedtv-avc.c b/drivers/media/firewire/firedtv-avc.c
index 2bf9467b917d..71991f8638e6 100644
--- a/drivers/media/firewire/firedtv-avc.c
+++ b/drivers/media/firewire/firedtv-avc.c
@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
 		read_pos += program_info_length;
 		write_pos += program_info_length;
 	}
-	while (read_pos < length) {
+	while (read_pos + 4 < length) {
+		if (write_pos + 4 >= sizeof(c->operand) - 4) {
+			ret = -EINVAL;
+			goto out;
+		}
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];
@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
 		c->operand[write_pos++] = es_info_length >> 8;
 		c->operand[write_pos++] = es_info_length & 0xff;
 		if (es_info_length > 0) {
+			if (read_pos >= length) {
+				ret = -EINVAL;
+				goto out;
+			}
 			pmt_cmd_id = msg[read_pos++];
 			if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
 				dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
 					pmt_cmd_id);
 
-			if (es_info_length > sizeof(c->operand) - 4 -
-					     write_pos) {
+			if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
+			    es_info_length > length - read_pos) {
 				ret = -EINVAL;
 				goto out;
 			}
diff --git a/drivers/media/firewire/firedtv-ci.c b/drivers/media/firewire/firedtv-ci.c
index 9363d005e2b6..e0d57e09dab0 100644
--- a/drivers/media/firewire/firedtv-ci.c
+++ b/drivers/media/firewire/firedtv-ci.c
@@ -134,6 +134,8 @@ static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg)
 	} else {
 		data_length = msg->msg[3];
 	}
+	if (data_length > sizeof(msg->msg) - data_pos)
+		return -EINVAL;
 
 	return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
 }

From 50f46bd3094992305cdde8832203634f01d46eea Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 3 Nov 2021 16:51:12 +0100
Subject: [PATCH 1124/1750] Revert "xhci: Set HCD flag to defer primary roothub
 registration"

This reverts commit 0ea9ac731a315cd10bd6d6b33817b68ca9111ecf which is
commit b7a0a792f864583207c593b50fd1b752ed89f4c1 upstream.

It has been reported to be causing problems in Arch and Fedora bug
reports.

Reported-by: Hans de Goede <hdegoede@redhat.com>
Link: https://bbs.archlinux.org/viewtopic.php?pid=2000956#p2000956
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2019542
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2019576
Link: https://lore.kernel.org/r/42bcbea6-5eb8-16c7-336a-2cb72e71bc36@redhat.com
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: Chris Chiu <chris.chiu@canonical.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 0d6dc2e20f2a..bf42ba3e4415 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -693,7 +693,6 @@ int xhci_run(struct usb_hcd *hcd)
 		if (ret)
 			xhci_free_command(xhci, command);
 	}
-	set_bit(HCD_FLAG_DEFER_RH_REGISTER, &hcd->flags);
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
 			"Finished xhci_run for USB2 roothub");
 

From 5a7957491e31c5d6bbffa2e5d471402e931f14ca Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 3 Nov 2021 16:51:36 +0100
Subject: [PATCH 1125/1750] Revert "usb: core: hcd: Add support for deferring
 roothub registration"

This reverts commit d58fc9e9c15825e3a8fc1ef3b52495c93c41e71c which is
commit 58877b0824da15698bd85a0a9dbfa8c354e6ecb7 upstream.

It has been reported to be causing problems in Arch and Fedora bug
reports.

Reported-by: Hans de Goede <hdegoede@redhat.com>
Link: https://bbs.archlinux.org/viewtopic.php?pid=2000956#p2000956
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2019542
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2019576
Link: https://lore.kernel.org/r/42bcbea6-5eb8-16c7-336a-2cb72e71bc36@redhat.com
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: Chris Chiu <chris.chiu@canonical.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/core/hcd.c  | 29 ++++++-----------------------
 include/linux/usb/hcd.h |  2 --
 2 files changed, 6 insertions(+), 25 deletions(-)

diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 4bbf3316a9a5..99908d8d2dd3 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2640,7 +2640,6 @@ int usb_add_hcd(struct usb_hcd *hcd,
 {
 	int retval;
 	struct usb_device *rhdev;
-	struct usb_hcd *shared_hcd;
 
 	if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
 		hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);
@@ -2797,26 +2796,13 @@ int usb_add_hcd(struct usb_hcd *hcd,
 		goto err_hcd_driver_start;
 	}
 
-	/* starting here, usbcore will pay attention to the shared HCD roothub */
-	shared_hcd = hcd->shared_hcd;
-	if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) {
-		retval = register_root_hub(shared_hcd);
-		if (retval != 0)
-			goto err_register_root_hub;
-
-		if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd))
-			usb_hcd_poll_rh_status(shared_hcd);
-	}
-
 	/* starting here, usbcore will pay attention to this root hub */
-	if (!HCD_DEFER_RH_REGISTER(hcd)) {
-		retval = register_root_hub(hcd);
-		if (retval != 0)
-			goto err_register_root_hub;
+	retval = register_root_hub(hcd);
+	if (retval != 0)
+		goto err_register_root_hub;
 
-		if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
-			usb_hcd_poll_rh_status(hcd);
-	}
+	if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
+		usb_hcd_poll_rh_status(hcd);
 
 	return retval;
 
@@ -2859,7 +2845,6 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);
 void usb_remove_hcd(struct usb_hcd *hcd)
 {
 	struct usb_device *rhdev = hcd->self.root_hub;
-	bool rh_registered;
 
 	dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
 
@@ -2870,7 +2855,6 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 
 	dev_dbg(hcd->self.controller, "roothub graceful disconnect\n");
 	spin_lock_irq (&hcd_root_hub_lock);
-	rh_registered = hcd->rh_registered;
 	hcd->rh_registered = 0;
 	spin_unlock_irq (&hcd_root_hub_lock);
 
@@ -2880,8 +2864,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	cancel_work_sync(&hcd->died_work);
 
 	mutex_lock(&usb_bus_idr_lock);
-	if (rh_registered)
-		usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
+	usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
 	mutex_unlock(&usb_bus_idr_lock);
 
 	/*
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 9f05016d823f..3dbb42c637c1 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -124,7 +124,6 @@ struct usb_hcd {
 #define HCD_FLAG_RH_RUNNING		5	/* root hub is running? */
 #define HCD_FLAG_DEAD			6	/* controller has died? */
 #define HCD_FLAG_INTF_AUTHORIZED	7	/* authorize interfaces? */
-#define HCD_FLAG_DEFER_RH_REGISTER	8	/* Defer roothub registration */
 
 	/* The flags can be tested using these macros; they are likely to
 	 * be slightly faster than test_bit().
@@ -135,7 +134,6 @@ struct usb_hcd {
 #define HCD_WAKEUP_PENDING(hcd)	((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING))
 #define HCD_RH_RUNNING(hcd)	((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING))
 #define HCD_DEAD(hcd)		((hcd)->flags & (1U << HCD_FLAG_DEAD))
-#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER))
 
 	/*
 	 * Specifies if interfaces are authorized by default

From 6d67b2a73b8e3a079c355bab3c1aef7d85a044b8 Mon Sep 17 00:00:00 2001
From: Yang Shi <shy828301@gmail.com>
Date: Thu, 28 Oct 2021 14:36:30 -0700
Subject: [PATCH 1126/1750] mm: khugepaged: skip huge page collapse for special
 files

commit a4aeaa06d45e90f9b279f0b09de84bd00006e733 upstream.

The read-only THP for filesystems will collapse THP for files opened
readonly and mapped with VM_EXEC.  The intended usecase is to avoid TLB
misses for large text segments.  But it doesn't restrict the file types
so a THP could be collapsed for a non-regular file, for example, block
device, if it is opened readonly and mapped with EXEC permission.  This
may cause bugs, like [1] and [2].

This is definitely not the intended usecase, so just collapse THP for
regular files in order to close the attack surface.

[shy828301@gmail.com: fix vm_file check [3]]

Link: https://lore.kernel.org/lkml/CACkBjsYwLYLRmX8GpsDpMthagWOjWWrNxqY6ZLNQVr6yx+f5vA@mail.gmail.com/ [1]
Link: https://lore.kernel.org/linux-mm/000000000000c6a82505ce284e4c@google.com/ [2]
Link: https://lkml.kernel.org/r/CAHbLzkqTW9U3VvTu1Ki5v_cLRC9gHW+znBukg_ycergE0JWj-A@mail.gmail.com [3]
Link: https://lkml.kernel.org/r/20211027195221.3825-1-shy828301@gmail.com
Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Yang Shi <shy828301@gmail.com>
Reported-by: Hao Sun <sunhao.th@gmail.com>
Reported-by: syzbot+aae069be1de40fb11825@syzkaller.appspotmail.com
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Andrea Righi <andrea.righi@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/khugepaged.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index ff389d970b68..969e57dde65f 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -443,21 +443,24 @@ static bool hugepage_vma_check(struct vm_area_struct *vma,
 	if (!transhuge_vma_enabled(vma, vm_flags))
 		return false;
 
+	if (vma->vm_file && !IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) -
+				vma->vm_pgoff, HPAGE_PMD_NR))
+		return false;
+
 	/* Enabled via shmem mount options or sysfs settings. */
-	if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) {
-		return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
-				HPAGE_PMD_NR);
-	}
+	if (shmem_file(vma->vm_file))
+		return shmem_huge_enabled(vma);
 
 	/* THP settings require madvise. */
 	if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always())
 		return false;
 
-	/* Read-only file mappings need to be aligned for THP to work. */
+	/* Only regular file is valid */
 	if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file &&
 	    (vm_flags & VM_DENYWRITE)) {
-		return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
-				HPAGE_PMD_NR);
+		struct inode *inode = vma->vm_file->f_inode;
+
+		return S_ISREG(inode->i_mode);
 	}
 
 	if (!vma->anon_vma || vma->vm_ops)

From bbc920fb320f1c241cc34ac85edaa0058922246a Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 4 Nov 2021 09:35:57 +0100
Subject: [PATCH 1127/1750] Revert "drm/ttm: fix memleak in
 ttm_transfered_destroy"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit c21b4002214c1c7e7b627b9b53375612f7aab6db which is
commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream.

Seems that the older kernels can not handle this fix because, to quote
Christian:
	The problem is this memory leak could potentially happen with
	5.10 as wel, just much much much less likely.

	But my guess is that 5.10 is so buggy that when the leak does
	NOT happen we double free and obviously causing a crash.

So it needs to be reverted.

Link: https://lore.kernel.org/r/1a1cc125-9314-f569-a6c4-40fc4509a377@amd.com
Cc: Christian König <christian.koenig@amd.com>
Cc: Erhard F. <erhard_f@mailbox.org>
Cc: Erhard F. <erhard_f@mailbox.org>
Cc: Huang Rui <ray.huang@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/ttm/ttm_bo_util.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 8fba425a7626..fb2a25f8408f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -322,7 +322,6 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo)
 	struct ttm_transfer_obj *fbo;
 
 	fbo = container_of(bo, struct ttm_transfer_obj, base);
-	dma_resv_fini(&fbo->base.base._resv);
 	ttm_bo_put(fbo->bo);
 	kfree(fbo);
 }

From f84b791d4c3b459ef404c32fc5986f18758461e9 Mon Sep 17 00:00:00 2001
From: Wang Kefeng <wangkefeng.wang@huawei.com>
Date: Mon, 23 Aug 2021 10:41:42 +0100
Subject: [PATCH 1128/1750] ARM: 9120/1: Revert "amba: make use of -1 IRQs
 warn"

commit eb4f756915875b0ea0757751cd29841f0504d547 upstream.

After commit 77a7300abad7 ("of/irq: Get rid of NO_IRQ usage"),
no irq case has been removed, irq_of_parse_and_map() will return
0 in all cases when get error from parse and map an interrupt into
linux virq space.

amba_device_register() is only used on no-DT initialization, see
  s3c64xx_pl080_init()		arch/arm/mach-s3c/pl080.c
  ep93xx_init_devices()		arch/arm/mach-ep93xx/core.c

They won't set -1 to irq[0], so no need the warn.

This reverts commit 2eac58d5026e4ec8b17ff8b62877fea9e1d2f1b3.

Reviewed-by: Rob Herring <robh@kernel.org>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/amba/bus.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index b5f5ca4e3f34..8f4ae6e967e3 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -375,9 +375,6 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent)
 	void __iomem *tmp;
 	int i, ret;
 
-	WARN_ON(dev->irq[0] == (unsigned int)-1);
-	WARN_ON(dev->irq[1] == (unsigned int)-1);
-
 	ret = request_resource(parent, &dev->res);
 	if (ret)
 		goto err_out;

From 68765fc977629f79f68f016802246d3d2f308fa6 Mon Sep 17 00:00:00 2001
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Date: Fri, 22 Oct 2021 15:04:47 +0100
Subject: [PATCH 1129/1750] Revert "wcn36xx: Disable bmps when encryption is
 disabled"

commit 285bb1738e196507bf985574d0bc1e9dd72d46b1 upstream.

This reverts commit c6522a5076e1a65877c51cfee313a74ef61cabf8.

Testing on tip-of-tree shows that this is working now. Revert this and
re-enable BMPS for Open APs.

Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211022140447.2846248-3-bryan.odonoghue@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/wcn36xx/main.c    | 10 ----------
 drivers/net/wireless/ath/wcn36xx/pmc.c     |  5 +----
 drivers/net/wireless/ath/wcn36xx/wcn36xx.h |  1 -
 3 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 6bed61953542..43be20baab35 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -601,15 +601,6 @@ static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 				}
 			}
 		}
-		/* FIXME: Only enable bmps support when encryption is enabled.
-		 * For any reasons, when connected to open/no-security BSS,
-		 * the wcn36xx controller in bmps mode does not forward
-		 * 'wake-up' beacons despite AP sends DTIM with station AID.
-		 * It could be due to a firmware issue or to the way driver
-		 * configure the station.
-		 */
-		if (vif->type == NL80211_IFTYPE_STATION)
-			vif_priv->allow_bmps = true;
 		break;
 	case DISABLE_KEY:
 		if (!(IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags)) {
@@ -909,7 +900,6 @@ static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
 				    vif->addr,
 				    bss_conf->aid);
 			vif_priv->sta_assoc = false;
-			vif_priv->allow_bmps = false;
 			wcn36xx_smd_set_link_st(wcn,
 						bss_conf->bssid,
 						vif->addr,
diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.c b/drivers/net/wireless/ath/wcn36xx/pmc.c
index 2d0780fefd47..2936aaf53273 100644
--- a/drivers/net/wireless/ath/wcn36xx/pmc.c
+++ b/drivers/net/wireless/ath/wcn36xx/pmc.c
@@ -23,10 +23,7 @@ int wcn36xx_pmc_enter_bmps_state(struct wcn36xx *wcn,
 {
 	int ret = 0;
 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
-
-	if (!vif_priv->allow_bmps)
-		return -ENOTSUPP;
-
+	/* TODO: Make sure the TX chain clean */
 	ret = wcn36xx_smd_enter_bmps(wcn, vif);
 	if (!ret) {
 		wcn36xx_dbg(WCN36XX_DBG_PMC, "Entered BMPS\n");
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index d0fcce86903a..9b4dee2fc648 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -127,7 +127,6 @@ struct wcn36xx_vif {
 	enum wcn36xx_hal_bss_type bss_type;
 
 	/* Power management */
-	bool allow_bmps;
 	enum wcn36xx_power_state pw_state;
 
 	u8 bss_index;

From f3eb44f496ef09a7df20f264879a396f642e73a7 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 4 Nov 2021 12:23:08 +0100
Subject: [PATCH 1130/1750] ALSA: usb-audio: Add Schiit Hel device to mixer map
 quirk table

commit 22390ce786c59328ccd13c329959dee1e8757487 upstream.

This is a fix equivalent with the upstream commit 22390ce786c5 ("ALSA:
usb-audio: add Schiit Hel device to quirk table"), adapted to the
earlier kernels up to 5.14.y.  It adds the quirk entry with the old
ignore_ctl_error flag to the usbmix_ctl_maps, instead.

The original patch description says:
    The Shciit Hel device responds to the ctl message for the mic capture
    switch with a timeout of -EPIPE:

            usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1
            usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1
            usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1
            usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1

    This seems safe to ignore as the device works properly with the control
    message quirk, so add it to the quirk table so all is good.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer_maps.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index c5794e83fd80..809ac6d18d2b 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -538,6 +538,10 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = {
 		.id = USB_ID(0x25c4, 0x0003),
 		.map = scms_usb3318_map,
 	},
+	{
+		.id = USB_ID(0x30be, 0x0101), /*  Schiit Hel */
+		.ignore_ctl_error = 1,
+	},
 	{
 		/* Bose Companion 5 */
 		.id = USB_ID(0x05a7, 0x1020),

From 4c7c0243275b926d35e6904c20ded6463bd69a82 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 4 Nov 2021 12:23:09 +0100
Subject: [PATCH 1131/1750] ALSA: usb-audio: Add Audient iD14 to mixer map
 quirk table

commit df0380b9539b04c1ae8854a984098da06d5f1e67 upstream.

This is a fix equivalent with the upstream commit df0380b9539b ("ALSA:
usb-audio: Add quirk for Audient iD14"), adapted to the earlier
kernels up to 5.14.y.  It adds the quirk entry with the old
ignore_ctl_error flag to the usbmix_ctl_maps, instead.

The original commit description says:
    Audient iD14 (2708:0002) may get a control message error that
    interferes the operation e.g. with alsactl.  Add the quirk to ignore
    such errors like other devices.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/mixer_maps.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 809ac6d18d2b..8f6823df944f 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -528,6 +528,10 @@ static const struct usbmix_ctl_map usbmix_ctl_maps[] = {
 		.id = USB_ID(0x2573, 0x0008),
 		.map = maya44_map,
 	},
+	{
+		.id = USB_ID(0x2708, 0x0002), /* Audient iD14 */
+		.ignore_ctl_error = 1,
+	},
 	{
 		/* KEF X300A */
 		.id = USB_ID(0x27ac, 0x1000),

From 5040520482a594e92d4f69141229a6dd26173511 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sat, 6 Nov 2021 14:10:10 +0100
Subject: [PATCH 1132/1750] Linux 5.10.78

Link: https://lore.kernel.org/r/20211104141159.561284732@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Link: https://lore.kernel.org/r/20211104170112.899181800@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index a58f49e415dc..288fb4839253 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 77
+SUBLEVEL = 78
 EXTRAVERSION =
 NAME = Dare mighty things
 

From ecf58653f1e4ab88b4eb62db8fe799826d99d5ec Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 15 Oct 2021 04:50:01 -0400
Subject: [PATCH 1133/1750] KVM: x86: avoid warning with
 -Wbitwise-instead-of-logical

commit 3d5e7a28b1ea2d603dea478e58e37ce75b9597ab upstream.

This is a new warning in clang top-of-tree (will be clang 14):

In file included from arch/x86/kvm/mmu/mmu.c:27:
arch/x86/kvm/mmu/spte.h:318:9: error: use of bitwise '|' with boolean operands [-Werror,-Wbitwise-instead-of-logical]
        return __is_bad_mt_xwr(rsvd_check, spte) |
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                                 ||
arch/x86/kvm/mmu/spte.h:318:9: note: cast one or both operands to int to silence this warning

The code is fine, but change it anyway to shut up this clever clogs
of a compiler.

Reported-by: torvic9@mailbox.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[nathan: Backport to 5.10, which does not have 961f84457cd4]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/mmu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 060d9a906535..770d18dc4650 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -3545,7 +3545,7 @@ static bool get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
 		 * reserved bit and EPT's invalid memtype/XWR checks to avoid
 		 * adding a Jcc in the loop.
 		 */
-		reserved |= __is_bad_mt_xwr(rsvd_check, sptes[level - 1]) |
+		reserved |= __is_bad_mt_xwr(rsvd_check, sptes[level - 1]) ||
 			    __is_rsvd_bits_set(rsvd_check, sptes[level - 1],
 					       level);
 	}

From a8db6fd04d58b92d0698ee56e42134f26b236a90 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Mon, 13 Sep 2021 15:57:43 +0200
Subject: [PATCH 1134/1750] Revert "x86/kvm: fix vcpu-id indexed array sizes"

commit 1e254d0d86a0f2efd4190a89d5204b37c18c6381 upstream.

This reverts commit 76b4f357d0e7d8f6f0013c733e6cba1773c266d3.

The commit has the wrong reasoning, as KVM_MAX_VCPU_ID is not defining the
maximum allowed vcpu-id as its name suggests, but the number of vcpu-ids.
So revert this patch again.

Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20210913135745.13944-2-jgross@suse.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/ioapic.c | 2 +-
 arch/x86/kvm/ioapic.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 8c065da73f8e..4e0f52660842 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -96,7 +96,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
 static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
 {
 	ioapic->rtc_status.pending_eoi = 0;
-	bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1);
+	bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
 }
 
 static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
index 11e4065e1617..660401700075 100644
--- a/arch/x86/kvm/ioapic.h
+++ b/arch/x86/kvm/ioapic.h
@@ -43,13 +43,13 @@ struct kvm_vcpu;
 
 struct dest_map {
 	/* vcpu bitmap where IRQ has been sent */
-	DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1);
+	DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
 
 	/*
 	 * Vector sent to a given vcpu, only valid when
 	 * the vcpu's bit in map is set
 	 */
-	u8 vectors[KVM_MAX_VCPU_ID + 1];
+	u8 vectors[KVM_MAX_VCPU_ID];
 };
 
 

From 94e5305a381658064949e2f427f4a7591f4194aa Mon Sep 17 00:00:00 2001
From: Neal Liu <neal_liu@aspeedtech.com>
Date: Fri, 10 Sep 2021 15:36:19 +0800
Subject: [PATCH 1135/1750] usb: ehci: handshake CMD_RUN instead of STS_HALT

commit 7f2d73788d9067fd4f677ac5f60ffd25945af7af upstream.

For Aspeed, HCHalted status depends on not only Run/Stop but also
ASS/PSS status.
Handshake CMD_RUN on startup instead.

Tested-by: Tao Ren <rentao.bupt@gmail.com>
Reviewed-by: Tao Ren <rentao.bupt@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Neal Liu <neal_liu@aspeedtech.com>
Link: https://lore.kernel.org/r/20210910073619.26095-1-neal_liu@aspeedtech.com
Cc: Joel Stanley <joel@jms.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/ehci-hcd.c      | 11 ++++++++++-
 drivers/usb/host/ehci-platform.c |  6 ++++++
 drivers/usb/host/ehci.h          |  1 +
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 6793fd99c1cb..8aff19ff8e8f 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd)
 	/* Wait until HC become operational */
 	ehci_readl(ehci, &ehci->regs->command);	/* unblock posted writes */
 	msleep(5);
-	rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
+
+	/* For Aspeed, STS_HALT also depends on ASS/PSS status.
+	 * Check CMD_RUN instead.
+	 */
+	if (ehci->is_aspeed)
+		rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN,
+				    1, 100 * 1000);
+	else
+		rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT,
+				    0, 100 * 1000);
 
 	up_write(&ehci_cf_port_reset_rwsem);
 
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index a48dd3fac153..2dcfc67f2ba8 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -294,6 +294,12 @@ static int ehci_platform_probe(struct platform_device *dev)
 					  "has-transaction-translator"))
 			hcd->has_tt = 1;
 
+		if (of_device_is_compatible(dev->dev.of_node,
+					    "aspeed,ast2500-ehci") ||
+		    of_device_is_compatible(dev->dev.of_node,
+					    "aspeed,ast2600-ehci"))
+			ehci->is_aspeed = 1;
+
 		if (soc_device_match(quirk_poll_match))
 			priv->quirk_poll = true;
 
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index eabf22a78eae..59fd523c55f3 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -218,6 +218,7 @@ struct ehci_hcd {			/* one per controller */
 	unsigned		frame_index_bug:1; /* MosChip (AKA NetMos) */
 	unsigned		need_oc_pp_cycle:1; /* MPC834X port power */
 	unsigned		imx28_write_fix:1; /* For Freescale i.MX28 */
+	unsigned		is_aspeed:1;
 
 	/* required for usb32 quirk */
 	#define OHCI_CTRL_HCFS          (3 << 6)

From 27409143122f9c68f74da42ce987cc6badb40784 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Wed, 27 Oct 2021 10:08:49 +0200
Subject: [PATCH 1136/1750] usb: gadget: Mark USB_FSL_QE broken on 64-bit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit a0548b26901f082684ad1fb3ba397d2de3a1406a upstream.

On 64-bit:

    drivers/usb/gadget/udc/fsl_qe_udc.c: In function ‘qe_ep0_rx’:
    drivers/usb/gadget/udc/fsl_qe_udc.c:842:13: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
      842 |     vaddr = (u32)phys_to_virt(in_be32(&bd->buf));
	  |             ^
    In file included from drivers/usb/gadget/udc/fsl_qe_udc.c:41:
    drivers/usb/gadget/udc/fsl_qe_udc.c:843:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
      843 |     frame_set_data(pframe, (u8 *)vaddr);
	  |                            ^

The driver assumes physical and virtual addresses are 32-bit, hence it
cannot work on 64-bit platforms.

Acked-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20211027080849.3276289-1-geert@linux-m68k.org
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/gadget/udc/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 1a12aab208b4..933e80d5053a 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -330,6 +330,7 @@ config USB_AMD5536UDC
 config USB_FSL_QE
 	tristate "Freescale QE/CPM USB Device Controller"
 	depends on FSL_SOC && (QUICC_ENGINE || CPM)
+	depends on !64BIT || BROKEN
 	help
 	   Some of Freescale PowerPC processors have a Full Speed
 	   QE/CPM2 USB controller, which support device mode with 4

From 1309753b7841db412063bcce3f2a0eddf1443e9d Mon Sep 17 00:00:00 2001
From: Viraj Shah <viraj.shah@linutronix.de>
Date: Thu, 21 Oct 2021 11:36:44 +0200
Subject: [PATCH 1137/1750] usb: musb: Balance list entry in musb_gadget_queue

commit 21b5fcdccb32ff09b6b63d4a83c037150665a83f upstream.

musb_gadget_queue() adds the passed request to musb_ep::req_list. If the
endpoint is idle and it is the first request then it invokes
musb_queue_resume_work(). If the function returns an error then the
error is passed to the caller without any clean-up and the request
remains enqueued on the list. If the caller enqueues the request again
then the list corrupts.

Remove the request from the list on error.

Fixes: ea2f35c01d5ea ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Viraj Shah <viraj.shah@linutronix.de>
Link: https://lore.kernel.org/r/20211021093644.4734-1-viraj.shah@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/musb/musb_gadget.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index f62ffaede1ab..fb806b33178a 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1247,9 +1247,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
 		status = musb_queue_resume_work(musb,
 						musb_ep_restart_resume_work,
 						request);
-		if (status < 0)
+		if (status < 0) {
 			dev_err(musb->controller, "%s resume work: %i\n",
 				__func__, status);
+			list_del(&request->list);
+		}
 	}
 
 unlock:

From 42681b90c4db8bf29fc2cc93789ec093bb209296 Mon Sep 17 00:00:00 2001
From: James Buren <braewoods+lkml@braewoods.net>
Date: Wed, 13 Oct 2021 20:55:04 -0500
Subject: [PATCH 1138/1750] usb-storage: Add compatibility quirk flags for iODD
 2531/2541

commit 05c8f1b67e67dcd786ae3fe44492bbc617b4bd12 upstream.

These drive enclosures have firmware bugs that make it impossible to mount
a new virtual ISO image after Linux ejects the old one if the device is
locked by Linux. Windows bypasses this problem by the fact that they do
not lock the device. Add a quirk to disable device locking for these
drive enclosures.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: James Buren <braewoods+lkml@braewoods.net>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211014015504.2695089-1-braewoods+lkml@braewoods.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/storage/unusual_devs.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c6b3fcf90180..29191d33c0e3 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -406,6 +406,16 @@ UNUSUAL_DEV(  0x04b8, 0x0602, 0x0110, 0x0110,
 		"785EPX Storage",
 		USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN),
 
+/*
+ * Reported by James Buren <braewoods+lkml@braewoods.net>
+ * Virtual ISOs cannot be remounted if ejected while the device is locked
+ * Disable locking to mimic Windows behavior that bypasses the issue
+ */
+UNUSUAL_DEV(  0x04c5, 0x2028, 0x0001, 0x0001,
+		"iODD",
+		"2531/2541",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE),
+
 /*
  * Not sure who reported this originally but
  * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN

From 07d1db141e478917600fa32be11e5b828ff9ed13 Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos@google.com>
Date: Fri, 15 Oct 2021 16:38:11 -0700
Subject: [PATCH 1139/1750] binder: don't detect sender/target during buffer
 cleanup

commit 32e9f56a96d8d0f23cb2aeb2a3cd18d40393e787 upstream.

When freeing txn buffers, binder_transaction_buffer_release()
attempts to detect whether the current context is the target by
comparing current->group_leader to proc->tsk. This is an unreliable
test. Instead explicitly pass an 'is_failure' boolean.

Detecting the sender was being used as a way to tell if the
transaction failed to be sent.  When cleaning up after
failing to send a transaction, there is no need to close
the fds associated with a BINDER_TYPE_FDA object. Now
'is_failure' can be used to accurately detect this case.

Fixes: 44d8047f1d87 ("binder: use standard functions to allocate fds")
Cc: stable <stable@vger.kernel.org>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211015233811.3532235-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 65b22b5af51a..d9977ce0be76 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2254,7 +2254,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
 		binder_dec_node(buffer->target_node, 1, 0);
 
 	off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
-	off_end_offset = is_failure ? failed_at :
+	off_end_offset = is_failure && failed_at ? failed_at :
 				off_start_offset + buffer->offsets_size;
 	for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
 	     buffer_offset += sizeof(binder_size_t)) {
@@ -2340,9 +2340,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
 			binder_size_t fd_buf_size;
 			binder_size_t num_valid;
 
-			if (proc->tsk != current->group_leader) {
+			if (is_failure) {
 				/*
-				 * Nothing to do if running in sender context
 				 * The fd fixups have not been applied so no
 				 * fds need to be closed.
 				 */
@@ -3544,6 +3543,7 @@ static void binder_transaction(struct binder_proc *proc,
  * binder_free_buf() - free the specified buffer
  * @proc:	binder proc that owns buffer
  * @buffer:	buffer to be freed
+ * @is_failure:	failed to send transaction
  *
  * If buffer for an async transaction, enqueue the next async
  * transaction from the node.
@@ -3553,7 +3553,7 @@ static void binder_transaction(struct binder_proc *proc,
 static void
 binder_free_buf(struct binder_proc *proc,
 		struct binder_thread *thread,
-		struct binder_buffer *buffer)
+		struct binder_buffer *buffer, bool is_failure)
 {
 	binder_inner_proc_lock(proc);
 	if (buffer->transaction) {
@@ -3581,7 +3581,7 @@ binder_free_buf(struct binder_proc *proc,
 		binder_node_inner_unlock(buf_node);
 	}
 	trace_binder_transaction_buffer_release(buffer);
-	binder_transaction_buffer_release(proc, thread, buffer, 0, false);
+	binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure);
 	binder_alloc_free_buf(&proc->alloc, buffer);
 }
 
@@ -3782,7 +3782,7 @@ static int binder_thread_write(struct binder_proc *proc,
 				     proc->pid, thread->pid, (u64)data_ptr,
 				     buffer->debug_id,
 				     buffer->transaction ? "active" : "finished");
-			binder_free_buf(proc, thread, buffer);
+			binder_free_buf(proc, thread, buffer, false);
 			break;
 		}
 
@@ -4470,7 +4470,7 @@ static int binder_thread_read(struct binder_proc *proc,
 			buffer->transaction = NULL;
 			binder_cleanup_transaction(t, "fd fixups failed",
 						   BR_FAILED_REPLY);
-			binder_free_buf(proc, thread, buffer);
+			binder_free_buf(proc, thread, buffer, true);
 			binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
 				     "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
 				     proc->pid, thread->pid,

From ab4af56ae2508df3bdabcb192874086f5f07d98c Mon Sep 17 00:00:00 2001
From: Petr Mladek <pmladek@suse.com>
Date: Wed, 11 Nov 2020 14:54:50 +0100
Subject: [PATCH 1140/1750] printk/console: Allow to disable console output by
 using console="" or console=null

commit 3cffa06aeef7ece30f6b5ac0ea51f264e8fea4d0 upstream.

The commit 48021f98130880dd74 ("printk: handle blank console arguments
passed in.") prevented crash caused by empty console= parameter value.

Unfortunately, this value is widely used on Chromebooks to disable
the console output. The above commit caused performance regression
because the messages were pushed on slow console even though nobody
was watching it.

Use ttynull driver explicitly for console="" and console=null
parameters. It has been created for exactly this purpose.

It causes that preferred_console is set. As a result, ttySX and ttyX
are not used as a fallback. And only ttynull console gets registered by
default.

It still allows to register other consoles either by additional console=
parameters or SPCR. It prevents regression because it worked this way even
before. Also it is a sane semantic. Preventing output on all consoles
should be done another way, for example, by introducing mute_console
parameter.

Link: https://lore.kernel.org/r/20201006025935.GA597@jagdpanzerIV.localdomain
Suggested-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20201111135450.11214-3-pmladek@suse.com
Cc: Yi Fan <yfa@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/printk/printk.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index d0df95346ab3..85351a12c85d 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2213,8 +2213,15 @@ static int __init console_setup(char *str)
 	char *s, *options, *brl_options = NULL;
 	int idx;
 
-	if (str[0] == 0)
+	/*
+	 * console="" or console=null have been suggested as a way to
+	 * disable console output. Use ttynull that has been created
+	 * for exacly this purpose.
+	 */
+	if (str[0] == 0 || strcmp(str, "null") == 0) {
+		__add_preferred_console("ttynull", 0, NULL, NULL, true);
 		return 1;
+	}
 
 	if (_braille_console_setup(&str, &brl_options))
 		return 1;

From c430094541a80575259a94ff879063ef01473506 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Wed, 20 Oct 2021 00:17:18 +0300
Subject: [PATCH 1141/1750] staging: rtl8712: fix use-after-free in
 rtl8712_dl_fw

commit c052cc1a069c3e575619cf64ec427eb41176ca70 upstream.

Syzbot reported use-after-free in rtl8712_dl_fw(). The problem was in
race condition between r871xu_dev_remove() ->ndo_open() callback.

It's easy to see from crash log, that driver accesses released firmware
in ->ndo_open() callback. It may happen, since driver was releasing
firmware _before_ unregistering netdev. Fix it by moving
unregister_netdev() before cleaning up resources.

Call Trace:
...
 rtl871x_open_fw drivers/staging/rtl8712/hal_init.c:83 [inline]
 rtl8712_dl_fw+0xd95/0xe10 drivers/staging/rtl8712/hal_init.c:170
 rtl8712_hal_init drivers/staging/rtl8712/hal_init.c:330 [inline]
 rtl871x_hal_init+0xae/0x180 drivers/staging/rtl8712/hal_init.c:394
 netdev_open+0xe6/0x6c0 drivers/staging/rtl8712/os_intfs.c:380
 __dev_open+0x2bc/0x4d0 net/core/dev.c:1484

Freed by task 1306:
...
 release_firmware+0x1b/0x30 drivers/base/firmware_loader/main.c:1053
 r871xu_dev_remove+0xcc/0x2c0 drivers/staging/rtl8712/usb_intf.c:599
 usb_unbind_interface+0x1d8/0x8d0 drivers/usb/core/driver.c:458

Fixes: 8c213fa59199 ("staging: r8712u: Use asynchronous firmware loading")
Cc: stable <stable@vger.kernel.org>
Reported-and-tested-by: syzbot+c55162be492189fb4f51@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20211019211718.26354-1-paskripkin@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8712/usb_intf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
index 17d28af0d086..fed96d4251bf 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -598,12 +598,12 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
 
 	/* never exit with a firmware callback pending */
 	wait_for_completion(&padapter->rtl8712_fw_ready);
+	if (pnetdev->reg_state != NETREG_UNINITIALIZED)
+		unregister_netdev(pnetdev); /* will call netdev_close() */
 	usb_set_intfdata(pusb_intf, NULL);
 	release_firmware(padapter->fw);
 	if (drvpriv.drv_registered)
 		padapter->surprise_removed = true;
-	if (pnetdev->reg_state != NETREG_UNINITIALIZED)
-		unregister_netdev(pnetdev); /* will call netdev_close() */
 	r8712_flush_rwctrl_works(padapter);
 	r8712_flush_led_works(padapter);
 	udelay(1);

From 86d4aedcbc69c0f84551fb70f953c24e396de2d7 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Mon, 18 Oct 2021 12:37:41 +0200
Subject: [PATCH 1142/1750] isofs: Fix out of bound access for corrupted isofs
 image

commit e96a1866b40570b5950cda8602c2819189c62a48 upstream.

When isofs image is suitably corrupted isofs_read_inode() can read data
beyond the end of buffer. Sanity-check the directory entry length before
using it.

Reported-and-tested-by: syzbot+6fc7fb214625d82af7d1@syzkaller.appspotmail.com
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/isofs/inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 35675a1065be..f62b5a501566 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -1321,6 +1321,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
 
 	de = (struct iso_directory_record *) (bh->b_data + offset);
 	de_len = *(unsigned char *) de;
+	if (de_len < sizeof(struct iso_directory_record))
+		goto fail;
 
 	if (offset + de_len > bufsize) {
 		int frag1 = bufsize - offset;

From 786f5b03450454557ff858a8bead5d7c0cbf78d6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 27 Oct 2021 11:35:29 +0200
Subject: [PATCH 1143/1750] comedi: dt9812: fix DMA buffers on stack

commit 536de747bc48262225889a533db6650731ab25d3 upstream.

USB transfer buffers are typically mapped for DMA and must not be
allocated on the stack or transfers will fail.

Allocate proper transfer buffers in the various command helpers and
return an error on short transfers instead of acting on random stack
data.

Note that this also fixes a stack info leak on systems where DMA is not
used as 32 bytes are always sent to the device regardless of how short
the command is.

Fixes: 63274cd7d38a ("Staging: comedi: add usb dt9812 driver")
Cc: stable@vger.kernel.org      # 2.6.29
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211027093529.30896-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/dt9812.c | 115 ++++++++++++++++++------
 1 file changed, 86 insertions(+), 29 deletions(-)

diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c
index 634f57730c1e..704b04d2980d 100644
--- a/drivers/staging/comedi/drivers/dt9812.c
+++ b/drivers/staging/comedi/drivers/dt9812.c
@@ -32,6 +32,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 #include <linux/uaccess.h>
 
 #include "../comedi_usb.h"
@@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev,
 {
 	struct usb_device *usb = comedi_to_usb_dev(dev);
 	struct dt9812_private *devpriv = dev->private;
-	struct dt9812_usb_cmd cmd;
+	struct dt9812_usb_cmd *cmd;
+	size_t tbuf_size;
 	int count, ret;
+	void *tbuf;
 
-	cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
-	cmd.u.flash_data_info.address =
+	tbuf_size = max(sizeof(*cmd), buf_size);
+
+	tbuf = kzalloc(tbuf_size, GFP_KERNEL);
+	if (!tbuf)
+		return -ENOMEM;
+
+	cmd = tbuf;
+
+	cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
+	cmd->u.flash_data_info.address =
 	    cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset);
-	cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size);
+	cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size);
 
 	/* DT9812 only responds to 32 byte writes!! */
 	ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
-			   &cmd, 32, &count, DT9812_USB_TIMEOUT);
+			   cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
 	if (ret)
-		return ret;
+		goto out;
 
-	return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
-			    buf, buf_size, &count, DT9812_USB_TIMEOUT);
+	ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
+			   tbuf, buf_size, &count, DT9812_USB_TIMEOUT);
+	if (!ret) {
+		if (count == buf_size)
+			memcpy(buf, tbuf, buf_size);
+		else
+			ret = -EREMOTEIO;
+	}
+out:
+	kfree(tbuf);
+
+	return ret;
 }
 
 static int dt9812_read_multiple_registers(struct comedi_device *dev,
@@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev,
 {
 	struct usb_device *usb = comedi_to_usb_dev(dev);
 	struct dt9812_private *devpriv = dev->private;
-	struct dt9812_usb_cmd cmd;
+	struct dt9812_usb_cmd *cmd;
 	int i, count, ret;
+	size_t buf_size;
+	void *buf;
 
-	cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
-	cmd.u.read_multi_info.count = reg_count;
+	buf_size = max_t(size_t, sizeof(*cmd), reg_count);
+
+	buf = kzalloc(buf_size, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	cmd = buf;
+
+	cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
+	cmd->u.read_multi_info.count = reg_count;
 	for (i = 0; i < reg_count; i++)
-		cmd.u.read_multi_info.address[i] = address[i];
+		cmd->u.read_multi_info.address[i] = address[i];
 
 	/* DT9812 only responds to 32 byte writes!! */
 	ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
-			   &cmd, 32, &count, DT9812_USB_TIMEOUT);
+			   cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
 	if (ret)
-		return ret;
+		goto out;
 
-	return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
-			    value, reg_count, &count, DT9812_USB_TIMEOUT);
+	ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
+			   buf, reg_count, &count, DT9812_USB_TIMEOUT);
+	if (!ret) {
+		if (count == reg_count)
+			memcpy(value, buf, reg_count);
+		else
+			ret = -EREMOTEIO;
+	}
+out:
+	kfree(buf);
+
+	return ret;
 }
 
 static int dt9812_write_multiple_registers(struct comedi_device *dev,
@@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev,
 {
 	struct usb_device *usb = comedi_to_usb_dev(dev);
 	struct dt9812_private *devpriv = dev->private;
-	struct dt9812_usb_cmd cmd;
+	struct dt9812_usb_cmd *cmd;
 	int i, count;
+	int ret;
 
-	cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
-	cmd.u.read_multi_info.count = reg_count;
+	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+	if (!cmd)
+		return -ENOMEM;
+
+	cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
+	cmd->u.read_multi_info.count = reg_count;
 	for (i = 0; i < reg_count; i++) {
-		cmd.u.write_multi_info.write[i].address = address[i];
-		cmd.u.write_multi_info.write[i].value = value[i];
+		cmd->u.write_multi_info.write[i].address = address[i];
+		cmd->u.write_multi_info.write[i].value = value[i];
 	}
 
 	/* DT9812 only responds to 32 byte writes!! */
-	return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
-			    &cmd, 32, &count, DT9812_USB_TIMEOUT);
+	ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
+			   cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
+	kfree(cmd);
+
+	return ret;
 }
 
 static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
@@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
 {
 	struct usb_device *usb = comedi_to_usb_dev(dev);
 	struct dt9812_private *devpriv = dev->private;
-	struct dt9812_usb_cmd cmd;
+	struct dt9812_usb_cmd *cmd;
 	int i, count;
+	int ret;
 
-	cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
-	cmd.u.rmw_multi_info.count = reg_count;
+	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+	if (!cmd)
+		return -ENOMEM;
+
+	cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
+	cmd->u.rmw_multi_info.count = reg_count;
 	for (i = 0; i < reg_count; i++)
-		cmd.u.rmw_multi_info.rmw[i] = rmw[i];
+		cmd->u.rmw_multi_info.rmw[i] = rmw[i];
 
 	/* DT9812 only responds to 32 byte writes!! */
-	return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
-			    &cmd, 32, &count, DT9812_USB_TIMEOUT);
+	ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
+			   cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
+	kfree(cmd);
+
+	return ret;
 }
 
 static int dt9812_digital_in(struct comedi_device *dev, u8 *bits)

From ef143dc0c3defe56730ecd3a9de7b3e1d7e557c1 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 27 Oct 2021 11:35:28 +0200
Subject: [PATCH 1144/1750] comedi: ni_usb6501: fix NULL-deref in command paths

commit 907767da8f3a925b060c740e0b5c92ea7dbec440 upstream.

The driver uses endpoint-sized USB transfer buffers but had no sanity
checks on the sizes. This can lead to zero-size-pointer dereferences or
overflowed transfer buffers in ni6501_port_command() and
ni6501_counter_command() if a (malicious) device has smaller max-packet
sizes than expected (or when doing descriptor fuzz testing).

Add the missing sanity checks to probe().

Fixes: a03bb00e50ab ("staging: comedi: add NI USB-6501 support")
Cc: stable@vger.kernel.org      # 3.18
Cc: Luca Ellero <luca.ellero@brickedbrain.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211027093529.30896-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/ni_usb6501.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
index 5b6d9d783b2f..c42987b74b1d 100644
--- a/drivers/staging/comedi/drivers/ni_usb6501.c
+++ b/drivers/staging/comedi/drivers/ni_usb6501.c
@@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[]	= {0x00, 0x01, 0x00, 0x10,
 					   0x00, 0x00, 0x00, 0x02,
 					   0x00, 0x00, 0x00, 0x00};
 
+/* Largest supported packets */
+static const size_t TX_MAX_SIZE	= sizeof(SET_PORT_DIR_REQUEST);
+static const size_t RX_MAX_SIZE	= sizeof(READ_PORT_RESPONSE);
+
 enum commands {
 	READ_PORT,
 	WRITE_PORT,
@@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev)
 	if (!devpriv->ep_rx || !devpriv->ep_tx)
 		return -ENODEV;
 
+	if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
+		return -ENODEV;
+
+	if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
+		return -ENODEV;
+
 	return 0;
 }
 

From 33d7a470730dfe7c9bfc8da84575cf2cedd60d00 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 13:45:30 +0200
Subject: [PATCH 1145/1750] comedi: vmk80xx: fix transfer-buffer overflows

commit a23461c47482fc232ffc9b819539d1f837adf2b1 upstream.

The driver uses endpoint-sized USB transfer buffers but up until
recently had no sanity checks on the sizes.

Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize
of usb endpoints found") inadvertently fixed NULL-pointer dereferences
when accessing the transfer buffers in case a malicious device has a
zero wMaxPacketSize.

Make sure to allocate buffers large enough to handle also the other
accesses that are done without a size check (e.g. byte 18 in
vmk80xx_cnt_insn_read() for the VMK8061_MODEL) to avoid writing beyond
the buffers, for example, when doing descriptor fuzzing.

The original driver was for a low-speed device with 8-byte buffers.
Support was later added for a device that uses bulk transfers and is
presumably a full-speed device with a maximum 64-byte wMaxPacketSize.

Fixes: 985cafccbf9b ("Staging: Comedi: vmk80xx: Add k8061 support")
Cc: stable@vger.kernel.org      # 2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20211025114532.4599-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/vmk80xx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 7956abcbae22..2787757cf75f 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -90,6 +90,8 @@ enum {
 #define IC3_VERSION		BIT(0)
 #define IC6_VERSION		BIT(1)
 
+#define MIN_BUF_SIZE		64
+
 enum vmk80xx_model {
 	VMK8055_MODEL,
 	VMK8061_MODEL
@@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
 	struct vmk80xx_private *devpriv = dev->private;
 	size_t size;
 
-	size = usb_endpoint_maxp(devpriv->ep_rx);
+	size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
 	devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL);
 	if (!devpriv->usb_rx_buf)
 		return -ENOMEM;
 
-	size = usb_endpoint_maxp(devpriv->ep_tx);
+	size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
 	devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
 	if (!devpriv->usb_tx_buf)
 		return -ENOMEM;

From b7fd7f3387f070215e6be341e68eb5c087eeecc0 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 13:45:31 +0200
Subject: [PATCH 1146/1750] comedi: vmk80xx: fix bulk-buffer overflow

commit 78cdfd62bd54af615fba9e3ca1ba35de39d3871d upstream.

The driver is using endpoint-sized buffers but must not assume that the
tx and rx buffers are of equal size or a malicious device could overflow
the slab-allocated receive buffer when doing bulk transfers.

Fixes: 985cafccbf9b ("Staging: Comedi: vmk80xx: Add k8061 support")
Cc: stable@vger.kernel.org      # 2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20211025114532.4599-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/vmk80xx.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 2787757cf75f..78c0383b8088 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -159,22 +159,20 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
 	__u8 rx_addr;
 	unsigned int tx_pipe;
 	unsigned int rx_pipe;
-	size_t size;
+	size_t tx_size;
+	size_t rx_size;
 
 	tx_addr = devpriv->ep_tx->bEndpointAddress;
 	rx_addr = devpriv->ep_rx->bEndpointAddress;
 	tx_pipe = usb_sndbulkpipe(usb, tx_addr);
 	rx_pipe = usb_rcvbulkpipe(usb, rx_addr);
-
-	/*
-	 * The max packet size attributes of the K8061
-	 * input/output endpoints are identical
-	 */
-	size = usb_endpoint_maxp(devpriv->ep_tx);
+	tx_size = usb_endpoint_maxp(devpriv->ep_tx);
+	rx_size = usb_endpoint_maxp(devpriv->ep_rx);
 
 	usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf,
-		     size, NULL, devpriv->ep_tx->bInterval);
-	usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10);
+		     tx_size, NULL, devpriv->ep_tx->bInterval);
+
+	usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, HZ * 10);
 }
 
 static int vmk80xx_read_packet(struct comedi_device *dev)

From 844b02496eaca61c3eb2e7430dfc25a06302bff3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 13:45:32 +0200
Subject: [PATCH 1147/1750] comedi: vmk80xx: fix bulk and interrupt message
 timeouts

commit a56d3e40bda460edf3f8d6aac00ec0b322b4ab83 upstream.

USB bulk and interrupt message timeouts are specified in milliseconds
and should specifically not vary with CONFIG_HZ.

Note that the bulk-out transfer timeout was set to the endpoint
bInterval value, which should be ignored for bulk endpoints and is
typically set to zero. This meant that a failing bulk-out transfer
would never time out.

Assume that the 10 second timeout used for all other transfers is more
than enough also for the bulk-out endpoint.

Fixes: 985cafccbf9b ("Staging: Comedi: vmk80xx: Add k8061 support")
Fixes: 951348b37738 ("staging: comedi: vmk80xx: wait for URBs to complete")
Cc: stable@vger.kernel.org      # 2.6.31
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20211025114532.4599-6-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/comedi/drivers/vmk80xx.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 78c0383b8088..7769eadfaf61 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -91,6 +91,7 @@ enum {
 #define IC6_VERSION		BIT(1)
 
 #define MIN_BUF_SIZE		64
+#define PACKET_TIMEOUT		10000	/* ms */
 
 enum vmk80xx_model {
 	VMK8055_MODEL,
@@ -169,10 +170,11 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
 	tx_size = usb_endpoint_maxp(devpriv->ep_tx);
 	rx_size = usb_endpoint_maxp(devpriv->ep_rx);
 
-	usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf,
-		     tx_size, NULL, devpriv->ep_tx->bInterval);
+	usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
+		     PACKET_TIMEOUT);
 
-	usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, HZ * 10);
+	usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
+		     PACKET_TIMEOUT);
 }
 
 static int vmk80xx_read_packet(struct comedi_device *dev)
@@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
 	pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
 	return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf,
 				 usb_endpoint_maxp(ep), NULL,
-				 HZ * 10);
+				 PACKET_TIMEOUT);
 }
 
 static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
@@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
 	pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
 	return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf,
 				 usb_endpoint_maxp(ep), NULL,
-				 HZ * 10);
+				 PACKET_TIMEOUT);
 }
 
 static int vmk80xx_reset_device(struct comedi_device *dev)

From 9963ba5b9d495d05bf32f37dc42d69afed46639b Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:09:10 +0200
Subject: [PATCH 1148/1750] staging: r8712u: fix control-message timeout

commit ce4940525f36ffdcf4fa623bcedab9c2a6db893a upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
Cc: stable@vger.kernel.org      # 2.6.37
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025120910.6339-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8712/usb_ops_linux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c
index 655497cead12..f984a5ab2c6f 100644
--- a/drivers/staging/rtl8712/usb_ops_linux.c
+++ b/drivers/staging/rtl8712/usb_ops_linux.c
@@ -494,7 +494,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
 		memcpy(pIo_buf, pdata, len);
 	}
 	status = usb_control_msg(udev, pipe, request, reqtype, value, index,
-				 pIo_buf, len, HZ / 2);
+				 pIo_buf, len, 500);
 	if (status > 0) {  /* Success this control transfer. */
 		if (requesttype == 0x01) {
 			/* For Control read transfer, we have to copy the read

From 1cf43e928954f5d511d3bb28c045ab430e9440a8 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:09:09 +0200
Subject: [PATCH 1149/1750] staging: rtl8192u: fix control-message timeouts

commit 4cfa36d312d6789448b59a7aae770ac8425017a3 upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging")
Cc: stable@vger.kernel.org      # 2.6.33
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025120910.6339-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8192u/r8192U_core.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index 4523e825a61a..7f90af8a7c7c 100644
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -229,7 +229,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data)
 
 	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 				 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
-				 indx | 0xfe00, 0, usbdata, 1, HZ / 2);
+				 indx | 0xfe00, 0, usbdata, 1, 500);
 	kfree(usbdata);
 
 	if (status < 0) {
@@ -251,7 +251,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data)
 
 	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 				 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
-				 indx | 0xfe00, 0, usbdata, 1, HZ / 2);
+				 indx | 0xfe00, 0, usbdata, 1, 500);
 	*data = *usbdata;
 	kfree(usbdata);
 
@@ -279,7 +279,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
 	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 				 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
 				 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
-				 usbdata, 1, HZ / 2);
+				 usbdata, 1, 500);
 	kfree(usbdata);
 
 	if (status < 0) {
@@ -305,7 +305,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data)
 	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 				 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
 				 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
-				 usbdata, 2, HZ / 2);
+				 usbdata, 2, 500);
 	kfree(usbdata);
 
 	if (status < 0) {
@@ -331,7 +331,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
 	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
 				 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
 				 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
-				 usbdata, 4, HZ / 2);
+				 usbdata, 4, 500);
 	kfree(usbdata);
 
 	if (status < 0) {
@@ -355,7 +355,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data)
 	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 				 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
 				 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
-				 usbdata, 1, HZ / 2);
+				 usbdata, 1, 500);
 	*data = *usbdata;
 	kfree(usbdata);
 
@@ -380,7 +380,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data)
 	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 				 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
 				 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
-				 usbdata, 2, HZ / 2);
+				 usbdata, 2, 500);
 	*data = *usbdata;
 	kfree(usbdata);
 
@@ -404,7 +404,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data)
 
 	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 				 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
-				 indx | 0xfe00, 0, usbdata, 2, HZ / 2);
+				 indx | 0xfe00, 0, usbdata, 2, 500);
 	*data = *usbdata;
 	kfree(usbdata);
 
@@ -430,7 +430,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data)
 	status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
 				 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
 				 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
-				 usbdata, 4, HZ / 2);
+				 usbdata, 4, 500);
 	*data = *usbdata;
 	kfree(usbdata);
 

From 8971158af1e0138bf0576c16f9aa153f151fb6b4 Mon Sep 17 00:00:00 2001
From: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Date: Tue, 10 Aug 2021 19:09:55 +0200
Subject: [PATCH 1150/1750] media: staging/intel-ipu3: css: Fix wrong size
 comparison imgu_css_fw_init

commit a44f9d6f9dc1fb314a3f1ed2dcd4fbbcc3d9f892 upstream.

There is a wrong comparison of the total size of the loaded firmware
css->fw->size with the size of a pointer to struct imgu_fw_header.

Turn binary_header into a flexible-array member[1][2], use the
struct_size() helper and fix the wrong size comparison. Notice
that the loaded firmware needs to contain at least one 'struct
imgu_fw_info' item in the binary_header[] array.

It's also worth mentioning that

	"css->fw->size < struct_size(css->fwp, binary_header, 1)"

with binary_header declared as a flexible-array member is equivalent
to

	"css->fw->size < sizeof(struct imgu_fw_header)"

with binary_header declared as a one-element array (as in the original
code).

The replacement of the one-element array with a flexible-array member
also helps with the ongoing efforts to globally enable -Warray-bounds
and get us closer to being able to tighten the FORTIFY_SOURCE routines
on memcpy().

[1] https://en.wikipedia.org/wiki/Flexible_array_member
[2] https://www.kernel.org/doc/html/v5.10/process/deprecated.html#zero-length-and-one-element-arrays

Link: https://github.com/KSPP/linux/issues/79
Link: https://github.com/KSPP/linux/issues/109

Fixes: 09d290f0ba21 ("media: staging/intel-ipu3: css: Add support for firmware management")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/media/ipu3/ipu3-css-fw.c | 7 +++----
 drivers/staging/media/ipu3/ipu3-css-fw.h | 2 +-
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.c b/drivers/staging/media/ipu3/ipu3-css-fw.c
index 45aff76198e2..981693eed815 100644
--- a/drivers/staging/media/ipu3/ipu3-css-fw.c
+++ b/drivers/staging/media/ipu3/ipu3-css-fw.c
@@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css)
 	/* Check and display fw header info */
 
 	css->fwp = (struct imgu_fw_header *)css->fw->data;
-	if (css->fw->size < sizeof(struct imgu_fw_header *) ||
+	if (css->fw->size < struct_size(css->fwp, binary_header, 1) ||
 	    css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h))
 		goto bad_fw;
-	if (sizeof(struct imgu_fw_bi_file_h) +
-	    css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) >
-	    css->fw->size)
+	if (struct_size(css->fwp, binary_header,
+			css->fwp->file_header.binary_nr) > css->fw->size)
 		goto bad_fw;
 
 	dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n",
diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.h b/drivers/staging/media/ipu3/ipu3-css-fw.h
index 79ffa7045139..650fd25fc79e 100644
--- a/drivers/staging/media/ipu3/ipu3-css-fw.h
+++ b/drivers/staging/media/ipu3/ipu3-css-fw.h
@@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h {
 
 struct imgu_fw_header {
 	struct imgu_fw_bi_file_h file_header;
-	struct imgu_fw_info binary_header[1];	/* binary_nr items */
+	struct imgu_fw_info binary_header[];	/* binary_nr items */
 };
 
 /******************* Firmware functions *******************/

From 62424fe4c2cf38f27c1eef66cbfa226ffe233e90 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:05:22 +0200
Subject: [PATCH 1151/1750] rsi: fix control-message timeout

commit 541fd20c3ce5b0bc39f0c6a52414b6b92416831c upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Use the common control-message timeout define for the five-second
timeout.

Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: stable@vger.kernel.org      # 3.15
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 3b13de59605e..983045ad79dc 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter,
 			      (void *)seg,
 			      (int)len,
 			      &transfer,
-			      HZ * 5);
+			      USB_CTRL_SET_TIMEOUT);
 
 	if (status < 0) {
 		rsi_dbg(ERR_ZONE,

From bd816c278316f20a5575debc64dde4422229a880 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 12 Nov 2021 14:58:35 +0100
Subject: [PATCH 1152/1750] Linux 5.10.79

Link: https://lore.kernel.org/r/20211110182002.964190708@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 288fb4839253..756479b101f8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 78
+SUBLEVEL = 79
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 87acf4924e1bb384226ef2e8bb6e090a5d51d733 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sat, 13 Nov 2021 14:37:26 +0100
Subject: [PATCH 1153/1750] ANDROID: GKI: fix up abi break in ehci code

Commit 94e5305a3816 ("usb: ehci: handshake CMD_RUN instead of STS_HALT")
that got added into 5.10.79, added a new bitfield to the struct ehci_hcd
structure.  This bitfield is only used by the ehci core, and does not
change the size of the structure overall at all, so comment it properly
so that the CRC of any ehci functions do not change, and update the .xml
file with the newly added bitfield:

Leaf changes summary: 1 artifact changed
Changed leaf types summary: 1 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 0 Added function
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 0 Added variable

'struct ehci_hcd at ehci.h:111:1' changed:
  type size hasn't changed
  1 data member insertion:
    'unsigned int is_aspeed', at offset 15 (in bits) at ehci.h:226:1
  one impacted interface

Bug: 161946584
Fixes: 94e5305a3816 ("usb: ehci: handshake CMD_RUN instead of STS_HALT")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id5d3a9324d9a15f8baaf4aefedda786ed6d949c2
---
 android/abi_gki_aarch64.xml | 299 ++++++++++++++++++------------------
 drivers/usb/host/ehci.h     |   6 +
 2 files changed, 157 insertions(+), 148 deletions(-)

diff --git a/android/abi_gki_aarch64.xml b/android/abi_gki_aarch64.xml
index 8720cb9c767e..0cde5a0ddf9e 100755
--- a/android/abi_gki_aarch64.xml
+++ b/android/abi_gki_aarch64.xml
@@ -6463,24 +6463,24 @@
         <enumerator name='SINK_DISCOVERY_BC12' value='3'/>
       </enum-decl>
       <pointer-type-def type-id='01d363ff' size-in-bits='64' id='014f3c9b'/>
-      <union-decl name='ehci_shadow' size-in-bits='64' visibility='default' filepath='drivers/usb/host/ehci.h' line='358' column='1' id='014fe25e'>
+      <union-decl name='ehci_shadow' size-in-bits='64' visibility='default' filepath='drivers/usb/host/ehci.h' line='365' column='1' id='014fe25e'>
         <data-member access='public'>
-          <var-decl name='qh' type-id='8b139582' visibility='default' filepath='drivers/usb/host/ehci.h' line='359' column='1'/>
+          <var-decl name='qh' type-id='8b139582' visibility='default' filepath='drivers/usb/host/ehci.h' line='366' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='itd' type-id='eff2bbc2' visibility='default' filepath='drivers/usb/host/ehci.h' line='360' column='1'/>
+          <var-decl name='itd' type-id='eff2bbc2' visibility='default' filepath='drivers/usb/host/ehci.h' line='367' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='sitd' type-id='bae724d1' visibility='default' filepath='drivers/usb/host/ehci.h' line='361' column='1'/>
+          <var-decl name='sitd' type-id='bae724d1' visibility='default' filepath='drivers/usb/host/ehci.h' line='368' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='fstn' type-id='7d78884e' visibility='default' filepath='drivers/usb/host/ehci.h' line='362' column='1'/>
+          <var-decl name='fstn' type-id='7d78884e' visibility='default' filepath='drivers/usb/host/ehci.h' line='369' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='hw_next' type-id='3e77f659' visibility='default' filepath='drivers/usb/host/ehci.h' line='363' column='1'/>
+          <var-decl name='hw_next' type-id='3e77f659' visibility='default' filepath='drivers/usb/host/ehci.h' line='370' column='1'/>
         </data-member>
         <data-member access='public'>
-          <var-decl name='ptr' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/host/ehci.h' line='364' column='1'/>
+          <var-decl name='ptr' type-id='eaa32e2f' visibility='default' filepath='drivers/usb/host/ehci.h' line='371' column='1'/>
         </data-member>
       </union-decl>
       <function-type size-in-bits='64' id='0156f9e6'>
@@ -22466,42 +22466,42 @@
           <var-decl name='sd3_curr_limit' type-id='f0981eeb' visibility='default' filepath='include/linux/mmc/card.h' line='180' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='ehci_itd' size-in-bits='1536' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='508' column='1' id='2a4c87c4'>
+      <class-decl name='ehci_itd' size-in-bits='1536' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='515' column='1' id='2a4c87c4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='510' column='1'/>
+          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='517' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='hw_transaction' type-id='e389acd5' visibility='default' filepath='drivers/usb/host/ehci.h' line='511' column='1'/>
+          <var-decl name='hw_transaction' type-id='e389acd5' visibility='default' filepath='drivers/usb/host/ehci.h' line='518' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='288'>
-          <var-decl name='hw_bufp' type-id='e369592a' visibility='default' filepath='drivers/usb/host/ehci.h' line='521' column='1'/>
+          <var-decl name='hw_bufp' type-id='e369592a' visibility='default' filepath='drivers/usb/host/ehci.h' line='528' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='hw_bufp_hi' type-id='e369592a' visibility='default' filepath='drivers/usb/host/ehci.h' line='522' column='1'/>
+          <var-decl name='hw_bufp_hi' type-id='e369592a' visibility='default' filepath='drivers/usb/host/ehci.h' line='529' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='itd_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='525' column='1'/>
+          <var-decl name='itd_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='532' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='itd_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='526' column='1'/>
+          <var-decl name='itd_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='533' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='urb' type-id='ab85b8f2' visibility='default' filepath='drivers/usb/host/ehci.h' line='528' column='1'/>
+          <var-decl name='urb' type-id='ab85b8f2' visibility='default' filepath='drivers/usb/host/ehci.h' line='535' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='stream' type-id='74ad1fb3' visibility='default' filepath='drivers/usb/host/ehci.h' line='529' column='1'/>
+          <var-decl name='stream' type-id='74ad1fb3' visibility='default' filepath='drivers/usb/host/ehci.h' line='536' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='itd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='530' column='1'/>
+          <var-decl name='itd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='537' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1152'>
-          <var-decl name='frame' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='533' column='1'/>
+          <var-decl name='frame' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='540' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1184'>
-          <var-decl name='pg' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='534' column='1'/>
+          <var-decl name='pg' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='541' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1216'>
-          <var-decl name='index' type-id='496104bf' visibility='default' filepath='drivers/usb/host/ehci.h' line='535' column='1'/>
+          <var-decl name='index' type-id='496104bf' visibility='default' filepath='drivers/usb/host/ehci.h' line='542' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='38d1cb6d' size-in-bits='64' id='2a5d0ea1'/>
@@ -33506,48 +33506,48 @@
           <var-decl name='android_kabi_reserved4' type-id='91ce1af9' visibility='default' filepath='include/linux/netdevice.h' line='637' column='1'/>
         </data-member>
       </class-decl>
-      <class-decl name='ehci_sitd' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='546' column='1' id='49addcd9'>
+      <class-decl name='ehci_sitd' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='553' column='1' id='49addcd9'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='548' column='1'/>
+          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='555' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='hw_fullspeed_ep' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='550' column='1'/>
+          <var-decl name='hw_fullspeed_ep' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='557' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='hw_uframe' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='551' column='1'/>
+          <var-decl name='hw_uframe' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='558' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='hw_results' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='552' column='1'/>
+          <var-decl name='hw_results' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='559' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='hw_buf' type-id='df700ea3' visibility='default' filepath='drivers/usb/host/ehci.h' line='566' column='1'/>
+          <var-decl name='hw_buf' type-id='df700ea3' visibility='default' filepath='drivers/usb/host/ehci.h' line='573' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='hw_backpointer' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='567' column='1'/>
+          <var-decl name='hw_backpointer' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='574' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='hw_buf_hi' type-id='df700ea3' visibility='default' filepath='drivers/usb/host/ehci.h' line='568' column='1'/>
+          <var-decl name='hw_buf_hi' type-id='df700ea3' visibility='default' filepath='drivers/usb/host/ehci.h' line='575' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='sitd_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='571' column='1'/>
+          <var-decl name='sitd_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='578' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='sitd_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='572' column='1'/>
+          <var-decl name='sitd_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='579' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='urb' type-id='ab85b8f2' visibility='default' filepath='drivers/usb/host/ehci.h' line='574' column='1'/>
+          <var-decl name='urb' type-id='ab85b8f2' visibility='default' filepath='drivers/usb/host/ehci.h' line='581' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='stream' type-id='74ad1fb3' visibility='default' filepath='drivers/usb/host/ehci.h' line='575' column='1'/>
+          <var-decl name='stream' type-id='74ad1fb3' visibility='default' filepath='drivers/usb/host/ehci.h' line='582' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='576'>
-          <var-decl name='sitd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='576' column='1'/>
+          <var-decl name='sitd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='583' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='frame' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='577' column='1'/>
+          <var-decl name='frame' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='584' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='736'>
-          <var-decl name='index' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='578' column='1'/>
+          <var-decl name='index' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='585' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='p_log' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/fs_context.h' line='76' column='1' id='49afbfba'>
@@ -34341,57 +34341,57 @@
         <parameter type-id='30864cdc'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='ehci_qh' size-in-bits='1152' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='404' column='1' id='4c1280d4'>
+      <class-decl name='ehci_qh' size-in-bits='1152' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='411' column='1' id='4c1280d4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw' type-id='a3740d42' visibility='default' filepath='drivers/usb/host/ehci.h' line='405' column='1'/>
+          <var-decl name='hw' type-id='a3740d42' visibility='default' filepath='drivers/usb/host/ehci.h' line='412' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='qh_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='407' column='1'/>
+          <var-decl name='qh_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='414' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='qh_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='408' column='1'/>
+          <var-decl name='qh_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='415' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='qtd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='409' column='1'/>
+          <var-decl name='qtd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='416' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='320'>
-          <var-decl name='intr_node' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='410' column='1'/>
+          <var-decl name='intr_node' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='417' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='dummy' type-id='251cfe5a' visibility='default' filepath='drivers/usb/host/ehci.h' line='411' column='1'/>
+          <var-decl name='dummy' type-id='251cfe5a' visibility='default' filepath='drivers/usb/host/ehci.h' line='418' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='unlink_node' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='412' column='1'/>
+          <var-decl name='unlink_node' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='419' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='ps' type-id='a60134e4' visibility='default' filepath='drivers/usb/host/ehci.h' line='413' column='1'/>
+          <var-decl name='ps' type-id='a60134e4' visibility='default' filepath='drivers/usb/host/ehci.h' line='420' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1024'>
-          <var-decl name='unlink_cycle' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='415' column='1'/>
+          <var-decl name='unlink_cycle' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='422' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1056'>
-          <var-decl name='qh_state' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='417' column='1'/>
+          <var-decl name='qh_state' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='424' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1064'>
-          <var-decl name='xacterrs' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='424' column='1'/>
+          <var-decl name='xacterrs' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='431' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1072'>
-          <var-decl name='unlink_reason' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='427' column='1'/>
+          <var-decl name='unlink_reason' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='434' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1080'>
-          <var-decl name='gap_uf' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='435' column='1'/>
+          <var-decl name='gap_uf' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='442' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='is_out' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='437' column='1'/>
+          <var-decl name='is_out' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='444' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='clearing_tt' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='438' column='1'/>
+          <var-decl name='clearing_tt' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='445' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='dequeue_during_giveback' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='439' column='1'/>
+          <var-decl name='dequeue_during_giveback' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='446' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='3'>
-          <var-decl name='should_be_inactive' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='440' column='1'/>
+          <var-decl name='should_be_inactive' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='447' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='4c1698f3'>
@@ -36451,33 +36451,33 @@
       </function-type>
       <typedef-decl name='efi_get_wakeup_time_t' type-id='39e463ea' filepath='include/linux/efi.h' line='236' column='1' id='50c6d8a2'/>
       <pointer-type-def type-id='d04e3bd9' size-in-bits='64' id='50c74428'/>
-      <class-decl name='ehci_qtd' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='287' column='1' id='50db3e2c'>
+      <class-decl name='ehci_qtd' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='294' column='1' id='50db3e2c'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='289' column='1'/>
+          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='296' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='hw_alt_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='290' column='1'/>
+          <var-decl name='hw_alt_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='297' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='hw_token' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='291' column='1'/>
+          <var-decl name='hw_token' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='298' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='hw_buf' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='310' column='1'/>
+          <var-decl name='hw_buf' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='317' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='hw_buf_hi' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='311' column='1'/>
+          <var-decl name='hw_buf_hi' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='318' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='448'>
-          <var-decl name='qtd_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='314' column='1'/>
+          <var-decl name='qtd_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='321' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='512'>
-          <var-decl name='qtd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='315' column='1'/>
+          <var-decl name='qtd_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='322' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='640'>
-          <var-decl name='urb' type-id='ab85b8f2' visibility='default' filepath='drivers/usb/host/ehci.h' line='316' column='1'/>
+          <var-decl name='urb' type-id='ab85b8f2' visibility='default' filepath='drivers/usb/host/ehci.h' line='323' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='704'>
-          <var-decl name='length' type-id='b59d7dce' visibility='default' filepath='drivers/usb/host/ehci.h' line='317' column='1'/>
+          <var-decl name='length' type-id='b59d7dce' visibility='default' filepath='drivers/usb/host/ehci.h' line='324' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='50e956a4'>
@@ -72646,32 +72646,35 @@
         <data-member access='public' layout-offset-in-bits='14'>
           <var-decl name='imx28_write_fix' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='220' column='1'/>
         </data-member>
+        <data-member access='public' layout-offset-in-bits='15'>
+          <var-decl name='is_aspeed' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='226' column='1'/>
+        </data-member>
         <data-member access='public' layout-offset-in-bits='5632'>
-          <var-decl name='ohci_hcctrl_reg' type-id='3e77f659' visibility='default' filepath='drivers/usb/host/ehci.h' line='229' column='1'/>
+          <var-decl name='ohci_hcctrl_reg' type-id='3e77f659' visibility='default' filepath='drivers/usb/host/ehci.h' line='236' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='has_hostpc' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='230' column='1'/>
+          <var-decl name='has_hostpc' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='237' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='1'>
-          <var-decl name='has_tdi_phy_lpm' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='231' column='1'/>
+          <var-decl name='has_tdi_phy_lpm' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='238' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='2'>
-          <var-decl name='has_ppcd' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='232' column='1'/>
+          <var-decl name='has_ppcd' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='239' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5704'>
-          <var-decl name='sbrn' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='233' column='1'/>
+          <var-decl name='sbrn' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='240' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='5712'>
-          <var-decl name='bandwidth' type-id='47ba3182' visibility='default' filepath='drivers/usb/host/ehci.h' line='251' column='1'/>
+          <var-decl name='bandwidth' type-id='47ba3182' visibility='default' filepath='drivers/usb/host/ehci.h' line='258' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6224'>
-          <var-decl name='tt_budget' type-id='47ba3182' visibility='default' filepath='drivers/usb/host/ehci.h' line='253' column='1'/>
+          <var-decl name='tt_budget' type-id='47ba3182' visibility='default' filepath='drivers/usb/host/ehci.h' line='260' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6784'>
-          <var-decl name='tt_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='255' column='1'/>
+          <var-decl name='tt_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='262' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='6912'>
-          <var-decl name='priv' type-id='c99b5ecd' visibility='default' filepath='drivers/usb/host/ehci.h' line='258' column='1'/>
+          <var-decl name='priv' type-id='c99b5ecd' visibility='default' filepath='drivers/usb/host/ehci.h' line='265' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='a7132e26'>
@@ -75314,51 +75317,51 @@
         <enumerator name='DRM_UNLOCKED' value='16'/>
         <enumerator name='DRM_RENDER_ALLOW' value='32'/>
       </enum-decl>
-      <class-decl name='ehci_iso_stream' size-in-bits='1024' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='470' column='1' id='ad57f193'>
+      <class-decl name='ehci_iso_stream' size-in-bits='1024' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='477' column='1' id='ad57f193'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw' type-id='a3740d42' visibility='default' filepath='drivers/usb/host/ehci.h' line='472' column='1'/>
+          <var-decl name='hw' type-id='a3740d42' visibility='default' filepath='drivers/usb/host/ehci.h' line='479' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='bEndpointAddress' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='474' column='1'/>
+          <var-decl name='bEndpointAddress' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='481' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='72'>
-          <var-decl name='highspeed' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='475' column='1'/>
+          <var-decl name='highspeed' type-id='f9b06939' visibility='default' filepath='drivers/usb/host/ehci.h' line='482' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='td_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='476' column='1'/>
+          <var-decl name='td_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='483' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='256'>
-          <var-decl name='free_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='477' column='1'/>
+          <var-decl name='free_list' type-id='72f469ec' visibility='default' filepath='drivers/usb/host/ehci.h' line='484' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='ps' type-id='a60134e4' visibility='default' filepath='drivers/usb/host/ehci.h' line='480' column='1'/>
+          <var-decl name='ps' type-id='a60134e4' visibility='default' filepath='drivers/usb/host/ehci.h' line='487' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='768'>
-          <var-decl name='next_uframe' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='481' column='1'/>
+          <var-decl name='next_uframe' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='488' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='800'>
-          <var-decl name='splits' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='482' column='1'/>
+          <var-decl name='splits' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='489' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='832'>
-          <var-decl name='uperiod' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/ehci.h' line='487' column='1'/>
+          <var-decl name='uperiod' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/ehci.h' line='494' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='848'>
-          <var-decl name='maxp' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/ehci.h' line='488' column='1'/>
+          <var-decl name='maxp' type-id='1dc6a898' visibility='default' filepath='drivers/usb/host/ehci.h' line='495' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='864'>
-          <var-decl name='bandwidth' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='489' column='1'/>
+          <var-decl name='bandwidth' type-id='f0981eeb' visibility='default' filepath='drivers/usb/host/ehci.h' line='496' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='896'>
-          <var-decl name='buf0' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='492' column='1'/>
+          <var-decl name='buf0' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='499' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='928'>
-          <var-decl name='buf1' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='493' column='1'/>
+          <var-decl name='buf1' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='500' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='960'>
-          <var-decl name='buf2' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='494' column='1'/>
+          <var-decl name='buf2' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='501' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='992'>
-          <var-decl name='address' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='497' column='1'/>
+          <var-decl name='address' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='504' column='1'/>
         </data-member>
       </class-decl>
       <class-decl name='bsg_buffer' size-in-bits='128' is-struct='yes' visibility='default' filepath='include/linux/bsg-lib.h' line='23' column='1' id='ad60a032'>
@@ -99742,33 +99745,33 @@
         <parameter type-id='4ea020ae'/>
         <return type-id='48b5725f'/>
       </function-type>
-      <class-decl name='ehci_qh_hw' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='378' column='1' id='e0f37aa4'>
+      <class-decl name='ehci_qh_hw' size-in-bits='768' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='385' column='1' id='e0f37aa4'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='379' column='1'/>
+          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='386' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='hw_info1' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='380' column='1'/>
+          <var-decl name='hw_info1' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='387' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='hw_info2' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='388' column='1'/>
+          <var-decl name='hw_info2' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='395' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='96'>
-          <var-decl name='hw_current' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='394' column='1'/>
+          <var-decl name='hw_current' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='401' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='hw_qtd_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='397' column='1'/>
+          <var-decl name='hw_qtd_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='404' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='160'>
-          <var-decl name='hw_alt_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='398' column='1'/>
+          <var-decl name='hw_alt_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='405' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='192'>
-          <var-decl name='hw_token' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='399' column='1'/>
+          <var-decl name='hw_token' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='406' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='224'>
-          <var-decl name='hw_buf' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='400' column='1'/>
+          <var-decl name='hw_buf' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='407' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='384'>
-          <var-decl name='hw_buf_hi' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='401' column='1'/>
+          <var-decl name='hw_buf_hi' type-id='9f6d6b4c' visibility='default' filepath='drivers/usb/host/ehci.h' line='408' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='e0f7a7a4'>
@@ -106794,15 +106797,15 @@
         </data-member>
       </class-decl>
       <type-decl name='unsigned int' size-in-bits='32' id='f0981eeb'/>
-      <class-decl name='ehci_driver_overrides' size-in-bits='192' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='872' column='1' id='f0985961'>
+      <class-decl name='ehci_driver_overrides' size-in-bits='192' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='879' column='1' id='f0985961'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='extra_priv_size' type-id='b59d7dce' visibility='default' filepath='drivers/usb/host/ehci.h' line='873' column='1'/>
+          <var-decl name='extra_priv_size' type-id='b59d7dce' visibility='default' filepath='drivers/usb/host/ehci.h' line='880' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='reset' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/ehci.h' line='874' column='1'/>
+          <var-decl name='reset' type-id='3d4f6569' visibility='default' filepath='drivers/usb/host/ehci.h' line='881' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='port_power' type-id='57938551' visibility='default' filepath='drivers/usb/host/ehci.h' line='875' column='1'/>
+          <var-decl name='port_power' type-id='57938551' visibility='default' filepath='drivers/usb/host/ehci.h' line='882' column='1'/>
         </data-member>
       </class-decl>
       <pointer-type-def type-id='415eecf1' size-in-bits='64' id='f0acc909'/>
@@ -111144,18 +111147,18 @@
         <parameter type-id='feb59272'/>
         <return type-id='95e97e5e'/>
       </function-type>
-      <class-decl name='ehci_fstn' size-in-bits='256' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='592' column='1' id='fc0d91e8'>
+      <class-decl name='ehci_fstn' size-in-bits='256' is-struct='yes' visibility='default' filepath='drivers/usb/host/ehci.h' line='599' column='1' id='fc0d91e8'>
         <data-member access='public' layout-offset-in-bits='0'>
-          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='593' column='1'/>
+          <var-decl name='hw_next' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='600' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='32'>
-          <var-decl name='hw_prev' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='594' column='1'/>
+          <var-decl name='hw_prev' type-id='2f162548' visibility='default' filepath='drivers/usb/host/ehci.h' line='601' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='64'>
-          <var-decl name='fstn_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='597' column='1'/>
+          <var-decl name='fstn_dma' type-id='cf29c9b3' visibility='default' filepath='drivers/usb/host/ehci.h' line='604' column='1'/>
         </data-member>
         <data-member access='public' layout-offset-in-bits='128'>
-          <var-decl name='fstn_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='598' column='1'/>
+          <var-decl name='fstn_next' type-id='014fe25e' visibility='default' filepath='drivers/usb/host/ehci.h' line='605' column='1'/>
         </data-member>
       </class-decl>
       <function-type size-in-bits='64' id='fc14a418'>
@@ -114048,8 +114051,8 @@
         <parameter type-id='1ea237a6' name='ws' filepath='drivers/base/power/wakeup.c' line='639' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='__printk_ratelimit' mangled-name='__printk_ratelimit' filepath='kernel/printk/printk.c' line='3127' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__printk_ratelimit'>
-        <parameter type-id='80f4b756' name='func' filepath='kernel/printk/printk.c' line='3127' column='1'/>
+      <function-decl name='__printk_ratelimit' mangled-name='__printk_ratelimit' filepath='kernel/printk/printk.c' line='3134' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__printk_ratelimit'>
+        <parameter type-id='80f4b756' name='func' filepath='kernel/printk/printk.c' line='3134' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='__pskb_copy_fclone' mangled-name='__pskb_copy_fclone' filepath='net/core/skbuff.c' line='1559' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='__pskb_copy_fclone'>
@@ -119371,19 +119374,19 @@
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='console_drivers' type-id='b9aa0100' mangled-name='console_drivers' visibility='default' filepath='kernel/printk/printk.c' line='90' column='1' elf-symbol-id='console_drivers'/>
-      <function-decl name='console_lock' mangled-name='console_lock' filepath='kernel/printk/printk.c' line='2351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_lock'>
+      <function-decl name='console_lock' mangled-name='console_lock' filepath='kernel/printk/printk.c' line='2358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_lock'>
         <return type-id='48b5725f'/>
       </function-decl>
       <var-decl name='console_printk' type-id='2020bac4' mangled-name='console_printk' visibility='default' filepath='kernel/printk/printk.c' line='66' column='1' elf-symbol-id='console_printk'/>
-      <function-decl name='console_stop' mangled-name='console_stop' filepath='kernel/printk/printk.c' line='2665' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_stop'>
-        <parameter type-id='b9aa0100' name='console' filepath='kernel/printk/printk.c' line='2665' column='1'/>
+      <function-decl name='console_stop' mangled-name='console_stop' filepath='kernel/printk/printk.c' line='2672' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_stop'>
+        <parameter type-id='b9aa0100' name='console' filepath='kernel/printk/printk.c' line='2672' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <var-decl name='console_suspend_enabled' type-id='b50a4934' mangled-name='console_suspend_enabled' visibility='default' filepath='kernel/printk/printk.c' line='2280' column='1' elf-symbol-id='console_suspend_enabled'/>
-      <function-decl name='console_trylock' mangled-name='console_trylock' filepath='kernel/printk/printk.c' line='2371' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_trylock'>
+      <var-decl name='console_suspend_enabled' type-id='b50a4934' mangled-name='console_suspend_enabled' visibility='default' filepath='kernel/printk/printk.c' line='2287' column='1' elf-symbol-id='console_suspend_enabled'/>
+      <function-decl name='console_trylock' mangled-name='console_trylock' filepath='kernel/printk/printk.c' line='2378' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_trylock'>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='console_unlock' mangled-name='console_unlock' filepath='kernel/printk/printk.c' line='2433' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_unlock'>
+      <function-decl name='console_unlock' mangled-name='console_unlock' filepath='kernel/printk/printk.c' line='2440' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='console_unlock'>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='consume_skb' mangled-name='consume_skb' filepath='net/core/skbuff.c' line='845' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='consume_skb'>
@@ -125397,13 +125400,13 @@
         <parameter type-id='1dc6a898' name='wLength' filepath='drivers/usb/host/ehci-hub.c' line='876' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='ehci_init_driver' mangled-name='ehci_init_driver' filepath='drivers/usb/host/ehci-hcd.c' line='1260' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ehci_init_driver'>
-        <parameter type-id='c07d5ba3' name='drv' filepath='drivers/usb/host/ehci-hcd.c' line='1260' column='1'/>
-        <parameter type-id='843888b8' name='over' filepath='drivers/usb/host/ehci-hcd.c' line='1261' column='1'/>
+      <function-decl name='ehci_init_driver' mangled-name='ehci_init_driver' filepath='drivers/usb/host/ehci-hcd.c' line='1269' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ehci_init_driver'>
+        <parameter type-id='c07d5ba3' name='drv' filepath='drivers/usb/host/ehci-hcd.c' line='1269' column='1'/>
+        <parameter type-id='843888b8' name='over' filepath='drivers/usb/host/ehci-hcd.c' line='1270' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='ehci_setup' mangled-name='ehci_setup' filepath='drivers/usb/host/ehci-hcd.c' line='669' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ehci_setup'>
-        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/ehci-hcd.c' line='669' column='1'/>
+      <function-decl name='ehci_setup' mangled-name='ehci_setup' filepath='drivers/usb/host/ehci-hcd.c' line='678' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='ehci_setup'>
+        <parameter type-id='fc4f83c1' name='hcd' filepath='drivers/usb/host/ehci-hcd.c' line='678' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='elevator_alloc' mangled-name='elevator_alloc' filepath='block/elevator.c' line='164' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='elevator_alloc'>
@@ -128625,7 +128628,7 @@
         <parameter type-id='44bef697' name='work' filepath='kernel/irq_work.c' line='197' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='is_console_locked' mangled-name='is_console_locked' filepath='kernel/printk/printk.c' line='2385' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_console_locked'>
+      <function-decl name='is_console_locked' mangled-name='is_console_locked' filepath='kernel/printk/printk.c' line='2392' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_console_locked'>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='is_dma_buf_file' mangled-name='is_dma_buf_file' filepath='drivers/dma-buf/dma-buf.c' line='491' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='is_dma_buf_file'>
@@ -128958,32 +128961,32 @@
         <parameter type-id='3eb7c31c' name='gfp' filepath='mm/util.c' line='147' column='1'/>
         <return type-id='26a90f95'/>
       </function-decl>
-      <function-decl name='kmsg_dump_get_buffer' mangled-name='kmsg_dump_get_buffer' filepath='kernel/printk/printk.c' line='3384' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_get_buffer'>
-        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3384' column='1'/>
-        <parameter type-id='b50a4934' name='syslog' filepath='kernel/printk/printk.c' line='3384' column='1'/>
-        <parameter type-id='26a90f95' name='buf' filepath='kernel/printk/printk.c' line='3385' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='kernel/printk/printk.c' line='3385' column='1'/>
-        <parameter type-id='78c01427' name='len' filepath='kernel/printk/printk.c' line='3385' column='1'/>
+      <function-decl name='kmsg_dump_get_buffer' mangled-name='kmsg_dump_get_buffer' filepath='kernel/printk/printk.c' line='3391' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_get_buffer'>
+        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3391' column='1'/>
+        <parameter type-id='b50a4934' name='syslog' filepath='kernel/printk/printk.c' line='3391' column='1'/>
+        <parameter type-id='26a90f95' name='buf' filepath='kernel/printk/printk.c' line='3392' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='kernel/printk/printk.c' line='3392' column='1'/>
+        <parameter type-id='78c01427' name='len' filepath='kernel/printk/printk.c' line='3392' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='kmsg_dump_get_line' mangled-name='kmsg_dump_get_line' filepath='kernel/printk/printk.c' line='3351' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_get_line'>
-        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3351' column='1'/>
-        <parameter type-id='b50a4934' name='syslog' filepath='kernel/printk/printk.c' line='3351' column='1'/>
-        <parameter type-id='26a90f95' name='line' filepath='kernel/printk/printk.c' line='3352' column='1'/>
-        <parameter type-id='b59d7dce' name='size' filepath='kernel/printk/printk.c' line='3352' column='1'/>
-        <parameter type-id='78c01427' name='len' filepath='kernel/printk/printk.c' line='3352' column='1'/>
+      <function-decl name='kmsg_dump_get_line' mangled-name='kmsg_dump_get_line' filepath='kernel/printk/printk.c' line='3358' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_get_line'>
+        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3358' column='1'/>
+        <parameter type-id='b50a4934' name='syslog' filepath='kernel/printk/printk.c' line='3358' column='1'/>
+        <parameter type-id='26a90f95' name='line' filepath='kernel/printk/printk.c' line='3359' column='1'/>
+        <parameter type-id='b59d7dce' name='size' filepath='kernel/printk/printk.c' line='3359' column='1'/>
+        <parameter type-id='78c01427' name='len' filepath='kernel/printk/printk.c' line='3359' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
-      <function-decl name='kmsg_dump_register' mangled-name='kmsg_dump_register' filepath='kernel/printk/printk.c' line='3166' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_register'>
-        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3166' column='1'/>
+      <function-decl name='kmsg_dump_register' mangled-name='kmsg_dump_register' filepath='kernel/printk/printk.c' line='3173' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_register'>
+        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3173' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='kmsg_dump_rewind' mangled-name='kmsg_dump_rewind' filepath='kernel/printk/printk.c' line='3486' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_rewind'>
-        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3486' column='1'/>
+      <function-decl name='kmsg_dump_rewind' mangled-name='kmsg_dump_rewind' filepath='kernel/printk/printk.c' line='3493' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_rewind'>
+        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3493' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='kmsg_dump_unregister' mangled-name='kmsg_dump_unregister' filepath='kernel/printk/printk.c' line='3195' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_unregister'>
-        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3195' column='1'/>
+      <function-decl name='kmsg_dump_unregister' mangled-name='kmsg_dump_unregister' filepath='kernel/printk/printk.c' line='3202' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='kmsg_dump_unregister'>
+        <parameter type-id='a83d0951' name='dumper' filepath='kernel/printk/printk.c' line='3202' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <var-decl name='kobj_sysfs_ops' type-id='0f840455' mangled-name='kobj_sysfs_ops' visibility='default' filepath='lib/kobject.c' line='860' column='1' elf-symbol-id='kobj_sysfs_ops'/>
@@ -133653,14 +133656,14 @@
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='printk_deferred' mangled-name='printk_deferred' filepath='kernel/printk/printk.c' line='3106' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk_deferred'>
-        <parameter type-id='80f4b756' name='fmt' filepath='kernel/printk/printk.c' line='3106' column='1'/>
+      <function-decl name='printk_deferred' mangled-name='printk_deferred' filepath='kernel/printk/printk.c' line='3113' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk_deferred'>
+        <parameter type-id='80f4b756' name='fmt' filepath='kernel/printk/printk.c' line='3113' column='1'/>
         <parameter is-variadic='yes'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='printk_timed_ratelimit' mangled-name='printk_timed_ratelimit' filepath='kernel/printk/printk.c' line='3142' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk_timed_ratelimit'>
-        <parameter type-id='1d2c2b85' name='caller_jiffies' filepath='kernel/printk/printk.c' line='3142' column='1'/>
-        <parameter type-id='f0981eeb' name='interval_msecs' filepath='kernel/printk/printk.c' line='3143' column='1'/>
+      <function-decl name='printk_timed_ratelimit' mangled-name='printk_timed_ratelimit' filepath='kernel/printk/printk.c' line='3149' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='printk_timed_ratelimit'>
+        <parameter type-id='1d2c2b85' name='caller_jiffies' filepath='kernel/printk/printk.c' line='3149' column='1'/>
+        <parameter type-id='f0981eeb' name='interval_msecs' filepath='kernel/printk/printk.c' line='3150' column='1'/>
         <return type-id='b50a4934'/>
       </function-decl>
       <function-decl name='proc_create' mangled-name='proc_create' filepath='fs/proc/generic.c' line='584' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='proc_create'>
@@ -134244,8 +134247,8 @@
         <parameter type-id='80f4b756' name='name' filepath='fs/char_dev.c' line='200' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
-      <function-decl name='register_console' mangled-name='register_console' filepath='kernel/printk/printk.c' line='2769' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_console'>
-        <parameter type-id='b9aa0100' name='newcon' filepath='kernel/printk/printk.c' line='2769' column='1'/>
+      <function-decl name='register_console' mangled-name='register_console' filepath='kernel/printk/printk.c' line='2776' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_console'>
+        <parameter type-id='b9aa0100' name='newcon' filepath='kernel/printk/printk.c' line='2776' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
       <function-decl name='register_die_notifier' mangled-name='register_die_notifier' filepath='kernel/notifier.c' line='552' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='register_die_notifier'>
@@ -140055,8 +140058,8 @@
         <parameter type-id='f0981eeb' name='count' filepath='fs/char_dev.c' line='311' column='1'/>
         <return type-id='48b5725f'/>
       </function-decl>
-      <function-decl name='unregister_console' mangled-name='unregister_console' filepath='kernel/printk/printk.c' line='2905' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_console'>
-        <parameter type-id='b9aa0100' name='console' filepath='kernel/printk/printk.c' line='2905' column='1'/>
+      <function-decl name='unregister_console' mangled-name='unregister_console' filepath='kernel/printk/printk.c' line='2912' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_console'>
+        <parameter type-id='b9aa0100' name='console' filepath='kernel/printk/printk.c' line='2912' column='1'/>
         <return type-id='95e97e5e'/>
       </function-decl>
       <function-decl name='unregister_die_notifier' mangled-name='unregister_die_notifier' filepath='kernel/notifier.c' line='558' column='1' visibility='default' binding='global' size-in-bits='64' elf-symbol-id='unregister_die_notifier'>
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 59fd523c55f3..55e517248af7 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -218,7 +218,13 @@ struct ehci_hcd {			/* one per controller */
 	unsigned		frame_index_bug:1; /* MosChip (AKA NetMos) */
 	unsigned		need_oc_pp_cycle:1; /* MPC834X port power */
 	unsigned		imx28_write_fix:1; /* For Freescale i.MX28 */
+	/*
+	 * __GENKSYMS__ test is an abi workaround for commit
+	 * 7f2d73788d90 ("usb: ehci: handshake CMD_RUN * instead of STS_HALT")
+	 */
+#ifndef __GENKSYMS__
 	unsigned		is_aspeed:1;
+#endif
 
 	/* required for usb32 quirk */
 	#define OHCI_CTRL_HCFS          (3 << 6)

From ff32302687fdb7b6b49393d6feecdbe73607b506 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Fri, 5 Nov 2021 18:00:36 +0200
Subject: [PATCH 1154/1750] xhci: Fix USB 3.1 enumeration issues by increasing
 roothub power-on-good delay

commit e1959faf085b004e6c3afaaaa743381f00e7c015 upstream.

Some USB 3.1 enumeration issues were reported after the hub driver removed
the minimum 100ms limit for the power-on-good delay.

Since commit 90d28fb53d4a ("usb: core: reduce power-on-good delay time of
root hub") the hub driver sets the power-on-delay based on the
bPwrOn2PwrGood value in the hub descriptor.

xhci driver has a 20ms bPwrOn2PwrGood value for both roothubs based
on xhci spec section 5.4.8, but it's clearly not enough for the
USB 3.1 devices, causing enumeration issues.

Tests indicate full 100ms delay is needed.

Reported-by: Walt Jr. Brake <mr.yming81@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Fixes: 90d28fb53d4a ("usb: core: reduce power-on-good delay time of root hub")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211105160036.549516-1-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-hub.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 8466527eb246..41d5a46c1dc1 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -171,7 +171,6 @@ static void xhci_common_hub_descriptor(struct xhci_hcd *xhci,
 {
 	u16 temp;
 
-	desc->bPwrOn2PwrGood = 10;	/* xhci section 5.4.9 says 20ms max */
 	desc->bHubContrCurrent = 0;
 
 	desc->bNbrPorts = ports;
@@ -206,6 +205,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
 	desc->bDescriptorType = USB_DT_HUB;
 	temp = 1 + (ports / 8);
 	desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * temp;
+	desc->bPwrOn2PwrGood = 10;	/* xhci section 5.4.8 says 20ms */
 
 	/* The Device Removable bits are reported on a byte granularity.
 	 * If the port doesn't exist within that byte, the bit is set to 0.
@@ -258,6 +258,7 @@ static void xhci_usb3_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
 	xhci_common_hub_descriptor(xhci, desc, ports);
 	desc->bDescriptorType = USB_DT_SS_HUB;
 	desc->bDescLength = USB_DT_SS_HUB_SIZE;
+	desc->bPwrOn2PwrGood = 50;	/* usb 3.1 may fail if less than 100ms */
 
 	/* header decode latency should be zero for roothubs,
 	 * see section 4.23.5.2.

From 7f1d5a1a7d80175f9a1af6b00aa7415c5ba08290 Mon Sep 17 00:00:00 2001
From: Nehal Bakulchandra Shah <Nehal-Bakulchandra.shah@amd.com>
Date: Thu, 14 Oct 2021 15:12:00 +0300
Subject: [PATCH 1155/1750] usb: xhci: Enable runtime-pm by default on AMD
 Yellow Carp platform

commit 660a92a59b9e831a0407e41ff62875656d30006e upstream.

AMD's Yellow Carp platform supports runtime power management for
XHCI Controllers, so enable the same by default for all XHCI Controllers.

[ regrouped and aligned the PCI_DEVICE_ID definitions -Mathias]

Cc: stable <stable@vger.kernel.org>
Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Reviewed-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Signed-off-by: Nehal Bakulchandra Shah <Nehal-Bakulchandra.shah@amd.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211014121200.75433-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci-pci.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 8c65e9476b41..80251a2579fd 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -64,6 +64,13 @@
 #define PCI_DEVICE_ID_AMD_PROMONTORYA_3			0x43ba
 #define PCI_DEVICE_ID_AMD_PROMONTORYA_2			0x43bb
 #define PCI_DEVICE_ID_AMD_PROMONTORYA_1			0x43bc
+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_1		0x161a
+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_2		0x161b
+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_3		0x161d
+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4		0x161e
+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5		0x15d6
+#define PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6		0x15d7
+
 #define PCI_DEVICE_ID_ASMEDIA_1042_XHCI			0x1042
 #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI		0x1142
 #define PCI_DEVICE_ID_ASMEDIA_1142_XHCI			0x1242
@@ -312,6 +319,15 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
 	     pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4))
 		xhci->quirks |= XHCI_NO_SOFT_RETRY;
 
+	if (pdev->vendor == PCI_VENDOR_ID_AMD &&
+	    (pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_1 ||
+	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_2 ||
+	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_3 ||
+	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_4 ||
+	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_5 ||
+	    pdev->device == PCI_DEVICE_ID_AMD_YELLOW_CARP_XHCI_6))
+		xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW;
+
 	if (xhci->quirks & XHCI_RESET_ON_RESUME)
 		xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
 				"QUIRK: Resetting on resume");

From bd9cea41ac6e08f615030dea28b23e12b7a2674f Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos@google.com>
Date: Wed, 10 Nov 2021 15:00:34 -0800
Subject: [PATCH 1156/1750] binder: use euid from cred instead of using task

commit 29bc22ac5e5bc63275e850f0c8fc549e3d0e306b upstream.

Save the 'struct cred' associated with a binder process
at initial open to avoid potential race conditions
when converting to an euid.

Set a transaction's sender_euid from the 'struct cred'
saved at binder_open() instead of looking up the euid
from the binder proc's 'struct task'. This ensures
the euid is associated with the security context that
of the task that opened binder.

Cc: stable@vger.kernel.org # 4.4+
Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
Signed-off-by: Todd Kjos <tkjos@google.com>
Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Suggested-by: Jann Horn <jannh@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d9977ce0be76..b45d33c5bcdb 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -420,6 +420,9 @@ enum binder_deferred_state {
  *                        (invariant after initialized)
  * @tsk                   task_struct for group_leader of process
  *                        (invariant after initialized)
+ * @cred                  struct cred associated with the `struct file`
+ *                        in binder_open()
+ *                        (invariant after initialized)
  * @deferred_work_node:   element for binder_deferred_list
  *                        (protected by binder_deferred_lock)
  * @deferred_work:        bitmap of deferred work to perform
@@ -465,6 +468,7 @@ struct binder_proc {
 	struct list_head waiting_threads;
 	int pid;
 	struct task_struct *tsk;
+	const struct cred *cred;
 	struct hlist_node deferred_work_node;
 	int deferred_work;
 	bool is_dead;
@@ -3087,7 +3091,7 @@ static void binder_transaction(struct binder_proc *proc,
 		t->from = thread;
 	else
 		t->from = NULL;
-	t->sender_euid = task_euid(proc->tsk);
+	t->sender_euid = proc->cred->euid;
 	t->to_proc = target_proc;
 	t->to_thread = target_thread;
 	t->code = tr->code;
@@ -4703,6 +4707,7 @@ static void binder_free_proc(struct binder_proc *proc)
 	}
 	binder_alloc_deferred_release(&proc->alloc);
 	put_task_struct(proc->tsk);
+	put_cred(proc->cred);
 	binder_stats_deleted(BINDER_STAT_PROC);
 	kfree(proc);
 }
@@ -5220,6 +5225,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
 	spin_lock_init(&proc->outer_lock);
 	get_task_struct(current->group_leader);
 	proc->tsk = current->group_leader;
+	proc->cred = get_cred(filp->f_cred);
 	INIT_LIST_HEAD(&proc->todo);
 	proc->default_priority = task_nice(current);
 	/* binderfs stashes devices in i_private */

From 0d9f4ae7cd6f5283dd0e343265268c695ef592b0 Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos@google.com>
Date: Wed, 10 Nov 2021 15:00:35 -0800
Subject: [PATCH 1157/1750] binder: use cred instead of task for selinux checks

commit 52f88693378a58094c538662ba652aff0253c4fe upstream.

Since binder was integrated with selinux, it has passed
'struct task_struct' associated with the binder_proc
to represent the source and target of transactions.
The conversion of task to SID was then done in the hook
implementations. It turns out that there are race conditions
which can result in an incorrect security context being used.

Fix by using the 'struct cred' saved during binder_open and pass
it to the selinux subsystem.

Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables)
Fixes: 79af73079d75 ("Add security hooks to binder and implement the hooks for SELinux.")
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c      | 12 ++++++------
 include/linux/lsm_hook_defs.h | 14 +++++++-------
 include/linux/lsm_hooks.h     | 14 +++++++-------
 include/linux/security.h      | 28 +++++++++++++--------------
 security/security.c           | 14 +++++++-------
 security/selinux/hooks.c      | 36 +++++++++++++++--------------------
 6 files changed, 56 insertions(+), 62 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index b45d33c5bcdb..5a9df224b001 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2443,7 +2443,7 @@ static int binder_translate_binder(struct flat_binder_object *fp,
 		ret = -EINVAL;
 		goto done;
 	}
-	if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
+	if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
 		ret = -EPERM;
 		goto done;
 	}
@@ -2489,7 +2489,7 @@ static int binder_translate_handle(struct flat_binder_object *fp,
 				  proc->pid, thread->pid, fp->handle);
 		return -EINVAL;
 	}
-	if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
+	if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
 		ret = -EPERM;
 		goto done;
 	}
@@ -2577,7 +2577,7 @@ static int binder_translate_fd(u32 fd, binder_size_t fd_offset,
 		ret = -EBADF;
 		goto err_fget;
 	}
-	ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
+	ret = security_binder_transfer_file(proc->cred, target_proc->cred, file);
 	if (ret < 0) {
 		ret = -EPERM;
 		goto err_security;
@@ -2975,8 +2975,8 @@ static void binder_transaction(struct binder_proc *proc,
 			return_error_line = __LINE__;
 			goto err_invalid_target_handle;
 		}
-		if (security_binder_transaction(proc->tsk,
-						target_proc->tsk) < 0) {
+		if (security_binder_transaction(proc->cred,
+						target_proc->cred) < 0) {
 			return_error = BR_FAILED_REPLY;
 			return_error_param = -EPERM;
 			return_error_line = __LINE__;
@@ -4918,7 +4918,7 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp,
 		ret = -EBUSY;
 		goto out;
 	}
-	ret = security_binder_set_context_mgr(proc->tsk);
+	ret = security_binder_set_context_mgr(proc->cred);
 	if (ret < 0)
 		goto out;
 	if (uid_valid(context->binder_context_mgr_uid)) {
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index 32a940117e7a..a6a3d4ddfc2d 100644
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -26,13 +26,13 @@
  *   #undef LSM_HOOK
  * };
  */
-LSM_HOOK(int, 0, binder_set_context_mgr, struct task_struct *mgr)
-LSM_HOOK(int, 0, binder_transaction, struct task_struct *from,
-	 struct task_struct *to)
-LSM_HOOK(int, 0, binder_transfer_binder, struct task_struct *from,
-	 struct task_struct *to)
-LSM_HOOK(int, 0, binder_transfer_file, struct task_struct *from,
-	 struct task_struct *to, struct file *file)
+LSM_HOOK(int, 0, binder_set_context_mgr, const struct cred *mgr)
+LSM_HOOK(int, 0, binder_transaction, const struct cred *from,
+	 const struct cred *to)
+LSM_HOOK(int, 0, binder_transfer_binder, const struct cred *from,
+	 const struct cred *to)
+LSM_HOOK(int, 0, binder_transfer_file, const struct cred *from,
+	 const struct cred *to, struct file *file)
 LSM_HOOK(int, 0, ptrace_access_check, struct task_struct *child,
 	 unsigned int mode)
 LSM_HOOK(int, 0, ptrace_traceme, struct task_struct *parent)
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index c503f7ab8afb..a8531b37e6f5 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -1288,22 +1288,22 @@
  *
  * @binder_set_context_mgr:
  *	Check whether @mgr is allowed to be the binder context manager.
- *	@mgr contains the task_struct for the task being registered.
+ *	@mgr contains the struct cred for the current binder process.
  *	Return 0 if permission is granted.
  * @binder_transaction:
  *	Check whether @from is allowed to invoke a binder transaction call
  *	to @to.
- *	@from contains the task_struct for the sending task.
- *	@to contains the task_struct for the receiving task.
+ *	@from contains the struct cred for the sending process.
+ *	@to contains the struct cred for the receiving process.
  * @binder_transfer_binder:
  *	Check whether @from is allowed to transfer a binder reference to @to.
- *	@from contains the task_struct for the sending task.
- *	@to contains the task_struct for the receiving task.
+ *	@from contains the struct cred for the sending process.
+ *	@to contains the struct cred for the receiving process.
  * @binder_transfer_file:
  *	Check whether @from is allowed to transfer @file to @to.
- *	@from contains the task_struct for the sending task.
+ *	@from contains the struct cred for the sending process.
  *	@file contains the struct file being transferred.
- *	@to contains the task_struct for the receiving task.
+ *	@to contains the struct cred for the receiving process.
  *
  * @ptrace_access_check:
  *	Check permission before allowing the current process to trace the
diff --git a/include/linux/security.h b/include/linux/security.h
index 7ef74d01b8e7..e67cc8c40865 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -254,13 +254,13 @@ extern int security_init(void);
 extern int early_security_init(void);
 
 /* Security operations */
-int security_binder_set_context_mgr(struct task_struct *mgr);
-int security_binder_transaction(struct task_struct *from,
-				struct task_struct *to);
-int security_binder_transfer_binder(struct task_struct *from,
-				    struct task_struct *to);
-int security_binder_transfer_file(struct task_struct *from,
-				  struct task_struct *to, struct file *file);
+int security_binder_set_context_mgr(const struct cred *mgr);
+int security_binder_transaction(const struct cred *from,
+				const struct cred *to);
+int security_binder_transfer_binder(const struct cred *from,
+				    const struct cred *to);
+int security_binder_transfer_file(const struct cred *from,
+				  const struct cred *to, struct file *file);
 int security_ptrace_access_check(struct task_struct *child, unsigned int mode);
 int security_ptrace_traceme(struct task_struct *parent);
 int security_capget(struct task_struct *target,
@@ -493,25 +493,25 @@ static inline int early_security_init(void)
 	return 0;
 }
 
-static inline int security_binder_set_context_mgr(struct task_struct *mgr)
+static inline int security_binder_set_context_mgr(const struct cred *mgr)
 {
 	return 0;
 }
 
-static inline int security_binder_transaction(struct task_struct *from,
-					      struct task_struct *to)
+static inline int security_binder_transaction(const struct cred *from,
+					      const struct cred *to)
 {
 	return 0;
 }
 
-static inline int security_binder_transfer_binder(struct task_struct *from,
-						  struct task_struct *to)
+static inline int security_binder_transfer_binder(const struct cred *from,
+						  const struct cred *to)
 {
 	return 0;
 }
 
-static inline int security_binder_transfer_file(struct task_struct *from,
-						struct task_struct *to,
+static inline int security_binder_transfer_file(const struct cred *from,
+						const struct cred *to,
 						struct file *file)
 {
 	return 0;
diff --git a/security/security.c b/security/security.c
index 1c696bce8e1c..a864ff824dd3 100644
--- a/security/security.c
+++ b/security/security.c
@@ -723,25 +723,25 @@ static void __init lsm_early_task(struct task_struct *task)
 
 /* Security operations */
 
-int security_binder_set_context_mgr(struct task_struct *mgr)
+int security_binder_set_context_mgr(const struct cred *mgr)
 {
 	return call_int_hook(binder_set_context_mgr, 0, mgr);
 }
 
-int security_binder_transaction(struct task_struct *from,
-				struct task_struct *to)
+int security_binder_transaction(const struct cred *from,
+				const struct cred *to)
 {
 	return call_int_hook(binder_transaction, 0, from, to);
 }
 
-int security_binder_transfer_binder(struct task_struct *from,
-				    struct task_struct *to)
+int security_binder_transfer_binder(const struct cred *from,
+				    const struct cred *to)
 {
 	return call_int_hook(binder_transfer_binder, 0, from, to);
 }
 
-int security_binder_transfer_file(struct task_struct *from,
-				  struct task_struct *to, struct file *file)
+int security_binder_transfer_file(const struct cred *from,
+				  const struct cred *to, struct file *file)
 {
 	return call_int_hook(binder_transfer_file, 0, from, to, file);
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 227eb8967963..f32026bc96b4 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2004,22 +2004,19 @@ static inline u32 open_file_to_av(struct file *file)
 
 /* Hook functions begin here. */
 
-static int selinux_binder_set_context_mgr(struct task_struct *mgr)
+static int selinux_binder_set_context_mgr(const struct cred *mgr)
 {
-	u32 mysid = current_sid();
-	u32 mgrsid = task_sid(mgr);
-
 	return avc_has_perm(&selinux_state,
-			    mysid, mgrsid, SECCLASS_BINDER,
+			    current_sid(), cred_sid(mgr), SECCLASS_BINDER,
 			    BINDER__SET_CONTEXT_MGR, NULL);
 }
 
-static int selinux_binder_transaction(struct task_struct *from,
-				      struct task_struct *to)
+static int selinux_binder_transaction(const struct cred *from,
+				      const struct cred *to)
 {
 	u32 mysid = current_sid();
-	u32 fromsid = task_sid(from);
-	u32 tosid = task_sid(to);
+	u32 fromsid = cred_sid(from);
+	u32 tosid = cred_sid(to);
 	int rc;
 
 	if (mysid != fromsid) {
@@ -2030,27 +2027,24 @@ static int selinux_binder_transaction(struct task_struct *from,
 			return rc;
 	}
 
-	return avc_has_perm(&selinux_state,
-			    fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
-			    NULL);
+	return avc_has_perm(&selinux_state, fromsid, tosid,
+			    SECCLASS_BINDER, BINDER__CALL, NULL);
 }
 
-static int selinux_binder_transfer_binder(struct task_struct *from,
-					  struct task_struct *to)
+static int selinux_binder_transfer_binder(const struct cred *from,
+					  const struct cred *to)
 {
-	u32 fromsid = task_sid(from);
-	u32 tosid = task_sid(to);
-
 	return avc_has_perm(&selinux_state,
-			    fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
+			    cred_sid(from), cred_sid(to),
+			    SECCLASS_BINDER, BINDER__TRANSFER,
 			    NULL);
 }
 
-static int selinux_binder_transfer_file(struct task_struct *from,
-					struct task_struct *to,
+static int selinux_binder_transfer_file(const struct cred *from,
+					const struct cred *to,
 					struct file *file)
 {
-	u32 sid = task_sid(to);
+	u32 sid = cred_sid(to);
 	struct file_security_struct *fsec = selinux_file(file);
 	struct dentry *dentry = file->f_path.dentry;
 	struct inode_security_struct *isec;

From afbec52fbce006a775edb21f87ccae713bc0e7d6 Mon Sep 17 00:00:00 2001
From: Todd Kjos <tkjos@google.com>
Date: Wed, 10 Nov 2021 15:00:36 -0800
Subject: [PATCH 1158/1750] binder: use cred instead of task for getsecid

commit 4d5b5539742d2554591751b4248b0204d20dcc9d upstream.

Use the 'struct cred' saved at binder_open() to lookup
the security ID via security_cred_getsecid(). This
ensures that the security context that opened binder
is the one used to generate the secctx.

Cc: stable@vger.kernel.org # 5.4+
Fixes: ec74136ded79 ("binder: create node flag to request sender's security context")
Signed-off-by: Todd Kjos <tkjos@google.com>
Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/android/binder.c | 2 +-
 include/linux/security.h | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 5a9df224b001..8f14ad7ab5bd 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3102,7 +3102,7 @@ static void binder_transaction(struct binder_proc *proc,
 		u32 secid;
 		size_t added_size;
 
-		security_task_getsecid(proc->tsk, &secid);
+		security_cred_getsecid(proc->cred, &secid);
 		ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
 		if (ret) {
 			return_error = BR_FAILED_REPLY;
diff --git a/include/linux/security.h b/include/linux/security.h
index e67cc8c40865..35355429648e 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1003,6 +1003,11 @@ static inline void security_transfer_creds(struct cred *new,
 {
 }
 
+static inline void security_cred_getsecid(const struct cred *c, u32 *secid)
+{
+	*secid = 0;
+}
+
 static inline int security_kernel_act_as(struct cred *cred, u32 secid)
 {
 	return 0;

From d1eb42de7cf9511702df7751626c21a87f9d0ef9 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 9 Nov 2021 22:58:01 -0800
Subject: [PATCH 1159/1750] Input: iforce - fix control-message timeout

commit 744d0090a5f6dfa4c81b53402ccdf08313100429 upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 487358627825 ("Input: iforce - use DMA-safe buffer when getting IDs from USB")
Signed-off-by: Johan Hovold <johan@kernel.org>
Cc: stable@vger.kernel.org      # 5.3
Link: https://lore.kernel.org/r/20211025115501.5190-1-johan@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/iforce/iforce-usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index 6c554c11a7ac..ea58805c480f 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -92,7 +92,7 @@ static int iforce_usb_get_id(struct iforce *iforce, u8 id,
 				 id,
 				 USB_TYPE_VENDOR | USB_DIR_IN |
 					USB_RECIP_INTERFACE,
-				 0, 0, buf, IFORCE_MAX_LENGTH, HZ);
+				 0, 0, buf, IFORCE_MAX_LENGTH, 1000);
 	if (status < 0) {
 		dev_err(&iforce_usb->intf->dev,
 			"usb_submit_urb failed: %d\n", status);

From 8c341d11c8bd366791cacfbf96608de905607fde Mon Sep 17 00:00:00 2001
From: Phoenix Huang <phoenix@emc.com.tw>
Date: Sun, 7 Nov 2021 22:00:03 -0800
Subject: [PATCH 1160/1750] Input: elantench - fix misreporting trackpoint
 coordinates

commit be896bd3b72b44126c55768f14c22a8729b0992e upstream.

Some firmwares occasionally report bogus data from trackpoint, with X or Y
displacement being too large (outside of [-127, 127] range). Let's drop such
packets so that we do not generate jumps.

Signed-off-by: Phoenix Huang <phoenix@emc.com.tw>
Tested-by: Yufei Du <yufeidu@cs.unc.edu>
Link: https://lore.kernel.org/r/20210729010940.5752-1-phoenix@emc.com.tw
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/mouse/elantech.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index e0e53a9a816f..4357d30c15c5 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -517,6 +517,19 @@ static void elantech_report_trackpoint(struct psmouse *psmouse,
 	case 0x16008020U:
 	case 0x26800010U:
 	case 0x36808000U:
+
+		/*
+		 * This firmware misreport coordinates for trackpoint
+		 * occasionally. Discard packets outside of [-127, 127] range
+		 * to prevent cursor jumps.
+		 */
+		if (packet[4] == 0x80 || packet[5] == 0x80 ||
+		    packet[1] >> 7 == packet[4] >> 7 ||
+		    packet[2] >> 7 == packet[5] >> 7) {
+			elantech_debug("discarding packet [%6ph]\n", packet);
+			break;
+
+		}
 		x = packet[4] - (int)((packet[1]^0x80) << 1);
 		y = (int)((packet[2]^0x80) << 1) - packet[5];
 

From ab0a06769e69f8ecdf291ee8028a00e7b196aeff Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 3 Nov 2021 08:00:19 +0100
Subject: [PATCH 1161/1750] Input: i8042 - Add quirk for Fujitsu Lifebook T725

commit 16e28abb7290c4ca3b3a0f333ba067f34bb18c86 upstream.

Fujitsu Lifebook T725 laptop requires, like a few other similar
models, the nomux and notimeout options to probe the touchpad
properly.  This patch adds the corresponding quirk entries.

BugLink: https://bugzilla.suse.com/show_bug.cgi?id=1191980
Tested-by: Neal Gompa <ngompa13@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20211103070019.13374-1-tiwai@suse.de
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/serio/i8042-x86ia64io.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index a5a003553646..aedd05541044 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -272,6 +272,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
 		},
 	},
+	{
+		/* Fujitsu Lifebook T725 laptop */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
+		},
+	},
 	{
 		/* Fujitsu Lifebook U745 */
 		.matches = {
@@ -840,6 +847,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
 		},
 	},
+	{
+		/* Fujitsu Lifebook T725 laptop */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T725"),
+		},
+	},
 	{
 		/* Fujitsu U574 laptop */
 		/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */

From 39264eaa6d44df00e53d2f9b503c6439b7ec270c Mon Sep 17 00:00:00 2001
From: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Date: Thu, 4 Nov 2021 17:31:58 +0900
Subject: [PATCH 1162/1750] libata: fix read log timeout value

commit 68dbbe7d5b4fde736d104cbbc9a2fce875562012 upstream.

Some ATA drives are very slow to respond to READ_LOG_EXT and
READ_LOG_DMA_EXT commands issued from ata_dev_configure() when the
device is revalidated right after resuming a system or inserting the
ATA adapter driver (e.g. ahci). The default 5s timeout
(ATA_EH_CMD_DFL_TIMEOUT) used for these commands is too short, causing
errors during the device configuration. Ex:

...
ata9: SATA max UDMA/133 abar m524288@0x9d200000 port 0x9d200400 irq 209
ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
ata9.00: ATA-9: XXX  XXXXXXXXXXXXXXX, XXXXXXXX, max UDMA/133
ata9.00: qc timeout (cmd 0x2f)
ata9.00: Read log page 0x00 failed, Emask 0x4
ata9.00: Read log page 0x00 failed, Emask 0x40
ata9.00: NCQ Send/Recv Log not supported
ata9.00: Read log page 0x08 failed, Emask 0x40
ata9.00: 27344764928 sectors, multi 16: LBA48 NCQ (depth 32), AA
ata9.00: Read log page 0x00 failed, Emask 0x40
ata9.00: ATA Identify Device Log not supported
ata9.00: failed to set xfermode (err_mask=0x40)
ata9: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
ata9.00: configured for UDMA/133
...

The timeout error causes a soft reset of the drive link, followed in
most cases by a successful revalidation as that give enough time to the
drive to become fully ready to quickly process the read log commands.
However, in some cases, this also fails resulting in the device being
dropped.

Fix this by using adding the ata_eh_revalidate_timeouts entries for the
READ_LOG_EXT and READ_LOG_DMA_EXT commands. This defines a timeout
increased to 15s, retriable one time.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/libata-eh.c | 8 ++++++++
 include/linux/libata.h  | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index b6f92050e60c..018ed8736a64 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -93,6 +93,12 @@ static const unsigned long ata_eh_identify_timeouts[] = {
 	ULONG_MAX,
 };
 
+static const unsigned long ata_eh_revalidate_timeouts[] = {
+	15000,	/* Some drives are slow to read log pages when waking-up */
+	15000,  /* combined time till here is enough even for media access */
+	ULONG_MAX,
+};
+
 static const unsigned long ata_eh_flush_timeouts[] = {
 	15000,	/* be generous with flush */
 	15000,  /* ditto */
@@ -129,6 +135,8 @@ static const struct ata_eh_cmd_timeout_ent
 ata_eh_cmd_timeout_table[ATA_EH_CMD_TIMEOUT_TABLE_SIZE] = {
 	{ .commands = CMDS(ATA_CMD_ID_ATA, ATA_CMD_ID_ATAPI),
 	  .timeouts = ata_eh_identify_timeouts, },
+	{ .commands = CMDS(ATA_CMD_READ_LOG_EXT, ATA_CMD_READ_LOG_DMA_EXT),
+	  .timeouts = ata_eh_revalidate_timeouts, },
 	{ .commands = CMDS(ATA_CMD_READ_NATIVE_MAX, ATA_CMD_READ_NATIVE_MAX_EXT),
 	  .timeouts = ata_eh_other_timeouts, },
 	{ .commands = CMDS(ATA_CMD_SET_MAX, ATA_CMD_SET_MAX_EXT),
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 57dffa0d5870..d3600fc7f7c4 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -390,7 +390,7 @@ enum {
 	/* This should match the actual table size of
 	 * ata_eh_cmd_timeout_table in libata-eh.c.
 	 */
-	ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 6,
+	ATA_EH_CMD_TIMEOUT_TABLE_SIZE = 7,
 
 	/* Horkage types. May be set by libata or controller on drives
 	   (some horkage may be drive/controller pair dependent */

From 9d623bf1736b71563c039c67636398c7c6086445 Mon Sep 17 00:00:00 2001
From: Jan Kara <jack@suse.cz>
Date: Fri, 5 Nov 2021 13:34:55 -0700
Subject: [PATCH 1163/1750] ocfs2: fix data corruption on truncate

commit 839b63860eb3835da165642923120d305925561d upstream.

Patch series "ocfs2: Truncate data corruption fix".

As further testing has shown, commit 5314454ea3f ("ocfs2: fix data
corruption after conversion from inline format") didn't fix all the data
corruption issues the customer started observing after 6dbf7bb55598
("fs: Don't invalidate page buffers in block_write_full_page()") This
time I have tracked them down to two bugs in ocfs2 truncation code.

One bug (truncating page cache before clearing tail cluster and setting
i_size) could cause data corruption even before 6dbf7bb55598, but before
that commit it needed a race with page fault, after 6dbf7bb55598 it
started to be pretty deterministic.

Another bug (zeroing pages beyond old i_size) used to be harmless
inefficiency before commit 6dbf7bb55598.  But after commit 6dbf7bb55598
in combination with the first bug it resulted in deterministic data
corruption.

Although fixing only the first problem is needed to stop data
corruption, I've fixed both issues to make the code more robust.

This patch (of 2):

ocfs2_truncate_file() did unmap invalidate page cache pages before
zeroing partial tail cluster and setting i_size.  Thus some pages could
be left (and likely have left if the cluster zeroing happened) in the
page cache beyond i_size after truncate finished letting user possibly
see stale data once the file was extended again.  Also the tail cluster
zeroing was not guaranteed to finish before truncate finished causing
possible stale data exposure.  The problem started to be particularly
easy to hit after commit 6dbf7bb55598 "fs: Don't invalidate page buffers
in block_write_full_page()" stopped invalidation of pages beyond i_size
from page writeback path.

Fix these problems by unmapping and invalidating pages in the page cache
after the i_size is reduced and tail cluster is zeroed out.

Link: https://lkml.kernel.org/r/20211025150008.29002-1-jack@suse.cz
Link: https://lkml.kernel.org/r/20211025151332.11301-1-jack@suse.cz
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ocfs2/file.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 919e552abf63..1470b49adb2d 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -478,10 +478,11 @@ int ocfs2_truncate_file(struct inode *inode,
 	 * greater than page size, so we have to truncate them
 	 * anyway.
 	 */
-	unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
-	truncate_inode_pages(inode->i_mapping, new_i_size);
 
 	if (OCFS2_I(inode)->ip_dyn_features & OCFS2_INLINE_DATA_FL) {
+		unmap_mapping_range(inode->i_mapping,
+				    new_i_size + PAGE_SIZE - 1, 0, 1);
+		truncate_inode_pages(inode->i_mapping, new_i_size);
 		status = ocfs2_truncate_inline(inode, di_bh, new_i_size,
 					       i_size_read(inode), 1);
 		if (status)
@@ -500,6 +501,9 @@ int ocfs2_truncate_file(struct inode *inode,
 		goto bail_unlock_sem;
 	}
 
+	unmap_mapping_range(inode->i_mapping, new_i_size + PAGE_SIZE - 1, 0, 1);
+	truncate_inode_pages(inode->i_mapping, new_i_size);
+
 	status = ocfs2_commit_truncate(osb, inode, di_bh);
 	if (status < 0) {
 		mlog_errno(status);

From 06cc8187dbb6218b746a2976c05cb8934a1ff728 Mon Sep 17 00:00:00 2001
From: Tadeusz Struk <tadeusz.struk@linaro.org>
Date: Wed, 3 Nov 2021 10:06:59 -0700
Subject: [PATCH 1164/1750] scsi: core: Remove command size deduction from
 scsi_setup_scsi_cmnd()

commit 703535e6ae1e94c89a9c1396b4c7b6b41160ef0c upstream.

No need to deduce command size in scsi_setup_scsi_cmnd() anymore as
appropriate checks have been added to scsi_fill_sghdr_rq() function and the
cmd_len should never be zero here.  The code to do that wasn't correct
anyway, as it used uninitialized cmd->cmnd, which caused a null-ptr-deref
if the command size was zero as in the trace below. Fix this by removing
the unneeded code.

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 1822 Comm: repro Not tainted 5.15.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014
Call Trace:
 blk_mq_dispatch_rq_list+0x7c7/0x12d0
 __blk_mq_sched_dispatch_requests+0x244/0x380
 blk_mq_sched_dispatch_requests+0xf0/0x160
 __blk_mq_run_hw_queue+0xe8/0x160
 __blk_mq_delay_run_hw_queue+0x252/0x5d0
 blk_mq_run_hw_queue+0x1dd/0x3b0
 blk_mq_sched_insert_request+0x1ff/0x3e0
 blk_execute_rq_nowait+0x173/0x1e0
 blk_execute_rq+0x15c/0x540
 sg_io+0x97c/0x1370
 scsi_ioctl+0xe16/0x28e0
 sd_ioctl+0x134/0x170
 blkdev_ioctl+0x362/0x6e0
 block_ioctl+0xb0/0xf0
 vfs_ioctl+0xa7/0xf0
 do_syscall_64+0x3d/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae
---[ end trace 8b086e334adef6d2 ]---
Kernel panic - not syncing: Fatal exception

Link: https://lore.kernel.org/r/20211103170659.22151-2-tadeusz.struk@linaro.org
Fixes: 2ceda20f0a99 ("scsi: core: Move command size detection out of the fast path")
Cc: Bart Van Assche <bvanassche@acm.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: James E.J. Bottomley <jejb@linux.ibm.com>
Cc: Martin K. Petersen <martin.petersen@oracle.com>
Cc: <linux-scsi@vger.kernel.org>
Cc: <linux-kernel@vger.kernel.org>
Cc: <stable@vger.kernel.org> # 5.15, 5.14, 5.10
Reported-by: syzbot+5516b30f5401d4dcbcae@syzkaller.appspotmail.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/scsi_lib.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d89db29fa829..6f3d29d16d1f 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1193,8 +1193,6 @@ static blk_status_t scsi_setup_scsi_cmnd(struct scsi_device *sdev,
 	}
 
 	cmd->cmd_len = scsi_req(req)->cmd_len;
-	if (cmd->cmd_len == 0)
-		cmd->cmd_len = scsi_command_size(cmd->cmnd);
 	cmd->cmnd = scsi_req(req)->cmd;
 	cmd->transfersize = blk_rq_bytes(req);
 	cmd->allowed = scsi_req(req)->retries;

From 37b15db1d87c8b5d90b2a0ad67eaa8510eb69d02 Mon Sep 17 00:00:00 2001
From: Arun Easi <aeasi@marvell.com>
Date: Wed, 8 Sep 2021 09:46:18 -0700
Subject: [PATCH 1165/1750] scsi: qla2xxx: Fix kernel crash when accessing
 port_speed sysfs file

commit 3ef68d4f0c9e7cb589ae8b70f07d77f528105331 upstream.

Kernel crashes when accessing port_speed sysfs file.  The issue happens on
a CNA when the local array was accessed beyond bounds. Fix this by changing
the lookup.

BUG: unable to handle kernel paging request at 0000000000004000
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 15 PID: 455213 Comm: sosreport Kdump: loaded Not tainted
4.18.0-305.7.1.el8_4.x86_64 #1
RIP: 0010:string_nocheck+0x12/0x70
Code: 00 00 4c 89 e2 be 20 00 00 00 48 89 ef e8 86 9a 00 00 4c 01
e3 eb 81 90 49 89 f2 48 89 ce 48 89 f8 48 c1 fe 30 66 85 f6 74 4f <44> 0f b6 0a
45 84 c9 74 46 83 ee 01 41 b8 01 00 00 00 48 8d 7c 37
RSP: 0018:ffffb5141c1afcf0 EFLAGS: 00010286
RAX: ffff8bf4009f8000 RBX: ffff8bf4009f9000 RCX: ffff0a00ffffff04
RDX: 0000000000004000 RSI: ffffffffffffffff RDI: ffff8bf4009f8000
RBP: 0000000000004000 R08: 0000000000000001 R09: ffffb5141c1afb84
R10: ffff8bf4009f9000 R11: ffffb5141c1afce6 R12: ffff0a00ffffff04
R13: ffffffffc08e21aa R14: 0000000000001000 R15: ffffffffc08e21aa
FS:  00007fc4ebfff700(0000) GS:ffff8c717f7c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000004000 CR3: 000000edfdee6006 CR4: 00000000001706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
  string+0x40/0x50
  vsnprintf+0x33c/0x520
  scnprintf+0x4d/0x90
  qla2x00_port_speed_show+0xb5/0x100 [qla2xxx]
  dev_attr_show+0x1c/0x40
  sysfs_kf_seq_show+0x9b/0x100
  seq_read+0x153/0x410
  vfs_read+0x91/0x140
  ksys_read+0x4f/0xb0
  do_syscall_64+0x5b/0x1a0
  entry_SYSCALL_64_after_hwframe+0x65/0xca

Link: https://lore.kernel.org/r/20210908164622.19240-7-njavali@marvell.com
Fixes: 4910b524ac9e ("scsi: qla2xxx: Add support for setting port speed")
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Arun Easi <aeasi@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/qla2xxx/qla_attr.c | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 6a2c4a6fcded..e40a37236aa1 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1862,6 +1862,18 @@ qla2x00_port_speed_store(struct device *dev, struct device_attribute *attr,
 	return strlen(buf);
 }
 
+static const struct {
+	u16 rate;
+	char *str;
+} port_speed_str[] = {
+	{ PORT_SPEED_4GB, "4" },
+	{ PORT_SPEED_8GB, "8" },
+	{ PORT_SPEED_16GB, "16" },
+	{ PORT_SPEED_32GB, "32" },
+	{ PORT_SPEED_64GB, "64" },
+	{ PORT_SPEED_10GB, "10" },
+};
+
 static ssize_t
 qla2x00_port_speed_show(struct device *dev, struct device_attribute *attr,
     char *buf)
@@ -1869,7 +1881,8 @@ qla2x00_port_speed_show(struct device *dev, struct device_attribute *attr,
 	struct scsi_qla_host *vha = shost_priv(dev_to_shost(dev));
 	struct qla_hw_data *ha = vha->hw;
 	ssize_t rval;
-	char *spd[7] = {"0", "0", "0", "4", "8", "16", "32"};
+	u16 i;
+	char *speed = "Unknown";
 
 	rval = qla2x00_get_data_rate(vha);
 	if (rval != QLA_SUCCESS) {
@@ -1878,7 +1891,14 @@ qla2x00_port_speed_show(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}
 
-	return scnprintf(buf, PAGE_SIZE, "%s\n", spd[ha->link_data_rate]);
+	for (i = 0; i < ARRAY_SIZE(port_speed_str); i++) {
+		if (port_speed_str[i].rate != ha->link_data_rate)
+			continue;
+		speed = port_speed_str[i].str;
+		break;
+	}
+
+	return scnprintf(buf, PAGE_SIZE, "%s\n", speed);
 }
 
 /* ----- */

From c1d31266de3ddd5c5bc54f8e917c4f20453156ac Mon Sep 17 00:00:00 2001
From: Quinn Tran <qutran@marvell.com>
Date: Wed, 8 Sep 2021 09:46:21 -0700
Subject: [PATCH 1166/1750] scsi: qla2xxx: Fix use after free in eh_abort path

commit 3d33b303d4f3b74a71bede5639ebba3cfd2a2b4d upstream.

In eh_abort path driver prematurely exits the call to upper layer. Check
whether command is aborted / completed by firmware before exiting the call.

9 [ffff8b1ebf803c00] page_fault at ffffffffb0389778
  [exception RIP: qla2x00_status_entry+0x48d]
  RIP: ffffffffc04fa62d  RSP: ffff8b1ebf803cb0  RFLAGS: 00010082
  RAX: 00000000ffffffff  RBX: 00000000000e0000  RCX: 0000000000000000
  RDX: 0000000000000000  RSI: 00000000000013d8  RDI: fffff3253db78440
  RBP: ffff8b1ebf803dd0   R8: ffff8b1ebcd9b0c0   R9: 0000000000000000
  R10: ffff8b1e38a30808  R11: 0000000000001000  R12: 00000000000003e9
  R13: 0000000000000000  R14: ffff8b1ebcd9d740  R15: 0000000000000028
  ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
10 [ffff8b1ebf803cb0] enqueue_entity at ffffffffafce708f
11 [ffff8b1ebf803d00] enqueue_task_fair at ffffffffafce7b88
12 [ffff8b1ebf803dd8] qla24xx_process_response_queue at ffffffffc04fc9a6
[qla2xxx]
13 [ffff8b1ebf803e78] qla24xx_msix_rsp_q at ffffffffc04ff01b [qla2xxx]
14 [ffff8b1ebf803eb0] __handle_irq_event_percpu at ffffffffafd50714

Link: https://lore.kernel.org/r/20210908164622.19240-10-njavali@marvell.com
Fixes: f45bca8c5052 ("scsi: qla2xxx: Fix double scsi_done for abort path")
Cc: stable@vger.kernel.org
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Co-developed-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: David Jeffery <djeffery@redhat.com>
Co-developed-by: Laurence Oberman <loberman@redhat.com>
Signed-off-by: Laurence Oberman <loberman@redhat.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4af794c46d17..e075f855f298 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1254,6 +1254,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 	uint32_t ratov_j;
 	struct qla_qpair *qpair;
 	unsigned long flags;
+	int fast_fail_status = SUCCESS;
 
 	if (qla2x00_isp_reg_stat(ha)) {
 		ql_log(ql_log_info, vha, 0x8042,
@@ -1261,15 +1262,16 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 		return FAILED;
 	}
 
+	/* Save any FAST_IO_FAIL value to return later if abort succeeds */
 	ret = fc_block_scsi_eh(cmd);
 	if (ret != 0)
-		return ret;
+		fast_fail_status = ret;
 
 	sp = scsi_cmd_priv(cmd);
 	qpair = sp->qpair;
 
 	if ((sp->fcport && sp->fcport->deleted) || !qpair)
-		return SUCCESS;
+		return fast_fail_status != SUCCESS ? fast_fail_status : FAILED;
 
 	spin_lock_irqsave(qpair->qp_lock_ptr, flags);
 	sp->comp = &comp;
@@ -1304,7 +1306,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 			    __func__, ha->r_a_tov/10);
 			ret = FAILED;
 		} else {
-			ret = SUCCESS;
+			ret = fast_fail_status;
 		}
 		break;
 	default:

From 7b24b669d3f99ec25e2c74de2c05156d9812c662 Mon Sep 17 00:00:00 2001
From: Derong Liu <derong.liu@mediatek.com>
Date: Fri, 27 Aug 2021 15:15:37 +0800
Subject: [PATCH 1167/1750] mmc: mtk-sd: Add wait dma stop done flow

commit 43e5fee317f4b0a48992b8b07935b1a3ac20ce84 upstream.

We found this issue on a 5G platform, during CMDQ error handling, if DMA
status is active when it call msdc_reset_hw(), it means mmc host hw reset
and DMA transfer will be parallel, mmc host may access sram region
unexpectedly. According to the programming guide of mtk-sd host, it needs
to wait for dma stop done after set dma stop.

This change should be applied to all SoCs.

Signed-off-by: Derong Liu <derong.liu@mediatek.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210827071537.1034-1-derong.liu@mediatek.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/mtk-sd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index fb8b9475b1d0..f5c965da9501 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -8,6 +8,7 @@
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/dma-mapping.h>
+#include <linux/iopoll.h>
 #include <linux/ioport.h>
 #include <linux/irq.h>
 #include <linux/of_address.h>
@@ -2285,6 +2286,7 @@ static void msdc_cqe_enable(struct mmc_host *mmc)
 static void msdc_cqe_disable(struct mmc_host *mmc, bool recovery)
 {
 	struct msdc_host *host = mmc_priv(mmc);
+	unsigned int val = 0;
 
 	/* disable cmdq irq */
 	sdr_clr_bits(host->base + MSDC_INTEN, MSDC_INT_CMDQ);
@@ -2294,6 +2296,9 @@ static void msdc_cqe_disable(struct mmc_host *mmc, bool recovery)
 	if (recovery) {
 		sdr_set_field(host->base + MSDC_DMA_CTRL,
 			      MSDC_DMA_CTRL_STOP, 1);
+		if (WARN_ON(readl_poll_timeout(host->base + MSDC_DMA_CFG, val,
+			!(val & MSDC_DMA_CFG_STS), 1, 3000)))
+			return;
 		msdc_reset_hw(host);
 	}
 }

From 823b487cfbfc80f4accb8e3bad23d02745bcf6f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christian=20L=C3=B6hle?= <CLoehle@hyperstone.com>
Date: Thu, 16 Sep 2021 05:59:19 +0000
Subject: [PATCH 1168/1750] mmc: dw_mmc: Dont wait for DRTO on Write RSP error

commit 43592c8736e84025d7a45e61a46c3fa40536a364 upstream.

Only wait for DRTO on reads, otherwise the driver hangs.

The driver prevents sending CMD12 on response errors like CRCs. According
to the comment this is because some cards have problems with this during
the UHS tuning sequence. Unfortunately this workaround currently also
applies for any command with data. On reads this will set the drto timer,
which then triggers after a while. On writes this will not set any timer
and the tasklet will not be scheduled again.

I cannot test for the UHS workarounds need, but even if so, it should at
most apply to reads. I have observed many hangs when CMD25 response
contained a CRC error. This patch fixes this without touching the actual
UHS tuning workaround.

Signed-off-by: Christian Loehle <cloehle@hyperstone.com>
Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/af8f8b8674ba4fcc9a781019e4aeb72c@hyperstone.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/dw_mmc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 7f90326b1be5..a6170f80ba64 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -2014,7 +2014,8 @@ static void dw_mci_tasklet_func(unsigned long priv)
 				 * delayed. Allowing the transfer to take place
 				 * avoids races and keeps things simple.
 				 */
-				if (err != -ETIMEDOUT) {
+				if (err != -ETIMEDOUT &&
+				    host->dir_status == DW_MCI_RECV_STATUS) {
 					state = STATE_SENDING_DATA;
 					continue;
 				}

From 284ad310542ffb4e5c2acf11d8a6420b5b7b9cea Mon Sep 17 00:00:00 2001
From: Sungjong Seo <sj1557.seo@samsung.com>
Date: Tue, 19 Oct 2021 15:14:21 +0900
Subject: [PATCH 1169/1750] exfat: fix incorrect loading of i_blocks for large
 files

commit 0c336d6e33f4bedc443404c89f43c91c8bd9ee11 upstream.

When calculating i_blocks, there was a mistake that was masked with a
32-bit variable. So i_blocks for files larger than 4 GiB had incorrect
values. Mask with a 64-bit variable instead of 32-bit one.

Fixes: 5f2aa075070c ("exfat: add inode operations")
Cc: stable@vger.kernel.org # v5.7+
Reported-by: Ganapathi Kamath <hgkamath@hotmail.com>
Signed-off-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/exfat/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/exfat/inode.c b/fs/exfat/inode.c
index 730373e0965a..8b0288f70e93 100644
--- a/fs/exfat/inode.c
+++ b/fs/exfat/inode.c
@@ -602,7 +602,7 @@ static int exfat_fill_inode(struct inode *inode, struct exfat_dir_entry *info)
 	exfat_save_attr(inode, info->attr);
 
 	inode->i_blocks = ((i_size_read(inode) + (sbi->cluster_size - 1)) &
-		~(sbi->cluster_size - 1)) >> inode->i_blkbits;
+		~((loff_t)sbi->cluster_size - 1)) >> inode->i_blkbits;
 	inode->i_mtime = info->mtime;
 	inode->i_ctime = info->mtime;
 	ei->i_crtime = info->crtime;

From 15b4142aea0a46fcb65dc2940909316996ee3334 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sun, 31 Oct 2021 21:58:12 +0100
Subject: [PATCH 1170/1750] parisc: Fix set_fixmap() on PA1.x CPUs

commit 6e866a462867b60841202e900f10936a0478608c upstream.

Fix a kernel crash which happens on PA1.x CPUs while initializing the
FTRACE/KPROBE breakpoints.  The PTE table entries for the fixmap area
were not created correctly.

Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: ccfbc68d41c2 ("parisc: add set_fixmap()/clear_fixmap()")
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/mm/fixmap.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/arch/parisc/mm/fixmap.c b/arch/parisc/mm/fixmap.c
index 24426a7e1a5e..cc15d737fda6 100644
--- a/arch/parisc/mm/fixmap.c
+++ b/arch/parisc/mm/fixmap.c
@@ -20,12 +20,9 @@ void notrace set_fixmap(enum fixed_addresses idx, phys_addr_t phys)
 	pte_t *pte;
 
 	if (pmd_none(*pmd))
-		pmd = pmd_alloc(NULL, pud, vaddr);
-
-	pte = pte_offset_kernel(pmd, vaddr);
-	if (pte_none(*pte))
 		pte = pte_alloc_kernel(pmd, vaddr);
 
+	pte = pte_offset_kernel(pmd, vaddr);
 	set_pte_at(&init_mm, vaddr, pte, __mk_pte(phys, PAGE_KERNEL_RWX));
 	flush_tlb_kernel_range(vaddr, vaddr + PAGE_SIZE);
 }

From 32498b8889c8d1f9b2b67f4e43e017c63359b03e Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 5 Oct 2021 00:27:49 +0200
Subject: [PATCH 1171/1750] parisc: Fix ptrace check on syscall return

commit 8779e05ba8aaffec1829872ef9774a71f44f6580 upstream.

The TIF_XXX flags are stored in the flags field in the thread_info
struct (TI_FLAGS), not in the flags field of the task_struct structure
(TASK_FLAGS).

It seems this bug didn't generate any important side-effects, otherwise it
wouldn't have went unnoticed for 12 years (since v2.6.32).

Signed-off-by: Helge Deller <deller@gmx.de>
Fixes: ecd3d4bc06e48 ("parisc: stop using task->ptrace for {single,block}step flags")
Cc: Kyle McMartin <kyle@mcmartin.ca>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/entry.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 5d8123eb38ec..9c76d50a5654 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -1848,7 +1848,7 @@ syscall_restore:
 	LDREG	TI_TASK-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1
 
 	/* Are we being ptraced? */
-	ldw	TASK_FLAGS(%r1),%r19
+	LDREG	TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19
 	ldi	_TIF_SYSCALL_TRACE_MASK,%r2
 	and,COND(=)	%r19,%r2,%r0
 	b,n	syscall_restore_rfi

From dd189feebaf83849d220fefa39a1c2bfdbcd4406 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 8 Sep 2021 08:33:57 +0300
Subject: [PATCH 1172/1750] tpm: Check for integer overflow in
 tpm2_map_response_body()

commit a0bcce2b2a169e10eb265c8f0ebdd5ae4c875670 upstream.

The "4 * be32_to_cpu(data->count)" multiplication can potentially
overflow which would lead to memory corruption.  Add a check for that.

Cc: stable@vger.kernel.org
Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/tpm/tpm2-space.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
index 784b8b3cb903..97e916856cf3 100644
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -455,6 +455,9 @@ static int tpm2_map_response_body(struct tpm_chip *chip, u32 cc, u8 *rsp,
 	if (be32_to_cpu(data->capability) != TPM2_CAP_HANDLES)
 		return 0;
 
+	if (be32_to_cpu(data->count) > (UINT_MAX - TPM_HEADER_SIZE - 9) / 4)
+		return -EFAULT;
+
 	if (len != TPM_HEADER_SIZE + 9 + 4 * be32_to_cpu(data->count))
 		return -EFAULT;
 

From 9ac25cd2f4ec9c2feb2ab06442830bab8edf2b54 Mon Sep 17 00:00:00 2001
From: jing yangyang <cgel.zte@gmail.com>
Date: Thu, 19 Aug 2021 19:30:16 -0700
Subject: [PATCH 1173/1750] firmware/psci: fix application of sizeof to pointer

commit 2ac5fb35cd520ab1851c9a4816c523b65276052f upstream.

sizeof when applied to a pointer typed expression gives the size of
the pointer.

./drivers/firmware/psci/psci_checker.c:158:41-47: ERROR application of sizeof to pointer

This issue was detected with the help of Coccinelle.

Fixes: 7401056de5f8 ("drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests")
Cc: stable@vger.kernel.org
Reported-by: Zeal Robot <zealci@zte.com.cn>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: jing yangyang <jing.yangyang@zte.com.cn>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/firmware/psci/psci_checker.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/psci/psci_checker.c b/drivers/firmware/psci/psci_checker.c
index 9a369a2eda71..116eb465cdb4 100644
--- a/drivers/firmware/psci/psci_checker.c
+++ b/drivers/firmware/psci/psci_checker.c
@@ -155,7 +155,7 @@ static int alloc_init_cpu_groups(cpumask_var_t **pcpu_groups)
 	if (!alloc_cpumask_var(&tmp, GFP_KERNEL))
 		return -ENOMEM;
 
-	cpu_groups = kcalloc(nb_available_cpus, sizeof(cpu_groups),
+	cpu_groups = kcalloc(nb_available_cpus, sizeof(*cpu_groups),
 			     GFP_KERNEL);
 	if (!cpu_groups) {
 		free_cpumask_var(tmp);

From 949c5b6daa75aff41ff8861381be67337e133f5f Mon Sep 17 00:00:00 2001
From: Tang Bin <tangbin@cmss.chinamobile.com>
Date: Thu, 21 Oct 2021 09:34:22 +0800
Subject: [PATCH 1174/1750] crypto: s5p-sss - Add error handling in
 s5p_aes_probe()

commit a472cc0dde3eb057db71c80f102556eeced03805 upstream.

The function s5p_aes_probe() does not perform sufficient error
checking after executing platform_get_resource(), thus fix it.

Fixes: c2afad6c6105 ("crypto: s5p-sss - Add HASH support for Exynos")
Cc: <stable@vger.kernel.org>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/crypto/s5p-sss.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
index 88a6c853ffd7..c4a7a2bba086 100644
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -2173,6 +2173,8 @@ static int s5p_aes_probe(struct platform_device *pdev)
 
 	variant = find_s5p_sss_version(pdev);
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!res)
+		return -EINVAL;
 
 	/*
 	 * Note: HASH and PRNG uses the same registers in secss, avoid

From 39275d2ec6ffbdb97d462e2529b3ae9e4da4bfca Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wenst@chromium.org>
Date: Fri, 8 Oct 2021 11:04:22 +0100
Subject: [PATCH 1175/1750] media: rkvdec: Do not override sizeimage for output
 format

commit 298d8e8f7bcf023aceb60232d59b983255fec0df upstream.

The rkvdec H.264 decoder currently overrides sizeimage for the output
format. This causes issues when userspace requires and requests a larger
buffer, but ends up with one of insufficient size.

Instead, only provide a default size if none was requested. This fixes
the video_decode_accelerator_tests from Chromium failing on the first
frame due to insufficient buffer space. It also aligns the behavior
of the rkvdec driver with the Hantro and Cedrus drivers.

Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/media/rkvdec/rkvdec-h264.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/media/rkvdec/rkvdec-h264.c b/drivers/staging/media/rkvdec/rkvdec-h264.c
index 7cc3b478a5f4..5487f6d0bcb6 100644
--- a/drivers/staging/media/rkvdec/rkvdec-h264.c
+++ b/drivers/staging/media/rkvdec/rkvdec-h264.c
@@ -1015,8 +1015,9 @@ static int rkvdec_h264_adjust_fmt(struct rkvdec_ctx *ctx,
 	struct v4l2_pix_format_mplane *fmt = &f->fmt.pix_mp;
 
 	fmt->num_planes = 1;
-	fmt->plane_fmt[0].sizeimage = fmt->width * fmt->height *
-				      RKVDEC_H264_MAX_DEPTH_IN_BYTES;
+	if (!fmt->plane_fmt[0].sizeimage)
+		fmt->plane_fmt[0].sizeimage = fmt->width * fmt->height *
+					      RKVDEC_H264_MAX_DEPTH_IN_BYTES;
 	return 0;
 }
 

From b2b5126a777b61bfca2472fcfc3bdc920da61844 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Sun, 17 Oct 2021 13:01:15 +0100
Subject: [PATCH 1176/1750] media: ite-cir: IR receiver stop working after
 receive overflow

commit fdc881783099c6343921ff017450831c8766d12a upstream.

On an Intel NUC6iSYK, no IR is reported after a receive overflow.

When a receiver overflow occurs, this condition is only cleared by
reading the fifo. Make sure we read anything in the fifo.

Fixes: 28c7afb07ccf ("media: ite-cir: check for receive overflow")
Suggested-by: Bryan Pass <bryan.pass@gmail.com>
Tested-by: Bryan Pass <bryan.pass@gmail.com>
Cc: stable@vger.kernel.org>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/rc/ite-cir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index e5c4a6941d26..fbe794ca1eef 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -283,7 +283,7 @@ static irqreturn_t ite_cir_isr(int irq, void *data)
 	}
 
 	/* check for the receive interrupt */
-	if (iflags & ITE_IRQ_RX_FIFO) {
+	if (iflags & (ITE_IRQ_RX_FIFO | ITE_IRQ_RX_FIFO_OVERRUN)) {
 		/* read the FIFO bytes */
 		rx_bytes =
 			dev->params.get_rx_bytes(dev, rx_buf,

From 71a137376b6496bedc3e26574ebf451bf97107a0 Mon Sep 17 00:00:00 2001
From: Chen-Yu Tsai <wenst@chromium.org>
Date: Fri, 8 Oct 2021 11:04:23 +0100
Subject: [PATCH 1177/1750] media: rkvdec: Support dynamic resolution changes

commit 0887e9e152efbd3601d6c907e90033d25067277d upstream.

The mem-to-mem stateless decoder API specifies support for dynamic
resolution changes. In particular, the decoder should accept format
changes on the OUTPUT queue even when buffers have been allocated,
as long as it is not streaming.

Relax restrictions for S_FMT as described in the previous paragraph,
and as long as the codec format remains the same. This aligns it with
the Hantro and Cedrus decoders. This change was mostly based on commit
ae02d49493b5 ("media: hantro: Fix s_fmt for dynamic resolution changes").

Since rkvdec_s_fmt() is now just a wrapper around the output/capture
variants without any additional shared functionality, drop the wrapper
and call the respective functions directly.

Fixes: cd33c830448b ("media: rkvdec: Add the rkvdec driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/media/rkvdec/rkvdec.c | 42 +++++++++++++--------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
index e68303e2b390..a7788e7a9542 100644
--- a/drivers/staging/media/rkvdec/rkvdec.c
+++ b/drivers/staging/media/rkvdec/rkvdec.c
@@ -270,31 +270,20 @@ static int rkvdec_try_output_fmt(struct file *file, void *priv,
 	return 0;
 }
 
-static int rkvdec_s_fmt(struct file *file, void *priv,
-			struct v4l2_format *f,
-			int (*try_fmt)(struct file *, void *,
-				       struct v4l2_format *))
-{
-	struct rkvdec_ctx *ctx = fh_to_rkvdec_ctx(priv);
-	struct vb2_queue *vq;
-
-	if (!try_fmt)
-		return -EINVAL;
-
-	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, f->type);
-	if (vb2_is_busy(vq))
-		return -EBUSY;
-
-	return try_fmt(file, priv, f);
-}
-
 static int rkvdec_s_capture_fmt(struct file *file, void *priv,
 				struct v4l2_format *f)
 {
 	struct rkvdec_ctx *ctx = fh_to_rkvdec_ctx(priv);
+	struct vb2_queue *vq;
 	int ret;
 
-	ret = rkvdec_s_fmt(file, priv, f, rkvdec_try_capture_fmt);
+	/* Change not allowed if queue is busy */
+	vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
+			     V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE);
+	if (vb2_is_busy(vq))
+		return -EBUSY;
+
+	ret = rkvdec_try_capture_fmt(file, priv, f);
 	if (ret)
 		return ret;
 
@@ -309,9 +298,20 @@ static int rkvdec_s_output_fmt(struct file *file, void *priv,
 	struct v4l2_m2m_ctx *m2m_ctx = ctx->fh.m2m_ctx;
 	const struct rkvdec_coded_fmt_desc *desc;
 	struct v4l2_format *cap_fmt;
-	struct vb2_queue *peer_vq;
+	struct vb2_queue *peer_vq, *vq;
 	int ret;
 
+	/*
+	 * In order to support dynamic resolution change, the decoder admits
+	 * a resolution change, as long as the pixelformat remains. Can't be
+	 * done if streaming.
+	 */
+	vq = v4l2_m2m_get_vq(m2m_ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE);
+	if (vb2_is_streaming(vq) ||
+	    (vb2_is_busy(vq) &&
+	     f->fmt.pix_mp.pixelformat != ctx->coded_fmt.fmt.pix_mp.pixelformat))
+		return -EBUSY;
+
 	/*
 	 * Since format change on the OUTPUT queue will reset the CAPTURE
 	 * queue, we can't allow doing so when the CAPTURE queue has buffers
@@ -321,7 +321,7 @@ static int rkvdec_s_output_fmt(struct file *file, void *priv,
 	if (vb2_is_busy(peer_vq))
 		return -EBUSY;
 
-	ret = rkvdec_s_fmt(file, priv, f, rkvdec_try_output_fmt);
+	ret = rkvdec_try_output_fmt(file, priv, f);
 	if (ret)
 		return ret;
 

From 151eff588043db6383ec062120c79c11ed5908c5 Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Wed, 15 Sep 2021 18:14:07 +0200
Subject: [PATCH 1178/1750] media: ir-kbd-i2c: improve responsiveness of
 hauppauge zilog receivers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit c73ba202a851c0b611ef2c25e568fadeff5e667f upstream.

The IR receiver has two issues:

 - Sometimes there is no response to a button press
 - Sometimes a button press is repeated when it should not have been

Hanging the polling interval fixes this behaviour.

Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=994050

Cc: stable@vger.kernel.org
Suggested-by: Joaquín Alberto Calderón Pozo <kini_calderon@hotmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/i2c/ir-kbd-i2c.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index 92376592455e..56674173524f 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -791,6 +791,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id)
 		rc_proto    = RC_PROTO_BIT_RC5 | RC_PROTO_BIT_RC6_MCE |
 							RC_PROTO_BIT_RC6_6A_32;
 		ir_codes    = RC_MAP_HAUPPAUGE;
+		ir->polling_interval = 125;
 		probe_tx = true;
 		break;
 	}

From a2b3dbc9fd241af29c36225e107d3ffa912ec97b Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 18 Jun 2021 14:29:03 +0200
Subject: [PATCH 1179/1750] media: v4l2-ioctl: Fix check_ext_ctrls

commit 861f92cb9160b14beef0ada047384c2340701ee2 upstream.

Drivers that do not use the ctrl-framework use this function instead.

Fix the following issues:

- Do not check for multiple classes when getting the DEF_VAL.
- Return -EINVAL for request_api calls
- Default value cannot be changed, return EINVAL as soon as possible.
- Return the right error_idx
[If an error is found when validating the list of controls passed with
VIDIOC_G_EXT_CTRLS, then error_idx shall be set to ctrls->count to
indicate to userspace that no actual hardware was touched.
It would have been much nicer of course if error_idx could point to the
control index that failed the validation, but sadly that's not how the
API was designed.]

Fixes v4l2-compliance:
Control ioctls (Input 0):
        warn: v4l2-test-controls.cpp(834): error_idx should be equal to count
        warn: v4l2-test-controls.cpp(855): error_idx should be equal to count
		fail: v4l2-test-controls.cpp(813): doioctl(node, VIDIOC_G_EXT_CTRLS, &ctrls)
	test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL
Buffer ioctls (Input 0):
		fail: v4l2-test-buffers.cpp(1994): ret != EINVAL && ret != EBADR && ret != ENOTTY
	test Requests: FAIL

Cc: stable@vger.kernel.org
Fixes: 6fa6f831f095 ("media: v4l2-ctrls: add core request support")
Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/media/v4l2-core/v4l2-ioctl.c | 60 ++++++++++++++++++----------
 1 file changed, 39 insertions(+), 21 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 9eda8b91d17a..42958ce22de1 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -907,7 +907,7 @@ static void v4l_print_default(const void *arg, bool write_only)
 	pr_cont("driver-specific ioctl\n");
 }
 
-static int check_ext_ctrls(struct v4l2_ext_controls *c, int allow_priv)
+static bool check_ext_ctrls(struct v4l2_ext_controls *c, unsigned long ioctl)
 {
 	__u32 i;
 
@@ -916,23 +916,41 @@ static int check_ext_ctrls(struct v4l2_ext_controls *c, int allow_priv)
 	for (i = 0; i < c->count; i++)
 		c->controls[i].reserved2[0] = 0;
 
-	/* V4L2_CID_PRIVATE_BASE cannot be used as control class
-	   when using extended controls.
-	   Only when passed in through VIDIOC_G_CTRL and VIDIOC_S_CTRL
-	   is it allowed for backwards compatibility.
-	 */
-	if (!allow_priv && c->which == V4L2_CID_PRIVATE_BASE)
-		return 0;
-	if (!c->which)
-		return 1;
+	switch (c->which) {
+	case V4L2_CID_PRIVATE_BASE:
+		/*
+		 * V4L2_CID_PRIVATE_BASE cannot be used as control class
+		 * when using extended controls.
+		 * Only when passed in through VIDIOC_G_CTRL and VIDIOC_S_CTRL
+		 * is it allowed for backwards compatibility.
+		 */
+		if (ioctl == VIDIOC_G_CTRL || ioctl == VIDIOC_S_CTRL)
+			return false;
+		break;
+	case V4L2_CTRL_WHICH_DEF_VAL:
+		/* Default value cannot be changed */
+		if (ioctl == VIDIOC_S_EXT_CTRLS ||
+		    ioctl == VIDIOC_TRY_EXT_CTRLS) {
+			c->error_idx = c->count;
+			return false;
+		}
+		return true;
+	case V4L2_CTRL_WHICH_CUR_VAL:
+		return true;
+	case V4L2_CTRL_WHICH_REQUEST_VAL:
+		c->error_idx = c->count;
+		return false;
+	}
+
 	/* Check that all controls are from the same control class. */
 	for (i = 0; i < c->count; i++) {
 		if (V4L2_CTRL_ID2WHICH(c->controls[i].id) != c->which) {
-			c->error_idx = i;
-			return 0;
+			c->error_idx = ioctl == VIDIOC_TRY_EXT_CTRLS ? i :
+								      c->count;
+			return false;
 		}
 	}
-	return 1;
+	return true;
 }
 
 static int check_fmt(struct file *file, enum v4l2_buf_type type)
@@ -2226,7 +2244,7 @@ static int v4l_g_ctrl(const struct v4l2_ioctl_ops *ops,
 	ctrls.controls = &ctrl;
 	ctrl.id = p->id;
 	ctrl.value = p->value;
-	if (check_ext_ctrls(&ctrls, 1)) {
+	if (check_ext_ctrls(&ctrls, VIDIOC_G_CTRL)) {
 		int ret = ops->vidioc_g_ext_ctrls(file, fh, &ctrls);
 
 		if (ret == 0)
@@ -2260,7 +2278,7 @@ static int v4l_s_ctrl(const struct v4l2_ioctl_ops *ops,
 	ctrls.controls = &ctrl;
 	ctrl.id = p->id;
 	ctrl.value = p->value;
-	if (check_ext_ctrls(&ctrls, 1))
+	if (check_ext_ctrls(&ctrls, VIDIOC_S_CTRL))
 		return ops->vidioc_s_ext_ctrls(file, fh, &ctrls);
 	return -EINVAL;
 }
@@ -2282,8 +2300,8 @@ static int v4l_g_ext_ctrls(const struct v4l2_ioctl_ops *ops,
 					vfd, vfd->v4l2_dev->mdev, p);
 	if (ops->vidioc_g_ext_ctrls == NULL)
 		return -ENOTTY;
-	return check_ext_ctrls(p, 0) ? ops->vidioc_g_ext_ctrls(file, fh, p) :
-					-EINVAL;
+	return check_ext_ctrls(p, VIDIOC_G_EXT_CTRLS) ?
+				ops->vidioc_g_ext_ctrls(file, fh, p) : -EINVAL;
 }
 
 static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops,
@@ -2303,8 +2321,8 @@ static int v4l_s_ext_ctrls(const struct v4l2_ioctl_ops *ops,
 					vfd, vfd->v4l2_dev->mdev, p);
 	if (ops->vidioc_s_ext_ctrls == NULL)
 		return -ENOTTY;
-	return check_ext_ctrls(p, 0) ? ops->vidioc_s_ext_ctrls(file, fh, p) :
-					-EINVAL;
+	return check_ext_ctrls(p, VIDIOC_S_EXT_CTRLS) ?
+				ops->vidioc_s_ext_ctrls(file, fh, p) : -EINVAL;
 }
 
 static int v4l_try_ext_ctrls(const struct v4l2_ioctl_ops *ops,
@@ -2324,8 +2342,8 @@ static int v4l_try_ext_ctrls(const struct v4l2_ioctl_ops *ops,
 					  vfd, vfd->v4l2_dev->mdev, p);
 	if (ops->vidioc_try_ext_ctrls == NULL)
 		return -ENOTTY;
-	return check_ext_ctrls(p, 0) ? ops->vidioc_try_ext_ctrls(file, fh, p) :
-					-EINVAL;
+	return check_ext_ctrls(p, VIDIOC_TRY_EXT_CTRLS) ?
+			ops->vidioc_try_ext_ctrls(file, fh, p) : -EINVAL;
 }
 
 /*

From f0750e98010a162191f7cb01f177e8df162af814 Mon Sep 17 00:00:00 2001
From: Johnathon Clark <john.clark@cantab.net>
Date: Wed, 20 Oct 2021 14:12:51 +0100
Subject: [PATCH 1180/1750] ALSA: hda/realtek: Fix mic mute LED for the HP
 Spectre x360 14

commit 5fc462c3aaad601d5089fd5588a5799896a6937d upstream.

On the 'HP Spectre x360 Convertible 14-ea0xx' the microphone mute led is
controlled by GPIO 0x04. The speaker mute LED does not seem to be
exposed by GPIO and is there not set.

[ a slight coding-style fix by tiwai ]

Fixes: c3bb2b521944 ("ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup")
Signed-off-by: Johnathon Clark <john.clark@cantab.net>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211020131253.35894-1-john.clark@cantab.net
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f511ae66bc8a..bff5a7697953 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4300,6 +4300,16 @@ static void alc287_fixup_hp_gpio_led(struct hda_codec *codec,
 	alc_fixup_hp_gpio_led(codec, action, 0x10, 0);
 }
 
+static void alc245_fixup_hp_gpio_led(struct hda_codec *codec,
+				const struct hda_fixup *fix, int action)
+{
+	struct alc_spec *spec = codec->spec;
+
+	if (action == HDA_FIXUP_ACT_PRE_PROBE)
+		spec->micmute_led_polarity = 1;
+	alc_fixup_hp_gpio_led(codec, action, 0, 0x04);
+}
+
 /* turn on/off mic-mute LED per capture hook via VREF change */
 static int vref_micmute_led_set(struct led_classdev *led_cdev,
 				enum led_brightness brightness)
@@ -6616,6 +6626,7 @@ enum {
 	ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
 	ALC287_FIXUP_HP_GPIO_LED,
 	ALC256_FIXUP_HP_HEADSET_MIC,
+	ALC245_FIXUP_HP_GPIO_LED,
 	ALC236_FIXUP_DELL_AIO_HEADSET_MIC,
 	ALC282_FIXUP_ACER_DISABLE_LINEOUT,
 	ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST,
@@ -7239,6 +7250,8 @@ static const struct hda_fixup alc269_fixups[] = {
 	[ALC245_FIXUP_HP_X360_AMP] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc245_fixup_hp_x360_amp,
+		.chained = true,
+		.chain_id = ALC245_FIXUP_HP_GPIO_LED
 	},
 	[ALC288_FIXUP_DELL_HEADSET_MODE] = {
 		.type = HDA_FIXUP_FUNC,
@@ -8328,6 +8341,10 @@ static const struct hda_fixup alc269_fixups[] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc256_fixup_tongfang_reset_persistent_settings,
 	},
+	[ALC245_FIXUP_HP_GPIO_LED] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc245_fixup_hp_gpio_led,
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {

From 3d0e5d2eaff1c065116668582808003b4cd88780 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Thu, 28 Oct 2021 09:09:11 +0200
Subject: [PATCH 1181/1750] ALSA: hda/realtek: Add a quirk for HP OMEN 15 mute
 LED

commit 375f8426ed994addd2be4d76febc946a6fdd8280 upstream.

HP OMEN 15 laptop requires the quirk to fiddle with COEF 0x0b bit 2
for toggling the mute LED.  It's already implemented for other HP
laptops, and we just need to add a proper fixup entry.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214735
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211028070911.18891-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index bff5a7697953..f4e33ccee4b5 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8530,6 +8530,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 		      ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x8783, "HP ZBook Fury 15 G7 Mobile Workstation",
 		      ALC285_FIXUP_HP_GPIO_AMP_INIT),
+	SND_PCI_QUIRK(0x103c, 0x8788, "HP OMEN 15", ALC285_FIXUP_HP_MUTE_LED),
 	SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87e5, "HP ProBook 440 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x87e7, "HP ProBook 450 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),

From 0288f838a2e3a7a6814911c82a25b1ff7dde2e52 Mon Sep 17 00:00:00 2001
From: Tim Crawford <tcrawford@system76.com>
Date: Mon, 1 Nov 2021 10:21:34 -0600
Subject: [PATCH 1182/1750] ALSA: hda/realtek: Add quirk for Clevo PC70HS

commit dbfe83507cf4ea66ce4efee2ac14c5ad420e31d3 upstream.

Apply the PB51ED PCI quirk to the Clevo PC70HS. Fixes audio output from
the internal speakers.

Signed-off-by: Tim Crawford <tcrawford@system76.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211101162134.5336-1-tcrawford@system76.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f4e33ccee4b5..c3596cda2e49 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2551,6 +2551,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x67f1, "Clevo PC70H[PRS]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170SM", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x7715, "Clevo X170KM-G", ALC1220_FIXUP_CLEVO_PB51ED),

From 88bcfcc50d0ead805cb1ab5791982e2589da3997 Mon Sep 17 00:00:00 2001
From: Jeremy Soller <jeremy@system76.com>
Date: Tue, 2 Nov 2021 11:21:04 -0600
Subject: [PATCH 1183/1750] ALSA: hda/realtek: Headset fixup for Clevo NH77HJQ

commit 1278cc5ac2f96bab50dd55c8c05e0a6a77ce323e upstream.

On Clevo NH77HJ, NH77HP, and their 15" variants, there is a headset
microphone input attached to 0x19 that does not have a jack detect. In
order to get it working, the pin configuration needs to be set
correctly, and a new ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE fixup is
applied. This is similar to the existing System76 quirk for ALC293, but
for ALC256.

Signed-off-by: Jeremy Soller <jeremy@system76.com>
Signed-off-by: Tim Crawford <tcrawford@system76.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211102172104.10610-1-tcrawford@system76.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c3596cda2e49..2e813d5865be 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6645,6 +6645,7 @@ enum {
 	ALC287_FIXUP_YOGA7_14ITL_SPEAKERS,
 	ALC287_FIXUP_13S_GEN2_SPEAKERS,
 	ALC256_FIXUP_TONGFANG_RESET_PERSISTENT_SETTINGS,
+	ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -8346,6 +8347,15 @@ static const struct hda_fixup alc269_fixups[] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc245_fixup_hp_gpio_led,
 	},
+	[ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE] = {
+		.type = HDA_FIXUP_PINS,
+		.v.pins = (const struct hda_pintbl[]) {
+			{ 0x19, 0x03a11120 }, /* use as headset mic, without its own jack detect */
+			{ }
+		},
+		.chained = true,
+		.chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8642,11 +8652,15 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1558, 0x40a1, "Clevo NL40GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x40c1, "Clevo NL40[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x40d1, "Clevo NL41DU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x5015, "Clevo NH5[58]H[HJK]Q", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x5017, "Clevo NH7[79]H[HJK]Q", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50a3, "Clevo NJ51GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50b3, "Clevo NK50S[BEZ]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50b6, "Clevo NK50S5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50e1, "Clevo NH5[58]HPQ", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50e2, "Clevo NH7[79]HPQ", ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50f2, "Clevo NH50E[PR]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),

From a770cb746bddce4ebd985f9e560f132b7bdec089 Mon Sep 17 00:00:00 2001
From: Jaroslav Kysela <perex@perex.cz>
Date: Thu, 4 Nov 2021 16:57:26 +0100
Subject: [PATCH 1184/1750] ALSA: hda/realtek: Add a quirk for Acer Spin
 SP513-54N

commit 2a5bb694488bb6593066d46881bfd9d07edd1628 upstream.

Another model requires ALC255_FIXUP_ACER_MIC_NO_PRESENCE fixup.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=211853
Signed-off-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211104155726.2090997-1-perex@perex.cz
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 2e813d5865be..b414d760c882 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8392,6 +8392,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1025, 0x141f, "Acer Spin SP513-54N", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC),

From 62b189f9f3c51c986595904399011001b06a43cb Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Sun, 7 Nov 2021 09:33:39 +0100
Subject: [PATCH 1185/1750] ALSA: hda/realtek: Add quirk for ASUS UX550VE

commit 4fad4fb9871b43389e4f4bead18ec693064697bb upstream.

ASUS UX550VE (SSID 1043:1970) requires a similar workaround for
managing the routing of the 4 speakers like some other ASUS models.
Add a corresponding quirk entry for fixing it.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212641
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211107083339.18013-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index b414d760c882..e8e62febbaa4 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8590,6 +8590,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1043, 0x194e, "ASUS UX563FD", ALC294_FIXUP_ASUS_HPE),
+	SND_PCI_QUIRK(0x1043, 0x1970, "ASUS UX550VE", ALC289_FIXUP_ASUS_GA401),
 	SND_PCI_QUIRK(0x1043, 0x1982, "ASUS B1400CEPE", ALC256_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x19ce, "ASUS B9450FA", ALC294_FIXUP_ASUS_HPE),
 	SND_PCI_QUIRK(0x1043, 0x19e1, "ASUS UX581LV", ALC295_FIXUP_ASUS_MIC_NO_PRESENCE),

From 4f9e9c389e107e2c4f262beeab483d8947d1ab4e Mon Sep 17 00:00:00 2001
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
Date: Wed, 10 Nov 2021 22:40:32 +0800
Subject: [PATCH 1186/1750] ALSA: hda/realtek: Add quirk for HP EliteBook 840
 G7 mute LED

commit c058493df7edcef8f48c1494d9a84218519f966b upstream.

The mute and micmute LEDs don't work on HP EliteBook 840 G7. The same
quirk for other HP laptops can let LEDs work, so apply it.

Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211110144033.118451-1-kai.heng.feng@canonical.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index e8e62febbaa4..5b2827514705 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -8532,6 +8532,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x8716, "HP Elite Dragonfly G2 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x8720, "HP EliteBook x360 1040 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_AMP_INIT),
 	SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8728, "HP EliteBook 840 G7", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8730, "HP ProBook 445 G7", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
 	SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),

From 0e4c288a74a3238b5e8ce63cb984ec62a3fd6495 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Tue, 26 Oct 2021 11:54:01 +0200
Subject: [PATCH 1187/1750] ALSA: ua101: fix division by zero at probe

commit 55f261b73a7e1cb254577c3536cef8f415de220a upstream.

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in alloc_stream_buffers() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 63978ab3e3e9 ("sound: add Edirol UA-101 support")
Cc: stable@vger.kernel.org      # 2.6.34
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211026095401.26522-1-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/misc/ua101.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c
index 6b30155964ec..5dd1cbe29d12 100644
--- a/sound/usb/misc/ua101.c
+++ b/sound/usb/misc/ua101.c
@@ -1001,7 +1001,7 @@ static int detect_usb_format(struct ua101 *ua)
 		fmt_playback->bSubframeSize * ua->playback.channels;
 
 	epd = &ua->intf[INTF_CAPTURE]->altsetting[1].endpoint[0].desc;
-	if (!usb_endpoint_is_isoc_in(epd)) {
+	if (!usb_endpoint_is_isoc_in(epd) || usb_endpoint_maxp(epd) == 0) {
 		dev_err(&ua->dev->dev, "invalid capture endpoint\n");
 		return -ENXIO;
 	}
@@ -1009,7 +1009,7 @@ static int detect_usb_format(struct ua101 *ua)
 	ua->capture.max_packet_bytes = usb_endpoint_maxp(epd);
 
 	epd = &ua->intf[INTF_PLAYBACK]->altsetting[1].endpoint[0].desc;
-	if (!usb_endpoint_is_isoc_out(epd)) {
+	if (!usb_endpoint_is_isoc_out(epd) || usb_endpoint_maxp(epd) == 0) {
 		dev_err(&ua->dev->dev, "invalid playback endpoint\n");
 		return -ENXIO;
 	}

From 21f9c02a4dedca2f9011bbeaf1159b04d9931a34 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:11:41 +0200
Subject: [PATCH 1188/1750] ALSA: 6fire: fix control and bulk message timeouts

commit 9b371c6cc37f954360989eec41c2ddc5a6b83917 upstream.

USB control and bulk message timeouts are specified in milliseconds and
should specifically not vary with CONFIG_HZ.

Fixes: c6d43ba816d1 ("ALSA: usb/6fire - Driver for TerraTec DMX 6Fire USB")
Cc: stable@vger.kernel.org      # 2.6.39
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025121142.6531-2-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/6fire/comm.c     | 2 +-
 sound/usb/6fire/firmware.c | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c
index 43a2a62d66f7..49629d4bb327 100644
--- a/sound/usb/6fire/comm.c
+++ b/sound/usb/6fire/comm.c
@@ -95,7 +95,7 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev)
 	int actual_len;
 
 	ret = usb_interrupt_msg(dev, usb_sndintpipe(dev, COMM_EP),
-			buffer, buffer[1] + 2, &actual_len, HZ);
+			buffer, buffer[1] + 2, &actual_len, 1000);
 	if (ret < 0)
 		return ret;
 	else if (actual_len != buffer[1] + 2)
diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c
index 8981e61f2da4..c51abc54d2f8 100644
--- a/sound/usb/6fire/firmware.c
+++ b/sound/usb/6fire/firmware.c
@@ -160,7 +160,7 @@ static int usb6fire_fw_ezusb_write(struct usb_device *device,
 {
 	return usb_control_msg_send(device, 0, type,
 				    USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-				    value, 0, data, len, HZ, GFP_KERNEL);
+				    value, 0, data, len, 1000, GFP_KERNEL);
 }
 
 static int usb6fire_fw_ezusb_read(struct usb_device *device,
@@ -168,7 +168,7 @@ static int usb6fire_fw_ezusb_read(struct usb_device *device,
 {
 	return usb_control_msg_recv(device, 0, type,
 				    USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-				    value, 0, data, len, HZ, GFP_KERNEL);
+				    value, 0, data, len, 1000, GFP_KERNEL);
 }
 
 static int usb6fire_fw_fpga_write(struct usb_device *device,
@@ -178,7 +178,7 @@ static int usb6fire_fw_fpga_write(struct usb_device *device,
 	int ret;
 
 	ret = usb_bulk_msg(device, usb_sndbulkpipe(device, FPGA_EP), data, len,
-			&actual_len, HZ);
+			&actual_len, 1000);
 	if (ret < 0)
 		return ret;
 	else if (actual_len != len)

From 3c7a3f2d79f73edf5a8fa1d57edefaec617b5db3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:11:42 +0200
Subject: [PATCH 1189/1750] ALSA: line6: fix control and interrupt message
 timeouts

commit f4000b58b64344871d7b27c05e73932f137cfef6 upstream.

USB control and interrupt message timeouts are specified in milliseconds
and should specifically not vary with CONFIG_HZ.

Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
Cc: stable@vger.kernel.org      # 2.6.30
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025121142.6531-3-johan@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/line6/driver.c   | 14 +++++++-------
 sound/usb/line6/driver.h   |  2 +-
 sound/usb/line6/podhd.c    |  6 +++---
 sound/usb/line6/toneport.c |  2 +-
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
index 9602929b7de9..59faa5a9a714 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -113,12 +113,12 @@ int line6_send_raw_message(struct usb_line6 *line6, const char *buffer,
 			retval = usb_interrupt_msg(line6->usbdev,
 						usb_sndintpipe(line6->usbdev, properties->ep_ctrl_w),
 						(char *)frag_buf, frag_size,
-						&partial, LINE6_TIMEOUT * HZ);
+						&partial, LINE6_TIMEOUT);
 		} else {
 			retval = usb_bulk_msg(line6->usbdev,
 						usb_sndbulkpipe(line6->usbdev, properties->ep_ctrl_w),
 						(char *)frag_buf, frag_size,
-						&partial, LINE6_TIMEOUT * HZ);
+						&partial, LINE6_TIMEOUT);
 		}
 
 		if (retval) {
@@ -347,7 +347,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
 	ret = usb_control_msg_send(usbdev, 0, 0x67,
 				   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
 				   (datalen << 8) | 0x21, address, NULL, 0,
-				   LINE6_TIMEOUT * HZ, GFP_KERNEL);
+				   LINE6_TIMEOUT, GFP_KERNEL);
 	if (ret) {
 		dev_err(line6->ifcdev, "read request failed (error %d)\n", ret);
 		goto exit;
@@ -360,7 +360,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
 		ret = usb_control_msg_recv(usbdev, 0, 0x67,
 					   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
 					   0x0012, 0x0000, &len, 1,
-					   LINE6_TIMEOUT * HZ, GFP_KERNEL);
+					   LINE6_TIMEOUT, GFP_KERNEL);
 		if (ret) {
 			dev_err(line6->ifcdev,
 				"receive length failed (error %d)\n", ret);
@@ -387,7 +387,7 @@ int line6_read_data(struct usb_line6 *line6, unsigned address, void *data,
 	/* receive the result: */
 	ret = usb_control_msg_recv(usbdev, 0, 0x67,
 				   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
-				   0x0013, 0x0000, data, datalen, LINE6_TIMEOUT * HZ,
+				   0x0013, 0x0000, data, datalen, LINE6_TIMEOUT,
 				   GFP_KERNEL);
 	if (ret)
 		dev_err(line6->ifcdev, "read failed (error %d)\n", ret);
@@ -417,7 +417,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
 
 	ret = usb_control_msg_send(usbdev, 0, 0x67,
 				   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
-				   0x0022, address, data, datalen, LINE6_TIMEOUT * HZ,
+				   0x0022, address, data, datalen, LINE6_TIMEOUT,
 				   GFP_KERNEL);
 	if (ret) {
 		dev_err(line6->ifcdev,
@@ -430,7 +430,7 @@ int line6_write_data(struct usb_line6 *line6, unsigned address, void *data,
 
 		ret = usb_control_msg_recv(usbdev, 0, 0x67,
 					   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
-					   0x0012, 0x0000, status, 1, LINE6_TIMEOUT * HZ,
+					   0x0012, 0x0000, status, 1, LINE6_TIMEOUT,
 					   GFP_KERNEL);
 		if (ret) {
 			dev_err(line6->ifcdev,
diff --git a/sound/usb/line6/driver.h b/sound/usb/line6/driver.h
index 71d3da1db8c8..ecf3a2b39c7e 100644
--- a/sound/usb/line6/driver.h
+++ b/sound/usb/line6/driver.h
@@ -27,7 +27,7 @@
 #define LINE6_FALLBACK_INTERVAL 10
 #define LINE6_FALLBACK_MAXPACKETSIZE 16
 
-#define LINE6_TIMEOUT 1
+#define LINE6_TIMEOUT 1000
 #define LINE6_BUFSIZE_LISTEN 64
 #define LINE6_MIDI_MESSAGE_MAXLEN 256
 
diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
index 28794a35949d..b24bc82f89e3 100644
--- a/sound/usb/line6/podhd.c
+++ b/sound/usb/line6/podhd.c
@@ -190,7 +190,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
 	ret = usb_control_msg_send(usbdev, 0,
 					0x67, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
 					0x11, 0,
-					NULL, 0, LINE6_TIMEOUT * HZ, GFP_KERNEL);
+					NULL, 0, LINE6_TIMEOUT, GFP_KERNEL);
 	if (ret) {
 		dev_err(pod->line6.ifcdev, "read request failed (error %d)\n", ret);
 		goto exit;
@@ -200,7 +200,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
 	ret = usb_control_msg_recv(usbdev, 0, 0x67,
 					USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
 					0x11, 0x0,
-					init_bytes, 3, LINE6_TIMEOUT * HZ, GFP_KERNEL);
+					init_bytes, 3, LINE6_TIMEOUT, GFP_KERNEL);
 	if (ret) {
 		dev_err(pod->line6.ifcdev,
 			"receive length failed (error %d)\n", ret);
@@ -220,7 +220,7 @@ static int podhd_dev_start(struct usb_line6_podhd *pod)
 					USB_REQ_SET_FEATURE,
 					USB_TYPE_STANDARD | USB_RECIP_DEVICE | USB_DIR_OUT,
 					1, 0,
-					NULL, 0, LINE6_TIMEOUT * HZ, GFP_KERNEL);
+					NULL, 0, LINE6_TIMEOUT, GFP_KERNEL);
 exit:
 	return ret;
 }
diff --git a/sound/usb/line6/toneport.c b/sound/usb/line6/toneport.c
index 4e5693c97aa4..e33df58740a9 100644
--- a/sound/usb/line6/toneport.c
+++ b/sound/usb/line6/toneport.c
@@ -128,7 +128,7 @@ static int toneport_send_cmd(struct usb_device *usbdev, int cmd1, int cmd2)
 
 	ret = usb_control_msg_send(usbdev, 0, 0x67,
 				   USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
-				   cmd1, cmd2, NULL, 0, LINE6_TIMEOUT * HZ,
+				   cmd1, cmd2, NULL, 0, LINE6_TIMEOUT,
 				   GFP_KERNEL);
 
 	if (ret) {

From 9259518fab5bc80f88c1c902bd57b6807377fba8 Mon Sep 17 00:00:00 2001
From: Jason Ormes <skryking@gmail.com>
Date: Sat, 30 Oct 2021 15:04:05 -0500
Subject: [PATCH 1190/1750] ALSA: usb-audio: Line6 HX-Stomp XL USB_ID for
 48k-fixed quirk

commit 8f27b689066113a3e579d4df171c980c54368c4e upstream.

Adding the Line6 HX-Stomp XL USB_ID as it needs this fixed frequency
quirk as well.

The device is basically just the HX-Stomp with some more buttons on
the face.  I've done some recording with it after adding it, and it
seems to function properly with this fix.  The Midi features appear to
be working as well.

[ a coding style fix and patch reformat by tiwai ]

Signed-off-by: Jason Ormes <skryking@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211030200405.1358678-1-skryking@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/format.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/format.c b/sound/usb/format.c
index 5c5b76c61148..4693384db069 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -410,6 +410,7 @@ static int line6_parse_audio_format_rates_quirk(struct snd_usb_audio *chip,
 	case USB_ID(0x0e41, 0x4242): /* Line6 Helix Rack */
 	case USB_ID(0x0e41, 0x4244): /* Line6 Helix LT */
 	case USB_ID(0x0e41, 0x4246): /* Line6 HX-Stomp */
+	case USB_ID(0x0e41, 0x4253): /* Line6 HX-Stomp XL */
 	case USB_ID(0x0e41, 0x4247): /* Line6 Pod Go */
 	case USB_ID(0x0e41, 0x4248): /* Line6 Helix >= fw 2.82 */
 	case USB_ID(0x0e41, 0x4249): /* Line6 Helix Rack >= fw 2.82 */

From f503a25a3de3d8ce434277edee518555c6e89465 Mon Sep 17 00:00:00 2001
From: Alexander Tsoy <alexander@tsoy.me>
Date: Sat, 30 Oct 2021 20:43:08 +0300
Subject: [PATCH 1191/1750] ALSA: usb-audio: Add registration quirk for JBL
 Quantum 400

commit 763d92ed5dece7d439fc28a88b2d2728d525ffd9 upstream.

Add another device ID for JBL Quantum 400. It requires the same quirk as
other JBL Quantum devices.

Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211030174308.1011825-1-alexander@tsoy.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/usb/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a45b27a2ed4e..75d4d317b34b 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1897,6 +1897,7 @@ static const struct registration_quirk registration_quirks[] = {
 	REG_QUIRK_ENTRY(0x0951, 0x16ea, 2),	/* Kingston HyperX Cloud Flight S */
 	REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2),	/* JBL Quantum 600 */
 	REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2),	/* JBL Quantum 800 */
+	REG_QUIRK_ENTRY(0x0ecb, 0x1f4c, 2),	/* JBL Quantum 400 */
 	REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2),	/* JBL Quantum 400 */
 	REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2),	/* JBL Quantum 600 */
 	REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2),	/* JBL Quantum 800 */

From ecd536c57ab71ed1b06ebbc6231101545127cc0b Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 10 Nov 2021 20:46:33 +0100
Subject: [PATCH 1192/1750] ALSA: hda: Free card instance properly at probe
 errors

commit 39173303c83859723dab32c2abfb97296d6af3bf upstream.

The recent change in hda-intel driver to allow repeated probes
surfaced a problem that has been hidden until; the probe process in
the work calls azx_free() at the error path, and this skips the card
free process that eventually releases codec instances.  As a result,
we get a kernel WARNING like:

  snd_hda_intel 0000:00:1f.3: Cannot probe codecs, giving up
  ------------[ cut here ]------------
  WARNING: CPU: 14 PID: 186 at sound/hda/hdac_bus.c:73
  ....

For fixing this, we need to call snd_card_free() instead of
azx_free().  Additionally, the device drvdata has to be cleared, as
the driver binding itself is still active.  Then the PM and other
driver callbacks will ignore the procedure.

Fixes: c0f1886de7e1 ("ALSA: hda: intel: Allow repeatedly probing on codec configuration errors")
Reported-and-tested-by: Scott Branden <scott.branden@broadcom.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/063e2397-7edb-5f48-7b0d-618b938d9dd8@broadcom.com
Link: https://lore.kernel.org/r/20211110194633.19098-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/pci/hda/hda_intel.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 8bc27e7c0590..1bae0746e726 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2392,7 +2392,8 @@ static int azx_probe_continue(struct azx *chip)
 
 out_free:
 	if (err < 0) {
-		azx_free(chip);
+		pci_set_drvdata(pci, NULL);
+		snd_card_free(chip->card);
 		return err;
 	}
 

From 7c6fd525044c20082233f15312f62a9aee18ec38 Mon Sep 17 00:00:00 2001
From: Austin Kim <austin.kim@lge.com>
Date: Tue, 9 Nov 2021 00:37:42 +0000
Subject: [PATCH 1193/1750] ALSA: synth: missing check for possible NULL after
 the call to kstrdup

commit d159037abbe3412285c271bdfb9cdf19e62678ff upstream.

If kcalloc() return NULL due to memory starvation, it is possible for
kstrdup() to return NULL in similar case. So add null check after the call
to kstrdup() is made.

[ minor coding-style fix by tiwai ]

Signed-off-by: Austin Kim <austin.kim@lge.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211109003742.GA5423@raspberrypi
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/synth/emux/emux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/synth/emux/emux.c b/sound/synth/emux/emux.c
index f65e6c7b139f..6695530bba9b 100644
--- a/sound/synth/emux/emux.c
+++ b/sound/synth/emux/emux.c
@@ -88,7 +88,7 @@ int snd_emux_register(struct snd_emux *emu, struct snd_card *card, int index, ch
 	emu->name = kstrdup(name, GFP_KERNEL);
 	emu->voices = kcalloc(emu->max_voices, sizeof(struct snd_emux_voice),
 			      GFP_KERNEL);
-	if (emu->voices == NULL)
+	if (emu->name == NULL || emu->voices == NULL)
 		return -ENOMEM;
 
 	/* create soundfont list */

From b980ce4ebb8b8d79b71b63f374607fa434a1d9dd Mon Sep 17 00:00:00 2001
From: Wang Wensheng <wangwensheng4@huawei.com>
Date: Wed, 3 Nov 2021 03:35:17 +0000
Subject: [PATCH 1194/1750] ALSA: timer: Fix use-after-free problem

commit c0317c0e87094f5b5782b6fdef5ae0a4b150496c upstream.

When the timer instance was add into ack_list but was not currently in
process, the user could stop it via snd_timer_stop1() without delete it
from the ack_list. Then the user could free the timer instance and when
it was actually processed UAF occurred.

This issue could be reproduced via testcase snd_timer01 in ltp - running
several instances of that testcase at the same time.

What I actually met was that the ack_list of the timer broken and the
kernel went into deadloop with irqoff. That could be detected by
hardlockup detector on board or when we run it on qemu, we could use gdb
to dump the ack_list when the console has no response.

To fix this issue, we delete the timer instance from ack_list and
active_list unconditionally in snd_timer_stop1().

Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211103033517.80531-1-wangwensheng4@huawei.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/core/timer.c b/sound/core/timer.c
index c15c8314671b..963ddd9e7715 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -624,13 +624,13 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
 	if (!timer)
 		return -EINVAL;
 	spin_lock_irqsave(&timer->lock, flags);
+	list_del_init(&timeri->ack_list);
+	list_del_init(&timeri->active_list);
 	if (!(timeri->flags & (SNDRV_TIMER_IFLG_RUNNING |
 			       SNDRV_TIMER_IFLG_START))) {
 		result = -EBUSY;
 		goto unlock;
 	}
-	list_del_init(&timeri->ack_list);
-	list_del_init(&timeri->active_list);
 	if (timer->card && timer->card->shutdown)
 		goto unlock;
 	if (stop) {

From 782025948bc6ab36ebad2de20816b0302a3269a9 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Fri, 5 Nov 2021 10:15:17 +0100
Subject: [PATCH 1195/1750] ALSA: timer: Unconditionally unlink slave
 instances, too

commit ffdd98277f0a1d15a67a74ae09bee713df4c0dbc upstream.

Like the previous fix (commit c0317c0e8709 "ALSA: timer: Fix
use-after-free problem"), we have to unlink slave timer instances
immediately at snd_timer_stop(), too.  Otherwise it may leave a stale
entry in the list if the slave instance is freed before actually
running.

Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211105091517.21733-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/timer.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 963ddd9e7715..04cd8953605a 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -665,23 +665,22 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
 static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop)
 {
 	unsigned long flags;
+	bool running;
 
 	spin_lock_irqsave(&slave_active_lock, flags);
-	if (!(timeri->flags & SNDRV_TIMER_IFLG_RUNNING)) {
-		spin_unlock_irqrestore(&slave_active_lock, flags);
-		return -EBUSY;
-	}
+	running = timeri->flags & SNDRV_TIMER_IFLG_RUNNING;
 	timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
 	if (timeri->timer) {
 		spin_lock(&timeri->timer->lock);
 		list_del_init(&timeri->ack_list);
 		list_del_init(&timeri->active_list);
-		snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
-				  SNDRV_TIMER_EVENT_PAUSE);
+		if (running)
+			snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
+					  SNDRV_TIMER_EVENT_PAUSE);
 		spin_unlock(&timeri->timer->lock);
 	}
 	spin_unlock_irqrestore(&slave_active_lock, flags);
-	return 0;
+	return running ? 0 : -EBUSY;
 }
 
 /*

From aa21b7e3d3205322d11dbced09941702ef308d8d Mon Sep 17 00:00:00 2001
From: Shaoying Xu <shaoyi@amazon.com>
Date: Thu, 2 Sep 2021 16:44:12 +0000
Subject: [PATCH 1196/1750] ext4: fix lazy initialization next schedule time
 computation in more granular unit

commit 39fec6889d15a658c3a3ebb06fd69d3584ddffd3 upstream.

Ext4 file system has default lazy inode table initialization setup once
it is mounted. However, it has issue on computing the next schedule time
that makes the timeout same amount in jiffies but different real time in
secs if with various HZ values. Therefore, fix by measuring the current
time in a more granular unit nanoseconds and make the next schedule time
independent of the HZ value.

Fixes: bfff68738f1c ("ext4: add support for lazy inode table initialization")
Signed-off-by: Shaoying Xu <shaoyi@amazon.com>
Cc: stable@vger.kernel.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20210902164412.9994-2-shaoyi@amazon.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/super.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 953c7e875783..b1af6588bad0 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3436,9 +3436,9 @@ static int ext4_run_li_request(struct ext4_li_request *elr)
 	struct super_block *sb = elr->lr_super;
 	ext4_group_t ngroups = EXT4_SB(sb)->s_groups_count;
 	ext4_group_t group = elr->lr_next_group;
-	unsigned long timeout = 0;
 	unsigned int prefetch_ios = 0;
 	int ret = 0;
+	u64 start_time;
 
 	if (elr->lr_mode == EXT4_LI_MODE_PREFETCH_BBITMAP) {
 		elr->lr_next_group = ext4_mb_prefetch(sb, group,
@@ -3475,14 +3475,13 @@ static int ext4_run_li_request(struct ext4_li_request *elr)
 		ret = 1;
 
 	if (!ret) {
-		timeout = jiffies;
+		start_time = ktime_get_real_ns();
 		ret = ext4_init_inode_table(sb, group,
 					    elr->lr_timeout ? 0 : 1);
 		trace_ext4_lazy_itable_init(sb, group);
 		if (elr->lr_timeout == 0) {
-			timeout = (jiffies - timeout) *
-				EXT4_SB(elr->lr_super)->s_li_wait_mult;
-			elr->lr_timeout = timeout;
+			elr->lr_timeout = nsecs_to_jiffies((ktime_get_real_ns() - start_time) *
+				EXT4_SB(elr->lr_super)->s_li_wait_mult);
 		}
 		elr->lr_next_sched = jiffies + elr->lr_timeout;
 		elr->lr_next_group = group + 1;

From 4089432dc0302a981bfc7e3fe63885eb0a6c8589 Mon Sep 17 00:00:00 2001
From: yangerkun <yangerkun@huawei.com>
Date: Fri, 3 Sep 2021 14:27:47 +0800
Subject: [PATCH 1197/1750] ext4: ensure enough credits in
 ext4_ext_shift_path_extents

commit 4268496e48dc681cfa53b92357314b5d7221e625 upstream.

Like ext4_ext_rm_leaf, we can ensure that there are enough credits
before every call that will consume credits.  As part of this fix we
fold the functionality of ext4_access_path() into
ext4_ext_shift_path_extents().  This change is needed as a preparation
for the next bugfix patch.

Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20210903062748.4118886-3-yangerkun@huawei.com
Signed-off-by: yangerkun <yangerkun@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents.c | 49 +++++++++++++++--------------------------------
 1 file changed, 15 insertions(+), 34 deletions(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index aa4d74f9d162..98e0194a7b17 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4970,36 +4970,6 @@ int ext4_get_es_cache(struct inode *inode, struct fiemap_extent_info *fieinfo,
 	return ext4_fill_es_cache_info(inode, start_blk, len_blks, fieinfo);
 }
 
-/*
- * ext4_access_path:
- * Function to access the path buffer for marking it dirty.
- * It also checks if there are sufficient credits left in the journal handle
- * to update path.
- */
-static int
-ext4_access_path(handle_t *handle, struct inode *inode,
-		struct ext4_ext_path *path)
-{
-	int credits, err;
-
-	if (!ext4_handle_valid(handle))
-		return 0;
-
-	/*
-	 * Check if need to extend journal credits
-	 * 3 for leaf, sb, and inode plus 2 (bmap and group
-	 * descriptor) for each block group; assume two block
-	 * groups
-	 */
-	credits = ext4_writepage_trans_blocks(inode);
-	err = ext4_datasem_ensure_credits(handle, inode, 7, credits, 0);
-	if (err < 0)
-		return err;
-
-	err = ext4_ext_get_access(handle, inode, path);
-	return err;
-}
-
 /*
  * ext4_ext_shift_path_extents:
  * Shift the extents of a path structure lying between path[depth].p_ext
@@ -5014,6 +4984,7 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift,
 	int depth, err = 0;
 	struct ext4_extent *ex_start, *ex_last;
 	bool update = false;
+	int credits, restart_credits;
 	depth = path->p_depth;
 
 	while (depth >= 0) {
@@ -5023,13 +4994,23 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift,
 				return -EFSCORRUPTED;
 
 			ex_last = EXT_LAST_EXTENT(path[depth].p_hdr);
+			/* leaf + sb + inode */
+			credits = 3;
+			if (ex_start == EXT_FIRST_EXTENT(path[depth].p_hdr)) {
+				update = true;
+				/* extent tree + sb + inode */
+				credits = depth + 2;
+			}
 
-			err = ext4_access_path(handle, inode, path + depth);
+			restart_credits = ext4_writepage_trans_blocks(inode);
+			err = ext4_datasem_ensure_credits(handle, inode, credits,
+					restart_credits, 0);
 			if (err)
 				goto out;
 
-			if (ex_start == EXT_FIRST_EXTENT(path[depth].p_hdr))
-				update = true;
+			err = ext4_ext_get_access(handle, inode, path + depth);
+			if (err)
+				goto out;
 
 			while (ex_start <= ex_last) {
 				if (SHIFT == SHIFT_LEFT) {
@@ -5060,7 +5041,7 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift,
 		}
 
 		/* Update index too */
-		err = ext4_access_path(handle, inode, path + depth);
+		err = ext4_ext_get_access(handle, inode, path + depth);
 		if (err)
 			goto out;
 

From d81e341fb13ad8cd21e10d795c577c060dab130d Mon Sep 17 00:00:00 2001
From: yangerkun <yangerkun@huawei.com>
Date: Fri, 3 Sep 2021 14:27:48 +0800
Subject: [PATCH 1198/1750] ext4: refresh the ext4_ext_path struct after
 dropping i_data_sem.

commit 1811bc401aa58c7bdb0df3205aa6613b49d32127 upstream.

After we drop i_data sem, we need to reload the ext4_ext_path
structure since the extent tree can change once i_data_sem is
released.

This addresses the BUG:

[52117.465187] ------------[ cut here ]------------
[52117.465686] kernel BUG at fs/ext4/extents.c:1756!
...
[52117.478306] Call Trace:
[52117.478565]  ext4_ext_shift_extents+0x3ee/0x710
[52117.479020]  ext4_fallocate+0x139c/0x1b40
[52117.479405]  ? __do_sys_newfstat+0x6b/0x80
[52117.479805]  vfs_fallocate+0x151/0x4b0
[52117.480177]  ksys_fallocate+0x4a/0xa0
[52117.480533]  __x64_sys_fallocate+0x22/0x30
[52117.480930]  do_syscall_64+0x35/0x80
[52117.481277]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[52117.481769] RIP: 0033:0x7fa062f855ca

Cc: stable@kernel.org
Link: https://lore.kernel.org/r/20210903062748.4118886-4-yangerkun@huawei.com
Signed-off-by: yangerkun <yangerkun@huawei.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/ext4/extents.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 98e0194a7b17..c2f237653f68 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -5005,8 +5005,11 @@ ext4_ext_shift_path_extents(struct ext4_ext_path *path, ext4_lblk_t shift,
 			restart_credits = ext4_writepage_trans_blocks(inode);
 			err = ext4_datasem_ensure_credits(handle, inode, credits,
 					restart_credits, 0);
-			if (err)
+			if (err) {
+				if (err > 0)
+					err = -EAGAIN;
 				goto out;
+			}
 
 			err = ext4_ext_get_access(handle, inode, path + depth);
 			if (err)
@@ -5080,6 +5083,7 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
 	int ret = 0, depth;
 	struct ext4_extent *extent;
 	ext4_lblk_t stop, *iterator, ex_start, ex_end;
+	ext4_lblk_t tmp = EXT_MAX_BLOCKS;
 
 	/* Let path point to the last extent */
 	path = ext4_find_extent(inode, EXT_MAX_BLOCKS - 1, NULL,
@@ -5133,11 +5137,15 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
 	 * till we reach stop. In case of right shift, iterator points to stop
 	 * and it is decreased till we reach start.
 	 */
+again:
 	if (SHIFT == SHIFT_LEFT)
 		iterator = &start;
 	else
 		iterator = &stop;
 
+	if (tmp != EXT_MAX_BLOCKS)
+		*iterator = tmp;
+
 	/*
 	 * Its safe to start updating extents.  Start and stop are unsigned, so
 	 * in case of right shift if extent with 0 block is reached, iterator
@@ -5166,6 +5174,7 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
 			}
 		}
 
+		tmp = *iterator;
 		if (SHIFT == SHIFT_LEFT) {
 			extent = EXT_LAST_EXTENT(path[depth].p_hdr);
 			*iterator = le32_to_cpu(extent->ee_block) +
@@ -5184,6 +5193,9 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
 		}
 		ret = ext4_ext_shift_path_extents(path, shift, inode,
 				handle, SHIFT);
+		/* iterator can be NULL which means we should break */
+		if (ret == -EAGAIN)
+			goto again;
 		if (ret)
 			break;
 	}

From b05eea1bcb363dc2aa139ddb1b1876fb6ef85977 Mon Sep 17 00:00:00 2001
From: Miklos Szeredi <mszeredi@redhat.com>
Date: Tue, 2 Nov 2021 11:10:37 +0100
Subject: [PATCH 1199/1750] fuse: fix page stealing

commit 712a951025c0667ff00b25afc360f74e639dfabe upstream.

It is possible to trigger a crash by splicing anon pipe bufs to the fuse
device.

The reason for this is that anon_pipe_buf_release() will reuse buf->page if
the refcount is 1, but that page might have already been stolen and its
flags modified (e.g. PG_lru added).

This happens in the unlikely case of fuse_dev_splice_write() getting around
to calling pipe_buf_release() after a page has been stolen, added to the
page cache and removed from the page cache.

Fix by calling pipe_buf_release() right after the page was inserted into
the page cache.  In this case the page has an elevated refcount so any
release function will know that the page isn't reusable.

Reported-by: Frank Dinoff <fdinoff@google.com>
Link: https://lore.kernel.org/r/CAAmZXrsGg2xsP1CK+cbuEMumtrqdvD-NKnWzhNcvn71RV3c1yw@mail.gmail.com/
Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device")
Cc: <stable@vger.kernel.org> # v2.6.35
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/dev.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index f943eea9fe4e..fb1917730e0e 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -851,6 +851,12 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
 		goto out_put_old;
 	}
 
+	/*
+	 * Release while we have extra ref on stolen page.  Otherwise
+	 * anon_pipe_buf_release() might think the page can be reused.
+	 */
+	pipe_buf_release(cs->pipe, buf);
+
 	get_page(newpage);
 
 	if (!(buf->flags & PIPE_BUF_FLAG_LRU))
@@ -2035,8 +2041,12 @@ static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
 
 	pipe_lock(pipe);
 out_free:
-	for (idx = 0; idx < nbuf; idx++)
-		pipe_buf_release(pipe, &bufs[idx]);
+	for (idx = 0; idx < nbuf; idx++) {
+		struct pipe_buffer *buf = &bufs[idx];
+
+		if (buf->ops)
+			pipe_buf_release(pipe, buf);
+	}
 	pipe_unlock(pipe);
 
 	kvfree(bufs);

From 115810a265273c052e754af60ab4faed908838de Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Fri, 15 Oct 2021 12:24:16 -0500
Subject: [PATCH 1200/1750] x86/sme: Use #define USE_EARLY_PGTABLE_L5 in
 mem_encrypt_identity.c

commit e7d445ab26db833d6640d4c9a08bee176777cc82 upstream.

When runtime support for converting between 4-level and 5-level pagetables
was added to the kernel, the SME code that built pagetables was updated
to use the pagetable functions, e.g. p4d_offset(), etc., in order to
simplify the code. However, the use of the pagetable functions in early
boot code requires the use of the USE_EARLY_PGTABLE_L5 #define in order to
ensure that the proper definition of pgtable_l5_enabled() is used.

Without the #define, pgtable_l5_enabled() is #defined as
cpu_feature_enabled(X86_FEATURE_LA57). In early boot, the CPU features
have not yet been discovered and populated, so pgtable_l5_enabled() will
return false even when 5-level paging is enabled. This causes the SME code
to always build 4-level pagetables to perform the in-place encryption.
If 5-level paging is enabled, switching to the SME pagetables results in
a page-fault that kills the boot.

Adding the #define results in pgtable_l5_enabled() using the
__pgtable_l5_enabled variable set in early boot and the SME code building
pagetables for the proper paging level.

Fixes: aad983913d77 ("x86/mm/encrypt: Simplify sme_populate_pgd() and sme_populate_pgd_large()")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org> # 4.18.x
Link: https://lkml.kernel.org/r/2cb8329655f5c753905812d951e212022a480475.1634318656.git.thomas.lendacky@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/mm/mem_encrypt_identity.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
index 65f599e9075b..011e042b47ba 100644
--- a/arch/x86/mm/mem_encrypt_identity.c
+++ b/arch/x86/mm/mem_encrypt_identity.c
@@ -27,6 +27,15 @@
 #undef CONFIG_PARAVIRT_XXL
 #undef CONFIG_PARAVIRT_SPINLOCKS
 
+/*
+ * This code runs before CPU feature bits are set. By default, the
+ * pgtable_l5_enabled() function uses bit X86_FEATURE_LA57 to determine if
+ * 5-level paging is active, so that won't work here. USE_EARLY_PGTABLE_L5
+ * is provided to handle this situation and, instead, use a variable that
+ * has been set by the early boot code.
+ */
+#define USE_EARLY_PGTABLE_L5
+
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/mem_encrypt.h>

From df8a74fc15ea59bdd1a1aebc8b1187370576e4e1 Mon Sep 17 00:00:00 2001
From: Jane Malalane <jane.malalane@citrix.com>
Date: Thu, 21 Oct 2021 11:47:44 +0100
Subject: [PATCH 1201/1750] x86/cpu: Fix migration safety with X86_BUG_NULL_SEL

commit 415de44076640483648d6c0f6d645a9ee61328ad upstream.

Currently, Linux probes for X86_BUG_NULL_SEL unconditionally which
makes it unsafe to migrate in a virtualised environment as the
properties across the migration pool might differ.

To be specific, the case which goes wrong is:

1. Zen1 (or earlier) and Zen2 (or later) in a migration pool
2. Linux boots on Zen2, probes and finds the absence of X86_BUG_NULL_SEL
3. Linux is then migrated to Zen1

Linux is now running on a X86_BUG_NULL_SEL-impacted CPU while believing
that the bug is fixed.

The only way to address the problem is to fully trust the "no longer
affected" CPUID bit when virtualised, because in the above case it would
be clear deliberately to indicate the fact "you might migrate to
somewhere which has this behaviour".

Zen3 adds the NullSelectorClearsBase CPUID bit to indicate that loading
a NULL segment selector zeroes the base and limit fields, as well as
just attributes. Zen2 also has this behaviour but doesn't have the NSCB
bit.

 [ bp: Minor touchups. ]

Signed-off-by: Jane Malalane <jane.malalane@citrix.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
CC: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20211021104744.24126-1-jane.malalane@citrix.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/amd.c    |  2 ++
 arch/x86/kernel/cpu/common.c | 44 ++++++++++++++++++++++++++++++------
 arch/x86/kernel/cpu/cpu.h    |  1 +
 arch/x86/kernel/cpu/hygon.c  |  2 ++
 4 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index a2551b10780c..acea05eed27d 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -1017,6 +1017,8 @@ static void init_amd(struct cpuinfo_x86 *c)
 	if (cpu_has(c, X86_FEATURE_IRPERF) &&
 	    !cpu_has_amd_erratum(c, amd_erratum_1054))
 		msr_set_bit(MSR_K7_HWCR, MSR_K7_HWCR_IRPERF_EN_BIT);
+
+	check_null_seg_clears_base(c);
 }
 
 #ifdef CONFIG_X86_32
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index ec21f5e9ffd0..9c8fc6f513ed 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1391,9 +1391,8 @@ void __init early_cpu_init(void)
 	early_identify_cpu(&boot_cpu_data);
 }
 
-static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
+static bool detect_null_seg_behavior(void)
 {
-#ifdef CONFIG_X86_64
 	/*
 	 * Empirically, writing zero to a segment selector on AMD does
 	 * not clear the base, whereas writing zero to a segment
@@ -1414,10 +1413,43 @@ static void detect_null_seg_behavior(struct cpuinfo_x86 *c)
 	wrmsrl(MSR_FS_BASE, 1);
 	loadsegment(fs, 0);
 	rdmsrl(MSR_FS_BASE, tmp);
-	if (tmp != 0)
-		set_cpu_bug(c, X86_BUG_NULL_SEG);
 	wrmsrl(MSR_FS_BASE, old_base);
-#endif
+	return tmp == 0;
+}
+
+void check_null_seg_clears_base(struct cpuinfo_x86 *c)
+{
+	/* BUG_NULL_SEG is only relevant with 64bit userspace */
+	if (!IS_ENABLED(CONFIG_X86_64))
+		return;
+
+	/* Zen3 CPUs advertise Null Selector Clears Base in CPUID. */
+	if (c->extended_cpuid_level >= 0x80000021 &&
+	    cpuid_eax(0x80000021) & BIT(6))
+		return;
+
+	/*
+	 * CPUID bit above wasn't set. If this kernel is still running
+	 * as a HV guest, then the HV has decided not to advertize
+	 * that CPUID bit for whatever reason.	For example, one
+	 * member of the migration pool might be vulnerable.  Which
+	 * means, the bug is present: set the BUG flag and return.
+	 */
+	if (cpu_has(c, X86_FEATURE_HYPERVISOR)) {
+		set_cpu_bug(c, X86_BUG_NULL_SEG);
+		return;
+	}
+
+	/*
+	 * Zen2 CPUs also have this behaviour, but no CPUID bit.
+	 * 0x18 is the respective family for Hygon.
+	 */
+	if ((c->x86 == 0x17 || c->x86 == 0x18) &&
+	    detect_null_seg_behavior())
+		return;
+
+	/* All the remaining ones are affected */
+	set_cpu_bug(c, X86_BUG_NULL_SEG);
 }
 
 static void generic_identify(struct cpuinfo_x86 *c)
@@ -1453,8 +1485,6 @@ static void generic_identify(struct cpuinfo_x86 *c)
 
 	get_model_name(c); /* Default name */
 
-	detect_null_seg_behavior(c);
-
 	/*
 	 * ESPFIX is a strange bug.  All real CPUs have it.  Paravirt
 	 * systems that run Linux at CPL > 0 may or may not have the
diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
index 67944128876d..093f5fc860e3 100644
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -73,6 +73,7 @@ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
 extern int detect_extended_topology(struct cpuinfo_x86 *c);
 extern int detect_ht_early(struct cpuinfo_x86 *c);
 extern void detect_ht(struct cpuinfo_x86 *c);
+extern void check_null_seg_clears_base(struct cpuinfo_x86 *c);
 
 unsigned int aperfmperf_get_khz(int cpu);
 
diff --git a/arch/x86/kernel/cpu/hygon.c b/arch/x86/kernel/cpu/hygon.c
index dc0840aae26c..b78c471ec344 100644
--- a/arch/x86/kernel/cpu/hygon.c
+++ b/arch/x86/kernel/cpu/hygon.c
@@ -351,6 +351,8 @@ static void init_hygon(struct cpuinfo_x86 *c)
 	/* Hygon CPUs don't reset SS attributes on SYSRET, Xen does. */
 	if (!cpu_has(c, X86_FEATURE_XENPV))
 		set_cpu_bug(c, X86_BUG_SYSRET_SS_ATTRS);
+
+	check_null_seg_clears_base(c);
 }
 
 static void cpu_detect_tlb_hygon(struct cpuinfo_x86 *c)

From 73199aadcd5c56be232902debe74e2d6a4080313 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Fri, 8 Oct 2021 17:11:04 -0700
Subject: [PATCH 1202/1750] x86/irq: Ensure PI wakeup handler is unregistered
 before module unload

commit 6ff53f6a438f72998f56e82e76694a1df9d1ea2c upstream.

Add a synchronize_rcu() after clearing the posted interrupt wakeup handler
to ensure all readers, i.e. in-flight IRQ handlers, see the new handler
before returning to the caller.  If the caller is an exiting module and
is unregistering its handler, failure to wait could result in the IRQ
handler jumping into an unloaded module.

The registration path doesn't require synchronization, as it's the
caller's responsibility to not generate interrupts it cares about until
after its handler is registered.

Fixes: f6b3c72c2366 ("x86/irq: Define a global vector for VT-d Posted-Interrupts")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211009001107.3936588-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/irq.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index c5dd50369e2f..ce904c89c6c7 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -290,8 +290,10 @@ void kvm_set_posted_intr_wakeup_handler(void (*handler)(void))
 {
 	if (handler)
 		kvm_posted_intr_wakeup_handler = handler;
-	else
+	else {
 		kvm_posted_intr_wakeup_handler = dummy_handler;
+		synchronize_rcu();
+	}
 }
 EXPORT_SYMBOL_GPL(kvm_set_posted_intr_wakeup_handler);
 

From 92556e3c2b2ed414225282b0024868b65ba3aafc Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Sat, 9 Oct 2021 14:58:40 +0800
Subject: [PATCH 1203/1750] ASoC: soc-core: fix null-ptr-deref in
 snd_soc_del_component_unlocked()

[ Upstream commit c448b7aa3e66042fc0f849d9a0fb90d1af82e948 ]

'component' is allocated in snd_soc_register_component(), but component->list
is not initalized, this may cause snd_soc_del_component_unlocked() deref null
ptr in the error handing case.

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:__list_del_entry_valid+0x81/0xf0
Call Trace:
 snd_soc_del_component_unlocked+0x69/0x1b0 [snd_soc_core]
 snd_soc_add_component.cold+0x54/0x6c [snd_soc_core]
 snd_soc_register_component+0x70/0x90 [snd_soc_core]
 devm_snd_soc_register_component+0x5e/0xd0 [snd_soc_core]
 tas2552_probe+0x265/0x320 [snd_soc_tas2552]
 ? tas2552_component_probe+0x1e0/0x1e0 [snd_soc_tas2552]
 i2c_device_probe+0xa31/0xbe0

Fix by adding INIT_LIST_HEAD() to snd_soc_component_initialize().

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211009065840.3196239-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/soc-core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index e677422c1058..133296596864 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2454,6 +2454,7 @@ int snd_soc_component_initialize(struct snd_soc_component *component,
 	INIT_LIST_HEAD(&component->dai_list);
 	INIT_LIST_HEAD(&component->dobj_list);
 	INIT_LIST_HEAD(&component->card_list);
+	INIT_LIST_HEAD(&component->list);
 	mutex_init(&component->io_mutex);
 
 	component->name = fmt_single_name(dev, &component->id);

From 75710d583cc4ccdfad1d94078ab8368a7353a5df Mon Sep 17 00:00:00 2001
From: Davide Baldo <davide@baldo.me>
Date: Fri, 15 Oct 2021 09:21:22 +0200
Subject: [PATCH 1204/1750] ALSA: hda/realtek: Fixes HP Spectre x360 15-eb1xxx
 speakers

[ Upstream commit d94befbb5ae379f6dfd4fa6d460eacc09fa7b9c3 ]

In laptop 'HP Spectre x360 Convertible 15-eb1xxx/8811' both front and
rear speakers are silent, this patch fixes that by overriding the pin
layout and by initializing the amplifier which needs a GPIO pin to be
set to 1 then 0, similar to the existing HP Spectre x360 14 model.

In order to have volume control, both front and rear speakers were
forced to use the DAC1.

This patch also correctly map the mute LED but since there is no
microphone on/off switch exposed by the alsa subsystem it never turns
on by itself.

There are still known audio issues in this laptop: headset microphone
doesn't work, the button to mute/unmute microphone is not yet mapped,
the LED of the mute/unmute speakers doesn't seems to be exposed via
GPIO and never turns on.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213953
Signed-off-by: Davide Baldo <davide@baldo.me>
Link: https://lore.kernel.org/r/20211015072121.5287-1-davide@baldo.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/patch_realtek.c | 46 +++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 5b2827514705..2eb06351de1f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6363,6 +6363,44 @@ static void alc_fixup_no_int_mic(struct hda_codec *codec,
 	}
 }
 
+/* GPIO1 = amplifier on/off
+ * GPIO3 = mic mute LED
+ */
+static void alc285_fixup_hp_spectre_x360_eb1(struct hda_codec *codec,
+					  const struct hda_fixup *fix, int action)
+{
+	static const hda_nid_t conn[] = { 0x02 };
+
+	struct alc_spec *spec = codec->spec;
+	static const struct hda_pintbl pincfgs[] = {
+		{ 0x14, 0x90170110 },  /* front/high speakers */
+		{ 0x17, 0x90170130 },  /* back/bass speakers */
+		{ }
+	};
+
+	//enable micmute led
+	alc_fixup_hp_gpio_led(codec, action, 0x00, 0x04);
+
+	switch (action) {
+	case HDA_FIXUP_ACT_PRE_PROBE:
+		spec->micmute_led_polarity = 1;
+		/* needed for amp of back speakers */
+		spec->gpio_mask |= 0x01;
+		spec->gpio_dir |= 0x01;
+		snd_hda_apply_pincfgs(codec, pincfgs);
+		/* share DAC to have unified volume control */
+		snd_hda_override_conn_list(codec, 0x14, ARRAY_SIZE(conn), conn);
+		snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn);
+		break;
+	case HDA_FIXUP_ACT_INIT:
+		/* need to toggle GPIO to enable the amp of back speakers */
+		alc_update_gpio_data(codec, 0x01, true);
+		msleep(100);
+		alc_update_gpio_data(codec, 0x01, false);
+		break;
+	}
+}
+
 static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec,
 					  const struct hda_fixup *fix, int action)
 {
@@ -6515,6 +6553,7 @@ enum {
 	ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED,
 	ALC280_FIXUP_HP_9480M,
 	ALC245_FIXUP_HP_X360_AMP,
+	ALC285_FIXUP_HP_SPECTRE_X360_EB1,
 	ALC288_FIXUP_DELL_HEADSET_MODE,
 	ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
 	ALC288_FIXUP_DELL_XPS_13,
@@ -8205,6 +8244,10 @@ static const struct hda_fixup alc269_fixups[] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc285_fixup_hp_spectre_x360,
 	},
+	[ALC285_FIXUP_HP_SPECTRE_X360_EB1] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc285_fixup_hp_spectre_x360_eb1
+	},
 	[ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc285_fixup_ideapad_s740_coef,
@@ -8555,6 +8598,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
 	SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
+	SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
+	SND_PCI_QUIRK(0x103c, 0x8812, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
 	SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
 	SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
@@ -8979,6 +9024,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
 	{.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"},
 	{.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"},
 	{.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"},
+	{.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"},
 	{.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
 	{.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
 	{.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"},

From 940783d08d1592619d3de15931de38c6da09cf13 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Mon, 18 Oct 2021 02:16:22 +0000
Subject: [PATCH 1205/1750] cavium: Return negative value when
 pci_alloc_irq_vectors() fails

[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ]

During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 9361f964bb9b..816453a4f8d6 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -1193,7 +1193,7 @@ static int nic_register_interrupts(struct nicpf *nic)
 		dev_err(&nic->pdev->dev,
 			"Request for #%d msix vectors failed, returned %d\n",
 			   nic->num_vec, ret);
-		return 1;
+		return ret;
 	}
 
 	/* Register mailbox interrupt handler */

From 77fee241e6eb95a3ef317a1243e4a6f0f439f9d2 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Mon, 18 Oct 2021 01:56:21 +0000
Subject: [PATCH 1206/1750] scsi: qla2xxx: Return -ENOMEM if kzalloc() fails

[ Upstream commit 06634d5b6e923ed0d4772aba8def5a618f44c7fe ]

The driver probing function should return < 0 for failure, otherwise
kernel will treat value > 0 as success.

Link: https://lore.kernel.org/r/1634522181-31166-1-git-send-email-zheyuma97@gmail.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_os.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index e075f855f298..813abaf1b087 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -4079,7 +4079,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
 					ql_dbg_pci(ql_dbg_init, ha->pdev,
 					    0xe0ee, "%s: failed alloc dsd\n",
 					    __func__);
-					return 1;
+					return -ENOMEM;
 				}
 				ha->dif_bundle_kallocs++;
 

From a6cb5e09e16a049ac7f5d44d5cde0f65c72bda83 Mon Sep 17 00:00:00 2001
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
Date: Mon, 18 Oct 2021 15:26:50 +0300
Subject: [PATCH 1207/1750] scsi: qla2xxx: Fix unmap of already freed sgl

[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ]

The sgl is freed in the target stack in target_release_cmd_kref() before
calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that
causes a panic if sgl is not yet DMA unmapped:

NIP dma_direct_unmap_sg+0xdc/0x180
LR  dma_direct_unmap_sg+0xc8/0x180
Call Trace:
 ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable)
 dma_unmap_sg_attrs+0x54/0xf0
 qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx]
 qlt_free_cmd+0x124/0x1d0 [qla2xxx]
 tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx]
 target_put_sess_cmd+0x198/0x370 [target_core_mod]
 transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod]
 tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx]

The sgl may be left unmapped in error cases of response sending.  For
instance, qlt_rdy_to_xfer() maps sgl and exits when session is being
deleted keeping the sgl mapped.

This patch removes use-after-free of the sgl and ensures that the sgl is
unmapped for any command that was not sent to firmware.

Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_target.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 8d4976725a75..ebed14bed783 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3256,8 +3256,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
 			"RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n",
 			vha->flags.online, qla2x00_reset_active(vha),
 			cmd->reset_count, qpair->chip_reset);
-		spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
-		return 0;
+		goto out_unmap_unlock;
 	}
 
 	/* Does F/W have an IOCBs for this request */
@@ -3380,10 +3379,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
 	prm.sg = NULL;
 	prm.req_cnt = 1;
 
-	/* Calculate number of entries and segments required */
-	if (qlt_pci_map_calc_cnt(&prm) != 0)
-		return -EAGAIN;
-
 	if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
 	    (cmd->sess && cmd->sess->deleted)) {
 		/*
@@ -3401,6 +3396,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
 		return 0;
 	}
 
+	/* Calculate number of entries and segments required */
+	if (qlt_pci_map_calc_cnt(&prm) != 0)
+		return -EAGAIN;
+
 	spin_lock_irqsave(qpair->qp_lock_ptr, flags);
 	/* Does F/W have an IOCBs for this request */
 	res = qlt_check_reserve_free_req(qpair, prm.req_cnt);
@@ -3805,9 +3804,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
 
 	BUG_ON(cmd->cmd_in_wq);
 
-	if (cmd->sg_mapped)
-		qlt_unmap_sg(cmd->vha, cmd);
-
 	if (!cmd->q_full)
 		qlt_decr_num_pend_cmds(cmd->vha);
 

From ad01685177ce41afeab8c878405935c817487227 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Mon, 18 Oct 2021 14:20:38 +0000
Subject: [PATCH 1208/1750] mISDN: Fix return values of the probe function

[ Upstream commit e211210098cb7490db2183d725f5c0f10463a704 ]

During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/isdn/hardware/mISDN/hfcpci.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c
index e501cb03f211..bd087cca1c1d 100644
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -1994,14 +1994,14 @@ setup_hw(struct hfc_pci *hc)
 	pci_set_master(hc->pdev);
 	if (!hc->irq) {
 		printk(KERN_WARNING "HFC-PCI: No IRQ for PCI card found\n");
-		return 1;
+		return -EINVAL;
 	}
 	hc->hw.pci_io =
 		(char __iomem *)(unsigned long)hc->pdev->resource[1].start;
 
 	if (!hc->hw.pci_io) {
 		printk(KERN_WARNING "HFC-PCI: No IO-Mem for PCI card found\n");
-		return 1;
+		return -ENOMEM;
 	}
 	/* Allocate memory for FIFOS */
 	/* the memory needs to be on a 32k boundary within the first 4G */
@@ -2012,7 +2012,7 @@ setup_hw(struct hfc_pci *hc)
 	if (!buffer) {
 		printk(KERN_WARNING
 		       "HFC-PCI: Error allocating memory for FIFO!\n");
-		return 1;
+		return -ENOMEM;
 	}
 	hc->hw.fifos = buffer;
 	pci_write_config_dword(hc->pdev, 0x80, hc->hw.dmahandle);
@@ -2022,7 +2022,7 @@ setup_hw(struct hfc_pci *hc)
 		       "HFC-PCI: Error in ioremap for PCI!\n");
 		dma_free_coherent(&hc->pdev->dev, 0x8000, hc->hw.fifos,
 				  hc->hw.dmahandle);
-		return 1;
+		return -ENOMEM;
 	}
 
 	printk(KERN_INFO

From 7986fdbbe0090d208a2299d432f806979f6611b2 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Mon, 18 Oct 2021 14:32:57 +0000
Subject: [PATCH 1209/1750] cavium: Fix return values of the probe function

[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ]

During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index f3b7b443f964..c00f1a7ffc15 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1226,7 +1226,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
 	if (ret < 0) {
 		netdev_err(nic->netdev,
 			   "Req for #%d msix vectors failed\n", nic->num_vec);
-		return 1;
+		return ret;
 	}
 
 	sprintf(nic->irq_name[irq], "%s Mbox", "NICVF");
@@ -1245,7 +1245,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
 	if (!nicvf_check_pf_ready(nic)) {
 		nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
 		nicvf_unregister_interrupts(nic);
-		return 1;
+		return -EIO;
 	}
 
 	return 0;

From e519acba2faeca5259fe7126850a28ff76500819 Mon Sep 17 00:00:00 2001
From: Erik Ekman <erik@kryo.se>
Date: Tue, 19 Oct 2021 23:13:32 +0200
Subject: [PATCH 1210/1750] sfc: Export fibre-specific supported link modes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c62041c5baa9ded3bc6fd38d3f724de70683b489 ]

The 1/10GbaseT modes were set up for cards with SFP+ cages in
3497ed8c852a5 ("sfc: report supported link speeds on SFP connections").
10GbaseT was likely used since no 10G fibre mode existed.

The missing fibre modes for 1/10G were added to ethtool.h in 5711a9822144
("net: ethtool: add support for 1000BaseX and missing 10G link modes")
shortly thereafter.

The user guide available at https://support-nic.xilinx.com/wp/drivers
lists support for the following cable and transceiver types in section 2.9:
- QSFP28 100G Direct Attach Cables
- QSFP28 100G SR Optical Transceivers (with SR4 modules listed)
- SFP28 25G Direct Attach Cables
- SFP28 25G SR Optical Transceivers
- QSFP+ 40G Direct Attach Cables
- QSFP+ 40G Active Optical Cables
- QSFP+ 40G SR4 Optical Transceivers
- QSFP+ to SFP+ Breakout Direct Attach Cables
- QSFP+ to SFP+ Breakout Active Optical Cables
- SFP+ 10G Direct Attach Cables
- SFP+ 10G SR Optical Transceivers
- SFP+ 10G LR Optical Transceivers
- SFP 1000BASE‐T Transceivers
- 1G Optical Transceivers
(From user guide issue 28. Issue 16 which also includes older cards like
SFN5xxx/SFN6xxx has matching lists for 1/10/40G transceiver types.)

Regarding SFP+ 10GBASE‐T transceivers the latest guide says:
"Solarflare adapters do not support 10GBASE‐T transceiver modules."

Tested using SFN5122F-R7 (with 2 SFP+ ports). Supported link modes do not change
depending on module used (tested with 1000BASE-T, 1000BASE-BX10, 10GBASE-LR).
Before:

$ ethtool ext
Settings for ext:
	Supported ports: [ FIBRE ]
	Supported link modes:   1000baseT/Full
	                        10000baseT/Full
	Supported pause frame use: Symmetric Receive-only
	Supports auto-negotiation: No
	Supported FEC modes: Not reported
	Advertised link modes:  Not reported
	Advertised pause frame use: No
	Advertised auto-negotiation: No
	Advertised FEC modes: Not reported
	Link partner advertised link modes:  Not reported
	Link partner advertised pause frame use: No
	Link partner advertised auto-negotiation: No
	Link partner advertised FEC modes: Not reported
	Speed: 1000Mb/s
	Duplex: Full
	Auto-negotiation: off
	Port: FIBRE
	PHYAD: 255
	Transceiver: internal
        Current message level: 0x000020f7 (8439)
                               drv probe link ifdown ifup rx_err tx_err hw
	Link detected: yes

After:

$ ethtool ext
Settings for ext:
	Supported ports: [ FIBRE ]
	Supported link modes:   1000baseT/Full
	                        1000baseX/Full
	                        10000baseCR/Full
	                        10000baseSR/Full
	                        10000baseLR/Full
	Supported pause frame use: Symmetric Receive-only
	Supports auto-negotiation: No
	Supported FEC modes: Not reported
	Advertised link modes:  Not reported
	Advertised pause frame use: No
	Advertised auto-negotiation: No
	Advertised FEC modes: Not reported
	Link partner advertised link modes:  Not reported
	Link partner advertised pause frame use: No
	Link partner advertised auto-negotiation: No
	Link partner advertised FEC modes: Not reported
	Speed: 1000Mb/s
	Duplex: Full
	Auto-negotiation: off
	Port: FIBRE
	PHYAD: 255
	Transceiver: internal
	Supports Wake-on: g
	Wake-on: d
        Current message level: 0x000020f7 (8439)
                               drv probe link ifdown ifup rx_err tx_err hw
	Link detected: yes

Signed-off-by: Erik Ekman <erik@kryo.se>
Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sfc/mcdi_port_common.c | 37 +++++++++++++++------
 1 file changed, 26 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/sfc/mcdi_port_common.c b/drivers/net/ethernet/sfc/mcdi_port_common.c
index 4bd3ef8f3384..c4fe3c48ac46 100644
--- a/drivers/net/ethernet/sfc/mcdi_port_common.c
+++ b/drivers/net/ethernet/sfc/mcdi_port_common.c
@@ -132,16 +132,27 @@ void mcdi_to_ethtool_linkset(u32 media, u32 cap, unsigned long *linkset)
 	case MC_CMD_MEDIA_SFP_PLUS:
 	case MC_CMD_MEDIA_QSFP_PLUS:
 		SET_BIT(FIBRE);
-		if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN))
+		if (cap & (1 << MC_CMD_PHY_CAP_1000FDX_LBN)) {
 			SET_BIT(1000baseT_Full);
-		if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN))
-			SET_BIT(10000baseT_Full);
-		if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN))
+			SET_BIT(1000baseX_Full);
+		}
+		if (cap & (1 << MC_CMD_PHY_CAP_10000FDX_LBN)) {
+			SET_BIT(10000baseCR_Full);
+			SET_BIT(10000baseLR_Full);
+			SET_BIT(10000baseSR_Full);
+		}
+		if (cap & (1 << MC_CMD_PHY_CAP_40000FDX_LBN)) {
 			SET_BIT(40000baseCR4_Full);
-		if (cap & (1 << MC_CMD_PHY_CAP_100000FDX_LBN))
+			SET_BIT(40000baseSR4_Full);
+		}
+		if (cap & (1 << MC_CMD_PHY_CAP_100000FDX_LBN)) {
 			SET_BIT(100000baseCR4_Full);
-		if (cap & (1 << MC_CMD_PHY_CAP_25000FDX_LBN))
+			SET_BIT(100000baseSR4_Full);
+		}
+		if (cap & (1 << MC_CMD_PHY_CAP_25000FDX_LBN)) {
 			SET_BIT(25000baseCR_Full);
+			SET_BIT(25000baseSR_Full);
+		}
 		if (cap & (1 << MC_CMD_PHY_CAP_50000FDX_LBN))
 			SET_BIT(50000baseCR2_Full);
 		break;
@@ -192,15 +203,19 @@ u32 ethtool_linkset_to_mcdi_cap(const unsigned long *linkset)
 		result |= (1 << MC_CMD_PHY_CAP_100FDX_LBN);
 	if (TEST_BIT(1000baseT_Half))
 		result |= (1 << MC_CMD_PHY_CAP_1000HDX_LBN);
-	if (TEST_BIT(1000baseT_Full) || TEST_BIT(1000baseKX_Full))
+	if (TEST_BIT(1000baseT_Full) || TEST_BIT(1000baseKX_Full) ||
+			TEST_BIT(1000baseX_Full))
 		result |= (1 << MC_CMD_PHY_CAP_1000FDX_LBN);
-	if (TEST_BIT(10000baseT_Full) || TEST_BIT(10000baseKX4_Full))
+	if (TEST_BIT(10000baseT_Full) || TEST_BIT(10000baseKX4_Full) ||
+			TEST_BIT(10000baseCR_Full) || TEST_BIT(10000baseLR_Full) ||
+			TEST_BIT(10000baseSR_Full))
 		result |= (1 << MC_CMD_PHY_CAP_10000FDX_LBN);
-	if (TEST_BIT(40000baseCR4_Full) || TEST_BIT(40000baseKR4_Full))
+	if (TEST_BIT(40000baseCR4_Full) || TEST_BIT(40000baseKR4_Full) ||
+			TEST_BIT(40000baseSR4_Full))
 		result |= (1 << MC_CMD_PHY_CAP_40000FDX_LBN);
-	if (TEST_BIT(100000baseCR4_Full))
+	if (TEST_BIT(100000baseCR4_Full) || TEST_BIT(100000baseSR4_Full))
 		result |= (1 << MC_CMD_PHY_CAP_100000FDX_LBN);
-	if (TEST_BIT(25000baseCR_Full))
+	if (TEST_BIT(25000baseCR_Full) || TEST_BIT(25000baseSR_Full))
 		result |= (1 << MC_CMD_PHY_CAP_25000FDX_LBN);
 	if (TEST_BIT(50000baseCR2_Full))
 		result |= (1 << MC_CMD_PHY_CAP_50000FDX_LBN);

From 6491ccdde2c5d1c7cf3114f867513ad13903104f Mon Sep 17 00:00:00 2001
From: Erik Ekman <erik@kryo.se>
Date: Wed, 20 Oct 2021 00:40:16 +0200
Subject: [PATCH 1211/1750] sfc: Don't use netif_info before net_device setup

[ Upstream commit bf6abf345dfa77786aca554bc58c64bd428ecb1d ]

Use pci_info instead to avoid unnamed/uninitialized noise:

[197088.688729] sfc 0000:01:00.0: Solarflare NIC detected
[197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F
[197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed
[197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support

Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before
net_device is registered") from Heiner Kallweit.

Signed-off-by: Erik Ekman <erik@kryo.se>
Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/sfc/ptp.c         | 4 ++--
 drivers/net/ethernet/sfc/siena_sriov.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index a39c5143b386..797e51802ccb 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -648,7 +648,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx)
 	} else if (rc == -EINVAL) {
 		fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS;
 	} else if (rc == -EPERM) {
-		netif_info(efx, probe, efx->net_dev, "no PTP support\n");
+		pci_info(efx->pci_dev, "no PTP support\n");
 		return rc;
 	} else {
 		efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf),
@@ -824,7 +824,7 @@ static int efx_ptp_disable(struct efx_nic *efx)
 	 * should only have been called during probe.
 	 */
 	if (rc == -ENOSYS || rc == -EPERM)
-		netif_info(efx, probe, efx->net_dev, "no PTP support\n");
+		pci_info(efx->pci_dev, "no PTP support\n");
 	else if (rc)
 		efx_mcdi_display_error(efx, MC_CMD_PTP,
 				       MC_CMD_PTP_IN_DISABLE_LEN,
diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c
index 83dcfcae3d4b..441e7f3e5375 100644
--- a/drivers/net/ethernet/sfc/siena_sriov.c
+++ b/drivers/net/ethernet/sfc/siena_sriov.c
@@ -1057,7 +1057,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx)
 		return;
 
 	if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) {
-		netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n");
+		pci_info(efx->pci_dev, "no SR-IOV VFs probed\n");
 		return;
 	}
 	if (count > 0 && count > max_vfs)

From f03e04bb9d11d0f2e64e32b85c7473fd27e86d9a Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 18 Oct 2021 15:19:08 +0200
Subject: [PATCH 1212/1750] hyperv/vmbus: include linux/bitops.h

[ Upstream commit 8017c99680fa65e1e8d999df1583de476a187830 ]

On arm64 randconfig builds, hyperv sometimes fails with this
error:

In file included from drivers/hv/hv_trace.c:3:
In file included from drivers/hv/hyperv_vmbus.h:16:
In file included from arch/arm64/include/asm/sync_bitops.h:5:
arch/arm64/include/asm/bitops.h:11:2: error: only <linux/bitops.h> can be included directly
In file included from include/asm-generic/bitops/hweight.h:5:
include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration]
include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration]

Include the correct header first.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211018131929.2260087-1-arnd@kernel.org
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hv/hyperv_vmbus.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index 40e2b9f91163..7845fa5de79e 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -13,6 +13,7 @@
 #define _HYPERV_VMBUS_H
 
 #include <linux/list.h>
+#include <linux/bitops.h>
 #include <asm/sync_bitops.h>
 #include <asm/hyperv-tlfs.h>
 #include <linux/atomic.h>

From a903984385175d5e074963d8a97736dff1100bb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bastien=20Roucari=C3=A8s?= <rouca@debian.org>
Date: Thu, 16 Sep 2021 08:17:21 +0000
Subject: [PATCH 1213/1750] ARM: dts: sun7i: A20-olinuxino-lime2: Fix ethernet
 phy-mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 55dd7e059098ce4bd0a55c251cb78e74604abb57 ]

Commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay
config") sets the RX/TX delay according to the phy-mode property in the
device tree. For the A20-olinuxino-lime2 board this is "rgmii", which is the
wrong setting.

Following the example of a900cac3750b ("ARM: dts: sun7i: a20: bananapro:
Fix ethernet phy-mode") the phy-mode is changed to "rgmii-id" which gets
the Ethernet working again on this board.

Signed-off-by: Bastien Roucariès <rouca@debian.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20210916081721.237137-1-rouca@debian.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
index 9ba62774e89a..488933b87ad5 100644
--- a/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
+++ b/arch/arm/boot/dts/sun7i-a20-olinuxino-lime2.dts
@@ -112,7 +112,7 @@ &gmac {
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 

From a1ea41f91dcbd2dd69ce47dbe8693261f20cbe3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Anikiel?= <pan@semihalf.com>
Date: Mon, 20 Sep 2021 14:41:41 +0200
Subject: [PATCH 1214/1750] reset: socfpga: add empty driver allowing consumers
 to probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 3ad60b4b3570937f3278509fe6797a5093ce53f8 ]

The early reset driver doesn't ever probe, which causes consuming
devices to be unable to probe. Add an empty driver to set this device
as available, allowing consumers to probe.

Signed-off-by: Paweł Anikiel <pan@semihalf.com>
Link: https://lore.kernel.org/r/20210920124141.1166544-4-pan@semihalf.com
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/reset/reset-socfpga.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/drivers/reset/reset-socfpga.c b/drivers/reset/reset-socfpga.c
index bdd984296196..f9fa7fde7afb 100644
--- a/drivers/reset/reset-socfpga.c
+++ b/drivers/reset/reset-socfpga.c
@@ -85,3 +85,29 @@ void __init socfpga_reset_init(void)
 	for_each_matching_node(np, socfpga_early_reset_dt_ids)
 		a10_reset_init(np);
 }
+
+/*
+ * The early driver is problematic, because it doesn't register
+ * itself as a driver. This causes certain device links to prevent
+ * consumer devices from probing. The hacky solution is to register
+ * an empty driver, whose only job is to attach itself to the reset
+ * manager and call probe.
+ */
+static const struct of_device_id socfpga_reset_dt_ids[] = {
+	{ .compatible = "altr,rst-mgr", },
+	{ /* sentinel */ },
+};
+
+static int reset_simple_probe(struct platform_device *pdev)
+{
+	return 0;
+}
+
+static struct platform_driver reset_socfpga_driver = {
+	.probe	= reset_simple_probe,
+	.driver = {
+		.name		= "socfpga-reset",
+		.of_match_table	= socfpga_reset_dt_ids,
+	},
+};
+builtin_platform_driver(reset_socfpga_driver);

From 4002f3944d413c7ba22588c333c5645b029e6ecb Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 17 Oct 2021 10:59:49 -0700
Subject: [PATCH 1215/1750] mmc: winbond: don't build on M68K

[ Upstream commit 162079f2dccd02cb4b6654defd32ca387dd6d4d4 ]

The Winbond MMC driver fails to build on ARCH=m68k so prevent
that build config. Silences these build errors:

../drivers/mmc/host/wbsd.c: In function 'wbsd_request_end':
../drivers/mmc/host/wbsd.c:212:28: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration]
  212 |                 dmaflags = claim_dma_lock();
../drivers/mmc/host/wbsd.c:215:17: error: implicit declaration of function 'release_dma_lock'; did you mean 'release_task'? [-Werror=implicit-function-declaration]
  215 |                 release_dma_lock(dmaflags);

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Pierre Ossman <pierre@ossman.eu>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211017175949.23838-1-rdunlap@infradead.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 31481c9fcc2e..30ff42fd173e 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -503,7 +503,7 @@ config MMC_OMAP_HS
 
 config MMC_WBSD
 	tristate "Winbond W83L51xD SD/MMC Card Interface support"
-	depends on ISA_DMA_API
+	depends on ISA_DMA_API && !M68K
 	help
 	  This selects the Winbond(R) W83L51xD Secure digital and
 	  Multimedia card Interface.

From bc3e73ebb79b01abc121703669c65f54f0023cfe Mon Sep 17 00:00:00 2001
From: Bryant Mairs <bryant@mai.rs>
Date: Tue, 19 Oct 2021 09:24:33 -0500
Subject: [PATCH 1216/1750] drm: panel-orientation-quirks: Add quirk for Aya
 Neo 2021

[ Upstream commit def0c3697287f6e85d5ac68b21302966c95474f9 ]

Fixes screen orientation for the Aya Neo 2021 handheld gaming console.

Signed-off-by: Bryant Mairs <bryant@mai.rs>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211019142433.4295-1-bryant@mai.rs
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index f6bdec7fa925..30c17a76f49a 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -134,6 +134,12 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* AYA NEO 2021 */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYA NEO 2021"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
 	}, {	/* GPD MicroPC (generic strings, also match on bios date) */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),

From 0ad7f317b93394d4e866aee763ff1726cb6c6cea Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Thu, 21 Oct 2021 16:02:47 +0200
Subject: [PATCH 1217/1750] fcnal-test: kill hanging ping/nettest binaries on
 cleanup

[ Upstream commit 1f83b835a3eaa5ae4bd825fb07182698bfc243ba ]

On my box I see a bunch of ping/nettest processes hanging
around after fcntal-test.sh is done.

Clean those up before netns deletion.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20211021140247.29691-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/fcnal-test.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index 02b0b9ead40b..225440f5f99e 100755
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -436,10 +436,13 @@ cleanup()
 		ip -netns ${NSA} link set dev ${NSA_DEV} down
 		ip -netns ${NSA} link del dev ${NSA_DEV}
 
+		ip netns pids ${NSA} | xargs kill 2>/dev/null
 		ip netns del ${NSA}
 	fi
 
+	ip netns pids ${NSB} | xargs kill 2>/dev/null
 	ip netns del ${NSB}
+	ip netns pids ${NSC} | xargs kill 2>/dev/null
 	ip netns del ${NSC} >/dev/null 2>&1
 }
 

From a3564fb7b0bf11d941d57c87b0f38a656a997860 Mon Sep 17 00:00:00 2001
From: Lorenz Bauer <lmb@cloudflare.com>
Date: Thu, 14 Oct 2021 15:25:52 +0100
Subject: [PATCH 1218/1750] bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT

[ Upstream commit 5d63ae908242f028bd10860cba98450d11c079b8 ]

Expose the maximum amount of useable memory from the arm64 JIT.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211014142554.53120-3-lmb@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/net/bpf_jit_comp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 345066b8e9fc..064577ff9ff5 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -1134,6 +1134,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
 	return prog;
 }
 
+u64 bpf_jit_alloc_exec_limit(void)
+{
+	return BPF_JIT_REGION_SIZE;
+}
+
 void *bpf_jit_alloc_exec(unsigned long size)
 {
 	return __vmalloc_node_range(size, PAGE_SIZE, BPF_JIT_REGION_START,

From b92ac0a9ca8f27076c2096cae0896b94aaa4a6ac Mon Sep 17 00:00:00 2001
From: Lorenz Bauer <lmb@cloudflare.com>
Date: Thu, 14 Oct 2021 15:25:53 +0100
Subject: [PATCH 1219/1750] bpf: Prevent increasing bpf_jit_limit above max

[ Upstream commit fadb7ff1a6c2c565af56b4aacdd086b067eed440 ]

Restrict bpf_jit_limit to the maximum supported by the arch's JIT.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211014142554.53120-4-lmb@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/filter.h     | 1 +
 kernel/bpf/core.c          | 4 +++-
 net/core/sysctl_net_core.c | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 822b701c803d..bc6ce4b202a8 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -998,6 +998,7 @@ extern int bpf_jit_enable;
 extern int bpf_jit_harden;
 extern int bpf_jit_kallsyms;
 extern long bpf_jit_limit;
+extern long bpf_jit_limit_max;
 
 typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
 
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 72e4bf0ee546..d3a1f25f8ec2 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -528,6 +528,7 @@ int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
 int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
 int bpf_jit_harden   __read_mostly;
 long bpf_jit_limit   __read_mostly;
+long bpf_jit_limit_max __read_mostly;
 
 static void
 bpf_prog_ksym_set_addr(struct bpf_prog *prog)
@@ -821,7 +822,8 @@ u64 __weak bpf_jit_alloc_exec_limit(void)
 static int __init bpf_jit_charge_init(void)
 {
 	/* Only used as heuristic here to derive limit. */
-	bpf_jit_limit = min_t(u64, round_up(bpf_jit_alloc_exec_limit() >> 2,
+	bpf_jit_limit_max = bpf_jit_alloc_exec_limit();
+	bpf_jit_limit = min_t(u64, round_up(bpf_jit_limit_max >> 2,
 					    PAGE_SIZE), LONG_MAX);
 	return 0;
 }
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index d86d8d11cfe4..2e0a4378e778 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -419,7 +419,7 @@ static struct ctl_table net_core_table[] = {
 		.mode		= 0600,
 		.proc_handler	= proc_dolongvec_minmax_bpf_restricted,
 		.extra1		= &long_one,
-		.extra2		= &long_max,
+		.extra2		= &bpf_jit_limit_max,
 	},
 #endif
 	{

From 69b14e23dfc3c140a9513266763c58d4688b038a Mon Sep 17 00:00:00 2001
From: Asmaa Mnebhi <asmaa@nvidia.com>
Date: Fri, 22 Oct 2021 09:44:38 -0400
Subject: [PATCH 1220/1750] gpio: mlxbf2.c: Add check for bgpio_init failure

[ Upstream commit c0eee6fbfa2b3377f1efed10dad539abeb7312aa ]

Add a check if bgpio_init fails.

Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpio/gpio-mlxbf2.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpio/gpio-mlxbf2.c b/drivers/gpio/gpio-mlxbf2.c
index befa5e109943..d4b250b470b4 100644
--- a/drivers/gpio/gpio-mlxbf2.c
+++ b/drivers/gpio/gpio-mlxbf2.c
@@ -268,6 +268,11 @@ mlxbf2_gpio_probe(struct platform_device *pdev)
 			NULL,
 			0);
 
+	if (ret) {
+		dev_err(dev, "bgpio_init failed\n");
+		return ret;
+	}
+
 	gc->direction_input = mlxbf2_gpio_direction_input;
 	gc->direction_output = mlxbf2_gpio_direction_output;
 	gc->ngpio = npins;

From 0e86b727a94fc4d532a166c449ab96e3b15015ea Mon Sep 17 00:00:00 2001
From: Dongli Zhang <dongli.zhang@oracle.com>
Date: Fri, 22 Oct 2021 16:31:39 -0700
Subject: [PATCH 1221/1750] xen/netfront: stop tx queues during live migration

[ Upstream commit 042b2046d0f05cf8124c26ff65dbb6148a4404fb ]

The tx queues are not stopped during the live migration. As a result, the
ndo_start_xmit() may access netfront_info->queues which is freed by
talk_to_netback()->xennet_destroy_queues().

This patch is to netif_device_detach() at the beginning of xen-netfront
resuming, and netif_device_attach() at the end of resuming.

     CPU A                                CPU B

 talk_to_netback()
 -> if (info->queues)
        xennet_destroy_queues(info);
    to free netfront_info->queues

                                        xennet_start_xmit()
                                        to access netfront_info->queues

  -> err = xennet_create_queues(info, &num_queues);

The idea is borrowed from virtio-net.

Cc: Joe Jin <joe.jin@oracle.com>
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/xen-netfront.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 3e9895bec15f..dd79534910b0 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1671,6 +1671,10 @@ static int netfront_resume(struct xenbus_device *dev)
 
 	dev_dbg(&dev->dev, "%s\n", dev->nodename);
 
+	netif_tx_lock_bh(info->netdev);
+	netif_device_detach(info->netdev);
+	netif_tx_unlock_bh(info->netdev);
+
 	xennet_disconnect_backend(info);
 	return 0;
 }
@@ -2285,6 +2289,10 @@ static int xennet_connect(struct net_device *dev)
 	 * domain a kick because we've probably just requeued some
 	 * packets.
 	 */
+	netif_tx_lock_bh(np->netdev);
+	netif_device_attach(np->netdev);
+	netif_tx_unlock_bh(np->netdev);
+
 	netif_carrier_on(np->netdev);
 	for (j = 0; j < num_queues; ++j) {
 		queue = &np->queues[j];

From db1d9d102ee45b0462237d3257d1520806ab0b4e Mon Sep 17 00:00:00 2001
From: Maurizio Lombardi <mlombard@redhat.com>
Date: Fri, 15 Oct 2021 10:26:34 +0200
Subject: [PATCH 1222/1750] nvmet-tcp: fix a memory leak when releasing a queue

[ Upstream commit 926245c7d22271307606c88b1fbb2539a8550e94 ]

page_frag_free() won't completely release the memory
allocated for the commands, the cache page must be explicitly
freed by calling __page_frag_cache_drain().

This bug can be easily reproduced by repeatedly
executing the following command on the initiator:

$echo 1 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/reset_controller

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/tcp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 5266d534c4b3..b4ef7e9e8461 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1398,6 +1398,7 @@ static void nvmet_tcp_uninit_data_in_cmds(struct nvmet_tcp_queue *queue)
 
 static void nvmet_tcp_release_queue_work(struct work_struct *w)
 {
+	struct page *page;
 	struct nvmet_tcp_queue *queue =
 		container_of(w, struct nvmet_tcp_queue, release_work);
 
@@ -1417,6 +1418,8 @@ static void nvmet_tcp_release_queue_work(struct work_struct *w)
 		nvmet_tcp_free_crypto(queue);
 	ida_simple_remove(&nvmet_tcp_queue_ida, queue->idx);
 
+	page = virt_to_head_page(queue->pf_cache.va);
+	__page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias);
 	kfree(queue);
 }
 

From 07f7a1864929fe705afd9b5b97946fe0b2983064 Mon Sep 17 00:00:00 2001
From: Thomas Perrot <thomas.perrot@bootlin.com>
Date: Fri, 22 Oct 2021 16:21:04 +0200
Subject: [PATCH 1223/1750] spi: spl022: fix Microwire full duplex mode

[ Upstream commit d81d0e41ed5fe7229a2c9a29d13bad288c7cf2d2 ]

There are missing braces in the function that verify controller parameters,
then an error is always returned when the parameter to select Microwire
frames operation is used on devices allowing it.

Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Link: https://lore.kernel.org/r/20211022142104.1386379-1-thomas.perrot@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-pl022.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index d1776fea287e..e4ee8b084799 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1723,12 +1723,13 @@ static int verify_controller_parameters(struct pl022 *pl022,
 				return -EINVAL;
 			}
 		} else {
-			if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX)
+			if (chip_info->duplex != SSP_MICROWIRE_CHANNEL_FULL_DUPLEX) {
 				dev_err(&pl022->adev->dev,
 					"Microwire half duplex mode requested,"
 					" but this is only available in the"
 					" ST version of PL022\n");
-			return -EINVAL;
+				return -EINVAL;
+			}
 		}
 	}
 	return 0;

From b8cb3f4ffa3ad0b4f0d62334aa6cda28e7f93881 Mon Sep 17 00:00:00 2001
From: Cyril Strejc <cyril.strejc@skoda.cz>
Date: Sun, 24 Oct 2021 22:14:25 +0200
Subject: [PATCH 1224/1750] net: multicast: calculate csum of looped-back and
 forwarded packets

[ Upstream commit 9122a70a6333705c0c35614ddc51c274ed1d3637 ]

During a testing of an user-space application which transmits UDP
multicast datagrams and utilizes multicast routing to send the UDP
datagrams out of defined network interfaces, I've found a multicast
router does not fill-in UDP checksum into locally produced, looped-back
and forwarded UDP datagrams, if an original output NIC the datagrams
are sent to has UDP TX checksum offload enabled.

The datagrams are sent malformed out of the NIC the datagrams have been
forwarded to.

It is because:

1. If TX checksum offload is enabled on the output NIC, UDP checksum
   is not calculated by kernel and is not filled into skb data.

2. dev_loopback_xmit(), which is called solely by
   ip_mc_finish_output(), sets skb->ip_summed = CHECKSUM_UNNECESSARY
   unconditionally.

3. Since 35fc92a9 ("[NET]: Allow forwarding of ip_summed except
   CHECKSUM_COMPLETE"), the ip_summed value is preserved during
   forwarding.

4. If ip_summed != CHECKSUM_PARTIAL, checksum is not calculated during
   a packet egress.

The minimum fix in dev_loopback_xmit():

1. Preserves skb->ip_summed CHECKSUM_PARTIAL. This is the
   case when the original output NIC has TX checksum offload enabled.
   The effects are:

     a) If the forwarding destination interface supports TX checksum
        offloading, the NIC driver is responsible to fill-in the
        checksum.

     b) If the forwarding destination interface does NOT support TX
        checksum offloading, checksums are filled-in by kernel before
        skb is submitted to the NIC driver.

     c) For local delivery, checksum validation is skipped as in the
        case of CHECKSUM_UNNECESSARY, thanks to skb_csum_unnecessary().

2. Translates ip_summed CHECKSUM_NONE to CHECKSUM_UNNECESSARY. It
   means, for CHECKSUM_NONE, the behavior is unmodified and is there
   to skip a looped-back packet local delivery checksum validation.

Signed-off-by: Cyril Strejc <cyril.strejc@skoda.cz>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/udp.h | 5 +++--
 net/core/dev.c    | 3 ++-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/include/net/udp.h b/include/net/udp.h
index 949ae14a5425..435cc009e6ea 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -488,8 +488,9 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk,
 	 * CHECKSUM_NONE in __udp_gso_segment. UDP GRO indeed builds partial
 	 * packets in udp_gro_complete_segment. As does UDP GSO, verified by
 	 * udp_send_skb. But when those packets are looped in dev_loopback_xmit
-	 * their ip_summed is set to CHECKSUM_UNNECESSARY. Reset in this
-	 * specific case, where PARTIAL is both correct and required.
+	 * their ip_summed CHECKSUM_NONE is changed to CHECKSUM_UNNECESSARY.
+	 * Reset in this specific case, where PARTIAL is both correct and
+	 * required.
 	 */
 	if (skb->pkt_type == PACKET_LOOPBACK)
 		skb->ip_summed = CHECKSUM_PARTIAL;
diff --git a/net/core/dev.c b/net/core/dev.c
index 6a4e0e3c59fe..e14294e9ba32 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3867,7 +3867,8 @@ int dev_loopback_xmit(struct net *net, struct sock *sk, struct sk_buff *skb)
 	skb_reset_mac_header(skb);
 	__skb_pull(skb, skb_network_offset(skb));
 	skb->pkt_type = PACKET_LOOPBACK;
-	skb->ip_summed = CHECKSUM_UNNECESSARY;
+	if (skb->ip_summed == CHECKSUM_NONE)
+		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	WARN_ON(!skb_dst(skb));
 	skb_dst_force(skb);
 	netif_rx_ni(skb);

From 4d41059b9e23bbb573fbf59c03334a138fbe55ef Mon Sep 17 00:00:00 2001
From: Walter Stoll <walter.stoll@duagon.com>
Date: Thu, 14 Oct 2021 12:22:29 +0200
Subject: [PATCH 1225/1750] watchdog: Fix OMAP watchdog early handling

[ Upstream commit cd004d8299f1dc6cfa6a4eea8f94cb45eaedf070 ]

TI's implementation does not service the watchdog even if the kernel
command line parameter omap_wdt.early_enable is set to 1. This patch
fixes the issue.

Signed-off-by: Walter Stoll <walter.stoll@duagon.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/88a8fe5229cd68fa0f1fd22f5d66666c1b7057a0.camel@duagon.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/omap_wdt.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
index 1616f93dfad7..74d785b2b478 100644
--- a/drivers/watchdog/omap_wdt.c
+++ b/drivers/watchdog/omap_wdt.c
@@ -268,8 +268,12 @@ static int omap_wdt_probe(struct platform_device *pdev)
 			wdev->wdog.bootstatus = WDIOF_CARDRESET;
 	}
 
-	if (!early_enable)
+	if (early_enable) {
+		omap_wdt_start(&wdev->wdog);
+		set_bit(WDOG_HW_RUNNING, &wdev->wdog.status);
+	} else {
 		omap_wdt_disable(wdev);
+	}
 
 	ret = watchdog_register_device(&wdev->wdog);
 	if (ret) {

From 7d1fb5c12cc0c88159ebf946385141ed3019f009 Mon Sep 17 00:00:00 2001
From: Mario <awxkrnl@gmail.com>
Date: Tue, 26 Oct 2021 13:27:37 +0200
Subject: [PATCH 1226/1750] drm: panel-orientation-quirks: Add quirk for GPD
 Win3

[ Upstream commit 61b1d445f3bfe4c3ba4335ceeb7e8ba688fd31e2 ]

Fixes screen orientation for GPD Win 3 handheld gaming console.

Signed-off-by: Mario Risoldi <awxkrnl@gmail.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20211026112737.9181-1-awxkrnl@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 30c17a76f49a..e1b2ce4921ae 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -191,6 +191,12 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
 		},
 		.driver_data = (void *)&gpd_win2,
+	}, {	/* GPD Win 3 */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03")
+		},
+		.driver_data = (void *)&lcd720x1280_rightside_up,
 	}, {	/* I.T.Works TW891 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."),

From c8270435cfb4c20992d3048fe1813b853399218f Mon Sep 17 00:00:00 2001
From: Naohiro Aota <naohiro.aota@wdc.com>
Date: Wed, 27 Oct 2021 01:51:27 +0900
Subject: [PATCH 1227/1750] block: schedule queue restart after
 BLK_STS_ZONE_RESOURCE

[ Upstream commit 9586e67b911c95ba158fcc247b230e9c2d718623 ]

When dispatching a zone append write request to a SCSI zoned block device,
if the target zone of the request is already locked, the device driver will
return BLK_STS_ZONE_RESOURCE and the request will be pushed back to the
hctx dipatch queue. The queue will be marked as RESTART in
dd_finish_request() and restarted in __blk_mq_free_request(). However, this
restart applies to the hctx of the completed request. If the requeued
request is on a different hctx, dispatch will no be retried until another
request is submitted or the next periodic queue run triggers, leading to up
to 30 seconds latency for the requeued request.

Fix this problem by scheduling a queue restart similarly to the
BLK_STS_RESOURCE case or when we cannot get the budget.

Also, consolidate the checks into the "need_resource" variable to simplify
the condition.

Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Niklas Cassel <Niklas.Cassel@wdc.com>
Link: https://lore.kernel.org/r/20211026165127.4151055-1-naohiro.aota@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index eed9a4c1519d..69cc552c3dfc 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1327,6 +1327,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
 	int errors, queued;
 	blk_status_t ret = BLK_STS_OK;
 	LIST_HEAD(zone_list);
+	bool needs_resource = false;
 
 	if (list_empty(list))
 		return false;
@@ -1372,6 +1373,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
 			queued++;
 			break;
 		case BLK_STS_RESOURCE:
+			needs_resource = true;
+			fallthrough;
 		case BLK_STS_DEV_RESOURCE:
 			blk_mq_handle_dev_resource(rq, list);
 			goto out;
@@ -1382,6 +1385,7 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
 			 * accept.
 			 */
 			blk_mq_handle_zone_resource(rq, &zone_list);
+			needs_resource = true;
 			break;
 		default:
 			errors++;
@@ -1408,7 +1412,6 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
 		/* For non-shared tags, the RESTART check will suffice */
 		bool no_tag = prep == PREP_DISPATCH_NO_TAG &&
 			(hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED);
-		bool no_budget_avail = prep == PREP_DISPATCH_NO_BUDGET;
 
 		blk_mq_release_budgets(q, nr_budgets);
 
@@ -1448,14 +1451,16 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list,
 		 * If driver returns BLK_STS_RESOURCE and SCHED_RESTART
 		 * bit is set, run queue after a delay to avoid IO stalls
 		 * that could otherwise occur if the queue is idle.  We'll do
-		 * similar if we couldn't get budget and SCHED_RESTART is set.
+		 * similar if we couldn't get budget or couldn't lock a zone
+		 * and SCHED_RESTART is set.
 		 */
 		needs_restart = blk_mq_sched_needs_restart(hctx);
+		if (prep == PREP_DISPATCH_NO_BUDGET)
+			needs_resource = true;
 		if (!needs_restart ||
 		    (no_tag && list_empty_careful(&hctx->dispatch_wait.entry)))
 			blk_mq_run_hw_queue(hctx, true);
-		else if (needs_restart && (ret == BLK_STS_RESOURCE ||
-					   no_budget_avail))
+		else if (needs_restart && needs_resource)
 			blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY);
 
 		blk_mq_update_dispatch_busy(hctx, true);

From ad6a2a1e566ff3996b07e20cb3d096fc4b81cd02 Mon Sep 17 00:00:00 2001
From: Amit Engel <amit.engel@dell.com>
Date: Wed, 27 Oct 2021 09:49:27 +0300
Subject: [PATCH 1228/1750] nvmet-tcp: fix header digest verification

[ Upstream commit 86aeda32b887cdaeb0f4b7bfc9971e36377181c7 ]

Pass the correct length to nvmet_tcp_verify_hdgst, which is the pdu
header length.  This fixes a wrong behaviour where header digest
verification passes although the digest is wrong.

Signed-off-by: Amit Engel <amit.engel@dell.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index b4ef7e9e8461..58dc517fe867 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1084,7 +1084,7 @@ static int nvmet_tcp_try_recv_pdu(struct nvmet_tcp_queue *queue)
 	}
 
 	if (queue->hdr_digest &&
-	    nvmet_tcp_verify_hdgst(queue, &queue->pdu, queue->offset)) {
+	    nvmet_tcp_verify_hdgst(queue, &queue->pdu, hdr->hlen)) {
 		nvmet_tcp_fatal_error(queue); /* fatal */
 		return -EPROTO;
 	}

From 9813218e96db4fbfd1dfae4d2bbd979d3031597f Mon Sep 17 00:00:00 2001
From: Janghyub Seo <jhyub06@gmail.com>
Date: Tue, 26 Oct 2021 07:12:42 +0000
Subject: [PATCH 1229/1750] r8169: Add device 10ec:8162 to driver r8169

[ Upstream commit 72f898ca0ab85fde6facf78b14d9f67a4a7b32d1 ]

This patch makes the driver r8169 pick up device Realtek Semiconductor Co.
, Ltd. Device [10ec:8162].

Signed-off-by: Janghyub Seo <jhyub06@gmail.com>
Suggested-by: Rushab Shah <rushabshah32@gmail.com>
Link: https://lore.kernel.org/r/1635231849296.1489250046.441294000@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/realtek/r8169_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 30be18bac806..5eac3f494d9e 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -157,6 +157,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = {
 	{ PCI_VDEVICE(REALTEK,	0x8129) },
 	{ PCI_VDEVICE(REALTEK,	0x8136), RTL_CFG_NO_GBIT },
 	{ PCI_VDEVICE(REALTEK,	0x8161) },
+	{ PCI_VDEVICE(REALTEK,	0x8162) },
 	{ PCI_VDEVICE(REALTEK,	0x8167) },
 	{ PCI_VDEVICE(REALTEK,	0x8168) },
 	{ PCI_VDEVICE(NCUBE,	0x8168) },

From c9a7d5fe155245e396ac6a3ce3b84c069ee602fa Mon Sep 17 00:00:00 2001
From: Dongli Zhang <dongli.zhang@oracle.com>
Date: Tue, 26 Oct 2021 14:50:31 -0700
Subject: [PATCH 1230/1750] vmxnet3: do not stop tx queues after
 netif_device_detach()

[ Upstream commit 9159f102402a64ac85e676b75cc1f9c62c5b4b73 ]

The netif_device_detach() conditionally stops all tx queues if the queues
are running. There is no need to call netif_tx_stop_all_queues() again.

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vmxnet3/vmxnet3_drv.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 336504b7531d..932a39945cc6 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -3765,7 +3765,6 @@ vmxnet3_suspend(struct device *device)
 	vmxnet3_free_intr_resources(adapter);
 
 	netif_device_detach(netdev);
-	netif_tx_stop_all_queues(netdev);
 
 	/* Create wake-up filters. */
 	pmConf = adapter->pm_conf;

From 2167a9a12cc9d246f9075a2fdf37618ff3032117 Mon Sep 17 00:00:00 2001
From: Yu Xiao <yu.xiao@corigine.com>
Date: Thu, 28 Oct 2021 12:00:36 +0200
Subject: [PATCH 1231/1750] nfp: bpf: relax prog rejection for mtu check
 through max_pkt_offset

[ Upstream commit 90a881fc352a953f1c8beb61977a2db0818157d4 ]

MTU change is refused whenever the value of new MTU is bigger than
the max packet bytes that fits in NFP Cluster Target Memory (CTM).
However, an eBPF program doesn't always need to access the whole
packet data.

The maximum direct packet access (DPA) offset has always been
caculated by verifier and stored in the max_pkt_offset field of prog
aux data.

Signed-off-by: Yu Xiao <yu.xiao@corigine.com>
Reviewed-by: Yinjun Zhang <yinjun.zhang@corigine.com>
Reviewed-by: Niklas Soderlund <niklas.soderlund@corigine.com>
Signed-off-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/netronome/nfp/bpf/main.c   | 16 +++++++++++-----
 drivers/net/ethernet/netronome/nfp/bpf/main.h   |  2 ++
 .../net/ethernet/netronome/nfp/bpf/offload.c    | 17 +++++++++++++----
 3 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.c b/drivers/net/ethernet/netronome/nfp/bpf/main.c
index 11c83a99b014..f469950c7265 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.c
@@ -182,15 +182,21 @@ static int
 nfp_bpf_check_mtu(struct nfp_app *app, struct net_device *netdev, int new_mtu)
 {
 	struct nfp_net *nn = netdev_priv(netdev);
-	unsigned int max_mtu;
+	struct nfp_bpf_vnic *bv;
+	struct bpf_prog *prog;
 
 	if (~nn->dp.ctrl & NFP_NET_CFG_CTRL_BPF)
 		return 0;
 
-	max_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32;
-	if (new_mtu > max_mtu) {
-		nn_info(nn, "BPF offload active, MTU over %u not supported\n",
-			max_mtu);
+	if (nn->xdp_hw.prog) {
+		prog = nn->xdp_hw.prog;
+	} else {
+		bv = nn->app_priv;
+		prog = bv->tc_prog;
+	}
+
+	if (nfp_bpf_offload_check_mtu(nn, prog, new_mtu)) {
+		nn_info(nn, "BPF offload active, potential packet access beyond hardware packet boundary");
 		return -EBUSY;
 	}
 	return 0;
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/main.h b/drivers/net/ethernet/netronome/nfp/bpf/main.h
index fac9c6f9e197..c74620fcc539 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/main.h
+++ b/drivers/net/ethernet/netronome/nfp/bpf/main.h
@@ -560,6 +560,8 @@ bool nfp_is_subprog_start(struct nfp_insn_meta *meta);
 void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog);
 int nfp_bpf_jit(struct nfp_prog *prog);
 bool nfp_bpf_supported_opcode(u8 code);
+bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog,
+			       unsigned int mtu);
 
 int nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx,
 		    int prev_insn_idx);
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/offload.c b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
index 53851853562c..9d97cd281f18 100644
--- a/drivers/net/ethernet/netronome/nfp/bpf/offload.c
+++ b/drivers/net/ethernet/netronome/nfp/bpf/offload.c
@@ -481,19 +481,28 @@ int nfp_bpf_event_output(struct nfp_app_bpf *bpf, const void *data,
 	return 0;
 }
 
+bool nfp_bpf_offload_check_mtu(struct nfp_net *nn, struct bpf_prog *prog,
+			       unsigned int mtu)
+{
+	unsigned int fw_mtu, pkt_off;
+
+	fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32;
+	pkt_off = min(prog->aux->max_pkt_offset, mtu);
+
+	return fw_mtu < pkt_off;
+}
+
 static int
 nfp_net_bpf_load(struct nfp_net *nn, struct bpf_prog *prog,
 		 struct netlink_ext_ack *extack)
 {
 	struct nfp_prog *nfp_prog = prog->aux->offload->dev_priv;
-	unsigned int fw_mtu, pkt_off, max_stack, max_prog_len;
+	unsigned int max_stack, max_prog_len;
 	dma_addr_t dma_addr;
 	void *img;
 	int err;
 
-	fw_mtu = nn_readb(nn, NFP_NET_CFG_BPF_INL_MTU) * 64 - 32;
-	pkt_off = min(prog->aux->max_pkt_offset, nn->dp.netdev->mtu);
-	if (fw_mtu < pkt_off) {
+	if (nfp_bpf_offload_check_mtu(nn, prog, nn->dp.netdev->mtu)) {
 		NL_SET_ERR_MSG_MOD(extack, "BPF offload not supported with potential packet access beyond HW packet split boundary");
 		return -EOPNOTSUPP;
 	}

From 9b86eb2f34d1e3e47451777cd4bfd3754914ed66 Mon Sep 17 00:00:00 2001
From: Tony Lu <tonylu@linux.alibaba.com>
Date: Thu, 28 Oct 2021 15:13:45 +0800
Subject: [PATCH 1232/1750] net/smc: Fix smc_link->llc_testlink_time overflow

[ Upstream commit c4a146c7cf5e8ad76231523b174d161bf152c6e7 ]

The value of llc_testlink_time is set to the value stored in
net->ipv4.sysctl_tcp_keepalive_time when linkgroup init. The value of
sysctl_tcp_keepalive_time is already jiffies, so we don't need to
multiply by HZ, which would cause smc_link->llc_testlink_time overflow,
and test_link send flood.

Signed-off-by: Tony Lu <tonylu@linux.alibaba.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Reviewed-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/smc_llc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index 2e7560eba981..d8fe4e1f24d1 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -1787,7 +1787,7 @@ void smc_llc_link_active(struct smc_link *link)
 			    link->smcibdev->ibdev->name, link->ibport);
 	link->state = SMC_LNK_ACTIVE;
 	if (link->lgr->llc_testlink_time) {
-		link->llc_testlink_time = link->lgr->llc_testlink_time * HZ;
+		link->llc_testlink_time = link->lgr->llc_testlink_time;
 		schedule_delayed_work(&link->llc_testlink_wrk,
 				      link->llc_testlink_time);
 	}

From 0bfb1c1a16ffb12b765cdf1aa3ae2e818b986d89 Mon Sep 17 00:00:00 2001
From: Wen Gu <guwen@linux.alibaba.com>
Date: Thu, 28 Oct 2021 15:13:47 +0800
Subject: [PATCH 1233/1750] net/smc: Correct spelling mistake to TCPF_SYN_RECV

[ Upstream commit f3a3a0fe0b644582fa5d83dd94b398f99fc57914 ]

There should use TCPF_SYN_RECV instead of TCP_SYN_RECV.

Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/af_smc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index 030d7f30b13f..cc2af94e7450 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -1018,7 +1018,7 @@ static void smc_connect_work(struct work_struct *work)
 	if (smc->clcsock->sk->sk_err) {
 		smc->sk.sk_err = smc->clcsock->sk->sk_err;
 	} else if ((1 << smc->clcsock->sk->sk_state) &
-					(TCPF_SYN_SENT | TCP_SYN_RECV)) {
+					(TCPF_SYN_SENT | TCPF_SYN_RECV)) {
 		rc = sk_stream_wait_connect(smc->clcsock->sk, &timeo);
 		if ((rc == -EPIPE) &&
 		    ((1 << smc->clcsock->sk->sk_state) &

From a99da5b68080829982b07b12295646e101763528 Mon Sep 17 00:00:00 2001
From: Christoph Hellwig <hch@lst.de>
Date: Fri, 6 Nov 2020 19:19:36 +0100
Subject: [PATCH 1234/1750] rds: stop using dmapool

[ Upstream commit 42f2611cc1738b201701e717246e11e86bef4e1e ]

RDMA ULPs should only perform DMA through the ib_dma_* API instead of
using the hidden dma_device directly.  In addition using the dma coherent
API family that dmapool is a part of can be very ineffcient on plaforms
that are not DMA coherent.  Switch to use slab allocations and the
ib_dma_* APIs instead.

Link: https://lore.kernel.org/r/20201106181941.1878556-6-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/ib.c      |  10 ----
 net/rds/ib.h      |   6 ---
 net/rds/ib_cm.c   | 128 ++++++++++++++++++++++++++++------------------
 net/rds/ib_recv.c |  18 +++++--
 net/rds/ib_send.c |   8 +++
 5 files changed, 101 insertions(+), 69 deletions(-)

diff --git a/net/rds/ib.c b/net/rds/ib.c
index deecbdcdae84..24c9a9005a6f 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -30,7 +30,6 @@
  * SOFTWARE.
  *
  */
-#include <linux/dmapool.h>
 #include <linux/kernel.h>
 #include <linux/in.h>
 #include <linux/if.h>
@@ -108,7 +107,6 @@ static void rds_ib_dev_free(struct work_struct *work)
 		rds_ib_destroy_mr_pool(rds_ibdev->mr_1m_pool);
 	if (rds_ibdev->pd)
 		ib_dealloc_pd(rds_ibdev->pd);
-	dma_pool_destroy(rds_ibdev->rid_hdrs_pool);
 
 	list_for_each_entry_safe(i_ipaddr, i_next, &rds_ibdev->ipaddr_list, list) {
 		list_del(&i_ipaddr->list);
@@ -191,14 +189,6 @@ static int rds_ib_add_one(struct ib_device *device)
 		rds_ibdev->pd = NULL;
 		goto put_dev;
 	}
-	rds_ibdev->rid_hdrs_pool = dma_pool_create(device->name,
-						   device->dma_device,
-						   sizeof(struct rds_header),
-						   L1_CACHE_BYTES, 0);
-	if (!rds_ibdev->rid_hdrs_pool) {
-		ret = -ENOMEM;
-		goto put_dev;
-	}
 
 	rds_ibdev->mr_1m_pool =
 		rds_ib_create_mr_pool(rds_ibdev, RDS_IB_MR_1M_POOL);
diff --git a/net/rds/ib.h b/net/rds/ib.h
index c23a11d9ad36..2ba71102b1f1 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h
@@ -246,7 +246,6 @@ struct rds_ib_device {
 	struct list_head	conn_list;
 	struct ib_device	*dev;
 	struct ib_pd		*pd;
-	struct dma_pool		*rid_hdrs_pool; /* RDS headers DMA pool */
 	u8			odp_capable:1;
 
 	unsigned int		max_mrs;
@@ -380,11 +379,6 @@ int rds_ib_cm_handle_connect(struct rdma_cm_id *cm_id,
 int rds_ib_cm_initiate_connect(struct rdma_cm_id *cm_id, bool isv6);
 void rds_ib_cm_connect_complete(struct rds_connection *conn,
 				struct rdma_cm_event *event);
-struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev,
-				       struct dma_pool *pool,
-				       dma_addr_t **dma_addrs, u32 num_hdrs);
-void rds_dma_hdrs_free(struct dma_pool *pool, struct rds_header **hdrs,
-		       dma_addr_t *dma_addrs, u32 num_hdrs);
 
 #define rds_ib_conn_error(conn, fmt...) \
 	__rds_ib_conn_error(conn, KERN_WARNING "RDS/IB: " fmt)
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index b36b60668b1d..f5cbe963cd8f 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -30,7 +30,6 @@
  * SOFTWARE.
  *
  */
-#include <linux/dmapool.h>
 #include <linux/kernel.h>
 #include <linux/in.h>
 #include <linux/slab.h>
@@ -441,42 +440,87 @@ static inline void ibdev_put_vector(struct rds_ib_device *rds_ibdev, int index)
 	rds_ibdev->vector_load[index]--;
 }
 
+static void rds_dma_hdr_free(struct ib_device *dev, struct rds_header *hdr,
+		dma_addr_t dma_addr, enum dma_data_direction dir)
+{
+	ib_dma_unmap_single(dev, dma_addr, sizeof(*hdr), dir);
+	kfree(hdr);
+}
+
+static struct rds_header *rds_dma_hdr_alloc(struct ib_device *dev,
+		dma_addr_t *dma_addr, enum dma_data_direction dir)
+{
+	struct rds_header *hdr;
+
+	hdr = kzalloc_node(sizeof(*hdr), GFP_KERNEL, ibdev_to_node(dev));
+	if (!hdr)
+		return NULL;
+
+	*dma_addr = ib_dma_map_single(dev, hdr, sizeof(*hdr),
+				      DMA_BIDIRECTIONAL);
+	if (ib_dma_mapping_error(dev, *dma_addr)) {
+		kfree(hdr);
+		return NULL;
+	}
+
+	return hdr;
+}
+
+/* Free the DMA memory used to store struct rds_header.
+ *
+ * @dev: the RDS IB device
+ * @hdrs: pointer to the array storing DMA memory pointers
+ * @dma_addrs: pointer to the array storing DMA addresses
+ * @num_hdars: number of headers to free.
+ */
+static void rds_dma_hdrs_free(struct rds_ib_device *dev,
+		struct rds_header **hdrs, dma_addr_t *dma_addrs, u32 num_hdrs,
+		enum dma_data_direction dir)
+{
+	u32 i;
+
+	for (i = 0; i < num_hdrs; i++)
+		rds_dma_hdr_free(dev->dev, hdrs[i], dma_addrs[i], dir);
+	kvfree(hdrs);
+	kvfree(dma_addrs);
+}
+
+
 /* Allocate DMA coherent memory to be used to store struct rds_header for
  * sending/receiving packets.  The pointers to the DMA memory and the
  * associated DMA addresses are stored in two arrays.
  *
- * @ibdev: the IB device
- * @pool: the DMA memory pool
+ * @dev: the RDS IB device
  * @dma_addrs: pointer to the array for storing DMA addresses
  * @num_hdrs: number of headers to allocate
  *
  * It returns the pointer to the array storing the DMA memory pointers.  On
  * error, NULL pointer is returned.
  */
-struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev,
-				       struct dma_pool *pool,
-				       dma_addr_t **dma_addrs, u32 num_hdrs)
+static struct rds_header **rds_dma_hdrs_alloc(struct rds_ib_device *dev,
+		dma_addr_t **dma_addrs, u32 num_hdrs,
+		enum dma_data_direction dir)
 {
 	struct rds_header **hdrs;
 	dma_addr_t *hdr_daddrs;
 	u32 i;
 
 	hdrs = kvmalloc_node(sizeof(*hdrs) * num_hdrs, GFP_KERNEL,
-			     ibdev_to_node(ibdev));
+			     ibdev_to_node(dev->dev));
 	if (!hdrs)
 		return NULL;
 
 	hdr_daddrs = kvmalloc_node(sizeof(*hdr_daddrs) * num_hdrs, GFP_KERNEL,
-				   ibdev_to_node(ibdev));
+				   ibdev_to_node(dev->dev));
 	if (!hdr_daddrs) {
 		kvfree(hdrs);
 		return NULL;
 	}
 
 	for (i = 0; i < num_hdrs; i++) {
-		hdrs[i] = dma_pool_zalloc(pool, GFP_KERNEL, &hdr_daddrs[i]);
+		hdrs[i] = rds_dma_hdr_alloc(dev->dev, &hdr_daddrs[i], dir);
 		if (!hdrs[i]) {
-			rds_dma_hdrs_free(pool, hdrs, hdr_daddrs, i);
+			rds_dma_hdrs_free(dev, hdrs, hdr_daddrs, i, dir);
 			return NULL;
 		}
 	}
@@ -485,24 +529,6 @@ struct rds_header **rds_dma_hdrs_alloc(struct ib_device *ibdev,
 	return hdrs;
 }
 
-/* Free the DMA memory used to store struct rds_header.
- *
- * @pool: the DMA memory pool
- * @hdrs: pointer to the array storing DMA memory pointers
- * @dma_addrs: pointer to the array storing DMA addresses
- * @num_hdars: number of headers to free.
- */
-void rds_dma_hdrs_free(struct dma_pool *pool, struct rds_header **hdrs,
-		       dma_addr_t *dma_addrs, u32 num_hdrs)
-{
-	u32 i;
-
-	for (i = 0; i < num_hdrs; i++)
-		dma_pool_free(pool, hdrs[i], dma_addrs[i]);
-	kvfree(hdrs);
-	kvfree(dma_addrs);
-}
-
 /*
  * This needs to be very careful to not leave IS_ERR pointers around for
  * cleanup to trip over.
@@ -516,7 +542,6 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
 	struct rds_ib_device *rds_ibdev;
 	unsigned long max_wrs;
 	int ret, fr_queue_space;
-	struct dma_pool *pool;
 
 	/*
 	 * It's normal to see a null device if an incoming connection races
@@ -612,25 +637,26 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
 		goto recv_cq_out;
 	}
 
-	pool = rds_ibdev->rid_hdrs_pool;
-	ic->i_send_hdrs = rds_dma_hdrs_alloc(dev, pool, &ic->i_send_hdrs_dma,
-					     ic->i_send_ring.w_nr);
+	ic->i_send_hdrs = rds_dma_hdrs_alloc(rds_ibdev, &ic->i_send_hdrs_dma,
+					     ic->i_send_ring.w_nr,
+					     DMA_TO_DEVICE);
 	if (!ic->i_send_hdrs) {
 		ret = -ENOMEM;
 		rdsdebug("DMA send hdrs alloc failed\n");
 		goto qp_out;
 	}
 
-	ic->i_recv_hdrs = rds_dma_hdrs_alloc(dev, pool, &ic->i_recv_hdrs_dma,
-					     ic->i_recv_ring.w_nr);
+	ic->i_recv_hdrs = rds_dma_hdrs_alloc(rds_ibdev, &ic->i_recv_hdrs_dma,
+					     ic->i_recv_ring.w_nr,
+					     DMA_FROM_DEVICE);
 	if (!ic->i_recv_hdrs) {
 		ret = -ENOMEM;
 		rdsdebug("DMA recv hdrs alloc failed\n");
 		goto send_hdrs_dma_out;
 	}
 
-	ic->i_ack = dma_pool_zalloc(pool, GFP_KERNEL,
-				    &ic->i_ack_dma);
+	ic->i_ack = rds_dma_hdr_alloc(rds_ibdev->dev, &ic->i_ack_dma,
+				      DMA_TO_DEVICE);
 	if (!ic->i_ack) {
 		ret = -ENOMEM;
 		rdsdebug("DMA ack header alloc failed\n");
@@ -666,18 +692,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
 	vfree(ic->i_sends);
 
 ack_dma_out:
-	dma_pool_free(pool, ic->i_ack, ic->i_ack_dma);
+	rds_dma_hdr_free(rds_ibdev->dev, ic->i_ack, ic->i_ack_dma,
+			 DMA_TO_DEVICE);
 	ic->i_ack = NULL;
 
 recv_hdrs_dma_out:
-	rds_dma_hdrs_free(pool, ic->i_recv_hdrs, ic->i_recv_hdrs_dma,
-			  ic->i_recv_ring.w_nr);
+	rds_dma_hdrs_free(rds_ibdev, ic->i_recv_hdrs, ic->i_recv_hdrs_dma,
+			  ic->i_recv_ring.w_nr, DMA_FROM_DEVICE);
 	ic->i_recv_hdrs = NULL;
 	ic->i_recv_hdrs_dma = NULL;
 
 send_hdrs_dma_out:
-	rds_dma_hdrs_free(pool, ic->i_send_hdrs, ic->i_send_hdrs_dma,
-			  ic->i_send_ring.w_nr);
+	rds_dma_hdrs_free(rds_ibdev, ic->i_send_hdrs, ic->i_send_hdrs_dma,
+			  ic->i_send_ring.w_nr, DMA_TO_DEVICE);
 	ic->i_send_hdrs = NULL;
 	ic->i_send_hdrs_dma = NULL;
 
@@ -1110,29 +1137,30 @@ void rds_ib_conn_path_shutdown(struct rds_conn_path *cp)
 		}
 
 		if (ic->rds_ibdev) {
-			struct dma_pool *pool;
-
-			pool = ic->rds_ibdev->rid_hdrs_pool;
-
 			/* then free the resources that ib callbacks use */
 			if (ic->i_send_hdrs) {
-				rds_dma_hdrs_free(pool, ic->i_send_hdrs,
+				rds_dma_hdrs_free(ic->rds_ibdev,
+						  ic->i_send_hdrs,
 						  ic->i_send_hdrs_dma,
-						  ic->i_send_ring.w_nr);
+						  ic->i_send_ring.w_nr,
+						  DMA_TO_DEVICE);
 				ic->i_send_hdrs = NULL;
 				ic->i_send_hdrs_dma = NULL;
 			}
 
 			if (ic->i_recv_hdrs) {
-				rds_dma_hdrs_free(pool, ic->i_recv_hdrs,
+				rds_dma_hdrs_free(ic->rds_ibdev,
+						  ic->i_recv_hdrs,
 						  ic->i_recv_hdrs_dma,
-						  ic->i_recv_ring.w_nr);
+						  ic->i_recv_ring.w_nr,
+						  DMA_FROM_DEVICE);
 				ic->i_recv_hdrs = NULL;
 				ic->i_recv_hdrs_dma = NULL;
 			}
 
 			if (ic->i_ack) {
-				dma_pool_free(pool, ic->i_ack, ic->i_ack_dma);
+				rds_dma_hdr_free(ic->rds_ibdev->dev, ic->i_ack,
+						 ic->i_ack_dma, DMA_TO_DEVICE);
 				ic->i_ack = NULL;
 			}
 		} else {
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 3cffcec5fb37..6fdedd9dbbc2 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -662,10 +662,16 @@ static void rds_ib_send_ack(struct rds_ib_connection *ic, unsigned int adv_credi
 	seq = rds_ib_get_ack(ic);
 
 	rdsdebug("send_ack: ic %p ack %llu\n", ic, (unsigned long long) seq);
+
+	ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev, ic->i_ack_dma,
+				   sizeof(*hdr), DMA_TO_DEVICE);
 	rds_message_populate_header(hdr, 0, 0, 0);
 	hdr->h_ack = cpu_to_be64(seq);
 	hdr->h_credit = adv_credits;
 	rds_message_make_checksum(hdr);
+	ib_dma_sync_single_for_device(ic->rds_ibdev->dev, ic->i_ack_dma,
+				      sizeof(*hdr), DMA_TO_DEVICE);
+
 	ic->i_ack_queued = jiffies;
 
 	ret = ib_post_send(ic->i_cm_id->qp, &ic->i_ack_wr, NULL);
@@ -845,6 +851,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 	struct rds_ib_connection *ic = conn->c_transport_data;
 	struct rds_ib_incoming *ibinc = ic->i_ibinc;
 	struct rds_header *ihdr, *hdr;
+	dma_addr_t dma_addr = ic->i_recv_hdrs_dma[recv - ic->i_recvs];
 
 	/* XXX shut down the connection if port 0,0 are seen? */
 
@@ -863,6 +870,8 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 
 	ihdr = ic->i_recv_hdrs[recv - ic->i_recvs];
 
+	ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev, dma_addr,
+				   sizeof(*ihdr), DMA_FROM_DEVICE);
 	/* Validate the checksum. */
 	if (!rds_message_verify_checksum(ihdr)) {
 		rds_ib_conn_error(conn, "incoming message "
@@ -870,7 +879,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 		       "forcing a reconnect\n",
 		       &conn->c_faddr);
 		rds_stats_inc(s_recv_drop_bad_checksum);
-		return;
+		goto done;
 	}
 
 	/* Process the ACK sequence which comes with every packet */
@@ -899,7 +908,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 		 */
 		rds_ib_frag_free(ic, recv->r_frag);
 		recv->r_frag = NULL;
-		return;
+		goto done;
 	}
 
 	/*
@@ -933,7 +942,7 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 		    hdr->h_dport != ihdr->h_dport) {
 			rds_ib_conn_error(conn,
 				"fragment header mismatch; forcing reconnect\n");
-			return;
+			goto done;
 		}
 	}
 
@@ -965,6 +974,9 @@ static void rds_ib_process_recv(struct rds_connection *conn,
 
 		rds_inc_put(&ibinc->ii_inc);
 	}
+done:
+	ib_dma_sync_single_for_device(ic->rds_ibdev->dev, dma_addr,
+				      sizeof(*ihdr), DMA_FROM_DEVICE);
 }
 
 void rds_ib_recv_cqe_handler(struct rds_ib_connection *ic,
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index dfe778220657..92b4a8689aae 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -638,6 +638,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
 		send->s_sge[0].length = sizeof(struct rds_header);
 		send->s_sge[0].lkey = ic->i_pd->local_dma_lkey;
 
+		ib_dma_sync_single_for_cpu(ic->rds_ibdev->dev,
+					   ic->i_send_hdrs_dma[pos],
+					   sizeof(struct rds_header),
+					   DMA_TO_DEVICE);
 		memcpy(ic->i_send_hdrs[pos], &rm->m_inc.i_hdr,
 		       sizeof(struct rds_header));
 
@@ -688,6 +692,10 @@ int rds_ib_xmit(struct rds_connection *conn, struct rds_message *rm,
 			adv_credits = 0;
 			rds_ib_stats_inc(s_ib_tx_credit_updates);
 		}
+		ib_dma_sync_single_for_device(ic->rds_ibdev->dev,
+					      ic->i_send_hdrs_dma[pos],
+					      sizeof(struct rds_header),
+					      DMA_TO_DEVICE);
 
 		if (prev)
 			prev->s_wr.next = &send->s_wr;

From 8992aab294cb7c70d430e7ad6671ccb0002de5b7 Mon Sep 17 00:00:00 2001
From: Li Zhang <zhanglikernel@gmail.com>
Date: Tue, 5 Oct 2021 01:15:33 +0800
Subject: [PATCH 1235/1750] btrfs: clear MISSING device status bit in
 btrfs_close_one_device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 5d03dbebba2594d2e6fbf3b5dd9060c5a835de3b upstream.

Reported bug: https://github.com/kdave/btrfs-progs/issues/389

There's a problem with scrub reporting aborted status but returning
error code 0, on a filesystem with missing and readded device.

Roughly these steps:

- mkfs -d raid1 dev1 dev2
- fill with data
- unmount
- make dev1 disappear
- mount -o degraded
- copy more data
- make dev1 appear again

Running scrub afterwards reports that the command was aborted, but the
system log message says the exit code was 0.

It seems that the cause of the error is decrementing
fs_devices->missing_devices but not clearing device->dev_state.  Every
time we umount filesystem, it would call close_ctree, And it would
eventually involve btrfs_close_one_device to close the device, but it
only decrements fs_devices->missing_devices but does not clear the
device BTRFS_DEV_STATE_MISSING bit. Worse, this bug will cause Integer
Overflow, because every time umount, fs_devices->missing_devices will
decrease. If fs_devices->missing_devices value hit 0, it would overflow.

With added debugging:

   loop1: detected capacity change from 0 to 20971520
   BTRFS: device fsid 56ad51f1-5523-463b-8547-c19486c51ebb devid 1 transid 21 /dev/loop1 scanned by systemd-udevd (2311)
   loop2: detected capacity change from 0 to 20971520
   BTRFS: device fsid 56ad51f1-5523-463b-8547-c19486c51ebb devid 2 transid 17 /dev/loop2 scanned by systemd-udevd (2313)
   BTRFS info (device loop1): flagging fs with big metadata feature
   BTRFS info (device loop1): allowing degraded mounts
   BTRFS info (device loop1): using free space tree
   BTRFS info (device loop1): has skinny extents
   BTRFS info (device loop1):  before clear_missing.00000000f706684d /dev/loop1 0
   BTRFS warning (device loop1): devid 2 uuid 6635ac31-56dd-4852-873b-c60f5e2d53d2 is missing
   BTRFS info (device loop1):  before clear_missing.0000000000000000 /dev/loop2 1
   BTRFS info (device loop1): flagging fs with big metadata feature
   BTRFS info (device loop1): allowing degraded mounts
   BTRFS info (device loop1): using free space tree
   BTRFS info (device loop1): has skinny extents
   BTRFS info (device loop1):  before clear_missing.00000000f706684d /dev/loop1 0
   BTRFS warning (device loop1): devid 2 uuid 6635ac31-56dd-4852-873b-c60f5e2d53d2 is missing
   BTRFS info (device loop1):  before clear_missing.0000000000000000 /dev/loop2 0
   BTRFS info (device loop1): flagging fs with big metadata feature
   BTRFS info (device loop1): allowing degraded mounts
   BTRFS info (device loop1): using free space tree
   BTRFS info (device loop1): has skinny extents
   BTRFS info (device loop1):  before clear_missing.00000000f706684d /dev/loop1 18446744073709551615
   BTRFS warning (device loop1): devid 2 uuid 6635ac31-56dd-4852-873b-c60f5e2d53d2 is missing
   BTRFS info (device loop1):  before clear_missing.0000000000000000 /dev/loop2 18446744073709551615

If fs_devices->missing_devices is 0, next time it would be 18446744073709551615

After apply this patch, the fs_devices->missing_devices seems to be
right:

  $ truncate -s 10g test1
  $ truncate -s 10g test2
  $ losetup /dev/loop1 test1
  $ losetup /dev/loop2 test2
  $ mkfs.btrfs -draid1 -mraid1 /dev/loop1 /dev/loop2 -f
  $ losetup -d /dev/loop2
  $ mount -o degraded /dev/loop1 /mnt/1
  $ umount /mnt/1
  $ mount -o degraded /dev/loop1 /mnt/1
  $ umount /mnt/1
  $ mount -o degraded /dev/loop1 /mnt/1
  $ umount /mnt/1
  $ dmesg

   loop1: detected capacity change from 0 to 20971520
   loop2: detected capacity change from 0 to 20971520
   BTRFS: device fsid 15aa1203-98d3-4a66-bcae-ca82f629c2cd devid 1 transid 5 /dev/loop1 scanned by mkfs.btrfs (1863)
   BTRFS: device fsid 15aa1203-98d3-4a66-bcae-ca82f629c2cd devid 2 transid 5 /dev/loop2 scanned by mkfs.btrfs (1863)
   BTRFS info (device loop1): flagging fs with big metadata feature
   BTRFS info (device loop1): allowing degraded mounts
   BTRFS info (device loop1): disk space caching is enabled
   BTRFS info (device loop1): has skinny extents
   BTRFS info (device loop1):  before clear_missing.00000000975bd577 /dev/loop1 0
   BTRFS warning (device loop1): devid 2 uuid 8b333791-0b3f-4f57-b449-1c1ab6b51f38 is missing
   BTRFS info (device loop1):  before clear_missing.0000000000000000 /dev/loop2 1
   BTRFS info (device loop1): checking UUID tree
   BTRFS info (device loop1): flagging fs with big metadata feature
   BTRFS info (device loop1): allowing degraded mounts
   BTRFS info (device loop1): disk space caching is enabled
   BTRFS info (device loop1): has skinny extents
   BTRFS info (device loop1):  before clear_missing.00000000975bd577 /dev/loop1 0
   BTRFS warning (device loop1): devid 2 uuid 8b333791-0b3f-4f57-b449-1c1ab6b51f38 is missing
   BTRFS info (device loop1):  before clear_missing.0000000000000000 /dev/loop2 1
   BTRFS info (device loop1): flagging fs with big metadata feature
   BTRFS info (device loop1): allowing degraded mounts
   BTRFS info (device loop1): disk space caching is enabled
   BTRFS info (device loop1): has skinny extents
   BTRFS info (device loop1):  before clear_missing.00000000975bd577 /dev/loop1 0
   BTRFS warning (device loop1): devid 2 uuid 8b333791-0b3f-4f57-b449-1c1ab6b51f38 is missing
   BTRFS info (device loop1):  before clear_missing.0000000000000000 /dev/loop2 1

CC: stable@vger.kernel.org # 4.19+
Signed-off-by: Li Zhang <zhanglikernel@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/volumes.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 593e0c6d6b44..8946355dfe44 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -1133,8 +1133,10 @@ static void btrfs_close_one_device(struct btrfs_device *device)
 	if (device->devid == BTRFS_DEV_REPLACE_DEVID)
 		clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state);
 
-	if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state))
+	if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) {
+		clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state);
 		fs_devices->missing_devices--;
+	}
 
 	btrfs_close_bdev(device);
 	if (device->bdev) {

From b406439afe734da8bbd15b7dcaaa297c77a98905 Mon Sep 17 00:00:00 2001
From: Filipe Manana <fdmanana@suse.com>
Date: Thu, 14 Oct 2021 17:26:04 +0100
Subject: [PATCH 1236/1750] btrfs: fix lost error handling when replaying
 directory deletes

commit 10adb1152d957a4d570ad630f93a88bb961616c1 upstream.

At replay_dir_deletes(), if find_dir_range() returns an error we break out
of the main while loop and then assign a value of 0 (success) to the 'ret'
variable, resulting in completely ignoring that an error happened. Fix
that by jumping to the 'out' label when find_dir_range() returns an error
(negative value).

CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/tree-log.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 3b93a98fd544..4a5a3ae0acaa 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2466,7 +2466,9 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans,
 		else {
 			ret = find_dir_range(log, path, dirid, key_type,
 					     &range_start, &range_end);
-			if (ret != 0)
+			if (ret < 0)
+				goto out;
+			else if (ret > 0)
 				break;
 		}
 

From b4a4c9dc4407ae77ebf4ad8bdf9ecf57e29658b4 Mon Sep 17 00:00:00 2001
From: Anand Jain <anand.jain@oracle.com>
Date: Tue, 19 Oct 2021 18:43:38 +0800
Subject: [PATCH 1237/1750] btrfs: call btrfs_check_rw_degradable only if there
 is a missing device

commit 5c78a5e7aa835c4f08a7c90fe02d19f95a776f29 upstream.

In open_ctree() in btrfs_check_rw_degradable() [1], we check each block
group individually if at least the minimum number of devices is available
for that profile. If all the devices are available, then we don't have to
check degradable.

[1]
open_ctree()
::
3559 if (!sb_rdonly(sb) && !btrfs_check_rw_degradable(fs_info, NULL)) {

Also before calling btrfs_check_rw_degradable() in open_ctee() at the
line number shown below [2] we call btrfs_read_chunk_tree() and down to
add_missing_dev() to record number of missing devices.

[2]
open_ctree()
::
3454         ret = btrfs_read_chunk_tree(fs_info);

btrfs_read_chunk_tree()
  read_one_chunk() / read_one_dev()
    add_missing_dev()

So, check if there is any missing device before btrfs_check_rw_degradable()
in open_ctree().

Also, with this the mount command could save ~16ms.[3] in the most
common case, that is no device is missing.

[3]
 1) * 16934.96 us | btrfs_check_rw_degradable [btrfs]();

CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/btrfs/disk-io.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index ef7df2141f34..9051bb47cbdd 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -3223,7 +3223,8 @@ int __cold open_ctree(struct super_block *sb, struct btrfs_fs_devices *fs_device
 		goto fail_sysfs;
 	}
 
-	if (!sb_rdonly(sb) && !btrfs_check_rw_degradable(fs_info, NULL)) {
+	if (!sb_rdonly(sb) && fs_info->fs_devices->missing_devices &&
+	    !btrfs_check_rw_degradable(fs_info, NULL)) {
 		btrfs_warn(fs_info,
 		"writable mount is not allowed due to too many missing devices");
 		goto fail_sysfs;

From 2f65b76c444587ca1033a9af1ce60766ac910628 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Fri, 8 Oct 2021 17:11:05 -0700
Subject: [PATCH 1238/1750] KVM: VMX: Unregister posted interrupt wakeup
 handler on hardware unsetup

commit ec5a4919fa7b7d8c7a2af1c7e799b1fe4be84343 upstream.

Unregister KVM's posted interrupt wakeup handler during unsetup so that a
spurious interrupt that arrives after kvm_intel.ko is unloaded doesn't
call into freed memory.

Fixes: bf9f6ac8d749 ("KVM: Update Posted-Interrupts Descriptor when vCPU is blocked")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211009001107.3936588-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/vmx.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index f77d98973782..31b4452c931a 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7586,6 +7586,8 @@ static void vmx_migrate_timers(struct kvm_vcpu *vcpu)
 
 static void hardware_unsetup(void)
 {
+	kvm_set_posted_intr_wakeup_handler(NULL);
+
 	if (nested)
 		nested_vmx_hardware_unsetup();
 
@@ -7877,8 +7879,6 @@ static __init int hardware_setup(void)
 		vmx_x86_ops.request_immediate_exit = __kvm_request_immediate_exit;
 	}
 
-	kvm_set_posted_intr_wakeup_handler(pi_wakeup_handler);
-
 	kvm_mce_cap_supported |= MCG_LMCE_P;
 
 	if (pt_mode != PT_MODE_SYSTEM && pt_mode != PT_MODE_HOST_GUEST)
@@ -7900,6 +7900,9 @@ static __init int hardware_setup(void)
 	r = alloc_kvm_area();
 	if (r)
 		nested_vmx_hardware_unsetup();
+
+	kvm_set_posted_intr_wakeup_handler(pi_wakeup_handler);
+
 	return r;
 }
 

From a09a5f4c075d0c91d040d58b8a15d08b5cd94943 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Tue, 14 Sep 2021 23:40:27 +0900
Subject: [PATCH 1239/1750] ia64: kprobes: Fix to pass correct trampoline
 address to the handler

commit a7fe2378454cf46cd5e2776d05e72bbe8f0a468c upstream.

The following commit:

   Commit e792ff804f49 ("ia64: kprobes: Use generic kretprobe trampoline handler")

Passed the wrong trampoline address to __kretprobe_trampoline_handler(): it
passes the descriptor address instead of function entry address.

Pass the right parameter.

Also use correct symbol dereference function to get the function address
from 'kretprobe_trampoline' - an IA64 special.

Link: https://lkml.kernel.org/r/163163042696.489837.12551102356265354730.stgit@devnote2

Fixes: e792ff804f49 ("ia64: kprobes: Use generic kretprobe trampoline handler")
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: X86 ML <x86@kernel.org>
Cc: Daniel Xu <dxu@dxuuu.xyz>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Abhishek Sagar <sagar.abhishek@gmail.com>
Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Cc: Paul McKenney <paulmck@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/ia64/kernel/kprobes.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
index fc1ff8a4d7de..ca4b4fa45aef 100644
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -398,7 +398,8 @@ static void kretprobe_trampoline(void)
 
 int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
-	regs->cr_iip = __kretprobe_trampoline_handler(regs, kretprobe_trampoline, NULL);
+	regs->cr_iip = __kretprobe_trampoline_handler(regs,
+		dereference_function_descriptor(kretprobe_trampoline), NULL);
 	/*
 	 * By returning a non-zero value, we are telling
 	 * kprobe_handler() that we don't want the post_handler
@@ -414,7 +415,7 @@ void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
 	ri->fp = NULL;
 
 	/* Replace the return addr with trampoline addr */
-	regs->b0 = ((struct fnptr *)kretprobe_trampoline)->ip;
+	regs->b0 = (unsigned long)dereference_function_descriptor(kretprobe_trampoline);
 }
 
 /* Check the instruction in the slot is break */
@@ -918,14 +919,14 @@ static struct kprobe trampoline_p = {
 int __init arch_init_kprobes(void)
 {
 	trampoline_p.addr =
-		(kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip;
+		dereference_function_descriptor(kretprobe_trampoline);
 	return register_kprobe(&trampoline_p);
 }
 
 int __kprobes arch_trampoline_kprobe(struct kprobe *p)
 {
 	if (p->addr ==
-		(kprobe_opcode_t *)((struct fnptr *)kretprobe_trampoline)->ip)
+		dereference_function_descriptor(kretprobe_trampoline))
 		return 1;
 
 	return 0;

From db04fb4111e6f5cf1518c7a4718ccde1756f909e Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Wed, 28 Jul 2021 16:03:13 +0200
Subject: [PATCH 1240/1750] selinux: fix race condition when computing ocontext
 SIDs

commit cbfcd13be5cb2a07868afe67520ed181956579a7 upstream.

Current code contains a lot of racy patterns when converting an
ocontext's context structure to an SID. This is being done in a "lazy"
fashion, such that the SID is looked up in the SID table only when it's
first needed and then cached in the "sid" field of the ocontext
structure. However, this is done without any locking or memory barriers
and is thus unsafe.

Between commits 24ed7fdae669 ("selinux: use separate table for initial
SID lookup") and 66f8e2f03c02 ("selinux: sidtab reverse lookup hash
table"), this race condition lead to an actual observable bug, because a
pointer to the shared sid field was passed directly to
sidtab_context_to_sid(), which was using this location to also store an
intermediate value, which could have been read by other threads and
interpreted as an SID. In practice this caused e.g. new mounts to get a
wrong (seemingly random) filesystem context, leading to strange denials.
This bug has been spotted in the wild at least twice, see [1] and [2].

Fix the race condition by making all the racy functions use a common
helper that ensures the ocontext::sid accesses are made safely using the
appropriate SMP constructs.

Note that security_netif_sid() was populating the sid field of both
contexts stored in the ocontext, but only the first one was actually
used. The SELinux wiki's documentation on the "netifcon" policy
statement [3] suggests that using only the first context is intentional.
I kept only the handling of the first context here, as there is really
no point in doing the SID lookup for the unused one.

I wasn't able to reproduce the bug mentioned above on any kernel that
includes commit 66f8e2f03c02, even though it has been reported that the
issue occurs with that commit, too, just less frequently. Thus, I wasn't
able to verify that this patch fixes the issue, but it makes sense to
avoid the race condition regardless.

[1] https://github.com/containers/container-selinux/issues/89
[2] https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.org/thread/6DMTAMHIOAOEMUAVTULJD45JZU7IBAFM/
[3] https://selinuxproject.org/page/NetworkStatements#netifcon

Cc: stable@vger.kernel.org
Cc: Xinjie Zheng <xinjie@google.com>
Reported-by: Sujithra Periasamy <sujithra@google.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/selinux/ss/services.c | 162 ++++++++++++++++-----------------
 1 file changed, 77 insertions(+), 85 deletions(-)

diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index fbdbfb5aa370..31d631fa846e 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2368,6 +2368,43 @@ int security_load_policy(struct selinux_state *state, void *data, size_t len,
 	return rc;
 }
 
+/**
+ * ocontext_to_sid - Helper to safely get sid for an ocontext
+ * @sidtab: SID table
+ * @c: ocontext structure
+ * @index: index of the context entry (0 or 1)
+ * @out_sid: pointer to the resulting SID value
+ *
+ * For all ocontexts except OCON_ISID the SID fields are populated
+ * on-demand when needed. Since updating the SID value is an SMP-sensitive
+ * operation, this helper must be used to do that safely.
+ *
+ * WARNING: This function may return -ESTALE, indicating that the caller
+ * must retry the operation after re-acquiring the policy pointer!
+ */
+static int ocontext_to_sid(struct sidtab *sidtab, struct ocontext *c,
+			   size_t index, u32 *out_sid)
+{
+	int rc;
+	u32 sid;
+
+	/* Ensure the associated sidtab entry is visible to this thread. */
+	sid = smp_load_acquire(&c->sid[index]);
+	if (!sid) {
+		rc = sidtab_context_to_sid(sidtab, &c->context[index], &sid);
+		if (rc)
+			return rc;
+
+		/*
+		 * Ensure the new sidtab entry is visible to other threads
+		 * when they see the SID.
+		 */
+		smp_store_release(&c->sid[index], sid);
+	}
+	*out_sid = sid;
+	return 0;
+}
+
 /**
  * security_port_sid - Obtain the SID for a port.
  * @protocol: protocol number
@@ -2405,17 +2442,13 @@ int security_port_sid(struct selinux_state *state,
 	}
 
 	if (c) {
-		if (!c->sid[0]) {
-			rc = sidtab_context_to_sid(sidtab, &c->context[0],
-						   &c->sid[0]);
-			if (rc == -ESTALE) {
-				rcu_read_unlock();
-				goto retry;
-			}
-			if (rc)
-				goto out;
+		rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+		if (rc == -ESTALE) {
+			rcu_read_unlock();
+			goto retry;
 		}
-		*out_sid = c->sid[0];
+		if (rc)
+			goto out;
 	} else {
 		*out_sid = SECINITSID_PORT;
 	}
@@ -2463,18 +2496,13 @@ int security_ib_pkey_sid(struct selinux_state *state,
 	}
 
 	if (c) {
-		if (!c->sid[0]) {
-			rc = sidtab_context_to_sid(sidtab,
-						   &c->context[0],
-						   &c->sid[0]);
-			if (rc == -ESTALE) {
-				rcu_read_unlock();
-				goto retry;
-			}
-			if (rc)
-				goto out;
+		rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+		if (rc == -ESTALE) {
+			rcu_read_unlock();
+			goto retry;
 		}
-		*out_sid = c->sid[0];
+		if (rc)
+			goto out;
 	} else
 		*out_sid = SECINITSID_UNLABELED;
 
@@ -2522,17 +2550,13 @@ int security_ib_endport_sid(struct selinux_state *state,
 	}
 
 	if (c) {
-		if (!c->sid[0]) {
-			rc = sidtab_context_to_sid(sidtab, &c->context[0],
-						   &c->sid[0]);
-			if (rc == -ESTALE) {
-				rcu_read_unlock();
-				goto retry;
-			}
-			if (rc)
-				goto out;
+		rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+		if (rc == -ESTALE) {
+			rcu_read_unlock();
+			goto retry;
 		}
-		*out_sid = c->sid[0];
+		if (rc)
+			goto out;
 	} else
 		*out_sid = SECINITSID_UNLABELED;
 
@@ -2575,25 +2599,13 @@ int security_netif_sid(struct selinux_state *state,
 	}
 
 	if (c) {
-		if (!c->sid[0] || !c->sid[1]) {
-			rc = sidtab_context_to_sid(sidtab, &c->context[0],
-						   &c->sid[0]);
-			if (rc == -ESTALE) {
-				rcu_read_unlock();
-				goto retry;
-			}
-			if (rc)
-				goto out;
-			rc = sidtab_context_to_sid(sidtab, &c->context[1],
-						   &c->sid[1]);
-			if (rc == -ESTALE) {
-				rcu_read_unlock();
-				goto retry;
-			}
-			if (rc)
-				goto out;
+		rc = ocontext_to_sid(sidtab, c, 0, if_sid);
+		if (rc == -ESTALE) {
+			rcu_read_unlock();
+			goto retry;
 		}
-		*if_sid = c->sid[0];
+		if (rc)
+			goto out;
 	} else
 		*if_sid = SECINITSID_NETIF;
 
@@ -2684,18 +2696,13 @@ int security_node_sid(struct selinux_state *state,
 	}
 
 	if (c) {
-		if (!c->sid[0]) {
-			rc = sidtab_context_to_sid(sidtab,
-						   &c->context[0],
-						   &c->sid[0]);
-			if (rc == -ESTALE) {
-				rcu_read_unlock();
-				goto retry;
-			}
-			if (rc)
-				goto out;
+		rc = ocontext_to_sid(sidtab, c, 0, out_sid);
+		if (rc == -ESTALE) {
+			rcu_read_unlock();
+			goto retry;
 		}
-		*out_sid = c->sid[0];
+		if (rc)
+			goto out;
 	} else {
 		*out_sid = SECINITSID_NODE;
 	}
@@ -2859,7 +2866,7 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
 	u16 sclass;
 	struct genfs *genfs;
 	struct ocontext *c;
-	int rc, cmp = 0;
+	int cmp = 0;
 
 	while (path[0] == '/' && path[1] == '/')
 		path++;
@@ -2873,9 +2880,8 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
 			break;
 	}
 
-	rc = -ENOENT;
 	if (!genfs || cmp)
-		goto out;
+		return -ENOENT;
 
 	for (c = genfs->head; c; c = c->next) {
 		len = strlen(c->u.name);
@@ -2884,20 +2890,10 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
 			break;
 	}
 
-	rc = -ENOENT;
 	if (!c)
-		goto out;
+		return -ENOENT;
 
-	if (!c->sid[0]) {
-		rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]);
-		if (rc)
-			goto out;
-	}
-
-	*sid = c->sid[0];
-	rc = 0;
-out:
-	return rc;
+	return ocontext_to_sid(sidtab, c, 0, sid);
 }
 
 /**
@@ -2980,17 +2976,13 @@ int security_fs_use(struct selinux_state *state, struct super_block *sb)
 
 	if (c) {
 		sbsec->behavior = c->v.behavior;
-		if (!c->sid[0]) {
-			rc = sidtab_context_to_sid(sidtab, &c->context[0],
-						   &c->sid[0]);
-			if (rc == -ESTALE) {
-				rcu_read_unlock();
-				goto retry;
-			}
-			if (rc)
-				goto out;
+		rc = ocontext_to_sid(sidtab, c, 0, &sbsec->sid);
+		if (rc == -ESTALE) {
+			rcu_read_unlock();
+			goto retry;
 		}
-		sbsec->sid = c->sid[0];
+		if (rc)
+			goto out;
 	} else {
 		rc = __security_genfs_sid(policy, fstype, "/",
 					SECCLASS_DIR, &sbsec->sid);

From 5b7e3bb16310e597aac1d35f1bf260143e8d5def Mon Sep 17 00:00:00 2001
From: Zev Weiss <zev@bewilderbeest.net>
Date: Tue, 28 Sep 2021 02:22:35 -0700
Subject: [PATCH 1241/1750] hwmon: (pmbus/lm25066) Add offset coefficients

commit ae59dc455a78fb73034dd1fbb337d7e59c27cbd8 upstream.

With the exception of the lm5066i, all the devices handled by this
driver had been missing their offset ('b') coefficients for direct
format readings.

Cc: stable@vger.kernel.org
Fixes: 58615a94f6a1 ("hwmon: (pmbus/lm25066) Add support for LM25056")
Fixes: e53e6497fc9f ("hwmon: (pmbus/lm25066) Refactor device specific coefficients")
Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
Link: https://lore.kernel.org/r/20210928092242.30036-2-zev@bewilderbeest.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwmon/pmbus/lm25066.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
index 429172a42902..d14f923b3740 100644
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -55,22 +55,27 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
 	[lm25056] = {
 		[PSC_VOLTAGE_IN] = {
 			.m = 16296,
+			.b = 1343,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN] = {
 			.m = 13797,
+			.b = -1833,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN_L] = {
 			.m = 6726,
+			.b = -537,
 			.R = -2,
 		},
 		[PSC_POWER] = {
 			.m = 5501,
+			.b = -2908,
 			.R = -3,
 		},
 		[PSC_POWER_L] = {
 			.m = 26882,
+			.b = -5646,
 			.R = -4,
 		},
 		[PSC_TEMPERATURE] = {
@@ -82,26 +87,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
 	[lm25066] = {
 		[PSC_VOLTAGE_IN] = {
 			.m = 22070,
+			.b = -1800,
 			.R = -2,
 		},
 		[PSC_VOLTAGE_OUT] = {
 			.m = 22070,
+			.b = -1800,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN] = {
 			.m = 13661,
+			.b = -5200,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN_L] = {
 			.m = 6852,
+			.b = -3100,
 			.R = -2,
 		},
 		[PSC_POWER] = {
 			.m = 736,
+			.b = -3300,
 			.R = -2,
 		},
 		[PSC_POWER_L] = {
 			.m = 369,
+			.b = -1900,
 			.R = -2,
 		},
 		[PSC_TEMPERATURE] = {
@@ -111,26 +122,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
 	[lm5064] = {
 		[PSC_VOLTAGE_IN] = {
 			.m = 4611,
+			.b = -642,
 			.R = -2,
 		},
 		[PSC_VOLTAGE_OUT] = {
 			.m = 4621,
+			.b = 423,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN] = {
 			.m = 10742,
+			.b = 1552,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN_L] = {
 			.m = 5456,
+			.b = 2118,
 			.R = -2,
 		},
 		[PSC_POWER] = {
 			.m = 1204,
+			.b = 8524,
 			.R = -3,
 		},
 		[PSC_POWER_L] = {
 			.m = 612,
+			.b = 11202,
 			.R = -3,
 		},
 		[PSC_TEMPERATURE] = {
@@ -140,26 +157,32 @@ static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
 	[lm5066] = {
 		[PSC_VOLTAGE_IN] = {
 			.m = 4587,
+			.b = -1200,
 			.R = -2,
 		},
 		[PSC_VOLTAGE_OUT] = {
 			.m = 4587,
+			.b = -2400,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN] = {
 			.m = 10753,
+			.b = -1200,
 			.R = -2,
 		},
 		[PSC_CURRENT_IN_L] = {
 			.m = 5405,
+			.b = -600,
 			.R = -2,
 		},
 		[PSC_POWER] = {
 			.m = 1204,
+			.b = -6000,
 			.R = -3,
 		},
 		[PSC_POWER_L] = {
 			.m = 605,
+			.b = -8000,
 			.R = -3,
 		},
 		[PSC_TEMPERATURE] = {

From 02ecf56faa56f46be1c6ac7975cdc23710517349 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Fri, 8 Oct 2021 13:37:13 +0200
Subject: [PATCH 1242/1750] regulator: s5m8767: do not use reset value as DVS
 voltage if GPIO DVS is disabled

commit b16bef60a9112b1e6daf3afd16484eb06e7ce792 upstream.

The driver and its bindings, before commit 04f9f068a619 ("regulator:
s5m8767: Modify parsing method of the voltage table of buck2/3/4") were
requiring to provide at least one safe/default voltage for DVS registers
if DVS GPIO is not being enabled.

IOW, if s5m8767,pmic-buck2-uses-gpio-dvs is missing, the
s5m8767,pmic-buck2-dvs-voltage should still be present and contain one
voltage.

This requirement was coming from driver behavior matching this condition
(none of DVS GPIO is enabled): it was always initializing the DVS
selector pins to 0 and keeping the DVS enable setting at reset value
(enabled).  Therefore if none of DVS GPIO is enabled in devicetree,
driver was configuring the first DVS voltage for buck[234].

Mentioned commit 04f9f068a619 ("regulator: s5m8767: Modify parsing
method of the voltage table of buck2/3/4") broke it because DVS voltage
won't be parsed from devicetree if DVS GPIO is not enabled.  After the
change, driver will configure bucks to use the register reset value as
voltage which might have unpleasant effects.

Fix this by relaxing the bindings constrain: if DVS GPIO is not enabled
in devicetree (therefore DVS voltage is also not parsed), explicitly
disable it.

Cc: <stable@vger.kernel.org>
Fixes: 04f9f068a619 ("regulator: s5m8767: Modify parsing method of the voltage table of buck2/3/4")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Acked-by: Rob Herring <robh@kernel.org>
Message-Id: <20211008113723.134648-2-krzysztof.kozlowski@canonical.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../bindings/regulator/samsung,s5m8767.txt    | 21 +++++++------------
 drivers/regulator/s5m8767.c                   | 21 ++++++++-----------
 2 files changed, 17 insertions(+), 25 deletions(-)

diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
index 093edda0c8df..d9cff1614f7a 100644
--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
+++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
@@ -13,6 +13,14 @@ common regulator binding documented in:
 
 
 Required properties of the main device node (the parent!):
+ - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used
+   for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines.
+
+ [1] If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
+     property is specified, then all the eight voltage values for the
+     's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified.
+
+Optional properties of the main device node (the parent!):
  - s5m8767,pmic-buck2-dvs-voltage: A set of 8 voltage values in micro-volt (uV)
    units for buck2 when changing voltage using gpio dvs. Refer to [1] below
    for additional information.
@@ -25,19 +33,6 @@ Required properties of the main device node (the parent!):
    units for buck4 when changing voltage using gpio dvs. Refer to [1] below
    for additional information.
 
- - s5m8767,pmic-buck-ds-gpios: GPIO specifiers for three host gpio's used
-   for selecting GPIO DVS lines. It is one-to-one mapped to dvs gpio lines.
-
- [1] If none of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
-     property is specified, the 's5m8767,pmic-buck[2/3/4]-dvs-voltage'
-     property should specify atleast one voltage level (which would be a
-     safe operating voltage).
-
-     If either of the 's5m8767,pmic-buck[2/3/4]-uses-gpio-dvs' optional
-     property is specified, then all the eight voltage values for the
-     's5m8767,pmic-buck[2/3/4]-dvs-voltage' should be specified.
-
-Optional properties of the main device node (the parent!):
  - s5m8767,pmic-buck2-uses-gpio-dvs: 'buck2' can be controlled by gpio dvs.
  - s5m8767,pmic-buck3-uses-gpio-dvs: 'buck3' can be controlled by gpio dvs.
  - s5m8767,pmic-buck4-uses-gpio-dvs: 'buck4' can be controlled by gpio dvs.
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index 7c111bbdc2af..35269f998210 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -850,18 +850,15 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
 	/* DS4 GPIO */
 	gpio_direction_output(pdata->buck_ds[2], 0x0);
 
-	if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs ||
-	   pdata->buck4_gpiodvs) {
-		regmap_update_bits(s5m8767->iodev->regmap_pmic,
-				S5M8767_REG_BUCK2CTRL, 1 << 1,
-				(pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1));
-		regmap_update_bits(s5m8767->iodev->regmap_pmic,
-				S5M8767_REG_BUCK3CTRL, 1 << 1,
-				(pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1));
-		regmap_update_bits(s5m8767->iodev->regmap_pmic,
-				S5M8767_REG_BUCK4CTRL, 1 << 1,
-				(pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1));
-	}
+	regmap_update_bits(s5m8767->iodev->regmap_pmic,
+			   S5M8767_REG_BUCK2CTRL, 1 << 1,
+			   (pdata->buck2_gpiodvs) ? (1 << 1) : (0 << 1));
+	regmap_update_bits(s5m8767->iodev->regmap_pmic,
+			   S5M8767_REG_BUCK3CTRL, 1 << 1,
+			   (pdata->buck3_gpiodvs) ? (1 << 1) : (0 << 1));
+	regmap_update_bits(s5m8767->iodev->regmap_pmic,
+			   S5M8767_REG_BUCK4CTRL, 1 << 1,
+			   (pdata->buck4_gpiodvs) ? (1 << 1) : (0 << 1));
 
 	/* Initialize GPIO DVS registers */
 	for (i = 0; i < 8; i++) {

From 31f5c925464aa500dbd0bdd59bbc2e23d6d098fc Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Fri, 8 Oct 2021 13:37:14 +0200
Subject: [PATCH 1243/1750] regulator: dt-bindings: samsung,s5m8767: correct
 s5m8767,pmic-buck-default-dvs-idx property

commit a7fda04bc9b6ad9da8e19c9e6e3b1dab773d068a upstream.

The driver was always parsing "s5m8767,pmic-buck-default-dvs-idx", not
"s5m8767,pmic-buck234-default-dvs-idx".

Cc: <stable@vger.kernel.org>
Fixes: 26aec009f6b6 ("regulator: add device tree support for s5m8767")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Acked-by: Rob Herring <robh@kernel.org>
Message-Id: <20211008113723.134648-3-krzysztof.kozlowski@canonical.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
index d9cff1614f7a..6cd83d920155 100644
--- a/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
+++ b/Documentation/devicetree/bindings/regulator/samsung,s5m8767.txt
@@ -39,7 +39,7 @@ Optional properties of the main device node (the parent!):
 
 Additional properties required if either of the optional properties are used:
 
- - s5m8767,pmic-buck234-default-dvs-idx: Default voltage setting selected from
+ - s5m8767,pmic-buck-default-dvs-idx: Default voltage setting selected from
    the possible 8 options selectable by the dvs gpios. The value of this
    property should be between 0 and 7. If not specified or if out of range, the
    default value of this property is set to 0.

From a5d8d76710e83d45af60afe95304d9c46b2258cc Mon Sep 17 00:00:00 2001
From: Eric Badger <ebadger@purestorage.com>
Date: Sun, 10 Oct 2021 10:06:56 -0700
Subject: [PATCH 1244/1750] EDAC/sb_edac: Fix top-of-high-memory value for
 Broadwell/Haswell

commit 537bddd069c743759addf422d0b8f028ff0f8dbc upstream.

The computation of TOHM is off by one bit. This missed bit results in
too low a value for TOHM, which can cause errors in regular memory to
incorrectly report:

  EDAC MC0: 1 CE Error at MMIOH area, on addr 0x000000207fffa680 on any memory

Fixes: 50d1bb93672f ("sb_edac: add support for Haswell based systems")
Cc: stable@vger.kernel.org
Reported-by: Meeta Saggi <msaggi@purestorage.com>
Signed-off-by: Eric Badger <ebadger@purestorage.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/20211010170127.848113-1-ebadger@purestorage.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/edac/sb_edac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 4c626fcd4dcb..1522d4aa2ca6 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -1052,7 +1052,7 @@ static u64 haswell_get_tohm(struct sbridge_pvt *pvt)
 	pci_read_config_dword(pvt->info.pci_vtd, HASWELL_TOHM_1, &reg);
 	rc = ((reg << 6) | rc) << 26;
 
-	return rc | 0x1ffffff;
+	return rc | 0x3ffffff;
 }
 
 static u64 knl_get_tolm(struct sbridge_pvt *pvt)

From fd1e4d8c61ef577c1b21f96d6a04ab0cb771f9d6 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 27 Oct 2021 10:08:19 +0200
Subject: [PATCH 1245/1750] mwifiex: fix division by zero in fw download path

commit 89f8765a11d8df49296d92c404067f9b5c58ee26 upstream.

Add the missing endpoint sanity checks to probe() to avoid division by
zero in mwifiex_write_data_sync() in case a malicious device has broken
descriptors (or when doing descriptor fuzz testing).

Only add checks for the firmware-download boot stage, which require both
command endpoints, for now. The driver looks like it will handle a
missing endpoint during normal operation without oopsing, albeit not
very gracefully as it will try to submit URBs to the default pipe and
fail.

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 4daffe354366 ("mwifiex: add support for Marvell USB8797 chipset")
Cc: stable@vger.kernel.org      # 3.5
Cc: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/marvell/mwifiex/usb.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
index 426e39d4ccf0..9736aa0ab7fd 100644
--- a/drivers/net/wireless/marvell/mwifiex/usb.c
+++ b/drivers/net/wireless/marvell/mwifiex/usb.c
@@ -505,6 +505,22 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
 		}
 	}
 
+	switch (card->usb_boot_state) {
+	case USB8XXX_FW_DNLD:
+		/* Reject broken descriptors. */
+		if (!card->rx_cmd_ep || !card->tx_cmd_ep)
+			return -ENODEV;
+		if (card->bulk_out_maxpktsize == 0)
+			return -ENODEV;
+		break;
+	case USB8XXX_FW_READY:
+		/* Assume the driver can handle missing endpoints for now. */
+		break;
+	default:
+		WARN_ON(1);
+		return -ENODEV;
+	}
+
 	usb_set_intfdata(intf, card);
 
 	ret = mwifiex_add_card(card, &card->fw_done, &usb_ops,

From f34487c7f223c435dce529ec8cfe55826bd9d8e3 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 27 Oct 2021 10:08:18 +0200
Subject: [PATCH 1246/1750] ath6kl: fix division by zero in send path

commit c1b9ca365deae667192be9fe24db244919971234 upstream.

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_usb_hif_tx_sg() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 9cbee358687e ("ath6kl: add full USB support")
Cc: stable@vger.kernel.org      # 3.5
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath6kl/usb.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 5372e948e761..a917092b259c 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -340,6 +340,11 @@ static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb)
 				   le16_to_cpu(endpoint->wMaxPacketSize),
 				   endpoint->bInterval);
 		}
+
+		/* Ignore broken descriptors. */
+		if (usb_endpoint_maxp(endpoint) == 0)
+			continue;
+
 		urbcount = 0;
 
 		pipe_num =

From 1336b2af8adcea8e70b759f3bd852a4ffb1404a1 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:05:20 +0200
Subject: [PATCH 1247/1750] ath6kl: fix control-message timeout

commit a066d28a7e729f808a3e6eff22e70c003091544e upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 241b128b6b69 ("ath6kl: add back beginnings of USB support")
Cc: stable@vger.kernel.org      # 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath6kl/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index a917092b259c..aba70f35e574 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -912,7 +912,7 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb,
 				 req,
 				 USB_DIR_IN | USB_TYPE_VENDOR |
 				 USB_RECIP_DEVICE, value, index, buf,
-				 size, 2 * HZ);
+				 size, 2000);
 
 	if (ret < 0) {
 		ath6kl_warn("Failed to read usb control message: %d\n", ret);

From ce560076091a1c39909db8fee3dd01751b0206a4 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:05:19 +0200
Subject: [PATCH 1248/1750] ath10k: fix control-message timeout

commit 5286132324230168d3fab6ffc16bfd7de85bdfb4 upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Cc: stable@vger.kernel.org      # 4.14
Cc: Erik Stromdahl <erik.stromdahl@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index 19b9c27e30e2..6d831b098cbb 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -525,7 +525,7 @@ static int ath10k_usb_submit_ctrl_in(struct ath10k *ar,
 			      req,
 			      USB_DIR_IN | USB_TYPE_VENDOR |
 			      USB_RECIP_DEVICE, value, index, buf,
-			      size, 2 * HZ);
+			      size, 2000);
 
 	if (ret < 0) {
 		ath10k_warn(ar, "Failed to read usb control message: %d\n",

From 30182b8c138818302d44a16fe5debc66ad23c021 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Wed, 27 Oct 2021 10:08:17 +0200
Subject: [PATCH 1249/1750] ath10k: fix division by zero in send path

commit a006acb931317aad3a8dd41333ebb0453caf49b8 upstream.

Add the missing endpoint max-packet sanity check to probe() to avoid
division by zero in ath10k_usb_hif_tx_sg() in case a malicious device
has broken descriptors (or when doing descriptor fuzz testing).

Note that USB core will reject URBs submitted for endpoints with zero
wMaxPacketSize but that drivers doing packet-size calculations still
need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip
endpoint descriptors with maxpacket=0")).

Fixes: 4db66499df91 ("ath10k: add initial USB support")
Cc: stable@vger.kernel.org      # 4.14
Cc: Erik Stromdahl <erik.stromdahl@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211027080819.6675-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath10k/usb.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index 6d831b098cbb..3d98f19c6ec8 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -853,6 +853,11 @@ static int ath10k_usb_setup_pipe_resources(struct ath10k *ar,
 				   le16_to_cpu(endpoint->wMaxPacketSize),
 				   endpoint->bInterval);
 		}
+
+		/* Ignore broken descriptors. */
+		if (usb_endpoint_maxp(endpoint) == 0)
+			continue;
+
 		urbcount = 0;
 
 		pipe_num =

From 73b79ada4c1c4e26714b611223c49483421ffc25 Mon Sep 17 00:00:00 2001
From: Ingmar Klein <ingmar_klein@web.de>
Date: Fri, 9 Apr 2021 11:26:33 +0200
Subject: [PATCH 1250/1750] PCI: Mark Atheros QCA6174 to avoid bus reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e3f4bd3462f6f796594ecc0dda7144ed2d1e5a26 upstream.

When passing the Atheros QCA6174 through to a virtual machine, the VM hangs
at the point where the ath10k driver loads.

Add a quirk to avoid bus resets on this device, which avoids the hang.

[bhelgaas: commit log]
Link: https://lore.kernel.org/r/08982e05-b6e8-5a8d-24ab-da1488ee50a8@web.de
Signed-off-by: Ingmar Klein <ingmar_klein@web.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Pali Rohár <pali@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 5d2acebc3e96..fb91b2d7b1c5 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3584,6 +3584,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003e, quirk_no_bus_reset);
 
 /*
  * Root port on some Cavium CN8xxx chips do not successfully complete a bus

From eab090dfcb1dbb5b8469343357ad037827345270 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 14:05:21 +0200
Subject: [PATCH 1251/1750] rtl8187: fix control-message timeouts

commit 2e9be536a213e838daed6ba42024dd68954ac061 upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Fixes: 605bebe23bf6 ("[PATCH] Add rtl8187 wireless driver")
Cc: stable@vger.kernel.org      # 2.6.23
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211025120522.6045-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../net/wireless/realtek/rtl818x/rtl8187/rtl8225.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
index 585784258c66..4efab907a3ac 100644
--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
+++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/rtl8225.c
@@ -28,7 +28,7 @@ u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv,
 	usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
 			RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
 			(unsigned long)addr, idx & 0x03,
-			&priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits8, sizeof(val), 500);
 
 	val = priv->io_dmabuf->bits8;
 	mutex_unlock(&priv->io_mutex);
@@ -45,7 +45,7 @@ u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv,
 	usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
 			RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
 			(unsigned long)addr, idx & 0x03,
-			&priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits16, sizeof(val), 500);
 
 	val = priv->io_dmabuf->bits16;
 	mutex_unlock(&priv->io_mutex);
@@ -62,7 +62,7 @@ u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv,
 	usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
 			RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
 			(unsigned long)addr, idx & 0x03,
-			&priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits32, sizeof(val), 500);
 
 	val = priv->io_dmabuf->bits32;
 	mutex_unlock(&priv->io_mutex);
@@ -79,7 +79,7 @@ void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
 			(unsigned long)addr, idx & 0x03,
-			&priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits8, sizeof(val), 500);
 
 	mutex_unlock(&priv->io_mutex);
 }
@@ -93,7 +93,7 @@ void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
 			(unsigned long)addr, idx & 0x03,
-			&priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits16, sizeof(val), 500);
 
 	mutex_unlock(&priv->io_mutex);
 }
@@ -107,7 +107,7 @@ void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
 			(unsigned long)addr, idx & 0x03,
-			&priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+			&priv->io_dmabuf->bits32, sizeof(val), 500);
 
 	mutex_unlock(&priv->io_mutex);
 }
@@ -183,7 +183,7 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data)
 	usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
 			RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
 			addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
-			HZ / 2);
+			500);
 
 	mutex_unlock(&priv->io_mutex);
 

From c7400e2ec8de2cf0f8a858aeeaec2722106b2aab Mon Sep 17 00:00:00 2001
From: Austin Kim <austin.kim@lge.com>
Date: Thu, 28 Oct 2021 12:26:42 +0100
Subject: [PATCH 1252/1750] evm: mark evm_fixmode as __ro_after_init

commit 32ba540f3c2a7ef61ed5a577ce25069a3d714fc9 upstream.

The evm_fixmode is only configurable by command-line option and it is never
modified outside initcalls, so declaring it with __ro_after_init is better.

Signed-off-by: Austin Kim <austin.kim@lge.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/integrity/evm/evm_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
index f1ca3cac9b86..b929c683aba1 100644
--- a/security/integrity/evm/evm_main.c
+++ b/security/integrity/evm/evm_main.c
@@ -54,7 +54,7 @@ static struct xattr_list evm_config_default_xattrnames[] = {
 
 LIST_HEAD(evm_config_xattrnames);
 
-static int evm_fixmode;
+static int evm_fixmode __ro_after_init;
 static int __init evm_set_fixmode(char *str)
 {
 	if (strncmp(str, "fix", 3) == 0)

From c044f34ca22f26b0845912e3ca7b33d77b041c70 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas@wunner.de>
Date: Tue, 26 Oct 2021 07:15:32 +0200
Subject: [PATCH 1253/1750] ifb: Depend on netfilter alternatively to tc

commit 046178e726c2977d686ba5e07105d5a6685c830e upstream.

IFB originally depended on NET_CLS_ACT for traffic redirection.
But since v4.5, that may be achieved with NFT_FWD_NETDEV as well.

Fixes: 39e6dea28adc ("netfilter: nf_tables: add forward expression to the netdev family")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.5+: bcfabee1afd9: netfilter: nft_fwd_netdev: allow to redirect to ifb via ingress
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 600b9d09ec08..cb865b7ec375 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -148,7 +148,7 @@ config NET_FC
 
 config IFB
 	tristate "Intermediate Functional Block support"
-	depends on NET_CLS_ACT
+	depends on NET_ACT_MIRRED || NFT_FWD_NETDEV
 	select NET_REDIRECT
 	help
 	  This is an intermediate driver that allows sharing of

From 3d62e1c9bc5575ac042748814a1d3d3e5cc967d6 Mon Sep 17 00:00:00 2001
From: Loic Poulain <loic.poulain@linaro.org>
Date: Wed, 20 Oct 2021 15:38:53 +0200
Subject: [PATCH 1254/1750] wcn36xx: Fix HT40 capability for 2Ghz band

commit 960ae77f25631bbe4e3aafefe209b52e044baf31 upstream.

All wcn36xx controllers are supposed to support HT40 (and SGI40),
This doubles the maximum bitrate/throughput with compatible APs.

Tested with wcn3620 & wcn3680B.

Cc: stable@vger.kernel.org
Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634737133-22336-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/wcn36xx/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 43be20baab35..883534125df1 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -134,7 +134,9 @@ static struct ieee80211_supported_band wcn_band_2ghz = {
 		.cap =	IEEE80211_HT_CAP_GRN_FLD |
 			IEEE80211_HT_CAP_SGI_20 |
 			IEEE80211_HT_CAP_DSSSCCK40 |
-			IEEE80211_HT_CAP_LSIG_TXOP_PROT,
+			IEEE80211_HT_CAP_LSIG_TXOP_PROT |
+			IEEE80211_HT_CAP_SGI_40 |
+			IEEE80211_HT_CAP_SUP_WIDTH_20_40,
 		.ht_supported = true,
 		.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K,
 		.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,

From c1b8ad661ff16e89cf7753cfe81afea5094f163b Mon Sep 17 00:00:00 2001
From: Loic Poulain <loic.poulain@linaro.org>
Date: Mon, 25 Oct 2021 16:12:18 +0300
Subject: [PATCH 1255/1750] wcn36xx: Fix tx_status mechanism

commit a9e79b116cc4d0057e912be8f40b2c2e5bdc7c43 upstream.

This change fix the TX ack mechanism in various ways:

- For NO_ACK tagged packets, we don't need to wait for TX_ACK indication
and so are not subject to the single packet ack limitation. So we don't
have to stop the tx queue, and can call the tx status callback as soon
as DMA transfer has completed.

- Fix skb ownership/reference. Only start status indication timeout
once the DMA transfer has been completed. This avoids the skb to be
both referenced in the DMA tx ring and by the tx_ack_skb pointer,
preventing any use-after-free or double-free.

- This adds a sanity (paranoia?) check on the skb tx ack pointer.

- Resume TX queue if TX status tagged packet TX fails.

Cc: stable@vger.kernel.org
Fixes: fdf21cc37149 ("wcn36xx: Add TX ack support")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634567281-28997-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/wcn36xx/dxe.c  | 37 ++++++++++---------------
 drivers/net/wireless/ath/wcn36xx/txrx.c | 31 ++++-----------------
 2 files changed, 21 insertions(+), 47 deletions(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 63079231e48e..70c46c327512 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -403,8 +403,21 @@ static void reap_tx_dxes(struct wcn36xx *wcn, struct wcn36xx_dxe_ch *ch)
 			dma_unmap_single(wcn->dev, ctl->desc->src_addr_l,
 					 ctl->skb->len, DMA_TO_DEVICE);
 			info = IEEE80211_SKB_CB(ctl->skb);
-			if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)) {
-				/* Keep frame until TX status comes */
+			if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
+				if (info->flags & IEEE80211_TX_CTL_NO_ACK) {
+					info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
+					ieee80211_tx_status_irqsafe(wcn->hw, ctl->skb);
+				} else {
+					/* Wait for the TX ack indication or timeout... */
+					spin_lock(&wcn->dxe_lock);
+					if (WARN_ON(wcn->tx_ack_skb))
+						ieee80211_free_txskb(wcn->hw, wcn->tx_ack_skb);
+					wcn->tx_ack_skb = ctl->skb; /* Tracking ref */
+					mod_timer(&wcn->tx_ack_timer, jiffies + HZ / 10);
+					spin_unlock(&wcn->dxe_lock);
+				}
+				/* do not free, ownership transferred to mac80211 status cb */
+			} else {
 				ieee80211_free_txskb(wcn->hw, ctl->skb);
 			}
 
@@ -426,7 +439,6 @@ static irqreturn_t wcn36xx_irq_tx_complete(int irq, void *dev)
 {
 	struct wcn36xx *wcn = (struct wcn36xx *)dev;
 	int int_src, int_reason;
-	bool transmitted = false;
 
 	wcn36xx_dxe_read_register(wcn, WCN36XX_DXE_INT_SRC_RAW_REG, &int_src);
 
@@ -466,7 +478,6 @@ static irqreturn_t wcn36xx_irq_tx_complete(int irq, void *dev)
 		if (int_reason & (WCN36XX_CH_STAT_INT_DONE_MASK |
 				  WCN36XX_CH_STAT_INT_ED_MASK)) {
 			reap_tx_dxes(wcn, &wcn->dxe_tx_h_ch);
-			transmitted = true;
 		}
 	}
 
@@ -479,7 +490,6 @@ static irqreturn_t wcn36xx_irq_tx_complete(int irq, void *dev)
 					   WCN36XX_DXE_0_INT_CLR,
 					   WCN36XX_INT_MASK_CHAN_TX_L);
 
-
 		if (int_reason & WCN36XX_CH_STAT_INT_ERR_MASK ) {
 			wcn36xx_dxe_write_register(wcn,
 						   WCN36XX_DXE_0_INT_ERR_CLR,
@@ -507,26 +517,9 @@ static irqreturn_t wcn36xx_irq_tx_complete(int irq, void *dev)
 		if (int_reason & (WCN36XX_CH_STAT_INT_DONE_MASK |
 				  WCN36XX_CH_STAT_INT_ED_MASK)) {
 			reap_tx_dxes(wcn, &wcn->dxe_tx_l_ch);
-			transmitted = true;
 		}
 	}
 
-	spin_lock(&wcn->dxe_lock);
-	if (wcn->tx_ack_skb && transmitted) {
-		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(wcn->tx_ack_skb);
-
-		/* TX complete, no need to wait for 802.11 ack indication */
-		if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS &&
-		    info->flags & IEEE80211_TX_CTL_NO_ACK) {
-			info->flags |= IEEE80211_TX_STAT_NOACK_TRANSMITTED;
-			del_timer(&wcn->tx_ack_timer);
-			ieee80211_tx_status_irqsafe(wcn->hw, wcn->tx_ack_skb);
-			wcn->tx_ack_skb = NULL;
-			ieee80211_wake_queues(wcn->hw);
-		}
-	}
-	spin_unlock(&wcn->dxe_lock);
-
 	return IRQ_HANDLED;
 }
 
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index cab196bb38cd..f2e20449d4fb 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -502,10 +502,11 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 	struct wcn36xx_vif *vif_priv = NULL;
 	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-	unsigned long flags;
 	bool is_low = ieee80211_is_data(hdr->frame_control);
 	bool bcast = is_broadcast_ether_addr(hdr->addr1) ||
 		is_multicast_ether_addr(hdr->addr1);
+	bool ack_ind = (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) &&
+					!(info->flags & IEEE80211_TX_CTL_NO_ACK);
 	struct wcn36xx_tx_bd bd;
 	int ret;
 
@@ -521,30 +522,16 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
 
 	bd.dpu_rf = WCN36XX_BMU_WQ_TX;
 
-	if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
+	if (unlikely(ack_ind)) {
 		wcn36xx_dbg(WCN36XX_DBG_DXE, "TX_ACK status requested\n");
 
-		spin_lock_irqsave(&wcn->dxe_lock, flags);
-		if (wcn->tx_ack_skb) {
-			spin_unlock_irqrestore(&wcn->dxe_lock, flags);
-			wcn36xx_warn("tx_ack_skb already set\n");
-			return -EINVAL;
-		}
-
-		wcn->tx_ack_skb = skb;
-		spin_unlock_irqrestore(&wcn->dxe_lock, flags);
-
 		/* Only one at a time is supported by fw. Stop the TX queues
 		 * until the ack status gets back.
 		 */
 		ieee80211_stop_queues(wcn->hw);
 
-		/* TX watchdog if no TX irq or ack indication received  */
-		mod_timer(&wcn->tx_ack_timer, jiffies + HZ / 10);
-
 		/* Request ack indication from the firmware */
-		if (!(info->flags & IEEE80211_TX_CTL_NO_ACK))
-			bd.tx_comp = 1;
+		bd.tx_comp = 1;
 	}
 
 	/* Data frames served first*/
@@ -558,14 +545,8 @@ int wcn36xx_start_tx(struct wcn36xx *wcn,
 	bd.tx_bd_sign = 0xbdbdbdbd;
 
 	ret = wcn36xx_dxe_tx_frame(wcn, vif_priv, &bd, skb, is_low);
-	if (ret && (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS)) {
-		/* If the skb has not been transmitted,
-		 * don't keep a reference to it.
-		 */
-		spin_lock_irqsave(&wcn->dxe_lock, flags);
-		wcn->tx_ack_skb = NULL;
-		spin_unlock_irqrestore(&wcn->dxe_lock, flags);
-
+	if (unlikely(ret && ack_ind)) {
+		/* If the skb has not been transmitted, resume TX queue */
 		ieee80211_wake_queues(wcn->hw);
 	}
 

From 1c422d63010a741902c233bec6ef07eae944b661 Mon Sep 17 00:00:00 2001
From: Loic Poulain <loic.poulain@linaro.org>
Date: Mon, 25 Oct 2021 16:12:18 +0300
Subject: [PATCH 1256/1750] wcn36xx: Fix (QoS) null data frame
 bitrate/modulation

commit d3fd2c95c1c13ec217d43ebef3c61cfa00a6cd37 upstream.

We observe unexpected connection drops with some APs due to
non-acked mac80211 generated null data frames (keep-alive).
After debugging and capture, we noticed that null frames are
submitted at standard data bitrate and that the given APs are
in trouble with that.

After setting the null frame bitrate to control bitrate, all
null frames are acked as expected and connection is maintained.

Not sure if it's a requirement of the specification, but it seems
the right thing to do anyway, null frames are mostly used for control
purpose (power-saving, keep-alive...), and submitting them with
a slower/simpler bitrate/modulation is more robust.

Cc: stable@vger.kernel.org
Fixes: 512b191d9652 ("wcn36xx: Fix TX data path")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634560399-15290-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/wcn36xx/txrx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index f2e20449d4fb..eaf2410e3964 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -429,6 +429,7 @@ static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
 	if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
 		/* Don't use a regular queue for null packet (no ampdu) */
 		bd->queue_id = WCN36XX_TX_U_WQ_ID;
+		bd->bd_rate = WCN36XX_BD_RATE_CTRL;
 	}
 
 	if (bcast) {

From daccf40320d41fe7241caa8c47584b934b0fe97f Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Fri, 22 Oct 2021 14:58:23 +0200
Subject: [PATCH 1257/1750] PM: sleep: Do not let "syscore" devices
 runtime-suspend during system transitions

commit 928265e3601cde78c7e0a3e518a93b27defed3b1 upstream.

There is no reason to allow "syscore" devices to runtime-suspend
during system-wide PM transitions, because they are subject to the
same possible failure modes as any other devices in that respect.

Accordingly, change device_prepare() and device_complete() to call
pm_runtime_get_noresume() and pm_runtime_put(), respectively, for
"syscore" devices too.

Fixes: 057d51a1268f ("Merge branch 'pm-sleep'")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: 3.10+ <stable@vger.kernel.org> # 3.10+
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/base/power/main.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 192b1c7286b3..4167e2aef397 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1053,7 +1053,7 @@ static void device_complete(struct device *dev, pm_message_t state)
 	const char *info = NULL;
 
 	if (dev->power.syscore)
-		return;
+		goto out;
 
 	device_lock(dev);
 
@@ -1083,6 +1083,7 @@ static void device_complete(struct device *dev, pm_message_t state)
 
 	device_unlock(dev);
 
+out:
 	pm_runtime_put(dev);
 }
 
@@ -1796,9 +1797,6 @@ static int device_prepare(struct device *dev, pm_message_t state)
 	int (*callback)(struct device *) = NULL;
 	int ret = 0;
 
-	if (dev->power.syscore)
-		return 0;
-
 	/*
 	 * If a device's parent goes into runtime suspend at the wrong time,
 	 * it won't be possible to resume the device.  To prevent this we
@@ -1807,6 +1805,9 @@ static int device_prepare(struct device *dev, pm_message_t state)
 	 */
 	pm_runtime_get_noresume(dev);
 
+	if (dev->power.syscore)
+		return 0;
+
 	device_lock(dev);
 
 	dev->power.wakeup_path = false;

From d59d2f7af7e041cafe32a7c42002308ea53dc24f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
Date: Mon, 11 Oct 2021 15:32:23 +0200
Subject: [PATCH 1258/1750] mwifiex: Read a PCI register after writing the TX
 ring write pointer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e5f4eb8223aa740237cd463246a7debcddf4eda1 upstream.

On the 88W8897 PCIe+USB card the firmware randomly crashes after setting
the TX ring write pointer. The issue is present in the latest firmware
version 15.68.19.p21 of the PCIe+USB card.

Those firmware crashes can be worked around by reading any PCI register
of the card after setting that register, so read the PCI_VENDOR_ID
register here. The reason this works is probably because we keep the bus
from entering an ASPM state for a bit longer, because that's what causes
the cards firmware to crash.

This fixes a bug where during RX/TX traffic and with ASPM L1 substates
enabled (the specific substates where the issue happens appear to be
platform dependent), the firmware crashes and eventually a command
timeout appears in the logs.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=109681
Cc: stable@vger.kernel.org
Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211011133224.15561-2-verdre@v0yd.nl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/marvell/mwifiex/pcie.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index b2de8d03c5fa..3c154f7ffbb9 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -1480,6 +1480,14 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
 			ret = -1;
 			goto done_unmap;
 		}
+
+		/* The firmware (latest version 15.68.19.p21) of the 88W8897 PCIe+USB card
+		 * seems to crash randomly after setting the TX ring write pointer when
+		 * ASPM powersaving is enabled. A workaround seems to be keeping the bus
+		 * busy by reading a random register afterwards.
+		 */
+		mwifiex_read_reg(adapter, PCI_VENDOR_ID, &rx_val);
+
 		if ((mwifiex_pcie_txbd_not_full(card)) &&
 		    tx_param->next_pkt_len) {
 			/* have more packets and TxBD still can hold more */

From 890e416c026ee339cd08c6d8e4fba86868e3f510 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
Date: Mon, 11 Oct 2021 15:32:24 +0200
Subject: [PATCH 1259/1750] mwifiex: Try waking the firmware until we get an
 interrupt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 8e3e59c31fea5de95ffc52c46f0c562c39f20c59 upstream.

It seems that the PCIe+USB firmware (latest version 15.68.19.p21) of the
88W8897 card sometimes ignores or misses when we try to wake it up by
writing to the firmware status register. This leads to the firmware
wakeup timeout expiring and the driver resetting the card because we
assume the firmware has hung up or crashed.

Turns out that the firmware actually didn't hang up, but simply "missed"
our wakeup request and didn't send us an interrupt with an AWAKE event.

Trying again to read the firmware status register after a short timeout
usually makes the firmware wake up as expected, so add a small retry
loop to mwifiex_pm_wakeup_card() that looks at the interrupt status to
check whether the card woke up.

The number of tries and timeout lengths for this were determined
experimentally: The firmware usually takes about 500 us to wake up
after we attempt to read the status register. In some cases where the
firmware is very busy (for example while doing a bluetooth scan) it
might even miss our requests for multiple milliseconds, which is why
after 15 tries the waiting time gets increased to 10 ms. The maximum
number of tries it took to wake the firmware when testing this was
around 20, so a maximum number of 50 tries should give us plenty of
safety margin.

Here's a reproducer for those firmware wakeup failures I've found:

1) Make sure wifi powersaving is enabled (iw dev wlp1s0 set power_save on)
2) Connect to any wifi network (makes firmware go into wifi powersaving
mode, not deep sleep)
3) Make sure bluetooth is turned off (to ensure the firmware actually
enters powersave mode and doesn't keep the radio active doing bluetooth
stuff)
4) To confirm that wifi powersaving is entered ping a device on the LAN,
pings should be a few ms higher than without powersaving
5) Run "while true; do iwconfig; sleep 0.0001; done", this wakes and
suspends the firmware extremely often
6) Wait until things explode, for me it consistently takes <5 minutes

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=109681
Cc: stable@vger.kernel.org
Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211011133224.15561-3-verdre@v0yd.nl
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/marvell/mwifiex/pcie.c | 28 +++++++++++++++++----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index 3c154f7ffbb9..7c137eba8cda 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -17,6 +17,7 @@
  * this warranty disclaimer.
  */
 
+#include <linux/iopoll.h>
 #include <linux/firmware.h>
 
 #include "decl.h"
@@ -637,11 +638,15 @@ static void mwifiex_delay_for_sleep_cookie(struct mwifiex_adapter *adapter,
 			    "max count reached while accessing sleep cookie\n");
 }
 
+#define N_WAKEUP_TRIES_SHORT_INTERVAL 15
+#define N_WAKEUP_TRIES_LONG_INTERVAL 35
+
 /* This function wakes up the card by reading fw_status register. */
 static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 {
 	struct pcie_service_card *card = adapter->card;
 	const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
+	int retval;
 
 	mwifiex_dbg(adapter, EVENT,
 		    "event: Wakeup device...\n");
@@ -649,11 +654,24 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
 	if (reg->sleep_cookie)
 		mwifiex_pcie_dev_wakeup_delay(adapter);
 
-	/* Accessing fw_status register will wakeup device */
-	if (mwifiex_write_reg(adapter, reg->fw_status, FIRMWARE_READY_PCIE)) {
-		mwifiex_dbg(adapter, ERROR,
-			    "Writing fw_status register failed\n");
-		return -1;
+	/* The 88W8897 PCIe+USB firmware (latest version 15.68.19.p21) sometimes
+	 * appears to ignore or miss our wakeup request, so we continue trying
+	 * until we receive an interrupt from the card.
+	 */
+	if (read_poll_timeout(mwifiex_write_reg, retval,
+			      READ_ONCE(adapter->int_status) != 0,
+			      500, 500 * N_WAKEUP_TRIES_SHORT_INTERVAL,
+			      false,
+			      adapter, reg->fw_status, FIRMWARE_READY_PCIE)) {
+		if (read_poll_timeout(mwifiex_write_reg, retval,
+				      READ_ONCE(adapter->int_status) != 0,
+				      10000, 10000 * N_WAKEUP_TRIES_LONG_INTERVAL,
+				      false,
+				      adapter, reg->fw_status, FIRMWARE_READY_PCIE)) {
+			mwifiex_dbg(adapter, ERROR,
+				    "Firmware didn't wake up\n");
+			return -EIO;
+		}
 	}
 
 	if (reg->sleep_cookie) {

From 701cf28e019d5f88684aec194d7f0119772bc10a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Reimar=20D=C3=B6ffinger?= <Reimar.Doeffinger@gmx.de>
Date: Tue, 12 Oct 2021 08:27:44 +0200
Subject: [PATCH 1260/1750] libata: fix checking of DMA state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit f971a85439bd25dc7b4d597cf5e4e8dc7ffc884b upstream.

Checking if DMA is enabled should be done via the
ata_dma_enabled helper function, since the init state
0xff indicates disabled.
This meant that ATA_CMD_READ_LOG_DMA_EXT was used and probed
for before DMA was enabled, which caused hangs for some combinations
of controllers and devices.
It might also have caused it to be incorrectly disabled as broken,
but there have been no reports of that.

Cc: stable@vger.kernel.org
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=195895
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/ata/libata-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 8916163d508e..8acf99b88b21 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2004,7 +2004,7 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
 
 retry:
 	ata_tf_init(dev, &tf);
-	if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
+	if (ata_dma_enabled(dev) && ata_id_has_read_log_dma_ext(dev->id) &&
 	    !(dev->horkage & ATA_HORKAGE_NO_DMA_LOG)) {
 		tf.command = ATA_CMD_READ_LOG_DMA_EXT;
 		tf.protocol = ATA_PROT_DMA;

From a194e9c721d9e0ca6fc10814acb647055d8f3d18 Mon Sep 17 00:00:00 2001
From: Benjamin Li <benl@squareup.com>
Date: Wed, 1 Sep 2021 11:06:05 -0700
Subject: [PATCH 1261/1750] wcn36xx: handle connection loss indication

commit d6dbce453b19c64b96f3e927b10230f9a704b504 upstream.

Firmware sends delete_sta_context_ind when it detects the AP has gone
away in STA mode. Right now the handler for that indication only handles
AP mode; fix it to also handle STA mode.

Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Li <benl@squareup.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210901180606.11686-1-benl@squareup.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/wcn36xx/smd.c | 44 +++++++++++++++++++-------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 766400f7b61c..3793907ace92 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2632,30 +2632,52 @@ static int wcn36xx_smd_delete_sta_context_ind(struct wcn36xx *wcn,
 					      size_t len)
 {
 	struct wcn36xx_hal_delete_sta_context_ind_msg *rsp = buf;
-	struct wcn36xx_vif *tmp;
+	struct wcn36xx_vif *vif_priv;
+	struct ieee80211_vif *vif;
+	struct ieee80211_bss_conf *bss_conf;
 	struct ieee80211_sta *sta;
+	bool found = false;
 
 	if (len != sizeof(*rsp)) {
 		wcn36xx_warn("Corrupted delete sta indication\n");
 		return -EIO;
 	}
 
-	wcn36xx_dbg(WCN36XX_DBG_HAL, "delete station indication %pM index %d\n",
-		    rsp->addr2, rsp->sta_id);
+	wcn36xx_dbg(WCN36XX_DBG_HAL,
+		    "delete station indication %pM index %d reason %d\n",
+		    rsp->addr2, rsp->sta_id, rsp->reason_code);
 
-	list_for_each_entry(tmp, &wcn->vif_list, list) {
+	list_for_each_entry(vif_priv, &wcn->vif_list, list) {
 		rcu_read_lock();
-		sta = ieee80211_find_sta(wcn36xx_priv_to_vif(tmp), rsp->addr2);
-		if (sta)
-			ieee80211_report_low_ack(sta, 0);
+		vif = wcn36xx_priv_to_vif(vif_priv);
+
+		if (vif->type == NL80211_IFTYPE_STATION) {
+			/* We could call ieee80211_find_sta too, but checking
+			 * bss_conf is clearer.
+			 */
+			bss_conf = &vif->bss_conf;
+			if (vif_priv->sta_assoc &&
+			    !memcmp(bss_conf->bssid, rsp->addr2, ETH_ALEN)) {
+				found = true;
+				wcn36xx_dbg(WCN36XX_DBG_HAL,
+					    "connection loss bss_index %d\n",
+					    vif_priv->bss_index);
+				ieee80211_connection_loss(vif);
+			}
+		} else {
+			sta = ieee80211_find_sta(vif, rsp->addr2);
+			if (sta) {
+				found = true;
+				ieee80211_report_low_ack(sta, 0);
+			}
+		}
+
 		rcu_read_unlock();
-		if (sta)
+		if (found)
 			return 0;
 	}
 
-	wcn36xx_warn("STA with addr %pM and index %d not found\n",
-		     rsp->addr2,
-		     rsp->sta_id);
+	wcn36xx_warn("BSS or STA with addr %pM not found\n", rsp->addr2);
 	return -ENOENT;
 }
 

From 46752a7aed913a7f653053f025f96d0d9a457f84 Mon Sep 17 00:00:00 2001
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
Date: Mon, 30 Aug 2021 17:26:44 +0200
Subject: [PATCH 1262/1750] rsi: fix occasional initialisation failure with BT
 coex

commit 9b14ed6e11b72dd4806535449ca6c6962cb2369d upstream.

When BT coexistence is enabled (eg oper mode 13, which is the default)
the initialisation on startup sometimes silently fails.

In a normal initialisation we see
	usb 1-1.3: Product: Wireless USB Network Module
	usb 1-1.3: Manufacturer: Redpine Signals, Inc.
	usb 1-1.3: SerialNumber: 000000000001
	rsi_91x: rsi_probe: Initialized os intf ops
	rsi_91x: rsi_load_9116_firmware: Loading chunk 0
	rsi_91x: rsi_load_9116_firmware: Loading chunk 1
	rsi_91x: rsi_load_9116_firmware: Loading chunk 2
	rsi_91x: Max Stations Allowed = 1

But sometimes the last log is missing and the wlan net device is
not created.

Running a userspace loop that resets the hardware via a GPIO shows the
problem occurring ~5/100 resets.

The problem does not occur in oper mode 1 (wifi only).

Adding logs shows that the initialisation state machine requests a MAC
reset via rsi_send_reset_mac() but the firmware does not reply, leading
to the initialisation sequence being incomplete.

Fix this by delaying attaching the BT adapter until the wifi
initialisation has completed.

With this applied I have done > 300 reset loops with no errors.

Fixes: 716b840c7641 ("rsi: handle BT traffic in driver")
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
CC: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1630337206-12410-2-git-send-email-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/rsi/rsi_91x_main.c | 16 +++++++++++++---
 drivers/net/wireless/rsi/rsi_91x_mgmt.c |  3 +++
 drivers/net/wireless/rsi/rsi_main.h     |  2 ++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
index 9a3d2439a8e7..0a2f8b4f447b 100644
--- a/drivers/net/wireless/rsi/rsi_91x_main.c
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -211,9 +211,10 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len)
 			bt_pkt_type = frame_desc[offset + BT_RX_PKT_TYPE_OFST];
 			if (bt_pkt_type == BT_CARD_READY_IND) {
 				rsi_dbg(INFO_ZONE, "BT Card ready recvd\n");
-				if (rsi_bt_ops.attach(common, &g_proto_ops))
-					rsi_dbg(ERR_ZONE,
-						"Failed to attach BT module\n");
+				if (common->fsm_state == FSM_MAC_INIT_DONE)
+					rsi_attach_bt(common);
+				else
+					common->bt_defer_attach = true;
 			} else {
 				if (common->bt_adapter)
 					rsi_bt_ops.recv_pkt(common->bt_adapter,
@@ -278,6 +279,15 @@ void rsi_set_bt_context(void *priv, void *bt_context)
 }
 #endif
 
+void rsi_attach_bt(struct rsi_common *common)
+{
+#ifdef CONFIG_RSI_COEX
+	if (rsi_bt_ops.attach(common, &g_proto_ops))
+		rsi_dbg(ERR_ZONE,
+			"Failed to attach BT module\n");
+#endif
+}
+
 /**
  * rsi_91x_init() - This function initializes os interface operations.
  * @oper_mode: One of DEV_OPMODE_*.
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index b6d050a2fbe7..275370d37880 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -2071,6 +2071,9 @@ static int rsi_handle_ta_confirm_type(struct rsi_common *common,
 				if (common->reinit_hw) {
 					complete(&common->wlan_init_completion);
 				} else {
+					if (common->bt_defer_attach)
+						rsi_attach_bt(common);
+
 					return rsi_mac80211_attach(common);
 				}
 			}
diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h
index b3e25bc28682..f7a4636b7bca 100644
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -320,6 +320,7 @@ struct rsi_common {
 	struct ieee80211_vif *roc_vif;
 
 	bool eapol4_confirm;
+	bool bt_defer_attach;
 	void *bt_adapter;
 
 	struct cfg80211_scan_request *hwscan;
@@ -401,5 +402,6 @@ struct rsi_host_intf_ops {
 
 enum rsi_host_intf rsi_get_host_intf(void *priv);
 void rsi_set_bt_context(void *priv, void *bt_context);
+void rsi_attach_bt(struct rsi_common *common);
 
 #endif

From 41d97e0360e9af3714b32b790885aa1f0d763712 Mon Sep 17 00:00:00 2001
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
Date: Mon, 30 Aug 2021 17:26:45 +0200
Subject: [PATCH 1263/1750] rsi: fix key enabled check causing unwanted
 encryption for vap_id > 0

commit 99ac6018821253ec67f466086afb63fc18ea48e2 upstream.

My previous patch checked if encryption should be enabled by directly
checking info->control.hw_key (like the downstream driver).
However that missed that the control and driver_info members of
struct ieee80211_tx_info are union fields.

Due to this when rsi_core_xmit() updates fields in "tx_params"
(driver_info) it can overwrite the control.hw_key, causing the result
of the later test to be incorrect.

With the current structure layout the first byte of control.hw_key is
overlayed with the vap_id so, since we only test if control.hw_key is
NULL / non NULL, a non zero vap_id will incorrectly enable encryption.

In basic STA and AP modes the vap_id is always zero so it works but in
P2P client mode a second VIF is created causing vap_id to be non zero
and hence encryption to be enabled before keys have been set.

Fix this by extracting the key presence flag to a new field in the driver
private tx_params structure and populating it first.

Fixes: 314538041b56 ("rsi: fix AP mode with WPA failure due to encrypted EAPOL")
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
CC: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1630337206-12410-3-git-send-email-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/rsi/rsi_91x_core.c | 2 ++
 drivers/net/wireless/rsi/rsi_91x_hal.c  | 2 +-
 drivers/net/wireless/rsi/rsi_main.h     | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c
index 2d49c5b5eefb..9c4c58557248 100644
--- a/drivers/net/wireless/rsi/rsi_91x_core.c
+++ b/drivers/net/wireless/rsi/rsi_91x_core.c
@@ -400,6 +400,8 @@ void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb)
 
 	info = IEEE80211_SKB_CB(skb);
 	tx_params = (struct skb_info *)info->driver_data;
+	/* info->driver_data and info->control part of union so make copy */
+	tx_params->have_key = !!info->control.hw_key;
 	wh = (struct ieee80211_hdr *)&skb->data[0];
 	tx_params->sta_id = 0;
 
diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
index f4a26f16f00f..2aa9f0b12839 100644
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -203,7 +203,7 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
 		wh->frame_control |= cpu_to_le16(RSI_SET_PS_ENABLE);
 
 	if ((!(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) &&
-	    info->control.hw_key) {
+	    tx_params->have_key) {
 		if (rsi_is_cipher_wep(common))
 			ieee80211_size += 4;
 		else
diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h
index f7a4636b7bca..526e60e02125 100644
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -139,6 +139,7 @@ struct skb_info {
 	u8 internal_hdr_size;
 	struct ieee80211_vif *vif;
 	u8 vap_id;
+	bool have_key;
 };
 
 enum edca_queue {

From d69ffec3aa22825be17a8c1611e101a269fa6030 Mon Sep 17 00:00:00 2001
From: Martin Fuzzey <martin.fuzzey@flowbird.group>
Date: Mon, 30 Aug 2021 17:26:46 +0200
Subject: [PATCH 1264/1750] rsi: fix rate mask set leading to P2P failure

commit b515d097053a71d624e0c5840b42cd4caa653941 upstream.

P2P client mode was only working the first time.
On subsequent connection attempts the group was successfully created but
no data was sent (no transmitted data packets were seen with a sniffer).

The reason for this was that the hardware was being configured in fixed
rate mode with rate RSI_RATE_1 (1Mbps) which is not valid in the 5GHz band.

In P2P mode wpa_supplicant uses NL80211_CMD_SET_TX_BITRATE_MASK to disallow
the 11b rates in the 2.4GHz band which updated common->fixedrate_mask.

rsi_set_min_rate() then used the fixedrate_mask to calculate the minimum
allowed rate, or 0xffff = auto if none was found.
However that calculation did not account for the different rate sets
allowed in the different bands leading to the error.

Fixing set_min_rate() would result in 6Mb/s being used all the time
which is not what we want either.

The reason the problem did not occur on the first connection is that
rsi_mac80211_set_rate_mask() only updated the fixedrate_mask for
the *current* band. When it was called that was still 2.4GHz as the
switch is done later. So the when set_min_rate() was subsequently
called after the switch to 5GHz it still had a mask of zero, leading
to defaulting to auto mode.

Fix this by differentiating the case of a single rate being
requested, in which case the hardware will be used in fixed rate
mode with just that rate, and multiple rates being requested,
in which case we remain in auto mode but the firmware rate selection
algorithm is configured with a restricted set of rates.

Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Signed-off-by: Martin Fuzzey <martin.fuzzey@flowbird.group>
CC: stable@vger.kernel.org
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1630337206-12410-4-git-send-email-martin.fuzzey@flowbird.group
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/rsi/rsi_91x_hal.c      |  8 ++-
 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 74 ++++++---------------
 drivers/net/wireless/rsi/rsi_91x_mgmt.c     | 21 ++++--
 drivers/net/wireless/rsi/rsi_main.h         | 12 +++-
 4 files changed, 50 insertions(+), 65 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
index 2aa9f0b12839..dca81a4bbdd7 100644
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -214,15 +214,17 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
 			RSI_WIFI_DATA_Q);
 	data_desc->header_len = ieee80211_size;
 
-	if (common->min_rate != RSI_RATE_AUTO) {
+	if (common->rate_config[common->band].fixed_enabled) {
 		/* Send fixed rate */
+		u16 fixed_rate = common->rate_config[common->band].fixed_hw_rate;
+
 		data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE);
-		data_desc->rate_info = cpu_to_le16(common->min_rate);
+		data_desc->rate_info = cpu_to_le16(fixed_rate);
 
 		if (conf_is_ht40(&common->priv->hw->conf))
 			data_desc->bbp_info = cpu_to_le16(FULL40M_ENABLE);
 
-		if ((common->vif_info[0].sgi) && (common->min_rate & 0x100)) {
+		if (common->vif_info[0].sgi && (fixed_rate & 0x100)) {
 		       /* Only MCS rates */
 			data_desc->rate_info |=
 				cpu_to_le16(ENABLE_SHORTGI_RATE);
diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 57c9e3559dfd..8abf9f699db1 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -510,7 +510,6 @@ static int rsi_mac80211_add_interface(struct ieee80211_hw *hw,
 	if ((vif->type == NL80211_IFTYPE_AP) ||
 	    (vif->type == NL80211_IFTYPE_P2P_GO)) {
 		rsi_send_rx_filter_frame(common, DISALLOW_BEACONS);
-		common->min_rate = RSI_RATE_AUTO;
 		for (i = 0; i < common->max_stations; i++)
 			common->stations[i].sta = NULL;
 	}
@@ -1211,20 +1210,32 @@ static int rsi_mac80211_set_rate_mask(struct ieee80211_hw *hw,
 				      struct ieee80211_vif *vif,
 				      const struct cfg80211_bitrate_mask *mask)
 {
+	const unsigned int mcs_offset = ARRAY_SIZE(rsi_rates);
 	struct rsi_hw *adapter = hw->priv;
 	struct rsi_common *common = adapter->priv;
-	enum nl80211_band band = hw->conf.chandef.chan->band;
+	int i;
 
 	mutex_lock(&common->mutex);
-	common->fixedrate_mask[band] = 0;
 
-	if (mask->control[band].legacy == 0xfff) {
-		common->fixedrate_mask[band] =
-			(mask->control[band].ht_mcs[0] << 12);
-	} else {
-		common->fixedrate_mask[band] =
-			mask->control[band].legacy;
+	for (i = 0; i < ARRAY_SIZE(common->rate_config); i++) {
+		struct rsi_rate_config *cfg = &common->rate_config[i];
+		u32 bm;
+
+		bm = mask->control[i].legacy | (mask->control[i].ht_mcs[0] << mcs_offset);
+		if (hweight32(bm) == 1) { /* single rate */
+			int rate_index = ffs(bm) - 1;
+
+			if (rate_index < mcs_offset)
+				cfg->fixed_hw_rate = rsi_rates[rate_index].hw_value;
+			else
+				cfg->fixed_hw_rate = rsi_mcsrates[rate_index - mcs_offset];
+			cfg->fixed_enabled = true;
+		} else {
+			cfg->configured_mask = bm;
+			cfg->fixed_enabled = false;
+		}
 	}
+
 	mutex_unlock(&common->mutex);
 
 	return 0;
@@ -1361,46 +1372,6 @@ void rsi_indicate_pkt_to_os(struct rsi_common *common,
 	ieee80211_rx_irqsafe(hw, skb);
 }
 
-static void rsi_set_min_rate(struct ieee80211_hw *hw,
-			     struct ieee80211_sta *sta,
-			     struct rsi_common *common)
-{
-	u8 band = hw->conf.chandef.chan->band;
-	u8 ii;
-	u32 rate_bitmap;
-	bool matched = false;
-
-	common->bitrate_mask[band] = sta->supp_rates[band];
-
-	rate_bitmap = (common->fixedrate_mask[band] & sta->supp_rates[band]);
-
-	if (rate_bitmap & 0xfff) {
-		/* Find out the min rate */
-		for (ii = 0; ii < ARRAY_SIZE(rsi_rates); ii++) {
-			if (rate_bitmap & BIT(ii)) {
-				common->min_rate = rsi_rates[ii].hw_value;
-				matched = true;
-				break;
-			}
-		}
-	}
-
-	common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
-
-	if ((common->vif_info[0].is_ht) && (rate_bitmap >> 12)) {
-		for (ii = 0; ii < ARRAY_SIZE(rsi_mcsrates); ii++) {
-			if ((rate_bitmap >> 12) & BIT(ii)) {
-				common->min_rate = rsi_mcsrates[ii];
-				matched = true;
-				break;
-			}
-		}
-	}
-
-	if (!matched)
-		common->min_rate = 0xffff;
-}
-
 /**
  * rsi_mac80211_sta_add() - This function notifies driver about a peer getting
  *			    connected.
@@ -1499,9 +1470,9 @@ static int rsi_mac80211_sta_add(struct ieee80211_hw *hw,
 
 	if ((vif->type == NL80211_IFTYPE_STATION) ||
 	    (vif->type == NL80211_IFTYPE_P2P_CLIENT)) {
-		rsi_set_min_rate(hw, sta, common);
+		common->bitrate_mask[common->band] = sta->supp_rates[common->band];
+		common->vif_info[0].is_ht = sta->ht_cap.ht_supported;
 		if (sta->ht_cap.ht_supported) {
-			common->vif_info[0].is_ht = true;
 			common->bitrate_mask[NL80211_BAND_2GHZ] =
 					sta->supp_rates[NL80211_BAND_2GHZ];
 			if ((sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20) ||
@@ -1575,7 +1546,6 @@ static int rsi_mac80211_sta_remove(struct ieee80211_hw *hw,
 		bss->qos = sta->wme;
 		common->bitrate_mask[NL80211_BAND_2GHZ] = 0;
 		common->bitrate_mask[NL80211_BAND_5GHZ] = 0;
-		common->min_rate = 0xffff;
 		common->vif_info[0].is_ht = false;
 		common->vif_info[0].sgi = false;
 		common->vif_info[0].seq_start = 0;
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 275370d37880..9000a5d51003 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -276,7 +276,7 @@ static void rsi_set_default_parameters(struct rsi_common *common)
 	common->channel_width = BW_20MHZ;
 	common->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 	common->channel = 1;
-	common->min_rate = 0xffff;
+	memset(&common->rate_config, 0, sizeof(common->rate_config));
 	common->fsm_state = FSM_CARD_NOT_READY;
 	common->iface_down = true;
 	common->endpoint = EP_2GHZ_20MHZ;
@@ -1314,7 +1314,7 @@ static int rsi_send_auto_rate_request(struct rsi_common *common,
 	u8 band = hw->conf.chandef.chan->band;
 	u8 num_supported_rates = 0;
 	u8 rate_table_offset, rate_offset = 0;
-	u32 rate_bitmap;
+	u32 rate_bitmap, configured_rates;
 	u16 *selected_rates, min_rate;
 	bool is_ht = false, is_sgi = false;
 	u16 frame_len = sizeof(struct rsi_auto_rate);
@@ -1364,6 +1364,10 @@ static int rsi_send_auto_rate_request(struct rsi_common *common,
 			is_sgi = true;
 	}
 
+	/* Limit to any rates administratively configured by cfg80211 */
+	configured_rates = common->rate_config[band].configured_mask ?: 0xffffffff;
+	rate_bitmap &= configured_rates;
+
 	if (band == NL80211_BAND_2GHZ) {
 		if ((rate_bitmap == 0) && (is_ht))
 			min_rate = RSI_RATE_MCS0;
@@ -1389,10 +1393,13 @@ static int rsi_send_auto_rate_request(struct rsi_common *common,
 	num_supported_rates = jj;
 
 	if (is_ht) {
-		for (ii = 0; ii < ARRAY_SIZE(mcs); ii++)
-			selected_rates[jj++] = mcs[ii];
-		num_supported_rates += ARRAY_SIZE(mcs);
-		rate_offset += ARRAY_SIZE(mcs);
+		for (ii = 0; ii < ARRAY_SIZE(mcs); ii++) {
+			if (configured_rates & BIT(ii + ARRAY_SIZE(rsi_rates))) {
+				selected_rates[jj++] = mcs[ii];
+				num_supported_rates++;
+				rate_offset++;
+			}
+		}
 	}
 
 	sort(selected_rates, jj, sizeof(u16), &rsi_compare, NULL);
@@ -1482,7 +1489,7 @@ void rsi_inform_bss_status(struct rsi_common *common,
 					      qos_enable,
 					      aid, sta_id,
 					      vif);
-		if (common->min_rate == 0xffff)
+		if (!common->rate_config[common->band].fixed_enabled)
 			rsi_send_auto_rate_request(common, sta, sta_id, vif);
 		if (opmode == RSI_OPMODE_STA &&
 		    !(assoc_cap & WLAN_CAPABILITY_PRIVACY) &&
diff --git a/drivers/net/wireless/rsi/rsi_main.h b/drivers/net/wireless/rsi/rsi_main.h
index 526e60e02125..de595025c019 100644
--- a/drivers/net/wireless/rsi/rsi_main.h
+++ b/drivers/net/wireless/rsi/rsi_main.h
@@ -61,6 +61,7 @@ enum RSI_FSM_STATES {
 extern u32 rsi_zone_enabled;
 extern __printf(2, 3) void rsi_dbg(u32 zone, const char *fmt, ...);
 
+#define RSI_MAX_BANDS			2
 #define RSI_MAX_VIFS                    3
 #define NUM_EDCA_QUEUES                 4
 #define IEEE80211_ADDR_LEN              6
@@ -230,6 +231,12 @@ struct rsi_9116_features {
 	u32 ps_options;
 };
 
+struct rsi_rate_config {
+	u32 configured_mask;	/* configured by mac80211 bits 0-11=legacy 12+ mcs */
+	u16 fixed_hw_rate;
+	bool fixed_enabled;
+};
+
 struct rsi_common {
 	struct rsi_hw *priv;
 	struct vif_priv vif_info[RSI_MAX_VIFS];
@@ -255,8 +262,8 @@ struct rsi_common {
 	u8 channel_width;
 
 	u16 rts_threshold;
-	u16 bitrate_mask[2];
-	u32 fixedrate_mask[2];
+	u32 bitrate_mask[RSI_MAX_BANDS];
+	struct rsi_rate_config rate_config[RSI_MAX_BANDS];
 
 	u8 rf_reset;
 	struct transmit_q_stats tx_stats;
@@ -277,7 +284,6 @@ struct rsi_common {
 	u8 mac_id;
 	u8 radio_id;
 	u16 rate_pwr[20];
-	u16 min_rate;
 
 	/* WMM algo related */
 	u8 selected_qnum;

From da8b3b95c57fd96baafdda2334f0c0cdfe827b9e Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Thu, 16 Sep 2021 16:42:45 +0200
Subject: [PATCH 1265/1750] rsi: Fix module dev_oper_mode parameter description

commit 31f97cf9f0c31143a2a6fcc89c4a1286ce20157e upstream.

The module parameters are missing dev_oper_mode 12, BT classic alone,
add it. Moreover, the parameters encode newlines, which ends up being
printed malformed e.g. by modinfo, so fix that too.

However, the module parameter string is duplicated in both USB and SDIO
modules and the dev_oper_mode mode enumeration in those module parameters
is a duplicate of macros used by the driver. Furthermore, the enumeration
is confusing.

So, deduplicate the module parameter string and use __stringify() to
encode the correct mode enumeration values into the module parameter
string. Finally, replace 'Wi-Fi' with 'Wi-Fi alone' and 'BT' with
'BT classic alone' to clarify what those modes really mean.

Fixes: 898b255339310 ("rsi: add module parameter operating mode")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Cc: Angus Ainslie <angus@akkea.ca>
Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Kalle Valo <kvalo@codeaurora.org>
Cc: Karun Eagalapati <karun256@gmail.com>
Cc: Martin Fuzzey <martin.fuzzey@flowbird.group>
Cc: Martin Kepplinger <martink@posteo.de>
Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
Cc: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Cc: Siva Rebbagondla <siva8118@gmail.com>
Cc: netdev@vger.kernel.org
Cc: <stable@vger.kernel.org> # 4.17+
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210916144245.10181-1-marex@denx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/rsi/rsi_91x_sdio.c |  5 +----
 drivers/net/wireless/rsi/rsi_91x_usb.c  |  5 +----
 drivers/net/wireless/rsi/rsi_hal.h      | 11 +++++++++++
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
index 3a243c532647..8108f941ccd3 100644
--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
+++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
@@ -24,10 +24,7 @@
 /* Default operating mode is wlan STA + BT */
 static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
 module_param(dev_oper_mode, ushort, 0444);
-MODULE_PARM_DESC(dev_oper_mode,
-		 "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
-		 "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
-		 "6[AP + BT classic], 14[AP + BT classic + BT LE]");
+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);
 
 /**
  * rsi_sdio_set_cmd52_arg() - This function prepares cmd 52 read/write arg.
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 983045ad79dc..d881df9ebd0c 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -25,10 +25,7 @@
 /* Default operating mode is wlan STA + BT */
 static u16 dev_oper_mode = DEV_OPMODE_STA_BT_DUAL;
 module_param(dev_oper_mode, ushort, 0444);
-MODULE_PARM_DESC(dev_oper_mode,
-		 "1[Wi-Fi], 4[BT], 8[BT LE], 5[Wi-Fi STA + BT classic]\n"
-		 "9[Wi-Fi STA + BT LE], 13[Wi-Fi STA + BT classic + BT LE]\n"
-		 "6[AP + BT classic], 14[AP + BT classic + BT LE]");
+MODULE_PARM_DESC(dev_oper_mode, DEV_OPMODE_PARAM_DESC);
 
 static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t flags);
 
diff --git a/drivers/net/wireless/rsi/rsi_hal.h b/drivers/net/wireless/rsi/rsi_hal.h
index 46e36df9e8e3..a2fbec1cec4c 100644
--- a/drivers/net/wireless/rsi/rsi_hal.h
+++ b/drivers/net/wireless/rsi/rsi_hal.h
@@ -28,6 +28,17 @@
 #define DEV_OPMODE_AP_BT		6
 #define DEV_OPMODE_AP_BT_DUAL		14
 
+#define DEV_OPMODE_PARAM_DESC		\
+	__stringify(DEV_OPMODE_WIFI_ALONE)	"[Wi-Fi alone], "	\
+	__stringify(DEV_OPMODE_BT_ALONE)	"[BT classic alone], "	\
+	__stringify(DEV_OPMODE_BT_LE_ALONE)	"[BT LE alone], "	\
+	__stringify(DEV_OPMODE_BT_DUAL)		"[BT classic + BT LE alone], " \
+	__stringify(DEV_OPMODE_STA_BT)		"[Wi-Fi STA + BT classic], " \
+	__stringify(DEV_OPMODE_STA_BT_LE)	"[Wi-Fi STA + BT LE], "	\
+	__stringify(DEV_OPMODE_STA_BT_DUAL)	"[Wi-Fi STA + BT classic + BT LE], " \
+	__stringify(DEV_OPMODE_AP_BT)		"[Wi-Fi AP + BT classic], "	\
+	__stringify(DEV_OPMODE_AP_BT_DUAL)	"[Wi-Fi AP + BT classic + BT LE]"
+
 #define FLASH_WRITE_CHUNK_SIZE		(4 * 1024)
 #define FLASH_SECTOR_SIZE		(4 * 1024)
 

From aef1a67fbf4923a21e5de6353a137ed60e2c61ed Mon Sep 17 00:00:00 2001
From: Kan Liang <kan.liang@linux.intel.com>
Date: Thu, 26 Aug 2021 08:32:37 -0700
Subject: [PATCH 1266/1750] perf/x86/intel/uncore: Support extra IMC channel on
 Ice Lake server

commit 496a18f09374ad89b3ab4366019bc3975db90234 upstream.

There are three channels on a Ice Lake server, but only two channels
will ever be active. Current perf only enables two channels.

Support the extra IMC channel, which may be activated on some Ice Lake
machines. For a non-activated channel, the SW can still access it. The
write will be ignored by the HW. 0 is always returned for the reading.

Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1629991963-102621-2-git-send-email-kan.liang@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/intel/uncore_snbep.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 2701f87a9a7c..3777b560ea4d 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -444,7 +444,7 @@
 #define ICX_M3UPI_PCI_PMON_BOX_CTL		0xa0
 
 /* ICX IMC */
-#define ICX_NUMBER_IMC_CHN			2
+#define ICX_NUMBER_IMC_CHN			3
 #define ICX_IMC_MEM_STRIDE			0x4
 
 DEFINE_UNCORE_FORMAT_ATTR(event, event, "config:0-7");
@@ -5228,7 +5228,7 @@ static struct intel_uncore_ops icx_uncore_mmio_ops = {
 static struct intel_uncore_type icx_uncore_imc = {
 	.name		= "imc",
 	.num_counters   = 4,
-	.num_boxes	= 8,
+	.num_boxes	= 12,
 	.perf_ctr_bits	= 48,
 	.fixed_ctr_bits	= 48,
 	.fixed_ctr	= SNR_IMC_MMIO_PMON_FIXED_CTR,

From 30cdf50357695b89d879a345e9b3afb186f64aff Mon Sep 17 00:00:00 2001
From: Kan Liang <kan.liang@linux.intel.com>
Date: Thu, 26 Aug 2021 08:32:39 -0700
Subject: [PATCH 1267/1750] perf/x86/intel/uncore: Fix Intel ICX IIO event
 constraints

commit f42e8a603c88f72bf047a710b9fc1d3579f31e71 upstream.

According to the latest uncore document, both NUM_OUTSTANDING_REQ_OF_CPU
(0x88) event and COMP_BUF_OCCUPANCY(0xd5) event also have constraints. Add
them into the event constraints table.

Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support")
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1629991963-102621-4-git-send-email-kan.liang@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/intel/uncore_snbep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 3777b560ea4d..c01b51d1cbdf 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -4898,8 +4898,10 @@ static struct event_constraint icx_uncore_iio_constraints[] = {
 	UNCORE_EVENT_CONSTRAINT(0x02, 0x3),
 	UNCORE_EVENT_CONSTRAINT(0x03, 0x3),
 	UNCORE_EVENT_CONSTRAINT(0x83, 0x3),
+	UNCORE_EVENT_CONSTRAINT(0x88, 0xc),
 	UNCORE_EVENT_CONSTRAINT(0xc0, 0xc),
 	UNCORE_EVENT_CONSTRAINT(0xc5, 0xc),
+	UNCORE_EVENT_CONSTRAINT(0xd5, 0xc),
 	EVENT_CONSTRAINT_END
 };
 

From 5c6fedce4a6a6a9739926a0c28d53ff41e256d08 Mon Sep 17 00:00:00 2001
From: Alok Prasad <palok@marvell.com>
Date: Wed, 27 Oct 2021 18:43:29 +0000
Subject: [PATCH 1268/1750] RDMA/qedr: Fix NULL deref for query_qp on the GSI
 QP

commit 4f960393a0ee9a39469ceb7c8077ae8db665cc12 upstream.

This patch fixes a crash caused by querying the QP via netlink, and
corrects the state of GSI qp. GSI qp's have a NULL qed_qp.

The call trace is generated by:
 $ rdma res show

 BUG: kernel NULL pointer dereference, address: 0000000000000034
 Hardware name: Dell Inc. PowerEdge R720/0M1GCR, BIOS 1.2.6 05/10/2012
 RIP: 0010:qed_rdma_query_qp+0x33/0x1a0 [qed]
 RSP: 0018:ffffba560a08f580 EFLAGS: 00010206
 RAX: 0000000200000000 RBX: ffffba560a08f5b8 RCX: 0000000000000000
 RDX: ffffba560a08f5b8 RSI: 0000000000000000 RDI: ffff9807ee458090
 RBP: ffffba560a08f5a0 R08: 0000000000000000 R09: ffff9807890e7048
 R10: ffffba560a08f658 R11: 0000000000000000 R12: 0000000000000000
 R13: ffff9807ee458090 R14: ffff9807f0afb000 R15: ffffba560a08f7ec
 FS:  00007fbbf8bfe740(0000) GS:ffff980aafa00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000034 CR3: 00000001720ba001 CR4: 00000000000606f0
 Call Trace:
  qedr_query_qp+0x82/0x360 [qedr]
  ib_query_qp+0x34/0x40 [ib_core]
  ? ib_query_qp+0x34/0x40 [ib_core]
  fill_res_qp_entry_query.isra.26+0x47/0x1d0 [ib_core]
  ? __nla_put+0x20/0x30
  ? nla_put+0x33/0x40
  fill_res_qp_entry+0xe3/0x120 [ib_core]
  res_get_common_dumpit+0x3f8/0x5d0 [ib_core]
  ? fill_res_cm_id_entry+0x1f0/0x1f0 [ib_core]
  nldev_res_get_qp_dumpit+0x1a/0x20 [ib_core]
  netlink_dump+0x156/0x2f0
  __netlink_dump_start+0x1ab/0x260
  rdma_nl_rcv+0x1de/0x330 [ib_core]
  ? nldev_res_get_cm_id_dumpit+0x20/0x20 [ib_core]
  netlink_unicast+0x1b8/0x270
  netlink_sendmsg+0x33e/0x470
  sock_sendmsg+0x63/0x70
  __sys_sendto+0x13f/0x180
  ? setup_sgl.isra.12+0x70/0xc0
  __x64_sys_sendto+0x28/0x30
  do_syscall_64+0x3a/0xb0
  entry_SYSCALL_64_after_hwframe+0x44/0xae

Cc: stable@vger.kernel.org
Fixes: cecbcddf6461 ("qedr: Add support for QP verbs")
Link: https://lore.kernel.org/r/20211027184329.18454-1-palok@marvell.com
Signed-off-by: Ariel Elior <aelior@marvell.com>
Signed-off-by: Shai Malin <smalin@marvell.com>
Signed-off-by: Prabhakar Kushwaha <pkushwaha@marvell.com>
Signed-off-by: Alok Prasad <palok@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/qedr/verbs.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index cdfb7732dff3..16d528365189 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -2744,15 +2744,18 @@ int qedr_query_qp(struct ib_qp *ibqp,
 	int rc = 0;
 
 	memset(&params, 0, sizeof(params));
-
-	rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, &params);
-	if (rc)
-		goto err;
-
 	memset(qp_attr, 0, sizeof(*qp_attr));
 	memset(qp_init_attr, 0, sizeof(*qp_init_attr));
 
-	qp_attr->qp_state = qedr_get_ibqp_state(params.state);
+	if (qp->qp_type != IB_QPT_GSI) {
+		rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, &params);
+		if (rc)
+			goto err;
+		qp_attr->qp_state = qedr_get_ibqp_state(params.state);
+	} else {
+		qp_attr->qp_state = qedr_get_ibqp_state(QED_ROCE_QP_STATE_RTS);
+	}
+
 	qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state);
 	qp_attr->path_mtu = ib_mtu_int_to_enum(params.mtu);
 	qp_attr->path_mig_state = IB_MIG_MIGRATED;

From 4fbecebb31c7071ec6047a978ae6dae092c09d19 Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xmission.com>
Date: Wed, 1 Sep 2021 13:21:34 -0500
Subject: [PATCH 1269/1750] signal: Remove the bogus sigkill_pending in
 ptrace_stop

commit 7d613f9f72ec8f90ddefcae038fdae5adb8404b3 upstream.

The existence of sigkill_pending is a little silly as it is
functionally a duplicate of fatal_signal_pending that is used in
exactly one place.

Checking for pending fatal signals and returning early in ptrace_stop
is actively harmful.  It casues the ptrace_stop called by
ptrace_signal to return early before setting current->exit_code.
Later when ptrace_signal reads the signal number from
current->exit_code is undefined, making it unpredictable what will
happen.

Instead rely on the fact that schedule will not sleep if there is a
pending signal that can awaken a task.

Removing the explict sigkill_pending test fixes fixes ptrace_signal
when ptrace_stop does not stop because current->exit_code is always
set to to signr.

Cc: stable@vger.kernel.org
Fixes: 3d749b9e676b ("ptrace: simplify ptrace_stop()->sigkill_pending() path")
Fixes: 1a669c2f16d4 ("Add arch_ptrace_stop")
Link: https://lkml.kernel.org/r/87pmsyx29t.fsf@disp2133
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/signal.c | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/kernel/signal.c b/kernel/signal.c
index ef8f2a28d37c..6bb2df4f6109 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2097,15 +2097,6 @@ static inline bool may_ptrace_stop(void)
 	return true;
 }
 
-/*
- * Return non-zero if there is a SIGKILL that should be waking us up.
- * Called with the siglock held.
- */
-static bool sigkill_pending(struct task_struct *tsk)
-{
-	return sigismember(&tsk->pending.signal, SIGKILL) ||
-	       sigismember(&tsk->signal->shared_pending.signal, SIGKILL);
-}
 
 /*
  * This must be called with current->sighand->siglock held.
@@ -2132,17 +2123,16 @@ static void ptrace_stop(int exit_code, int why, int clear_code, kernel_siginfo_t
 		 * calling arch_ptrace_stop, so we must release it now.
 		 * To preserve proper semantics, we must do this before
 		 * any signal bookkeeping like checking group_stop_count.
-		 * Meanwhile, a SIGKILL could come in before we retake the
-		 * siglock.  That must prevent us from sleeping in TASK_TRACED.
-		 * So after regaining the lock, we must check for SIGKILL.
 		 */
 		spin_unlock_irq(&current->sighand->siglock);
 		arch_ptrace_stop(exit_code, info);
 		spin_lock_irq(&current->sighand->siglock);
-		if (sigkill_pending(current))
-			return;
 	}
 
+	/*
+	 * schedule() will not sleep if there is a pending signal that
+	 * can awaken the task.
+	 */
 	set_special_state(TASK_TRACED);
 
 	/*

From 5e63b85a489d18f1c27bd6dbfc4dd1073f95e327 Mon Sep 17 00:00:00 2001
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
Date: Wed, 22 Sep 2021 11:10:06 +0200
Subject: [PATCH 1270/1750] memory: renesas-rpc-if: Correct QSPI data transfer
 in Manual mode

commit fff53a551db50f5edecaa0b29a64056ab8d2bbca upstream.

This patch fixes 2 problems:
[1] The output warning logs and data loss when performing
mount/umount then remount the device with jffs2 format.
[2] The access width of SMWDR[0:1]/SMRDR[0:1] register is wrong.

This is the sample warning logs when performing mount/umount then
remount the device with jffs2 format:
jffs2: jffs2_scan_inode_node(): CRC failed on node at 0x031c51d4:
Read 0x00034e00, calculated 0xadb272a7

The reason for issue [1] is that the writing data seems to
get messed up.
Data is only completed when the number of bytes is divisible by 4.
If you only have 3 bytes of data left to write, 1 garbage byte
is inserted after the end of the write stream.
If you only have 2 bytes of data left to write, 2 bytes of '00'
are added into the write stream.
If you only have 1 byte of data left to write, 2 bytes of '00'
are added into the write stream. 1 garbage byte is inserted after
the end of the write stream.

To solve problem [1], data must be written continuously in serial
and the write stream ends when data is out.

Following HW manual 62.2.15, access to SMWDR0 register should be
in the same size as the transfer size specified in the SPIDE[3:0]
bits in the manual mode enable setting register (SMENR).
Be sure to access from address 0.

So, in 16-bit transfer (SPIDE[3:0]=b'1100), SMWDR0 should be
accessed by 16-bit width.
Similar to SMWDR1, SMDDR0/1 registers.
In current code, SMWDR0 register is accessed by regmap_write()
that only set up to do 32-bit width.

To solve problem [2], data must be written 16-bit or 8-bit when
transferring 1-byte or 2-byte.

Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Duc Nguyen <duc.nguyen.ub@renesas.com>
[wsa: refactored to use regmap only via reg_read/reg_write]
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://lore.kernel.org/r/20210922091007.5516-1-wsa+renesas@sang-engineering.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/memory/renesas-rpc-if.c | 113 ++++++++++++++++++++++----------
 include/memory/renesas-rpc-if.h |   1 +
 2 files changed, 79 insertions(+), 35 deletions(-)

diff --git a/drivers/memory/renesas-rpc-if.c b/drivers/memory/renesas-rpc-if.c
index 1fe6c35b7503..a760ab08256f 100644
--- a/drivers/memory/renesas-rpc-if.c
+++ b/drivers/memory/renesas-rpc-if.c
@@ -161,10 +161,62 @@ static const struct regmap_access_table rpcif_volatile_table = {
 	.n_yes_ranges	= ARRAY_SIZE(rpcif_volatile_ranges),
 };
 
+
+/*
+ * Custom accessor functions to ensure SMRDR0 and SMWDR0 are always accessed
+ * with proper width. Requires SMENR_SPIDE to be correctly set before!
+ */
+static int rpcif_reg_read(void *context, unsigned int reg, unsigned int *val)
+{
+	struct rpcif *rpc = context;
+
+	if (reg == RPCIF_SMRDR0 || reg == RPCIF_SMWDR0) {
+		u32 spide = readl(rpc->base + RPCIF_SMENR) & RPCIF_SMENR_SPIDE(0xF);
+
+		if (spide == 0x8) {
+			*val = readb(rpc->base + reg);
+			return 0;
+		} else if (spide == 0xC) {
+			*val = readw(rpc->base + reg);
+			return 0;
+		} else if (spide != 0xF) {
+			return -EILSEQ;
+		}
+	}
+
+	*val = readl(rpc->base + reg);
+	return 0;
+
+}
+
+static int rpcif_reg_write(void *context, unsigned int reg, unsigned int val)
+{
+	struct rpcif *rpc = context;
+
+	if (reg == RPCIF_SMRDR0 || reg == RPCIF_SMWDR0) {
+		u32 spide = readl(rpc->base + RPCIF_SMENR) & RPCIF_SMENR_SPIDE(0xF);
+
+		if (spide == 0x8) {
+			writeb(val, rpc->base + reg);
+			return 0;
+		} else if (spide == 0xC) {
+			writew(val, rpc->base + reg);
+			return 0;
+		} else if (spide != 0xF) {
+			return -EILSEQ;
+		}
+	}
+
+	writel(val, rpc->base + reg);
+	return 0;
+}
+
 static const struct regmap_config rpcif_regmap_config = {
 	.reg_bits	= 32,
 	.val_bits	= 32,
 	.reg_stride	= 4,
+	.reg_read	= rpcif_reg_read,
+	.reg_write	= rpcif_reg_write,
 	.fast_io	= true,
 	.max_register	= RPCIF_PHYINT,
 	.volatile_table	= &rpcif_volatile_table,
@@ -174,17 +226,15 @@ int rpcif_sw_init(struct rpcif *rpc, struct device *dev)
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct resource *res;
-	void __iomem *base;
 
 	rpc->dev = dev;
 
 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs");
-	base = devm_ioremap_resource(&pdev->dev, res);
-	if (IS_ERR(base))
-		return PTR_ERR(base);
+	rpc->base = devm_ioremap_resource(&pdev->dev, res);
+	if (IS_ERR(rpc->base))
+		return PTR_ERR(rpc->base);
 
-	rpc->regmap = devm_regmap_init_mmio(&pdev->dev, base,
-					    &rpcif_regmap_config);
+	rpc->regmap = devm_regmap_init(&pdev->dev, NULL, rpc, &rpcif_regmap_config);
 	if (IS_ERR(rpc->regmap)) {
 		dev_err(&pdev->dev,
 			"failed to init regmap for rpcif, error %ld\n",
@@ -367,20 +417,16 @@ void rpcif_prepare(struct rpcif *rpc, const struct rpcif_op *op, u64 *offs,
 			nbytes = op->data.nbytes;
 		rpc->xferlen = nbytes;
 
-		rpc->enable |= RPCIF_SMENR_SPIDE(rpcif_bits_set(rpc, nbytes)) |
-			RPCIF_SMENR_SPIDB(rpcif_bit_size(op->data.buswidth));
+		rpc->enable |= RPCIF_SMENR_SPIDB(rpcif_bit_size(op->data.buswidth));
 	}
 }
 EXPORT_SYMBOL(rpcif_prepare);
 
 int rpcif_manual_xfer(struct rpcif *rpc)
 {
-	u32 smenr, smcr, pos = 0, max = 4;
+	u32 smenr, smcr, pos = 0, max = rpc->bus_size == 2 ? 8 : 4;
 	int ret = 0;
 
-	if (rpc->bus_size == 2)
-		max = 8;
-
 	pm_runtime_get_sync(rpc->dev);
 
 	regmap_update_bits(rpc->regmap, RPCIF_PHYCNT,
@@ -391,37 +437,36 @@ int rpcif_manual_xfer(struct rpcif *rpc)
 	regmap_write(rpc->regmap, RPCIF_SMOPR, rpc->option);
 	regmap_write(rpc->regmap, RPCIF_SMDMCR, rpc->dummy);
 	regmap_write(rpc->regmap, RPCIF_SMDRENR, rpc->ddr);
+	regmap_write(rpc->regmap, RPCIF_SMADR, rpc->smadr);
 	smenr = rpc->enable;
 
 	switch (rpc->dir) {
 	case RPCIF_DATA_OUT:
 		while (pos < rpc->xferlen) {
-			u32 nbytes = rpc->xferlen - pos;
-			u32 data[2];
+			u32 bytes_left = rpc->xferlen - pos;
+			u32 nbytes, data[2];
 
 			smcr = rpc->smcr | RPCIF_SMCR_SPIE;
-			if (nbytes > max) {
-				nbytes = max;
+
+			/* nbytes may only be 1, 2, 4, or 8 */
+			nbytes = bytes_left >= max ? max : (1 << ilog2(bytes_left));
+			if (bytes_left > nbytes)
 				smcr |= RPCIF_SMCR_SSLKP;
-			}
+
+			smenr |= RPCIF_SMENR_SPIDE(rpcif_bits_set(rpc, nbytes));
+			regmap_write(rpc->regmap, RPCIF_SMENR, smenr);
 
 			memcpy(data, rpc->buffer + pos, nbytes);
-			if (nbytes > 4) {
+			if (nbytes == 8) {
 				regmap_write(rpc->regmap, RPCIF_SMWDR1,
 					     data[0]);
 				regmap_write(rpc->regmap, RPCIF_SMWDR0,
 					     data[1]);
-			} else if (nbytes > 2) {
+			} else {
 				regmap_write(rpc->regmap, RPCIF_SMWDR0,
 					     data[0]);
-			} else	{
-				regmap_write(rpc->regmap, RPCIF_SMWDR0,
-					     data[0] << 16);
 			}
 
-			regmap_write(rpc->regmap, RPCIF_SMADR,
-				     rpc->smadr + pos);
-			regmap_write(rpc->regmap, RPCIF_SMENR, smenr);
 			regmap_write(rpc->regmap, RPCIF_SMCR, smcr);
 			ret = wait_msg_xfer_end(rpc);
 			if (ret)
@@ -461,14 +506,16 @@ int rpcif_manual_xfer(struct rpcif *rpc)
 			break;
 		}
 		while (pos < rpc->xferlen) {
-			u32 nbytes = rpc->xferlen - pos;
-			u32 data[2];
+			u32 bytes_left = rpc->xferlen - pos;
+			u32 nbytes, data[2];
 
-			if (nbytes > max)
-				nbytes = max;
+			/* nbytes may only be 1, 2, 4, or 8 */
+			nbytes = bytes_left >= max ? max : (1 << ilog2(bytes_left));
 
 			regmap_write(rpc->regmap, RPCIF_SMADR,
 				     rpc->smadr + pos);
+			smenr &= ~RPCIF_SMENR_SPIDE(0xF);
+			smenr |= RPCIF_SMENR_SPIDE(rpcif_bits_set(rpc, nbytes));
 			regmap_write(rpc->regmap, RPCIF_SMENR, smenr);
 			regmap_write(rpc->regmap, RPCIF_SMCR,
 				     rpc->smcr | RPCIF_SMCR_SPIE);
@@ -476,18 +523,14 @@ int rpcif_manual_xfer(struct rpcif *rpc)
 			if (ret)
 				goto err_out;
 
-			if (nbytes > 4) {
+			if (nbytes == 8) {
 				regmap_read(rpc->regmap, RPCIF_SMRDR1,
 					    &data[0]);
 				regmap_read(rpc->regmap, RPCIF_SMRDR0,
 					    &data[1]);
-			} else if (nbytes > 2) {
+			} else {
 				regmap_read(rpc->regmap, RPCIF_SMRDR0,
 					    &data[0]);
-			} else	{
-				regmap_read(rpc->regmap, RPCIF_SMRDR0,
-					    &data[0]);
-				data[0] >>= 16;
 			}
 			memcpy(rpc->buffer + pos, data, nbytes);
 
diff --git a/include/memory/renesas-rpc-if.h b/include/memory/renesas-rpc-if.h
index 9ad136682c47..aceb2c360d3f 100644
--- a/include/memory/renesas-rpc-if.h
+++ b/include/memory/renesas-rpc-if.h
@@ -58,6 +58,7 @@ struct	rpcif_op {
 
 struct	rpcif {
 	struct device *dev;
+	void __iomem *base;
 	void __iomem *dirmap;
 	struct regmap *regmap;
 	struct reset_control *rstc;

From 62bd9eac5fa203876b064c572aa8ebe8c86b788f Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xmission.com>
Date: Wed, 20 Oct 2021 12:43:51 -0500
Subject: [PATCH 1271/1750] signal/mips: Update (_save|_restore)_fp_context to
 fail with -EFAULT

commit 95bf9d646c3c3f95cb0be7e703b371db8da5be68 upstream.

When an instruction to save or restore a register from the stack fails
in _save_fp_context or _restore_fp_context return with -EFAULT.  This
change was made to r2300_fpu.S[1] but it looks like it got lost with
the introduction of EX2[2].  This is also what the other implementation
of _save_fp_context and _restore_fp_context in r4k_fpu.S does, and
what is needed for the callers to be able to handle the error.

Furthermore calling do_exit(SIGSEGV) from bad_stack is wrong because
it does not terminate the entire process it just terminates a single
thread.

As the changed code was the only caller of arch/mips/kernel/syscall.c:bad_stack
remove the problematic and now unused helper function.

Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Maciej Rozycki <macro@orcam.me.uk>
Cc: linux-mips@vger.kernel.org
[1] 35938a00ba86 ("MIPS: Fix ISA I FP sigcontext access violation handling")
[2] f92722dc4545 ("MIPS: Correct MIPS I FP sigcontext layout")
Cc: stable@vger.kernel.org
Fixes: f92722dc4545 ("MIPS: Correct MIPS I FP sigcontext layout")
Acked-by: Maciej W. Rozycki <macro@orcam.me.uk>
Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://lkml.kernel.org/r/20211020174406.17889-5-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/kernel/r2300_fpu.S | 4 ++--
 arch/mips/kernel/syscall.c   | 9 ---------
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/arch/mips/kernel/r2300_fpu.S b/arch/mips/kernel/r2300_fpu.S
index 12e58053544f..cbf6db98cfb3 100644
--- a/arch/mips/kernel/r2300_fpu.S
+++ b/arch/mips/kernel/r2300_fpu.S
@@ -29,8 +29,8 @@
 #define EX2(a,b)						\
 9:	a,##b;							\
 	.section __ex_table,"a";				\
-	PTR	9b,bad_stack;					\
-	PTR	9b+4,bad_stack;					\
+	PTR	9b,fault;					\
+	PTR	9b+4,fault;					\
 	.previous
 
 	.set	mips1
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 2afa3eef486a..5512cd586e6e 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -240,12 +240,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr, int, nbytes, int, op)
 {
 	return -ENOSYS;
 }
-
-/*
- * If we ever come here the user sp is bad.  Zap the process right away.
- * Due to the bad stack signaling wouldn't work.
- */
-asmlinkage void bad_stack(void)
-{
-	do_exit(SIGSEGV);
-}

From 55c97165adf6dd3939f6925a254e0c44c50dd464 Mon Sep 17 00:00:00 2001
From: Meng Li <Meng.Li@windriver.com>
Date: Tue, 19 Oct 2021 10:32:41 +0800
Subject: [PATCH 1272/1750] soc: fsl: dpio: replace smp_processor_id with
 raw_smp_processor_id

commit e775eb9fc2a4107f03222fa48bc95c2c82427e64 upstream.

When enable debug kernel configs,there will be calltrace as below:

BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1
caller is debug_smp_processor_id+0x20/0x30
CPU: 6 PID: 1 Comm: swapper/0 Not tainted 5.10.63-yocto-standard #1
Hardware name: NXP Layerscape LX2160ARDB (DT)
Call trace:
 dump_backtrace+0x0/0x1a0
 show_stack+0x24/0x30
 dump_stack+0xf0/0x13c
 check_preemption_disabled+0x100/0x110
 debug_smp_processor_id+0x20/0x30
 dpaa2_io_query_fq_count+0xdc/0x154
 dpaa2_eth_stop+0x144/0x314
 __dev_close_many+0xdc/0x160
 __dev_change_flags+0xe8/0x220
 dev_change_flags+0x30/0x70
 ic_close_devs+0x50/0x78
 ip_auto_config+0xed0/0xf10
 do_one_initcall+0xac/0x460
 kernel_init_freeable+0x30c/0x378
 kernel_init+0x20/0x128
 ret_from_fork+0x10/0x38

Based on comment in the context, it doesn't matter whether
preemption is disable or not. So, replace smp_processor_id()
with raw_smp_processor_id() to avoid above call trace.

Fixes: c89105c9b390 ("staging: fsl-mc: Move DPIO from staging to drivers/soc/fsl")
Cc: stable@vger.kernel.org
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/fsl/dpio/dpio-service.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/fsl/dpio/dpio-service.c b/drivers/soc/fsl/dpio/dpio-service.c
index 7351f3030550..779c319a4b82 100644
--- a/drivers/soc/fsl/dpio/dpio-service.c
+++ b/drivers/soc/fsl/dpio/dpio-service.c
@@ -59,7 +59,7 @@ static inline struct dpaa2_io *service_select_by_cpu(struct dpaa2_io *d,
 	 * potentially being migrated away.
 	 */
 	if (cpu < 0)
-		cpu = smp_processor_id();
+		cpu = raw_smp_processor_id();
 
 	/* If a specific cpu was requested, pick it up immediately */
 	return dpio_by_cpu[cpu];

From 7e867f8bb3fe234524cc55bdbec9fe2cc5999241 Mon Sep 17 00:00:00 2001
From: Meng Li <Meng.Li@windriver.com>
Date: Tue, 19 Oct 2021 11:05:55 +0800
Subject: [PATCH 1273/1750] soc: fsl: dpio: use the combined functions to
 protect critical zone

commit dc7e5940aad6641bd5ab33ea8b21c4b3904d989f upstream.

In orininal code, use 2 function spin_lock() and local_irq_save() to
protect the critical zone. But when enable the kernel debug config,
there are below inconsistent lock state detected.
================================
WARNING: inconsistent lock state
5.10.63-yocto-standard #1 Not tainted
--------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
lock_torture_wr/226 [HC0[0]:SC1[5]:HE1:SE0] takes:
ffff002005b2dd80 (&p->access_spinlock){+.?.}-{3:3}, at: qbman_swp_enqueue_multiple_mem_back+0x44/0x270
{SOFTIRQ-ON-W} state was registered at:
  lock_acquire.part.0+0xf8/0x250
  lock_acquire+0x68/0x84
  _raw_spin_lock+0x68/0x90
  qbman_swp_enqueue_multiple_mem_back+0x44/0x270
  ......
  cryptomgr_test+0x38/0x60
  kthread+0x158/0x164
  ret_from_fork+0x10/0x38
irq event stamp: 4498
hardirqs last  enabled at (4498): [<ffff800010fcf980>] _raw_spin_unlock_irqrestore+0x90/0xb0
hardirqs last disabled at (4497): [<ffff800010fcffc4>] _raw_spin_lock_irqsave+0xd4/0xe0
softirqs last  enabled at (4458): [<ffff8000100108c4>] __do_softirq+0x674/0x724
softirqs last disabled at (4465): [<ffff80001005b2a4>] __irq_exit_rcu+0x190/0x19c

other info that might help us debug this:
 Possible unsafe locking scenario:
       CPU0
       ----
  lock(&p->access_spinlock);
  <Interrupt>
    lock(&p->access_spinlock);
 *** DEADLOCK ***

So, in order to avoid deadlock, use the combined functions
spin_lock_irqsave/spin_unlock_irqrestore() to protect critical zone.

Fixes: 3b2abda7d28c ("soc: fsl: dpio: Replace QMAN array mode with ring mode enqueue")
Cc: stable@vger.kernel.org
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/fsl/dpio/qbman-portal.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/soc/fsl/dpio/qbman-portal.c b/drivers/soc/fsl/dpio/qbman-portal.c
index 659b4a570d5b..3d69f56d9b9f 100644
--- a/drivers/soc/fsl/dpio/qbman-portal.c
+++ b/drivers/soc/fsl/dpio/qbman-portal.c
@@ -732,8 +732,7 @@ int qbman_swp_enqueue_multiple_mem_back(struct qbman_swp *s,
 	int i, num_enqueued = 0;
 	unsigned long irq_flags;
 
-	spin_lock(&s->access_spinlock);
-	local_irq_save(irq_flags);
+	spin_lock_irqsave(&s->access_spinlock, irq_flags);
 
 	half_mask = (s->eqcr.pi_ci_mask>>1);
 	full_mask = s->eqcr.pi_ci_mask;
@@ -744,8 +743,7 @@ int qbman_swp_enqueue_multiple_mem_back(struct qbman_swp *s,
 		s->eqcr.available = qm_cyc_diff(s->eqcr.pi_ring_size,
 					eqcr_ci, s->eqcr.ci);
 		if (!s->eqcr.available) {
-			local_irq_restore(irq_flags);
-			spin_unlock(&s->access_spinlock);
+			spin_unlock_irqrestore(&s->access_spinlock, irq_flags);
 			return 0;
 		}
 	}
@@ -784,8 +782,7 @@ int qbman_swp_enqueue_multiple_mem_back(struct qbman_swp *s,
 	dma_wmb();
 	qbman_write_register(s, QBMAN_CINH_SWP_EQCR_PI,
 				(QB_RT_BIT)|(s->eqcr.pi)|s->eqcr.pi_vb);
-	local_irq_restore(irq_flags);
-	spin_unlock(&s->access_spinlock);
+	spin_unlock_irqrestore(&s->access_spinlock, irq_flags);
 
 	return num_enqueued;
 }

From 5720436bc7ba3370dc8c9baf0b1b28c93bdd9644 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:47 +0200
Subject: [PATCH 1274/1750] mtd: rawnand: socrates: Keep the driver compatible
 with on-die ECC engines

commit b4ebddd6540d78a7f977b3fea0261bd575c6ffe2 upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: b36bf0a0fe5d ("mtd: rawnand: socrates: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-9-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/socrates_nand.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/socrates_nand.c b/drivers/mtd/nand/raw/socrates_nand.c
index 70f8305c9b6e..fb39cc7ebce0 100644
--- a/drivers/mtd/nand/raw/socrates_nand.c
+++ b/drivers/mtd/nand/raw/socrates_nand.c
@@ -119,9 +119,8 @@ static int socrates_nand_device_ready(struct nand_chip *nand_chip)
 
 static int socrates_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -175,6 +174,13 @@ static int socrates_nand_probe(struct platform_device *ofdev)
 	/* TODO: I have no idea what real delay is. */
 	nand_chip->legacy.chip_delay = 20;	/* 20us command delay time */
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	nand_chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	dev_set_drvdata(&ofdev->dev, host);
 
 	res = nand_scan(nand_chip, 1);

From f2feac81edcdb38435a9ac061c720248166d626f Mon Sep 17 00:00:00 2001
From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Date: Tue, 14 Sep 2021 14:18:06 +0200
Subject: [PATCH 1275/1750] power: supply: max17042_battery: Prevent int
 underflow in set_soc_threshold

commit e660dbb68c6b3f7b9eb8b9775846a44f9798b719 upstream.

max17042_set_soc_threshold gets called with offset set to 1, which means
that minimum threshold value would underflow once SOC got down to 0,
causing invalid alerts from the gauge.

Fixes: e5f3872d2044 ("max17042: Add support for signalling change in SOC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/power/supply/max17042_battery.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
index 69bb0f56e492..595314f0c4fb 100644
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -851,7 +851,8 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off)
 	regmap_read(map, MAX17042_RepSOC, &soc);
 	soc >>= 8;
 	soc_tr = (soc + off) << 8;
-	soc_tr |= (soc - off);
+	if (off < soc)
+		soc_tr |= soc - off;
 	regmap_write(map, MAX17042_SALRT_Th, soc_tr);
 }
 

From 924955df37f25a832b6a690160c611f121257abf Mon Sep 17 00:00:00 2001
From: Henrik Grimler <henrik@grimler.se>
Date: Wed, 29 Sep 2021 20:14:17 +0200
Subject: [PATCH 1276/1750] power: supply: max17042_battery: use VFSOC for
 capacity when no rsns

commit 223a3b82834f036a62aa831f67cbf1f1d644c6e2 upstream.

On Galaxy S3 (i9300/i9305), which has the max17047 fuel gauge and no
current sense resistor (rsns), the RepSOC register does not provide an
accurate state of charge value. The reported value is wrong, and does
not change over time. VFSOC however, which uses the voltage fuel gauge
to determine the state of charge, always shows an accurate value.

For devices without current sense, VFSOC is already used for the
soc-alert (0x0003 is written to MiscCFG register), so with this change
the source of the alert and the PROP_CAPACITY value match.

Fixes: 359ab9f5b154 ("power_supply: Add MAX17042 Fuel Gauge Driver")
Cc: <stable@vger.kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Suggested-by: Wolfgang Wiedmeyer <wolfgit@wiedmeyer.de>
Signed-off-by: Henrik Grimler <henrik@grimler.se>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/power/supply/max17042_battery.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
index 595314f0c4fb..98b2e369f80e 100644
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -316,7 +316,10 @@ static int max17042_get_property(struct power_supply *psy,
 		val->intval = data * 625 / 8;
 		break;
 	case POWER_SUPPLY_PROP_CAPACITY:
-		ret = regmap_read(map, MAX17042_RepSOC, &data);
+		if (chip->pdata->enable_current_sense)
+			ret = regmap_read(map, MAX17042_RepSOC, &data);
+		else
+			ret = regmap_read(map, MAX17042_VFSOC, &data);
 		if (ret < 0)
 			return ret;
 

From bd37419f4fde95bf08d31588b80f69b99ac07b3f Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 3 Nov 2021 11:05:45 +0000
Subject: [PATCH 1277/1750] KVM: arm64: Extract ESR_ELx.EC only

commit 8bb084119f1acc2ec55ea085a97231e3ddb30782 upstream.

Since ARMv8.0 the upper 32 bits of ESR_ELx have been RES0, and recently
some of the upper bits gained a meaning and can be non-zero. For
example, when FEAT_LS64 is implemented, ESR_ELx[36:32] contain ISS2,
which for an ST64BV or ST64BV0 can be non-zero. This can be seen in ARM
DDI 0487G.b, page D13-3145, section D13.2.37.

Generally, we must not rely on RES0 bit remaining zero in future, and
when extracting ESR_ELx.EC we must mask out all other bits.

All C code uses the ESR_ELx_EC() macro, which masks out the irrelevant
bits, and therefore no alterations are required to C code to avoid
consuming irrelevant bits.

In a couple of places the KVM assembly extracts ESR_ELx.EC using LSR on
an X register, and so could in theory consume previously RES0 bits. In
both cases this is for comparison with EC values ESR_ELx_EC_HVC32 and
ESR_ELx_EC_HVC64, for which the upper bits of ESR_ELx must currently be
zero, but this could change in future.

This patch adjusts the KVM vectors to use UBFX rather than LSR to
extract ESR_ELx.EC, ensuring these are robust to future additions to
ESR_ELx.

Cc: stable@vger.kernel.org
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Will Deacon <will@kernel.org>
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211103110545.4613-1-mark.rutland@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/include/asm/esr.h   | 1 +
 arch/arm64/kvm/hyp/hyp-entry.S | 2 +-
 arch/arm64/kvm/hyp/nvhe/host.S | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/include/asm/esr.h b/arch/arm64/include/asm/esr.h
index 85a3e49f92f4..4a76f566e44f 100644
--- a/arch/arm64/include/asm/esr.h
+++ b/arch/arm64/include/asm/esr.h
@@ -68,6 +68,7 @@
 #define ESR_ELx_EC_MAX		(0x3F)
 
 #define ESR_ELx_EC_SHIFT	(26)
+#define ESR_ELx_EC_WIDTH	(6)
 #define ESR_ELx_EC_MASK		(UL(0x3F) << ESR_ELx_EC_SHIFT)
 #define ESR_ELx_EC(esr)		(((esr) & ESR_ELx_EC_MASK) >> ESR_ELx_EC_SHIFT)
 
diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S
index 0a5b36eb54b3..bcbead3746c6 100644
--- a/arch/arm64/kvm/hyp/hyp-entry.S
+++ b/arch/arm64/kvm/hyp/hyp-entry.S
@@ -43,7 +43,7 @@
 el1_sync:				// Guest trapped into EL2
 
 	mrs	x0, esr_el2
-	lsr	x0, x0, #ESR_ELx_EC_SHIFT
+	ubfx	x0, x0, #ESR_ELx_EC_SHIFT, #ESR_ELx_EC_WIDTH
 	cmp	x0, #ESR_ELx_EC_HVC64
 	ccmp	x0, #ESR_ELx_EC_HVC32, #4, ne
 	b.ne	el1_trap
diff --git a/arch/arm64/kvm/hyp/nvhe/host.S b/arch/arm64/kvm/hyp/nvhe/host.S
index 4ce934fc1f72..4f57a803d1c8 100644
--- a/arch/arm64/kvm/hyp/nvhe/host.S
+++ b/arch/arm64/kvm/hyp/nvhe/host.S
@@ -97,7 +97,7 @@ SYM_FUNC_END(__hyp_do_panic)
 .L__vect_start\@:
 	stp	x0, x1, [sp, #-16]!
 	mrs	x0, esr_el2
-	lsr	x0, x0, #ESR_ELx_EC_SHIFT
+	ubfx	x0, x0, #ESR_ELx_EC_SHIFT, #ESR_ELx_EC_WIDTH
 	cmp	x0, #ESR_ELx_EC_HVC64
 	ldp	x0, x1, [sp], #16
 	b.ne	__host_exit

From 9f9d6d391ff5f8a3a4f6a0547fe8ed78dc4d8f15 Mon Sep 17 00:00:00 2001
From: Sean Christopherson <seanjc@google.com>
Date: Tue, 9 Nov 2021 01:30:44 +0000
Subject: [PATCH 1278/1750] KVM: nVMX: Query current VMCS when determining if
 MSR bitmaps are in use

commit 7dfbc624eb5726367900c8d86deff50836240361 upstream.

Check the current VMCS controls to determine if an MSR write will be
intercepted due to MSR bitmaps being disabled.  In the nested VMX case,
KVM will disable MSR bitmaps in vmcs02 if they're disabled in vmcs12 or
if KVM can't map L1's bitmaps for whatever reason.

Note, the bad behavior is relatively benign in the current code base as
KVM sets all bits in vmcs02's MSR bitmap by default, clears bits if and
only if L0 KVM also disables interception of an MSR, and only uses the
buggy helper for MSR_IA32_SPEC_CTRL.  Because KVM explicitly tests WRMSR
before disabling interception of MSR_IA32_SPEC_CTRL, the flawed check
will only result in KVM reading MSR_IA32_SPEC_CTRL from hardware when it
isn't strictly necessary.

Tag the fix for stable in case a future fix wants to use
msr_write_intercepted(), in which case a buggy implementation in older
kernels could prove subtly problematic.

Fixes: d28b387fb74d ("KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20211109013047.2041518-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/vmx.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index 31b4452c931a..baa4244f3e6a 100644
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -859,15 +859,15 @@ void update_exception_bitmap(struct kvm_vcpu *vcpu)
 /*
  * Check if MSR is intercepted for currently loaded MSR bitmap.
  */
-static bool msr_write_intercepted(struct kvm_vcpu *vcpu, u32 msr)
+static bool msr_write_intercepted(struct vcpu_vmx *vmx, u32 msr)
 {
 	unsigned long *msr_bitmap;
 	int f = sizeof(unsigned long);
 
-	if (!cpu_has_vmx_msr_bitmap())
+	if (!(exec_controls_get(vmx) & CPU_BASED_USE_MSR_BITMAPS))
 		return true;
 
-	msr_bitmap = to_vmx(vcpu)->loaded_vmcs->msr_bitmap;
+	msr_bitmap = vmx->loaded_vmcs->msr_bitmap;
 
 	if (msr <= 0x1fff) {
 		return !!test_bit(msr, msr_bitmap + 0x800 / f);
@@ -6744,7 +6744,7 @@ static fastpath_t vmx_vcpu_run(struct kvm_vcpu *vcpu)
 	 * If the L02 MSR bitmap does not intercept the MSR, then we need to
 	 * save it.
 	 */
-	if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)))
+	if (unlikely(!msr_write_intercepted(vmx, MSR_IA32_SPEC_CTRL)))
 		vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL);
 
 	x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0);

From c3cb7b5c9d140b1a678b74ba8d2544e1eb66e2fc Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Thu, 28 Oct 2021 22:38:25 +0800
Subject: [PATCH 1279/1750] can: j1939: j1939_tp_cmd_recv(): ignore abort
 message in the BAM transport

commit c0f49d98006f2db3333b917caac65bce2af9865c upstream.

This patch prevents BAM transport from being closed by receiving abort
message, as specified in SAE-J1939-82 2015 (A.3.3 Row 4).

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/1635431907-15617-2-git-send-email-zhangchangzhong@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/transport.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index e59fbbffa31c..fe35fdad35c9 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -2065,6 +2065,12 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb)
 		break;
 
 	case J1939_ETP_CMD_ABORT: /* && J1939_TP_CMD_ABORT */
+		if (j1939_cb_is_broadcast(skcb)) {
+			netdev_err_once(priv->ndev, "%s: abort to broadcast (%02x), ignoring!\n",
+					__func__, skcb->addr.sa);
+			return;
+		}
+
 		if (j1939_tp_im_transmitter(skcb))
 			j1939_xtp_rx_abort(priv, skb, true);
 

From 875609ad8020a818ec25244fa0915e04e2cf4bf5 Mon Sep 17 00:00:00 2001
From: Zhang Changzhong <zhangchangzhong@huawei.com>
Date: Thu, 28 Oct 2021 22:38:26 +0800
Subject: [PATCH 1280/1750] can: j1939: j1939_can_recv(): ignore messages with
 invalid source address

commit a79305e156db3d24fcd8eb649cdb3c3b2350e5c2 upstream.

According to SAE-J1939-82 2015 (A.3.6 Row 2), a receiver should never
send TP.CM_CTS to the global address, so we can add a check in
j1939_can_recv() to drop messages with invalid source address.

Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/1635431907-15617-3-git-send-email-zhangchangzhong@huawei.com
Cc: stable@vger.kernel.org
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/can/j1939/main.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/can/j1939/main.c b/net/can/j1939/main.c
index 266c189f1e80..ca75d1b8f415 100644
--- a/net/can/j1939/main.c
+++ b/net/can/j1939/main.c
@@ -75,6 +75,13 @@ static void j1939_can_recv(struct sk_buff *iskb, void *data)
 	skcb->addr.pgn = (cf->can_id >> 8) & J1939_PGN_MAX;
 	/* set default message type */
 	skcb->addr.type = J1939_TP;
+
+	if (!j1939_address_is_valid(skcb->addr.sa)) {
+		netdev_err_once(priv->ndev, "%s: sa is broadcast address, ignoring!\n",
+				__func__);
+		goto done;
+	}
+
 	if (j1939_pgn_is_pdu1(skcb->addr.pgn)) {
 		/* Type 1: with destination address */
 		skcb->addr.da = skcb->addr.pgn;

From 93fccb1f8939ef5328a674a2301286a0d0a77bfa Mon Sep 17 00:00:00 2001
From: Xiaoming Ni <nixiaoming@huawei.com>
Date: Wed, 29 Sep 2021 11:36:45 +0800
Subject: [PATCH 1281/1750] powerpc/85xx: Fix oops when mpc85xx_smp_guts_ids
 node cannot be found

commit 3c2172c1c47b4079c29f0e6637d764a99355ebcd upstream.

When the field described in mpc85xx_smp_guts_ids[] is not configured in
dtb, the mpc85xx_setup_pmc() does not assign a value to the "guts"
variable. As a result, the oops is triggered when
mpc85xx_freeze_time_base() is executed.

Fixes: 56f1ba280719 ("powerpc/mpc85xx: refactor the PM operations")
Cc: stable@vger.kernel.org # v4.6+
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210929033646.39630-2-nixiaoming@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
index 7c0133f558d0..ffa8a7a6a2db 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
@@ -94,9 +94,8 @@ int __init mpc85xx_setup_pmc(void)
 			pr_err("Could not map guts node address\n");
 			return -ENOMEM;
 		}
+		qoriq_pm_ops = &mpc85xx_pm_ops;
 	}
 
-	qoriq_pm_ops = &mpc85xx_pm_ops;
-
 	return 0;
 }

From c1e6e42740cb3904d80abd2e0c623c7736ed57d9 Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Mon, 8 Nov 2021 10:58:10 -0500
Subject: [PATCH 1282/1750] ring-buffer: Protect ring_buffer_reset() from
 reentrancy

commit 51d157946666382e779f94c39891e8e9a020da78 upstream.

The resetting of the entire ring buffer use to simply go through and reset
each individual CPU buffer that had its own protection and synchronization.
But this was very slow, due to performing a synchronization for each CPU.
The code was reshuffled to do one disabling of all CPU buffers, followed
by a single RCU synchronization, and then the resetting of each of the CPU
buffers. But unfortunately, the mutex that prevented multiple occurrences
of resetting the buffer was not moved to the upper function, and there is
nothing to protect from it.

Take the ring buffer mutex around the global reset.

Cc: stable@vger.kernel.org
Fixes: b23d7a5f4a07a ("ring-buffer: speed up buffer resets by avoiding synchronize_rcu for each CPU")
Reported-by: "Tzvetomir Stoyanov (VMware)" <tz.stoyanov@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/trace/ring_buffer.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 39d4d9b25d1a..6deac666ba3e 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5000,6 +5000,9 @@ void ring_buffer_reset(struct trace_buffer *buffer)
 	struct ring_buffer_per_cpu *cpu_buffer;
 	int cpu;
 
+	/* prevent another thread from changing buffer sizes */
+	mutex_lock(&buffer->mutex);
+
 	for_each_buffer_cpu(buffer, cpu) {
 		cpu_buffer = buffer->buffers[cpu];
 
@@ -5018,6 +5021,8 @@ void ring_buffer_reset(struct trace_buffer *buffer)
 		atomic_dec(&cpu_buffer->record_disabled);
 		atomic_dec(&cpu_buffer->resize_disabled);
 	}
+
+	mutex_unlock(&buffer->mutex);
 }
 EXPORT_SYMBOL_GPL(ring_buffer_reset);
 

From 47462c5e600fbaffd755cd13dedd80d04e41ff83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Sat, 2 Oct 2021 15:09:00 +0200
Subject: [PATCH 1283/1750] serial: core: Fix initializing and restoring
 termios speed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 027b57170bf8bb6999a28e4a5f3d78bf1db0f90c upstream.

Since commit edc6afc54968 ("tty: switch to ktermios and new framework")
termios speed is no longer stored only in c_cflag member but also in new
additional c_ispeed and c_ospeed members. If BOTHER flag is set in c_cflag
then termios speed is stored only in these new members.

Therefore to correctly restore termios speed it is required to store also
ispeed and ospeed members, not only cflag member.

In case only cflag member with BOTHER flag is restored then functions
tty_termios_baud_rate() and tty_termios_input_baud_rate() returns baudrate
stored in c_ospeed / c_ispeed member, which is zero as it was not restored
too. If reported baudrate is invalid (e.g. zero) then serial core functions
report fallback baudrate value 9600. So it means that in this case original
baudrate is lost and kernel changes it to value 9600.

Simple reproducer of this issue is to boot kernel with following command
line argument: "console=ttyXXX,86400" (where ttyXXX is the device name).
For speed 86400 there is no Bnnn constant and therefore kernel has to
represent this speed via BOTHER c_cflag. Which means that speed is stored
only in c_ospeed and c_ispeed members, not in c_cflag anymore.

If bootloader correctly configures serial device to speed 86400 then kernel
prints boot log to early console at speed speed 86400 without any issue.
But after kernel starts initializing real console device ttyXXX then speed
is changed to fallback value 9600 because information about speed was lost.

This patch fixes above issue by storing and restoring also ispeed and
ospeed members, which are required for BOTHER flag.

Fixes: edc6afc54968 ("[PATCH] tty: switch to ktermios and new framework")
Cc: stable@vger.kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/20211002130900.9518-1-pali@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/serial_core.c | 16 ++++++++++++++--
 include/linux/console.h          |  2 ++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 68a0ff605476..e6fb5077fe34 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -222,7 +222,11 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
 	if (retval == 0) {
 		if (uart_console(uport) && uport->cons->cflag) {
 			tty->termios.c_cflag = uport->cons->cflag;
+			tty->termios.c_ispeed = uport->cons->ispeed;
+			tty->termios.c_ospeed = uport->cons->ospeed;
 			uport->cons->cflag = 0;
+			uport->cons->ispeed = 0;
+			uport->cons->ospeed = 0;
 		}
 		/*
 		 * Initialise the hardware port settings.
@@ -290,8 +294,11 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
 		/*
 		 * Turn off DTR and RTS early.
 		 */
-		if (uport && uart_console(uport) && tty)
+		if (uport && uart_console(uport) && tty) {
 			uport->cons->cflag = tty->termios.c_cflag;
+			uport->cons->ispeed = tty->termios.c_ispeed;
+			uport->cons->ospeed = tty->termios.c_ospeed;
+		}
 
 		if (!tty || C_HUPCL(tty))
 			uart_port_dtr_rts(uport, 0);
@@ -2123,8 +2130,11 @@ uart_set_options(struct uart_port *port, struct console *co,
 	 * Allow the setting of the UART parameters with a NULL console
 	 * too:
 	 */
-	if (co)
+	if (co) {
 		co->cflag = termios.c_cflag;
+		co->ispeed = termios.c_ispeed;
+		co->ospeed = termios.c_ospeed;
+	}
 
 	return 0;
 }
@@ -2258,6 +2268,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
 		 */
 		memset(&termios, 0, sizeof(struct ktermios));
 		termios.c_cflag = uport->cons->cflag;
+		termios.c_ispeed = uport->cons->ispeed;
+		termios.c_ospeed = uport->cons->ospeed;
 
 		/*
 		 * If that's unset, use the tty termios setting.
diff --git a/include/linux/console.h b/include/linux/console.h
index 4b1e26c4cb42..bc2a749e6f0d 100644
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -150,6 +150,8 @@ struct console {
 	short	flags;
 	short	index;
 	int	cflag;
+	uint	ispeed;
+	uint	ospeed;
 	void	*data;
 	struct	 console *next;
 };

From cd0b29a89bc29b9b3728185382ea14ee6225af3f Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 29 Oct 2021 13:30:51 +0200
Subject: [PATCH 1284/1750] ifb: fix building without CONFIG_NET_CLS_ACT

commit 7444d706be31753f65052c7f6325fc8470cc1789 upstream.

The driver no longer depends on this option, but it fails to
build if it's disabled because the skb->tc_skip_classify is
hidden behind an #ifdef:

drivers/net/ifb.c:81:8: error: no member named 'tc_skip_classify' in 'struct sk_buff'
                skb->tc_skip_classify = 1;

Use the same #ifdef around the assignment.

Fixes: 046178e726c2 ("ifb: Depend on netfilter alternatively to tc")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ifb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 7fe306e76281..db3a9b93d4db 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -76,7 +76,9 @@ static void ifb_ri_tasklet(unsigned long _txp)
 
 	while ((skb = __skb_dequeue(&txp->tq)) != NULL) {
 		skb->redirected = 0;
+#ifdef CONFIG_NET_CLS_ACT
 		skb->tc_skip_classify = 1;
+#endif
 
 		u64_stats_update_begin(&txp->tsync);
 		txp->tx_packets++;

From 694c0c84a6ec3cdb143c2fcf037b880b07c2f798 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 20 Oct 2021 18:48:46 +0200
Subject: [PATCH 1285/1750] ALSA: mixer: oss: Fix racy access to slots

commit 411cef6adfb38a5bb6bd9af3941b28198e7fb680 upstream.

The OSS mixer can reassign the mapping slots dynamically via proc
file.  Although the addition and deletion of those slots are protected
by mixer->reg_mutex, the access to slots aren't, hence this may cause
UAF when the slots in use are deleted concurrently.

This patch applies the mixer->reg_mutex in all appropriate code paths
(i.e. the ioctl functions) that may access slots.

Reported-by: syzbot+9988f17cf72a1045a189@syzkaller.appspotmail.com
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/00000000000036adc005ceca9175@google.com
Link: https://lore.kernel.org/r/20211020164846.922-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/mixer_oss.c | 43 +++++++++++++++++++++++++++++---------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index f702c96a7478..c113768484be 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -130,11 +130,13 @@ static int snd_mixer_oss_devmask(struct snd_mixer_oss_file *fmixer)
 
 	if (mixer == NULL)
 		return -EIO;
+	mutex_lock(&mixer->reg_mutex);
 	for (chn = 0; chn < 31; chn++) {
 		pslot = &mixer->slots[chn];
 		if (pslot->put_volume || pslot->put_recsrc)
 			result |= 1 << chn;
 	}
+	mutex_unlock(&mixer->reg_mutex);
 	return result;
 }
 
@@ -146,11 +148,13 @@ static int snd_mixer_oss_stereodevs(struct snd_mixer_oss_file *fmixer)
 
 	if (mixer == NULL)
 		return -EIO;
+	mutex_lock(&mixer->reg_mutex);
 	for (chn = 0; chn < 31; chn++) {
 		pslot = &mixer->slots[chn];
 		if (pslot->put_volume && pslot->stereo)
 			result |= 1 << chn;
 	}
+	mutex_unlock(&mixer->reg_mutex);
 	return result;
 }
 
@@ -161,6 +165,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer)
 
 	if (mixer == NULL)
 		return -EIO;
+	mutex_lock(&mixer->reg_mutex);
 	if (mixer->put_recsrc && mixer->get_recsrc) {	/* exclusive */
 		result = mixer->mask_recsrc;
 	} else {
@@ -172,6 +177,7 @@ static int snd_mixer_oss_recmask(struct snd_mixer_oss_file *fmixer)
 				result |= 1 << chn;
 		}
 	}
+	mutex_unlock(&mixer->reg_mutex);
 	return result;
 }
 
@@ -182,11 +188,12 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer)
 
 	if (mixer == NULL)
 		return -EIO;
+	mutex_lock(&mixer->reg_mutex);
 	if (mixer->put_recsrc && mixer->get_recsrc) {	/* exclusive */
-		int err;
 		unsigned int index;
-		if ((err = mixer->get_recsrc(fmixer, &index)) < 0)
-			return err;
+		result = mixer->get_recsrc(fmixer, &index);
+		if (result < 0)
+			goto unlock;
 		result = 1 << index;
 	} else {
 		struct snd_mixer_oss_slot *pslot;
@@ -201,7 +208,10 @@ static int snd_mixer_oss_get_recsrc(struct snd_mixer_oss_file *fmixer)
 			}
 		}
 	}
-	return mixer->oss_recsrc = result;
+	mixer->oss_recsrc = result;
+ unlock:
+	mutex_unlock(&mixer->reg_mutex);
+	return result;
 }
 
 static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsrc)
@@ -214,6 +224,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr
 
 	if (mixer == NULL)
 		return -EIO;
+	mutex_lock(&mixer->reg_mutex);
 	if (mixer->get_recsrc && mixer->put_recsrc) {	/* exclusive input */
 		if (recsrc & ~mixer->oss_recsrc)
 			recsrc &= ~mixer->oss_recsrc;
@@ -239,6 +250,7 @@ static int snd_mixer_oss_set_recsrc(struct snd_mixer_oss_file *fmixer, int recsr
 			}
 		}
 	}
+	mutex_unlock(&mixer->reg_mutex);
 	return result;
 }
 
@@ -250,6 +262,7 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot)
 
 	if (mixer == NULL || slot > 30)
 		return -EIO;
+	mutex_lock(&mixer->reg_mutex);
 	pslot = &mixer->slots[slot];
 	left = pslot->volume[0];
 	right = pslot->volume[1];
@@ -257,15 +270,21 @@ static int snd_mixer_oss_get_volume(struct snd_mixer_oss_file *fmixer, int slot)
 		result = pslot->get_volume(fmixer, pslot, &left, &right);
 	if (!pslot->stereo)
 		right = left;
-	if (snd_BUG_ON(left < 0 || left > 100))
-		return -EIO;
-	if (snd_BUG_ON(right < 0 || right > 100))
-		return -EIO;
+	if (snd_BUG_ON(left < 0 || left > 100)) {
+		result = -EIO;
+		goto unlock;
+	}
+	if (snd_BUG_ON(right < 0 || right > 100)) {
+		result = -EIO;
+		goto unlock;
+	}
 	if (result >= 0) {
 		pslot->volume[0] = left;
 		pslot->volume[1] = right;
 	 	result = (left & 0xff) | ((right & 0xff) << 8);
 	}
+ unlock:
+	mutex_unlock(&mixer->reg_mutex);
 	return result;
 }
 
@@ -278,6 +297,7 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer,
 
 	if (mixer == NULL || slot > 30)
 		return -EIO;
+	mutex_lock(&mixer->reg_mutex);
 	pslot = &mixer->slots[slot];
 	if (left > 100)
 		left = 100;
@@ -288,10 +308,13 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer,
 	if (pslot->put_volume)
 		result = pslot->put_volume(fmixer, pslot, left, right);
 	if (result < 0)
-		return result;
+		goto unlock;
 	pslot->volume[0] = left;
 	pslot->volume[1] = right;
- 	return (left & 0xff) | ((right & 0xff) << 8);
+	result = (left & 0xff) | ((right & 0xff) << 8);
+ unlock:
+	mutex_lock(&mixer->reg_mutex);
+	return result;
 }
 
 static int snd_mixer_oss_ioctl1(struct snd_mixer_oss_file *fmixer, unsigned int cmd, unsigned long arg)

From 96e7880a432a429994f3389ecf90587a4a130a13 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Sun, 24 Oct 2021 17:03:15 +0300
Subject: [PATCH 1286/1750] ALSA: mixer: fix deadlock in
 snd_mixer_oss_set_volume

commit 3ab7992018455ac63c33e9b3eaa7264e293e40f4 upstream.

In commit 411cef6adfb3 ("ALSA: mixer: oss: Fix racy access to slots")
added mutex protection in snd_mixer_oss_set_volume(). Second
mutex_lock() in same function looks like typo, fix it.

Reported-by: syzbot+ace149a75a9a0a399ac7@syzkaller.appspotmail.com
Fixes: 411cef6adfb3 ("ALSA: mixer: oss: Fix racy access to slots")
Cc: <stable@vger.kernel.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20211024140315.16704-1-paskripkin@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/core/oss/mixer_oss.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index c113768484be..bfed82a3a188 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -313,7 +313,7 @@ static int snd_mixer_oss_set_volume(struct snd_mixer_oss_file *fmixer,
 	pslot->volume[1] = right;
 	result = (left & 0xff) | ((right & 0xff) << 8);
  unlock:
-	mutex_lock(&mixer->reg_mutex);
+	mutex_unlock(&mixer->reg_mutex);
 	return result;
 }
 

From af7d25d7853c286126e660e59cfa52c026334881 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 2 Nov 2021 10:19:44 +0100
Subject: [PATCH 1287/1750] xen/balloon: add late_initcall_sync() for initial
 ballooning done
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 40fdea0284bb20814399da0484a658a96c735d90 upstream.

When running as PVH or HVM guest with actual memory < max memory the
hypervisor is using "populate on demand" in order to allow the guest
to balloon down from its maximum memory size. For this to work
correctly the guest must not touch more memory pages than its target
memory size as otherwise the PoD cache will be exhausted and the guest
is crashed as a result of that.

In extreme cases ballooning down might not be finished today before
the init process is started, which can consume lots of memory.

In order to avoid random boot crashes in such cases, add a late init
call to wait for ballooning down having finished for PVH/HVM guests.

Warn on console if initial ballooning fails, panic() after stalling
for more than 3 minutes per default. Add a module parameter for
changing this timeout.

[boris: replaced pr_info() with pr_notice()]

Cc: <stable@vger.kernel.org>
Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20211102091944.17487-1-jgross@suse.com
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 .../admin-guide/kernel-parameters.txt         |  7 ++
 drivers/xen/balloon.c                         | 86 ++++++++++++++-----
 2 files changed, 70 insertions(+), 23 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index f103667d3727..516499f9ccae 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -5988,6 +5988,13 @@
 			improve timer resolution at the expense of processing
 			more timer interrupts.
 
+	xen.balloon_boot_timeout= [XEN]
+			The time (in seconds) to wait before giving up to boot
+			in case initial ballooning fails to free enough memory.
+			Applies only when running as HVM or PVH guest and
+			started with less memory configured than allowed at
+			max. Default is 180.
+
 	xen.event_eoi_delay=	[XEN]
 			How long to delay EOI handling in case of event
 			storms (jiffies). Default is 10.
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 1911a62a6d9c..c5b02365a5fe 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -58,6 +58,7 @@
 #include <linux/percpu-defs.h>
 #include <linux/slab.h>
 #include <linux/sysctl.h>
+#include <linux/moduleparam.h>
 
 #include <asm/page.h>
 #include <asm/tlb.h>
@@ -73,6 +74,12 @@
 #include <xen/page.h>
 #include <xen/mem-reservation.h>
 
+#undef MODULE_PARAM_PREFIX
+#define MODULE_PARAM_PREFIX "xen."
+
+static uint __read_mostly balloon_boot_timeout = 180;
+module_param(balloon_boot_timeout, uint, 0444);
+
 static int xen_hotplug_unpopulated;
 
 #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
@@ -125,12 +132,12 @@ static struct ctl_table xen_root[] = {
  * BP_ECANCELED: error, balloon operation canceled.
  */
 
-enum bp_state {
+static enum bp_state {
 	BP_DONE,
 	BP_WAIT,
 	BP_EAGAIN,
 	BP_ECANCELED
-};
+} balloon_state = BP_DONE;
 
 /* Main waiting point for xen-balloon thread. */
 static DECLARE_WAIT_QUEUE_HEAD(balloon_thread_wq);
@@ -199,18 +206,15 @@ static struct page *balloon_next_page(struct page *page)
 	return list_entry(next, struct page, lru);
 }
 
-static enum bp_state update_schedule(enum bp_state state)
+static void update_schedule(void)
 {
-	if (state == BP_WAIT)
-		return BP_WAIT;
+	if (balloon_state == BP_WAIT || balloon_state == BP_ECANCELED)
+		return;
 
-	if (state == BP_ECANCELED)
-		return BP_ECANCELED;
-
-	if (state == BP_DONE) {
+	if (balloon_state == BP_DONE) {
 		balloon_stats.schedule_delay = 1;
 		balloon_stats.retry_count = 1;
-		return BP_DONE;
+		return;
 	}
 
 	++balloon_stats.retry_count;
@@ -219,7 +223,8 @@ static enum bp_state update_schedule(enum bp_state state)
 			balloon_stats.retry_count > balloon_stats.max_retry_count) {
 		balloon_stats.schedule_delay = 1;
 		balloon_stats.retry_count = 1;
-		return BP_ECANCELED;
+		balloon_state = BP_ECANCELED;
+		return;
 	}
 
 	balloon_stats.schedule_delay <<= 1;
@@ -227,7 +232,7 @@ static enum bp_state update_schedule(enum bp_state state)
 	if (balloon_stats.schedule_delay > balloon_stats.max_schedule_delay)
 		balloon_stats.schedule_delay = balloon_stats.max_schedule_delay;
 
-	return BP_EAGAIN;
+	balloon_state = BP_EAGAIN;
 }
 
 #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
@@ -494,9 +499,9 @@ static enum bp_state decrease_reservation(unsigned long nr_pages, gfp_t gfp)
  * Stop waiting if either state is BP_DONE and ballooning action is
  * needed, or if the credit has changed while state is not BP_DONE.
  */
-static bool balloon_thread_cond(enum bp_state state, long credit)
+static bool balloon_thread_cond(long credit)
 {
-	if (state == BP_DONE)
+	if (balloon_state == BP_DONE)
 		credit = 0;
 
 	return current_credit() != credit || kthread_should_stop();
@@ -510,13 +515,12 @@ static bool balloon_thread_cond(enum bp_state state, long credit)
  */
 static int balloon_thread(void *unused)
 {
-	enum bp_state state = BP_DONE;
 	long credit;
 	unsigned long timeout;
 
 	set_freezable();
 	for (;;) {
-		switch (state) {
+		switch (balloon_state) {
 		case BP_DONE:
 		case BP_ECANCELED:
 			timeout = 3600 * HZ;
@@ -532,7 +536,7 @@ static int balloon_thread(void *unused)
 		credit = current_credit();
 
 		wait_event_freezable_timeout(balloon_thread_wq,
-			balloon_thread_cond(state, credit), timeout);
+			balloon_thread_cond(credit), timeout);
 
 		if (kthread_should_stop())
 			return 0;
@@ -543,22 +547,23 @@ static int balloon_thread(void *unused)
 
 		if (credit > 0) {
 			if (balloon_is_inflated())
-				state = increase_reservation(credit);
+				balloon_state = increase_reservation(credit);
 			else
-				state = reserve_additional_memory();
+				balloon_state = reserve_additional_memory();
 		}
 
 		if (credit < 0) {
 			long n_pages;
 
 			n_pages = min(-credit, si_mem_available());
-			state = decrease_reservation(n_pages, GFP_BALLOON);
-			if (state == BP_DONE && n_pages != -credit &&
+			balloon_state = decrease_reservation(n_pages,
+							     GFP_BALLOON);
+			if (balloon_state == BP_DONE && n_pages != -credit &&
 			    n_pages < totalreserve_pages)
-				state = BP_EAGAIN;
+				balloon_state = BP_EAGAIN;
 		}
 
-		state = update_schedule(state);
+		update_schedule();
 
 		mutex_unlock(&balloon_mutex);
 
@@ -765,3 +770,38 @@ static int __init balloon_init(void)
 	return 0;
 }
 subsys_initcall(balloon_init);
+
+static int __init balloon_wait_finish(void)
+{
+	long credit, last_credit = 0;
+	unsigned long last_changed = 0;
+
+	if (!xen_domain())
+		return -ENODEV;
+
+	/* PV guests don't need to wait. */
+	if (xen_pv_domain() || !current_credit())
+		return 0;
+
+	pr_notice("Waiting for initial ballooning down having finished.\n");
+
+	while ((credit = current_credit()) < 0) {
+		if (credit != last_credit) {
+			last_changed = jiffies;
+			last_credit = credit;
+		}
+		if (balloon_state == BP_ECANCELED) {
+			pr_warn_once("Initial ballooning failed, %ld pages need to be freed.\n",
+				     -credit);
+			if (jiffies - last_changed >= HZ * balloon_boot_timeout)
+				panic("Initial ballooning failed!\n");
+		}
+
+		schedule_timeout_interruptible(HZ / 10);
+	}
+
+	pr_notice("Initial ballooning down finished.\n");
+
+	return 0;
+}
+late_initcall_sync(balloon_wait_finish);

From 4fd9f0509a1452b45e89c668e2bab854cb05cd25 Mon Sep 17 00:00:00 2001
From: yangerkun <yangerkun@huawei.com>
Date: Thu, 30 Sep 2021 11:22:28 +0800
Subject: [PATCH 1288/1750] ovl: fix use after free in struct ovl_aio_req

commit 9a254403760041528bc8f69fe2f5e1ef86950991 upstream.

Example for triggering use after free in a overlay on ext4 setup:

aio_read
  ovl_read_iter
    vfs_iter_read
      ext4_file_read_iter
        ext4_dio_read_iter
          iomap_dio_rw -> -EIOCBQUEUED
          /*
	   * Here IO is completed in a separate thread,
	   * ovl_aio_cleanup_handler() frees aio_req which has iocb embedded
	   */
          file_accessed(iocb->ki_filp); /**BOOM**/

Fix by introducing a refcount in ovl_aio_req similarly to aio_kiocb.  This
guarantees that iocb is only freed after vfs_read/write_iter() returns on
underlying fs.

Fixes: 2406a307ac7d ("ovl: implement async IO routines")
Signed-off-by: yangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20210930032228.3199690-3-yangerkun@huawei.com/
Cc: <stable@vger.kernel.org> # v5.6
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/overlayfs/file.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index f7135777cb4e..d1ae643a999a 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -17,6 +17,7 @@
 
 struct ovl_aio_req {
 	struct kiocb iocb;
+	refcount_t ref;
 	struct kiocb *orig_iocb;
 	struct fd fd;
 };
@@ -257,6 +258,14 @@ static rwf_t ovl_iocb_to_rwf(int ifl)
 	return flags;
 }
 
+static inline void ovl_aio_put(struct ovl_aio_req *aio_req)
+{
+	if (refcount_dec_and_test(&aio_req->ref)) {
+		fdput(aio_req->fd);
+		kmem_cache_free(ovl_aio_request_cachep, aio_req);
+	}
+}
+
 static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req)
 {
 	struct kiocb *iocb = &aio_req->iocb;
@@ -273,8 +282,7 @@ static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req)
 	}
 
 	orig_iocb->ki_pos = iocb->ki_pos;
-	fdput(aio_req->fd);
-	kmem_cache_free(ovl_aio_request_cachep, aio_req);
+	ovl_aio_put(aio_req);
 }
 
 static void ovl_aio_rw_complete(struct kiocb *iocb, long res, long res2)
@@ -324,7 +332,9 @@ static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter)
 		aio_req->orig_iocb = iocb;
 		kiocb_clone(&aio_req->iocb, iocb, real.file);
 		aio_req->iocb.ki_complete = ovl_aio_rw_complete;
+		refcount_set(&aio_req->ref, 2);
 		ret = vfs_iocb_iter_read(real.file, &aio_req->iocb, iter);
+		ovl_aio_put(aio_req);
 		if (ret != -EIOCBQUEUED)
 			ovl_aio_cleanup_handler(aio_req);
 	}
@@ -395,7 +405,9 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter)
 		kiocb_clone(&aio_req->iocb, iocb, real.file);
 		aio_req->iocb.ki_flags = ifl;
 		aio_req->iocb.ki_complete = ovl_aio_rw_complete;
+		refcount_set(&aio_req->ref, 2);
 		ret = vfs_iocb_iter_write(real.file, &aio_req->iocb, iter);
+		ovl_aio_put(aio_req);
 		if (ret != -EIOCBQUEUED)
 			ovl_aio_cleanup_handler(aio_req);
 	}

From adcfc317d3f5d14d02881211f409c32f6f845fd2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Thu, 28 Oct 2021 20:56:53 +0200
Subject: [PATCH 1289/1750] PCI: pci-bridge-emul: Fix emulation of W1C bits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 7a41ae80bdcb17e14dd7d83239b8a0cf368f18be upstream.

The pci_bridge_emul_conf_write() function correctly clears W1C bits in
cfgspace cache, but it does not inform the underlying implementation
about the clear request: the .write_op() method is given the value with
these bits cleared.

This is wrong if the .write_op() needs to know which bits were requested
to be cleared.

Fix the value to be passed into the .write_op() method to have requested
W1C bits set, so that it can clear them.

Both pci-bridge-emul users (mvebu and aardvark) are compatible with this
change.

Link: https://lore.kernel.org/r/20211028185659.20329-2-kabel@kernel.org
Fixes: 23a5fba4d941 ("PCI: Introduce PCI bridge emulated config space common logic")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Cc: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/pci-bridge-emul.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/pci/pci-bridge-emul.c b/drivers/pci/pci-bridge-emul.c
index fdaf86a888b7..db97cddfc85e 100644
--- a/drivers/pci/pci-bridge-emul.c
+++ b/drivers/pci/pci-bridge-emul.c
@@ -431,8 +431,21 @@ int pci_bridge_emul_conf_write(struct pci_bridge_emul *bridge, int where,
 	/* Clear the W1C bits */
 	new &= ~((value << shift) & (behavior[reg / 4].w1c & mask));
 
+	/* Save the new value with the cleared W1C bits into the cfgspace */
 	cfgspace[reg / 4] = cpu_to_le32(new);
 
+	/*
+	 * Clear the W1C bits not specified by the write mask, so that the
+	 * write_op() does not clear them.
+	 */
+	new &= ~(behavior[reg / 4].w1c & ~mask);
+
+	/*
+	 * Set the W1C bits specified by the write mask, so that write_op()
+	 * knows about that they are to be cleared.
+	 */
+	new |= (value << shift) & (behavior[reg / 4].w1c & mask);
+
 	if (write_op)
 		write_op(bridge, reg, old, new, mask);
 

From c1a8fb237470f1579fe4504389f4b3cf2e4015e8 Mon Sep 17 00:00:00 2001
From: Li Chen <lchen@ambarella.com>
Date: Thu, 21 Oct 2021 02:50:19 +0000
Subject: [PATCH 1290/1750] PCI: cadence: Add cdns_plat_pcie_probe() missing
 return

commit 27cd7e3c9bb1ae13bc16f08138edd6e4df3cd211 upstream.

When cdns_plat_pcie_probe() succeeds, return success instead of falling
into the error handling code.

Fixes: bd22885aa188 ("PCI: cadence: Refactor driver to use as a core library")
Link: https://lore.kernel.org/r/DM6PR19MB40271B93057D949310F0B0EDA0BF9@DM6PR19MB4027.namprd19.prod.outlook.com
Signed-off-by: Xuliang Zhang <xlzhanga@ambarella.com>
Signed-off-by: Li Chen <lchen@ambarella.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/cadence/pcie-cadence-plat.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/controller/cadence/pcie-cadence-plat.c b/drivers/pci/controller/cadence/pcie-cadence-plat.c
index 5fee0f89ab59..a224afadbcc0 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-plat.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-plat.c
@@ -127,6 +127,8 @@ static int cdns_plat_pcie_probe(struct platform_device *pdev)
 			goto err_init;
 	}
 
+	return 0;
+
  err_init:
  err_get_sync:
 	pm_runtime_put_sync(dev);

From 3bcbace714bb82721a38955b358afd476c800c3b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:45 +0200
Subject: [PATCH 1291/1750] PCI: aardvark: Do not clear status bits of masked
 interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit a7ca6d7fa3c02c032db5440ff392d96c04684c21 upstream.

The PCIE_ISR1_REG says which interrupts are currently set / active,
including those which are masked.

The driver currently reads this register and looks if some unmasked
interrupts are active, and if not, it clears status bits of _all_
interrupts, including the masked ones.

This is incorrect, since, for example, some drivers may poll these bits.

Remove this clearing, and also remove this early return statement
completely, since it does not change functionality in any way.

Link: https://lore.kernel.org/r/20211005180952.6812-7-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 4f1a29ede576..5f5ba6143f83 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -1286,12 +1286,6 @@ static void advk_pcie_handle_int(struct advk_pcie *pcie)
 	isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG);
 	isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK);
 
-	if (!isr0_status && !isr1_status) {
-		advk_writel(pcie, isr0_val, PCIE_ISR0_REG);
-		advk_writel(pcie, isr1_val, PCIE_ISR1_REG);
-		return;
-	}
-
 	/* Process MSI interrupts */
 	if (isr0_status & PCIE_ISR0_MSI_INT_PENDING)
 		advk_pcie_handle_msi(pcie);

From 1085ee5236ef46836690a29a6e6749e61f904105 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:51 +0200
Subject: [PATCH 1292/1750] PCI: aardvark: Fix checking for link up via LTSSM
 state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 661c399a651c11aaf83c45cbfe0b4a1fb7bc3179 upstream.

Current implementation of advk_pcie_link_up() is wrong as it marks also
link disabled or hot reset states as link up.

Fix it by marking link up only to those states which are defined in PCIe
Base specification 3.0, Table 4-14: Link Status Mapped to the LTSSM.

To simplify implementation, Define macros for every LTSSM state which
aardvark hardware can return in CFG_REG register.

Fix also checking for link training according to the same Table 4-14.
Define a new function advk_pcie_link_training() for this purpose.

Link: https://lore.kernel.org/r/20211005180952.6812-13-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Cc: Remi Pommarel <repk@triplefau.lt>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 76 ++++++++++++++++++++++++---
 1 file changed, 70 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 5f5ba6143f83..0107fd456605 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -163,8 +163,50 @@
 #define CFG_REG					(LMI_BASE_ADDR + 0x0)
 #define     LTSSM_SHIFT				24
 #define     LTSSM_MASK				0x3f
-#define     LTSSM_L0				0x10
 #define     RC_BAR_CONFIG			0x300
+
+/* LTSSM values in CFG_REG */
+enum {
+	LTSSM_DETECT_QUIET			= 0x0,
+	LTSSM_DETECT_ACTIVE			= 0x1,
+	LTSSM_POLLING_ACTIVE			= 0x2,
+	LTSSM_POLLING_COMPLIANCE		= 0x3,
+	LTSSM_POLLING_CONFIGURATION		= 0x4,
+	LTSSM_CONFIG_LINKWIDTH_START		= 0x5,
+	LTSSM_CONFIG_LINKWIDTH_ACCEPT		= 0x6,
+	LTSSM_CONFIG_LANENUM_ACCEPT		= 0x7,
+	LTSSM_CONFIG_LANENUM_WAIT		= 0x8,
+	LTSSM_CONFIG_COMPLETE			= 0x9,
+	LTSSM_CONFIG_IDLE			= 0xa,
+	LTSSM_RECOVERY_RCVR_LOCK		= 0xb,
+	LTSSM_RECOVERY_SPEED			= 0xc,
+	LTSSM_RECOVERY_RCVR_CFG			= 0xd,
+	LTSSM_RECOVERY_IDLE			= 0xe,
+	LTSSM_L0				= 0x10,
+	LTSSM_RX_L0S_ENTRY			= 0x11,
+	LTSSM_RX_L0S_IDLE			= 0x12,
+	LTSSM_RX_L0S_FTS			= 0x13,
+	LTSSM_TX_L0S_ENTRY			= 0x14,
+	LTSSM_TX_L0S_IDLE			= 0x15,
+	LTSSM_TX_L0S_FTS			= 0x16,
+	LTSSM_L1_ENTRY				= 0x17,
+	LTSSM_L1_IDLE				= 0x18,
+	LTSSM_L2_IDLE				= 0x19,
+	LTSSM_L2_TRANSMIT_WAKE			= 0x1a,
+	LTSSM_DISABLED				= 0x20,
+	LTSSM_LOOPBACK_ENTRY_MASTER		= 0x21,
+	LTSSM_LOOPBACK_ACTIVE_MASTER		= 0x22,
+	LTSSM_LOOPBACK_EXIT_MASTER		= 0x23,
+	LTSSM_LOOPBACK_ENTRY_SLAVE		= 0x24,
+	LTSSM_LOOPBACK_ACTIVE_SLAVE		= 0x25,
+	LTSSM_LOOPBACK_EXIT_SLAVE		= 0x26,
+	LTSSM_HOT_RESET				= 0x27,
+	LTSSM_RECOVERY_EQUALIZATION_PHASE0	= 0x28,
+	LTSSM_RECOVERY_EQUALIZATION_PHASE1	= 0x29,
+	LTSSM_RECOVERY_EQUALIZATION_PHASE2	= 0x2a,
+	LTSSM_RECOVERY_EQUALIZATION_PHASE3	= 0x2b,
+};
+
 #define VENDOR_ID_REG				(LMI_BASE_ADDR + 0x44)
 
 /* PCIe core controller registers */
@@ -269,13 +311,35 @@ static inline u16 advk_read16(struct advk_pcie *pcie, u64 reg)
 	return advk_readl(pcie, (reg & ~0x3)) >> ((reg & 0x3) * 8);
 }
 
-static int advk_pcie_link_up(struct advk_pcie *pcie)
+static u8 advk_pcie_ltssm_state(struct advk_pcie *pcie)
 {
-	u32 val, ltssm_state;
+	u32 val;
+	u8 ltssm_state;
 
 	val = advk_readl(pcie, CFG_REG);
 	ltssm_state = (val >> LTSSM_SHIFT) & LTSSM_MASK;
-	return ltssm_state >= LTSSM_L0;
+	return ltssm_state;
+}
+
+static inline bool advk_pcie_link_up(struct advk_pcie *pcie)
+{
+	/* check if LTSSM is in normal operation - some L* state */
+	u8 ltssm_state = advk_pcie_ltssm_state(pcie);
+	return ltssm_state >= LTSSM_L0 && ltssm_state < LTSSM_DISABLED;
+}
+
+static inline bool advk_pcie_link_training(struct advk_pcie *pcie)
+{
+	/*
+	 * According to PCIe Base specification 3.0, Table 4-14: Link
+	 * Status Mapped to the LTSSM is Link Training mapped to LTSSM
+	 * Configuration and Recovery states.
+	 */
+	u8 ltssm_state = advk_pcie_ltssm_state(pcie);
+	return ((ltssm_state >= LTSSM_CONFIG_LINKWIDTH_START &&
+		 ltssm_state < LTSSM_L0) ||
+		(ltssm_state >= LTSSM_RECOVERY_EQUALIZATION_PHASE0 &&
+		 ltssm_state <= LTSSM_RECOVERY_EQUALIZATION_PHASE3));
 }
 
 static int advk_pcie_wait_for_link(struct advk_pcie *pcie)
@@ -298,7 +362,7 @@ static void advk_pcie_wait_for_retrain(struct advk_pcie *pcie)
 	size_t retries;
 
 	for (retries = 0; retries < RETRAIN_WAIT_MAX_RETRIES; ++retries) {
-		if (!advk_pcie_link_up(pcie))
+		if (advk_pcie_link_training(pcie))
 			break;
 		udelay(RETRAIN_WAIT_USLEEP_US);
 	}
@@ -738,7 +802,7 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
 		/* u32 contains both PCI_EXP_LNKCTL and PCI_EXP_LNKSTA */
 		u32 val = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg) &
 			~(PCI_EXP_LNKSTA_LT << 16);
-		if (!advk_pcie_link_up(pcie))
+		if (advk_pcie_link_training(pcie))
 			val |= (PCI_EXP_LNKSTA_LT << 16);
 		*value = val;
 		return PCI_BRIDGE_EMUL_HANDLED;

From 2b861523d7ceb88bf1ee36a0ab523f3d7ca03ca7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:46 +0200
Subject: [PATCH 1293/1750] PCI: aardvark: Do not unmask unused interrupts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 1fb95d7d3c7a926b002fe8a6bd27a1cb428b46dc upstream.

There are lot of undocumented interrupt bits. To prevent unwanted
spurious interrupts, fix all *_ALL_MASK macros to define all interrupt
bits, so that driver can properly mask all interrupts, including those
which are undocumented.

Link: https://lore.kernel.org/r/20211005180952.6812-8-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 0107fd456605..1ff6f0d68773 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -105,13 +105,13 @@
 #define     PCIE_ISR0_MSI_INT_PENDING		BIT(24)
 #define     PCIE_ISR0_INTX_ASSERT(val)		BIT(16 + (val))
 #define     PCIE_ISR0_INTX_DEASSERT(val)	BIT(20 + (val))
-#define	    PCIE_ISR0_ALL_MASK			GENMASK(26, 0)
+#define     PCIE_ISR0_ALL_MASK			GENMASK(31, 0)
 #define PCIE_ISR1_REG				(CONTROL_BASE_ADDR + 0x48)
 #define PCIE_ISR1_MASK_REG			(CONTROL_BASE_ADDR + 0x4C)
 #define     PCIE_ISR1_POWER_STATE_CHANGE	BIT(4)
 #define     PCIE_ISR1_FLUSH			BIT(5)
 #define     PCIE_ISR1_INTX_ASSERT(val)		BIT(8 + (val))
-#define     PCIE_ISR1_ALL_MASK			GENMASK(11, 4)
+#define     PCIE_ISR1_ALL_MASK			GENMASK(31, 0)
 #define PCIE_MSI_ADDR_LOW_REG			(CONTROL_BASE_ADDR + 0x50)
 #define PCIE_MSI_ADDR_HIGH_REG			(CONTROL_BASE_ADDR + 0x54)
 #define PCIE_MSI_STATUS_REG			(CONTROL_BASE_ADDR + 0x58)
@@ -239,7 +239,7 @@ enum {
 #define     PCIE_IRQ_MSI_INT2_DET		BIT(21)
 #define     PCIE_IRQ_RC_DBELL_DET		BIT(22)
 #define     PCIE_IRQ_EP_STATUS			BIT(23)
-#define     PCIE_IRQ_ALL_MASK			0xfff0fb
+#define     PCIE_IRQ_ALL_MASK			GENMASK(31, 0)
 #define     PCIE_IRQ_ENABLE_INTS_MASK		PCIE_IRQ_CORE_INT
 
 /* Transaction types */

From 5fb031fcd423bde73dccd3d752ca1f76fb23b503 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:52 +0200
Subject: [PATCH 1294/1750] PCI: aardvark: Fix reporting Data Link Layer Link
 Active
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 2b650b7ff20eb7ea8ef9031d20fb657286ab90cc upstream.

Add support for reporting PCI_EXP_LNKSTA_DLLLA bit in Link Control register
on emulated bridge via current LTSSM state. Also correctly indicate DLLLA
capability via PCI_EXP_LNKCAP_DLLLARC bit in Link Control Capability
register.

Link: https://lore.kernel.org/r/20211005180952.6812-14-kabel@kernel.org
Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 29 ++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 1ff6f0d68773..3225e288639f 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -328,6 +328,20 @@ static inline bool advk_pcie_link_up(struct advk_pcie *pcie)
 	return ltssm_state >= LTSSM_L0 && ltssm_state < LTSSM_DISABLED;
 }
 
+static inline bool advk_pcie_link_active(struct advk_pcie *pcie)
+{
+	/*
+	 * According to PCIe Base specification 3.0, Table 4-14: Link
+	 * Status Mapped to the LTSSM, and 4.2.6.3.6 Configuration.Idle
+	 * is Link Up mapped to LTSSM Configuration.Idle, Recovery, L0,
+	 * L0s, L1 and L2 states. And according to 3.2.1. Data Link
+	 * Control and Management State Machine Rules is DL Up status
+	 * reported in DL Active state.
+	 */
+	u8 ltssm_state = advk_pcie_ltssm_state(pcie);
+	return ltssm_state >= LTSSM_CONFIG_IDLE && ltssm_state < LTSSM_DISABLED;
+}
+
 static inline bool advk_pcie_link_training(struct advk_pcie *pcie)
 {
 	/*
@@ -798,12 +812,26 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
 		return PCI_BRIDGE_EMUL_HANDLED;
 	}
 
+	case PCI_EXP_LNKCAP: {
+		u32 val = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg);
+		/*
+		 * PCI_EXP_LNKCAP_DLLLARC bit is hardwired in aardvark HW to 0.
+		 * But support for PCI_EXP_LNKSTA_DLLLA is emulated via ltssm
+		 * state so explicitly enable PCI_EXP_LNKCAP_DLLLARC flag.
+		 */
+		val |= PCI_EXP_LNKCAP_DLLLARC;
+		*value = val;
+		return PCI_BRIDGE_EMUL_HANDLED;
+	}
+
 	case PCI_EXP_LNKCTL: {
 		/* u32 contains both PCI_EXP_LNKCTL and PCI_EXP_LNKSTA */
 		u32 val = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg) &
 			~(PCI_EXP_LNKSTA_LT << 16);
 		if (advk_pcie_link_training(pcie))
 			val |= (PCI_EXP_LNKSTA_LT << 16);
+		if (advk_pcie_link_active(pcie))
+			val |= (PCI_EXP_LNKSTA_DLLLA << 16);
 		*value = val;
 		return PCI_BRIDGE_EMUL_HANDLED;
 	}
@@ -811,7 +839,6 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
 	case PCI_CAP_LIST_ID:
 	case PCI_EXP_DEVCAP:
 	case PCI_EXP_DEVCTL:
-	case PCI_EXP_LNKCAP:
 		*value = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg);
 		return PCI_BRIDGE_EMUL_HANDLED;
 	default:

From 6a0da19be5eb819311ac9d54e42ed7b6c78cf6db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:44 +0200
Subject: [PATCH 1295/1750] PCI: aardvark: Fix configuring Reference clock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 46ef6090dbf590711cb12680b6eafde5fa21fe87 upstream.

Commit 366697018c9a ("PCI: aardvark: Add PHY support") introduced
configuration of PCIe Reference clock via PCIE_CORE_REF_CLK_REG register,
but did it incorrectly.

PCIe Reference clock differential pair is routed from system board to
endpoint card, so on CPU side it has output direction. Therefore it is
required to enable transmitting and disable receiving.

Default configuration according to Armada 3700 Functional Specifications is
enabled receiver part and disabled transmitter.

We need this change because otherwise PCIe Reference clock is configured to
some undefined state when differential pair is used for both transmitting
and receiving.

Fix this by disabling receiver part.

Link: https://lore.kernel.org/r/20211005180952.6812-6-kabel@kernel.org
Fixes: 366697018c9a ("PCI: aardvark: Add PHY support")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 3225e288639f..1221cf9a88c3 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -98,6 +98,7 @@
 #define     PCIE_CORE_CTRL2_MSI_ENABLE		BIT(10)
 #define PCIE_CORE_REF_CLK_REG			(CONTROL_BASE_ADDR + 0x14)
 #define     PCIE_CORE_REF_CLK_TX_ENABLE		BIT(1)
+#define     PCIE_CORE_REF_CLK_RX_ENABLE		BIT(2)
 #define PCIE_MSG_LOG_REG			(CONTROL_BASE_ADDR + 0x30)
 #define PCIE_ISR0_REG				(CONTROL_BASE_ADDR + 0x40)
 #define PCIE_MSG_PM_PME_MASK			BIT(7)
@@ -529,9 +530,15 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 	u32 reg;
 	int i;
 
-	/* Enable TX */
+	/*
+	 * Configure PCIe Reference clock. Direction is from the PCIe
+	 * controller to the endpoint card, so enable transmitting of
+	 * Reference clock differential signal off-chip and disable
+	 * receiving off-chip differential signal.
+	 */
 	reg = advk_readl(pcie, PCIE_CORE_REF_CLK_REG);
 	reg |= PCIE_CORE_REF_CLK_TX_ENABLE;
+	reg &= ~PCIE_CORE_REF_CLK_RX_ENABLE;
 	advk_writel(pcie, reg, PCIE_CORE_REF_CLK_REG);
 
 	/* Set to Direct mode */

From 2ad10bbf8477d54f61c2d977da12a11091e7610a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Thu, 28 Oct 2021 20:56:54 +0200
Subject: [PATCH 1296/1750] PCI: aardvark: Fix return value of MSI domain
 .alloc() method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit e4313be1599d397625c14fb7826996813622decf upstream.

MSI domain callback .alloc() (implemented by advk_msi_irq_domain_alloc()
function) should return zero on success, since non-zero value indicates
failure.

When the driver was converted to generic MSI API in commit f21a8b1b6837
("PCI: aardvark: Move to MSI handling using generic MSI support"), it
was converted so that it returns hwirq number.

Fix this.

Link: https://lore.kernel.org/r/20211028185659.20329-3-kabel@kernel.org
Fixes: f21a8b1b6837 ("PCI: aardvark: Move to MSI handling using generic MSI support")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 1221cf9a88c3..27be96f6b276 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -1180,7 +1180,7 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain,
 				    domain->host_data, handle_simple_irq,
 				    NULL, NULL);
 
-	return hwirq;
+	return 0;
 }
 
 static void advk_msi_irq_domain_free(struct irq_domain *domain,

From 4bb5399c1c73e36fbb186f3eda84e39e5422ed31 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Thu, 28 Oct 2021 20:56:55 +0200
Subject: [PATCH 1297/1750] PCI: aardvark: Read all 16-bits from
 PCIE_MSI_PAYLOAD_REG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 95997723b6402cd6c53e0f9e7ac640ec64eaaff8 upstream.

The PCIE_MSI_PAYLOAD_REG contains 16-bit MSI number, not only lower
8 bits. Fix reading content of this register and add a comment
describing the access to this register.

Link: https://lore.kernel.org/r/20211028185659.20329-4-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 27be96f6b276..62a91c9da7a3 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -118,6 +118,7 @@
 #define PCIE_MSI_STATUS_REG			(CONTROL_BASE_ADDR + 0x58)
 #define PCIE_MSI_MASK_REG			(CONTROL_BASE_ADDR + 0x5C)
 #define PCIE_MSI_PAYLOAD_REG			(CONTROL_BASE_ADDR + 0x9C)
+#define     PCIE_MSI_DATA_MASK			GENMASK(15, 0)
 
 /* PCIe window configuration */
 #define OB_WIN_BASE_ADDR			0x4c00
@@ -1361,8 +1362,12 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie)
 		if (!(BIT(msi_idx) & msi_status))
 			continue;
 
+		/*
+		 * msi_idx contains bits [4:0] of the msi_data and msi_data
+		 * contains 16bit MSI interrupt number
+		 */
 		advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG);
-		msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & 0xFF;
+		msi_data = advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK;
 		generic_handle_irq(msi_data);
 	}
 

From 2b99c6fb65b43804d7db5c2eab9d46db8909d83c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 28 Oct 2021 20:56:56 +0200
Subject: [PATCH 1298/1750] PCI: aardvark: Fix support for bus mastering and
 PCI_COMMAND on emulated bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 771153fc884f566a89af2d30033b7f3bc6e24e84 upstream.

From very vague, ambiguous and incomplete information from Marvell we
deduced that the 32-bit Aardvark register at address 0x4
(PCIE_CORE_CMD_STATUS_REG), which is not documented for Root Complex mode
in the Functional Specification (only for Endpoint mode), controls two
16-bit PCIe registers: Command Register and Status Registers of PCIe Root
Port.

This means that bit 2 controls bus mastering and forwarding of memory and
I/O requests in the upstream direction. According to PCI specifications
bits [0:2] of Command Register, this should be by default disabled on
reset. So explicitly disable these bits at early setup of the Aardvark
driver.

Remove code which unconditionally enables all 3 bits and let kernel code
(via pci_set_master() function) to handle bus mastering of Root PCIe
Bridge via emulated PCI_COMMAND on emulated bridge.

Link: https://lore.kernel.org/r/20211028185659.20329-5-kabel@kernel.org
Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org # b2a56469d550 ("PCI: aardvark: Add FIXME comment for PCIE_CORE_CMD_STATUS_REG access")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 54 +++++++++++++++++++--------
 1 file changed, 38 insertions(+), 16 deletions(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 62a91c9da7a3..eec9bb7c7a80 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -30,9 +30,6 @@
 /* PCIe core registers */
 #define PCIE_CORE_DEV_ID_REG					0x0
 #define PCIE_CORE_CMD_STATUS_REG				0x4
-#define     PCIE_CORE_CMD_IO_ACCESS_EN				BIT(0)
-#define     PCIE_CORE_CMD_MEM_ACCESS_EN				BIT(1)
-#define     PCIE_CORE_CMD_MEM_IO_REQ_EN				BIT(2)
 #define PCIE_CORE_DEV_REV_REG					0x8
 #define PCIE_CORE_PCIEXP_CAP					0xc0
 #define PCIE_CORE_ERR_CAPCTL_REG				0x118
@@ -563,6 +560,11 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 	reg = (PCI_VENDOR_ID_MARVELL << 16) | PCI_VENDOR_ID_MARVELL;
 	advk_writel(pcie, reg, VENDOR_ID_REG);
 
+	/* Disable Root Bridge I/O space, memory space and bus mastering */
+	reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
+	reg &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+	advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG);
+
 	/* Set Advanced Error Capabilities and Control PF0 register */
 	reg = PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX |
 		PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX_EN |
@@ -660,19 +662,6 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 		advk_pcie_disable_ob_win(pcie, i);
 
 	advk_pcie_train_link(pcie);
-
-	/*
-	 * FIXME: The following register update is suspicious. This register is
-	 * applicable only when the PCI controller is configured for Endpoint
-	 * mode, not as a Root Complex. But apparently when this code is
-	 * removed, some cards stop working. This should be investigated and
-	 * a comment explaining this should be put here.
-	 */
-	reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
-	reg |= PCIE_CORE_CMD_MEM_ACCESS_EN |
-		PCIE_CORE_CMD_IO_ACCESS_EN |
-		PCIE_CORE_CMD_MEM_IO_REQ_EN;
-	advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG);
 }
 
 static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u32 *val)
@@ -793,6 +782,37 @@ static int advk_pcie_wait_pio(struct advk_pcie *pcie)
 	return -ETIMEDOUT;
 }
 
+static pci_bridge_emul_read_status_t
+advk_pci_bridge_emul_base_conf_read(struct pci_bridge_emul *bridge,
+				    int reg, u32 *value)
+{
+	struct advk_pcie *pcie = bridge->data;
+
+	switch (reg) {
+	case PCI_COMMAND:
+		*value = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
+		return PCI_BRIDGE_EMUL_HANDLED;
+
+	default:
+		return PCI_BRIDGE_EMUL_NOT_HANDLED;
+	}
+}
+
+static void
+advk_pci_bridge_emul_base_conf_write(struct pci_bridge_emul *bridge,
+				     int reg, u32 old, u32 new, u32 mask)
+{
+	struct advk_pcie *pcie = bridge->data;
+
+	switch (reg) {
+	case PCI_COMMAND:
+		advk_writel(pcie, new, PCIE_CORE_CMD_STATUS_REG);
+		break;
+
+	default:
+		break;
+	}
+}
 
 static pci_bridge_emul_read_status_t
 advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
@@ -893,6 +913,8 @@ advk_pci_bridge_emul_pcie_conf_write(struct pci_bridge_emul *bridge,
 }
 
 static struct pci_bridge_emul_ops advk_pci_bridge_emul_ops = {
+	.read_base = advk_pci_bridge_emul_base_conf_read,
+	.write_base = advk_pci_bridge_emul_base_conf_write,
 	.read_pcie = advk_pci_bridge_emul_pcie_conf_read,
 	.write_pcie = advk_pci_bridge_emul_pcie_conf_write,
 };

From bd5d982822cf2b14c2d6aff5a43a5f667c56c758 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 28 Oct 2021 20:56:58 +0200
Subject: [PATCH 1299/1750] PCI: aardvark: Fix support for
 PCI_BRIDGE_CTL_BUS_RESET on emulated bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit bc4fac42e5f8460af09c0a7f2f1915be09e20c71 upstream.

Aardvark supports PCIe Hot Reset via PCIE_CORE_CTRL1_REG.

Use it for implementing PCI_BRIDGE_CTL_BUS_RESET bit of PCI_BRIDGE_CONTROL
register on emulated bridge.

With this, the function pci_reset_secondary_bus() starts working and can
reset connected PCIe card. Custom userspace script [1] which uses setpci
can trigger PCIe Hot Reset and reset the card manually.

[1] https://alexforencich.com/wiki/en/pcie/hot-reset-linux

Link: https://lore.kernel.org/r/20211028185659.20329-7-kabel@kernel.org
Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index eec9bb7c7a80..0a2d89425740 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -793,6 +793,22 @@ advk_pci_bridge_emul_base_conf_read(struct pci_bridge_emul *bridge,
 		*value = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
 		return PCI_BRIDGE_EMUL_HANDLED;
 
+	case PCI_INTERRUPT_LINE: {
+		/*
+		 * From the whole 32bit register we support reading from HW only
+		 * one bit: PCI_BRIDGE_CTL_BUS_RESET.
+		 * Other bits are retrieved only from emulated config buffer.
+		 */
+		__le32 *cfgspace = (__le32 *)&bridge->conf;
+		u32 val = le32_to_cpu(cfgspace[PCI_INTERRUPT_LINE / 4]);
+		if (advk_readl(pcie, PCIE_CORE_CTRL1_REG) & HOT_RESET_GEN)
+			val |= PCI_BRIDGE_CTL_BUS_RESET << 16;
+		else
+			val &= ~(PCI_BRIDGE_CTL_BUS_RESET << 16);
+		*value = val;
+		return PCI_BRIDGE_EMUL_HANDLED;
+	}
+
 	default:
 		return PCI_BRIDGE_EMUL_NOT_HANDLED;
 	}
@@ -809,6 +825,17 @@ advk_pci_bridge_emul_base_conf_write(struct pci_bridge_emul *bridge,
 		advk_writel(pcie, new, PCIE_CORE_CMD_STATUS_REG);
 		break;
 
+	case PCI_INTERRUPT_LINE:
+		if (mask & (PCI_BRIDGE_CTL_BUS_RESET << 16)) {
+			u32 val = advk_readl(pcie, PCIE_CORE_CTRL1_REG);
+			if (new & (PCI_BRIDGE_CTL_BUS_RESET << 16))
+				val |= HOT_RESET_GEN;
+			else
+				val &= ~HOT_RESET_GEN;
+			advk_writel(pcie, val, PCIE_CORE_CTRL1_REG);
+		}
+		break;
+
 	default:
 		break;
 	}

From e2e8961fbc3aaf164ed4bff922e327de11ba312e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 28 Oct 2021 20:56:57 +0200
Subject: [PATCH 1300/1750] PCI: aardvark: Set PCI Bridge Class Code to PCI
 Bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 84e1b4045dc887b78bdc87d92927093dc3a465aa upstream.

Aardvark controller has something like config space of a Root Port
available at offset 0x0 of internal registers - these registers are used
for implementation of the emulated bridge.

The default value of Class Code of this bridge corresponds to a RAID Mass
storage controller, though. (This is probably intended for when the
controller is used as Endpoint.)

Change the Class Code to correspond to a PCI Bridge.

Add comment explaining this change.

Link: https://lore.kernel.org/r/20211028185659.20329-6-kabel@kernel.org
Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 0a2d89425740..64799e92c946 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -560,6 +560,26 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 	reg = (PCI_VENDOR_ID_MARVELL << 16) | PCI_VENDOR_ID_MARVELL;
 	advk_writel(pcie, reg, VENDOR_ID_REG);
 
+	/*
+	 * Change Class Code of PCI Bridge device to PCI Bridge (0x600400),
+	 * because the default value is Mass storage controller (0x010400).
+	 *
+	 * Note that this Aardvark PCI Bridge does not have compliant Type 1
+	 * Configuration Space and it even cannot be accessed via Aardvark's
+	 * PCI config space access method. Something like config space is
+	 * available in internal Aardvark registers starting at offset 0x0
+	 * and is reported as Type 0. In range 0x10 - 0x34 it has totally
+	 * different registers.
+	 *
+	 * Therefore driver uses emulation of PCI Bridge which emulates
+	 * access to configuration space via internal Aardvark registers or
+	 * emulated configuration buffer.
+	 */
+	reg = advk_readl(pcie, PCIE_CORE_DEV_REV_REG);
+	reg &= ~0xffffff00;
+	reg |= (PCI_CLASS_BRIDGE_PCI << 8) << 8;
+	advk_writel(pcie, reg, PCIE_CORE_DEV_REV_REG);
+
 	/* Disable Root Bridge I/O space, memory space and bus mastering */
 	reg = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
 	reg &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);

From bc1274df3ff418f46ffe98e452f6ff149951f53c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Thu, 28 Oct 2021 20:56:59 +0200
Subject: [PATCH 1301/1750] PCI: aardvark: Fix support for PCI_ROM_ADDRESS1 on
 emulated bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 239edf686c14a9ff926dec2f350289ed7adfefe2 upstream.

This register is exported at address offset 0x30.

Link: https://lore.kernel.org/r/20211028185659.20329-8-kabel@kernel.org
Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 64799e92c946..ec7bafbe813f 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -31,6 +31,7 @@
 #define PCIE_CORE_DEV_ID_REG					0x0
 #define PCIE_CORE_CMD_STATUS_REG				0x4
 #define PCIE_CORE_DEV_REV_REG					0x8
+#define PCIE_CORE_EXP_ROM_BAR_REG				0x30
 #define PCIE_CORE_PCIEXP_CAP					0xc0
 #define PCIE_CORE_ERR_CAPCTL_REG				0x118
 #define     PCIE_CORE_ERR_CAPCTL_ECRC_CHK_TX			BIT(5)
@@ -813,6 +814,10 @@ advk_pci_bridge_emul_base_conf_read(struct pci_bridge_emul *bridge,
 		*value = advk_readl(pcie, PCIE_CORE_CMD_STATUS_REG);
 		return PCI_BRIDGE_EMUL_HANDLED;
 
+	case PCI_ROM_ADDRESS1:
+		*value = advk_readl(pcie, PCIE_CORE_EXP_ROM_BAR_REG);
+		return PCI_BRIDGE_EMUL_HANDLED;
+
 	case PCI_INTERRUPT_LINE: {
 		/*
 		 * From the whole 32bit register we support reading from HW only
@@ -845,6 +850,10 @@ advk_pci_bridge_emul_base_conf_write(struct pci_bridge_emul *bridge,
 		advk_writel(pcie, new, PCIE_CORE_CMD_STATUS_REG);
 		break;
 
+	case PCI_ROM_ADDRESS1:
+		advk_writel(pcie, new, PCIE_CORE_EXP_ROM_BAR_REG);
+		break;
+
 	case PCI_INTERRUPT_LINE:
 		if (mask & (PCI_BRIDGE_CTL_BUS_RESET << 16)) {
 			u32 val = advk_readl(pcie, PCIE_CORE_CTRL1_REG);

From ceeb0a8a8716a1c72af3fa4d4f98c3aced32b037 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Fri, 8 Oct 2021 17:38:20 +0800
Subject: [PATCH 1302/1750] quota: check block number when reading the block in
 quota file

commit 9bf3d20331295b1ecb81f4ed9ef358c51699a050 upstream.

The block number in the quota tree on disk should be smaller than the
v2_disk_dqinfo.dqi_blocks. If the quota file was corrupted, we may be
allocating an 'allocated' block and that would lead to a loop in a tree,
which will probably trigger oops later. This patch adds a check for the
block number in the quota tree to prevent such potential issue.

Link: https://lore.kernel.org/r/20211008093821.1001186-2-yi.zhang@huawei.com
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Cc: stable@kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/quota/quota_tree.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c
index c5562c871c8b..c459ac0cb2c7 100644
--- a/fs/quota/quota_tree.c
+++ b/fs/quota/quota_tree.c
@@ -488,6 +488,13 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot,
 		goto out_buf;
 	}
 	newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
+	if (newblk < QT_TREEOFF || newblk >= info->dqi_blocks) {
+		quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
+			    newblk, info->dqi_blocks);
+		ret = -EUCLEAN;
+		goto out_buf;
+	}
+
 	if (depth == info->dqi_qtree_depth - 1) {
 		ret = free_dqentry(info, dquot, newblk);
 		newblk = 0;
@@ -587,6 +594,13 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info,
 	blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]);
 	if (!blk)	/* No reference? */
 		goto out_buf;
+	if (blk < QT_TREEOFF || blk >= info->dqi_blocks) {
+		quota_error(dquot->dq_sb, "Getting block too big (%u >= %u)",
+			    blk, info->dqi_blocks);
+		ret = -EUCLEAN;
+		goto out_buf;
+	}
+
 	if (depth < info->dqi_qtree_depth - 1)
 		ret = find_tree_dqentry(info, dquot, blk, depth+1);
 	else

From 6bc8317b8cd5b2f8860f0923bab8085a6b4cb318 Mon Sep 17 00:00:00 2001
From: Zhang Yi <yi.zhang@huawei.com>
Date: Fri, 8 Oct 2021 17:38:21 +0800
Subject: [PATCH 1303/1750] quota: correct error number in free_dqentry()

commit d0e36a62bd4c60c09acc40e06ba4831a4d0bc75b upstream.

Fix the error path in free_dqentry(), pass out the error number if the
block to free is not correct.

Fixes: 1ccd14b9c271 ("quota: Split off quota tree handling into a separate file")
Link: https://lore.kernel.org/r/20211008093821.1001186-3-yi.zhang@huawei.com
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Cc: stable@kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/quota/quota_tree.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c
index c459ac0cb2c7..1a188fbdf34e 100644
--- a/fs/quota/quota_tree.c
+++ b/fs/quota/quota_tree.c
@@ -423,6 +423,7 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot,
 		quota_error(dquot->dq_sb, "Quota structure has offset to "
 			"other block (%u) than it should (%u)", blk,
 			(uint)(dquot->dq_off >> info->dqi_blocksize_bits));
+		ret = -EIO;
 		goto out_buf;
 	}
 	ret = read_blk(info, blk, buf);

From 46709163a54aa02e314aa8e1db41a3053763af17 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Fri, 22 Oct 2021 09:43:23 +0800
Subject: [PATCH 1304/1750] pinctrl: core: fix possible memory leak in
 pinctrl_enable()

commit c7892ae13e461ed20154321eb792e07ebe38f5b3 upstream.

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff888020a7a680 (size 64):
  comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s)
  hex dump (first 32 bytes):
    00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff  .H........V.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360
    [<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70
    [<0000000064346707>] pinctrl_register+0x27/0x80
    [<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0
    [<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08]
    [<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c]

If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin()
need be freed.

Cc: stable@vger.kernel.org
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 950b0d91dc10 ("pinctrl: core: Fix regression caused by delayed work for hogs")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211022014323.1156924-1-yangyingliang@huawei.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pinctrl/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 6e6825d17a1d..840000870d5a 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -2077,6 +2077,8 @@ int pinctrl_enable(struct pinctrl_dev *pctldev)
 	if (error) {
 		dev_err(pctldev->dev, "could not claim hogs: %i\n",
 			error);
+		pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
+				      pctldev->desc->npins);
 		mutex_destroy(&pctldev->mutex);
 		kfree(pctldev);
 

From a4e7a8c4321faa4e64868f4d79a29fa0f1c805d7 Mon Sep 17 00:00:00 2001
From: Tao Zhang <quic_taozha@quicinc.com>
Date: Thu, 19 Aug 2021 17:29:37 +0800
Subject: [PATCH 1305/1750] coresight: cti: Correct the parameter for
 pm_runtime_put

commit 692c9a499b286ea478f41b23a91fe3873b9e1326 upstream.

The input parameter of the function pm_runtime_put should be the
same in the function cti_enable_hw and cti_disable_hw. The correct
parameter to use here should be dev->parent.

Signed-off-by: Tao Zhang <quic_taozha@quicinc.com>
Reviewed-by: Leo Yan <leo.yan@linaro.org>
Fixes: 835d722ba10a ("coresight: cti: Initial CoreSight CTI Driver")
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1629365377-5937-1-git-send-email-quic_taozha@quicinc.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/coresight/coresight-cti-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c
index 61dbc1afd8da..7ea93598f0ee 100644
--- a/drivers/hwtracing/coresight/coresight-cti-core.c
+++ b/drivers/hwtracing/coresight/coresight-cti-core.c
@@ -174,7 +174,7 @@ static int cti_disable_hw(struct cti_drvdata *drvdata)
 	coresight_disclaim_device_unlocked(drvdata->base);
 	CS_LOCK(drvdata->base);
 	spin_unlock(&drvdata->spinlock);
-	pm_runtime_put(dev);
+	pm_runtime_put(dev->parent);
 	return 0;
 
 	/* not disabled this call */

From 638462060859244823a572bd0e35e3a45d2978d5 Mon Sep 17 00:00:00 2001
From: Pekka Korpinen <pekka.korpinen@iki.fi>
Date: Wed, 29 Sep 2021 21:57:55 +0300
Subject: [PATCH 1306/1750] iio: dac: ad5446: Fix ad5622_write() return value

commit 558df982d4ead9cac628153d0d7b60feae05ddc8 upstream.

On success i2c_master_send() returns the number of bytes written. The
call from iio_write_channel_info(), however, expects the return value to
be zero on success.

This bug causes incorrect consumption of the sysfs buffer in
iio_write_channel_info(). When writing more than two characters to
out_voltage0_raw, the ad5446 write handler is called multiple times
causing unexpected behavior.

Fixes: 3ec36a2cf0d5 ("iio:ad5446: Add support for I2C based DACs")
Signed-off-by: Pekka Korpinen <pekka.korpinen@iki.fi>
Link: https://lore.kernel.org/r/20210929185755.2384-1-pekka.korpinen@iki.fi
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/dac/ad5446.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c
index d87e21016863..e86886ca5ee4 100644
--- a/drivers/iio/dac/ad5446.c
+++ b/drivers/iio/dac/ad5446.c
@@ -531,8 +531,15 @@ static int ad5622_write(struct ad5446_state *st, unsigned val)
 {
 	struct i2c_client *client = to_i2c_client(st->dev);
 	__be16 data = cpu_to_be16(val);
+	int ret;
 
-	return i2c_master_send(client, (char *)&data, sizeof(data));
+	ret = i2c_master_send(client, (char *)&data, sizeof(data));
+	if (ret < 0)
+		return ret;
+	if (ret != sizeof(data))
+		return -EIO;
+
+	return 0;
 }
 
 /*

From ab4755ea9114760abd146751f4407af85c29c72c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
Date: Wed, 18 Aug 2021 10:05:25 +0200
Subject: [PATCH 1307/1750] iio: ad5770r: make devicetree property reading
 consistent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 26df977a909f818b7d346b3990735513e7e0bf93 upstream.

The bindings file for this driver is defining the property as 'reg' but
the driver was reading it with the 'num' name. The bindings actually had
the 'num' property when added in
commit ea52c21268e6 ("dt-bindings: iio: dac: Add docs for AD5770R DAC")
and then changed it to 'reg' in
commit 2cf3818f18b2 ("dt-bindings: iio: dac: AD5570R fix bindings errors").
However, both these commits landed in v5.7 so the assumption is
that either 'num' is not being used or if it is, the validations were not
done.

Anyways, if someone comes back yelling about this, we might just support
both of the properties in the future. Not ideal, but that's life...

Fixes: 2cf3818f18b2 ("dt-bindings: iio: dac: AD5570R fix bindings errors")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20210818080525.62790-1-nuno.sa@analog.com
Cc: Stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/iio/dac/ad5770r.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad5770r.c b/drivers/iio/dac/ad5770r.c
index 42decba1463c..56d8bd2dd92f 100644
--- a/drivers/iio/dac/ad5770r.c
+++ b/drivers/iio/dac/ad5770r.c
@@ -522,7 +522,7 @@ static int ad5770r_channel_config(struct ad5770r_state *st)
 		return -EINVAL;
 
 	device_for_each_child_node(&st->spi->dev, child) {
-		ret = fwnode_property_read_u32(child, "num", &num);
+		ret = fwnode_property_read_u32(child, "reg", &num);
 		if (ret)
 			goto err_child_out;
 		if (num >= AD5770R_MAX_CHANNELS) {

From 5f31af4e78b4d8f006bb7049138fbc7c9141ac7a Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Fri, 15 Oct 2021 16:55:43 +0800
Subject: [PATCH 1308/1750] USB: serial: keyspan: fix memleak on probe errors

commit 910c996335c37552ee30fcb837375b808bb4f33b upstream.

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff888258228440 (size 64):
  comm "kworker/7:2", pid 2005, jiffies 4294989509 (age 824.540s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
    [<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
    [<ffffffffa02ac0e4>] keyspan_port_probe+0xa4/0x5d0 [keyspan]
    [<ffffffffa0294c07>] usb_serial_device_probe+0x97/0x1d0 [usbserial]
    [<ffffffff82b50ca7>] really_probe+0x167/0x460
    [<ffffffff82b51099>] __driver_probe_device+0xf9/0x180
    [<ffffffff82b51173>] driver_probe_device+0x53/0x130
    [<ffffffff82b516f5>] __device_attach_driver+0x105/0x130
    [<ffffffff82b4cfe9>] bus_for_each_drv+0x129/0x190
    [<ffffffff82b50a69>] __device_attach+0x1c9/0x270
    [<ffffffff82b518d0>] device_initial_probe+0x20/0x30
    [<ffffffff82b4f062>] bus_probe_device+0x142/0x160
    [<ffffffff82b4a4e9>] device_add+0x829/0x1300
    [<ffffffffa0295fda>] usb_serial_probe.cold+0xc9b/0x14ac [usbserial]
    [<ffffffffa02266aa>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
    [<ffffffff82b50ca7>] really_probe+0x167/0x460

If keyspan_port_probe() fails to allocate memory for an out_buffer[i] or
in_buffer[i], the previously allocated memory for out_buffer or
in_buffer needs to be freed on the error handling path, otherwise a
memory leak will result.

Fixes: bad41a5bf177 ("USB: keyspan: fix port DMA-buffer allocations")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20211015085543.1203011-1-wanghai38@huawei.com
Cc: stable@vger.kernel.org      # 3.12
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/serial/keyspan.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index aa3dbce22cfb..451759f38b57 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -2910,22 +2910,22 @@ static int keyspan_port_probe(struct usb_serial_port *port)
 	for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) {
 		p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL);
 		if (!p_priv->in_buffer[i])
-			goto err_in_buffer;
+			goto err_free_in_buffer;
 	}
 
 	for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) {
 		p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL);
 		if (!p_priv->out_buffer[i])
-			goto err_out_buffer;
+			goto err_free_out_buffer;
 	}
 
 	p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL);
 	if (!p_priv->inack_buffer)
-		goto err_inack_buffer;
+		goto err_free_out_buffer;
 
 	p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL);
 	if (!p_priv->outcont_buffer)
-		goto err_outcont_buffer;
+		goto err_free_inack_buffer;
 
 	p_priv->device_details = d_details;
 
@@ -2971,15 +2971,14 @@ static int keyspan_port_probe(struct usb_serial_port *port)
 
 	return 0;
 
-err_outcont_buffer:
+err_free_inack_buffer:
 	kfree(p_priv->inack_buffer);
-err_inack_buffer:
+err_free_out_buffer:
 	for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i)
 		kfree(p_priv->out_buffer[i]);
-err_out_buffer:
+err_free_in_buffer:
 	for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i)
 		kfree(p_priv->in_buffer[i]);
-err_in_buffer:
 	kfree(p_priv);
 
 	return -ENOMEM;

From edc546625456da4cc1968086b5a76143fbb0c75d Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Fri, 15 Oct 2021 13:14:20 +0200
Subject: [PATCH 1309/1750] serial: 8250: fix racy uartclk update

commit 211cde4f5817dc88ef7f8f2fa286e57fbf14c8ee upstream.

Commit 868f3ee6e452 ("serial: 8250: Add 8250 port clock update method")
added a hack to support SoCs where the UART reference clock can
change behind the back of the driver but failed to add the proper
locking.

First, make sure to take a reference to the tty struct to avoid
dereferencing a NULL pointer if the clock change races with a hangup.

Second, the termios semaphore must be held during the update to prevent
a racing termios change.

Fixes: 868f3ee6e452 ("serial: 8250: Add 8250 port clock update method")
Fixes: c8dff3aa8241 ("serial: 8250: Skip uninitialized TTY port baud rate update")
Cc: stable@vger.kernel.org      # 5.9
Cc: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Tested-by: Serge Semin <fancer.lancer@gmail.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211015111422.1027-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/serial/8250/8250_port.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 5d40f1010fbf..110a19c5138e 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -2675,21 +2675,32 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port,
 void serial8250_update_uartclk(struct uart_port *port, unsigned int uartclk)
 {
 	struct uart_8250_port *up = up_to_u8250p(port);
+	struct tty_port *tport = &port->state->port;
 	unsigned int baud, quot, frac = 0;
 	struct ktermios *termios;
+	struct tty_struct *tty;
 	unsigned long flags;
 
-	mutex_lock(&port->state->port.mutex);
+	tty = tty_port_tty_get(tport);
+	if (!tty) {
+		mutex_lock(&tport->mutex);
+		port->uartclk = uartclk;
+		mutex_unlock(&tport->mutex);
+		return;
+	}
+
+	down_write(&tty->termios_rwsem);
+	mutex_lock(&tport->mutex);
 
 	if (port->uartclk == uartclk)
 		goto out_lock;
 
 	port->uartclk = uartclk;
 
-	if (!tty_port_initialized(&port->state->port))
+	if (!tty_port_initialized(tport))
 		goto out_lock;
 
-	termios = &port->state->port.tty->termios;
+	termios = &tty->termios;
 
 	baud = serial8250_get_baud_rate(port, termios, NULL);
 	quot = serial8250_get_divisor(port, baud, &frac);
@@ -2706,7 +2717,9 @@ void serial8250_update_uartclk(struct uart_port *port, unsigned int uartclk)
 	serial8250_rpm_put(up);
 
 out_lock:
-	mutex_unlock(&port->state->port.mutex);
+	mutex_unlock(&tport->mutex);
+	up_write(&tty->termios_rwsem);
+	tty_kref_put(tty);
 }
 EXPORT_SYMBOL_GPL(serial8250_update_uartclk);
 

From 0e71591e916ba1c2d183c72c8eda7a2be990b599 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 13:58:11 +0200
Subject: [PATCH 1310/1750] most: fix control-message timeouts

commit 63b3e810eff65fb8587fcb26fa0b56802be12dcf upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Use the common control-message timeout defines for the five-second
timeouts.

Fixes: 97a6f772f36b ("drivers: most: add USB adapter driver")
Cc: stable@vger.kernel.org      # 5.9
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025115811.5410-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/most/most_usb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/most/most_usb.c b/drivers/most/most_usb.c
index 2640c5b326a4..acabb7715b42 100644
--- a/drivers/most/most_usb.c
+++ b/drivers/most/most_usb.c
@@ -149,7 +149,8 @@ static inline int drci_rd_reg(struct usb_device *dev, u16 reg, u16 *buf)
 	retval = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
 				 DRCI_READ_REQ, req_type,
 				 0x0000,
-				 reg, dma_buf, sizeof(*dma_buf), 5 * HZ);
+				 reg, dma_buf, sizeof(*dma_buf),
+				 USB_CTRL_GET_TIMEOUT);
 	*buf = le16_to_cpu(*dma_buf);
 	kfree(dma_buf);
 
@@ -176,7 +177,7 @@ static inline int drci_wr_reg(struct usb_device *dev, u16 reg, u16 data)
 			       reg,
 			       NULL,
 			       0,
-			       5 * HZ);
+			       USB_CTRL_SET_TIMEOUT);
 }
 
 static inline int start_sync_ep(struct usb_device *usb_dev, u16 ep)

From 6edf4cffe1b46e2b1f07659132224706d01cf6de Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Mon, 25 Oct 2021 13:51:59 +0200
Subject: [PATCH 1311/1750] USB: iowarrior: fix control-message timeouts

commit 79a4479a17b83310deb0b1a2a274fe5be12d2318 upstream.

USB control-message timeouts are specified in milliseconds and should
specifically not vary with CONFIG_HZ.

Use the common control-message timeout define for the five-second
timeout and drop the driver-specific one.

Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Cc: stable@vger.kernel.org      # 2.6.21
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211025115159.4954-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/misc/iowarrior.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 70ec29681526..72a06af25081 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -99,10 +99,6 @@ struct iowarrior {
 /*    globals   */
 /*--------------*/
 
-/*
- *  USB spec identifies 5 second timeouts.
- */
-#define GET_TIMEOUT 5
 #define USB_REQ_GET_REPORT  0x01
 //#if 0
 static int usb_get_report(struct usb_device *dev,
@@ -114,7 +110,7 @@ static int usb_get_report(struct usb_device *dev,
 			       USB_DIR_IN | USB_TYPE_CLASS |
 			       USB_RECIP_INTERFACE, (type << 8) + id,
 			       inter->desc.bInterfaceNumber, buf, size,
-			       GET_TIMEOUT*HZ);
+			       USB_CTRL_GET_TIMEOUT);
 }
 //#endif
 
@@ -129,7 +125,7 @@ static int usb_set_report(struct usb_interface *intf, unsigned char type,
 			       USB_TYPE_CLASS | USB_RECIP_INTERFACE,
 			       (type << 8) + id,
 			       intf->cur_altsetting->desc.bInterfaceNumber, buf,
-			       size, HZ);
+			       size, 1000);
 }
 
 /*---------------------*/

From 898622adb7e9232b01482a24146b6c3492e3a919 Mon Sep 17 00:00:00 2001
From: Johan Hovold <johan@kernel.org>
Date: Thu, 21 Oct 2021 10:34:47 +0200
Subject: [PATCH 1312/1750] USB: chipidea: fix interrupt deadlock

commit 9aaa81c3366e8393a62374e3a1c67c69edc07b8a upstream.

Chipidea core was calling the interrupt handler from non-IRQ context
with interrupts enabled, something which can lead to a deadlock if
there's an actual interrupt trying to take a lock that's already held
(e.g. the controller lock in udc_irq()).

Add a wrapper that can be used to fake interrupts instead of calling the
handler directly.

Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect")
Fixes: 876d4e1e8298 ("usb: chipidea: core: add wakeup support for extcon")
Cc: Peter Chen <peter.chen@kernel.org>
Cc: stable@vger.kernel.org      # 4.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211021083447.20078-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/chipidea/core.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index aa40e510b806..127b1a62b1bf 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -509,7 +509,7 @@ int hw_device_reset(struct ci_hdrc *ci)
 	return 0;
 }
 
-static irqreturn_t ci_irq(int irq, void *data)
+static irqreturn_t ci_irq_handler(int irq, void *data)
 {
 	struct ci_hdrc *ci = data;
 	irqreturn_t ret = IRQ_NONE;
@@ -562,6 +562,15 @@ static irqreturn_t ci_irq(int irq, void *data)
 	return ret;
 }
 
+static void ci_irq(struct ci_hdrc *ci)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	ci_irq_handler(ci->irq, ci);
+	local_irq_restore(flags);
+}
+
 static int ci_cable_notifier(struct notifier_block *nb, unsigned long event,
 			     void *ptr)
 {
@@ -571,7 +580,7 @@ static int ci_cable_notifier(struct notifier_block *nb, unsigned long event,
 	cbl->connected = event;
 	cbl->changed = true;
 
-	ci_irq(ci->irq, ci);
+	ci_irq(ci);
 	return NOTIFY_DONE;
 }
 
@@ -612,7 +621,7 @@ static int ci_usb_role_switch_set(struct usb_role_switch *sw,
 	if (cable) {
 		cable->changed = true;
 		cable->connected = false;
-		ci_irq(ci->irq, ci);
+		ci_irq(ci);
 		spin_unlock_irqrestore(&ci->lock, flags);
 		if (ci->wq && role != USB_ROLE_NONE)
 			flush_workqueue(ci->wq);
@@ -630,7 +639,7 @@ static int ci_usb_role_switch_set(struct usb_role_switch *sw,
 	if (cable) {
 		cable->changed = true;
 		cable->connected = true;
-		ci_irq(ci->irq, ci);
+		ci_irq(ci);
 	}
 	spin_unlock_irqrestore(&ci->lock, flags);
 	pm_runtime_put_sync(ci->dev);
@@ -1166,7 +1175,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
 		}
 	}
 
-	ret = devm_request_irq(dev, ci->irq, ci_irq, IRQF_SHARED,
+	ret = devm_request_irq(dev, ci->irq, ci_irq_handler, IRQF_SHARED,
 			ci->platdata->name, ci);
 	if (ret)
 		goto stop;
@@ -1287,11 +1296,11 @@ static void ci_extcon_wakeup_int(struct ci_hdrc *ci)
 
 	if (!IS_ERR(cable_id->edev) && ci->is_otg &&
 		(otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
-		ci_irq(ci->irq, ci);
+		ci_irq(ci);
 
 	if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
 		(otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
-		ci_irq(ci->irq, ci);
+		ci_irq(ci);
 }
 
 static int ci_controller_resume(struct device *dev)

From 890e4edcecfa2380ec8507a260f4c8eb7da218b9 Mon Sep 17 00:00:00 2001
From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Date: Tue, 14 Sep 2021 14:18:05 +0200
Subject: [PATCH 1313/1750] power: supply: max17042_battery: Clear status bits
 in interrupt handler

commit 0cf48167b87e388fa1268c9fe6d2443ae7f43d8a upstream.

The gauge requires us to clear the status bits manually for some alerts
to be properly dismissed. Previously the IRQ was configured to react only
on falling edge, which wasn't technically correct (the ALRT line is active
low), but it had a happy side-effect of preventing interrupt storms
on uncleared alerts from happening.

Fixes: 7fbf6b731bca ("power: supply: max17042: Do not enforce (incorrect) interrupt trigger type")
Cc: <stable@vger.kernel.org>
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/power/supply/max17042_battery.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
index 98b2e369f80e..76b0f45a20b4 100644
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -875,6 +875,10 @@ static irqreturn_t max17042_thread_handler(int id, void *dev)
 		max17042_set_soc_threshold(chip, 1);
 	}
 
+	/* we implicitly handle all alerts via power_supply_changed */
+	regmap_clear_bits(chip->regmap, MAX17042_STATUS,
+			  0xFFFF & ~(STATUS_POR_BIT | STATUS_BST_BIT));
+
 	power_supply_changed(chip->battery);
 	return IRQ_HANDLED;
 }

From 6758d6651627323ec95d5e4cccf31f4760dcfba1 Mon Sep 17 00:00:00 2001
From: Charan Teja Reddy <charante@codeaurora.org>
Date: Fri, 23 Jul 2021 18:01:08 +0530
Subject: [PATCH 1314/1750] dma-buf: WARN on dmabuf release with pending
 attachments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f492283b157053e9555787262f058ae33096f568 ]

It is expected from the clients to follow the below steps on an imported
dmabuf fd:
a) dmabuf = dma_buf_get(fd) // Get the dmabuf from fd
b) dma_buf_attach(dmabuf); // Clients attach to the dmabuf
   o Here the kernel does some slab allocations, say for
dma_buf_attachment and may be some other slab allocation in the
dmabuf->ops->attach().
c) Client may need to do dma_buf_map_attachment().
d) Accordingly dma_buf_unmap_attachment() should be called.
e) dma_buf_detach () // Clients detach to the dmabuf.
   o Here the slab allocations made in b) are freed.
f) dma_buf_put(dmabuf) // Can free the dmabuf if it is the last
reference.

Now say an erroneous client failed at step c) above thus it directly
called dma_buf_put(), step f) above. Considering that it may be the last
reference to the dmabuf, buffer will be freed with pending attachments
left to the dmabuf which can show up as the 'memory leak'. This should
at least be reported as the WARN().

Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/1627043468-16381-1-git-send-email-charante@codeaurora.org
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma-buf/dma-buf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 922416b3aace..93e9bf738259 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -79,6 +79,7 @@ static void dma_buf_release(struct dentry *dentry)
 	if (dmabuf->resv == (struct dma_resv *)&dmabuf[1])
 		dma_resv_fini(dmabuf->resv);
 
+	WARN_ON(!list_empty(&dmabuf->attachments));
 	module_put(dmabuf->owner);
 	kfree(dmabuf->name);
 	kfree(dmabuf);

From 780fff2c75f096f3bc46855b105b83b4cec5cba7 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 30 May 2021 13:04:25 +0200
Subject: [PATCH 1315/1750] drm: panel-orientation-quirks: Update the Lenovo
 Ideapad D330 quirk (v2)

[ Upstream commit 820a2ab23d5eab4ccfb82581eda8ad4acf18458f ]

2 improvements to the Lenovo Ideapad D330 panel-orientation quirks:

1. Some versions of the Lenovo Ideapad D330 have a DMI_PRODUCT_NAME of
"81H3" and others have "81MD". Testing has shown that the "81MD" also has
a 90 degree mounted panel. Drop the DMI_PRODUCT_NAME from the existing
quirk so that the existing quirk matches both variants.

2. Some of the Lenovo Ideapad D330 models have a HD (800x1280) screen
instead of a FHD (1200x1920) screen (both are mounted right-side-up) add
a second Lenovo Ideapad D330 quirk for the HD version.

Changes in v2:
- Add a new quirk for Lenovo Ideapad D330 models with a HD screen instead
  of a FHD screen

Link: https://github.com/systemd/systemd/pull/18884
Acked-by: Simon Ser <contact@emersion.fr>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210530110428.12994-2-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panel_orientation_quirks.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index e1b2ce4921ae..5d0942e3985b 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -223,10 +223,15 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"),
 		},
 		.driver_data = (void *)&lcd800x1280_rightside_up,
-	}, {	/* Lenovo Ideapad D330 */
+	}, {	/* Lenovo Ideapad D330-10IGM (HD) */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
+	}, {	/* Lenovo Ideapad D330-10IGM (FHD) */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "81H3"),
 		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"),
 		},
 		.driver_data = (void *)&lcd1200x1920_rightside_up,

From 62b90d7eeb6deb0124dcfe1b12f41c1524d26352 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 30 May 2021 13:04:26 +0200
Subject: [PATCH 1316/1750] drm: panel-orientation-quirks: Add quirk for KD
 Kurio Smart C15200 2-in-1

[ Upstream commit a53f1dd3ab9fec715c6c2e8e01bf4d3c07eef8e5 ]

The KD Kurio Smart C15200 2-in-1 uses  a panel which has been mounted 90
degrees rotated. Add a quirk for this.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/20210530110428.12994-3-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panel_orientation_quirks.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 5d0942e3985b..cf4db2cdebbb 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -205,6 +205,13 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_BOARD_NAME, "TW891"),
 		},
 		.driver_data = (void *)&itworks_tw891,
+	}, {	/* KD Kurio Smart C15200 2-in-1 */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "KD Interactive"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Kurio Smart"),
+		  DMI_EXACT_MATCH(DMI_BOARD_NAME, "KDM960BCP"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
 	}, {	/*
 		 * Lenovo Ideapad Miix 310 laptop, only some production batches
 		 * have a portrait screen, the resolution checks makes the quirk

From 509ae4a4f0745bff108723e5d9a61b1113ea89fe Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 30 May 2021 13:04:27 +0200
Subject: [PATCH 1317/1750] drm: panel-orientation-quirks: Add quirk for the
 Samsung Galaxy Book 10.6

[ Upstream commit 88fa1fde918951c175ae5ea0f31efc4bb1736ab9 ]

The Samsung Galaxy Book 10.6 uses a panel which has been mounted
90 degrees rotated. Add a quirk for this.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/20210530110428.12994-4-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index cf4db2cdebbb..926094b83e2f 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -109,6 +109,12 @@ static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = {
 	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
 };
 
+static const struct drm_dmi_panel_orientation_data lcd1280x1920_rightside_up = {
+	.width = 1280,
+	.height = 1920,
+	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+};
+
 static const struct dmi_system_id orientation_data[] = {
 	{	/* Acer One 10 (S1003) */
 		.matches = {
@@ -249,6 +255,12 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Default string"),
 		},
 		.driver_data = (void *)&onegx1_pro,
+	}, {	/* Samsung GalaxyBook 10.6 */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Galaxy Book 10.6"),
+		},
+		.driver_data = (void *)&lcd1280x1920_rightside_up,
 	}, {	/* VIOS LTH17 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VIOS"),

From 4dfba42604f08a505f1a1efc69ec5207ea6243de Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Sat, 28 Aug 2021 18:18:18 +0200
Subject: [PATCH 1318/1750] Bluetooth: sco: Fix lock_sock() blockage by
 memcpy_from_msg()

[ Upstream commit 99c23da0eed4fd20cae8243f2b51e10e66aa0951 ]

The sco_send_frame() also takes lock_sock() during memcpy_from_msg()
call that may be endlessly blocked by a task with userfaultd
technique, and this will result in a hung task watchdog trigger.

Just like the similar fix for hci_sock_sendmsg() in commit
92c685dc5de0 ("Bluetooth: reorganize functions..."), this patch moves
the  memcpy_from_msg() out of lock_sock() for addressing the hang.

This should be the last piece for fixing CVE-2021-3640 after a few
already queued fixes.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/sco.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 7c24a9acbc45..93df269a6470 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -281,7 +281,8 @@ static int sco_connect(struct hci_dev *hdev, struct sock *sk)
 	return err;
 }
 
-static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
+static int sco_send_frame(struct sock *sk, void *buf, int len,
+			  unsigned int msg_flags)
 {
 	struct sco_conn *conn = sco_pi(sk)->conn;
 	struct sk_buff *skb;
@@ -293,15 +294,11 @@ static int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
 
 	BT_DBG("sk %p len %d", sk, len);
 
-	skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
+	skb = bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err);
 	if (!skb)
 		return err;
 
-	if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
-		kfree_skb(skb);
-		return -EFAULT;
-	}
-
+	memcpy(skb_put(skb, len), buf, len);
 	hci_send_sco(conn->hcon, skb);
 
 	return len;
@@ -726,6 +723,7 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 			    size_t len)
 {
 	struct sock *sk = sock->sk;
+	void *buf;
 	int err;
 
 	BT_DBG("sock %p, sk %p", sock, sk);
@@ -737,14 +735,24 @@ static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
 	if (msg->msg_flags & MSG_OOB)
 		return -EOPNOTSUPP;
 
+	buf = kmalloc(len, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+
+	if (memcpy_from_msg(buf, msg, len)) {
+		kfree(buf);
+		return -EFAULT;
+	}
+
 	lock_sock(sk);
 
 	if (sk->sk_state == BT_CONNECTED)
-		err = sco_send_frame(sk, msg, len);
+		err = sco_send_frame(sk, buf, len, msg->msg_flags);
 	else
 		err = -ENOTCONN;
 
 	release_sock(sk);
+	kfree(buf);
 	return err;
 }
 

From c10465f6d6208db2e45a6dac1db312b9589b2583 Mon Sep 17 00:00:00 2001
From: Wang ShaoBo <bobo.shaobowang@huawei.com>
Date: Tue, 31 Aug 2021 17:35:37 -0700
Subject: [PATCH 1319/1750] Bluetooth: fix use-after-free error in
 lock_sock_nested()

[ Upstream commit 1bff51ea59a9afb67d2dd78518ab0582a54a472c ]

use-after-free error in lock_sock_nested is reported:

[  179.140137][ T3731] =====================================================
[  179.142675][ T3731] BUG: KMSAN: use-after-free in lock_sock_nested+0x280/0x2c0
[  179.145494][ T3731] CPU: 4 PID: 3731 Comm: kworker/4:2 Not tainted 5.12.0-rc6+ #54
[  179.148432][ T3731] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[  179.151806][ T3731] Workqueue: events l2cap_chan_timeout
[  179.152730][ T3731] Call Trace:
[  179.153301][ T3731]  dump_stack+0x24c/0x2e0
[  179.154063][ T3731]  kmsan_report+0xfb/0x1e0
[  179.154855][ T3731]  __msan_warning+0x5c/0xa0
[  179.155579][ T3731]  lock_sock_nested+0x280/0x2c0
[  179.156436][ T3731]  ? kmsan_get_metadata+0x116/0x180
[  179.157257][ T3731]  l2cap_sock_teardown_cb+0xb8/0x890
[  179.158154][ T3731]  ? __msan_metadata_ptr_for_load_8+0x10/0x20
[  179.159141][ T3731]  ? kmsan_get_metadata+0x116/0x180
[  179.159994][ T3731]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  179.160959][ T3731]  ? l2cap_sock_recv_cb+0x420/0x420
[  179.161834][ T3731]  l2cap_chan_del+0x3e1/0x1d50
[  179.162608][ T3731]  ? kmsan_get_metadata+0x116/0x180
[  179.163435][ T3731]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[  179.164406][ T3731]  l2cap_chan_close+0xeea/0x1050
[  179.165189][ T3731]  ? kmsan_internal_unpoison_shadow+0x42/0x70
[  179.166180][ T3731]  l2cap_chan_timeout+0x1da/0x590
[  179.167066][ T3731]  ? __msan_metadata_ptr_for_load_8+0x10/0x20
[  179.168023][ T3731]  ? l2cap_chan_create+0x560/0x560
[  179.168818][ T3731]  process_one_work+0x121d/0x1ff0
[  179.169598][ T3731]  worker_thread+0x121b/0x2370
[  179.170346][ T3731]  kthread+0x4ef/0x610
[  179.171010][ T3731]  ? process_one_work+0x1ff0/0x1ff0
[  179.171828][ T3731]  ? kthread_blkcg+0x110/0x110
[  179.172587][ T3731]  ret_from_fork+0x1f/0x30
[  179.173348][ T3731]
[  179.173752][ T3731] Uninit was created at:
[  179.174409][ T3731]  kmsan_internal_poison_shadow+0x5c/0xf0
[  179.175373][ T3731]  kmsan_slab_free+0x76/0xc0
[  179.176060][ T3731]  kfree+0x3a5/0x1180
[  179.176664][ T3731]  __sk_destruct+0x8af/0xb80
[  179.177375][ T3731]  __sk_free+0x812/0x8c0
[  179.178032][ T3731]  sk_free+0x97/0x130
[  179.178686][ T3731]  l2cap_sock_release+0x3d5/0x4d0
[  179.179457][ T3731]  sock_close+0x150/0x450
[  179.180117][ T3731]  __fput+0x6bd/0xf00
[  179.180787][ T3731]  ____fput+0x37/0x40
[  179.181481][ T3731]  task_work_run+0x140/0x280
[  179.182219][ T3731]  do_exit+0xe51/0x3e60
[  179.182930][ T3731]  do_group_exit+0x20e/0x450
[  179.183656][ T3731]  get_signal+0x2dfb/0x38f0
[  179.184344][ T3731]  arch_do_signal_or_restart+0xaa/0xe10
[  179.185266][ T3731]  exit_to_user_mode_prepare+0x2d2/0x560
[  179.186136][ T3731]  syscall_exit_to_user_mode+0x35/0x60
[  179.186984][ T3731]  do_syscall_64+0xc5/0x140
[  179.187681][ T3731]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  179.188604][ T3731] =====================================================

In our case, there are two Thread A and B:

Context: Thread A:              Context: Thread B:

l2cap_chan_timeout()            __se_sys_shutdown()
  l2cap_chan_close()              l2cap_sock_shutdown()
    l2cap_chan_del()                l2cap_chan_close()
      l2cap_sock_teardown_cb()        l2cap_sock_teardown_cb()

Once l2cap_sock_teardown_cb() excuted, this sock will be marked as SOCK_ZAPPED,
and can be treated as killable in l2cap_sock_kill() if sock_orphan() has
excuted, at this time we close sock through sock_close() which end to call
l2cap_sock_kill() like Thread C:

Context: Thread C:

sock_close()
  l2cap_sock_release()
    sock_orphan()
    l2cap_sock_kill()  #free sock if refcnt is 1

If C completed, Once A or B reaches l2cap_sock_teardown_cb() again,
use-after-free happened.

We should set chan->data to NULL if sock is destructed, for telling teardown
operation is not allowed in l2cap_sock_teardown_cb(), and also we should
avoid killing an already killed socket in l2cap_sock_close_cb().

Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/l2cap_sock.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c99d65ef13b1..160c016a5dfb 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1508,6 +1508,9 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan)
 {
 	struct sock *sk = chan->data;
 
+	if (!sk)
+		return;
+
 	l2cap_sock_kill(sk);
 }
 
@@ -1516,6 +1519,9 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
 	struct sock *sk = chan->data;
 	struct sock *parent;
 
+	if (!sk)
+		return;
+
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
 	/* This callback can be called both for server (BT_LISTEN)
@@ -1707,8 +1713,10 @@ static void l2cap_sock_destruct(struct sock *sk)
 {
 	BT_DBG("sk %p", sk);
 
-	if (l2cap_pi(sk)->chan)
+	if (l2cap_pi(sk)->chan) {
+		l2cap_pi(sk)->chan->data = NULL;
 		l2cap_chan_put(l2cap_pi(sk)->chan);
+	}
 
 	if (l2cap_pi(sk)->rx_busy_skb) {
 		kfree_skb(l2cap_pi(sk)->rx_busy_skb);

From 7987f31e54a2a453c54bdc516fe7a48035fddf03 Mon Sep 17 00:00:00 2001
From: Simon Ser <contact@emersion.fr>
Date: Sat, 11 Sep 2021 10:24:40 +0000
Subject: [PATCH 1320/1750] drm/panel-orientation-quirks: add Valve Steam Deck

[ Upstream commit 9eeb7b4e40bfd69d8aaa920c7e9df751c9e11dce ]

Valve's Steam Deck has a 800x1280 LCD screen.

Signed-off-by: Simon Ser <contact@emersion.fr>
Cc: Jared Baldridge <jrb@expunge.us>
Cc: Emil Velikov <emil.l.velikov@gmail.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Hans de Goede <hdegoede@redhat.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210911102430.253986-1-contact@emersion.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_panel_orientation_quirks.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 926094b83e2f..a950d5db211c 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -261,6 +261,13 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Galaxy Book 10.6"),
 		},
 		.driver_data = (void *)&lcd1280x1920_rightside_up,
+	}, {	/* Valve Steam Deck */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Valve"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Jupiter"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "1"),
+		},
+		.driver_data = (void *)&lcd800x1280_rightside_up,
 	}, {	/* VIOS LTH17 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VIOS"),

From 7f43cda650d5ca7cac9ced26bb2f3f64643ddb9d Mon Sep 17 00:00:00 2001
From: Scott Wood <swood@redhat.com>
Date: Fri, 20 Aug 2021 09:42:36 +0200
Subject: [PATCH 1321/1750] rcutorture: Avoid problematic critical section
 nesting on PREEMPT_RT

[ Upstream commit 71921a9606ddbcc1d98c00eca7ae82c373d1fecd ]

rcutorture is generating some nesting scenarios that are not compatible on PREEMPT_RT.
For example:
	preempt_disable();
	rcu_read_lock_bh();
	preempt_enable();
	rcu_read_unlock_bh();

The problem here is that on PREEMPT_RT the bottom halves have to be
disabled and enabled in preemptible context.

Reorder locking: start with BH locking and continue with then with
disabling preemption or interrupts. In the unlocking do it reverse by
first enabling interrupts and preemption and BH at the very end.
Ensure that on PREEMPT_RT BH locking remains unchanged if in
non-preemptible context.

Link: https://lkml.kernel.org/r/20190911165729.11178-6-swood@redhat.com
Link: https://lkml.kernel.org/r/20210819182035.GF4126399@paulmck-ThinkPad-P17-Gen-1
Signed-off-by: Scott Wood <swood@redhat.com>
[bigeasy: Drop ATOM_BH, make it only about changing BH in atomic
context. Allow enabling RCU in IRQ-off section. Reword commit message.]
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/rcutorture.c | 48 ++++++++++++++++++++++++++++++-----------
 1 file changed, 36 insertions(+), 12 deletions(-)

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 916ea4f66e4b..6c1aea48a79a 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -1238,28 +1238,34 @@ static void rcutorture_one_extend(int *readstate, int newstate,
 	/* First, put new protection in place to avoid critical-section gap. */
 	if (statesnew & RCUTORTURE_RDR_BH)
 		local_bh_disable();
+	if (statesnew & RCUTORTURE_RDR_RBH)
+		rcu_read_lock_bh();
 	if (statesnew & RCUTORTURE_RDR_IRQ)
 		local_irq_disable();
 	if (statesnew & RCUTORTURE_RDR_PREEMPT)
 		preempt_disable();
-	if (statesnew & RCUTORTURE_RDR_RBH)
-		rcu_read_lock_bh();
 	if (statesnew & RCUTORTURE_RDR_SCHED)
 		rcu_read_lock_sched();
 	if (statesnew & RCUTORTURE_RDR_RCU)
 		idxnew = cur_ops->readlock() << RCUTORTURE_RDR_SHIFT;
 
-	/* Next, remove old protection, irq first due to bh conflict. */
+	/*
+	 * Next, remove old protection, in decreasing order of strength
+	 * to avoid unlock paths that aren't safe in the stronger
+	 * context. Namely: BH can not be enabled with disabled interrupts.
+	 * Additionally PREEMPT_RT requires that BH is enabled in preemptible
+	 * context.
+	 */
 	if (statesold & RCUTORTURE_RDR_IRQ)
 		local_irq_enable();
-	if (statesold & RCUTORTURE_RDR_BH)
-		local_bh_enable();
 	if (statesold & RCUTORTURE_RDR_PREEMPT)
 		preempt_enable();
-	if (statesold & RCUTORTURE_RDR_RBH)
-		rcu_read_unlock_bh();
 	if (statesold & RCUTORTURE_RDR_SCHED)
 		rcu_read_unlock_sched();
+	if (statesold & RCUTORTURE_RDR_BH)
+		local_bh_enable();
+	if (statesold & RCUTORTURE_RDR_RBH)
+		rcu_read_unlock_bh();
 	if (statesold & RCUTORTURE_RDR_RCU) {
 		bool lockit = !statesnew && !(torture_random(trsp) & 0xffff);
 
@@ -1302,6 +1308,9 @@ rcutorture_extend_mask(int oldmask, struct torture_random_state *trsp)
 	int mask = rcutorture_extend_mask_max();
 	unsigned long randmask1 = torture_random(trsp) >> 8;
 	unsigned long randmask2 = randmask1 >> 3;
+	unsigned long preempts = RCUTORTURE_RDR_PREEMPT | RCUTORTURE_RDR_SCHED;
+	unsigned long preempts_irq = preempts | RCUTORTURE_RDR_IRQ;
+	unsigned long bhs = RCUTORTURE_RDR_BH | RCUTORTURE_RDR_RBH;
 
 	WARN_ON_ONCE(mask >> RCUTORTURE_RDR_SHIFT);
 	/* Mostly only one bit (need preemption!), sometimes lots of bits. */
@@ -1309,11 +1318,26 @@ rcutorture_extend_mask(int oldmask, struct torture_random_state *trsp)
 		mask = mask & randmask2;
 	else
 		mask = mask & (1 << (randmask2 % RCUTORTURE_RDR_NBITS));
-	/* Can't enable bh w/irq disabled. */
-	if ((mask & RCUTORTURE_RDR_IRQ) &&
-	    ((!(mask & RCUTORTURE_RDR_BH) && (oldmask & RCUTORTURE_RDR_BH)) ||
-	     (!(mask & RCUTORTURE_RDR_RBH) && (oldmask & RCUTORTURE_RDR_RBH))))
-		mask |= RCUTORTURE_RDR_BH | RCUTORTURE_RDR_RBH;
+
+	/*
+	 * Can't enable bh w/irq disabled.
+	 */
+	if (mask & RCUTORTURE_RDR_IRQ)
+		mask |= oldmask & bhs;
+
+	/*
+	 * Ideally these sequences would be detected in debug builds
+	 * (regardless of RT), but until then don't stop testing
+	 * them on non-RT.
+	 */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT)) {
+		/* Can't modify BH in atomic context */
+		if (oldmask & preempts_irq)
+			mask &= ~bhs;
+		if ((oldmask | mask) & preempts_irq)
+			mask |= oldmask & bhs;
+	}
+
 	return mask ?: RCUTORTURE_RDR_RCU;
 }
 

From 396e302cc835975d42c7c88750e406ef2e01536e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Barnab=C3=A1s=20P=C5=91cze?= <pobrn@protonmail.com>
Date: Sat, 4 Sep 2021 17:56:26 +0000
Subject: [PATCH 1322/1750] platform/x86: wmi: do not fail if disabling fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 1975718c488a39128f1f515b23ae61a5a214cc3d ]

Previously, `__query_block()` would fail if the
second WCxx method call failed. However, the
WQxx method might have succeeded, and potentially
allocated memory for the result. Instead of
throwing away the result and potentially
leaking memory, ignore the result of
the second WCxx call.

Signed-off-by: Barnabás Pőcze <pobrn@protonmail.com>
Link: https://lore.kernel.org/r/20210904175450.156801-25-pobrn@protonmail.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/wmi.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index d88f388a3450..1f80b2628162 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -354,7 +354,14 @@ static acpi_status __query_block(struct wmi_block *wblock, u8 instance,
 	 * the WQxx method failed - we should disable collection anyway.
 	 */
 	if ((block->flags & ACPI_WMI_EXPENSIVE) && ACPI_SUCCESS(wc_status)) {
-		status = acpi_execute_simple_method(handle, wc_method, 0);
+		/*
+		 * Ignore whether this WCxx call succeeds or not since
+		 * the previously executed WQxx method call might have
+		 * succeeded, and returning the failing status code
+		 * of this call would throw away the result of the WQxx
+		 * call, potentially leaking memory.
+		 */
+		acpi_execute_simple_method(handle, wc_method, 0);
 	}
 
 	return status;

From 5af57ce8a6155fe3e4270d28d171abf8903bebc0 Mon Sep 17 00:00:00 2001
From: Aleksander Jan Bajkowski <olek2@wp.pl>
Date: Tue, 14 Sep 2021 23:20:58 +0200
Subject: [PATCH 1323/1750] MIPS: lantiq: dma: add small delay after reset

[ Upstream commit c12aa581f6d5e80c3c3675ab26a52c2b3b62f76e ]

Reading the DMA registers immediately after the reset causes
Data Bus Error. Adding a small delay fixes this issue.

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/lantiq/xway/dma.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
index aeb1b989cd4e..24c6267f7869 100644
--- a/arch/mips/lantiq/xway/dma.c
+++ b/arch/mips/lantiq/xway/dma.c
@@ -11,6 +11,7 @@
 #include <linux/export.h>
 #include <linux/spinlock.h>
 #include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/err.h>
 
 #include <lantiq_soc.h>
@@ -221,6 +222,8 @@ ltq_dma_init(struct platform_device *pdev)
 	clk_enable(clk);
 	ltq_dma_w32_mask(0, DMA_RESET, LTQ_DMA_CTRL);
 
+	usleep_range(1, 10);
+
 	/* disable all interrupts */
 	ltq_dma_w32(0, LTQ_DMA_IRNEN);
 

From b92a5df2c7adc79a57481445f67de0c1c716581f Mon Sep 17 00:00:00 2001
From: Aleksander Jan Bajkowski <olek2@wp.pl>
Date: Tue, 14 Sep 2021 23:20:59 +0200
Subject: [PATCH 1324/1750] MIPS: lantiq: dma: reset correct number of channel

[ Upstream commit 5ca9ce2ba4d5884cd94d1a856c675ab1242cd242 ]

Different SoCs have a different number of channels, e.g .:
* amazon-se has 10 channels,
* danube+ar9 have 20 channels,
* vr9 has 28 channels,
* ar10 has 24 channels.

We can read the ID register and, depending on the reported
number of channels, reset the appropriate number of channels.

Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/lantiq/xway/dma.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
index 24c6267f7869..e45077aecf83 100644
--- a/arch/mips/lantiq/xway/dma.c
+++ b/arch/mips/lantiq/xway/dma.c
@@ -30,6 +30,7 @@
 #define LTQ_DMA_PCTRL		0x44
 #define LTQ_DMA_IRNEN		0xf4
 
+#define DMA_ID_CHNR		GENMASK(26, 20)	/* channel number */
 #define DMA_DESCPT		BIT(3)		/* descriptor complete irq */
 #define DMA_TX			BIT(8)		/* TX channel direction */
 #define DMA_CHAN_ON		BIT(0)		/* channel on / off bit */
@@ -40,7 +41,6 @@
 #define DMA_POLL		BIT(31)		/* turn on channel polling */
 #define DMA_CLK_DIV4		BIT(6)		/* polling clock divider */
 #define DMA_2W_BURST		BIT(1)		/* 2 word burst length */
-#define DMA_MAX_CHANNEL		20		/* the soc has 20 channels */
 #define DMA_ETOP_ENDIANNESS	(0xf << 8) /* endianness swap etop channels */
 #define DMA_WEIGHT	(BIT(17) | BIT(16))	/* default channel wheight */
 
@@ -206,7 +206,7 @@ ltq_dma_init(struct platform_device *pdev)
 {
 	struct clk *clk;
 	struct resource *res;
-	unsigned id;
+	unsigned int id, nchannels;
 	int i;
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -228,17 +228,18 @@ ltq_dma_init(struct platform_device *pdev)
 	ltq_dma_w32(0, LTQ_DMA_IRNEN);
 
 	/* reset/configure each channel */
-	for (i = 0; i < DMA_MAX_CHANNEL; i++) {
+	id = ltq_dma_r32(LTQ_DMA_ID);
+	nchannels = ((id & DMA_ID_CHNR) >> 20);
+	for (i = 0; i < nchannels; i++) {
 		ltq_dma_w32(i, LTQ_DMA_CS);
 		ltq_dma_w32(DMA_CHAN_RST, LTQ_DMA_CCTRL);
 		ltq_dma_w32(DMA_POLL | DMA_CLK_DIV4, LTQ_DMA_CPOLL);
 		ltq_dma_w32_mask(DMA_CHAN_ON, 0, LTQ_DMA_CCTRL);
 	}
 
-	id = ltq_dma_r32(LTQ_DMA_ID);
 	dev_info(&pdev->dev,
 		"Init done - hw rev: %X, ports: %d, channels: %d\n",
-		id & 0x1f, (id >> 16) & 0xf, id >> 20);
+		id & 0x1f, (id >> 16) & 0xf, nchannels);
 
 	return 0;
 }

From 28118dcc871e4b015c6537488374b1a4bbffb6d4 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Thu, 24 Jun 2021 11:41:10 +0200
Subject: [PATCH 1325/1750] locking/lockdep: Avoid RCU-induced noinstr fail

[ Upstream commit ce0b9c805dd66d5e49fd53ec5415ae398f4c56e6 ]

vmlinux.o: warning: objtool: look_up_lock_class()+0xc7: call to rcu_read_lock_any_held() leaves .noinstr.text section

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20210624095148.311980536@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 5184f6896815..282332914350 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -887,7 +887,7 @@ look_up_lock_class(const struct lockdep_map *lock, unsigned int subclass)
 	if (DEBUG_LOCKS_WARN_ON(!irqs_disabled()))
 		return NULL;
 
-	hlist_for_each_entry_rcu(class, hash_head, hash_entry) {
+	hlist_for_each_entry_rcu_notrace(class, hash_head, hash_entry) {
 		if (class->key == key) {
 			/*
 			 * Huh! same key, different name? Did someone trample

From 8d433ab5c8c26fa33ef9013b375a74d30918ac03 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Mon, 13 Sep 2021 15:53:30 -0700
Subject: [PATCH 1326/1750] net: sched: update default qdisc visibility after
 Tx queue cnt changes

[ Upstream commit 1e080f17750d1083e8a32f7b350584ae1cd7ff20 ]

mq / mqprio make the default child qdiscs visible. They only do
so for the qdiscs which are within real_num_tx_queues when the
device is registered. Depending on order of calls in the driver,
or if user space changes config via ethtool -L the number of
qdiscs visible under tc qdisc show will differ from the number
of queues. This is confusing to users and potentially to system
configuration scripts which try to make sure qdiscs have the
right parameters.

Add a new Qdisc_ops callback and make relevant qdiscs TTRT.

Note that this uncovers the "shortcut" created by
commit 1f27cde313d7 ("net: sched: use pfifo_fast for non real queues")
The default child qdiscs beyond initial real_num_tx are always
pfifo_fast, no matter what the sysfs setting is. Fixing this
gets a little tricky because we'd need to keep a reference
on whatever the default qdisc was at the time of creation.
In practice this is likely an non-issue the qdiscs likely have
to be configured to non-default settings, so whatever user space
is doing such configuration can replace the pfifos... now that
it will see them.

Reported-by: Matthew Massey <matthewmassey@fb.com>
Reviewed-by: Dave Taht <dave.taht@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/sch_generic.h |  4 ++++
 net/core/dev.c            |  2 ++
 net/sched/sch_generic.c   |  9 +++++++++
 net/sched/sch_mq.c        | 24 ++++++++++++++++++++++++
 net/sched/sch_mqprio.c    | 23 +++++++++++++++++++++++
 5 files changed, 62 insertions(+)

diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index f8631ad3c868..9226a84dcc14 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -302,6 +302,8 @@ struct Qdisc_ops {
 					  struct netlink_ext_ack *extack);
 	void			(*attach)(struct Qdisc *sch);
 	int			(*change_tx_queue_len)(struct Qdisc *, unsigned int);
+	void			(*change_real_num_tx)(struct Qdisc *sch,
+						      unsigned int new_real_tx);
 
 	int			(*dump)(struct Qdisc *, struct sk_buff *);
 	int			(*dump_stats)(struct Qdisc *, struct gnet_dump *);
@@ -683,6 +685,8 @@ void qdisc_class_hash_grow(struct Qdisc *, struct Qdisc_class_hash *);
 void qdisc_class_hash_destroy(struct Qdisc_class_hash *);
 
 int dev_qdisc_change_tx_queue_len(struct net_device *dev);
+void dev_qdisc_change_real_num_tx(struct net_device *dev,
+				  unsigned int new_real_tx);
 void dev_init_scheduler(struct net_device *dev);
 void dev_shutdown(struct net_device *dev);
 void dev_activate(struct net_device *dev);
diff --git a/net/core/dev.c b/net/core/dev.c
index e14294e9ba32..7dd7b9fb600c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2973,6 +2973,8 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 		if (dev->num_tc)
 			netif_setup_tc(dev, txq);
 
+		dev_qdisc_change_real_num_tx(dev, txq);
+
 		dev->real_num_tx_queues = txq;
 
 		if (disabling) {
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 05aa2571a409..6a9c1a39874a 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -1303,6 +1303,15 @@ static int qdisc_change_tx_queue_len(struct net_device *dev,
 	return 0;
 }
 
+void dev_qdisc_change_real_num_tx(struct net_device *dev,
+				  unsigned int new_real_tx)
+{
+	struct Qdisc *qdisc = dev->qdisc;
+
+	if (qdisc->ops->change_real_num_tx)
+		qdisc->ops->change_real_num_tx(qdisc, new_real_tx);
+}
+
 int dev_qdisc_change_tx_queue_len(struct net_device *dev)
 {
 	bool up = dev->flags & IFF_UP;
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index e79f1afe0cfd..db18d8a860f9 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -125,6 +125,29 @@ static void mq_attach(struct Qdisc *sch)
 	priv->qdiscs = NULL;
 }
 
+static void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx)
+{
+#ifdef CONFIG_NET_SCHED
+	struct net_device *dev = qdisc_dev(sch);
+	struct Qdisc *qdisc;
+	unsigned int i;
+
+	for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
+		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+		/* Only update the default qdiscs we created,
+		 * qdiscs with handles are always hashed.
+		 */
+		if (qdisc != &noop_qdisc && !qdisc->handle)
+			qdisc_hash_del(qdisc);
+	}
+	for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
+		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+		if (qdisc != &noop_qdisc && !qdisc->handle)
+			qdisc_hash_add(qdisc, false);
+	}
+#endif
+}
+
 static int mq_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
 	struct net_device *dev = qdisc_dev(sch);
@@ -288,6 +311,7 @@ struct Qdisc_ops mq_qdisc_ops __read_mostly = {
 	.init		= mq_init,
 	.destroy	= mq_destroy,
 	.attach		= mq_attach,
+	.change_real_num_tx = mq_change_real_num_tx,
 	.dump		= mq_dump,
 	.owner		= THIS_MODULE,
 };
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 5eb3b1b7ae5e..50e15add6068 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -306,6 +306,28 @@ static void mqprio_attach(struct Qdisc *sch)
 	priv->qdiscs = NULL;
 }
 
+static void mqprio_change_real_num_tx(struct Qdisc *sch,
+				      unsigned int new_real_tx)
+{
+	struct net_device *dev = qdisc_dev(sch);
+	struct Qdisc *qdisc;
+	unsigned int i;
+
+	for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
+		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+		/* Only update the default qdiscs we created,
+		 * qdiscs with handles are always hashed.
+		 */
+		if (qdisc != &noop_qdisc && !qdisc->handle)
+			qdisc_hash_del(qdisc);
+	}
+	for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
+		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
+		if (qdisc != &noop_qdisc && !qdisc->handle)
+			qdisc_hash_add(qdisc, false);
+	}
+}
+
 static struct netdev_queue *mqprio_queue_get(struct Qdisc *sch,
 					     unsigned long cl)
 {
@@ -629,6 +651,7 @@ static struct Qdisc_ops mqprio_qdisc_ops __read_mostly = {
 	.init		= mqprio_init,
 	.destroy	= mqprio_destroy,
 	.attach		= mqprio_attach,
+	.change_real_num_tx = mqprio_change_real_num_tx,
 	.dump		= mqprio_dump,
 	.owner		= THIS_MODULE,
 };

From 02ddf26d849dd241e22a8713e15e243d851199cc Mon Sep 17 00:00:00 2001
From: "Paul E. McKenney" <paulmck@kernel.org>
Date: Wed, 11 Aug 2021 09:07:44 -0700
Subject: [PATCH 1327/1750] rcu-tasks: Move RTGS_WAIT_CBS to beginning of
 rcu_tasks_kthread() loop

[ Upstream commit 0db7c32ad3160ae06f497d48a74bd46a2a35e6bf ]

Early in debugging, it made some sense to differentiate the first
iteration from subsequent iterations, but now this just causes confusion.
This commit therefore moves the "set_tasks_gp_state(rtp, RTGS_WAIT_CBS)"
statement to the beginning of the "for" loop in rcu_tasks_kthread().

Reported-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tasks.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/rcu/tasks.h b/kernel/rcu/tasks.h
index b338f514ee5a..7c05c5ab7865 100644
--- a/kernel/rcu/tasks.h
+++ b/kernel/rcu/tasks.h
@@ -197,6 +197,7 @@ static int __noreturn rcu_tasks_kthread(void *arg)
 	 * This loop is terminated by the system going down.  ;-)
 	 */
 	for (;;) {
+		set_tasks_gp_state(rtp, RTGS_WAIT_CBS);
 
 		/* Pick up any new callbacks. */
 		raw_spin_lock_irqsave(&rtp->cbs_lock, flags);
@@ -236,8 +237,6 @@ static int __noreturn rcu_tasks_kthread(void *arg)
 		}
 		/* Paranoid sleep to keep this from entering a tight loop */
 		schedule_timeout_idle(rtp->gp_sleep);
-
-		set_tasks_gp_state(rtp, RTGS_WAIT_CBS);
 	}
 }
 

From 3fac6feca95fd7e8029c72be874bd62796f2f9cb Mon Sep 17 00:00:00 2001
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date: Sat, 28 Aug 2021 23:41:40 -0700
Subject: [PATCH 1328/1750] smackfs: Fix use-after-free in netlbl_catmap_walk()

[ Upstream commit 0817534ff9ea809fac1322c5c8c574be8483ea57 ]

Syzkaller reported use-after-free bug as described in [1]. The bug is
triggered when smk_set_cipso() tries to free stale category bitmaps
while there are concurrent reader(s) using the same bitmaps.

Wait for RCU grace period to finish before freeing the category bitmaps
in smk_set_cipso(). This makes sure that there are no more readers using
the stale bitmaps and freeing them should be safe.

[1] https://lore.kernel.org/netdev/000000000000a814c505ca657a4e@google.com/

Reported-by: syzbot+3f91de0b813cc3d19a80@syzkaller.appspotmail.com
Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smackfs.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index b88c1a953833..e33f98d25fc0 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -831,6 +831,7 @@ static int smk_open_cipso(struct inode *inode, struct file *file)
 static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 				size_t count, loff_t *ppos, int format)
 {
+	struct netlbl_lsm_catmap *old_cat;
 	struct smack_known *skp;
 	struct netlbl_lsm_secattr ncats;
 	char mapcatset[SMK_CIPSOLEN];
@@ -920,9 +921,11 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
 
 	rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
 	if (rc >= 0) {
-		netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat);
+		old_cat = skp->smk_netlabel.attr.mls.cat;
 		skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
 		skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
+		synchronize_rcu();
+		netlbl_catmap_free(old_cat);
 		rc = count;
 		/*
 		 * This mapping may have been cached, so clear the cache.

From 1c04dabbd1aa391adeaeb6c52e121435ff21ab00 Mon Sep 17 00:00:00 2001
From: Seevalamuthu Mariappan <seevalam@codeaurora.org>
Date: Wed, 21 Jul 2021 00:49:22 +0300
Subject: [PATCH 1329/1750] ath11k: Align bss_chan_info structure with firmware

[ Upstream commit feab5bb8f1d4621025dceae7eef62d5f92de34ac ]

pdev_id in structure 'wmi_pdev_bss_chan_info_event' is wrongly placed
at the beginning. This causes invalid values in survey dump. Hence, align
the structure with the firmware.

Note: The firmware releases follow this order since the feature was
implemented. Also, it is not changing across the branches including
QCA6390.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01228-QCAHKSWPL_SILICONZ-1

Signed-off-by: Ritesh Singh <ritesi@codeaurora.org>
Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210720214922.118078-3-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 1 +
 drivers/net/wireless/ath/ath11k/wmi.h | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index eca86225a341..fca71e00123d 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -1333,6 +1333,7 @@ int ath11k_wmi_pdev_bss_chan_info_request(struct ath11k *ar,
 				     WMI_TAG_PDEV_BSS_CHAN_INFO_REQUEST) |
 			  FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
 	cmd->req_type = type;
+	cmd->pdev_id = ar->pdev->pdev_id;
 
 	ath11k_dbg(ar->ab, ATH11K_DBG_WMI,
 		   "WMI bss chan info req type %d\n", type);
diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h
index 5a32ba0eb4f5..c47adaab7918 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.h
+++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -2935,6 +2935,7 @@ struct wmi_pdev_bss_chan_info_req_cmd {
 	u32 tlv_header;
 	/* ref wmi_bss_chan_info_req_type */
 	u32 req_type;
+	u32 pdev_id;
 } __packed;
 
 struct wmi_ap_ps_peer_cmd {
@@ -4028,7 +4029,6 @@ struct wmi_vdev_stopped_event {
 } __packed;
 
 struct wmi_pdev_bss_chan_info_event {
-	u32 pdev_id;
 	u32 freq;	/* Units in MHz */
 	u32 noise_floor;	/* units are dBm */
 	/* rx clear - how often the channel was unused */
@@ -4046,6 +4046,7 @@ struct wmi_pdev_bss_chan_info_event {
 	/*rx_cycle cnt for my bss in 64bits format */
 	u32 rx_bss_cycle_count_low;
 	u32 rx_bss_cycle_count_high;
+	u32 pdev_id;
 } __packed;
 
 #define WMI_VDEV_INSTALL_KEY_COMPL_STATUS_SUCCESS 0

From 7ca1711d59f1a9ff6c7c68e5a690891082486f34 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Wed, 15 Sep 2021 16:19:46 +0200
Subject: [PATCH 1330/1750] x86: Increase exception stack sizes

[ Upstream commit 7fae4c24a2b84a66c7be399727aca11e7a888462 ]

It turns out that a single page of stack is trivial to overflow with
all the tracing gunk enabled. Raise the exception stacks to 2 pages,
which is still half the interrupt stacks, which are at 4 pages.

Reported-by: Michael Wang <yun.wang@linux.alibaba.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/YUIO9Ye98S5Eb68w@hirez.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/page_64_types.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 3f49dac03617..224d71aef630 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -15,7 +15,7 @@
 #define THREAD_SIZE_ORDER	(2 + KASAN_STACK_ORDER)
 #define THREAD_SIZE  (PAGE_SIZE << THREAD_SIZE_ORDER)
 
-#define EXCEPTION_STACK_ORDER (0 + KASAN_STACK_ORDER)
+#define EXCEPTION_STACK_ORDER (1 + KASAN_STACK_ORDER)
 #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
 
 #define IRQ_STACK_ORDER (2 + KASAN_STACK_ORDER)

From bab15174ec2fdaa8c886050f83cc3441407cc478 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
Date: Tue, 14 Sep 2021 21:59:03 +0200
Subject: [PATCH 1331/1750] mwifiex: Run SET_BSS_MODE when changing from P2P to
 STATION vif-type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c2e9666cdffd347460a2b17988db4cfaf2a68fb9 ]

We currently handle changing from the P2P to the STATION virtual
interface type slightly different than changing from P2P to ADHOC: When
changing to STATION, we don't send the SET_BSS_MODE command. We do send
that command on all other type-changes though, and it probably makes
sense to send the command since after all we just changed our BSS_MODE.
Looking at prior changes to this part of the code, it seems that this is
simply a leftover from old refactorings.

Since sending the SET_BSS_MODE command is the only difference between
mwifiex_change_vif_to_sta_adhoc() and the current code, we can now use
mwifiex_change_vif_to_sta_adhoc() for both switching to ADHOC and
STATION interface type.

This does not fix any particular bug and just "looked right", so there's
a small chance it might be a regression.

Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914195909.36035-4-verdre@v0yd.nl
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/wireless/marvell/mwifiex/cfg80211.c   | 22 ++++---------------
 1 file changed, 4 insertions(+), 18 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index a6b9dc6700b1..7a4e3c693d38 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -1229,29 +1229,15 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy,
 		break;
 	case NL80211_IFTYPE_P2P_CLIENT:
 	case NL80211_IFTYPE_P2P_GO:
+		if (mwifiex_cfg80211_deinit_p2p(priv))
+			return -EFAULT;
+
 		switch (type) {
-		case NL80211_IFTYPE_STATION:
-			if (mwifiex_cfg80211_deinit_p2p(priv))
-				return -EFAULT;
-			priv->adapter->curr_iface_comb.p2p_intf--;
-			priv->adapter->curr_iface_comb.sta_intf++;
-			dev->ieee80211_ptr->iftype = type;
-			if (mwifiex_deinit_priv_params(priv))
-				return -1;
-			if (mwifiex_init_new_priv_params(priv, dev, type))
-				return -1;
-			if (mwifiex_sta_init_cmd(priv, false, false))
-				return -1;
-			break;
 		case NL80211_IFTYPE_ADHOC:
-			if (mwifiex_cfg80211_deinit_p2p(priv))
-				return -EFAULT;
+		case NL80211_IFTYPE_STATION:
 			return mwifiex_change_vif_to_sta_adhoc(dev, curr_iftype,
 							       type, params);
-			break;
 		case NL80211_IFTYPE_AP:
-			if (mwifiex_cfg80211_deinit_p2p(priv))
-				return -EFAULT;
 			return mwifiex_change_vif_to_ap(dev, curr_iftype, type,
 							params);
 		case NL80211_IFTYPE_UNSPECIFIED:

From f526d948c38ddda95c1855663e8fb8b87314fdce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
Date: Tue, 14 Sep 2021 21:59:08 +0200
Subject: [PATCH 1332/1750] mwifiex: Properly initialize private structure on
 interface type changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c606008b70627a2fc485732a53cc22f0f66d0981 ]

When creating a new virtual interface in mwifiex_add_virtual_intf(), we
update our internal driver states like bss_type, bss_priority, bss_role
and bss_mode to reflect the mode the firmware will be set to.

When switching virtual interface mode using
mwifiex_init_new_priv_params() though, we currently only update bss_mode
and bss_role. In order for the interface mode switch to actually work,
we also need to update bss_type to its proper value, so do that.

This fixes a crash of the firmware (because the driver tries to execute
commands that are invalid in AP mode) when switching from station mode
to AP mode.

Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914195909.36035-9-verdre@v0yd.nl
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/cfg80211.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
index 7a4e3c693d38..3d1b5d3d295a 100644
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -908,16 +908,20 @@ mwifiex_init_new_priv_params(struct mwifiex_private *priv,
 	switch (type) {
 	case NL80211_IFTYPE_STATION:
 	case NL80211_IFTYPE_ADHOC:
-		priv->bss_role =  MWIFIEX_BSS_ROLE_STA;
+		priv->bss_role = MWIFIEX_BSS_ROLE_STA;
+		priv->bss_type = MWIFIEX_BSS_TYPE_STA;
 		break;
 	case NL80211_IFTYPE_P2P_CLIENT:
-		priv->bss_role =  MWIFIEX_BSS_ROLE_STA;
+		priv->bss_role = MWIFIEX_BSS_ROLE_STA;
+		priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
 		break;
 	case NL80211_IFTYPE_P2P_GO:
-		priv->bss_role =  MWIFIEX_BSS_ROLE_UAP;
+		priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
+		priv->bss_type = MWIFIEX_BSS_TYPE_P2P;
 		break;
 	case NL80211_IFTYPE_AP:
 		priv->bss_role = MWIFIEX_BSS_ROLE_UAP;
+		priv->bss_type = MWIFIEX_BSS_TYPE_UAP;
 		break;
 	default:
 		mwifiex_dbg(adapter, ERROR,

From 68ac723fb17e52c101b722c10ed5ff23e1a3e071 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Mon, 20 Sep 2021 20:03:03 -0700
Subject: [PATCH 1333/1750] fscrypt: allow 256-bit master keys with AES-256-XTS

[ Upstream commit 7f595d6a6cdc336834552069a2e0a4f6d4756ddf ]

fscrypt currently requires a 512-bit master key when AES-256-XTS is
used, since AES-256-XTS keys are 512-bit and fscrypt requires that the
master key be at least as long any key that will be derived from it.

However, this is overly strict because AES-256-XTS doesn't actually have
a 512-bit security strength, but rather 256-bit.  The fact that XTS
takes twice the expected key size is a quirk of the XTS mode.  It is
sufficient to use 256 bits of entropy for AES-256-XTS, provided that it
is first properly expanded into a 512-bit key, which HKDF-SHA512 does.

Therefore, relax the check of the master key size to use the security
strength of the derived key rather than the size of the derived key
(except for v1 encryption policies, which don't use HKDF).

Besides making things more flexible for userspace, this is needed in
order for the use of a KDF which only takes a 256-bit key to be
introduced into the fscrypt key hierarchy.  This will happen with
hardware-wrapped keys support, as all known hardware which supports that
feature uses an SP800-108 KDF using AES-256-CMAC, so the wrapped keys
are wrapped 256-bit AES keys.  Moreover, there is interest in fscrypt
supporting the same type of AES-256-CMAC based KDF in software as an
alternative to HKDF-SHA512.  There is no security problem with such
features, so fix the key length check to work properly with them.

Reviewed-by: Paul Crowley <paulcrowley@google.com>
Link: https://lore.kernel.org/r/20210921030303.5598-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/filesystems/fscrypt.rst | 10 ++---
 fs/crypto/fscrypt_private.h           |  5 ++-
 fs/crypto/hkdf.c                      | 11 ++++--
 fs/crypto/keysetup.c                  | 57 +++++++++++++++++++++------
 4 files changed, 61 insertions(+), 22 deletions(-)

diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst
index 44b67ebd6e40..936fae06db77 100644
--- a/Documentation/filesystems/fscrypt.rst
+++ b/Documentation/filesystems/fscrypt.rst
@@ -176,11 +176,11 @@ Master Keys
 
 Each encrypted directory tree is protected by a *master key*.  Master
 keys can be up to 64 bytes long, and must be at least as long as the
-greater of the key length needed by the contents and filenames
-encryption modes being used.  For example, if AES-256-XTS is used for
-contents encryption, the master key must be 64 bytes (512 bits).  Note
-that the XTS mode is defined to require a key twice as long as that
-required by the underlying block cipher.
+greater of the security strength of the contents and filenames
+encryption modes being used.  For example, if any AES-256 mode is
+used, the master key must be at least 256 bits, i.e. 32 bytes.  A
+stricter requirement applies if the key is used by a v1 encryption
+policy and AES-256-XTS is used; such keys must be 64 bytes.
 
 To "unlock" an encrypted directory tree, userspace must provide the
 appropriate master key.  There can be any number of master keys, each
diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
index 322ecae9a758..052ad40ecdb2 100644
--- a/fs/crypto/fscrypt_private.h
+++ b/fs/crypto/fscrypt_private.h
@@ -557,8 +557,9 @@ int __init fscrypt_init_keyring(void);
 struct fscrypt_mode {
 	const char *friendly_name;
 	const char *cipher_str;
-	int keysize;
-	int ivsize;
+	int keysize;		/* key size in bytes */
+	int security_strength;	/* security strength in bytes */
+	int ivsize;		/* IV size in bytes */
 	int logged_impl_name;
 	enum blk_crypto_mode_num blk_crypto_mode;
 };
diff --git a/fs/crypto/hkdf.c b/fs/crypto/hkdf.c
index 0cba7928446d..24172bf3e8c6 100644
--- a/fs/crypto/hkdf.c
+++ b/fs/crypto/hkdf.c
@@ -16,9 +16,14 @@
 
 /*
  * HKDF supports any unkeyed cryptographic hash algorithm, but fscrypt uses
- * SHA-512 because it is reasonably secure and efficient; and since it produces
- * a 64-byte digest, deriving an AES-256-XTS key preserves all 64 bytes of
- * entropy from the master key and requires only one iteration of HKDF-Expand.
+ * SHA-512 because it is well-established, secure, and reasonably efficient.
+ *
+ * HKDF-SHA256 was also considered, as its 256-bit security strength would be
+ * sufficient here.  A 512-bit security strength is "nice to have", though.
+ * Also, on 64-bit CPUs, SHA-512 is usually just as fast as SHA-256.  In the
+ * common case of deriving an AES-256-XTS key (512 bits), that can result in
+ * HKDF-SHA512 being much faster than HKDF-SHA256, as the longer digest size of
+ * SHA-512 causes HKDF-Expand to only need to do one iteration rather than two.
  */
 #define HKDF_HMAC_ALG		"hmac(sha512)"
 #define HKDF_HASHLEN		SHA512_DIGEST_SIZE
diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c
index 9a6f9a188efb..73d96e35d9ae 100644
--- a/fs/crypto/keysetup.c
+++ b/fs/crypto/keysetup.c
@@ -19,6 +19,7 @@ struct fscrypt_mode fscrypt_modes[] = {
 		.friendly_name = "AES-256-XTS",
 		.cipher_str = "xts(aes)",
 		.keysize = 64,
+		.security_strength = 32,
 		.ivsize = 16,
 		.blk_crypto_mode = BLK_ENCRYPTION_MODE_AES_256_XTS,
 	},
@@ -26,12 +27,14 @@ struct fscrypt_mode fscrypt_modes[] = {
 		.friendly_name = "AES-256-CTS-CBC",
 		.cipher_str = "cts(cbc(aes))",
 		.keysize = 32,
+		.security_strength = 32,
 		.ivsize = 16,
 	},
 	[FSCRYPT_MODE_AES_128_CBC] = {
 		.friendly_name = "AES-128-CBC-ESSIV",
 		.cipher_str = "essiv(cbc(aes),sha256)",
 		.keysize = 16,
+		.security_strength = 16,
 		.ivsize = 16,
 		.blk_crypto_mode = BLK_ENCRYPTION_MODE_AES_128_CBC_ESSIV,
 	},
@@ -39,12 +42,14 @@ struct fscrypt_mode fscrypt_modes[] = {
 		.friendly_name = "AES-128-CTS-CBC",
 		.cipher_str = "cts(cbc(aes))",
 		.keysize = 16,
+		.security_strength = 16,
 		.ivsize = 16,
 	},
 	[FSCRYPT_MODE_ADIANTUM] = {
 		.friendly_name = "Adiantum",
 		.cipher_str = "adiantum(xchacha12,aes)",
 		.keysize = 32,
+		.security_strength = 32,
 		.ivsize = 32,
 		.blk_crypto_mode = BLK_ENCRYPTION_MODE_ADIANTUM,
 	},
@@ -357,6 +362,45 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci,
 	return 0;
 }
 
+/*
+ * Check whether the size of the given master key (@mk) is appropriate for the
+ * encryption settings which a particular file will use (@ci).
+ *
+ * If the file uses a v1 encryption policy, then the master key must be at least
+ * as long as the derived key, as this is a requirement of the v1 KDF.
+ *
+ * Otherwise, the KDF can accept any size key, so we enforce a slightly looser
+ * requirement: we require that the size of the master key be at least the
+ * maximum security strength of any algorithm whose key will be derived from it
+ * (but in practice we only need to consider @ci->ci_mode, since any other
+ * possible subkeys such as DIRHASH and INODE_HASH will never increase the
+ * required key size over @ci->ci_mode).  This allows AES-256-XTS keys to be
+ * derived from a 256-bit master key, which is cryptographically sufficient,
+ * rather than requiring a 512-bit master key which is unnecessarily long.  (We
+ * still allow 512-bit master keys if the user chooses to use them, though.)
+ */
+static bool fscrypt_valid_master_key_size(const struct fscrypt_master_key *mk,
+					  const struct fscrypt_info *ci)
+{
+	unsigned int min_keysize;
+
+	if (ci->ci_policy.version == FSCRYPT_POLICY_V1)
+		min_keysize = ci->ci_mode->keysize;
+	else
+		min_keysize = ci->ci_mode->security_strength;
+
+	if (mk->mk_secret.size < min_keysize) {
+		fscrypt_warn(NULL,
+			     "key with %s %*phN is too short (got %u bytes, need %u+ bytes)",
+			     master_key_spec_type(&mk->mk_spec),
+			     master_key_spec_len(&mk->mk_spec),
+			     (u8 *)&mk->mk_spec.u,
+			     mk->mk_secret.size, min_keysize);
+		return false;
+	}
+	return true;
+}
+
 /*
  * Find the master key, then set up the inode's actual encryption key.
  *
@@ -422,18 +466,7 @@ static int setup_file_encryption_key(struct fscrypt_info *ci,
 		goto out_release_key;
 	}
 
-	/*
-	 * Require that the master key be at least as long as the derived key.
-	 * Otherwise, the derived key cannot possibly contain as much entropy as
-	 * that required by the encryption mode it will be used for.  For v1
-	 * policies it's also required for the KDF to work at all.
-	 */
-	if (mk->mk_secret.size < ci->ci_mode->keysize) {
-		fscrypt_warn(NULL,
-			     "key with %s %*phN is too short (got %u bytes, need %u+ bytes)",
-			     master_key_spec_type(&mk_spec),
-			     master_key_spec_len(&mk_spec), (u8 *)&mk_spec.u,
-			     mk->mk_secret.size, ci->ci_mode->keysize);
+	if (!fscrypt_valid_master_key_size(mk, ci)) {
 		err = -ENOKEY;
 		goto out_release_key;
 	}

From 2114f80889d89f96e65e0f8a74bd0ecf10b658f5 Mon Sep 17 00:00:00 2001
From: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Date: Thu, 16 Sep 2021 12:54:07 -0400
Subject: [PATCH 1334/1750] drm/amdgpu: Fix MMIO access page fault

[ Upstream commit c03509cbc01559549700e14c4a6239f2572ab4ba ]

Add more guards to MMIO access post device
unbind/unplug

Bug: https://bugs.archlinux.org/task/72092?project=1&order=dateopened&sort=desc&pagenum=1
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
Reviewed-by: James Zhu <James.Zhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c |  8 ++++++--
 drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 17 +++++++++++------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
index f493b5c3d382..79bcc78f7704 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c
@@ -22,6 +22,7 @@
  */
 
 #include <linux/firmware.h>
+#include <drm/drm_drv.h>
 
 #include "amdgpu.h"
 #include "amdgpu_vcn.h"
@@ -192,11 +193,14 @@ static int vcn_v2_0_sw_init(void *handle)
  */
 static int vcn_v2_0_sw_fini(void *handle)
 {
-	int r;
+	int r, idx;
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 	volatile struct amdgpu_fw_shared *fw_shared = adev->vcn.inst->fw_shared_cpu_addr;
 
-	fw_shared->present_flag_0 = 0;
+	if (drm_dev_enter(&adev->ddev, &idx)) {
+		fw_shared->present_flag_0 = 0;
+		drm_dev_exit(idx);
+	}
 
 	amdgpu_virt_free_mm_table(adev);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
index ce64d4016f90..381839d005db 100644
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
@@ -22,6 +22,7 @@
  */
 
 #include <linux/firmware.h>
+#include <drm/drm_drv.h>
 
 #include "amdgpu.h"
 #include "amdgpu_vcn.h"
@@ -233,17 +234,21 @@ static int vcn_v2_5_sw_init(void *handle)
  */
 static int vcn_v2_5_sw_fini(void *handle)
 {
-	int i, r;
+	int i, r, idx;
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 	volatile struct amdgpu_fw_shared *fw_shared;
 
-	for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
-		if (adev->vcn.harvest_config & (1 << i))
-			continue;
-		fw_shared = adev->vcn.inst[i].fw_shared_cpu_addr;
-		fw_shared->present_flag_0 = 0;
+	if (drm_dev_enter(&adev->ddev, &idx)) {
+		for (i = 0; i < adev->vcn.num_vcn_inst; i++) {
+			if (adev->vcn.harvest_config & (1 << i))
+				continue;
+			fw_shared = adev->vcn.inst[i].fw_shared_cpu_addr;
+			fw_shared->present_flag_0 = 0;
+		}
+		drm_dev_exit(idx);
 	}
 
+
 	if (amdgpu_sriov_vf(adev))
 		amdgpu_virt_free_mm_table(adev);
 

From 97890f36333dd3932c7704ceeb7c13289c184537 Mon Sep 17 00:00:00 2001
From: Sriram R <srirrama@codeaurora.org>
Date: Tue, 28 Sep 2021 12:05:40 +0300
Subject: [PATCH 1335/1750] ath11k: Avoid reg rules update during firmware
 recovery

[ Upstream commit 69a0fcf8a9f2273040d03e5ee77c9689c09e9d3a ]

During firmware recovery, the default reg rules which are
received via WMI_REG_CHAN_LIST_CC_EVENT can overwrite
the currently configured user regd.

See below snap for example,

root@OpenWrt:/# iw reg get | grep country
country FR: DFS-ETSI
country FR: DFS-ETSI
country FR: DFS-ETSI
country FR: DFS-ETSI

root@OpenWrt:/# echo assert > /sys/kernel/debug/ath11k/ipq8074\ hw2.0/simulate_f
w_crash
<snip>
[ 5290.471696] ath11k c000000.wifi1: pdev 1 successfully recovered

root@OpenWrt:/# iw reg get | grep country
country FR: DFS-ETSI
country US: DFS-FCC
country US: DFS-FCC
country US: DFS-FCC

In the above, the user configured country 'FR' is overwritten
when the rules of default country 'US' are received and updated during
recovery. Hence avoid processing of these rules in general
during firmware recovery as they have been already applied during
driver registration or after last set user country is configured.

This scenario applies for both AP and STA devices basically because
cfg80211 is not aware of the recovery and only the driver recovers, but
changing or resetting of the reg domain during recovery is not needed so
as to continue with the configured regdomain currently in use.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01460-QCAHKSWPL_SILICONZ-1

Signed-off-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210721212029.142388-3-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index fca71e00123d..2f777d61f906 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5362,6 +5362,17 @@ static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *sk
 
 	pdev_idx = reg_info->phy_id;
 
+	/* Avoid default reg rule updates sent during FW recovery if
+	 * it is already available
+	 */
+	spin_lock(&ab->base_lock);
+	if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags) &&
+	    ab->default_regd[pdev_idx]) {
+		spin_unlock(&ab->base_lock);
+		goto mem_free;
+	}
+	spin_unlock(&ab->base_lock);
+
 	if (pdev_idx >= ab->num_radios) {
 		/* Process the event for phy0 only if single_pdev_only
 		 * is true. If pdev_idx is valid but not 0, discard the

From 43ab6457883670e0080938e2bb0544f58880f063 Mon Sep 17 00:00:00 2001
From: Wen Gong <wgong@codeaurora.org>
Date: Tue, 28 Sep 2021 14:00:45 +0300
Subject: [PATCH 1336/1750] ath11k: add handler for scan event
 WMI_SCAN_EVENT_DEQUEUED

[ Upstream commit 441b3b5911f8ead7f2fe2336587b340a33044d58 ]

When wlan interface is up, 11d scan is sent to the firmware, and the
firmware needs to spend couple of seconds to complete the 11d scan. If
immediately a normal scan from user space arrives to ath11k, then the
normal scan request is also sent to the firmware, but the scan started
event will be reported to ath11k until the 11d scan complete. When timed
out for the scan started in ath11k, ath11k stops the normal scan and the
firmware reports WMI_SCAN_EVENT_DEQUEUED to ath11k for the normal scan.
ath11k has no handler for the event and then timed out for the scan
completed in ath11k_scan_stop(), and ath11k prints the following error
message.

[ 1491.604750] ath11k_pci 0000:02:00.0: failed to receive scan abort comple: timed out
[ 1491.604756] ath11k_pci 0000:02:00.0: failed to stop scan: -110
[ 1491.604758] ath11k_pci 0000:02:00.0: failed to start hw scan: -110

Add a handler for WMI_SCAN_EVENT_DEQUEUED and then complete the scan to
get rid of the above error message.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1

Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914164226.38843-1-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/wmi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index 2f777d61f906..cf0f778b0cbc 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5856,6 +5856,8 @@ static void ath11k_scan_event(struct ath11k_base *ab, struct sk_buff *skb)
 		ath11k_wmi_event_scan_start_failed(ar);
 		break;
 	case WMI_SCAN_EVENT_DEQUEUED:
+		__ath11k_mac_scan_finish(ar);
+		break;
 	case WMI_SCAN_EVENT_PREEMPTED:
 	case WMI_SCAN_EVENT_RESTARTED:
 	case WMI_SCAN_EVENT_FOREIGN_CHAN_EXIT:

From 461a71a1a62aeb1c92fd5c52d4a93bb5a280cf24 Mon Sep 17 00:00:00 2001
From: Baochen Qiang <bqiang@codeaurora.org>
Date: Tue, 28 Sep 2021 14:00:46 +0300
Subject: [PATCH 1337/1750] ath11k: Change DMA_FROM_DEVICE to DMA_TO_DEVICE
 when map reinjected packets

[ Upstream commit 86a03dad0f5ad8182ed5fcf7bf3eec71cd96577c ]

For fragmented packets, ath11k reassembles each fragment as a normal
packet and then reinjects it into HW ring. In this case, the DMA
direction should be DMA_TO_DEVICE, not DMA_FROM_DEVICE, otherwise
invalid payload will be reinjected to HW and then delivered to host.
What is more, since arbitrary memory could be allocated to the frame, we
don't know what kind of data is contained in the buffer reinjected.
Thus, as a bad result, private info may be leaked.

Note that this issue is only found on Intel platform.

Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1
Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210916064617.20006-1-bqiang@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/dp_rx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 2bff8eb507d4..7d6fd8155bb2 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -3273,7 +3273,7 @@ static int ath11k_dp_rx_h_defrag_reo_reinject(struct ath11k *ar, struct dp_rx_ti
 
 	paddr = dma_map_single(ab->dev, defrag_skb->data,
 			       defrag_skb->len + skb_tailroom(defrag_skb),
-			       DMA_FROM_DEVICE);
+			       DMA_TO_DEVICE);
 	if (dma_mapping_error(ab->dev, paddr))
 		return -ENOMEM;
 
@@ -3338,7 +3338,7 @@ static int ath11k_dp_rx_h_defrag_reo_reinject(struct ath11k *ar, struct dp_rx_ti
 	spin_unlock_bh(&rx_refill_ring->idr_lock);
 err_unmap_dma:
 	dma_unmap_single(ab->dev, paddr, defrag_skb->len + skb_tailroom(defrag_skb),
-			 DMA_FROM_DEVICE);
+			 DMA_TO_DEVICE);
 	return ret;
 }
 

From aded39ff1f7a496b3c343f9e0e4130375ff05bdb Mon Sep 17 00:00:00 2001
From: Alagu Sankar <alagusankar@silex-india.com>
Date: Tue, 28 Sep 2021 14:00:47 +0300
Subject: [PATCH 1338/1750] ath10k: high latency fixes for beacon buffer

[ Upstream commit e263bdab9c0e8025fb7f41f153709a9cda51f6b6 ]

Beacon buffer for high latency devices does not use DMA. other similar
buffer allocation methods in the driver have already been modified for
high latency path. Fix the beacon buffer allocation left out in the
earlier high latency changes.

Signed-off-by: Alagu Sankar <alagusankar@silex-india.com>
Signed-off-by: Erik Stromdahl <erik.stromdahl@gmail.com>
[fabio: adapt it to use ar->bus_param.dev_type ]
Signed-off-by: Fabio Estevam <festevam@denx.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210818232627.2040121-1-festevam@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 31 ++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 36183fdfb7f0..90dc48f66fbf 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -982,8 +982,12 @@ static void ath10k_mac_vif_beacon_cleanup(struct ath10k_vif *arvif)
 	ath10k_mac_vif_beacon_free(arvif);
 
 	if (arvif->beacon_buf) {
-		dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
-				  arvif->beacon_buf, arvif->beacon_paddr);
+		if (ar->bus_param.dev_type == ATH10K_DEV_TYPE_HL)
+			kfree(arvif->beacon_buf);
+		else
+			dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
+					  arvif->beacon_buf,
+					  arvif->beacon_paddr);
 		arvif->beacon_buf = NULL;
 	}
 }
@@ -5466,10 +5470,17 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 	if (vif->type == NL80211_IFTYPE_ADHOC ||
 	    vif->type == NL80211_IFTYPE_MESH_POINT ||
 	    vif->type == NL80211_IFTYPE_AP) {
-		arvif->beacon_buf = dma_alloc_coherent(ar->dev,
-						       IEEE80211_MAX_FRAME_LEN,
-						       &arvif->beacon_paddr,
-						       GFP_ATOMIC);
+		if (ar->bus_param.dev_type == ATH10K_DEV_TYPE_HL) {
+			arvif->beacon_buf = kmalloc(IEEE80211_MAX_FRAME_LEN,
+						    GFP_KERNEL);
+			arvif->beacon_paddr = (dma_addr_t)arvif->beacon_buf;
+		} else {
+			arvif->beacon_buf =
+				dma_alloc_coherent(ar->dev,
+						   IEEE80211_MAX_FRAME_LEN,
+						   &arvif->beacon_paddr,
+						   GFP_ATOMIC);
+		}
 		if (!arvif->beacon_buf) {
 			ret = -ENOMEM;
 			ath10k_warn(ar, "failed to allocate beacon buffer: %d\n",
@@ -5684,8 +5695,12 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 
 err:
 	if (arvif->beacon_buf) {
-		dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
-				  arvif->beacon_buf, arvif->beacon_paddr);
+		if (ar->bus_param.dev_type == ATH10K_DEV_TYPE_HL)
+			kfree(arvif->beacon_buf);
+		else
+			dma_free_coherent(ar->dev, IEEE80211_MAX_FRAME_LEN,
+					  arvif->beacon_buf,
+					  arvif->beacon_paddr);
 		arvif->beacon_buf = NULL;
 	}
 

From 09ee09359af9cf42b0ebc640adca63008cb8dffa Mon Sep 17 00:00:00 2001
From: Dirk Bender <d.bender@phytec.de>
Date: Mon, 26 Jul 2021 09:35:15 +0200
Subject: [PATCH 1339/1750] media: mt9p031: Fix corrupted frame after
 restarting stream

[ Upstream commit 0961ba6dd211a4a52d1dd4c2d59be60ac2dc08c7 ]

To prevent corrupted frames after starting and stopping the sensor its
datasheet specifies a specific pause sequence to follow:

Stopping:
	Set Pause_Restart Bit -> Set Restart Bit -> Set Chip_Enable Off

Restarting:
	Set Chip_Enable On -> Clear Pause_Restart Bit

The Restart Bit is cleared automatically and must not be cleared
manually as this would cause undefined behavior.

Signed-off-by: Dirk Bender <d.bender@phytec.de>
Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/mt9p031.c | 28 +++++++++++++++++++++++++++-
 1 file changed, 27 insertions(+), 1 deletion(-)

diff --git a/drivers/media/i2c/mt9p031.c b/drivers/media/i2c/mt9p031.c
index dc23b9ed510a..18440c5104ad 100644
--- a/drivers/media/i2c/mt9p031.c
+++ b/drivers/media/i2c/mt9p031.c
@@ -78,7 +78,9 @@
 #define		MT9P031_PIXEL_CLOCK_INVERT		(1 << 15)
 #define		MT9P031_PIXEL_CLOCK_SHIFT(n)		((n) << 8)
 #define		MT9P031_PIXEL_CLOCK_DIVIDE(n)		((n) << 0)
-#define MT9P031_FRAME_RESTART				0x0b
+#define MT9P031_RESTART					0x0b
+#define		MT9P031_FRAME_PAUSE_RESTART		(1 << 1)
+#define		MT9P031_FRAME_RESTART			(1 << 0)
 #define MT9P031_SHUTTER_DELAY				0x0c
 #define MT9P031_RST					0x0d
 #define		MT9P031_RST_ENABLE			1
@@ -445,9 +447,23 @@ static int mt9p031_set_params(struct mt9p031 *mt9p031)
 static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable)
 {
 	struct mt9p031 *mt9p031 = to_mt9p031(subdev);
+	struct i2c_client *client = v4l2_get_subdevdata(subdev);
+	int val;
 	int ret;
 
 	if (!enable) {
+		/* enable pause restart */
+		val = MT9P031_FRAME_PAUSE_RESTART;
+		ret = mt9p031_write(client, MT9P031_RESTART, val);
+		if (ret < 0)
+			return ret;
+
+		/* enable restart + keep pause restart set */
+		val |= MT9P031_FRAME_RESTART;
+		ret = mt9p031_write(client, MT9P031_RESTART, val);
+		if (ret < 0)
+			return ret;
+
 		/* Stop sensor readout */
 		ret = mt9p031_set_output_control(mt9p031,
 						 MT9P031_OUTPUT_CONTROL_CEN, 0);
@@ -467,6 +483,16 @@ static int mt9p031_s_stream(struct v4l2_subdev *subdev, int enable)
 	if (ret < 0)
 		return ret;
 
+	/*
+	 * - clear pause restart
+	 * - don't clear restart as clearing restart manually can cause
+	 *   undefined behavior
+	 */
+	val = MT9P031_FRAME_RESTART;
+	ret = mt9p031_write(client, MT9P031_RESTART, val);
+	if (ret < 0)
+		return ret;
+
 	return mt9p031_pll_enable(mt9p031);
 }
 

From f4c652bd3506e9a5feb9e32f50a0b4cf5e3860f7 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Wed, 23 Jun 2021 08:01:05 +0200
Subject: [PATCH 1340/1750] media: netup_unidvb: handle interrupt properly
 according to the firmware

[ Upstream commit dbb4cfea6efe979ed153bd59a6a527a90d3d0ab3 ]

The interrupt handling should be related to the firmware version. If
the driver matches an old firmware, then the driver should not handle
interrupt such as i2c or dma, otherwise it will cause some errors.

This log reveals it:

[   27.708641] INFO: trying to register non-static key.
[   27.710851] The code is fine but needs lockdep annotation, or maybe
[   27.712010] you didn't initialize this object before use?
[   27.712396] turning off the locking correctness validator.
[   27.712787] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4-g70e7f0549188-dirty #169
[   27.713349] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[   27.714149] Call Trace:
[   27.714329]  <IRQ>
[   27.714480]  dump_stack+0xba/0xf5
[   27.714737]  register_lock_class+0x873/0x8f0
[   27.715052]  ? __lock_acquire+0x323/0x1930
[   27.715353]  __lock_acquire+0x75/0x1930
[   27.715636]  lock_acquire+0x1dd/0x3e0
[   27.715905]  ? netup_i2c_interrupt+0x19/0x310
[   27.716226]  _raw_spin_lock_irqsave+0x4b/0x60
[   27.716544]  ? netup_i2c_interrupt+0x19/0x310
[   27.716863]  netup_i2c_interrupt+0x19/0x310
[   27.717178]  netup_unidvb_isr+0xd3/0x160
[   27.717467]  __handle_irq_event_percpu+0x53/0x3e0
[   27.717808]  handle_irq_event_percpu+0x35/0x90
[   27.718129]  handle_irq_event+0x39/0x60
[   27.718409]  handle_fasteoi_irq+0xc2/0x1d0
[   27.718707]  __common_interrupt+0x7f/0x150
[   27.719008]  common_interrupt+0xb4/0xd0
[   27.719289]  </IRQ>
[   27.719446]  asm_common_interrupt+0x1e/0x40
[   27.719747] RIP: 0010:native_safe_halt+0x17/0x20
[   27.720084] Code: 07 0f 00 2d 8b ee 4c 00 f4 5d c3 0f 1f 84 00 00 00 00 00 8b 05 72 95 17 02 55 48 89 e5 85 c0 7e 07 0f 00 2d 6b ee 4c 00 fb f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d 29 f6
[   27.721386] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246
[   27.721758] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
[   27.722262] RDX: 0000000000000000 RSI: ffffffff85f7c054 RDI: ffffffff85ded4e6
[   27.722770] RBP: ffffc9000008fe90 R08: 0000000000000001 R09: 0000000000000001
[   27.723277] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff86a75408
[   27.723781] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888100260000
[   27.724289]  default_idle+0x9/0x10
[   27.724537]  arch_cpu_idle+0xa/0x10
[   27.724791]  default_idle_call+0x6e/0x250
[   27.725082]  do_idle+0x1f0/0x2d0
[   27.725326]  cpu_startup_entry+0x18/0x20
[   27.725613]  start_secondary+0x11f/0x160
[   27.725902]  secondary_startup_64_no_verify+0xb0/0xbb
[   27.726272] BUG: kernel NULL pointer dereference, address: 0000000000000002
[   27.726768] #PF: supervisor read access in kernel mode
[   27.727138] #PF: error_code(0x0000) - not-present page
[   27.727507] PGD 8000000118688067 P4D 8000000118688067 PUD 10feab067 PMD 0
[   27.727999] Oops: 0000 [#1] PREEMPT SMP PTI
[   27.728302] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4-g70e7f0549188-dirty #169
[   27.728861] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
[   27.729660] RIP: 0010:netup_i2c_interrupt+0x23/0x310
[   27.730019] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 89 fb e8 af 6e 95 fd 48 89 df e8 e7 9f 1c 01 49 89 c5 48 8b 83 48 08 00 00 <66> 44 8b 60 02 44 89 e0 48 8b 93 48 08 00 00 83 e0 f8 66 89 42 02
[   27.731339] RSP: 0018:ffffc90000118e90 EFLAGS: 00010046
[   27.731716] RAX: 0000000000000000 RBX: ffff88810803c4d8 RCX: 0000000000000000
[   27.732223] RDX: 0000000000000001 RSI: ffffffff85d37b94 RDI: ffff88810803c4d8
[   27.732727] RBP: ffffc90000118ea8 R08: 0000000000000000 R09: 0000000000000001
[   27.733239] R10: ffff88810803c4f0 R11: 61646e6f63657320 R12: 0000000000000000
[   27.733745] R13: 0000000000000046 R14: ffff888101041000 R15: ffff8881081b2400
[   27.734251] FS:  0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[   27.734821] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   27.735228] CR2: 0000000000000002 CR3: 0000000108194000 CR4: 00000000000006e0
[   27.735735] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   27.736241] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   27.736744] Call Trace:
[   27.736924]  <IRQ>
[   27.737074]  netup_unidvb_isr+0xd3/0x160
[   27.737363]  __handle_irq_event_percpu+0x53/0x3e0
[   27.737706]  handle_irq_event_percpu+0x35/0x90
[   27.738028]  handle_irq_event+0x39/0x60
[   27.738306]  handle_fasteoi_irq+0xc2/0x1d0
[   27.738602]  __common_interrupt+0x7f/0x150
[   27.738899]  common_interrupt+0xb4/0xd0
[   27.739176]  </IRQ>
[   27.739331]  asm_common_interrupt+0x1e/0x40
[   27.739633] RIP: 0010:native_safe_halt+0x17/0x20
[   27.739967] Code: 07 0f 00 2d 8b ee 4c 00 f4 5d c3 0f 1f 84 00 00 00 00 00 8b 05 72 95 17 02 55 48 89 e5 85 c0 7e 07 0f 00 2d 6b ee 4c 00 fb f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d 29 f6
[   27.741275] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246
[   27.741647] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
[   27.742148] RDX: 0000000000000000 RSI: ffffffff85f7c054 RDI: ffffffff85ded4e6
[   27.742652] RBP: ffffc9000008fe90 R08: 0000000000000001 R09: 0000000000000001
[   27.743154] R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff86a75408
[   27.743652] R13: 0000000000000000 R14: 0000000000000000 R15: ffff888100260000
[   27.744157]  default_idle+0x9/0x10
[   27.744405]  arch_cpu_idle+0xa/0x10
[   27.744658]  default_idle_call+0x6e/0x250
[   27.744948]  do_idle+0x1f0/0x2d0
[   27.745190]  cpu_startup_entry+0x18/0x20
[   27.745475]  start_secondary+0x11f/0x160
[   27.745761]  secondary_startup_64_no_verify+0xb0/0xbb
[   27.746123] Modules linked in:
[   27.746348] Dumping ftrace buffer:
[   27.746596]    (ftrace buffer empty)
[   27.746852] CR2: 0000000000000002
[   27.747094] ---[ end trace ebafd46f83ab946d ]---
[   27.747424] RIP: 0010:netup_i2c_interrupt+0x23/0x310
[   27.747778] Code: 0f 1f 80 00 00 00 00 55 48 89 e5 41 55 41 54 53 48 89 fb e8 af 6e 95 fd 48 89 df e8 e7 9f 1c 01 49 89 c5 48 8b 83 48 08 00 00 <66> 44 8b 60 02 44 89 e0 48 8b 93 48 08 00 00 83 e0 f8 66 89 42 02
[   27.749082] RSP: 0018:ffffc90000118e90 EFLAGS: 00010046
[   27.749461] RAX: 0000000000000000 RBX: ffff88810803c4d8 RCX: 0000000000000000
[   27.749966] RDX: 0000000000000001 RSI: ffffffff85d37b94 RDI: ffff88810803c4d8
[   27.750471] RBP: ffffc90000118ea8 R08: 0000000000000000 R09: 0000000000000001
[   27.750976] R10: ffff88810803c4f0 R11: 61646e6f63657320 R12: 0000000000000000
[   27.751480] R13: 0000000000000046 R14: ffff888101041000 R15: ffff8881081b2400
[   27.751986] FS:  0000000000000000(0000) GS:ffff88817bc80000(0000) knlGS:0000000000000000
[   27.752560] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   27.752970] CR2: 0000000000000002 CR3: 0000000108194000 CR4: 00000000000006e0
[   27.753481] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   27.753984] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   27.754487] Kernel panic - not syncing: Fatal exception in interrupt
[   27.755033] Dumping ftrace buffer:
[   27.755279]    (ftrace buffer empty)
[   27.755534] Kernel Offset: disabled
[   27.755785] Rebooting in 1 seconds..

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../pci/netup_unidvb/netup_unidvb_core.c      | 27 +++++++++++--------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
index 6f3125c2d097..77bae1468551 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
@@ -258,19 +258,24 @@ static irqreturn_t netup_unidvb_isr(int irq, void *dev_id)
 	if ((reg40 & AVL_IRQ_ASSERTED) != 0) {
 		/* IRQ is being signaled */
 		reg_isr = readw(ndev->bmmio0 + REG_ISR);
-		if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) {
-			iret = netup_i2c_interrupt(&ndev->i2c[0]);
-		} else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) {
-			iret = netup_i2c_interrupt(&ndev->i2c[1]);
-		} else if (reg_isr & NETUP_UNIDVB_IRQ_SPI) {
+		if (reg_isr & NETUP_UNIDVB_IRQ_SPI)
 			iret = netup_spi_interrupt(ndev->spi);
-		} else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) {
-			iret = netup_dma_interrupt(&ndev->dma[0]);
-		} else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) {
-			iret = netup_dma_interrupt(&ndev->dma[1]);
-		} else if (reg_isr & NETUP_UNIDVB_IRQ_CI) {
-			iret = netup_ci_interrupt(ndev);
+		else if (!ndev->old_fw) {
+			if (reg_isr & NETUP_UNIDVB_IRQ_I2C0) {
+				iret = netup_i2c_interrupt(&ndev->i2c[0]);
+			} else if (reg_isr & NETUP_UNIDVB_IRQ_I2C1) {
+				iret = netup_i2c_interrupt(&ndev->i2c[1]);
+			} else if (reg_isr & NETUP_UNIDVB_IRQ_DMA1) {
+				iret = netup_dma_interrupt(&ndev->dma[0]);
+			} else if (reg_isr & NETUP_UNIDVB_IRQ_DMA2) {
+				iret = netup_dma_interrupt(&ndev->dma[1]);
+			} else if (reg_isr & NETUP_UNIDVB_IRQ_CI) {
+				iret = netup_ci_interrupt(ndev);
+			} else {
+				goto err;
+			}
 		} else {
+err:
 			dev_err(&pci_dev->dev,
 				"%s(): unknown interrupt 0x%x\n",
 				__func__, reg_isr);

From 309ea2248d0ac305e41379bb50329a1664085a3f Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Tue, 10 Aug 2021 18:29:43 +0200
Subject: [PATCH 1341/1750] media: atomisp: Fix error handling in probe

[ Upstream commit e16f5e39acd6d10cc63ae39bc0a77188ed828f22 ]

There were several issues with handling errors in lm3554_probe():
- Probe did not set the error code when v4l2_ctrl_handler_init() failed.
- It intermixed gotos for handling errors of v4l2_ctrl_handler_init()
  and media_entity_pads_init().
- It did not set the error code for failures of v4l2_ctrl_new_custom().
- Probe did not free resources in case of failures of
  atomisp_register_i2c_module().

The patch fixes all these issues.

Found by Linux Driver Verification project (linuxtesting.org).

Link: https://lore.kernel.org/linux-media/20210810162943.19852-1-novikov@ispras.ru
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/atomisp/i2c/atomisp-lm3554.c        | 37 ++++++++++++-------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
index 0ab67b2aec67..8739f0874103 100644
--- a/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
+++ b/drivers/staging/media/atomisp/i2c/atomisp-lm3554.c
@@ -836,7 +836,6 @@ static int lm3554_probe(struct i2c_client *client)
 	int err = 0;
 	struct lm3554 *flash;
 	unsigned int i;
-	int ret;
 
 	flash = kzalloc(sizeof(*flash), GFP_KERNEL);
 	if (!flash)
@@ -845,7 +844,7 @@ static int lm3554_probe(struct i2c_client *client)
 	flash->pdata = lm3554_platform_data_func(client);
 	if (IS_ERR(flash->pdata)) {
 		err = PTR_ERR(flash->pdata);
-		goto fail1;
+		goto free_flash;
 	}
 
 	v4l2_i2c_subdev_init(&flash->sd, client, &lm3554_ops);
@@ -853,12 +852,12 @@ static int lm3554_probe(struct i2c_client *client)
 	flash->sd.flags |= V4L2_SUBDEV_FL_HAS_DEVNODE;
 	flash->mode = ATOMISP_FLASH_MODE_OFF;
 	flash->timeout = LM3554_MAX_TIMEOUT / LM3554_TIMEOUT_STEPSIZE - 1;
-	ret =
+	err =
 	    v4l2_ctrl_handler_init(&flash->ctrl_handler,
 				   ARRAY_SIZE(lm3554_controls));
-	if (ret) {
+	if (err) {
 		dev_err(&client->dev, "error initialize a ctrl_handler.\n");
-		goto fail3;
+		goto unregister_subdev;
 	}
 
 	for (i = 0; i < ARRAY_SIZE(lm3554_controls); i++)
@@ -867,14 +866,15 @@ static int lm3554_probe(struct i2c_client *client)
 
 	if (flash->ctrl_handler.error) {
 		dev_err(&client->dev, "ctrl_handler error.\n");
-		goto fail3;
+		err = flash->ctrl_handler.error;
+		goto free_handler;
 	}
 
 	flash->sd.ctrl_handler = &flash->ctrl_handler;
 	err = media_entity_pads_init(&flash->sd.entity, 0, NULL);
 	if (err) {
 		dev_err(&client->dev, "error initialize a media entity.\n");
-		goto fail2;
+		goto free_handler;
 	}
 
 	flash->sd.entity.function = MEDIA_ENT_F_FLASH;
@@ -885,16 +885,27 @@ static int lm3554_probe(struct i2c_client *client)
 
 	err = lm3554_gpio_init(client);
 	if (err) {
-		dev_err(&client->dev, "gpio request/direction_output fail");
-		goto fail3;
+		dev_err(&client->dev, "gpio request/direction_output fail.\n");
+		goto cleanup_media;
 	}
-	return atomisp_register_i2c_module(&flash->sd, NULL, LED_FLASH);
-fail3:
+
+	err = atomisp_register_i2c_module(&flash->sd, NULL, LED_FLASH);
+	if (err) {
+		dev_err(&client->dev, "fail to register atomisp i2c module.\n");
+		goto uninit_gpio;
+	}
+
+	return 0;
+
+uninit_gpio:
+	lm3554_gpio_uninit(client);
+cleanup_media:
 	media_entity_cleanup(&flash->sd.entity);
+free_handler:
 	v4l2_ctrl_handler_free(&flash->ctrl_handler);
-fail2:
+unregister_subdev:
 	v4l2_device_unregister_subdev(&flash->sd);
-fail1:
+free_flash:
 	kfree(flash);
 
 	return err;

From 0c91bb4fbde4729fe692575e82cce43c11063098 Mon Sep 17 00:00:00 2001
From: Dmitriy Ulitin <ulitin@ispras.ru>
Date: Thu, 27 May 2021 17:06:26 +0200
Subject: [PATCH 1342/1750] media: stm32: Potential NULL pointer dereference in
 dcmi_irq_thread()

[ Upstream commit 548fa43a58696450c15b8f5564e99589c5144664 ]

At the moment of enabling irq handling:

1922 ret = devm_request_threaded_irq(&pdev->dev, irq, dcmi_irq_callback,
1923			dcmi_irq_thread, IRQF_ONESHOT,
1924			dev_name(&pdev->dev), dcmi);

there is still uninitialized field sd_format of struct stm32_dcmi *dcmi.
If an interrupt occurs in the interval between the installation of the
interrupt handler and the initialization of this field, NULL pointer
dereference happens.

This field is dereferenced in the handler function without any check:

457 if (dcmi->sd_format->fourcc == V4L2_PIX_FMT_JPEG &&
458	    dcmi->misr & IT_FRAME) {

The patch moves interrupt handler installation
after initialization of the sd_format field that happens in
dcmi_graph_notify_complete() via dcmi_set_default_fmt().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Dmitriy Ulitin <ulitin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/stm32/stm32-dcmi.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c
index fd1c41cba52f..233e4d3feacd 100644
--- a/drivers/media/platform/stm32/stm32-dcmi.c
+++ b/drivers/media/platform/stm32/stm32-dcmi.c
@@ -135,6 +135,7 @@ struct stm32_dcmi {
 	int				sequence;
 	struct list_head		buffers;
 	struct dcmi_buf			*active;
+	int			irq;
 
 	struct v4l2_device		v4l2_dev;
 	struct video_device		*vdev;
@@ -1720,6 +1721,14 @@ static int dcmi_graph_notify_complete(struct v4l2_async_notifier *notifier)
 		return ret;
 	}
 
+	ret = devm_request_threaded_irq(dcmi->dev, dcmi->irq, dcmi_irq_callback,
+					dcmi_irq_thread, IRQF_ONESHOT,
+					dev_name(dcmi->dev), dcmi);
+	if (ret) {
+		dev_err(dcmi->dev, "Unable to request irq %d\n", dcmi->irq);
+		return ret;
+	}
+
 	return 0;
 }
 
@@ -1881,6 +1890,8 @@ static int dcmi_probe(struct platform_device *pdev)
 	if (irq <= 0)
 		return irq ? irq : -ENXIO;
 
+	dcmi->irq = irq;
+
 	dcmi->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	if (!dcmi->res) {
 		dev_err(&pdev->dev, "Could not get resource\n");
@@ -1893,14 +1904,6 @@ static int dcmi_probe(struct platform_device *pdev)
 		return PTR_ERR(dcmi->regs);
 	}
 
-	ret = devm_request_threaded_irq(&pdev->dev, irq, dcmi_irq_callback,
-					dcmi_irq_thread, IRQF_ONESHOT,
-					dev_name(&pdev->dev), dcmi);
-	if (ret) {
-		dev_err(&pdev->dev, "Unable to request irq %d\n", irq);
-		return ret;
-	}
-
 	mclk = devm_clk_get(&pdev->dev, "mclk");
 	if (IS_ERR(mclk)) {
 		if (PTR_ERR(mclk) != -EPROBE_DEFER)

From 2052c4cebce9e5f60c8a5b0e8fc4c2727d2a39ab Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 18 Jun 2021 14:29:08 +0200
Subject: [PATCH 1343/1750] media: uvcvideo: Set capability in s_param

[ Upstream commit 97a2777a96070afb7da5d587834086c0b586c8cc ]

Fixes v4l2-compliance:

Format ioctls (Input 0):
                warn: v4l2-test-formats.cpp(1339): S_PARM is supported but doesn't report V4L2_CAP_TIMEPERFRAME
                fail: v4l2-test-formats.cpp(1241): node->has_frmintervals && !cap->capability

Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_v4l2.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 5f0e2fa69da5..753b8a99e08f 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -471,10 +471,13 @@ static int uvc_v4l2_set_streamparm(struct uvc_streaming *stream,
 	uvc_simplify_fraction(&timeperframe.numerator,
 		&timeperframe.denominator, 8, 333);
 
-	if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+	if (parm->type == V4L2_BUF_TYPE_VIDEO_CAPTURE) {
 		parm->parm.capture.timeperframe = timeperframe;
-	else
+		parm->parm.capture.capability = V4L2_CAP_TIMEPERFRAME;
+	} else {
 		parm->parm.output.timeperframe = timeperframe;
+		parm->parm.output.capability = V4L2_CAP_TIMEPERFRAME;
+	}
 
 	return 0;
 }

From d9349416402d89fb179c02e86d40caf5d892835a Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 18 Jun 2021 14:29:09 +0200
Subject: [PATCH 1344/1750] media: uvcvideo: Return -EIO for control errors

[ Upstream commit ffccdde5f0e17d2f0d788a9d831a027187890eaa ]

The device is doing something unexpected with the control. Either because
the protocol is not properly implemented or there has been a HW error.

Fixes v4l2-compliance:

Control ioctls (Input 0):
                fail: v4l2-test-controls.cpp(448): s_ctrl returned an error (22)
        test VIDIOC_G/S_CTRL: FAIL
                fail: v4l2-test-controls.cpp(698): s_ext_ctrls returned an error (22)
        test VIDIOC_G/S/TRY_EXT_CTRLS: FAIL

Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_video.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 5878c7833486..b8477fa93b7d 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -112,6 +112,11 @@ int uvc_query_ctrl(struct uvc_device *dev, u8 query, u8 unit,
 	case 5: /* Invalid unit */
 	case 6: /* Invalid control */
 	case 7: /* Invalid Request */
+		/*
+		 * The firmware has not properly implemented
+		 * the control or there has been a HW error.
+		 */
+		return -EIO;
 	case 8: /* Invalid value within range */
 		return -EINVAL;
 	default: /* reserved or unknown */

From f4037b9b10621cfd0df79f2ef765fe15f16c7870 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 18 Jun 2021 14:29:13 +0200
Subject: [PATCH 1345/1750] media: uvcvideo: Set unique vdev name based in type

[ Upstream commit e3f60e7e1a2b451f538f9926763432249bcf39c4 ]

All the entities must have a unique name. We can have a descriptive and
unique name by appending the function and the entity->id.

This is even resilent to multi chain devices.

Fixes v4l2-compliance:
Media Controller ioctls:
                fail: v4l2-test-media.cpp(205): v2_entity_names_set.find(key) != v2_entity_names_set.end()
        test MEDIA_IOC_G_TOPOLOGY: FAIL
                fail: v4l2-test-media.cpp(394): num_data_links != num_links
	test MEDIA_IOC_ENUM_ENTITIES/LINKS: FAIL

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/uvc/uvc_driver.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 282f3d2388cc..447b6a198926 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -2065,6 +2065,7 @@ int uvc_register_video_device(struct uvc_device *dev,
 			      const struct v4l2_file_operations *fops,
 			      const struct v4l2_ioctl_ops *ioctl_ops)
 {
+	const char *name;
 	int ret;
 
 	/* Initialize the video buffers queue. */
@@ -2093,16 +2094,20 @@ int uvc_register_video_device(struct uvc_device *dev,
 	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
 	default:
 		vdev->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
+		name = "Video Capture";
 		break;
 	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
 		vdev->device_caps = V4L2_CAP_VIDEO_OUTPUT | V4L2_CAP_STREAMING;
+		name = "Video Output";
 		break;
 	case V4L2_BUF_TYPE_META_CAPTURE:
 		vdev->device_caps = V4L2_CAP_META_CAPTURE | V4L2_CAP_STREAMING;
+		name = "Metadata";
 		break;
 	}
 
-	strscpy(vdev->name, dev->name, sizeof(vdev->name));
+	snprintf(vdev->name, sizeof(vdev->name), "%s %u", name,
+		 stream->header.bTerminalLink);
 
 	/*
 	 * Set the driver data before calling video_register_device, otherwise

From b570e36a779c981267400a40895dff42de1346e5 Mon Sep 17 00:00:00 2001
From: Tuo Li <islituo@gmail.com>
Date: Thu, 5 Aug 2021 09:55:35 +0200
Subject: [PATCH 1346/1750] media: s5p-mfc: fix possible null-pointer
 dereference in s5p_mfc_probe()

[ Upstream commit 8515965e5e33f4feb56134348c95953f3eadfb26 ]

The variable pdev is assigned to dev->plat_dev, and dev->plat_dev is
checked in:
  if (!dev->plat_dev)

This indicates both dev->plat_dev and pdev can be NULL. If so, the
function dev_err() is called to print error information.
  dev_err(&pdev->dev, "No platform data specified\n");

However, &pdev->dev is an illegal address, and it is dereferenced in
dev_err().

To fix this possible null-pointer dereference, replace dev_err() with
mfc_err().

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-mfc/s5p_mfc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index eba2b9f040df..c763c0a03140 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1283,7 +1283,7 @@ static int s5p_mfc_probe(struct platform_device *pdev)
 	spin_lock_init(&dev->condlock);
 	dev->plat_dev = pdev;
 	if (!dev->plat_dev) {
-		dev_err(&pdev->dev, "No platform data specified\n");
+		mfc_err("No platform data specified\n");
 		return -ENODEV;
 	}
 

From a62edd8390ecef22fb9e7c1647926799620a6b9a Mon Sep 17 00:00:00 2001
From: Nadezda Lutovinova <lutovinova@ispras.ru>
Date: Wed, 11 Aug 2021 15:32:28 +0200
Subject: [PATCH 1347/1750] media: s5p-mfc: Add checking to s5p_mfc_probe().

[ Upstream commit cdfaf4752e6915a4b455ad4400133e540e4dc965 ]

If of_device_get_match_data() return NULL,
then null pointer dereference occurs in  s5p_mfc_init_pm().
The patch adds checking if dev->variant is NULL.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/s5p-mfc/s5p_mfc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index c763c0a03140..f336a9543273 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -1288,6 +1288,10 @@ static int s5p_mfc_probe(struct platform_device *pdev)
 	}
 
 	dev->variant = of_device_get_match_data(&pdev->dev);
+	if (!dev->variant) {
+		dev_err(&pdev->dev, "Failed to get device MFC hardware variant information\n");
+		return -ENOENT;
+	}
 
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	dev->regs_base = devm_ioremap_resource(&pdev->dev, res);

From 40b8e7dee544c067ed63488de026f4d1fc025dea Mon Sep 17 00:00:00 2001
From: Martin Kepplinger <martin.kepplinger@puri.sm>
Date: Wed, 8 Sep 2021 10:47:46 +0200
Subject: [PATCH 1348/1750] media: imx: set a media_device bus_info string

[ Upstream commit 6d0d779b212c27293d9ccb4da092ff0ccb6efa39 ]

Some tools like v4l2-compliance let users select a media device based
on the bus_info string which can be quite convenient. Use a unique
string for that.

This also fixes the following v4l2-compliance warning:
warn: v4l2-test-media.cpp(52): empty bus_info

Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/imx/imx-media-dev-common.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/media/imx/imx-media-dev-common.c b/drivers/staging/media/imx/imx-media-dev-common.c
index 5fe4b22ab847..7e0d769566bd 100644
--- a/drivers/staging/media/imx/imx-media-dev-common.c
+++ b/drivers/staging/media/imx/imx-media-dev-common.c
@@ -363,6 +363,8 @@ struct imx_media_dev *imx_media_dev_init(struct device *dev,
 	imxmd->v4l2_dev.notify = imx_media_notify;
 	strscpy(imxmd->v4l2_dev.name, "imx-media",
 		sizeof(imxmd->v4l2_dev.name));
+	snprintf(imxmd->md.bus_info, sizeof(imxmd->md.bus_info),
+		 "platform:%s", dev_name(imxmd->md.dev));
 
 	media_device_init(&imxmd->md);
 

From 2709971f9f60e49c805c7da4a0e85664f5532e58 Mon Sep 17 00:00:00 2001
From: Rajat Asthana <rajatasthana4@gmail.com>
Date: Wed, 18 Aug 2021 22:31:10 +0200
Subject: [PATCH 1349/1750] media: mceusb: return without resubmitting URB in
 case of -EPROTO error.

[ Upstream commit 476db72e521983ecb847e4013b263072bb1110fc ]

Syzkaller reported a warning called "rcu detected stall in dummy_timer".

The error seems to be an error in mceusb_dev_recv(). In the case of
-EPROTO error, the routine immediately resubmits the URB. Instead it
should return without resubmitting URB.

Reported-by: syzbot+4d3749e9612c2cfab956@syzkaller.appspotmail.com
Signed-off-by: Rajat Asthana <rajatasthana4@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/mceusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 5642595a057e..8870c4e6c5f4 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1386,6 +1386,7 @@ static void mceusb_dev_recv(struct urb *urb)
 	case -ECONNRESET:
 	case -ENOENT:
 	case -EILSEQ:
+	case -EPROTO:
 	case -ESHUTDOWN:
 		usb_unlink_urb(urb);
 		return;

From d506a3d60df938d82fcaa875475bfad759941554 Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sun, 26 Sep 2021 10:12:24 -0700
Subject: [PATCH 1350/1750] ia64: don't do IA64_CMPXCHG_DEBUG without
 CONFIG_PRINTK

[ Upstream commit c15b5fc054c3d6c97e953617605235c5cb8ce979 ]

When CONFIG_PRINTK is not set, the CMPXCHG_BUGCHECK() macro calls
_printk(), but _printk() is a static inline function, not available
as an extern.
Since the purpose of the macro is to print the BUGCHECK info,
make this config option depend on PRINTK.

Fixes multiple occurrences of this build error:

../include/linux/printk.h:208:5: error: static declaration of '_printk' follows non-static declaration
  208 | int _printk(const char *s, ...)
      |     ^~~~~~~
In file included from ../arch/ia64/include/asm/cmpxchg.h:5,
../arch/ia64/include/uapi/asm/cmpxchg.h:146:28: note: previous declaration of '_printk' with type 'int(const char *, ...)'
  146 |                 extern int _printk(const char *fmt, ...);

Cc: linux-ia64@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tony Luck <tony.luck@intel.com>
Cc: Chris Down <chris@chrisdown.name>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/ia64/Kconfig.debug | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/ia64/Kconfig.debug b/arch/ia64/Kconfig.debug
index 40ca23bd228d..2ce008e2d164 100644
--- a/arch/ia64/Kconfig.debug
+++ b/arch/ia64/Kconfig.debug
@@ -39,7 +39,7 @@ config DISABLE_VHPT
 
 config IA64_DEBUG_CMPXCHG
 	bool "Turn on compare-and-exchange bug checking (slow!)"
-	depends on DEBUG_KERNEL
+	depends on DEBUG_KERNEL && PRINTK
 	help
 	  Selecting this option turns on bug checking for the IA-64
 	  compare-and-exchange instructions.  This is slow!  Itaniums

From 7d54f52d8fdb95eb4ca7c7c917186591edb56377 Mon Sep 17 00:00:00 2001
From: Zong-Zhe Yang <kevin_yang@realtek.com>
Date: Mon, 27 Sep 2021 19:18:30 +0800
Subject: [PATCH 1351/1750] rtw88: fix RX clock gate setting while fifo dump

[ Upstream commit c5a8e90730a322f236731fc347dd3afa5db5550e ]

When fw fifo dumps, RX clock gating should be disabled to avoid
something unexpected. However, the register operation ran into
a mistake. So, we fix it.

Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210927111830.5354-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/realtek/rtw88/fw.c  | 7 +++----
 drivers/net/wireless/realtek/rtw88/reg.h | 1 +
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c
index 0452630bcfac..40bcfabd2d21 100644
--- a/drivers/net/wireless/realtek/rtw88/fw.c
+++ b/drivers/net/wireless/realtek/rtw88/fw.c
@@ -1421,12 +1421,10 @@ static void rtw_fw_read_fifo_page(struct rtw_dev *rtwdev, u32 offset, u32 size,
 	u32 i;
 	u16 idx = 0;
 	u16 ctl;
-	u8 rcr;
 
-	rcr = rtw_read8(rtwdev, REG_RCR + 2);
 	ctl = rtw_read16(rtwdev, REG_PKTBUF_DBG_CTRL) & 0xf000;
 	/* disable rx clock gate */
-	rtw_write8(rtwdev, REG_RCR, rcr | BIT(3));
+	rtw_write32_set(rtwdev, REG_RCR, BIT_DISGCLK);
 
 	do {
 		rtw_write16(rtwdev, REG_PKTBUF_DBG_CTRL, start_pg | ctl);
@@ -1445,7 +1443,8 @@ static void rtw_fw_read_fifo_page(struct rtw_dev *rtwdev, u32 offset, u32 size,
 
 out:
 	rtw_write16(rtwdev, REG_PKTBUF_DBG_CTRL, ctl);
-	rtw_write8(rtwdev, REG_RCR + 2, rcr);
+	/* restore rx clock gate */
+	rtw_write32_clr(rtwdev, REG_RCR, BIT_DISGCLK);
 }
 
 static void rtw_fw_read_fifo(struct rtw_dev *rtwdev, enum rtw_fw_fifo_sel sel,
diff --git a/drivers/net/wireless/realtek/rtw88/reg.h b/drivers/net/wireless/realtek/rtw88/reg.h
index aca3dbdc2d5a..9088bfb2a315 100644
--- a/drivers/net/wireless/realtek/rtw88/reg.h
+++ b/drivers/net/wireless/realtek/rtw88/reg.h
@@ -400,6 +400,7 @@
 #define BIT_MFBEN		BIT(22)
 #define BIT_DISCHKPPDLLEN	BIT(21)
 #define BIT_PKTCTL_DLEN		BIT(20)
+#define BIT_DISGCLK		BIT(19)
 #define BIT_TIM_PARSER_EN	BIT(18)
 #define BIT_BC_MD_EN		BIT(17)
 #define BIT_UC_MD_EN		BIT(16)

From 3d5575b3f536adfc2189e79a783a28a930730c81 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Tue, 28 Sep 2021 18:06:33 +0200
Subject: [PATCH 1352/1750] brcmfmac: Add DMI nvram filename quirk for
 Cyberbook T116 tablet

[ Upstream commit 49c3eb3036e6359c5c20fe76c611a2c0e0d4710e ]

The Cyberbook T116 tablet contains quite generic names in the sys_vendor
and product_name DMI strings, without this patch brcmfmac will try to load:
"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
is way too generic.

The nvram file shipped on the factory Android image contains the exact
same settings as those used on the AcePC T8 mini PC, so point the new
DMI nvram filename quirk to the acepc-t8 nvram file.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210928160633.96928-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
index 6d5188b78f2d..0af452dca766 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
@@ -75,6 +75,16 @@ static const struct dmi_system_id dmi_platform_data[] = {
 		},
 		.driver_data = (void *)&acepc_t8_data,
 	},
+	{
+		/* Cyberbook T116 rugged tablet */
+		.matches = {
+			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
+			DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
+			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"),
+		},
+		/* The factory image nvram file is identical to the ACEPC T8 one */
+		.driver_data = (void *)&acepc_t8_data,
+	},
 	{
 		/* Match for the GPDwin which unfortunately uses somewhat
 		 * generic dmi strings, which is why we test for 4 strings.

From 1f38e5e803df5acf8438c2891d01410b333fc19b Mon Sep 17 00:00:00 2001
From: Nadezda Lutovinova <lutovinova@ispras.ru>
Date: Wed, 11 Aug 2021 19:18:16 +0200
Subject: [PATCH 1353/1750] media: rcar-csi2: Add checking to
 rcsi2_start_receiver()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit fc41665498332ad394b7db37f23e9394096ddc71 ]

If rcsi2_code_to_fmt() return NULL, then null pointer dereference occurs
in the next cycle. That should not be possible now but adding checking
protects from future bugs.
The patch adds checking if format is NULL.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar-vin/rcar-csi2.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c
index 79f229756805..d2d87a204e91 100644
--- a/drivers/media/platform/rcar-vin/rcar-csi2.c
+++ b/drivers/media/platform/rcar-vin/rcar-csi2.c
@@ -544,6 +544,8 @@ static int rcsi2_start_receiver(struct rcar_csi2 *priv)
 
 	/* Code is validated in set_fmt. */
 	format = rcsi2_code_to_fmt(priv->mf.code);
+	if (!format)
+		return -EINVAL;
 
 	/*
 	 * Enable all supported CSI-2 channels with virtual channel and

From 6e242c557ad5d827dacba8ad9b03e90ebeb78581 Mon Sep 17 00:00:00 2001
From: Corey Minyard <cminyard@mvista.com>
Date: Thu, 16 Sep 2021 11:36:20 -0500
Subject: [PATCH 1354/1750] ipmi: Disable some operations during a panic

[ Upstream commit b36eb5e7b75a756baa64909a176dd4269ee05a8b ]

Don't do kfree or other risky things when oops_in_progress is set.
It's easy enough to avoid doing them

Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/ipmi/ipmi_msghandler.c | 10 +++++++---
 drivers/char/ipmi/ipmi_watchdog.c   | 17 ++++++++++++-----
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 8774a3b8ff95..abb865b1dff2 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -4802,7 +4802,9 @@ static atomic_t recv_msg_inuse_count = ATOMIC_INIT(0);
 static void free_smi_msg(struct ipmi_smi_msg *msg)
 {
 	atomic_dec(&smi_msg_inuse_count);
-	kfree(msg);
+	/* Try to keep as much stuff out of the panic path as possible. */
+	if (!oops_in_progress)
+		kfree(msg);
 }
 
 struct ipmi_smi_msg *ipmi_alloc_smi_msg(void)
@@ -4821,7 +4823,9 @@ EXPORT_SYMBOL(ipmi_alloc_smi_msg);
 static void free_recv_msg(struct ipmi_recv_msg *msg)
 {
 	atomic_dec(&recv_msg_inuse_count);
-	kfree(msg);
+	/* Try to keep as much stuff out of the panic path as possible. */
+	if (!oops_in_progress)
+		kfree(msg);
 }
 
 static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
@@ -4839,7 +4843,7 @@ static struct ipmi_recv_msg *ipmi_alloc_recv_msg(void)
 
 void ipmi_free_recv_msg(struct ipmi_recv_msg *msg)
 {
-	if (msg->user)
+	if (msg->user && !oops_in_progress)
 		kref_put(&msg->user->refcount, free_user);
 	msg->done(msg);
 }
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index 6384510c48d6..92eda5b2f134 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -342,13 +342,17 @@ static atomic_t msg_tofree = ATOMIC_INIT(0);
 static DECLARE_COMPLETION(msg_wait);
 static void msg_free_smi(struct ipmi_smi_msg *msg)
 {
-	if (atomic_dec_and_test(&msg_tofree))
-		complete(&msg_wait);
+	if (atomic_dec_and_test(&msg_tofree)) {
+		if (!oops_in_progress)
+			complete(&msg_wait);
+	}
 }
 static void msg_free_recv(struct ipmi_recv_msg *msg)
 {
-	if (atomic_dec_and_test(&msg_tofree))
-		complete(&msg_wait);
+	if (atomic_dec_and_test(&msg_tofree)) {
+		if (!oops_in_progress)
+			complete(&msg_wait);
+	}
 }
 static struct ipmi_smi_msg smi_msg = {
 	.done = msg_free_smi
@@ -434,8 +438,10 @@ static int _ipmi_set_timeout(int do_heartbeat)
 	rv = __ipmi_set_timeout(&smi_msg,
 				&recv_msg,
 				&send_heartbeat_now);
-	if (rv)
+	if (rv) {
+		atomic_set(&msg_tofree, 0);
 		return rv;
+	}
 
 	wait_for_completion(&msg_wait);
 
@@ -580,6 +586,7 @@ static int __ipmi_heartbeat(void)
 				      &recv_msg,
 				      1);
 	if (rv) {
+		atomic_set(&msg_tofree, 0);
 		pr_warn("heartbeat send failure: %d\n", rv);
 		return rv;
 	}

From f09e1a2d2c74ff5bdeb6b0ad63435ee0eb9c4263 Mon Sep 17 00:00:00 2001
From: Josh Don <joshdon@google.com>
Date: Fri, 27 Aug 2021 09:54:38 -0700
Subject: [PATCH 1355/1750] fs/proc/uptime.c: Fix idle time reporting in
 /proc/uptime

[ Upstream commit a130e8fbc7de796eb6e680724d87f4737a26d0ac ]

/proc/uptime reports idle time by reading the CPUTIME_IDLE field from
the per-cpu kcpustats. However, on NO_HZ systems, idle time is not
continually updated on idle cpus, leading this value to appear
incorrectly small.

/proc/stat performs an accounting update when reading idle time; we
can use the same approach for uptime.

With this patch, /proc/stat and /proc/uptime now agree on idle time.
Additionally, the following shows idle time tick up consistently on an
idle machine:

  (while true; do cat /proc/uptime; sleep 1; done) | awk '{print $2-prev; prev=$2}'

Reported-by: Luigi Rizzo <lrizzo@google.com>
Signed-off-by: Josh Don <joshdon@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lkml.kernel.org/r/20210827165438.3280779-1-joshdon@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/proc/stat.c              |  4 ++--
 fs/proc/uptime.c            | 14 +++++++++-----
 include/linux/kernel_stat.h |  1 +
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index 4695b6de3151..3bed48d8228b 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -23,7 +23,7 @@
 
 #ifdef arch_idle_time
 
-static u64 get_idle_time(struct kernel_cpustat *kcs, int cpu)
+u64 get_idle_time(struct kernel_cpustat *kcs, int cpu)
 {
 	u64 idle;
 
@@ -45,7 +45,7 @@ static u64 get_iowait_time(struct kernel_cpustat *kcs, int cpu)
 
 #else
 
-static u64 get_idle_time(struct kernel_cpustat *kcs, int cpu)
+u64 get_idle_time(struct kernel_cpustat *kcs, int cpu)
 {
 	u64 idle, idle_usecs = -1ULL;
 
diff --git a/fs/proc/uptime.c b/fs/proc/uptime.c
index 5a1b228964fb..deb99bc9b7e6 100644
--- a/fs/proc/uptime.c
+++ b/fs/proc/uptime.c
@@ -12,18 +12,22 @@ static int uptime_proc_show(struct seq_file *m, void *v)
 {
 	struct timespec64 uptime;
 	struct timespec64 idle;
-	u64 nsec;
+	u64 idle_nsec;
 	u32 rem;
 	int i;
 
-	nsec = 0;
-	for_each_possible_cpu(i)
-		nsec += (__force u64) kcpustat_cpu(i).cpustat[CPUTIME_IDLE];
+	idle_nsec = 0;
+	for_each_possible_cpu(i) {
+		struct kernel_cpustat kcs;
+
+		kcpustat_cpu_fetch(&kcs, i);
+		idle_nsec += get_idle_time(&kcs, i);
+	}
 
 	ktime_get_boottime_ts64(&uptime);
 	timens_add_boottime(&uptime);
 
-	idle.tv_sec = div_u64_rem(nsec, NSEC_PER_SEC, &rem);
+	idle.tv_sec = div_u64_rem(idle_nsec, NSEC_PER_SEC, &rem);
 	idle.tv_nsec = rem;
 	seq_printf(m, "%lu.%02lu %lu.%02lu\n",
 			(unsigned long) uptime.tv_sec,
diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
index 89f0745c096d..8fff3500d50e 100644
--- a/include/linux/kernel_stat.h
+++ b/include/linux/kernel_stat.h
@@ -103,6 +103,7 @@ extern void account_system_index_time(struct task_struct *, u64,
 				      enum cpu_usage_stat);
 extern void account_steal_time(u64);
 extern void account_idle_time(u64);
+extern u64 get_idle_time(struct kernel_cpustat *kcs, int cpu);
 
 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
 static inline void account_process_tick(struct task_struct *tsk, int user)

From 272e54604cf7f9420d907c39d977e08e0f7ffde5 Mon Sep 17 00:00:00 2001
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Date: Wed, 29 Sep 2021 18:31:25 +0200
Subject: [PATCH 1356/1750] ACPICA: Avoid evaluating methods too early during
 system resume

[ Upstream commit d3c4b6f64ad356c0d9ddbcf73fa471e6a841cc5c ]

ACPICA commit 0762982923f95eb652cf7ded27356b247c9774de

During wakeup from system-wide sleep states, acpi_get_sleep_type_data()
is called and it tries to get memory from the slab allocator in order
to evaluate a control method, but if KFENCE is enabled in the kernel,
the memory allocation attempt causes an IRQ work to be queued and a
self-IPI to be sent to the CPU running the code which requires the
memory controller to be ready, so if that happens too early in the
wakeup path, it doesn't work.

Prevent that from taking place by calling acpi_get_sleep_type_data()
for S0 upfront, when preparing to enter a given sleep state, and
saving the data obtained by it for later use during system wakeup.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=214271
Reported-by: Reik Keutterling <spielkind@gmail.com>
Tested-by: Reik Keutterling <spielkind@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/acpica/acglobal.h  |  2 ++
 drivers/acpi/acpica/hwesleep.c  |  8 ++------
 drivers/acpi/acpica/hwsleep.c   | 11 ++++-------
 drivers/acpi/acpica/hwxfsleep.c |  7 +++++++
 4 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/drivers/acpi/acpica/acglobal.h b/drivers/acpi/acpica/acglobal.h
index 2fee91f57b21..bd84d7f95e5f 100644
--- a/drivers/acpi/acpica/acglobal.h
+++ b/drivers/acpi/acpica/acglobal.h
@@ -226,6 +226,8 @@ extern struct acpi_bit_register_info
     acpi_gbl_bit_register_info[ACPI_NUM_BITREG];
 ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a);
 ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b);
+ACPI_GLOBAL(u8, acpi_gbl_sleep_type_a_s0);
+ACPI_GLOBAL(u8, acpi_gbl_sleep_type_b_s0);
 
 /*****************************************************************************
  *
diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c
index d9be5d0545d4..4836a4b8b38b 100644
--- a/drivers/acpi/acpica/hwesleep.c
+++ b/drivers/acpi/acpica/hwesleep.c
@@ -147,17 +147,13 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state)
 
 acpi_status acpi_hw_extended_wake_prep(u8 sleep_state)
 {
-	acpi_status status;
 	u8 sleep_type_value;
 
 	ACPI_FUNCTION_TRACE(hw_extended_wake_prep);
 
-	status = acpi_get_sleep_type_data(ACPI_STATE_S0,
-					  &acpi_gbl_sleep_type_a,
-					  &acpi_gbl_sleep_type_b);
-	if (ACPI_SUCCESS(status)) {
+	if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) {
 		sleep_type_value =
-		    ((acpi_gbl_sleep_type_a << ACPI_X_SLEEP_TYPE_POSITION) &
+		    ((acpi_gbl_sleep_type_a_s0 << ACPI_X_SLEEP_TYPE_POSITION) &
 		     ACPI_X_SLEEP_TYPE_MASK);
 
 		(void)acpi_write((u64)(sleep_type_value | ACPI_X_SLEEP_ENABLE),
diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c
index 317ae870336b..fcc84d196238 100644
--- a/drivers/acpi/acpica/hwsleep.c
+++ b/drivers/acpi/acpica/hwsleep.c
@@ -179,7 +179,7 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state)
 
 acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
 {
-	acpi_status status;
+	acpi_status status = AE_OK;
 	struct acpi_bit_register_info *sleep_type_reg_info;
 	struct acpi_bit_register_info *sleep_enable_reg_info;
 	u32 pm1a_control;
@@ -192,10 +192,7 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
 	 * This is unclear from the ACPI Spec, but it is required
 	 * by some machines.
 	 */
-	status = acpi_get_sleep_type_data(ACPI_STATE_S0,
-					  &acpi_gbl_sleep_type_a,
-					  &acpi_gbl_sleep_type_b);
-	if (ACPI_SUCCESS(status)) {
+	if (acpi_gbl_sleep_type_a_s0 != ACPI_SLEEP_TYPE_INVALID) {
 		sleep_type_reg_info =
 		    acpi_hw_get_bit_register_info(ACPI_BITREG_SLEEP_TYPE);
 		sleep_enable_reg_info =
@@ -216,9 +213,9 @@ acpi_status acpi_hw_legacy_wake_prep(u8 sleep_state)
 
 			/* Insert the SLP_TYP bits */
 
-			pm1a_control |= (acpi_gbl_sleep_type_a <<
+			pm1a_control |= (acpi_gbl_sleep_type_a_s0 <<
 					 sleep_type_reg_info->bit_position);
-			pm1b_control |= (acpi_gbl_sleep_type_b <<
+			pm1b_control |= (acpi_gbl_sleep_type_b_s0 <<
 					 sleep_type_reg_info->bit_position);
 
 			/* Write the control registers and ignore any errors */
diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
index a4b66f4b2714..f1645d87864c 100644
--- a/drivers/acpi/acpica/hwxfsleep.c
+++ b/drivers/acpi/acpica/hwxfsleep.c
@@ -217,6 +217,13 @@ acpi_status acpi_enter_sleep_state_prep(u8 sleep_state)
 		return_ACPI_STATUS(status);
 	}
 
+	status = acpi_get_sleep_type_data(ACPI_STATE_S0,
+					  &acpi_gbl_sleep_type_a_s0,
+					  &acpi_gbl_sleep_type_b_s0);
+	if (ACPI_FAILURE(status)) {
+		acpi_gbl_sleep_type_a_s0 = ACPI_SLEEP_TYPE_INVALID;
+	}
+
 	/* Execute the _PTS method (Prepare To Sleep) */
 
 	arg_list.count = 1;

From b499d405716061def13c61b74fdcba9ab74801ee Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Thu, 7 Oct 2021 00:26:21 +0200
Subject: [PATCH 1357/1750] media: ipu3-imgu: imgu_fmt: Handle properly try

[ Upstream commit 553481e38045f349bb9aa596d03bebd020020c9c ]

For a try_fmt call, the node noes not need to be enabled.

Fixes v4l2-compliance

fail: v4l2-test-formats.cpp(717): Video Output Multiplanar is valid, but
				  no TRY_FMT was implemented
test VIDIOC_TRY_FMT: FAIL

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/ipu3/ipu3-v4l2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c
index e0179616a29c..7926a777cbc8 100644
--- a/drivers/staging/media/ipu3/ipu3-v4l2.c
+++ b/drivers/staging/media/ipu3/ipu3-v4l2.c
@@ -696,7 +696,7 @@ static int imgu_fmt(struct imgu_device *imgu, unsigned int pipe, int node,
 
 		/* CSS expects some format on OUT queue */
 		if (i != IPU3_CSS_QUEUE_OUT &&
-		    !imgu_pipe->nodes[inode].enabled) {
+		    !imgu_pipe->nodes[inode].enabled && !try) {
 			fmts[i] = NULL;
 			continue;
 		}

From e3bc3e114135b6c450f5d4926db6141506dbfc69 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Thu, 7 Oct 2021 00:26:22 +0200
Subject: [PATCH 1358/1750] media: ipu3-imgu: VIDIOC_QUERYCAP: Fix bus_info

[ Upstream commit ea2b9a33711604e91f8c826f4dcb3c12baa1990a ]

bus_info field had a different value for the media entity and the video
device.

Fixes v4l2-compliance:

v4l2-compliance.cpp(637): media bus_info 'PCI:0000:00:05.0' differs from
			  V4L2 bus_info 'PCI:viewfinder'

Reviewed-by: Bingbu Cao <bingbu.cao@intel.com>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/ipu3/ipu3-v4l2.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/media/ipu3/ipu3-v4l2.c b/drivers/staging/media/ipu3/ipu3-v4l2.c
index 7926a777cbc8..103f84466f6f 100644
--- a/drivers/staging/media/ipu3/ipu3-v4l2.c
+++ b/drivers/staging/media/ipu3/ipu3-v4l2.c
@@ -592,11 +592,12 @@ static const struct imgu_fmt *find_format(struct v4l2_format *f, u32 type)
 static int imgu_vidioc_querycap(struct file *file, void *fh,
 				struct v4l2_capability *cap)
 {
-	struct imgu_video_device *node = file_to_intel_imgu_node(file);
+	struct imgu_device *imgu = video_drvdata(file);
 
 	strscpy(cap->driver, IMGU_NAME, sizeof(cap->driver));
 	strscpy(cap->card, IMGU_NAME, sizeof(cap->card));
-	snprintf(cap->bus_info, sizeof(cap->bus_info), "PCI:%s", node->name);
+	snprintf(cap->bus_info, sizeof(cap->bus_info), "PCI:%s",
+		 pci_name(imgu->pci_dev));
 
 	return 0;
 }

From b94e5bd540f4387fb7833509816ae02cc816a65a Mon Sep 17 00:00:00 2001
From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Date: Mon, 7 Dec 2020 07:16:06 +0100
Subject: [PATCH 1359/1750] media: usb: dvd-usb: fix uninit-value bug in
 dibusb_read_eeprom_byte()

[ Upstream commit 899a61a3305d49e8a712e9ab20d0db94bde5929f ]

In dibusb_read_eeprom_byte(), if dibusb_i2c_msg() fails, val gets
assigned an value that's not properly initialized.
Using kzalloc() in place of kmalloc() for the buffer fixes this issue,
as the val can now be set to 0 in the event dibusb_i2c_msg() fails.

Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com
Tested-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/dibusb-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c
index 02b51d1a1b67..aff60c10cb0b 100644
--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -223,7 +223,7 @@ int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val)
 	u8 *buf;
 	int rc;
 
-	buf = kmalloc(2, GFP_KERNEL);
+	buf = kzalloc(2, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 

From 8524501a0e7af259779c556a2fda2ff2dd47c992 Mon Sep 17 00:00:00 2001
From: Antoine Tenart <atenart@kernel.org>
Date: Thu, 7 Oct 2021 16:00:51 +0200
Subject: [PATCH 1360/1750] net-sysfs: try not to restart the syscall if it
 will fail eventually

[ Upstream commit 146e5e733310379f51924111068f08a3af0db830 ]

Due to deadlocks in the networking subsystem spotted 12 years ago[1],
a workaround was put in place[2] to avoid taking the rtnl lock when it
was not available and restarting the syscall (back to VFS, letting
userspace spin). The following construction is found a lot in the net
sysfs and sysctl code:

  if (!rtnl_trylock())
          return restart_syscall();

This can be problematic when multiple userspace threads use such
interfaces in a short period, making them to spin a lot. This happens
for example when adding and moving virtual interfaces: userspace
programs listening on events, such as systemd-udevd and NetworkManager,
do trigger actions reading files in sysfs. It gets worse when a lot of
virtual interfaces are created concurrently, say when creating
containers at boot time.

Returning early without hitting the above pattern when the syscall will
fail eventually does make things better. While it is not a fix for the
issue, it does ease things.

[1] https://lore.kernel.org/netdev/49A4D5D5.5090602@trash.net/
    https://lore.kernel.org/netdev/m14oyhis31.fsf@fess.ebiederm.org/
    and https://lore.kernel.org/netdev/20090226084924.16cb3e08@nehalam/
[2] Rightfully, those deadlocks are *hard* to solve.

Signed-off-by: Antoine Tenart <atenart@kernel.org>
Reviewed-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/net-sysfs.c | 55 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index cc5f760c7825..af5912360105 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -175,6 +175,14 @@ static int change_carrier(struct net_device *dev, unsigned long new_carrier)
 static ssize_t carrier_store(struct device *dev, struct device_attribute *attr,
 			     const char *buf, size_t len)
 {
+	struct net_device *netdev = to_net_dev(dev);
+
+	/* The check is also done in change_carrier; this helps returning early
+	 * without hitting the trylock/restart in netdev_store.
+	 */
+	if (!netdev->netdev_ops->ndo_change_carrier)
+		return -EOPNOTSUPP;
+
 	return netdev_store(dev, attr, buf, len, change_carrier);
 }
 
@@ -196,6 +204,12 @@ static ssize_t speed_show(struct device *dev,
 	struct net_device *netdev = to_net_dev(dev);
 	int ret = -EINVAL;
 
+	/* The check is also done in __ethtool_get_link_ksettings; this helps
+	 * returning early without hitting the trylock/restart below.
+	 */
+	if (!netdev->ethtool_ops->get_link_ksettings)
+		return ret;
+
 	if (!rtnl_trylock())
 		return restart_syscall();
 
@@ -216,6 +230,12 @@ static ssize_t duplex_show(struct device *dev,
 	struct net_device *netdev = to_net_dev(dev);
 	int ret = -EINVAL;
 
+	/* The check is also done in __ethtool_get_link_ksettings; this helps
+	 * returning early without hitting the trylock/restart below.
+	 */
+	if (!netdev->ethtool_ops->get_link_ksettings)
+		return ret;
+
 	if (!rtnl_trylock())
 		return restart_syscall();
 
@@ -468,6 +488,14 @@ static ssize_t proto_down_store(struct device *dev,
 				struct device_attribute *attr,
 				const char *buf, size_t len)
 {
+	struct net_device *netdev = to_net_dev(dev);
+
+	/* The check is also done in change_proto_down; this helps returning
+	 * early without hitting the trylock/restart in netdev_store.
+	 */
+	if (!netdev->netdev_ops->ndo_change_proto_down)
+		return -EOPNOTSUPP;
+
 	return netdev_store(dev, attr, buf, len, change_proto_down);
 }
 NETDEVICE_SHOW_RW(proto_down, fmt_dec);
@@ -478,6 +506,12 @@ static ssize_t phys_port_id_show(struct device *dev,
 	struct net_device *netdev = to_net_dev(dev);
 	ssize_t ret = -EINVAL;
 
+	/* The check is also done in dev_get_phys_port_id; this helps returning
+	 * early without hitting the trylock/restart below.
+	 */
+	if (!netdev->netdev_ops->ndo_get_phys_port_id)
+		return -EOPNOTSUPP;
+
 	if (!rtnl_trylock())
 		return restart_syscall();
 
@@ -500,6 +534,13 @@ static ssize_t phys_port_name_show(struct device *dev,
 	struct net_device *netdev = to_net_dev(dev);
 	ssize_t ret = -EINVAL;
 
+	/* The checks are also done in dev_get_phys_port_name; this helps
+	 * returning early without hitting the trylock/restart below.
+	 */
+	if (!netdev->netdev_ops->ndo_get_phys_port_name &&
+	    !netdev->netdev_ops->ndo_get_devlink_port)
+		return -EOPNOTSUPP;
+
 	if (!rtnl_trylock())
 		return restart_syscall();
 
@@ -522,6 +563,14 @@ static ssize_t phys_switch_id_show(struct device *dev,
 	struct net_device *netdev = to_net_dev(dev);
 	ssize_t ret = -EINVAL;
 
+	/* The checks are also done in dev_get_phys_port_name; this helps
+	 * returning early without hitting the trylock/restart below. This works
+	 * because recurse is false when calling dev_get_port_parent_id.
+	 */
+	if (!netdev->netdev_ops->ndo_get_port_parent_id &&
+	    !netdev->netdev_ops->ndo_get_devlink_port)
+		return -EOPNOTSUPP;
+
 	if (!rtnl_trylock())
 		return restart_syscall();
 
@@ -1179,6 +1228,12 @@ static ssize_t tx_maxrate_store(struct netdev_queue *queue,
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 
+	/* The check is also done later; this helps returning early without
+	 * hitting the trylock/restart below.
+	 */
+	if (!dev->netdev_ops->ndo_set_tx_maxrate)
+		return -EOPNOTSUPP;
+
 	err = kstrtou32(buf, 10, &rate);
 	if (err < 0)
 		return err;

From 3c2434d9a6c6807f84a7c7be9396588897e4f31f Mon Sep 17 00:00:00 2001
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
Date: Wed, 18 Aug 2021 11:24:50 -0400
Subject: [PATCH 1361/1750] tracefs: Have tracefs directories not set OTH
 permission bits by default

[ Upstream commit 49d67e445742bbcb03106b735b2ab39f6e5c56bc ]

The tracefs file system is by default mounted such that only root user can
access it. But there are legitimate reasons to create a group and allow
those added to the group to have access to tracing. By changing the
permissions of the tracefs mount point to allow access, it will allow
group access to the tracefs directory.

There should not be any real reason to allow all access to the tracefs
directory as it contains sensitive information. Have the default
permission of directories being created not have any OTH (other) bits set,
such that an admin that wants to give permission to a group has to first
disable all OTH bits in the file system.

Link: https://lkml.kernel.org/r/20210818153038.664127804@goodmis.org

Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/tracefs/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 0ee8c6dfb036..bf58ae6f984f 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -430,7 +430,8 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
 	if (unlikely(!inode))
 		return failed_creating(dentry);
 
-	inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
+	/* Do not set bits for OTH */
+	inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
 	inode->i_op = ops;
 	inode->i_fop = &simple_dir_operations;
 

From 38608d32adf08d7f9bf11f964e13fc7b14fde4c6 Mon Sep 17 00:00:00 2001
From: Tuo Li <islituo@gmail.com>
Date: Thu, 5 Aug 2021 08:38:53 -0700
Subject: [PATCH 1362/1750] ath: dfs_pattern_detector: Fix possible
 null-pointer dereference in channel_detector_create()

[ Upstream commit 4b6012a7830b813799a7faf40daa02a837e0fd5b ]

kzalloc() is used to allocate memory for cd->detectors, and if it fails,
channel_detector_exit() behind the label fail will be called:
  channel_detector_exit(dpd, cd);

In channel_detector_exit(), cd->detectors is dereferenced through:
  struct pri_detector *de = cd->detectors[i];

To fix this possible null-pointer dereference, check cd->detectors before
the for loop to dereference cd->detectors.

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Tuo Li <islituo@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210805153854.154066-1-islituo@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/dfs_pattern_detector.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
index 0813473793df..87369073098c 100644
--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
+++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
@@ -182,10 +182,12 @@ static void channel_detector_exit(struct dfs_pattern_detector *dpd,
 	if (cd == NULL)
 		return;
 	list_del(&cd->head);
-	for (i = 0; i < dpd->num_radar_types; i++) {
-		struct pri_detector *de = cd->detectors[i];
-		if (de != NULL)
-			de->exit(de);
+	if (cd->detectors) {
+		for (i = 0; i < dpd->num_radar_types; i++) {
+			struct pri_detector *de = cd->detectors[i];
+			if (de != NULL)
+				de->exit(de);
+		}
 	}
 	kfree(cd->detectors);
 	kfree(cd);

From 219df0f6bad4d301799c894e384e3832682d34f1 Mon Sep 17 00:00:00 2001
From: Xin Xiong <xiongx18@fudan.edu.cn>
Date: Sat, 9 Oct 2021 12:19:18 +0800
Subject: [PATCH 1363/1750] mmc: moxart: Fix reference count leaks in
 moxart_probe

[ Upstream commit 8105c2abbf36296bf38ca44f55ee45d160db476a ]

The issue happens in several error handling paths on two refcounted
object related to the object "host" (dma_chan_rx, dma_chan_tx). In
these paths, the function forgets to decrement one or both objects'
reference count increased earlier by dma_request_chan(), causing
reference count leaks.

Fix it by balancing the refcounts of both objects in some error
handling paths. In correspondence with the changes in moxart_probe(),
IS_ERR() is replaced with IS_ERR_OR_NULL() in moxart_remove() as well.

Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Link: https://lore.kernel.org/r/20211009041918.28419-1-xiongx18@fudan.edu.cn
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/moxart-mmc.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
index 2e4a7c6971dc..dcd128ecdf15 100644
--- a/drivers/mmc/host/moxart-mmc.c
+++ b/drivers/mmc/host/moxart-mmc.c
@@ -624,6 +624,14 @@ static int moxart_probe(struct platform_device *pdev)
 			ret = -EPROBE_DEFER;
 			goto out;
 		}
+		if (!IS_ERR(host->dma_chan_tx)) {
+			dma_release_channel(host->dma_chan_tx);
+			host->dma_chan_tx = NULL;
+		}
+		if (!IS_ERR(host->dma_chan_rx)) {
+			dma_release_channel(host->dma_chan_rx);
+			host->dma_chan_rx = NULL;
+		}
 		dev_dbg(dev, "PIO mode transfer enabled\n");
 		host->have_dma = false;
 	} else {
@@ -678,6 +686,10 @@ static int moxart_probe(struct platform_device *pdev)
 	return 0;
 
 out:
+	if (!IS_ERR_OR_NULL(host->dma_chan_tx))
+		dma_release_channel(host->dma_chan_tx);
+	if (!IS_ERR_OR_NULL(host->dma_chan_rx))
+		dma_release_channel(host->dma_chan_rx);
 	if (mmc)
 		mmc_free_host(mmc);
 	return ret;
@@ -690,9 +702,9 @@ static int moxart_remove(struct platform_device *pdev)
 
 	dev_set_drvdata(&pdev->dev, NULL);
 
-	if (!IS_ERR(host->dma_chan_tx))
+	if (!IS_ERR_OR_NULL(host->dma_chan_tx))
 		dma_release_channel(host->dma_chan_tx);
-	if (!IS_ERR(host->dma_chan_rx))
+	if (!IS_ERR_OR_NULL(host->dma_chan_rx))
 		dma_release_channel(host->dma_chan_rx);
 	mmc_remove_host(mmc);
 	mmc_free_host(mmc);

From b60086601832a8f8c05f7a833f2869aad21f2b50 Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruenba@redhat.com>
Date: Wed, 21 Jul 2021 19:03:47 +0200
Subject: [PATCH 1364/1750] iov_iter: Fix iov_iter_get_pages{,_alloc} page
 fault return value

[ Upstream commit 814a66741b9ffb5e1ba119e368b178edb0b7322d ]

Both iov_iter_get_pages and iov_iter_get_pages_alloc return the number
of bytes of the iovec they could get the pages for.  When they cannot
get any pages, they're supposed to return 0, but when the start of the
iovec isn't page aligned, the calculation goes wrong and they return a
negative value.  Fix both functions.

In addition, change iov_iter_get_pages_alloc to return NULL in that case
to prevent resource leaks.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/iov_iter.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 537bfdc8cd09..b364231b5fc8 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1343,7 +1343,7 @@ ssize_t iov_iter_get_pages(struct iov_iter *i,
 		res = get_user_pages_fast(addr, n,
 				iov_iter_rw(i) != WRITE ?  FOLL_WRITE : 0,
 				pages);
-		if (unlikely(res < 0))
+		if (unlikely(res <= 0))
 			return res;
 		return (res == n ? len : res * PAGE_SIZE) - *start;
 	0;}),({
@@ -1424,8 +1424,9 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
 			return -ENOMEM;
 		res = get_user_pages_fast(addr, n,
 				iov_iter_rw(i) != WRITE ?  FOLL_WRITE : 0, p);
-		if (unlikely(res < 0)) {
+		if (unlikely(res <= 0)) {
 			kvfree(p);
+			*pages = NULL;
 			return res;
 		}
 		*pages = p;

From 65c84e09e8d431c6c3273f118fedd4a46e67313c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9=20Almeida?= <andrealmeid@collabora.com>
Date: Fri, 8 Oct 2021 00:05:29 -0300
Subject: [PATCH 1365/1750] ACPI: battery: Accept charges over the design
 capacity as full
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 2835f327bd1240508db2c89fe94a056faa53c49a ]

Some buggy firmware and/or brand new batteries can support a charge that's
slightly over the reported design capacity. In such cases, the kernel will
report to userspace that the charging state of the battery is "Unknown",
when in reality the battery charge is "Full", at least from the design
capacity point of view. Make the fallback condition accepts capacities
over the designed capacity so userspace knows that is full.

Signed-off-by: André Almeida <andrealmeid@collabora.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/battery.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 08ee1c7b12e0..e04352c1dc2c 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -174,7 +174,7 @@ static int acpi_battery_is_charged(struct acpi_battery *battery)
 		return 1;
 
 	/* fallback to using design values for broken batteries */
-	if (battery->design_capacity == battery->capacity_now)
+	if (battery->design_capacity <= battery->capacity_now)
 		return 1;
 
 	/* we don't do any sort of metric based on percentages */

From 832fad367cac9ca075a1aff92e21dc77ea308e96 Mon Sep 17 00:00:00 2001
From: Yifan Zhang <yifan1.zhang@amd.com>
Date: Mon, 11 Oct 2021 20:42:31 +0800
Subject: [PATCH 1366/1750] drm/amdkfd: fix resume error when iommu disabled in
 Picasso

[ Upstream commit 6f4b590aae217da16cfa44039a2abcfb209137ab ]

When IOMMU disabled in sbios and kfd in iommuv2 path,
IOMMU resume failure blocks system resume. Don't allow kfd to
use iommu v2 when iommu is disabled.

Reported-by: youling <youling257@gmail.com>
Tested-by: youling <youling257@gmail.com>
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: James Zhu <James.Zhu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdkfd/kfd_device.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
index 903170e59342..5751bddc9cad 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c
@@ -744,6 +744,7 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd,
 	kfd_double_confirm_iommu_support(kfd);
 
 	if (kfd_iommu_device_init(kfd)) {
+		kfd->use_iommu_v2 = false;
 		dev_err(kfd_device, "Error initializing iommuv2\n");
 		goto device_iommu_error;
 	}

From 9101e2574b8153c80eb9056f86cfa4a853158f21 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
Date: Tue, 12 Oct 2021 12:34:02 +0200
Subject: [PATCH 1367/1750] net: phy: micrel: make *-skew-ps check more lenient

[ Upstream commit 67ca5159dbe2edb5dae7544447b8677d2596933a ]

It seems reasonable to fine-tune only some of the skew values when using
one of the rgmii-*id PHY modes, and even when all skew values are
specified, using the correct ID PHY mode makes sense for documentation
purposes. Such a configuration also appears in the binding docs in
Documentation/devicetree/bindings/net/micrel-ksz90x1.txt, so the driver
should not warn about it.

Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
Link: https://lore.kernel.org/r/20211012103402.21438-1-matthias.schiffer@ew.tq-group.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/micrel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 69b20a466c61..b341a8be09f9 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -732,9 +732,9 @@ static int ksz9031_config_init(struct phy_device *phydev)
 				MII_KSZ9031RN_TX_DATA_PAD_SKEW, 4,
 				tx_data_skews, 4, &update);
 
-		if (update && phydev->interface != PHY_INTERFACE_MODE_RGMII)
+		if (update && !phy_interface_is_rgmii(phydev))
 			phydev_warn(phydev,
-				    "*-skew-ps values should be used only with phy-mode = \"rgmii\"\n");
+				    "*-skew-ps values should be used only with RGMII PHY modes\n");
 
 		/* Silicon Errata Sheet (DS80000691D or DS80000692D):
 		 * When the device links in the 1000BASE-T slave mode only,

From e1d7f0202a9f038a59cc6ed954fdb4eba1324abe Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Wed, 29 Sep 2021 15:02:18 -0700
Subject: [PATCH 1368/1750] leaking_addresses: Always print a trailing newline

[ Upstream commit cf2a85efdade117e2169d6e26641016cbbf03ef0 ]

For files that lack trailing newlines and match a leaking address (e.g.
wchan[1]), the leaking_addresses.pl report would run together with the
next line, making things look corrupted.

Unconditionally remove the newline on input, and write it back out on
output.

[1] https://lore.kernel.org/all/20210103142726.GC30643@xsang-OptiPlex-9020/

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211008111626.151570317@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/leaking_addresses.pl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/leaking_addresses.pl b/scripts/leaking_addresses.pl
index b2d8b8aa2d99..8f636a23bc3f 100755
--- a/scripts/leaking_addresses.pl
+++ b/scripts/leaking_addresses.pl
@@ -455,8 +455,9 @@ sub parse_file
 
 	open my $fh, "<", $file or return;
 	while ( <$fh> ) {
+		chomp;
 		if (may_leak_address($_)) {
-			print $file . ': ' . $_;
+			printf("$file: $_\n");
 		}
 	}
 	close $fh;

From 517feec952ae3d728cea482fead1232a19b95078 Mon Sep 17 00:00:00 2001
From: Tim Gardner <tim.gardner@canonical.com>
Date: Wed, 29 Sep 2021 10:25:54 -0600
Subject: [PATCH 1369/1750] drm/msm: prevent NULL dereference in
 msm_gpu_crashstate_capture()

[ Upstream commit b220c154832c5cd0df34cbcbcc19d7135c16e823 ]

Coverity complains of a possible NULL dereference:

CID 120718 (#1 of 1): Dereference null return value (NULL_RETURNS)
23. dereference: Dereferencing a pointer that might be NULL state->bos when
    calling msm_gpu_crashstate_get_bo. [show details]
301                        msm_gpu_crashstate_get_bo(state, submit->bos[i].obj,
302                                submit->bos[i].iova, submit->bos[i].flags);

Fix this by employing the same state->bos NULL check as is used in the next
for loop.

Cc: Rob Clark <robdclark@gmail.com>
Cc: Sean Paul <sean@poorly.run>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: linux-arm-msm@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: freedreno@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210929162554.14295-1-tim.gardner@canonical.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_gpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c
index 55d16489d0f3..90c26da10902 100644
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -376,7 +376,7 @@ static void msm_gpu_crashstate_capture(struct msm_gpu *gpu,
 		state->bos = kcalloc(nr,
 			sizeof(struct msm_gpu_state_bo), GFP_KERNEL);
 
-		for (i = 0; i < submit->nr_bos; i++) {
+		for (i = 0; state->bos && i < submit->nr_bos; i++) {
 			if (should_dump(submit, i)) {
 				msm_gpu_crashstate_get_bo(state, submit->bos[i].obj,
 					submit->bos[i].iova, submit->bos[i].flags);

From b34ea3c91eacdc50c761506cab35b14f67216f76 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Wed, 6 Oct 2021 12:01:07 -0600
Subject: [PATCH 1370/1750] block: bump max plugged deferred size from 16 to 32

[ Upstream commit ba0ffdd8ce48ad7f7e85191cd29f9674caca3745 ]

Particularly for NVMe with efficient deferred submission for many
requests, there are nice benefits to be seen by bumping the default max
plug count from 16 to 32. This is especially true for virtualized setups,
where the submit part is more expensive. But can be noticed even on
native hardware.

Reduce the multiple queue factor from 4 to 2, since we're changing the
default size.

While changing it, move the defines into the block layer private header.
These aren't values that anyone outside of the block layer uses, or
should use.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c         | 4 ++--
 block/blk.h            | 6 ++++++
 include/linux/blkdev.h | 2 --
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 69cc552c3dfc..e4422a09b126 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2116,14 +2116,14 @@ static void blk_add_rq_to_plug(struct blk_plug *plug, struct request *rq)
 }
 
 /*
- * Allow 4x BLK_MAX_REQUEST_COUNT requests on plug queue for multiple
+ * Allow 2x BLK_MAX_REQUEST_COUNT requests on plug queue for multiple
  * queues. This is important for md arrays to benefit from merging
  * requests.
  */
 static inline unsigned short blk_plug_max_rq_count(struct blk_plug *plug)
 {
 	if (plug->multiple_queues)
-		return BLK_MAX_REQUEST_COUNT * 4;
+		return BLK_MAX_REQUEST_COUNT * 2;
 	return BLK_MAX_REQUEST_COUNT;
 }
 
diff --git a/block/blk.h b/block/blk.h
index f84c83300f6f..997941cd999f 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -188,6 +188,12 @@ bool blk_bio_list_merge(struct request_queue *q, struct list_head *list,
 void blk_account_io_start(struct request *req);
 void blk_account_io_done(struct request *req, u64 now);
 
+/*
+ * Plug flush limits
+ */
+#define BLK_MAX_REQUEST_COUNT	32
+#define BLK_PLUG_FLUSH_SIZE	(128 * 1024)
+
 /*
  * Internal elevator interface
  */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 8aae375864b6..4ba17736b614 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1248,8 +1248,6 @@ struct blk_plug {
 	bool multiple_queues;
 	bool nowait;
 };
-#define BLK_MAX_REQUEST_COUNT 16
-#define BLK_PLUG_FLUSH_SIZE (128 * 1024)
 
 struct blk_plug_cb;
 typedef void (*blk_plug_cb_fn)(struct blk_plug_cb *, bool);

From 2338c3501726895c1657adda2308fcf9e6f17449 Mon Sep 17 00:00:00 2001
From: Xiao Ni <xni@redhat.com>
Date: Wed, 13 Oct 2021 22:59:33 +0800
Subject: [PATCH 1371/1750] md: update superblock after changing rdev flags in
 state_store

[ Upstream commit 8b9e2291e355a0eafdd5b1e21a94a6659f24b351 ]

When the in memory flag is changed, we need to persist the change in the
rdev superblock flags. This is needed for "writemostly" and "failfast".

Reviewed-by: Li Feng <fengli@smartx.com>
Signed-off-by: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/md.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index f16f190546ef..7871e7dcd483 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3024,7 +3024,11 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 	 *  -write_error - clears WriteErrorSeen
 	 *  {,-}failfast - set/clear FailFast
 	 */
+
+	struct mddev *mddev = rdev->mddev;
 	int err = -EINVAL;
+	bool need_update_sb = false;
+
 	if (cmd_match(buf, "faulty") && rdev->mddev->pers) {
 		md_error(rdev->mddev, rdev);
 		if (test_bit(Faulty, &rdev->flags))
@@ -3039,7 +3043,6 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 		if (rdev->raid_disk >= 0)
 			err = -EBUSY;
 		else {
-			struct mddev *mddev = rdev->mddev;
 			err = 0;
 			if (mddev_is_clustered(mddev))
 				err = md_cluster_ops->remove_disk(mddev, rdev);
@@ -3056,10 +3059,12 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 	} else if (cmd_match(buf, "writemostly")) {
 		set_bit(WriteMostly, &rdev->flags);
 		mddev_create_serial_pool(rdev->mddev, rdev, false);
+		need_update_sb = true;
 		err = 0;
 	} else if (cmd_match(buf, "-writemostly")) {
 		mddev_destroy_serial_pool(rdev->mddev, rdev, false);
 		clear_bit(WriteMostly, &rdev->flags);
+		need_update_sb = true;
 		err = 0;
 	} else if (cmd_match(buf, "blocked")) {
 		set_bit(Blocked, &rdev->flags);
@@ -3085,9 +3090,11 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 		err = 0;
 	} else if (cmd_match(buf, "failfast")) {
 		set_bit(FailFast, &rdev->flags);
+		need_update_sb = true;
 		err = 0;
 	} else if (cmd_match(buf, "-failfast")) {
 		clear_bit(FailFast, &rdev->flags);
+		need_update_sb = true;
 		err = 0;
 	} else if (cmd_match(buf, "-insync") && rdev->raid_disk >= 0 &&
 		   !test_bit(Journal, &rdev->flags)) {
@@ -3166,6 +3173,8 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 		clear_bit(ExternalBbl, &rdev->flags);
 		err = 0;
 	}
+	if (need_update_sb)
+		md_update_sb(mddev, 1);
 	if (!err)
 		sysfs_notify_dirent_safe(rdev->sysfs_state);
 	return err ? err : len;

From cad55afe37c9d4c796d9b2f9531e96ed4204d631 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Sat, 16 Oct 2021 11:26:21 +0000
Subject: [PATCH 1372/1750] memstick: r592: Fix a UAF bug when removing the
 driver

[ Upstream commit 738216c1953e802aa9f930c5d15b8f9092c847ff ]

In r592_remove(), the driver will free dma after freeing the host, which
may cause a UAF bug.

The following log reveals it:

[   45.361796 ] BUG: KASAN: use-after-free in r592_remove+0x269/0x350 [r592]
[   45.364286 ] Call Trace:
[   45.364472 ]  dump_stack_lvl+0xa8/0xd1
[   45.364751 ]  print_address_description+0x87/0x3b0
[   45.365137 ]  kasan_report+0x172/0x1c0
[   45.365415 ]  ? r592_remove+0x269/0x350 [r592]
[   45.365834 ]  ? r592_remove+0x269/0x350 [r592]
[   45.366168 ]  __asan_report_load8_noabort+0x14/0x20
[   45.366531 ]  r592_remove+0x269/0x350 [r592]
[   45.378785 ]
[   45.378903 ] Allocated by task 4674:
[   45.379162 ]  ____kasan_kmalloc+0xb5/0xe0
[   45.379455 ]  __kasan_kmalloc+0x9/0x10
[   45.379730 ]  __kmalloc+0x150/0x280
[   45.379984 ]  memstick_alloc_host+0x2a/0x190
[   45.380664 ]
[   45.380781 ] Freed by task 5509:
[   45.381014 ]  kasan_set_track+0x3d/0x70
[   45.381293 ]  kasan_set_free_info+0x23/0x40
[   45.381635 ]  ____kasan_slab_free+0x10b/0x140
[   45.381950 ]  __kasan_slab_free+0x11/0x20
[   45.382241 ]  slab_free_freelist_hook+0x81/0x150
[   45.382575 ]  kfree+0x13e/0x290
[   45.382805 ]  memstick_free+0x1c/0x20
[   45.383070 ]  device_release+0x9c/0x1d0
[   45.383349 ]  kobject_put+0x2ef/0x4c0
[   45.383616 ]  put_device+0x1f/0x30
[   45.383865 ]  memstick_free_host+0x24/0x30
[   45.384162 ]  r592_remove+0x242/0x350 [r592]
[   45.384473 ]  pci_device_remove+0xa9/0x250

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Link: https://lore.kernel.org/r/1634383581-11055-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/host/r592.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c
index d2ef46337191..eaa2a94d18be 100644
--- a/drivers/memstick/host/r592.c
+++ b/drivers/memstick/host/r592.c
@@ -837,15 +837,15 @@ static void r592_remove(struct pci_dev *pdev)
 	}
 	memstick_remove_host(dev->host);
 
+	if (dev->dummy_dma_page)
+		dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
+			dev->dummy_dma_page_physical_address);
+
 	free_irq(dev->irq, dev);
 	iounmap(dev->mmio);
 	pci_release_regions(pdev);
 	pci_disable_device(pdev);
 	memstick_free_host(dev->host);
-
-	if (dev->dummy_dma_page)
-		dma_free_coherent(&pdev->dev, PAGE_SIZE, dev->dummy_dma_page,
-			dev->dummy_dma_page_physical_address);
 }
 
 #ifdef CONFIG_PM_SLEEP

From aa5d35e350f6587a17e7b17cc26eb0bfd7dda04c Mon Sep 17 00:00:00 2001
From: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon, 11 Oct 2021 05:31:39 +0800
Subject: [PATCH 1373/1750] lib/xz: Avoid overlapping memcpy() with invalid
 input with in-place decompression

[ Upstream commit 83d3c4f22a36d005b55f44628f46cc0d319a75e8 ]

With valid files, the safety margin described in lib/decompress_unxz.c
ensures that these buffers cannot overlap. But if the uncompressed size
of the input is larger than the caller thought, which is possible when
the input file is invalid/corrupt, the buffers can overlap. Obviously
the result will then be garbage (and usually the decoder will return
an error too) but no other harm will happen when such an over-run occurs.

This change only affects uncompressed LZMA2 chunks and so this
should have no effect on performance.

Link: https://lore.kernel.org/r/20211010213145.17462-2-xiang@kernel.org
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/decompress_unxz.c |  2 +-
 lib/xz/xz_dec_lzma2.c | 21 +++++++++++++++++++--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c
index 25d59a95bd66..abea25310ac7 100644
--- a/lib/decompress_unxz.c
+++ b/lib/decompress_unxz.c
@@ -167,7 +167,7 @@
  * memeq and memzero are not used much and any remotely sane implementation
  * is fast enough. memcpy/memmove speed matters in multi-call mode, but
  * the kernel image is decompressed in single-call mode, in which only
- * memcpy speed can matter and only if there is a lot of uncompressible data
+ * memmove speed can matter and only if there is a lot of uncompressible data
  * (LZMA2 stores uncompressible chunks in uncompressed form). Thus, the
  * functions below should just be kept small; it's probably not worth
  * optimizing for speed.
diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
index 65a1aad8c223..a18b52759fd9 100644
--- a/lib/xz/xz_dec_lzma2.c
+++ b/lib/xz/xz_dec_lzma2.c
@@ -387,7 +387,14 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
 
 		*left -= copy_size;
 
-		memcpy(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
+		/*
+		 * If doing in-place decompression in single-call mode and the
+		 * uncompressed size of the file is larger than the caller
+		 * thought (i.e. it is invalid input!), the buffers below may
+		 * overlap and cause undefined behavior with memcpy().
+		 * With valid inputs memcpy() would be fine here.
+		 */
+		memmove(dict->buf + dict->pos, b->in + b->in_pos, copy_size);
 		dict->pos += copy_size;
 
 		if (dict->full < dict->pos)
@@ -397,7 +404,11 @@ static void dict_uncompressed(struct dictionary *dict, struct xz_buf *b,
 			if (dict->pos == dict->end)
 				dict->pos = 0;
 
-			memcpy(b->out + b->out_pos, b->in + b->in_pos,
+			/*
+			 * Like above but for multi-call mode: use memmove()
+			 * to avoid undefined behavior with invalid input.
+			 */
+			memmove(b->out + b->out_pos, b->in + b->in_pos,
 					copy_size);
 		}
 
@@ -421,6 +432,12 @@ static uint32_t dict_flush(struct dictionary *dict, struct xz_buf *b)
 		if (dict->pos == dict->end)
 			dict->pos = 0;
 
+		/*
+		 * These buffers cannot overlap even if doing in-place
+		 * decompression because in multi-call mode dict->buf
+		 * has been allocated by us in this file; it's not
+		 * provided by the caller like in single-call mode.
+		 */
 		memcpy(b->out + b->out_pos, dict->buf + dict->start,
 				copy_size);
 	}

From ab5c46f258c9040347ac145b524c01834c9f15b8 Mon Sep 17 00:00:00 2001
From: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon, 11 Oct 2021 05:31:40 +0800
Subject: [PATCH 1374/1750] lib/xz: Validate the value before assigning it to
 an enum variable

[ Upstream commit 4f8d7abaa413c34da9d751289849dbfb7c977d05 ]

This might matter, for example, if the underlying type of enum xz_check
was a signed char. In such a case the validation wouldn't have caught an
unsupported header. I don't know if this problem can occur in the kernel
on any arch but it's still good to fix it because some people might copy
the XZ code to their own projects from Linux instead of the upstream
XZ Embedded repository.

This change may increase the code size by a few bytes. An alternative
would have been to use an unsigned int instead of enum xz_check but
using an enumeration looks cleaner.

Link: https://lore.kernel.org/r/20211010213145.17462-3-xiang@kernel.org
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/xz/xz_dec_stream.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/xz/xz_dec_stream.c b/lib/xz/xz_dec_stream.c
index 32ab2a08b7cb..a30e3308035f 100644
--- a/lib/xz/xz_dec_stream.c
+++ b/lib/xz/xz_dec_stream.c
@@ -402,12 +402,12 @@ static enum xz_ret dec_stream_header(struct xz_dec *s)
 	 * we will accept other check types too, but then the check won't
 	 * be verified and a warning (XZ_UNSUPPORTED_CHECK) will be given.
 	 */
+	if (s->temp.buf[HEADER_MAGIC_SIZE + 1] > XZ_CHECK_MAX)
+		return XZ_OPTIONS_ERROR;
+
 	s->check_type = s->temp.buf[HEADER_MAGIC_SIZE + 1];
 
 #ifdef XZ_DEC_ANY_CHECK
-	if (s->check_type > XZ_CHECK_MAX)
-		return XZ_OPTIONS_ERROR;
-
 	if (s->check_type > XZ_CHECK_CRC32)
 		return XZ_UNSUPPORTED_CHECK;
 #else

From 5736f1dead8484cadf0843d5d9707ae1173f31e1 Mon Sep 17 00:00:00 2001
From: Menglong Dong <imagedong@tencent.com>
Date: Sun, 17 Oct 2021 20:04:02 +0800
Subject: [PATCH 1375/1750] workqueue: make sysfs of unbound kworker cpumask
 more clever

[ Upstream commit d25302e46592c97d29f70ccb1be558df31a9a360 ]

Some unfriendly component, such as dpdk, write the same mask to
unbound kworker cpumask again and again. Every time it write to
this interface some work is queue to cpu, even though the mask
is same with the original mask.

So, fix it by return success and do nothing if the cpumask is
equal with the old one.

Signed-off-by: Mengen Sun <mengensun@tencent.com>
Signed-off-by: Menglong Dong <imagedong@tencent.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/workqueue.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 4cb622b2661b..d02073b9d56e 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5326,9 +5326,6 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
 	int ret = -EINVAL;
 	cpumask_var_t saved_cpumask;
 
-	if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL))
-		return -ENOMEM;
-
 	/*
 	 * Not excluding isolated cpus on purpose.
 	 * If the user wishes to include them, we allow that.
@@ -5336,6 +5333,15 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
 	cpumask_and(cpumask, cpumask, cpu_possible_mask);
 	if (!cpumask_empty(cpumask)) {
 		apply_wqattrs_lock();
+		if (cpumask_equal(cpumask, wq_unbound_cpumask)) {
+			ret = 0;
+			goto out_unlock;
+		}
+
+		if (!zalloc_cpumask_var(&saved_cpumask, GFP_KERNEL)) {
+			ret = -ENOMEM;
+			goto out_unlock;
+		}
 
 		/* save the old wq_unbound_cpumask. */
 		cpumask_copy(saved_cpumask, wq_unbound_cpumask);
@@ -5348,10 +5354,11 @@ int workqueue_set_unbound_cpumask(cpumask_var_t cpumask)
 		if (ret < 0)
 			cpumask_copy(wq_unbound_cpumask, saved_cpumask);
 
+		free_cpumask_var(saved_cpumask);
+out_unlock:
 		apply_wqattrs_unlock();
 	}
 
-	free_cpumask_var(saved_cpumask);
 	return ret;
 }
 

From ea7f8803a3144fdbb22257c7a501ee7b3caa8009 Mon Sep 17 00:00:00 2001
From: Kalesh Singh <kaleshsingh@google.com>
Date: Wed, 13 Oct 2021 21:52:17 -0700
Subject: [PATCH 1376/1750] tracing/cfi: Fix cmp_entries_* functions signature
 mismatch

[ Upstream commit 7ce1bb83a14019f8c396d57ec704d19478747716 ]

If CONFIG_CFI_CLANG=y, attempting to read an event histogram will cause
the kernel to panic due to failed CFI check.

    1. echo 'hist:keys=common_pid' >> events/sched/sched_switch/trigger
    2. cat events/sched/sched_switch/hist
    3. kernel panics on attempting to read hist

This happens because the sort() function expects a generic
int (*)(const void *, const void *) pointer for the compare function.
To prevent this CFI failure, change tracing map cmp_entries_* function
signatures to match this.

Also, fix the build error reported by the kernel test robot [1].

[1] https://lore.kernel.org/r/202110141140.zzi4dRh4-lkp@intel.com/

Link: https://lkml.kernel.org/r/20211014045217.3265162-1-kaleshsingh@google.com

Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/tracing_map.c | 40 ++++++++++++++++++++++----------------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index 4b50fc0cb12c..d63e51dde0d2 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -834,29 +834,35 @@ int tracing_map_init(struct tracing_map *map)
 	return err;
 }
 
-static int cmp_entries_dup(const struct tracing_map_sort_entry **a,
-			   const struct tracing_map_sort_entry **b)
+static int cmp_entries_dup(const void *A, const void *B)
 {
+	const struct tracing_map_sort_entry *a, *b;
 	int ret = 0;
 
-	if (memcmp((*a)->key, (*b)->key, (*a)->elt->map->key_size))
+	a = *(const struct tracing_map_sort_entry **)A;
+	b = *(const struct tracing_map_sort_entry **)B;
+
+	if (memcmp(a->key, b->key, a->elt->map->key_size))
 		ret = 1;
 
 	return ret;
 }
 
-static int cmp_entries_sum(const struct tracing_map_sort_entry **a,
-			   const struct tracing_map_sort_entry **b)
+static int cmp_entries_sum(const void *A, const void *B)
 {
 	const struct tracing_map_elt *elt_a, *elt_b;
+	const struct tracing_map_sort_entry *a, *b;
 	struct tracing_map_sort_key *sort_key;
 	struct tracing_map_field *field;
 	tracing_map_cmp_fn_t cmp_fn;
 	void *val_a, *val_b;
 	int ret = 0;
 
-	elt_a = (*a)->elt;
-	elt_b = (*b)->elt;
+	a = *(const struct tracing_map_sort_entry **)A;
+	b = *(const struct tracing_map_sort_entry **)B;
+
+	elt_a = a->elt;
+	elt_b = b->elt;
 
 	sort_key = &elt_a->map->sort_key;
 
@@ -873,18 +879,21 @@ static int cmp_entries_sum(const struct tracing_map_sort_entry **a,
 	return ret;
 }
 
-static int cmp_entries_key(const struct tracing_map_sort_entry **a,
-			   const struct tracing_map_sort_entry **b)
+static int cmp_entries_key(const void *A, const void *B)
 {
 	const struct tracing_map_elt *elt_a, *elt_b;
+	const struct tracing_map_sort_entry *a, *b;
 	struct tracing_map_sort_key *sort_key;
 	struct tracing_map_field *field;
 	tracing_map_cmp_fn_t cmp_fn;
 	void *val_a, *val_b;
 	int ret = 0;
 
-	elt_a = (*a)->elt;
-	elt_b = (*b)->elt;
+	a = *(const struct tracing_map_sort_entry **)A;
+	b = *(const struct tracing_map_sort_entry **)B;
+
+	elt_a = a->elt;
+	elt_b = b->elt;
 
 	sort_key = &elt_a->map->sort_key;
 
@@ -989,10 +998,8 @@ static void sort_secondary(struct tracing_map *map,
 			   struct tracing_map_sort_key *primary_key,
 			   struct tracing_map_sort_key *secondary_key)
 {
-	int (*primary_fn)(const struct tracing_map_sort_entry **,
-			  const struct tracing_map_sort_entry **);
-	int (*secondary_fn)(const struct tracing_map_sort_entry **,
-			    const struct tracing_map_sort_entry **);
+	int (*primary_fn)(const void *, const void *);
+	int (*secondary_fn)(const void *, const void *);
 	unsigned i, start = 0, n_sub = 1;
 
 	if (is_key(map, primary_key->field_idx))
@@ -1061,8 +1068,7 @@ int tracing_map_sort_entries(struct tracing_map *map,
 			     unsigned int n_sort_keys,
 			     struct tracing_map_sort_entry ***sort_entries)
 {
-	int (*cmp_entries_fn)(const struct tracing_map_sort_entry **,
-			      const struct tracing_map_sort_entry **);
+	int (*cmp_entries_fn)(const void *, const void *);
 	struct tracing_map_sort_entry *sort_entry, **entries;
 	int i, n_entries, ret;
 

From 16c2dd0ab5c24a124c92ab4b730073ffa3d9b952 Mon Sep 17 00:00:00 2001
From: Ryder Lee <ryder.lee@mediatek.com>
Date: Wed, 14 Jul 2021 15:56:10 +0800
Subject: [PATCH 1377/1750] mt76: mt7915: fix an off-by-one bound check

[ Upstream commit d45dac0732a287fc371a23f257cce04e65627947 ]

The bounds check on datalen is off-by-one, so fix it.

Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index ea7140975151..7c2d09a64882 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -830,7 +830,7 @@ static void mt7915_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy,
 
 	elem = ieee80211_bss_get_elem(bss, WLAN_EID_EXT_CAPABILITY);
 
-	if (!elem || elem->datalen < 10 ||
+	if (!elem || elem->datalen <= 10 ||
 	    !(elem->data[10] &
 	      WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT))
 		data->tolerated = false;

From 451cef276fe48fa43625654f07fc6f6db11746c9 Mon Sep 17 00:00:00 2001
From: Zheyu Ma <zheyuma97@gmail.com>
Date: Sat, 16 Oct 2021 04:02:59 +0000
Subject: [PATCH 1378/1750] mwl8k: Fix use-after-free in
 mwl8k_fw_state_machine()

[ Upstream commit 257051a235c17e33782b6e24a4b17f2d7915aaec ]

When the driver fails to request the firmware, it calls its error
handler. In the error handler, the driver detaches device from driver
first before releasing the firmware, which can cause a use-after-free bug.

Fix this by releasing firmware first.

The following log reveals it:

[    9.007301 ] BUG: KASAN: use-after-free in mwl8k_fw_state_machine+0x320/0xba0
[    9.010143 ] Workqueue: events request_firmware_work_func
[    9.010830 ] Call Trace:
[    9.010830 ]  dump_stack_lvl+0xa8/0xd1
[    9.010830 ]  print_address_description+0x87/0x3b0
[    9.010830 ]  kasan_report+0x172/0x1c0
[    9.010830 ]  ? mutex_unlock+0xd/0x10
[    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
[    9.010830 ]  ? mwl8k_fw_state_machine+0x320/0xba0
[    9.010830 ]  __asan_report_load8_noabort+0x14/0x20
[    9.010830 ]  mwl8k_fw_state_machine+0x320/0xba0
[    9.010830 ]  ? mwl8k_load_firmware+0x5f0/0x5f0
[    9.010830 ]  request_firmware_work_func+0x172/0x250
[    9.010830 ]  ? read_lock_is_recursive+0x20/0x20
[    9.010830 ]  ? process_one_work+0x7a1/0x1100
[    9.010830 ]  ? request_firmware_nowait+0x460/0x460
[    9.010830 ]  ? __this_cpu_preempt_check+0x13/0x20
[    9.010830 ]  process_one_work+0x9bb/0x1100

Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634356979-6211-1-git-send-email-zheyuma97@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwl8k.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
index 27b7d4b779e0..dc91ac8cbd48 100644
--- a/drivers/net/wireless/marvell/mwl8k.c
+++ b/drivers/net/wireless/marvell/mwl8k.c
@@ -5796,8 +5796,8 @@ static void mwl8k_fw_state_machine(const struct firmware *fw, void *context)
 fail:
 	priv->fw_state = FW_STATE_ERROR;
 	complete(&priv->firmware_loading_complete);
-	device_release_driver(&priv->pdev->dev);
 	mwl8k_release_firmware(priv);
+	device_release_driver(&priv->pdev->dev);
 }
 
 #define MAX_RESTART_ATTEMPTS 1

From 49cc377654d9b59a1356db000472eee2007b4162 Mon Sep 17 00:00:00 2001
From: Jens Axboe <axboe@kernel.dk>
Date: Wed, 20 Oct 2021 08:21:40 -0600
Subject: [PATCH 1379/1750] block: remove inaccurate requeue check

[ Upstream commit 037057a5a979c7eeb2ee5d12cf4c24b805192c75 ]

This check is meant to catch cases where a requeue is attempted on a
request that is still inserted. It's never really been useful to catch any
misuse, and now it's actively wrong. Outside of that, this should not be a
BUG_ON() to begin with.

Remove the check as it's now causing active harm, as requeue off the plug
path will trigger it even though the request state is just fine.

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Link: https://lore.kernel.org/linux-block/CAHj4cs80zAUc2grnCZ015-2Rvd-=gXRfB_dFKy=RTm+wRo09HQ@mail.gmail.com/
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-mq.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index e4422a09b126..15a11a217cd0 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -774,7 +774,6 @@ void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list)
 	/* this request will be re-inserted to io scheduler queue */
 	blk_mq_sched_requeue_request(rq);
 
-	BUG_ON(!list_empty(&rq->queuelist));
 	blk_mq_add_to_requeue_list(rq, true, kick_requeue_list);
 }
 EXPORT_SYMBOL(blk_mq_requeue_request);

From 1a10bf4c9dd3ba8937d108b615ad5efcfd632e3a Mon Sep 17 00:00:00 2001
From: Michael Tretter <m.tretter@pengutronix.de>
Date: Wed, 8 Sep 2021 14:03:10 +0100
Subject: [PATCH 1380/1750] media: allegro: ignore interrupt if mailbox is not
 initialized

[ Upstream commit 1ecda6393db4be44aba27a243e648dc98c9b92e3 ]

The mailbox is initialized after the interrupt handler is installed. As
the firmware is loaded and started even later, it should not happen that
the interrupt occurs without the mailbox being initialized.

As the Linux Driver Verification project (linuxtesting.org) keeps
reporting this as an error, add a check to ignore interrupts before the
mailbox is initialized to fix this potential null pointer dereference.

Reported-by: Yuri Savinykh <s02190703@gse.cs.msu.ru>
Reported-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/allegro-dvt/allegro-core.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/staging/media/allegro-dvt/allegro-core.c b/drivers/staging/media/allegro-dvt/allegro-core.c
index 640451134072..28b6ba895ccd 100644
--- a/drivers/staging/media/allegro-dvt/allegro-core.c
+++ b/drivers/staging/media/allegro-dvt/allegro-core.c
@@ -1802,6 +1802,15 @@ static irqreturn_t allegro_irq_thread(int irq, void *data)
 {
 	struct allegro_dev *dev = data;
 
+	/*
+	 * The firmware is initialized after the mailbox is setup. We further
+	 * check the AL5_ITC_CPU_IRQ_STA register, if the firmware actually
+	 * triggered the interrupt. Although this should not happen, make sure
+	 * that we ignore interrupts, if the mailbox is not initialized.
+	 */
+	if (!dev->mbox_status)
+		return IRQ_NONE;
+
 	allegro_mbox_notify(dev->mbox_status);
 
 	return IRQ_HANDLED;

From e73574f7bc9b83f290fbc7760a9153e05133cbf3 Mon Sep 17 00:00:00 2001
From: Israel Rukshin <israelr@nvidia.com>
Date: Wed, 6 Oct 2021 08:09:43 +0000
Subject: [PATCH 1381/1750] nvmet: fix use-after-free when a port is removed

[ Upstream commit e3e19dcc4c416d65f99f13d55be2b787f8d0050e ]

When a port is removed through configfs, any connected controllers
are starting teardown flow asynchronously and can still send commands.
This causes a use-after-free bug for any command that dereferences
req->port (like in nvmet_parse_io_cmd).

To fix this, wait for all the teardown scheduled works to complete
(like release_work at rdma/tcp drivers). This ensures there are no
active controllers when the port is eventually removed.

Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/configfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index 37e1d7784e17..9aed5cc71096 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -1462,6 +1462,8 @@ static void nvmet_port_release(struct config_item *item)
 {
 	struct nvmet_port *port = to_nvmet_port(item);
 
+	/* Let inflight controllers teardown complete */
+	flush_scheduled_work();
 	list_del(&port->global_entry);
 
 	kfree(port->ana_state);

From 2659d8213d886bfe6f37abc2661a8404c36d5a32 Mon Sep 17 00:00:00 2001
From: Israel Rukshin <israelr@nvidia.com>
Date: Wed, 6 Oct 2021 08:09:44 +0000
Subject: [PATCH 1382/1750] nvmet-rdma: fix use-after-free when a port is
 removed

[ Upstream commit fcf73a804c7d6bbf0ea63531c6122aa363852e04 ]

When removing a port, all its controllers are being removed, but there
are queues on the port that doesn't belong to any controller (during
connection time). This causes a use-after-free bug for any command
that dereferences req->port (like in nvmet_alloc_ctrl). Those queues
should be destroyed before freeing the port via configfs. Destroy the
remaining queues after the RDMA-CM was destroyed guarantees that no
new queue will be created.

Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/rdma.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 7d607f435e36..6d5552f2f184 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -1819,12 +1819,36 @@ static void nvmet_rdma_delete_ctrl(struct nvmet_ctrl *ctrl)
 	mutex_unlock(&nvmet_rdma_queue_mutex);
 }
 
+static void nvmet_rdma_destroy_port_queues(struct nvmet_rdma_port *port)
+{
+	struct nvmet_rdma_queue *queue, *tmp;
+	struct nvmet_port *nport = port->nport;
+
+	mutex_lock(&nvmet_rdma_queue_mutex);
+	list_for_each_entry_safe(queue, tmp, &nvmet_rdma_queue_list,
+				 queue_list) {
+		if (queue->port != nport)
+			continue;
+
+		list_del_init(&queue->queue_list);
+		__nvmet_rdma_queue_disconnect(queue);
+	}
+	mutex_unlock(&nvmet_rdma_queue_mutex);
+}
+
 static void nvmet_rdma_disable_port(struct nvmet_rdma_port *port)
 {
 	struct rdma_cm_id *cm_id = xchg(&port->cm_id, NULL);
 
 	if (cm_id)
 		rdma_destroy_id(cm_id);
+
+	/*
+	 * Destroy the remaining queues, which are not belong to any
+	 * controller yet. Do it here after the RDMA-CM was destroyed
+	 * guarantees that no new queue will be created.
+	 */
+	nvmet_rdma_destroy_port_queues(port);
 }
 
 static int nvmet_rdma_enable_port(struct nvmet_rdma_port *port)

From 82327823f34e920cfb27c796c82ff72a6554cebf Mon Sep 17 00:00:00 2001
From: Israel Rukshin <israelr@nvidia.com>
Date: Wed, 6 Oct 2021 08:09:45 +0000
Subject: [PATCH 1383/1750] nvmet-tcp: fix use-after-free when a port is
 removed

[ Upstream commit 2351ead99ce9164fb42555aee3f96af84c4839e9 ]

When removing a port, all its controllers are being removed, but there
are queues on the port that doesn't belong to any controller (during
connection time). This causes a use-after-free bug for any command
that dereferences req->port (like in nvmet_alloc_ctrl). Those queues
should be destroyed before freeing the port via configfs. Destroy
the remaining queues after the accept_work was cancelled guarantees
that no new queue will be created.

Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/tcp.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 58dc517fe867..1251fd6e9278 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1708,6 +1708,17 @@ static int nvmet_tcp_add_port(struct nvmet_port *nport)
 	return ret;
 }
 
+static void nvmet_tcp_destroy_port_queues(struct nvmet_tcp_port *port)
+{
+	struct nvmet_tcp_queue *queue;
+
+	mutex_lock(&nvmet_tcp_queue_mutex);
+	list_for_each_entry(queue, &nvmet_tcp_queue_list, queue_list)
+		if (queue->port == port)
+			kernel_sock_shutdown(queue->sock, SHUT_RDWR);
+	mutex_unlock(&nvmet_tcp_queue_mutex);
+}
+
 static void nvmet_tcp_remove_port(struct nvmet_port *nport)
 {
 	struct nvmet_tcp_port *port = nport->priv;
@@ -1717,6 +1728,11 @@ static void nvmet_tcp_remove_port(struct nvmet_port *nport)
 	port->sock->sk->sk_user_data = NULL;
 	write_unlock_bh(&port->sock->sk->sk_callback_lock);
 	cancel_work_sync(&port->accept_work);
+	/*
+	 * Destroy the remaining queues, which are not belong to any
+	 * controller yet.
+	 */
+	nvmet_tcp_destroy_port_queues(port);
 
 	sock_release(port->sock);
 	kfree(port);

From 7a0b68eecb5b557241597f9a887b99d9821916d5 Mon Sep 17 00:00:00 2001
From: Hannes Reinecke <hare@suse.de>
Date: Wed, 20 Oct 2021 07:59:10 +0200
Subject: [PATCH 1384/1750] nvme: drop scan_lock and always kick requeue list
 when removing namespaces

[ Upstream commit 2b81a5f015199f3d585ce710190a9e87714d3c1e ]

When reading the partition table on initial scan hits an I/O error the
I/O will hang with the scan_mutex held:

[<0>] do_read_cache_page+0x49b/0x790
[<0>] read_part_sector+0x39/0xe0
[<0>] read_lba+0xf9/0x1d0
[<0>] efi_partition+0xf1/0x7f0
[<0>] bdev_disk_changed+0x1ee/0x550
[<0>] blkdev_get_whole+0x81/0x90
[<0>] blkdev_get_by_dev+0x128/0x2e0
[<0>] device_add_disk+0x377/0x3c0
[<0>] nvme_mpath_set_live+0x130/0x1b0 [nvme_core]
[<0>] nvme_mpath_add_disk+0x150/0x160 [nvme_core]
[<0>] nvme_alloc_ns+0x417/0x950 [nvme_core]
[<0>] nvme_validate_or_alloc_ns+0xe9/0x1e0 [nvme_core]
[<0>] nvme_scan_work+0x168/0x310 [nvme_core]
[<0>] process_one_work+0x231/0x420

and trying to delete the controller will deadlock as it tries to grab
the scan mutex:

[<0>] nvme_mpath_clear_ctrl_paths+0x25/0x80 [nvme_core]
[<0>] nvme_remove_namespaces+0x31/0xf0 [nvme_core]
[<0>] nvme_do_delete_ctrl+0x4b/0x80 [nvme_core]

As we're now properly ordering the namespace list there is no need to
hold the scan_mutex in nvme_mpath_clear_ctrl_paths() anymore.
And we always need to kick the requeue list as the path will be marked
as unusable and I/O will be requeued _without_ a current path.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/multipath.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 46a1e24ba6f4..18a756444d5a 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -135,13 +135,12 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
 {
 	struct nvme_ns *ns;
 
-	mutex_lock(&ctrl->scan_lock);
 	down_read(&ctrl->namespaces_rwsem);
-	list_for_each_entry(ns, &ctrl->namespaces, list)
-		if (nvme_mpath_clear_current_path(ns))
-			kblockd_schedule_work(&ns->head->requeue_work);
+	list_for_each_entry(ns, &ctrl->namespaces, list) {
+		nvme_mpath_clear_current_path(ns);
+		kblockd_schedule_work(&ns->head->requeue_work);
+	}
 	up_read(&ctrl->namespaces_rwsem);
-	mutex_unlock(&ctrl->scan_lock);
 }
 
 static bool nvme_path_is_disabled(struct nvme_ns *ns)

From 9f4bd00a6ec6550515ffce7b91488f899a96d2bc Mon Sep 17 00:00:00 2001
From: Ye Bin <yebin10@huawei.com>
Date: Wed, 13 Oct 2021 20:19:14 +0800
Subject: [PATCH 1385/1750] PM: hibernate: Get block device exclusively in
 swsusp_check()

[ Upstream commit 39fbef4b0f77f9c89c8f014749ca533643a37c9f ]

The following kernel crash can be triggered:

[   89.266592] ------------[ cut here ]------------
[   89.267427] kernel BUG at fs/buffer.c:3020!
[   89.268264] invalid opcode: 0000 [#1] SMP KASAN PTI
[   89.269116] CPU: 7 PID: 1750 Comm: kmmpd-loop0 Not tainted 5.10.0-862.14.0.6.x86_64-08610-gc932cda3cef4-dirty #20
[   89.273169] RIP: 0010:submit_bh_wbc.isra.0+0x538/0x6d0
[   89.277157] RSP: 0018:ffff888105ddfd08 EFLAGS: 00010246
[   89.278093] RAX: 0000000000000005 RBX: ffff888124231498 RCX: ffffffffb2772612
[   89.279332] RDX: 1ffff11024846293 RSI: 0000000000000008 RDI: ffff888124231498
[   89.280591] RBP: ffff8881248cc000 R08: 0000000000000001 R09: ffffed1024846294
[   89.281851] R10: ffff88812423149f R11: ffffed1024846293 R12: 0000000000003800
[   89.283095] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8881161f7000
[   89.284342] FS:  0000000000000000(0000) GS:ffff88839b5c0000(0000) knlGS:0000000000000000
[   89.285711] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   89.286701] CR2: 00007f166ebc01a0 CR3: 0000000435c0e000 CR4: 00000000000006e0
[   89.287919] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   89.289138] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   89.290368] Call Trace:
[   89.290842]  write_mmp_block+0x2ca/0x510
[   89.292218]  kmmpd+0x433/0x9a0
[   89.294902]  kthread+0x2dd/0x3e0
[   89.296268]  ret_from_fork+0x22/0x30
[   89.296906] Modules linked in:

by running the following commands:

 1. mkfs.ext4 -O mmp  /dev/sda -b 1024
 2. mount /dev/sda /home/test
 3. echo "/dev/sda" > /sys/power/resume

That happens because swsusp_check() calls set_blocksize() on the
target partition which confuses the file system:

       Thread1                       Thread2
mount /dev/sda /home/test
get s_mmp_bh  --> has mapped flag
start kmmpd thread
				echo "/dev/sda" > /sys/power/resume
				  resume_store
				    software_resume
				      swsusp_check
				        set_blocksize
					  truncate_inode_pages_range
					    truncate_cleanup_page
					      block_invalidatepage
					        discard_buffer --> clean mapped flag
write_mmp_block
  submit_bh
    submit_bh_wbc
      BUG_ON(!buffer_mapped(bh))

To address this issue, modify swsusp_check() to open the target block
device with exclusive access.

Signed-off-by: Ye Bin <yebin10@huawei.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/power/swap.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 72e33054a2e1..c9126606fa6f 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -1521,9 +1521,10 @@ int swsusp_read(unsigned int *flags_p)
 int swsusp_check(void)
 {
 	int error;
+	void *holder;
 
 	hib_resume_bdev = blkdev_get_by_dev(swsusp_resume_device,
-					    FMODE_READ, NULL);
+					    FMODE_READ | FMODE_EXCL, &holder);
 	if (!IS_ERR(hib_resume_bdev)) {
 		set_blocksize(hib_resume_bdev, PAGE_SIZE);
 		clear_page(swsusp_header);
@@ -1545,7 +1546,7 @@ int swsusp_check(void)
 
 put:
 		if (error)
-			blkdev_put(hib_resume_bdev, FMODE_READ);
+			blkdev_put(hib_resume_bdev, FMODE_READ | FMODE_EXCL);
 		else
 			pr_debug("Image signature found, resuming\n");
 	} else {

From d6dca066fc4f8c068e968dc365f6cd1aa9c6baed Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Thu, 21 Oct 2021 11:56:03 -0600
Subject: [PATCH 1386/1750] selftests: kvm: fix mismatched fclose() after
 popen()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c3867ab5924b7a9a0b4a117902a08669d8be7c21 ]

get_warnings_count() does fclose() using File * returned from popen().
Fix it to call pclose() as it should.

tools/testing/selftests/kvm/x86_64/mmio_warning_test
x86_64/mmio_warning_test.c: In function ‘get_warnings_count’:
x86_64/mmio_warning_test.c:87:9: warning: ‘fclose’ called on pointer returned from a mismatched allocation function [-Wmismatched-dealloc]
   87 |         fclose(f);
      |         ^~~~~~~~~
x86_64/mmio_warning_test.c:84:13: note: returned from ‘popen’
   84 |         f = popen("dmesg | grep \"WARNING:\" | wc -l", "r");
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/x86_64/mmio_warning_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
index 8039e1eff938..9f55ccd169a1 100644
--- a/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
+++ b/tools/testing/selftests/kvm/x86_64/mmio_warning_test.c
@@ -84,7 +84,7 @@ int get_warnings_count(void)
 	f = popen("dmesg | grep \"WARNING:\" | wc -l", "r");
 	if (fscanf(f, "%d", &warnings) < 1)
 		warnings = 0;
-	fclose(f);
+	pclose(f);
 
 	return warnings;
 }

From e658d59f0ee4890446e457d8eec1f27bcb0643d0 Mon Sep 17 00:00:00 2001
From: Jiri Olsa <jolsa@redhat.com>
Date: Thu, 21 Oct 2021 13:41:30 +0200
Subject: [PATCH 1387/1750] selftests/bpf: Fix perf_buffer test on system with
 offline cpus

[ Upstream commit d4121376ac7a9c81a696d7558789b2f29ef3574e ]

The perf_buffer fails on system with offline cpus:

  # test_progs -t perf_buffer
  test_perf_buffer:PASS:nr_cpus 0 nsec
  test_perf_buffer:PASS:nr_on_cpus 0 nsec
  test_perf_buffer:PASS:skel_load 0 nsec
  test_perf_buffer:PASS:attach_kprobe 0 nsec
  test_perf_buffer:PASS:perf_buf__new 0 nsec
  test_perf_buffer:PASS:epoll_fd 0 nsec
  skipping offline CPU #24
  skipping offline CPU #25
  skipping offline CPU #26
  skipping offline CPU #27
  skipping offline CPU #28
  skipping offline CPU #29
  skipping offline CPU #30
  skipping offline CPU #31
  test_perf_buffer:PASS:perf_buffer__poll 0 nsec
  test_perf_buffer:PASS:seen_cpu_cnt 0 nsec
  test_perf_buffer:FAIL:buf_cnt got 24, expected 32
  Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED

Changing the test to check online cpus instead of possible.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20211021114132.8196-2-jolsa@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/prog_tests/perf_buffer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/perf_buffer.c b/tools/testing/selftests/bpf/prog_tests/perf_buffer.c
index ca9f0895ec84..8d75475408f5 100644
--- a/tools/testing/selftests/bpf/prog_tests/perf_buffer.c
+++ b/tools/testing/selftests/bpf/prog_tests/perf_buffer.c
@@ -107,8 +107,8 @@ void test_perf_buffer(void)
 		  "expect %d, seen %d\n", nr_on_cpus, CPU_COUNT(&cpu_seen)))
 		goto out_free_pb;
 
-	if (CHECK(perf_buffer__buffer_cnt(pb) != nr_cpus, "buf_cnt",
-		  "got %zu, expected %d\n", perf_buffer__buffer_cnt(pb), nr_cpus))
+	if (CHECK(perf_buffer__buffer_cnt(pb) != nr_on_cpus, "buf_cnt",
+		  "got %zu, expected %d\n", perf_buffer__buffer_cnt(pb), nr_on_cpus))
 		goto out_close;
 
 	for (i = 0; i < nr_cpus; i++) {

From 32a9a8fdbab717abb6fc51647e00f764320460af Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Sun, 17 Oct 2021 11:43:40 +0300
Subject: [PATCH 1388/1750] iwlwifi: mvm: disable RX-diversity in powersave

[ Upstream commit e5322b9ab5f63536c41301150b7ce64605ce52cc ]

Just like we have default SMPS mode as dynamic in powersave,
we should not enable RX-diversity in powersave, to reduce
power consumption when connected to a non-MIMO AP.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211017113927.fc896bc5cdaa.I1d11da71b8a5cbe921a37058d5f578f1b14a2023@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
index 3123036978a5..caf38ef64d3c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
@@ -741,6 +741,9 @@ bool iwl_mvm_rx_diversity_allowed(struct iwl_mvm *mvm)
 
 	lockdep_assert_held(&mvm->mutex);
 
+	if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
+		return false;
+
 	if (num_of_ant(iwl_mvm_get_valid_rx_ant(mvm)) == 1)
 		return false;
 

From c11aecbe0542afa4832dbb9b48d1c45064b2cb1b Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Tue, 19 Oct 2021 20:54:31 +0900
Subject: [PATCH 1389/1750] smackfs: use __GFP_NOFAIL for smk_cipso_doi()

[ Upstream commit f91488ee15bd3cac467e2d6a361fc2d34d1052ae ]

syzbot is reporting kernel panic at smk_cipso_doi() due to memory
allocation fault injection [1]. The reason for need to use panic() was
not explained. But since no fix was proposed for 18 months, for now
let's use __GFP_NOFAIL for utilizing syzbot resource on other bugs.

Link: https://syzkaller.appspot.com/bug?extid=89731ccb6fec15ce1c22 [1]
Reported-by: syzbot <syzbot+89731ccb6fec15ce1c22@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smackfs.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index e33f98d25fc0..ca0daba11f81 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -693,9 +693,7 @@ static void smk_cipso_doi(void)
 		printk(KERN_WARNING "%s:%d remove rc = %d\n",
 		       __func__, __LINE__, rc);
 
-	doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
-	if (doip == NULL)
-		panic("smack:  Failed to initialize cipso DOI.\n");
+	doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL | __GFP_NOFAIL);
 	doip->map.std = NULL;
 	doip->doi = smk_cipso_doi_value;
 	doip->type = CIPSO_V4_MAP_PASS;

From 25a45d399996bfbcb5c995b23d03f8df5f3bd6f9 Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Thu, 21 Oct 2021 09:55:17 +0900
Subject: [PATCH 1390/1750] ARM: clang: Do not rely on lr register for
 stacktrace

[ Upstream commit b3ea5d56f212ad81328c82454829a736197ebccc ]

Currently the stacktrace on clang compiled arm kernel uses the 'lr'
register to find the first frame address from pt_regs. However, that
is wrong after calling another function, because the 'lr' register
is used by 'bl' instruction and never be recovered.

As same as gcc arm kernel, directly use the frame pointer (r11) of
the pt_regs to find the first frame address.

Note that this fixes kretprobe stacktrace issue only with
CONFIG_UNWINDER_FRAME_POINTER=y. For the CONFIG_UNWINDER_ARM,
we need another fix.

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/kernel/stacktrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
index 76ea4178a55c..db798eac7431 100644
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -54,8 +54,7 @@ int notrace unwind_frame(struct stackframe *frame)
 
 	frame->sp = frame->fp;
 	frame->fp = *(unsigned long *)(fp);
-	frame->pc = frame->lr;
-	frame->lr = *(unsigned long *)(fp + 4);
+	frame->pc = *(unsigned long *)(fp + 4);
 #else
 	/* check current frame pointer is within bounds */
 	if (fp < low + 12 || fp > high - 4)

From 9ceac307b58ed35ba85fad928ca48119acd50a41 Mon Sep 17 00:00:00 2001
From: Stephen Suryaputra <ssuryaextr@gmail.com>
Date: Wed, 20 Oct 2021 16:06:18 -0400
Subject: [PATCH 1391/1750] gre/sit: Don't generate link-local addr if
 addr_gen_mode is IN6_ADDR_GEN_MODE_NONE

[ Upstream commit 61e18ce7348bfefb5688a8bcd4b4d6b37c0f9b2a ]

When addr_gen_mode is set to IN6_ADDR_GEN_MODE_NONE, the link-local addr
should not be generated. But it isn't the case for GRE (as well as GRE6)
and SIT tunnels. Make it so that tunnels consider the addr_gen_mode,
especially for IN6_ADDR_GEN_MODE_NONE.

Do this in add_v4_addrs() to cover both GRE and SIT only if the addr
scope is link.

Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Acked-by: Antonio Quartulli <a@unstable.cc>
Link: https://lore.kernel.org/r/20211020200618.467342-1-ssuryaextr@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/addrconf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 884d430e23cb..29526937077b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3097,6 +3097,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
 	memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4);
 
 	if (idev->dev->flags&IFF_POINTOPOINT) {
+		if (idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_NONE)
+			return;
+
 		addr.s6_addr32[0] = htonl(0xfe800000);
 		scope = IFA_LINK;
 		plen = 64;

From 16a7981188a33bb31d5dd579920f18fe895be958 Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruenba@redhat.com>
Date: Mon, 11 Oct 2021 20:53:02 +0200
Subject: [PATCH 1392/1750] gfs2: Cancel remote delete work asynchronously

[ Upstream commit 486408d690e130c3adacf816754b97558d715f46 ]

In gfs2_inode_lookup and gfs2_create_inode, we're calling
gfs2_cancel_delete_work which currently cancels any remote delete work
(delete_work_func) synchronously.  This means that if the work is
currently running, it will wait for it to finish.  We're doing this to
pevent a previous instance of an inode from having any influence on the
next instance.

However, delete_work_func uses gfs2_inode_lookup internally, and we can
end up in a deadlock when delete_work_func gets interrupted at the wrong
time.  For example,

  (1) An inode's iopen glock has delete work queued, but the inode
      itself has been evicted from the inode cache.

  (2) The delete work is preempted before reaching gfs2_inode_lookup.

  (3) Another process recreates the inode (gfs2_create_inode).  It tries
      to cancel any outstanding delete work, which blocks waiting for
      the ongoing delete work to finish.

  (4) The delete work calls gfs2_inode_lookup, which blocks waiting for
      gfs2_create_inode to instantiate and unlock the new inode =>
      deadlock.

It turns out that when the delete work notices that its inode has been
re-instantiated, it will do nothing.  This means that it's safe to
cancel the delete work asynchronously.  This prevents the kind of
deadlock described above.

Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/glock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 03c3407c8e26..533adcd48031 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1911,7 +1911,7 @@ bool gfs2_queue_delete_work(struct gfs2_glock *gl, unsigned long delay)
 
 void gfs2_cancel_delete_work(struct gfs2_glock *gl)
 {
-	if (cancel_delayed_work_sync(&gl->gl_delete)) {
+	if (cancel_delayed_work(&gl->gl_delete)) {
 		clear_bit(GLF_PENDING_DELETE, &gl->gl_flags);
 		gfs2_glock_put(gl);
 	}

From b870d8a76c04bb6875c68c261f266a1fac2241a9 Mon Sep 17 00:00:00 2001
From: Andreas Gruenbacher <agruenba@redhat.com>
Date: Thu, 7 Oct 2021 15:57:44 +0200
Subject: [PATCH 1393/1750] gfs2: Fix glock_hash_walk bugs

[ Upstream commit 7427f3bb49d81525b7dd1d0f7c5f6bbc752e6f0e ]

So far, glock_hash_walk took a reference on each glock it iterated over, and it
was the examiner's responsibility to drop those references.  Dropping the final
reference to a glock can sleep and the examiners are called in a RCU critical
section with spin locks held, so examiners that didn't need the extra reference
had to drop it asynchronously via gfs2_glock_queue_put or similar.  This wasn't
done correctly in thaw_glock which did call gfs2_glock_put, and not at all in
dump_glock_func.

Change glock_hash_walk to not take glock references at all.  That way, the
examiners that don't need them won't have to bother with slow asynchronous
puts, and the examiners that do need references can take them themselves.

Reported-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/glock.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 533adcd48031..dd052101e226 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1885,10 +1885,10 @@ static void glock_hash_walk(glock_examiner examiner, const struct gfs2_sbd *sdp)
 	do {
 		rhashtable_walk_start(&iter);
 
-		while ((gl = rhashtable_walk_next(&iter)) && !IS_ERR(gl))
-			if (gl->gl_name.ln_sbd == sdp &&
-			    lockref_get_not_dead(&gl->gl_lockref))
+		while ((gl = rhashtable_walk_next(&iter)) && !IS_ERR(gl)) {
+			if (gl->gl_name.ln_sbd == sdp)
 				examiner(gl);
+		}
 
 		rhashtable_walk_stop(&iter);
 	} while (cond_resched(), gl == ERR_PTR(-EAGAIN));
@@ -1930,7 +1930,6 @@ static void flush_delete_work(struct gfs2_glock *gl)
 					   &gl->gl_delete, 0);
 		}
 	}
-	gfs2_glock_queue_work(gl, 0);
 }
 
 void gfs2_flush_delete_work(struct gfs2_sbd *sdp)
@@ -1947,10 +1946,10 @@ void gfs2_flush_delete_work(struct gfs2_sbd *sdp)
 
 static void thaw_glock(struct gfs2_glock *gl)
 {
-	if (!test_and_clear_bit(GLF_FROZEN, &gl->gl_flags)) {
-		gfs2_glock_put(gl);
+	if (!test_and_clear_bit(GLF_FROZEN, &gl->gl_flags))
+		return;
+	if (!lockref_get_not_dead(&gl->gl_lockref))
 		return;
-	}
 	set_bit(GLF_REPLY_PENDING, &gl->gl_flags);
 	gfs2_glock_queue_work(gl, 0);
 }
@@ -1966,9 +1965,12 @@ static void clear_glock(struct gfs2_glock *gl)
 	gfs2_glock_remove_from_lru(gl);
 
 	spin_lock(&gl->gl_lockref.lock);
-	if (gl->gl_state != LM_ST_UNLOCKED)
-		handle_callback(gl, LM_ST_UNLOCKED, 0, false);
-	__gfs2_glock_queue_work(gl, 0);
+	if (!__lockref_is_dead(&gl->gl_lockref)) {
+		gl->gl_lockref.count++;
+		if (gl->gl_state != LM_ST_UNLOCKED)
+			handle_callback(gl, LM_ST_UNLOCKED, 0, false);
+		__gfs2_glock_queue_work(gl, 0);
+	}
 	spin_unlock(&gl->gl_lockref.lock);
 }
 

From b3ae170b8e3fb0b8a49f44911f4d700bb5a9d997 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 18 Oct 2021 15:30:06 +0100
Subject: [PATCH 1394/1750] ARM: 9136/1: ARMv7-M uses BE-8, not BE-32

[ Upstream commit 345dac33f58894a56d17b92a41be10e16585ceff ]

When configuring the kernel for big-endian, we set either BE-8 or BE-32
based on the CPU architecture level. Until linux-4.4, we did not have
any ARMv7-M platform allowing big-endian builds, but now i.MX/Vybrid
is in that category, adn we get a build error because of this:

arch/arm/kernel/module-plts.c: In function 'get_module_plt':
arch/arm/kernel/module-plts.c:60:46: error: implicit declaration of function '__opcode_to_mem_thumb32' [-Werror=implicit-function-declaration]

This comes down to picking the wrong default, ARMv7-M uses BE8
like ARMv7-A does. Changing the default gets the kernel to compile
and presumably works.

https://lore.kernel.org/all/1455804123-2526139-2-git-send-email-arnd@arndb.de/

Tested-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mm/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 02692fbe2db5..423a97dd2f57 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -753,7 +753,7 @@ config CPU_BIG_ENDIAN
 config CPU_ENDIAN_BE8
 	bool
 	depends on CPU_BIG_ENDIAN
-	default CPU_V6 || CPU_V6K || CPU_V7
+	default CPU_V6 || CPU_V6K || CPU_V7 || CPU_V7M
 	help
 	  Support for the BE-8 (big-endian) mode on ARMv6 and ARMv7 processors.
 

From c2e5f43db0c116c91f545b317bef3f333bdc5301 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Mon, 25 Oct 2021 16:14:00 +0200
Subject: [PATCH 1395/1750] vrf: run conntrack only in context of lower/physdev
 for locally generated packets

[ Upstream commit 8c9c296adfae9ea05f655d69e9f6e13daa86fb4a ]

The VRF driver invokes netfilter for output+postrouting hooks so that users
can create rules that check for 'oif $vrf' rather than lower device name.

This is a problem when NAT rules are configured.

To avoid any conntrack involvement in round 1, tag skbs as 'untracked'
to prevent conntrack from picking them up.

This gets cleared before the packet gets handed to the ip stack so
conntrack will be active on the second iteration.

One remaining issue is that a rule like

  output ... oif $vrfname notrack

won't propagate to the second round because we can't tell
'notrack set via ruleset' and 'notrack set by vrf driver' apart.
However, this isn't a regression: the 'notrack' removal happens
instead of unconditional nf_reset_ct().
I'd also like to avoid leaking more vrf specific conditionals into the
netfilter infra.

For ingress, conntrack has already been done before the packet makes it
to the vrf driver, with this patch egress does connection tracking with
lower/physical device as well.

Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/vrf.c | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 2746f77745e4..71902706234c 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -34,6 +34,7 @@
 #include <net/l3mdev.h>
 #include <net/fib_rules.h>
 #include <net/netns/generic.h>
+#include <net/netfilter/nf_conntrack.h>
 
 #define DRV_NAME	"vrf"
 #define DRV_VERSION	"1.1"
@@ -423,12 +424,26 @@ static int vrf_local_xmit(struct sk_buff *skb, struct net_device *dev,
 	return NETDEV_TX_OK;
 }
 
+static void vrf_nf_set_untracked(struct sk_buff *skb)
+{
+	if (skb_get_nfct(skb) == 0)
+		nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
+}
+
+static void vrf_nf_reset_ct(struct sk_buff *skb)
+{
+	if (skb_get_nfct(skb) == IP_CT_UNTRACKED)
+		nf_reset_ct(skb);
+}
+
 #if IS_ENABLED(CONFIG_IPV6)
 static int vrf_ip6_local_out(struct net *net, struct sock *sk,
 			     struct sk_buff *skb)
 {
 	int err;
 
+	vrf_nf_reset_ct(skb);
+
 	err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net,
 		      sk, skb, NULL, skb_dst(skb)->dev, dst_output);
 
@@ -508,6 +523,8 @@ static int vrf_ip_local_out(struct net *net, struct sock *sk,
 {
 	int err;
 
+	vrf_nf_reset_ct(skb);
+
 	err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk,
 		      skb, NULL, skb_dst(skb)->dev, dst_output);
 	if (likely(err == 1))
@@ -627,8 +644,7 @@ static void vrf_finish_direct(struct sk_buff *skb)
 		skb_pull(skb, ETH_HLEN);
 	}
 
-	/* reset skb device */
-	nf_reset_ct(skb);
+	vrf_nf_reset_ct(skb);
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
@@ -642,7 +658,7 @@ static int vrf_finish_output6(struct net *net, struct sock *sk,
 	struct neighbour *neigh;
 	int ret;
 
-	nf_reset_ct(skb);
+	vrf_nf_reset_ct(skb);
 
 	skb->protocol = htons(ETH_P_IPV6);
 	skb->dev = dev;
@@ -753,6 +769,8 @@ static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev,
 
 	skb->dev = vrf_dev;
 
+	vrf_nf_set_untracked(skb);
+
 	err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk,
 		      skb, NULL, vrf_dev, vrf_ip6_out_direct_finish);
 
@@ -860,7 +878,7 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
 	bool is_v6gw = false;
 	int ret = -EINVAL;
 
-	nf_reset_ct(skb);
+	vrf_nf_reset_ct(skb);
 
 	/* Be paranoid, rather than too clever. */
 	if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
@@ -988,6 +1006,8 @@ static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev,
 
 	skb->dev = vrf_dev;
 
+	vrf_nf_set_untracked(skb);
+
 	err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk,
 		      skb, NULL, vrf_dev, vrf_ip_out_direct_finish);
 

From 42d8c280dd65ec49ff5ceb6b9a1173dcbd8d7f95 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 25 Oct 2021 11:15:55 -0700
Subject: [PATCH 1396/1750] net: annotate data-race in neigh_output()

[ Upstream commit d18785e213866935b4c3dc0c33c3e18801ce0ce8 ]

neigh_output() reads n->nud_state and hh->hh_len locklessly.

This is fine, but we need to add annotations and document this.

We evaluate skip_cache first to avoid reading these fields
if the cache has to by bypassed.

syzbot report:

BUG: KCSAN: data-race in __neigh_event_send / ip_finish_output2

write to 0xffff88810798a885 of 1 bytes by interrupt on cpu 1:
 __neigh_event_send+0x40d/0xac0 net/core/neighbour.c:1128
 neigh_event_send include/net/neighbour.h:444 [inline]
 neigh_resolve_output+0x104/0x410 net/core/neighbour.c:1476
 neigh_output include/net/neighbour.h:510 [inline]
 ip_finish_output2+0x80a/0xaa0 net/ipv4/ip_output.c:221
 ip_finish_output+0x3b5/0x510 net/ipv4/ip_output.c:309
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:423
 dst_output include/net/dst.h:450 [inline]
 ip_local_out+0x164/0x220 net/ipv4/ip_output.c:126
 __ip_queue_xmit+0x9d3/0xa20 net/ipv4/ip_output.c:525
 ip_queue_xmit+0x34/0x40 net/ipv4/ip_output.c:539
 __tcp_transmit_skb+0x142a/0x1a00 net/ipv4/tcp_output.c:1405
 tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
 tcp_xmit_probe_skb net/ipv4/tcp_output.c:4011 [inline]
 tcp_write_wakeup+0x4a9/0x810 net/ipv4/tcp_output.c:4064
 tcp_send_probe0+0x2c/0x2b0 net/ipv4/tcp_output.c:4079
 tcp_probe_timer net/ipv4/tcp_timer.c:398 [inline]
 tcp_write_timer_handler+0x394/0x520 net/ipv4/tcp_timer.c:626
 tcp_write_timer+0xb9/0x180 net/ipv4/tcp_timer.c:642
 call_timer_fn+0x2e/0x1d0 kernel/time/timer.c:1421
 expire_timers+0x135/0x240 kernel/time/timer.c:1466
 __run_timers+0x368/0x430 kernel/time/timer.c:1734
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1747
 __do_softirq+0x12c/0x26e kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu kernel/softirq.c:636 [inline]
 irq_exit_rcu+0x4e/0xa0 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x69/0x80 arch/x86/kernel/apic/apic.c:1097
 asm_sysvec_apic_timer_interrupt+0x12/0x20
 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
 arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
 acpi_safe_halt drivers/acpi/processor_idle.c:109 [inline]
 acpi_idle_do_entry drivers/acpi/processor_idle.c:553 [inline]
 acpi_idle_enter+0x258/0x2e0 drivers/acpi/processor_idle.c:688
 cpuidle_enter_state+0x2b4/0x760 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:158 [inline]
 cpuidle_idle_call kernel/sched/idle.c:239 [inline]
 do_idle+0x1a3/0x250 kernel/sched/idle.c:306
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:403
 secondary_startup_64_no_verify+0xb1/0xbb

read to 0xffff88810798a885 of 1 bytes by interrupt on cpu 0:
 neigh_output include/net/neighbour.h:507 [inline]
 ip_finish_output2+0x79a/0xaa0 net/ipv4/ip_output.c:221
 ip_finish_output+0x3b5/0x510 net/ipv4/ip_output.c:309
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:423
 dst_output include/net/dst.h:450 [inline]
 ip_local_out+0x164/0x220 net/ipv4/ip_output.c:126
 __ip_queue_xmit+0x9d3/0xa20 net/ipv4/ip_output.c:525
 ip_queue_xmit+0x34/0x40 net/ipv4/ip_output.c:539
 __tcp_transmit_skb+0x142a/0x1a00 net/ipv4/tcp_output.c:1405
 tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
 tcp_xmit_probe_skb net/ipv4/tcp_output.c:4011 [inline]
 tcp_write_wakeup+0x4a9/0x810 net/ipv4/tcp_output.c:4064
 tcp_send_probe0+0x2c/0x2b0 net/ipv4/tcp_output.c:4079
 tcp_probe_timer net/ipv4/tcp_timer.c:398 [inline]
 tcp_write_timer_handler+0x394/0x520 net/ipv4/tcp_timer.c:626
 tcp_write_timer+0xb9/0x180 net/ipv4/tcp_timer.c:642
 call_timer_fn+0x2e/0x1d0 kernel/time/timer.c:1421
 expire_timers+0x135/0x240 kernel/time/timer.c:1466
 __run_timers+0x368/0x430 kernel/time/timer.c:1734
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1747
 __do_softirq+0x12c/0x26e kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu kernel/softirq.c:636 [inline]
 irq_exit_rcu+0x4e/0xa0 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x69/0x80 arch/x86/kernel/apic/apic.c:1097
 asm_sysvec_apic_timer_interrupt+0x12/0x20
 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
 arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
 acpi_safe_halt drivers/acpi/processor_idle.c:109 [inline]
 acpi_idle_do_entry drivers/acpi/processor_idle.c:553 [inline]
 acpi_idle_enter+0x258/0x2e0 drivers/acpi/processor_idle.c:688
 cpuidle_enter_state+0x2b4/0x760 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:158 [inline]
 cpuidle_idle_call kernel/sched/idle.c:239 [inline]
 do_idle+0x1a3/0x250 kernel/sched/idle.c:306
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:403
 rest_init+0xee/0x100 init/main.c:734
 arch_call_rest_init+0xa/0xb
 start_kernel+0x5e4/0x669 init/main.c:1142
 secondary_startup_64_no_verify+0xb1/0xbb

value changed: 0x20 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/neighbour.h | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 22ced1381ede..990f9b1d1709 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -504,10 +504,15 @@ static inline int neigh_output(struct neighbour *n, struct sk_buff *skb,
 {
 	const struct hh_cache *hh = &n->hh;
 
-	if ((n->nud_state & NUD_CONNECTED) && hh->hh_len && !skip_cache)
+	/* n->nud_state and hh->hh_len could be changed under us.
+	 * neigh_hh_output() is taking care of the race later.
+	 */
+	if (!skip_cache &&
+	    (READ_ONCE(n->nud_state) & NUD_CONNECTED) &&
+	    READ_ONCE(hh->hh_len))
 		return neigh_hh_output(hh, skb);
-	else
-		return n->output(n, skb);
+
+	return n->output(n, skb);
 }
 
 static inline struct neighbour *

From eeb96ebdc6862fa597daf594e4131d019c7611f7 Mon Sep 17 00:00:00 2001
From: Stefan Schaeckeler <schaecsn@gmx.net>
Date: Sun, 24 Oct 2021 15:04:45 -0700
Subject: [PATCH 1397/1750] ACPI: AC: Quirk GK45 to skip reading _PSR

[ Upstream commit 3d730ee686800d71ecc5c3cb8460dcdcdeaf38a3 ]

Let GK45 not go into BIOS for determining the AC power state.

The BIOS wrongly returns 0, so hardcode the power state to 1.

The mini PC GK45 by Besstar Tech Lld. (aka Kodlix) just runs
off AC. It does not include any batteries. Nevertheless BIOS
reports AC off:

root@kodlix:/usr/src/linux# cat /sys/class/power_supply/ADP1/online
0

root@kodlix:/usr/src/linux# modprobe acpi_dbg
root@kodlix:/usr/src/linux# tools/power/acpi/acpidbg

- find _PSR
   \_SB.PCI0.SBRG.H_EC.ADP1._PSR Method       000000009283cee8 001 Args 0 Len 001C Aml 00000000f54e5f67

- execute \_SB.PCI0.SBRG.H_EC.ADP1._PSR
Evaluating \_SB.PCI0.SBRG.H_EC.ADP1._PSR
Evaluation of \_SB.PCI0.SBRG.H_EC.ADP1._PSR returned object 00000000dc08c187, external buffer length 18
 [Integer] = 0000000000000000

that should be

 [Integer] = 0000000000000001

Signed-off-by: Stefan Schaeckeler <schaecsn@gmx.net>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/ac.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 46a64e9fa716..23ca1a1c67b7 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -64,6 +64,7 @@ static SIMPLE_DEV_PM_OPS(acpi_ac_pm, NULL, acpi_ac_resume);
 
 static int ac_sleep_before_get_state_ms;
 static int ac_check_pmic = 1;
+static int ac_only;
 
 static struct acpi_driver acpi_ac_driver = {
 	.name = "ac",
@@ -99,6 +100,11 @@ static int acpi_ac_get_state(struct acpi_ac *ac)
 	if (!ac)
 		return -EINVAL;
 
+	if (ac_only) {
+		ac->state = 1;
+		return 0;
+	}
+
 	status = acpi_evaluate_integer(ac->device->handle, "_PSR", NULL,
 				       &ac->state);
 	if (ACPI_FAILURE(status)) {
@@ -212,6 +218,12 @@ static int __init ac_do_not_check_pmic_quirk(const struct dmi_system_id *d)
 	return 0;
 }
 
+static int __init ac_only_quirk(const struct dmi_system_id *d)
+{
+	ac_only = 1;
+	return 0;
+}
+
 /* Please keep this list alphabetically sorted */
 static const struct dmi_system_id ac_dmi_table[]  __initconst = {
 	{
@@ -221,6 +233,13 @@ static const struct dmi_system_id ac_dmi_table[]  __initconst = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"),
 		},
 	},
+	{
+		/* Kodlix GK45 returning incorrect state */
+		.callback = ac_only_quirk,
+		.matches = {
+			DMI_MATCH(DMI_PRODUCT_NAME, "GK45"),
+		},
+	},
 	{
 		/* Lenovo Ideapad Miix 320, AXP288 PMIC, separate fuel-gauge */
 		.callback = ac_do_not_check_pmic_quirk,

From 428bb3d71e35b41f6ee325d680c56a6d6e9594f8 Mon Sep 17 00:00:00 2001
From: Sidong Yang <realwakka@gmail.com>
Date: Thu, 26 Aug 2021 14:44:36 +0000
Subject: [PATCH 1398/1750] btrfs: reflink: initialize return value to 0 in
 btrfs_extent_same()

[ Upstream commit 44bee215f72f13874c0e734a0712c2e3264c0108 ]

Fix a warning reported by smatch that ret could be returned without
initialized.  The dedupe operations are supposed to to return 0 for a 0
length range but the caller does not pass olen == 0. To keep this
behaviour and also fix the warning initialize ret to 0.

Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Sidong Yang <realwakka@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/reflink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/btrfs/reflink.c b/fs/btrfs/reflink.c
index 96ef9fed9a65..3a3102bc15a0 100644
--- a/fs/btrfs/reflink.c
+++ b/fs/btrfs/reflink.c
@@ -634,7 +634,7 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 len,
 static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
 			     struct inode *dst, u64 dst_loff)
 {
-	int ret;
+	int ret = 0;
 	u64 i, tail_len, chunk_count;
 	struct btrfs_root *root_dst = BTRFS_I(dst)->root;
 

From b917f9b94633bde8982f98965aa1fa534b9e8f46 Mon Sep 17 00:00:00 2001
From: Josef Bacik <josef@toxicpanda.com>
Date: Tue, 27 Jul 2021 17:01:14 -0400
Subject: [PATCH 1399/1750] btrfs: do not take the uuid_mutex in
 btrfs_rm_device

[ Upstream commit 8ef9dc0f14ba6124c62547a4fdc59b163d8b864e ]

We got the following lockdep splat while running fstests (specifically
btrfs/003 and btrfs/020 in a row) with the new rc.  This was uncovered
by 87579e9b7d8d ("loop: use worker per cgroup instead of kworker") which
converted loop to using workqueues, which comes with lockdep
annotations that don't exist with kworkers.  The lockdep splat is as
follows:

  WARNING: possible circular locking dependency detected
  5.14.0-rc2-custom+ #34 Not tainted
  ------------------------------------------------------
  losetup/156417 is trying to acquire lock:
  ffff9c7645b02d38 ((wq_completion)loop0){+.+.}-{0:0}, at: flush_workqueue+0x84/0x600

  but task is already holding lock:
  ffff9c7647395468 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x650 [loop]

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #5 (&lo->lo_mutex){+.+.}-{3:3}:
	 __mutex_lock+0xba/0x7c0
	 lo_open+0x28/0x60 [loop]
	 blkdev_get_whole+0x28/0xf0
	 blkdev_get_by_dev.part.0+0x168/0x3c0
	 blkdev_open+0xd2/0xe0
	 do_dentry_open+0x163/0x3a0
	 path_openat+0x74d/0xa40
	 do_filp_open+0x9c/0x140
	 do_sys_openat2+0xb1/0x170
	 __x64_sys_openat+0x54/0x90
	 do_syscall_64+0x3b/0x90
	 entry_SYSCALL_64_after_hwframe+0x44/0xae

  -> #4 (&disk->open_mutex){+.+.}-{3:3}:
	 __mutex_lock+0xba/0x7c0
	 blkdev_get_by_dev.part.0+0xd1/0x3c0
	 blkdev_get_by_path+0xc0/0xd0
	 btrfs_scan_one_device+0x52/0x1f0 [btrfs]
	 btrfs_control_ioctl+0xac/0x170 [btrfs]
	 __x64_sys_ioctl+0x83/0xb0
	 do_syscall_64+0x3b/0x90
	 entry_SYSCALL_64_after_hwframe+0x44/0xae

  -> #3 (uuid_mutex){+.+.}-{3:3}:
	 __mutex_lock+0xba/0x7c0
	 btrfs_rm_device+0x48/0x6a0 [btrfs]
	 btrfs_ioctl+0x2d1c/0x3110 [btrfs]
	 __x64_sys_ioctl+0x83/0xb0
	 do_syscall_64+0x3b/0x90
	 entry_SYSCALL_64_after_hwframe+0x44/0xae

  -> #2 (sb_writers#11){.+.+}-{0:0}:
	 lo_write_bvec+0x112/0x290 [loop]
	 loop_process_work+0x25f/0xcb0 [loop]
	 process_one_work+0x28f/0x5d0
	 worker_thread+0x55/0x3c0
	 kthread+0x140/0x170
	 ret_from_fork+0x22/0x30

  -> #1 ((work_completion)(&lo->rootcg_work)){+.+.}-{0:0}:
	 process_one_work+0x266/0x5d0
	 worker_thread+0x55/0x3c0
	 kthread+0x140/0x170
	 ret_from_fork+0x22/0x30

  -> #0 ((wq_completion)loop0){+.+.}-{0:0}:
	 __lock_acquire+0x1130/0x1dc0
	 lock_acquire+0xf5/0x320
	 flush_workqueue+0xae/0x600
	 drain_workqueue+0xa0/0x110
	 destroy_workqueue+0x36/0x250
	 __loop_clr_fd+0x9a/0x650 [loop]
	 lo_ioctl+0x29d/0x780 [loop]
	 block_ioctl+0x3f/0x50
	 __x64_sys_ioctl+0x83/0xb0
	 do_syscall_64+0x3b/0x90
	 entry_SYSCALL_64_after_hwframe+0x44/0xae

  other info that might help us debug this:
  Chain exists of:
    (wq_completion)loop0 --> &disk->open_mutex --> &lo->lo_mutex
   Possible unsafe locking scenario:
	 CPU0                    CPU1
	 ----                    ----
    lock(&lo->lo_mutex);
				 lock(&disk->open_mutex);
				 lock(&lo->lo_mutex);
    lock((wq_completion)loop0);

   *** DEADLOCK ***
  1 lock held by losetup/156417:
   #0: ffff9c7647395468 (&lo->lo_mutex){+.+.}-{3:3}, at: __loop_clr_fd+0x41/0x650 [loop]

  stack backtrace:
  CPU: 8 PID: 156417 Comm: losetup Not tainted 5.14.0-rc2-custom+ #34
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  Call Trace:
   dump_stack_lvl+0x57/0x72
   check_noncircular+0x10a/0x120
   __lock_acquire+0x1130/0x1dc0
   lock_acquire+0xf5/0x320
   ? flush_workqueue+0x84/0x600
   flush_workqueue+0xae/0x600
   ? flush_workqueue+0x84/0x600
   drain_workqueue+0xa0/0x110
   destroy_workqueue+0x36/0x250
   __loop_clr_fd+0x9a/0x650 [loop]
   lo_ioctl+0x29d/0x780 [loop]
   ? __lock_acquire+0x3a0/0x1dc0
   ? update_dl_rq_load_avg+0x152/0x360
   ? lock_is_held_type+0xa5/0x120
   ? find_held_lock.constprop.0+0x2b/0x80
   block_ioctl+0x3f/0x50
   __x64_sys_ioctl+0x83/0xb0
   do_syscall_64+0x3b/0x90
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  RIP: 0033:0x7f645884de6b

Usually the uuid_mutex exists to protect the fs_devices that map
together all of the devices that match a specific uuid.  In rm_device
we're messing with the uuid of a device, so it makes sense to protect
that here.

However in doing that it pulls in a whole host of lockdep dependencies,
as we call mnt_may_write() on the sb before we grab the uuid_mutex, thus
we end up with the dependency chain under the uuid_mutex being added
under the normal sb write dependency chain, which causes problems with
loop devices.

We don't need the uuid mutex here however.  If we call
btrfs_scan_one_device() before we scratch the super block we will find
the fs_devices and not find the device itself and return EBUSY because
the fs_devices is open.  If we call it after the scratch happens it will
not appear to be a valid btrfs file system.

We do not need to worry about other fs_devices modifying operations here
because we're protected by the exclusive operations locking.

So drop the uuid_mutex here in order to fix the lockdep splat.

A more detailed explanation from the discussion:

We are worried about rm and scan racing with each other, before this
change we'll zero the device out under the UUID mutex so when scan does
run it'll make sure that it can go through the whole device scan thing
without rm messing with us.

We aren't worried if the scratch happens first, because the result is we
don't think this is a btrfs device and we bail out.

The only case we are concerned with is we scratch _after_ scan is able
to read the superblock and gets a seemingly valid super block, so lets
consider this case.

Scan will call device_list_add() with the device we're removing.  We'll
call find_fsid_with_metadata_uuid() and get our fs_devices for this
UUID.  At this point we lock the fs_devices->device_list_mutex.  This is
what protects us in this case, but we have two cases here.

1. We aren't to the device removal part of the RM.  We found our device,
   and device name matches our path, we go down and we set total_devices
   to our super number of devices, which doesn't affect anything because
   we haven't done the remove yet.

2. We are past the device removal part, which is protected by the
   device_list_mutex.  Scan doesn't find the device, it goes down and
   does the

   if (fs_devices->opened)
	   return -EBUSY;

   check and we bail out.

Nothing about this situation is ideal, but the lockdep splat is real,
and the fix is safe, tho admittedly a bit scary looking.

Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ copy more from the discussion ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/btrfs/volumes.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 8946355dfe44..d9e582e40b5b 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2069,8 +2069,11 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,
 	u64 num_devices;
 	int ret = 0;
 
-	mutex_lock(&uuid_mutex);
-
+	/*
+	 * The device list in fs_devices is accessed without locks (neither
+	 * uuid_mutex nor device_list_mutex) as it won't change on a mounted
+	 * filesystem and another device rm cannot run.
+	 */
 	num_devices = btrfs_num_devices(fs_info);
 
 	ret = btrfs_check_raid_min_devices(fs_info, num_devices - 1);
@@ -2114,11 +2117,9 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,
 		mutex_unlock(&fs_info->chunk_mutex);
 	}
 
-	mutex_unlock(&uuid_mutex);
 	ret = btrfs_shrink_device(device, 0);
 	if (!ret)
 		btrfs_reada_remove_dev(device);
-	mutex_lock(&uuid_mutex);
 	if (ret)
 		goto error_undo;
 
@@ -2194,7 +2195,6 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path,
 	}
 
 out:
-	mutex_unlock(&uuid_mutex);
 	return ret;
 
 error_undo:

From a27095cda17df56acc97e8e7dc765ff5d8e5f479 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Mon, 18 Oct 2021 15:34:13 +0800
Subject: [PATCH 1400/1750] spi: bcm-qspi: Fix missing clk_disable_unprepare()
 on error in bcm_qspi_probe()

[ Upstream commit ca9b8f56ec089d3a436050afefd17b7237301f47 ]

Fix the missing clk_disable_unprepare() before return
from bcm_qspi_probe() in the error handling case.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211018073413.2029081-1-yangyingliang@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-bcm-qspi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
index b4d5930be2a9..3c0ae6dbc43e 100644
--- a/drivers/spi/spi-bcm-qspi.c
+++ b/drivers/spi/spi-bcm-qspi.c
@@ -1460,7 +1460,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
 					       &qspi->dev_ids[val]);
 			if (ret < 0) {
 				dev_err(&pdev->dev, "IRQ %s not found\n", name);
-				goto qspi_probe_err;
+				goto qspi_unprepare_err;
 			}
 
 			qspi->dev_ids[val].dev = qspi;
@@ -1475,7 +1475,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
 	if (!num_ints) {
 		dev_err(&pdev->dev, "no IRQs registered, cannot init driver\n");
 		ret = -EINVAL;
-		goto qspi_probe_err;
+		goto qspi_unprepare_err;
 	}
 
 	bcm_qspi_hw_init(qspi);
@@ -1499,6 +1499,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
 
 qspi_reg_err:
 	bcm_qspi_hw_uninit(qspi);
+qspi_unprepare_err:
 	clk_disable_unprepare(qspi->clk);
 qspi_probe_err:
 	kfree(qspi->dev_ids);

From c4cfdf5fa8fcb60c55e825de3c0876a2a27778b5 Mon Sep 17 00:00:00 2001
From: Loic Poulain <loic.poulain@linaro.org>
Date: Mon, 18 Oct 2021 12:57:57 +0200
Subject: [PATCH 1401/1750] wcn36xx: Correct band/freq reporting on RX

[ Upstream commit 8a27ca39478270e07baf9c09aa0c99709769ba03 ]

For packets originating from hardware scan, the channel and band is
included in the buffer descriptor (bd->rf_band & bd->rx_ch).

For 2Ghz band the channel value is directly reported in the 4-bit
rx_ch field. For 5Ghz band, the rx_ch field contains a mapping
index (given the 4-bit limitation).

The reserved0 value field is also used to extend 4-bit mapping to
5-bit mapping to support more than 16 5Ghz channels.

This change adds correct reporting of the frequency/band, that is
used in scan mechanism. And is required for 5Ghz hardware scan
support.

Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1634554678-7993-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/txrx.c | 23 +++++++++++++++++++++++
 drivers/net/wireless/ath/wcn36xx/txrx.h |  3 ++-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index eaf2410e3964..c0f51fa13dfa 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -31,6 +31,13 @@ struct wcn36xx_rate {
 	enum rate_info_bw bw;
 };
 
+/* Buffer descriptor rx_ch field is limited to 5-bit (4+1), a mapping is used
+ * for 11A Channels.
+ */
+static const u8 ab_rx_ch_map[] = { 36, 40, 44, 48, 52, 56, 60, 64, 100, 104,
+				   108, 112, 116, 120, 124, 128, 132, 136, 140,
+				   149, 153, 157, 161, 165, 144 };
+
 static const struct wcn36xx_rate wcn36xx_rate_table[] = {
 	/* 11b rates */
 	{  10, 0, RX_ENC_LEGACY, 0, RATE_INFO_BW_20 },
@@ -291,6 +298,22 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb)
 	    ieee80211_is_probe_resp(hdr->frame_control))
 		status.boottime_ns = ktime_get_boottime_ns();
 
+	if (bd->scan_learn) {
+		/* If packet originates from hardware scanning, extract the
+		 * band/channel from bd descriptor.
+		 */
+		u8 hwch = (bd->reserved0 << 4) + bd->rx_ch;
+
+		if (bd->rf_band != 1 && hwch <= sizeof(ab_rx_ch_map) && hwch >= 1) {
+			status.band = NL80211_BAND_5GHZ;
+			status.freq = ieee80211_channel_to_frequency(ab_rx_ch_map[hwch - 1],
+								     status.band);
+		} else {
+			status.band = NL80211_BAND_2GHZ;
+			status.freq = ieee80211_channel_to_frequency(hwch, status.band);
+		}
+	}
+
 	memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
 
 	if (ieee80211_is_beacon(hdr->frame_control)) {
diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.h b/drivers/net/wireless/ath/wcn36xx/txrx.h
index 032216e82b2b..b54311ffde9c 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.h
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.h
@@ -110,7 +110,8 @@ struct wcn36xx_rx_bd {
 	/* 0x44 */
 	u32	exp_seq_num:12;
 	u32	cur_seq_num:12;
-	u32	fr_type_subtype:8;
+	u32	rf_band:2;
+	u32	fr_type_subtype:6;
 
 	/* 0x48 */
 	u32	msdu_size:16;

From ddfcae905238b3e3fef7440feba455b957d96bef Mon Sep 17 00:00:00 2001
From: Vitaly Kuznetsov <vkuznets@redhat.com>
Date: Tue, 12 Oct 2021 17:50:05 +0200
Subject: [PATCH 1402/1750] x86/hyperv: Protect set_hv_tscchange_cb() against
 getting preempted

[ Upstream commit 285f68afa8b20f752b0b7194d54980b5e0e27b75 ]

The following issue is observed with CONFIG_DEBUG_PREEMPT when KVM loads:

 KVM: vmx: using Hyper-V Enlightened VMCS
 BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/488
 caller is set_hv_tscchange_cb+0x16/0x80
 CPU: 1 PID: 488 Comm: systemd-udevd Not tainted 5.15.0-rc5+ #396
 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019
 Call Trace:
  dump_stack_lvl+0x6a/0x9a
  check_preemption_disabled+0xde/0xe0
  ? kvm_gen_update_masterclock+0xd0/0xd0 [kvm]
  set_hv_tscchange_cb+0x16/0x80
  kvm_arch_init+0x23f/0x290 [kvm]
  kvm_init+0x30/0x310 [kvm]
  vmx_init+0xaf/0x134 [kvm_intel]
  ...

set_hv_tscchange_cb() can get preempted in between acquiring
smp_processor_id() and writing to HV_X64_MSR_REENLIGHTENMENT_CONTROL. This
is not an issue by itself: HV_X64_MSR_REENLIGHTENMENT_CONTROL is a
partition-wide MSR and it doesn't matter which particular CPU will be
used to receive reenlightenment notifications. The only real problem can
(in theory) be observed if the CPU whose id was acquired with
smp_processor_id() goes offline before we manage to write to the MSR,
the logic in hv_cpu_die() won't be able to reassign it correctly.

Reported-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Link: https://lore.kernel.org/r/20211012155005.1613352-1-vkuznets@redhat.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/hyperv/hv_init.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c
index 6375967a8244..3cf403023259 100644
--- a/arch/x86/hyperv/hv_init.c
+++ b/arch/x86/hyperv/hv_init.c
@@ -168,7 +168,6 @@ void set_hv_tscchange_cb(void (*cb)(void))
 	struct hv_reenlightenment_control re_ctrl = {
 		.vector = HYPERV_REENLIGHTENMENT_VECTOR,
 		.enabled = 1,
-		.target_vp = hv_vp_index[smp_processor_id()]
 	};
 	struct hv_tsc_emulation_control emu_ctrl = {.enabled = 1};
 
@@ -182,8 +181,12 @@ void set_hv_tscchange_cb(void (*cb)(void))
 	/* Make sure callback is registered before we write to MSRs */
 	wmb();
 
+	re_ctrl.target_vp = hv_vp_index[get_cpu()];
+
 	wrmsrl(HV_X64_MSR_REENLIGHTENMENT_CONTROL, *((u64 *)&re_ctrl));
 	wrmsrl(HV_X64_MSR_TSC_EMULATION_CONTROL, *((u64 *)&emu_ctrl));
+
+	put_cpu();
 }
 EXPORT_SYMBOL_GPL(set_hv_tscchange_cb);
 

From 6f038b1a941e87886f6bbced0a65aea343a9859e Mon Sep 17 00:00:00 2001
From: Anson Jacob <Anson.Jacob@amd.com>
Date: Fri, 17 Sep 2021 18:29:36 -0400
Subject: [PATCH 1403/1750] drm/amd/display: dcn20_resource_construct reduce
 scope of FPU enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bc39a69a2ac484e6575a958567c162ef56c9f278 ]

Limit when FPU is enabled to only functions that does FPU operations for
dcn20_resource_construct, which gets called during driver
initialization.

Enabling FPU operation disables preemption.  Sleeping functions(mutex
(un)lock, memory allocation using GFP_KERNEL, etc.) should not be called
when preemption is disabled.

Fixes the following case caught by enabling
CONFIG_DEBUG_ATOMIC_SLEEP in kernel config
[    1.338434] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281
[    1.347395] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 197, name: systemd-udevd
[    1.356356] CPU: 7 PID: 197 Comm: systemd-udevd Not tainted 5.13.0+ #3
[    1.356358] Hardware name: System manufacturer System Product Name/PRIME X570-PRO, BIOS 3405 02/01/2021
[    1.356360] Call Trace:
[    1.356361]  dump_stack+0x6b/0x86
[    1.356366]  ___might_sleep.cold+0x87/0x98
[    1.356370]  __might_sleep+0x4b/0x80
[    1.356372]  mutex_lock+0x21/0x50
[    1.356376]  smu_get_uclk_dpm_states+0x3f/0x80 [amdgpu]
[    1.356538]  pp_nv_get_uclk_dpm_states+0x35/0x50 [amdgpu]
[    1.356711]  init_soc_bounding_box+0xf9/0x210 [amdgpu]
[    1.356892]  ? create_object+0x20d/0x340
[    1.356897]  ? dcn20_resource_construct+0x46f/0xd30 [amdgpu]
[    1.357077]  dcn20_resource_construct+0x4b1/0xd30 [amdgpu]
...

Tested on: 5700XT (NAVI10 0x1002:0x731F 0x1DA2:0xE410 0xC1)

Cc: Christian König <christian.koenig@amd.com>
Cc: Hersen Wu <hersenxs.wu@amd.com>
Cc: Anson Jacob <Anson.Jacob@amd.com>
Cc: Harry Wentland <harry.wentland@amd.com>

Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Acked-by: Agustin Gutierrez <agustin.gutierrez@amd.com>
Signed-off-by: Anson Jacob <Anson.Jacob@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../drm/amd/display/dc/dcn20/dcn20_resource.c    | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
index 5dbc290bcbe8..312181654646 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
@@ -3754,16 +3754,22 @@ static bool init_soc_bounding_box(struct dc *dc,
 			clock_limits_available = (status == PP_SMU_RESULT_OK);
 		}
 
-		if (clock_limits_available && uclk_states_available && num_states)
+		if (clock_limits_available && uclk_states_available && num_states) {
+			DC_FP_START();
 			dcn20_update_bounding_box(dc, loaded_bb, &max_clocks, uclk_states, num_states);
-		else if (clock_limits_available)
+			DC_FP_END();
+		} else if (clock_limits_available) {
+			DC_FP_START();
 			dcn20_cap_soc_clocks(loaded_bb, max_clocks);
+			DC_FP_END();
+		}
 	}
 
 	loaded_ip->max_num_otg = pool->base.res_cap->num_timing_generator;
 	loaded_ip->max_num_dpp = pool->base.pipe_count;
+	DC_FP_START();
 	dcn20_patch_bounding_box(dc, loaded_bb);
-
+	DC_FP_END();
 	return true;
 }
 
@@ -3783,8 +3789,6 @@ static bool dcn20_resource_construct(
 	enum dml_project dml_project_version =
 			get_dml_project_version(ctx->asic_id.hw_internal_rev);
 
-	DC_FP_START();
-
 	ctx->dc_bios->regs = &bios_regs;
 	pool->base.funcs = &dcn20_res_pool_funcs;
 
@@ -4128,12 +4132,10 @@ static bool dcn20_resource_construct(
 		pool->base.oem_device = NULL;
 	}
 
-	DC_FP_END();
 	return true;
 
 create_fail:
 
-	DC_FP_END();
 	dcn20_resource_destruct(pool);
 
 	return false;

From d8166a27c64800a1a3fade1b54c947d369c9f7ef Mon Sep 17 00:00:00 2001
From: Shuah Khan <skhan@linuxfoundation.org>
Date: Wed, 27 Oct 2021 13:26:19 -0600
Subject: [PATCH 1404/1750] selftests/core: fix conflicting types compile error
 for close_range()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f35dcaa0a8a29188ed61083d153df1454cf89d08 ]

close_range() test type conflicts with close_range() library call in
x86_64-linux-gnu/bits/unistd_ext.h. Fix it by changing the name to
core_close_range().

gcc -g -I../../../../usr/include/    close_range_test.c  -o ../tools/testing/selftests/core/close_range_test
In file included from close_range_test.c:16:
close_range_test.c:57:6: error: conflicting types for ‘close_range’; have ‘void(struct __test_metadata *)’
   57 | TEST(close_range)
      |      ^~~~~~~~~~~
../kselftest_harness.h:181:21: note: in definition of macro ‘__TEST_IMPL’
  181 |         static void test_name(struct __test_metadata *_metadata); \
      |                     ^~~~~~~~~
close_range_test.c:57:1: note: in expansion of macro ‘TEST’
   57 | TEST(close_range)
      | ^~~~
In file included from /usr/include/unistd.h:1204,
                 from close_range_test.c:13:
/usr/include/x86_64-linux-gnu/bits/unistd_ext.h:56:12: note: previous declaration of ‘close_range’ with type ‘int(unsigned int,  unsigned int,  int)’
   56 | extern int close_range (unsigned int __fd, unsigned int __max_fd,
      |            ^~~~~~~~~~~

Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/core/close_range_test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/core/close_range_test.c b/tools/testing/selftests/core/close_range_test.c
index 575b391ddc78..0a26795842f6 100644
--- a/tools/testing/selftests/core/close_range_test.c
+++ b/tools/testing/selftests/core/close_range_test.c
@@ -33,7 +33,7 @@ static inline int sys_close_range(unsigned int fd, unsigned int max_fd,
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
 #endif
 
-TEST(close_range)
+TEST(core_close_range)
 {
 	int i, ret;
 	int open_fds[101];

From 44d4c43babb07a89e0308b1da3d94df1a9bd19ab Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@stackframe.org>
Date: Sat, 9 Oct 2021 20:24:39 +0200
Subject: [PATCH 1405/1750] parisc: fix warning in flush_tlb_all

[ Upstream commit 1030d681319b43869e0d5b568b9d0226652d1a6f ]

I've got the following splat after enabling preemption:

[    3.724721] BUG: using __this_cpu_add() in preemptible [00000000] code: swapper/0/1
[    3.734630] caller is __this_cpu_preempt_check+0x38/0x50
[    3.740635] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.0-rc4-64bit+ #324
[    3.744605] Hardware name: 9000/785/C8000
[    3.744605] Backtrace:
[    3.744605]  [<00000000401d9d58>] show_stack+0x74/0xb0
[    3.744605]  [<0000000040c27bd4>] dump_stack_lvl+0x10c/0x188
[    3.744605]  [<0000000040c27c84>] dump_stack+0x34/0x48
[    3.744605]  [<0000000040c33438>] check_preemption_disabled+0x178/0x1b0
[    3.744605]  [<0000000040c334f8>] __this_cpu_preempt_check+0x38/0x50
[    3.744605]  [<00000000401d632c>] flush_tlb_all+0x58/0x2e0
[    3.744605]  [<00000000401075c0>] 0x401075c0
[    3.744605]  [<000000004010b8fc>] 0x4010b8fc
[    3.744605]  [<00000000401080fc>] 0x401080fc
[    3.744605]  [<00000000401d5224>] do_one_initcall+0x128/0x378
[    3.744605]  [<0000000040102de8>] 0x40102de8
[    3.744605]  [<0000000040c33864>] kernel_init+0x60/0x3a8
[    3.744605]  [<00000000401d1020>] ret_from_kernel_thread+0x20/0x28
[    3.744605]

Fix this by moving the __inc_irq_stat() into the locked section.

Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/parisc/mm/init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index 3ec633b11b54..8f10cc6ee0fc 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -844,9 +844,9 @@ void flush_tlb_all(void)
 {
 	int do_recycle;
 
-	__inc_irq_stat(irq_tlb_count);
 	do_recycle = 0;
 	spin_lock(&sid_lock);
+	__inc_irq_stat(irq_tlb_count);
 	if (dirty_space_ids > RECYCLE_THRESHOLD) {
 	    BUG_ON(recycle_inuse);  /* FIXME: Use a semaphore/wait queue here */
 	    get_dirty_sids(&recycle_ndirty,recycle_dirty_array);
@@ -865,8 +865,8 @@ void flush_tlb_all(void)
 #else
 void flush_tlb_all(void)
 {
-	__inc_irq_stat(irq_tlb_count);
 	spin_lock(&sid_lock);
+	__inc_irq_stat(irq_tlb_count);
 	flush_tlb_all_local(NULL);
 	recycle_sids();
 	spin_unlock(&sid_lock);

From 50a2d1229b512d79233ce57ec5226f29467af8e1 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 5 Oct 2021 00:05:43 +0200
Subject: [PATCH 1406/1750] task_stack: Fix end_of_stack() for architectures
 with upwards-growing stack

[ Upstream commit 9cc2fa4f4a92ccc6760d764e7341be46ee8aaaa1 ]

The function end_of_stack() returns a pointer to the last entry of a
stack. For architectures like parisc where the stack grows upwards
return the pointer to the highest address in the stack.

Without this change I faced a crash on parisc, because the stackleak
functionality wrote STACKLEAK_POISON to the lowest address and thus
overwrote the first 4 bytes of the task_struct which included the
TIF_FLAGS.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sched/task_stack.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h
index 2413427e439c..d10150587d81 100644
--- a/include/linux/sched/task_stack.h
+++ b/include/linux/sched/task_stack.h
@@ -25,7 +25,11 @@ static inline void *task_stack_page(const struct task_struct *task)
 
 static inline unsigned long *end_of_stack(const struct task_struct *task)
 {
+#ifdef CONFIG_STACK_GROWSUP
+	return (unsigned long *)((unsigned long)task->stack + THREAD_SIZE) - 1;
+#else
 	return task->stack;
+#endif
 }
 
 #elif !defined(__HAVE_THREAD_FUNCTIONS)

From ee75174f6ab93611e1623f0ae5590beda008aef5 Mon Sep 17 00:00:00 2001
From: Gao Xiang <hsiangkao@linux.alibaba.com>
Date: Mon, 25 Oct 2021 15:43:11 +0800
Subject: [PATCH 1407/1750] erofs: don't trigger WARN() when decompression
 fails

[ Upstream commit a0961f351d82d43ab0b845304caa235dfe249ae9 ]

syzbot reported a WARNING [1] due to corrupted compressed data.

As Dmitry said, "If this is not a kernel bug, then the code should
not use WARN. WARN if for kernel bugs and is recognized as such by
all testing systems and humans."

[1] https://lore.kernel.org/r/000000000000b3586105cf0ff45e@google.com

Link: https://lore.kernel.org/r/20211025074311.130395-1-hsiangkao@linux.alibaba.com
Cc: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Reported-by: syzbot+d8aaffc3719597e8cfb4@syzkaller.appspotmail.com
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/erofs/decompressor.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/erofs/decompressor.c b/fs/erofs/decompressor.c
index cbadbf55c6c2..8a6260aac26c 100644
--- a/fs/erofs/decompressor.c
+++ b/fs/erofs/decompressor.c
@@ -170,7 +170,6 @@ static int z_erofs_lz4_decompress(struct z_erofs_decompress_req *rq, u8 *out)
 		erofs_err(rq->sb, "failed to decompress %d in[%u, %u] out[%u]",
 			  ret, inlen, inputmargin, rq->outputsize);
 
-		WARN_ON(1);
 		print_hex_dump(KERN_DEBUG, "[ in]: ", DUMP_PREFIX_OFFSET,
 			       16, 1, src + inputmargin, inlen, true);
 		print_hex_dump(KERN_DEBUG, "[out]: ", DUMP_PREFIX_OFFSET,

From a1ec31a0befa5458366959224e8e6d94c1513fa1 Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@stackframe.org>
Date: Sat, 9 Oct 2021 23:15:17 +0200
Subject: [PATCH 1408/1750] parisc/unwind: fix unwinder when CONFIG_64BIT is
 enabled

[ Upstream commit 8e0ba125c2bf1030af3267058019ba86da96863f ]

With 64 bit kernels unwind_special() is not working because
it compares the pc to the address of the function descriptor.
Add a helper function that compares pc with the dereferenced
address. This fixes all of the backtraces on my c8000. Without
this changes, a lot of backtraces are missing in kdb or the
show-all-tasks command from /proc/sysrq-trigger.

Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/parisc/kernel/unwind.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/arch/parisc/kernel/unwind.c b/arch/parisc/kernel/unwind.c
index 87ae476d1c4f..86a57fb0e6fa 100644
--- a/arch/parisc/kernel/unwind.c
+++ b/arch/parisc/kernel/unwind.c
@@ -21,6 +21,8 @@
 #include <asm/ptrace.h>
 
 #include <asm/unwind.h>
+#include <asm/switch_to.h>
+#include <asm/sections.h>
 
 /* #define DEBUG 1 */
 #ifdef DEBUG
@@ -203,6 +205,11 @@ int __init unwind_init(void)
 	return 0;
 }
 
+static bool pc_is_kernel_fn(unsigned long pc, void *fn)
+{
+	return (unsigned long)dereference_kernel_function_descriptor(fn) == pc;
+}
+
 static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int frame_size)
 {
 	/*
@@ -221,7 +228,7 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
 	extern void * const _call_on_stack;
 #endif /* CONFIG_IRQSTACKS */
 
-	if (pc == (unsigned long) &handle_interruption) {
+	if (pc_is_kernel_fn(pc, handle_interruption)) {
 		struct pt_regs *regs = (struct pt_regs *)(info->sp - frame_size - PT_SZ_ALGN);
 		dbg("Unwinding through handle_interruption()\n");
 		info->prev_sp = regs->gr[30];
@@ -229,13 +236,13 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
 		return 1;
 	}
 
-	if (pc == (unsigned long) &ret_from_kernel_thread ||
-	    pc == (unsigned long) &syscall_exit) {
+	if (pc_is_kernel_fn(pc, ret_from_kernel_thread) ||
+	    pc_is_kernel_fn(pc, syscall_exit)) {
 		info->prev_sp = info->prev_ip = 0;
 		return 1;
 	}
 
-	if (pc == (unsigned long) &intr_return) {
+	if (pc_is_kernel_fn(pc, intr_return)) {
 		struct pt_regs *regs;
 
 		dbg("Found intr_return()\n");
@@ -246,20 +253,20 @@ static int unwind_special(struct unwind_frame_info *info, unsigned long pc, int
 		return 1;
 	}
 
-	if (pc == (unsigned long) &_switch_to_ret) {
+	if (pc_is_kernel_fn(pc, _switch_to) ||
+	    pc_is_kernel_fn(pc, _switch_to_ret)) {
 		info->prev_sp = info->sp - CALLEE_SAVE_FRAME_SIZE;
 		info->prev_ip = *(unsigned long *)(info->prev_sp - RP_OFFSET);
 		return 1;
 	}
 
 #ifdef CONFIG_IRQSTACKS
-	if (pc == (unsigned long) &_call_on_stack) {
+	if (pc_is_kernel_fn(pc, _call_on_stack)) {
 		info->prev_sp = *(unsigned long *)(info->sp - FRAME_SIZE - REG_SZ);
 		info->prev_ip = *(unsigned long *)(info->sp - FRAME_SIZE - RP_OFFSET);
 		return 1;
 	}
 #endif
-
 	return 0;
 }
 

From 0c5e946794806474a421f24e62c569971f4401e7 Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@stackframe.org>
Date: Fri, 15 Oct 2021 21:49:23 +0200
Subject: [PATCH 1409/1750] parisc/kgdb: add kgdb_roundup() to make kgdb work
 with idle polling

[ Upstream commit 66e29fcda1824f0427966fbee2bd2c85bf362c82 ]

With idle polling, IPIs are not sent when a CPU idle, but queued
and run later from do_idle(). The default kgdb_call_nmi_hook()
implementation gets the pointer to struct pt_regs from get_irq_reqs(),
which doesn't work in that case because it was not called from the
IPI interrupt handler. Fix it by defining our own kgdb_roundup()
function which sents an IPI_ENTER_KGDB. When that IPI is received
on the target CPU kgdb_nmicallback() is called.

Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/parisc/kernel/smp.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c
index 1405b603b91b..cf92ece20b75 100644
--- a/arch/parisc/kernel/smp.c
+++ b/arch/parisc/kernel/smp.c
@@ -29,6 +29,7 @@
 #include <linux/bitops.h>
 #include <linux/ftrace.h>
 #include <linux/cpu.h>
+#include <linux/kgdb.h>
 
 #include <linux/atomic.h>
 #include <asm/current.h>
@@ -69,7 +70,10 @@ enum ipi_message_type {
 	IPI_CALL_FUNC,
 	IPI_CPU_START,
 	IPI_CPU_STOP,
-	IPI_CPU_TEST
+	IPI_CPU_TEST,
+#ifdef CONFIG_KGDB
+	IPI_ENTER_KGDB,
+#endif
 };
 
 
@@ -167,7 +171,12 @@ ipi_interrupt(int irq, void *dev_id)
 			case IPI_CPU_TEST:
 				smp_debug(100, KERN_DEBUG "CPU%d is alive!\n", this_cpu);
 				break;
-
+#ifdef CONFIG_KGDB
+			case IPI_ENTER_KGDB:
+				smp_debug(100, KERN_DEBUG "CPU%d ENTER_KGDB\n", this_cpu);
+				kgdb_nmicallback(raw_smp_processor_id(), get_irq_regs());
+				break;
+#endif
 			default:
 				printk(KERN_CRIT "Unknown IPI num on CPU%d: %lu\n",
 					this_cpu, which);
@@ -226,6 +235,12 @@ send_IPI_allbutself(enum ipi_message_type op)
 	}
 }
 
+#ifdef CONFIG_KGDB
+void kgdb_roundup_cpus(void)
+{
+	send_IPI_allbutself(IPI_ENTER_KGDB);
+}
+#endif
 
 inline void 
 smp_send_stop(void)	{ send_IPI_allbutself(IPI_CPU_STOP); }

From bc9199271c32ec104eac405f7d412283b86e0440 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 25 Oct 2021 11:26:49 +0200
Subject: [PATCH 1410/1750] netfilter: conntrack: set on IPS_ASSURED if flows
 enters internal stream state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b7b1d02fc43925a4d569ec221715db2dfa1ce4f5 ]

The internal stream state sets the timeout to 120 seconds 2 seconds
after the creation of the flow, attach this internal stream state to the
IPS_ASSURED flag for consistent event reporting.

Before this patch:

      [NEW] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 [UNREPLIED] src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
   [UPDATE] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
   [UPDATE] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]
  [DESTROY] udp      17 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]

Note IPS_ASSURED for the flow not yet in the internal stream state.

after this update:

      [NEW] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 [UNREPLIED] src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
   [UPDATE] udp      17 30 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282
   [UPDATE] udp      17 120 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]
  [DESTROY] udp      17 src=10.246.11.13 dst=216.239.35.0 sport=37282 dport=123 src=216.239.35.0 dst=10.246.11.13 sport=123 dport=37282 [ASSURED]

Before this patch, short-lived UDP flows never entered IPS_ASSURED, so
they were already candidate flow to be deleted by early_drop under
stress.

Before this patch, IPS_ASSURED is set on regardless the internal stream
state, attach this internal stream state to IPS_ASSURED.

packet #1 (original direction) enters NEW state
packet #2 (reply direction) enters ESTABLISHED state, sets on IPS_SEEN_REPLY
paclet #3 (any direction) sets on IPS_ASSURED (if 2 seconds since the
          creation has passed by).

Reported-by: Maciej Żenczykowski <zenczykowski@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nf_conntrack_proto_udp.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index af402f458ee0..0528e9c26ceb 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -105,10 +105,13 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
 	 */
 	if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
 		unsigned long extra = timeouts[UDP_CT_UNREPLIED];
+		bool stream = false;
 
 		/* Still active after two seconds? Extend timeout. */
-		if (time_after(jiffies, ct->proto.udp.stream_ts))
+		if (time_after(jiffies, ct->proto.udp.stream_ts)) {
 			extra = timeouts[UDP_CT_REPLIED];
+			stream = true;
+		}
 
 		nf_ct_refresh_acct(ct, ctinfo, skb, extra);
 
@@ -117,7 +120,7 @@ int nf_conntrack_udp_packet(struct nf_conn *ct,
 			return NF_ACCEPT;
 
 		/* Also, more likely to be important, and not a probe */
-		if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
+		if (stream && !test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
 			nf_conntrack_event_cache(IPCT_ASSURED, ct);
 	} else {
 		nf_ct_refresh_acct(ct, ctinfo, skb, timeouts[UDP_CT_UNREPLIED]);

From 19337ed10e7e7d36b017b40d08eece6ab428d3af Mon Sep 17 00:00:00 2001
From: Andrii Nakryiko <andrii@kernel.org>
Date: Fri, 29 Oct 2021 11:29:07 -0700
Subject: [PATCH 1411/1750] selftests/bpf: Fix strobemeta selftest regression

[ Upstream commit 0133c20480b14820d43c37c0e9502da4bffcad3a ]

After most recent nightly Clang update strobemeta selftests started
failing with the following error (relevant portion of assembly included):

  1624: (85) call bpf_probe_read_user_str#114
  1625: (bf) r1 = r0
  1626: (18) r2 = 0xfffffffe
  1628: (5f) r1 &= r2
  1629: (55) if r1 != 0x0 goto pc+7
  1630: (07) r9 += 104
  1631: (6b) *(u16 *)(r9 +0) = r0
  1632: (67) r0 <<= 32
  1633: (77) r0 >>= 32
  1634: (79) r1 = *(u64 *)(r10 -456)
  1635: (0f) r1 += r0
  1636: (7b) *(u64 *)(r10 -456) = r1
  1637: (79) r1 = *(u64 *)(r10 -368)
  1638: (c5) if r1 s< 0x1 goto pc+778
  1639: (bf) r6 = r8
  1640: (0f) r6 += r7
  1641: (b4) w1 = 0
  1642: (6b) *(u16 *)(r6 +108) = r1
  1643: (79) r3 = *(u64 *)(r10 -352)
  1644: (79) r9 = *(u64 *)(r10 -456)
  1645: (bf) r1 = r9
  1646: (b4) w2 = 1
  1647: (85) call bpf_probe_read_user_str#114

  R1 unbounded memory access, make sure to bounds check any such access

In the above code r0 and r1 are implicitly related. Clang knows that,
but verifier isn't able to infer this relationship.

Yonghong Song narrowed down this "regression" in code generation to
a recent Clang optimization change ([0]), which for BPF target generates
code pattern that BPF verifier can't handle and loses track of register
boundaries.

This patch works around the issue by adding an BPF assembly-based helper
that helps to prove to the verifier that upper bound of the register is
a given constant by controlling the exact share of generated BPF
instruction sequence. This fixes the immediate issue for strobemeta
selftest.

  [0] https://github.com/llvm/llvm-project/commit/acabad9ff6bf13e00305d9d8621ee8eafc1f8b08

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20211029182907.166910-1-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/progs/strobemeta.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/strobemeta.h b/tools/testing/selftests/bpf/progs/strobemeta.h
index 7de534f38c3f..3687ea755ab5 100644
--- a/tools/testing/selftests/bpf/progs/strobemeta.h
+++ b/tools/testing/selftests/bpf/progs/strobemeta.h
@@ -10,6 +10,14 @@
 #include <linux/types.h>
 #include <bpf/bpf_helpers.h>
 
+#define bpf_clamp_umax(VAR, UMAX)					\
+	asm volatile (							\
+		"if %0 <= %[max] goto +1\n"				\
+		"%0 = %[max]\n"						\
+		: "+r"(VAR)						\
+		: [max]"i"(UMAX)					\
+	)
+
 typedef uint32_t pid_t;
 struct task_struct {};
 
@@ -413,6 +421,7 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg,
 
 	len = bpf_probe_read_user_str(payload, STROBE_MAX_STR_LEN, map.tag);
 	if (len <= STROBE_MAX_STR_LEN) {
+		bpf_clamp_umax(len, STROBE_MAX_STR_LEN);
 		descr->tag_len = len;
 		payload += len;
 	}
@@ -430,6 +439,7 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg,
 		len = bpf_probe_read_user_str(payload, STROBE_MAX_STR_LEN,
 					      map.entries[i].key);
 		if (len <= STROBE_MAX_STR_LEN) {
+			bpf_clamp_umax(len, STROBE_MAX_STR_LEN);
 			descr->key_lens[i] = len;
 			payload += len;
 		}
@@ -437,6 +447,7 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg,
 		len = bpf_probe_read_user_str(payload, STROBE_MAX_STR_LEN,
 					      map.entries[i].val);
 		if (len <= STROBE_MAX_STR_LEN) {
+			bpf_clamp_umax(len, STROBE_MAX_STR_LEN);
 			descr->val_lens[i] = len;
 			payload += len;
 		}

From c20d8c197454068da758a83e09d93683f520d681 Mon Sep 17 00:00:00 2001
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Date: Thu, 2 Sep 2021 23:13:06 -0400
Subject: [PATCH 1412/1750] Bluetooth: fix init and cleanup of
 sco_conn.timeout_work

[ Upstream commit 49d8a5606428ca0962d09050a5af81461ff90fbb ]

Before freeing struct sco_conn, all delayed timeout work should be
cancelled. Otherwise, sco_sock_timeout could potentially use the
sco_conn after it has been freed.

Additionally, sco_conn.timeout_work should be initialized when the
connection is allocated, not when the channel is added. This is
because an sco_conn can create channels with multiple sockets over its
lifetime, which happens if sockets are released but the connection
isn't deleted.

Fixes: ba316be1b6a0 ("Bluetooth: schedule SCO timeouts with delayed_work")
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/sco.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 93df269a6470..2f2b8ddc4dd5 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -134,6 +134,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
 		return NULL;
 
 	spin_lock_init(&conn->lock);
+	INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
 
 	hcon->sco_data = conn;
 	conn->hcon = hcon;
@@ -197,11 +198,11 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
 		sco_chan_del(sk, err);
 		bh_unlock_sock(sk);
 		sock_put(sk);
-
-		/* Ensure no more work items will run before freeing conn. */
-		cancel_delayed_work_sync(&conn->timeout_work);
 	}
 
+	/* Ensure no more work items will run before freeing conn. */
+	cancel_delayed_work_sync(&conn->timeout_work);
+
 	hcon->sco_data = NULL;
 	kfree(conn);
 }
@@ -214,8 +215,6 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
 	sco_pi(sk)->conn = conn;
 	conn->sk = sk;
 
-	INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
-
 	if (parent)
 		bt_accept_enqueue(parent, sk, true);
 }

From 226d68fb6c0a22cf8cc258ff8912956516f944c1 Mon Sep 17 00:00:00 2001
From: Neeraj Upadhyay <neeraju@codeaurora.org>
Date: Wed, 18 Aug 2021 13:34:00 +0530
Subject: [PATCH 1413/1750] rcu: Fix existing exp request check in
 sync_sched_exp_online_cleanup()

[ Upstream commit f0b2b2df5423fb369ac762c77900bc7765496d58 ]

The sync_sched_exp_online_cleanup() checks to see if RCU needs
an expedited quiescent state from the incoming CPU, sending it
an IPI if so. Before sending IPI, it checks whether expedited
qs need has been already requested for the incoming CPU, by
checking rcu_data.cpu_no_qs.b.exp for the current cpu, on which
sync_sched_exp_online_cleanup() is running. This works for the
case where incoming CPU is same as self. However, for the case
where incoming CPU is different from self, expedited request
won't get marked, which can potentially delay reporting of
expedited quiescent state for the incoming CPU.

Fixes: e015a3411220 ("rcu: Avoid self-IPI in sync_sched_exp_online_cleanup()")
Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree_exp.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
index 8760b6ead770..0ffe185c1f46 100644
--- a/kernel/rcu/tree_exp.h
+++ b/kernel/rcu/tree_exp.h
@@ -759,7 +759,7 @@ static void sync_sched_exp_online_cleanup(int cpu)
 	my_cpu = get_cpu();
 	/* Quiescent state either not needed or already requested, leave. */
 	if (!(READ_ONCE(rnp->expmask) & rdp->grpmask) ||
-	    __this_cpu_read(rcu_data.cpu_no_qs.b.exp)) {
+	    rdp->cpu_no_qs.b.exp) {
 		put_cpu();
 		return;
 	}

From 6b72caabc47011d03f44064452b2c65e8ed18326 Mon Sep 17 00:00:00 2001
From: Aleksander Jan Bajkowski <olek2@wp.pl>
Date: Tue, 14 Sep 2021 23:21:00 +0200
Subject: [PATCH 1414/1750] MIPS: lantiq: dma: fix burst length for DEU

[ Upstream commit 5ad74d39c51dd41b3c819f4f5396655f0629b4fd ]

The current definition of 2W burst length is invalid.
This patch fixes it. Current downstream DEU driver doesn't
use DMA. An incorrect burst length value doesn't cause any
errors. This patch also adds other burst length values.

Fixes: dfec1a827d2b ("MIPS: Lantiq: Add DMA support")
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/lantiq/xway/dma.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/mips/lantiq/xway/dma.c b/arch/mips/lantiq/xway/dma.c
index e45077aecf83..ab13e257132a 100644
--- a/arch/mips/lantiq/xway/dma.c
+++ b/arch/mips/lantiq/xway/dma.c
@@ -40,7 +40,11 @@
 #define DMA_IRQ_ACK		0x7e		/* IRQ status register */
 #define DMA_POLL		BIT(31)		/* turn on channel polling */
 #define DMA_CLK_DIV4		BIT(6)		/* polling clock divider */
-#define DMA_2W_BURST		BIT(1)		/* 2 word burst length */
+#define DMA_PCTRL_2W_BURST	0x1		/* 2 word burst length */
+#define DMA_PCTRL_4W_BURST	0x2		/* 4 word burst length */
+#define DMA_PCTRL_8W_BURST	0x3		/* 8 word burst length */
+#define DMA_TX_BURST_SHIFT	4		/* tx burst shift */
+#define DMA_RX_BURST_SHIFT	2		/* rx burst shift */
 #define DMA_ETOP_ENDIANNESS	(0xf << 8) /* endianness swap etop channels */
 #define DMA_WEIGHT	(BIT(17) | BIT(16))	/* default channel wheight */
 
@@ -191,7 +195,8 @@ ltq_dma_init_port(int p)
 		break;
 
 	case DMA_PORT_DEU:
-		ltq_dma_w32((DMA_2W_BURST << 4) | (DMA_2W_BURST << 2),
+		ltq_dma_w32((DMA_PCTRL_2W_BURST << DMA_TX_BURST_SHIFT) |
+			(DMA_PCTRL_2W_BURST << DMA_RX_BURST_SHIFT),
 			LTQ_DMA_PCTRL);
 		break;
 

From abf37e855e53fe5b9bd4aeda047884e6fff9e32e Mon Sep 17 00:00:00 2001
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Thu, 21 Jan 2021 15:29:25 -0600
Subject: [PATCH 1415/1750] objtool: Add xen_start_kernel() to noreturn list

[ Upstream commit c26acfbbfbc2ae4167e33825793e85e1a53058d8 ]

xen_start_kernel() doesn't return.  Annotate it as such so objtool can
follow the code flow.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lore.kernel.org/r/930deafa89256c60b180442df59a1bbae48f30ab.1611263462.git.jpoimboe@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/objtool/check.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 5c83f73ad668..ec15cadbb3d3 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -156,6 +156,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
 		"machine_real_restart",
 		"rewind_stack_do_exit",
 		"kunit_try_catch_throw",
+		"xen_start_kernel",
 	};
 
 	if (!func)

From b36ab509e1817e60f73ce297494f0de1b7ed2c08 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Thu, 24 Jun 2021 11:41:00 +0200
Subject: [PATCH 1416/1750] x86/xen: Mark cpu_bringup_and_idle() as
 dead_end_function

[ Upstream commit 9af9dcf11bda3e2c0e24c1acaacb8685ad974e93 ]

The asm_cpu_bringup_and_idle() function is required to push the return
value on the stack in order to make ORC happy, but the only reason
objtool doesn't complain is because of a happy accident.

The thing is that asm_cpu_bringup_and_idle() doesn't return, so
validate_branch() never terminates and falls through to the next
function, which in the normal case is the hypercall_page. And that, as
it happens, is 4095 NOPs and a RET.

Make asm_cpu_bringup_and_idle() terminate on it's own, by making the
function it calls as a dead-end. This way we no longer rely on what
code happens to come after.

Fixes: c3881eb58d56 ("x86/xen: Make the secondary CPU idle tasks reliable")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Miroslav Benes <mbenes@suse.cz>
Link: https://lore.kernel.org/r/20210624095147.693801717@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/objtool/check.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index ec15cadbb3d3..4261f93ce06f 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -157,6 +157,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
 		"rewind_stack_do_exit",
 		"kunit_try_catch_throw",
 		"xen_start_kernel",
+		"cpu_bringup_and_idle",
 	};
 
 	if (!func)

From f0bc12b8482684fe4d0e48b367ca4fcb8580e81a Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Fri, 26 Mar 2021 16:12:05 +0100
Subject: [PATCH 1417/1750] objtool: Fix static_call list generation

[ Upstream commit a958c4fea768d2c378c89032ab41d38da2a24422 ]

Currently, objtool generates tail call entries in add_jump_destination()
but waits until validate_branch() to generate the regular call entries.
Move these to add_call_destination() for consistency.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Miroslav Benes <mbenes@suse.cz>
Link: https://lkml.kernel.org/r/20210326151259.691529901@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/objtool/check.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 4261f93ce06f..8932f41c387f 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -954,6 +954,11 @@ static int add_call_destinations(struct objtool_file *file)
 		} else
 			insn->call_dest = reloc->sym;
 
+		if (insn->call_dest && insn->call_dest->static_call_tramp) {
+			list_add_tail(&insn->static_call_node,
+				      &file->static_call_list);
+		}
+
 		/*
 		 * Many compilers cannot disable KCOV with a function attribute
 		 * so they need a little help, NOP out any KCOV calls from noinstr
@@ -1668,6 +1673,9 @@ static int decode_sections(struct objtool_file *file)
 	if (ret)
 		return ret;
 
+	/*
+	 * Must be before add_{jump_call}_destination.
+	 */
 	ret = read_static_call_tramps(file);
 	if (ret)
 		return ret;
@@ -1680,6 +1688,10 @@ static int decode_sections(struct objtool_file *file)
 	if (ret)
 		return ret;
 
+	/*
+	 * Must be before add_call_destination(); it changes INSN_CALL to
+	 * INSN_JUMP.
+	 */
 	ret = read_intra_function_calls(file);
 	if (ret)
 		return ret;
@@ -2534,11 +2546,6 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
 			if (dead_end_function(file, insn->call_dest))
 				return 0;
 
-			if (insn->type == INSN_CALL && insn->call_dest->static_call_tramp) {
-				list_add_tail(&insn->static_call_node,
-					      &file->static_call_list);
-			}
-
 			break;
 
 		case INSN_JUMP_CONDITIONAL:

From 582de9e38584f0578c2d2934644bc61d9247e707 Mon Sep 17 00:00:00 2001
From: Iago Toral Quiroga <itoral@igalia.com>
Date: Wed, 15 Sep 2021 12:05:07 +0200
Subject: [PATCH 1418/1750] drm/v3d: fix wait for TMU write combiner flush

[ Upstream commit e4f868191138975f2fdf2f37c11318b47db4acc9 ]

The hardware sets the TMUWCF bit back to 0 when the TMU write
combiner flush completes so we should be checking for that instead
of the L2TFLS bit.

v2 (Melissa Wen):
  - Add Signed-off-by and Fixes tags.
  - Change the error message for the timeout to be more clear.

Fixes spurious Vulkan CTS failures in:
dEQP-VK.binding_model.descriptorset_random.*

Fixes: d223f98f02099 ("drm/v3d: Add support for compute shader dispatch.")
Signed-off-by: Iago Toral Quiroga <itoral@igalia.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210915100507.3945-1-itoral@igalia.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/v3d/v3d_gem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c
index 182c586525eb..64fe63c1938f 100644
--- a/drivers/gpu/drm/v3d/v3d_gem.c
+++ b/drivers/gpu/drm/v3d/v3d_gem.c
@@ -195,8 +195,8 @@ v3d_clean_caches(struct v3d_dev *v3d)
 
 	V3D_CORE_WRITE(core, V3D_CTL_L2TCACTL, V3D_L2TCACTL_TMUWCF);
 	if (wait_for(!(V3D_CORE_READ(core, V3D_CTL_L2TCACTL) &
-		       V3D_L2TCACTL_L2TFLS), 100)) {
-		DRM_ERROR("Timeout waiting for L1T write combiner flush\n");
+		       V3D_L2TCACTL_TMUWCF), 100)) {
+		DRM_ERROR("Timeout waiting for TMU write combiner flush\n");
 	}
 
 	mutex_lock(&v3d->cache_clean_lock);

From 38098444b7877726b49fd525a9c001f78bde97cb Mon Sep 17 00:00:00 2001
From: liuyuntao <liuyuntao10@huawei.com>
Date: Sat, 28 Aug 2021 18:43:21 +0800
Subject: [PATCH 1419/1750] virtio-gpu: fix possible memory allocation failure

[ Upstream commit 5bd4f20de8acad37dbb3154feb34dbc36d506c02 ]

When kmem_cache_zalloc in virtio_gpu_get_vbuf fails, it will return
an error code. But none of its callers checks this error code, and
a core dump will take place.

Considering many of its callers can't handle such error, I add
a __GFP_NOFAIL flag when calling kmem_cache_zalloc to make sure
it won't fail, and delete those unused error handlings.

Fixes: dc5698e80cf724 ("Add virtio gpu driver.")
Signed-off-by: Yuntao Liu <liuyuntao10@huawei.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210828104321.3410312-1-liuyuntao10@huawei.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/virtio/virtgpu_vq.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 07945ca238e2..5e40fa0f5e8f 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -91,9 +91,7 @@ virtio_gpu_get_vbuf(struct virtio_gpu_device *vgdev,
 {
 	struct virtio_gpu_vbuffer *vbuf;
 
-	vbuf = kmem_cache_zalloc(vgdev->vbufs, GFP_KERNEL);
-	if (!vbuf)
-		return ERR_PTR(-ENOMEM);
+	vbuf = kmem_cache_zalloc(vgdev->vbufs, GFP_KERNEL | __GFP_NOFAIL);
 
 	BUG_ON(size > MAX_INLINE_CMD_SIZE ||
 	       size < sizeof(struct virtio_gpu_ctrl_hdr));
@@ -147,10 +145,6 @@ static void *virtio_gpu_alloc_cmd_resp(struct virtio_gpu_device *vgdev,
 
 	vbuf = virtio_gpu_get_vbuf(vgdev, cmd_size,
 				   resp_size, resp_buf, cb);
-	if (IS_ERR(vbuf)) {
-		*vbuffer_p = NULL;
-		return ERR_CAST(vbuf);
-	}
 	*vbuffer_p = vbuf;
 	return (struct virtio_gpu_command *)vbuf->buf;
 }

From fb4a58f5194e7391f4caff65041be243639ecbc5 Mon Sep 17 00:00:00 2001
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Date: Fri, 3 Sep 2021 10:40:01 +0200
Subject: [PATCH 1420/1750] lockdep: Let lock_is_held_type() detect recursive
 read as read

[ Upstream commit 2507003a1d10917c9158077bf6030719d02c941e ]

lock_is_held_type(, 1) detects acquired read locks. It only recognized
locks acquired with lock_acquire_shared(). Read locks acquired with
lock_acquire_shared_recursive() are not recognized because a `2' is
stored as the read value.

Rework the check to additionally recognise lock's read value one and two
as a read held lock.

Fixes: e918188611f07 ("locking: More accurate annotations for read_lock()")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Boqun Feng <boqun.feng@gmail.com>
Acked-by: Waiman Long <longman@redhat.com>
Link: https://lkml.kernel.org/r/20210903084001.lblecrvz4esl4mrr@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 282332914350..1f6a2f1226fa 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -5303,7 +5303,7 @@ int __lock_is_held(const struct lockdep_map *lock, int read)
 		struct held_lock *hlock = curr->held_locks + i;
 
 		if (match_held_lock(hlock, lock)) {
-			if (read == -1 || hlock->read == read)
+			if (read == -1 || !!hlock->read == read)
 				return 1;
 
 			return 0;

From a585e04e3472c6966fe73edd40420dad6fc911b3 Mon Sep 17 00:00:00 2001
From: Yajun Deng <yajun.deng@linux.dev>
Date: Sat, 18 Sep 2021 17:04:10 +0800
Subject: [PATCH 1421/1750] net: net_namespace: Fix undefined member in
 key_remove_domain()

[ Upstream commit aed0826b0cf2e488900ab92193893e803d65c070 ]

The key_domain member in struct net only exists if we define CONFIG_KEYS.
So we should add the define when we used key_domain.

Fixes: 9b242610514f ("keys: Network namespace domain tag")
Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/net_namespace.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 5c9d95f30be6..ac852db83de9 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -486,7 +486,9 @@ struct net *copy_net_ns(unsigned long flags,
 
 	if (rv < 0) {
 put_userns:
+#ifdef CONFIG_KEYS
 		key_remove_domain(net->key_domain);
+#endif
 		put_user_ns(user_ns);
 		net_drop_ns(net);
 dec_ucounts:
@@ -618,7 +620,9 @@ static void cleanup_net(struct work_struct *work)
 	list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
 		list_del_init(&net->exit_list);
 		dec_net_namespaces(net->ucounts);
+#ifdef CONFIG_KEYS
 		key_remove_domain(net->key_domain);
+#endif
 		put_user_ns(net->user_ns);
 		net_drop_ns(net);
 	}

From ba8ba7688594f3962f46d162c12bd7e20e059590 Mon Sep 17 00:00:00 2001
From: Waiman Long <longman@redhat.com>
Date: Sat, 18 Sep 2021 18:53:08 -0400
Subject: [PATCH 1422/1750] cgroup: Make rebind_subsystems() disable v2
 controllers all at once

[ Upstream commit 7ee285395b211cad474b2b989db52666e0430daf ]

It was found that the following warning was displayed when remounting
controllers from cgroup v2 to v1:

[ 8042.997778] WARNING: CPU: 88 PID: 80682 at kernel/cgroup/cgroup.c:3130 cgroup_apply_control_disable+0x158/0x190
   :
[ 8043.091109] RIP: 0010:cgroup_apply_control_disable+0x158/0x190
[ 8043.096946] Code: ff f6 45 54 01 74 39 48 8d 7d 10 48 c7 c6 e0 46 5a a4 e8 7b 67 33 00 e9 41 ff ff ff 49 8b 84 24 e8 01 00 00 0f b7 40 08 eb 95 <0f> 0b e9 5f ff ff ff 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3
[ 8043.115692] RSP: 0018:ffffba8a47c23d28 EFLAGS: 00010202
[ 8043.120916] RAX: 0000000000000036 RBX: ffffffffa624ce40 RCX: 000000000000181a
[ 8043.128047] RDX: ffffffffa63c43e0 RSI: ffffffffa63c43e0 RDI: ffff9d7284ee1000
[ 8043.135180] RBP: ffff9d72874c5800 R08: ffffffffa624b090 R09: 0000000000000004
[ 8043.142314] R10: ffffffffa624b080 R11: 0000000000002000 R12: ffff9d7284ee1000
[ 8043.149447] R13: ffff9d7284ee1000 R14: ffffffffa624ce70 R15: ffffffffa6269e20
[ 8043.156576] FS:  00007f7747cff740(0000) GS:ffff9d7a5fc00000(0000) knlGS:0000000000000000
[ 8043.164663] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8043.170409] CR2: 00007f7747e96680 CR3: 0000000887d60001 CR4: 00000000007706e0
[ 8043.177539] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 8043.184673] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 8043.191804] PKRU: 55555554
[ 8043.194517] Call Trace:
[ 8043.196970]  rebind_subsystems+0x18c/0x470
[ 8043.201070]  cgroup_setup_root+0x16c/0x2f0
[ 8043.205177]  cgroup1_root_to_use+0x204/0x2a0
[ 8043.209456]  cgroup1_get_tree+0x3e/0x120
[ 8043.213384]  vfs_get_tree+0x22/0xb0
[ 8043.216883]  do_new_mount+0x176/0x2d0
[ 8043.220550]  __x64_sys_mount+0x103/0x140
[ 8043.224474]  do_syscall_64+0x38/0x90
[ 8043.228063]  entry_SYSCALL_64_after_hwframe+0x44/0xae

It was caused by the fact that rebind_subsystem() disables
controllers to be rebound one by one. If more than one disabled
controllers are originally from the default hierarchy, it means that
cgroup_apply_control_disable() will be called multiple times for the
same default hierarchy. A controller may be killed by css_kill() in
the first round. In the second round, the killed controller may not be
completely dead yet leading to the warning.

To avoid this problem, we collect all the ssid's of controllers that
needed to be disabled from the default hierarchy and then disable them
in one go instead of one by one.

Fixes: 334c3679ec4b ("cgroup: reimplement rebind_subsystems() using cgroup_apply_control() and friends")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cgroup.c | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 60d38e2f69dd..a86857edaa57 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1711,6 +1711,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
 	struct cgroup *dcgrp = &dst_root->cgrp;
 	struct cgroup_subsys *ss;
 	int ssid, i, ret;
+	u16 dfl_disable_ss_mask = 0;
 
 	lockdep_assert_held(&cgroup_mutex);
 
@@ -1727,8 +1728,28 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
 		/* can't move between two non-dummy roots either */
 		if (ss->root != &cgrp_dfl_root && dst_root != &cgrp_dfl_root)
 			return -EBUSY;
+
+		/*
+		 * Collect ssid's that need to be disabled from default
+		 * hierarchy.
+		 */
+		if (ss->root == &cgrp_dfl_root)
+			dfl_disable_ss_mask |= 1 << ssid;
+
 	} while_each_subsys_mask();
 
+	if (dfl_disable_ss_mask) {
+		struct cgroup *scgrp = &cgrp_dfl_root.cgrp;
+
+		/*
+		 * Controllers from default hierarchy that need to be rebound
+		 * are all disabled together in one go.
+		 */
+		cgrp_dfl_root.subsys_mask &= ~dfl_disable_ss_mask;
+		WARN_ON(cgroup_apply_control(scgrp));
+		cgroup_finalize_control(scgrp, 0);
+	}
+
 	do_each_subsys_mask(ss, ssid, ss_mask) {
 		struct cgroup_root *src_root = ss->root;
 		struct cgroup *scgrp = &src_root->cgrp;
@@ -1737,10 +1758,12 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
 
 		WARN_ON(!css || cgroup_css(dcgrp, ss));
 
-		/* disable from the source */
-		src_root->subsys_mask &= ~(1 << ssid);
-		WARN_ON(cgroup_apply_control(scgrp));
-		cgroup_finalize_control(scgrp, 0);
+		if (src_root != &cgrp_dfl_root) {
+			/* disable from the source */
+			src_root->subsys_mask &= ~(1 << ssid);
+			WARN_ON(cgroup_apply_control(scgrp));
+			cgroup_finalize_control(scgrp, 0);
+		}
 
 		/* rebind */
 		RCU_INIT_POINTER(scgrp->subsys[ssid], NULL);

From 3a95dbc8b7f2ff264be884027aac3801f7ce2088 Mon Sep 17 00:00:00 2001
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Date: Thu, 9 Sep 2021 15:44:27 +0100
Subject: [PATCH 1423/1750] wcn36xx: Fix Antenna Diversity Switching

[ Upstream commit 701668d3bfa03dabc5095fc383d5315544ee5b31 ]

We have been tracking a strange bug with Antenna Diversity Switching (ADS)
on wcn3680b for a while.

ADS is configured like this:
   A. Via a firmware configuration table baked into the NV area.
       1. Defines if ADS is enabled.
       2. Defines which GPIOs are connected to which antenna enable pin.
       3. Defines which antenna/GPIO is primary and which is secondary.

   B. WCN36XX_CFG_VAL(ANTENNA_DIVERSITY, N)
      N is a bitmask of available antenna.

      Setting N to 3 indicates a bitmask of enabled antenna (1 | 2).

      Obviously then we can set N to 1 or N to 2 to fix to a particular
      antenna and disable antenna diversity.

   C. WCN36XX_CFG_VAL(ASD_PROBE_INTERVAL, XX)
      XX is the number of beacons between each antenna RSSI check.
      Setting this value to 50 means, every 50 received beacons, run the
      ADS algorithm.

   D. WCN36XX_CFG_VAL(ASD_TRIGGER_THRESHOLD, YY)
      YY is a two's complement integer which specifies the RSSI decibel
      threshold below which ADS will run.
      We default to -60db here, meaning a measured RSSI <= -60db will
      trigger an ADS probe.

   E. WCN36XX_CFG_VAL(ASD_RTT_RSSI_HYST_THRESHOLD, Z)
      Z is a hysteresis value, indicating a delta which the RSSI must
      exceed for the antenna switch to be valid.

      For example if HYST_THRESHOLD == 3 AntennaId1-RSSI == -60db and
      AntennaId-2-RSSI == -58db then firmware will not switch antenna.
      The threshold needs to be -57db or better to satisfy the criteria.

   F. A firmware feature bit also exists ANTENNA_DIVERSITY_SELECTION.
      This feature bit is used by the firmware to report if
      ANTENNA_DIVERSITY_SELECTION is supported. The host is not required to
      toggle this bit to enable or disable ADS.

ADS works like this:

    A. Every XX beacons the firmware switches to or remains on the primary
       antenna.

    B. The firmware then sends a Request-To-Send (RTS) packet to the AP.

    C. The firmware waits for a Clear-To-Send (CTS) response from the AP.

    D. The firmware then notes the received RSSI on the CTS packet.

    E. The firmware then repeats steps A-D on the secondary antenna.

    F. Subsequently if the RSSI on the measured antenna is better than
       ASD_TRIGGER_THRESHOLD + the active antenna's RSSI then the
       measured antenna becomes the active antenna.

    G. If RSSI rises past ASD_TRIGGER_THRESHOLD then ADS doesn't run at
       all even if there is a substantially better RSSI on the alternative
       antenna.

What we have been observing is that the RTS packet is being sent but the
MAC address is a byte-swapped version of the target MAC. The ADS/RTS MAC is
corrupted only when the link is encrypted, if the AP is open the RTS MAC is
correct. Similarly if we configure the firmware to an RTS/CTS sequence for
regular data - the transmitted RTS MAC is correctly formatted.

Internally the wcn36xx firmware uses the indexes in the SMD commands to
populate and extract data from specific entries in an STA lookup table. The
AP's MAC appears a number of times in different indexes within this lookup
table, so the MAC address extracted for the data-transmit RTS and the MAC
address extracted for the ADS/RTS packet are not the same STA table index.

Our analysis indicates the relevant firmware STA table index is
"bssSelfStaIdx".

There is an STA populate function responsible for formatting the MAC
address of the bssSelfStaIdx including byte-swapping the MAC address.

Its clear then that the required STA populate command did not run for
bssSelfStaIdx.

So taking a look at the sequence of SMD commands sent to the firmware we
see the following downstream when moving from an unencrypted to encrypted
BSS setup.

- WLAN_HAL_CONFIG_BSS_REQ
- WLAN_HAL_CONFIG_STA_REQ
- WLAN_HAL_SET_STAKEY_REQ

Upstream in wcn36xx we have

- WLAN_HAL_CONFIG_BSS_REQ
- WLAN_HAL_SET_STAKEY_REQ

The solution then is to add the missing WLAN_HAL_CONFIG_STA_REQ between
WLAN_HAL_CONFIG_BSS_REQ and WLAN_HAL_SET_STAKEY_REQ.

No surprise WLAN_HAL_CONFIG_STA_REQ is the routine responsible for
populating the STA lookup table in the firmware and once done the MAC sent
by the ADS routine is in the correct byte-order.

This bug is apparent with ADS but it is also the case that any other
firmware routine that depends on the "bssSelfStaIdx" would retrieve
malformed data on an encrypted link.

Fixes: 3e977c5c523d ("wcn36xx: Define wcn3680 specific firmware parameters")
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Tested-by: Benjamin Li <benl@squareup.com>
Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210909144428.2564650-2-bryan.odonoghue@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 883534125df1..629ddfd74da1 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -568,12 +568,14 @@ static int wcn36xx_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 		if (IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags) {
 			sta_priv->is_data_encrypted = true;
 			/* Reconfigure bss with encrypt_type */
-			if (NL80211_IFTYPE_STATION == vif->type)
+			if (NL80211_IFTYPE_STATION == vif->type) {
 				wcn36xx_smd_config_bss(wcn,
 						       vif,
 						       sta,
 						       sta->addr,
 						       true);
+				wcn36xx_smd_config_sta(wcn, vif, sta);
+			}
 
 			wcn36xx_smd_set_stakey(wcn,
 				vif_priv->encrypt_type,

From 310f581f54cb0a3a079fcd1436dca35f39b7ba65 Mon Sep 17 00:00:00 2001
From: Ajay Singh <ajay.kathat@microchip.com>
Date: Thu, 16 Sep 2021 16:49:18 +0000
Subject: [PATCH 1424/1750] wilc1000: fix possible memory leak in
 cfg_scan_result()

[ Upstream commit 3c719fed0f3a5e95b1d164609ecc81c4191ade70 ]

When the BSS reference holds a valid reference, it is not freed. The 'if'
condition is wrong. Instead of the 'if (bss)' check, the 'if (!bss)' check
is used.
The issue is solved by removing the unnecessary 'if' check because
cfg80211_put_bss() already performs the NULL validation.

Fixes: 6cd4fa5ab691 ("staging: wilc1000: make use of cfg80211_inform_bss_frame()")
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210916164902.74629-3-ajay.kathat@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/microchip/wilc1000/cfg80211.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
index c1ac1d84790f..6be5ac8ba518 100644
--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
@@ -129,8 +129,7 @@ static void cfg_scan_result(enum scan_event scan_event,
 						info->frame_len,
 						(s32)info->rssi * 100,
 						GFP_KERNEL);
-		if (!bss)
-			cfg80211_put_bss(wiphy, bss);
+		cfg80211_put_bss(wiphy, bss);
 	} else if (scan_event == SCAN_EVENT_DONE) {
 		mutex_lock(&priv->scan_req_lock);
 

From f0b40bf3e48a5af722b2d60adade5562e481904c Mon Sep 17 00:00:00 2001
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
Date: Wed, 22 Sep 2021 21:49:45 +0800
Subject: [PATCH 1425/1750] Bluetooth: btmtkuart: fix a memleak in
 mtk_hci_wmt_sync

[ Upstream commit 3e5f2d90c28f9454e421108554707620bc23269d ]

bdev->evt_skb will get freed in the normal path and one error path
of mtk_hci_wmt_sync, while the other error paths do not free it,
which may cause a memleak. This bug is suggested by a static analysis
tool, please advise.

Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btmtkuart.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index 6c40bc75fb5b..719d4685a2dd 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -158,8 +158,10 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
 	int err;
 
 	hlen = sizeof(*hdr) + wmt_params->dlen;
-	if (hlen > 255)
-		return -EINVAL;
+	if (hlen > 255) {
+		err = -EINVAL;
+		goto err_free_skb;
+	}
 
 	hdr = (struct mtk_wmt_hdr *)&wc;
 	hdr->dir = 1;
@@ -173,7 +175,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
 	err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc);
 	if (err < 0) {
 		clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
-		return err;
+		goto err_free_skb;
 	}
 
 	/* The vendor specific WMT commands are all answered by a vendor
@@ -190,13 +192,14 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
 	if (err == -EINTR) {
 		bt_dev_err(hdev, "Execution of wmt command interrupted");
 		clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
-		return err;
+		goto err_free_skb;
 	}
 
 	if (err) {
 		bt_dev_err(hdev, "Execution of wmt command timed out");
 		clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
-		return -ETIMEDOUT;
+		err = -ETIMEDOUT;
+		goto err_free_skb;
 	}
 
 	/* Parse and handle the return WMT event */

From 03725f7125db81c45544f29dd66d313f4a52f8cd Mon Sep 17 00:00:00 2001
From: Michael Walle <michael@walle.cc>
Date: Thu, 16 Sep 2021 00:03:07 +0200
Subject: [PATCH 1426/1750] crypto: caam - disable pkc for non-E SoCs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f20311cc9c58052e0b215013046cbf390937910c ]

On newer CAAM versions, not all accelerators are disabled if the SoC is
a non-E variant. While the driver checks most of the modules for
availability, there is one - PKHA - which sticks out. On non-E variants
it is still reported as available, that is the number of instances is
non-zero, but it has limited functionality. In particular it doesn't
support encryption and decryption, but just signing and verifying. This
is indicated by a bit in the PKHA_MISC field. Take this bit into account
if we are checking for availability.

This will the following error:
[    8.167817] caam_jr 8020000.jr: 20000b0f: CCB: desc idx 11: : Invalid CHA selected.

Tested on an NXP LS1028A (non-E) SoC.

Fixes: d239b10d4ceb ("crypto: caam - add register map changes cf. Era 10")
Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/caam/caampkc.c | 19 +++++++++++++++----
 drivers/crypto/caam/regs.h    |  3 +++
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index dd5f101e43f8..3acc825da4cc 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -1152,16 +1152,27 @@ static struct caam_akcipher_alg caam_rsa = {
 int caam_pkc_init(struct device *ctrldev)
 {
 	struct caam_drv_private *priv = dev_get_drvdata(ctrldev);
-	u32 pk_inst;
+	u32 pk_inst, pkha;
 	int err;
 	init_done = false;
 
 	/* Determine public key hardware accelerator presence. */
-	if (priv->era < 10)
+	if (priv->era < 10) {
 		pk_inst = (rd_reg32(&priv->ctrl->perfmon.cha_num_ls) &
 			   CHA_ID_LS_PK_MASK) >> CHA_ID_LS_PK_SHIFT;
-	else
-		pk_inst = rd_reg32(&priv->ctrl->vreg.pkha) & CHA_VER_NUM_MASK;
+	} else {
+		pkha = rd_reg32(&priv->ctrl->vreg.pkha);
+		pk_inst = pkha & CHA_VER_NUM_MASK;
+
+		/*
+		 * Newer CAAMs support partially disabled functionality. If this is the
+		 * case, the number is non-zero, but this bit is set to indicate that
+		 * no encryption or decryption is supported. Only signing and verifying
+		 * is supported.
+		 */
+		if (pkha & CHA_VER_MISC_PKHA_NO_CRYPT)
+			pk_inst = 0;
+	}
 
 	/* Do not register algorithms if PKHA is not present. */
 	if (!pk_inst)
diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
index af61f3a2c0d4..3738625c0250 100644
--- a/drivers/crypto/caam/regs.h
+++ b/drivers/crypto/caam/regs.h
@@ -322,6 +322,9 @@ struct version_regs {
 /* CHA Miscellaneous Information - AESA_MISC specific */
 #define CHA_VER_MISC_AES_GCM	BIT(1 + CHA_VER_MISC_SHIFT)
 
+/* CHA Miscellaneous Information - PKHA_MISC specific */
+#define CHA_VER_MISC_PKHA_NO_CRYPT	BIT(7 + CHA_VER_MISC_SHIFT)
+
 /*
  * caam_perfmon - Performance Monitor/Secure Memory Status/
  *                CAAM Global Status/Component Version IDs

From 78fb8c99924291d8f1d1366e467b609c30b7f7f6 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Date: Fri, 24 Sep 2021 03:18:37 +0000
Subject: [PATCH 1427/1750] rxrpc: Fix _usecs_to_jiffies() by using
 usecs_to_jiffies()

[ Upstream commit acde891c243c1ed85b19d4d5042bdf00914f5739 ]

Directly using _usecs_to_jiffies() might be unsafe, so it's
better to use usecs_to_jiffies() instead.
Because we can see that the result of _usecs_to_jiffies()
could be larger than MAX_JIFFY_OFFSET values without the
check of the input.

Fixes: c410bf01933e ("Fix the excessive initial retransmission timeout")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rxrpc/rtt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/rxrpc/rtt.c b/net/rxrpc/rtt.c
index 4e565eeab426..be61d6f5be8d 100644
--- a/net/rxrpc/rtt.c
+++ b/net/rxrpc/rtt.c
@@ -22,7 +22,7 @@ static u32 rxrpc_rto_min_us(struct rxrpc_peer *peer)
 
 static u32 __rxrpc_set_rto(const struct rxrpc_peer *peer)
 {
-	return _usecs_to_jiffies((peer->srtt_us >> 3) + peer->rttvar_us);
+	return usecs_to_jiffies((peer->srtt_us >> 3) + peer->rttvar_us);
 }
 
 static u32 rxrpc_bound_rto(u32 rto)

From 9833cb32066a35894b28d56441662aedd7bbcf02 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Sun, 26 Sep 2021 00:59:27 +0200
Subject: [PATCH 1428/1750] net: dsa: rtl8366rb: Fix off-by-one bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 5f5f12f5d4b108399130bb5c11f07765851d9cdb ]

The max VLAN number with non-4K VLAN activated is 15, and the
range is 0..15. Not 16.

The impact should be low since we by default have 4K VLAN and
thus have 4095 VLANs to play with in this switch. There will
not be a problem unless the code is rewritten to only use
16 VLANs.

Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver")
Cc: Mauri Sandberg <sandberg@mailfence.com>
Cc: DENG Qingfang <dqfext@gmail.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/rtl8366rb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
index cfe56960f44b..12d7e5cd3197 100644
--- a/drivers/net/dsa/rtl8366rb.c
+++ b/drivers/net/dsa/rtl8366rb.c
@@ -1343,7 +1343,7 @@ static int rtl8366rb_set_mc_index(struct realtek_smi *smi, int port, int index)
 
 static bool rtl8366rb_is_vlan_valid(struct realtek_smi *smi, unsigned int vlan)
 {
-	unsigned int max = RTL8366RB_NUM_VLANS;
+	unsigned int max = RTL8366RB_NUM_VLANS - 1;
 
 	if (smi->vlan4k_enabled)
 		max = RTL8366RB_NUM_VIDS - 1;

From ac49af173c6424951e9816486493a7d8b0414ae5 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 28 Sep 2021 12:05:43 +0300
Subject: [PATCH 1429/1750] ath11k: fix some sleeping in atomic bugs

[ Upstream commit aadf7c81a0771b8f1c97dabca6a48bae1b387779 ]

The ath11k_dbring_bufs_replenish() and ath11k_dbring_fill_bufs()
take a "gfp" parameter but they since they take spinlocks, the
allocations they do have to be atomic.  This causes a bug because
ath11k_dbring_buf_setup passes GFP_KERNEL for the gfp flags.

The fix is to use GFP_ATOMIC and remove the unused parameters.

Fixes: bd6478559e27 ("ath11k: Add direct buffer ring support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210812070434.GE31863@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/dbring.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/dbring.c b/drivers/net/wireless/ath/ath11k/dbring.c
index 5e1f5437b418..fd98ba5b1130 100644
--- a/drivers/net/wireless/ath/ath11k/dbring.c
+++ b/drivers/net/wireless/ath/ath11k/dbring.c
@@ -8,8 +8,7 @@
 
 static int ath11k_dbring_bufs_replenish(struct ath11k *ar,
 					struct ath11k_dbring *ring,
-					struct ath11k_dbring_element *buff,
-					gfp_t gfp)
+					struct ath11k_dbring_element *buff)
 {
 	struct ath11k_base *ab = ar->ab;
 	struct hal_srng *srng;
@@ -35,7 +34,7 @@ static int ath11k_dbring_bufs_replenish(struct ath11k *ar,
 		goto err;
 
 	spin_lock_bh(&ring->idr_lock);
-	buf_id = idr_alloc(&ring->bufs_idr, buff, 0, ring->bufs_max, gfp);
+	buf_id = idr_alloc(&ring->bufs_idr, buff, 0, ring->bufs_max, GFP_ATOMIC);
 	spin_unlock_bh(&ring->idr_lock);
 	if (buf_id < 0) {
 		ret = -ENOBUFS;
@@ -72,8 +71,7 @@ static int ath11k_dbring_bufs_replenish(struct ath11k *ar,
 }
 
 static int ath11k_dbring_fill_bufs(struct ath11k *ar,
-				   struct ath11k_dbring *ring,
-				   gfp_t gfp)
+				   struct ath11k_dbring *ring)
 {
 	struct ath11k_dbring_element *buff;
 	struct hal_srng *srng;
@@ -92,11 +90,11 @@ static int ath11k_dbring_fill_bufs(struct ath11k *ar,
 	size = sizeof(*buff) + ring->buf_sz + align - 1;
 
 	while (num_remain > 0) {
-		buff = kzalloc(size, gfp);
+		buff = kzalloc(size, GFP_ATOMIC);
 		if (!buff)
 			break;
 
-		ret = ath11k_dbring_bufs_replenish(ar, ring, buff, gfp);
+		ret = ath11k_dbring_bufs_replenish(ar, ring, buff);
 		if (ret) {
 			ath11k_warn(ar->ab, "failed to replenish db ring num_remain %d req_ent %d\n",
 				    num_remain, req_entries);
@@ -176,7 +174,7 @@ int ath11k_dbring_buf_setup(struct ath11k *ar,
 	ring->hp_addr = ath11k_hal_srng_get_hp_addr(ar->ab, srng);
 	ring->tp_addr = ath11k_hal_srng_get_tp_addr(ar->ab, srng);
 
-	ret = ath11k_dbring_fill_bufs(ar, ring, GFP_KERNEL);
+	ret = ath11k_dbring_fill_bufs(ar, ring);
 
 	return ret;
 }
@@ -322,7 +320,7 @@ int ath11k_dbring_buffer_release_event(struct ath11k_base *ab,
 		}
 
 		memset(buff, 0, size);
-		ath11k_dbring_bufs_replenish(ar, ring, buff, GFP_ATOMIC);
+		ath11k_dbring_bufs_replenish(ar, ring, buff);
 	}
 
 	spin_unlock_bh(&srng->lock);

From b6a46ec871ea7ab90a3f67cd3e0054f270125de1 Mon Sep 17 00:00:00 2001
From: Sriram R <srirrama@codeaurora.org>
Date: Tue, 28 Sep 2021 12:05:40 +0300
Subject: [PATCH 1430/1750] ath11k: Avoid race during regd updates

[ Upstream commit 1db2b0d0a39102238fcbf9092cefa65a710642e9 ]

Whenever ath11k is bootup with a user country already set, cfg80211
notifies this country info to ath11k soon after registration, where the
notification is sent to the firmware for fetching the rules of this user
country input.

Multiple race conditions could be seen in this scenario where a new
request is either lost as pointed in [1] or a new regd overwrites the
default regd provided by the firmware during bootup. Note that, the
default regd is used for intersection purpose and hence it should not be
overwritten.

The main reason as pointed by [1] is the usage of ATH11K_FLAG_REGISTERED
flag which is updated after completion of core registration, whereas the
reg notification from cfg80211 and wmi events for the corresponding
request can happen much before that. Since the ATH11K_FLAG_REGISTERED is
currently used to determine if the event containing reg rules belong to
default regd or for user request, there is a possibility of the default
regd getting overwritten.

Since the default reg rules will be received only once per pdev on
firmware load, the above flag based check can be replaced with a check
to see if default_regd is already set, so that we can now always update
the new_regd. Also if the new_regd is set, this will be always used to
update the reg rules for the registered phy.

[1] https://patchwork.kernel.org/project/linux-wireless/patch/1829665.1PRlr7bOQj@ripper/

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.4.0.1-01460-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")

Signed-off-by: Sriram R <srirrama@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210721212029.142388-4-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/mac.c |  2 +-
 drivers/net/wireless/ath/ath11k/reg.c | 11 ++++++-----
 drivers/net/wireless/ath/ath11k/reg.h |  2 +-
 drivers/net/wireless/ath/ath11k/wmi.c | 16 ++++++----------
 4 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 63d70aecbd0f..0924bc8b3520 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -6320,7 +6320,7 @@ static int __ath11k_mac_register(struct ath11k *ar)
 		ar->hw->wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MONITOR);
 
 	/* Apply the regd received during initialization */
-	ret = ath11k_regd_update(ar, true);
+	ret = ath11k_regd_update(ar);
 	if (ret) {
 		ath11k_err(ar->ab, "ath11k regd update failed: %d\n", ret);
 		goto err_unregister_hw;
diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index 678d0885fcee..b8f9f3440887 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -198,7 +198,7 @@ static void ath11k_copy_regd(struct ieee80211_regdomain *regd_orig,
 		       sizeof(struct ieee80211_reg_rule));
 }
 
-int ath11k_regd_update(struct ath11k *ar, bool init)
+int ath11k_regd_update(struct ath11k *ar)
 {
 	struct ieee80211_regdomain *regd, *regd_copy = NULL;
 	int ret, regd_len, pdev_id;
@@ -209,7 +209,10 @@ int ath11k_regd_update(struct ath11k *ar, bool init)
 
 	spin_lock_bh(&ab->base_lock);
 
-	if (init) {
+	/* Prefer the latest regd update over default if it's available */
+	if (ab->new_regd[pdev_id]) {
+		regd = ab->new_regd[pdev_id];
+	} else {
 		/* Apply the regd received during init through
 		 * WMI_REG_CHAN_LIST_CC event. In case of failure to
 		 * receive the regd, initialize with a default world
@@ -222,8 +225,6 @@ int ath11k_regd_update(struct ath11k *ar, bool init)
 				    "failed to receive default regd during init\n");
 			regd = (struct ieee80211_regdomain *)&ath11k_world_regd;
 		}
-	} else {
-		regd = ab->new_regd[pdev_id];
 	}
 
 	if (!regd) {
@@ -680,7 +681,7 @@ void ath11k_regd_update_work(struct work_struct *work)
 					 regd_update_work);
 	int ret;
 
-	ret = ath11k_regd_update(ar, false);
+	ret = ath11k_regd_update(ar);
 	if (ret) {
 		/* Firmware has already moved to the new regd. We need
 		 * to maintain channel consistency across FW, Host driver
diff --git a/drivers/net/wireless/ath/ath11k/reg.h b/drivers/net/wireless/ath/ath11k/reg.h
index 39b7fc943541..7dbbba9fae1d 100644
--- a/drivers/net/wireless/ath/ath11k/reg.h
+++ b/drivers/net/wireless/ath/ath11k/reg.h
@@ -30,6 +30,6 @@ void ath11k_regd_update_work(struct work_struct *work);
 struct ieee80211_regdomain *
 ath11k_reg_build_regd(struct ath11k_base *ab,
 		      struct cur_regulatory_info *reg_info, bool intersect);
-int ath11k_regd_update(struct ath11k *ar, bool init);
+int ath11k_regd_update(struct ath11k *ar);
 int ath11k_reg_update_chan_list(struct ath11k *ar);
 #endif
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index cf0f778b0cbc..e17419c8dde0 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5410,10 +5410,10 @@ static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *sk
 	}
 
 	spin_lock(&ab->base_lock);
-	if (test_bit(ATH11K_FLAG_REGISTERED, &ab->dev_flags)) {
-		/* Once mac is registered, ar is valid and all CC events from
-		 * fw is considered to be received due to user requests
-		 * currently.
+	if (ab->default_regd[pdev_idx]) {
+		/* The initial rules from FW after WMI Init is to build
+		 * the default regd. From then on, any rules updated for
+		 * the pdev could be due to user reg changes.
 		 * Free previously built regd before assigning the newly
 		 * generated regd to ar. NULL pointer handling will be
 		 * taken care by kfree itself.
@@ -5423,13 +5423,9 @@ static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *sk
 		ab->new_regd[pdev_idx] = regd;
 		ieee80211_queue_work(ar->hw, &ar->regd_update_work);
 	} else {
-		/* Multiple events for the same *ar is not expected. But we
-		 * can still clear any previously stored default_regd if we
-		 * are receiving this event for the same radio by mistake.
-		 * NULL pointer handling will be taken care by kfree itself.
+		/* This regd would be applied during mac registration and is
+		 * held constant throughout for regd intersection purpose
 		 */
-		kfree(ab->default_regd[pdev_idx]);
-		/* This regd would be applied during mac registration */
 		ab->default_regd[pdev_idx] = regd;
 	}
 	ab->dfs_region = reg_info->dfs_region;

From 4519fb910555453d2b5589dd0ff42a298e95583e Mon Sep 17 00:00:00 2001
From: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Date: Tue, 28 Sep 2021 14:00:43 +0300
Subject: [PATCH 1431/1750] ath11k: fix packet drops due to incorrect 6 GHz
 freq value in rx status

[ Upstream commit 9d6ae1f5cf733c0e8d7f904c501fd015c4b9f0f4 ]

Frequency in rx status is being filled incorrectly in the 6 GHz band as
channel number received is invalid in this case which is causing packet
drops. So fix that.

Fixes: 5dcf42f8b79d ("ath11k: Use freq instead of channel number in rx path")
Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210722102054.43419-2-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/dp_rx.c |  9 ++++++---
 drivers/net/wireless/ath/ath11k/wmi.c   | 10 +++++++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 7d6fd8155bb2..2e77dca6b1ad 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -2303,8 +2303,10 @@ static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
 	channel_num = ath11k_dp_rx_h_msdu_start_freq(rx_desc);
 	center_freq = ath11k_dp_rx_h_msdu_start_freq(rx_desc) >> 16;
 
-	if (center_freq >= 5935 && center_freq <= 7105) {
+	if (center_freq >= ATH11K_MIN_6G_FREQ &&
+	    center_freq <= ATH11K_MAX_6G_FREQ) {
 		rx_status->band = NL80211_BAND_6GHZ;
+		rx_status->freq = center_freq;
 	} else if (channel_num >= 1 && channel_num <= 14) {
 		rx_status->band = NL80211_BAND_2GHZ;
 	} else if (channel_num >= 36 && channel_num <= 173) {
@@ -2322,8 +2324,9 @@ static void ath11k_dp_rx_h_ppdu(struct ath11k *ar, struct hal_rx_desc *rx_desc,
 				rx_desc, sizeof(struct hal_rx_desc));
 	}
 
-	rx_status->freq = ieee80211_channel_to_frequency(channel_num,
-							 rx_status->band);
+	if (rx_status->band != NL80211_BAND_6GHZ)
+		rx_status->freq = ieee80211_channel_to_frequency(channel_num,
+								 rx_status->band);
 
 	ath11k_dp_rx_h_rate(ar, rx_desc, rx_status);
 }
diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
index e17419c8dde0..74ebe8e7d1d8 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.c
+++ b/drivers/net/wireless/ath/ath11k/wmi.c
@@ -5668,8 +5668,10 @@ static void ath11k_mgmt_rx_event(struct ath11k_base *ab, struct sk_buff *skb)
 	if (rx_ev.status & WMI_RX_STATUS_ERR_MIC)
 		status->flag |= RX_FLAG_MMIC_ERROR;
 
-	if (rx_ev.chan_freq >= ATH11K_MIN_6G_FREQ) {
+	if (rx_ev.chan_freq >= ATH11K_MIN_6G_FREQ &&
+	    rx_ev.chan_freq <= ATH11K_MAX_6G_FREQ) {
 		status->band = NL80211_BAND_6GHZ;
+		status->freq = rx_ev.chan_freq;
 	} else if (rx_ev.channel >= 1 && rx_ev.channel <= 14) {
 		status->band = NL80211_BAND_2GHZ;
 	} else if (rx_ev.channel >= 36 && rx_ev.channel <= ATH11K_MAX_5G_CHAN) {
@@ -5690,8 +5692,10 @@ static void ath11k_mgmt_rx_event(struct ath11k_base *ab, struct sk_buff *skb)
 
 	sband = &ar->mac.sbands[status->band];
 
-	status->freq = ieee80211_channel_to_frequency(rx_ev.channel,
-						      status->band);
+	if (status->band != NL80211_BAND_6GHZ)
+		status->freq = ieee80211_channel_to_frequency(rx_ev.channel,
+							      status->band);
+
 	status->signal = rx_ev.snr + ATH11K_DEFAULT_NOISE_FLOOR;
 	status->rate_idx = ath11k_mac_bitrate_to_idx(sband, rx_ev.rate / 100);
 

From 08fb0008d90ba34eba72291bf3e356c58fe38337 Mon Sep 17 00:00:00 2001
From: Baochen Qiang <bqiang@codeaurora.org>
Date: Tue, 28 Sep 2021 14:00:44 +0300
Subject: [PATCH 1432/1750] ath11k: Fix memory leak in
 ath11k_qmi_driver_event_work

[ Upstream commit 72de799aa9e3e064b35238ef053d2f0a49db055a ]

The buffer pointed to by event is not freed in case
ATH11K_FLAG_UNREGISTERING bit is set, resulting in
memory leak, so fix it.

Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-01720.1-QCAHSPSWPL_V1_V2_SILICONZ_LITE-1

Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Baochen Qiang <bqiang@codeaurora.org>
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210913180246.193388-4-jouni@codeaurora.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath11k/qmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c
index 2ae7c6bf091e..c842e275d1ad 100644
--- a/drivers/net/wireless/ath/ath11k/qmi.c
+++ b/drivers/net/wireless/ath/ath11k/qmi.c
@@ -2616,8 +2616,10 @@ static void ath11k_qmi_driver_event_work(struct work_struct *work)
 		list_del(&event->list);
 		spin_unlock(&qmi->event_lock);
 
-		if (test_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags))
+		if (test_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags)) {
+			kfree(event);
 			return;
+		}
 
 		switch (event->type) {
 		case ATH11K_QMI_EVENT_SERVER_ARRIVE:

From ffed645538179fce6f05557fd89b7e2f8a8120de Mon Sep 17 00:00:00 2001
From: Loic Poulain <loic.poulain@linaro.org>
Date: Tue, 28 Sep 2021 14:00:47 +0300
Subject: [PATCH 1433/1750] ath10k: Fix missing frame timestamp for
 beacon/probe-resp

[ Upstream commit e6dfbc3ba90cc2b619229be56b485f085a0a8e1c ]

When receiving a beacon or probe response, we should update the
boottime_ns field which is the timestamp the frame was received at.
(cf mac80211.h)

This fixes a scanning issue with Android since it relies on this
timestamp to determine when the AP has been seen for the last time
(via the nl80211 BSS_LAST_SEEN_BOOTTIME parameter).

Fixes: 5e3dd157d7e7 ("ath10k: mac80211 driver for Qualcomm Atheros 802.11ac CQA98xx devices")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1629811733-7927-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/wmi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 37b53af760d7..85fe855ece09 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -2610,6 +2610,10 @@ int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
 	if (ieee80211_is_beacon(hdr->frame_control))
 		ath10k_mac_handle_beacon(ar, skb);
 
+	if (ieee80211_is_beacon(hdr->frame_control) ||
+	    ieee80211_is_probe_resp(hdr->frame_control))
+		status->boottime_ns = ktime_get_boottime_ns();
+
 	ath10k_dbg(ar, ATH10K_DBG_MGMT,
 		   "event mgmt rx skb %pK len %d ftype %02x stype %02x\n",
 		   skb, skb->len,

From c39154d3d62316bcd24b0e8eda8d6569e2c67495 Mon Sep 17 00:00:00 2001
From: Fabio Estevam <festevam@denx.de>
Date: Tue, 28 Sep 2021 14:00:47 +0300
Subject: [PATCH 1434/1750] ath10k: sdio: Add missing BH locking around
 napi_schdule()

[ Upstream commit 019edd01d174ce4bb2e517dd332922514d176601 ]

On a i.MX-based board with a QCA9377 Wifi chip, the following errors
are seen after launching the 'hostapd' application:

hostapd /etc/wifi.conf
Configuration file: /etc/wifi.conf
wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
Using interface wlan0 with hwaddr 00:1f:7b:31:04:a0 and ssid "thessid"
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
wlan0: interface state COUNTRY_UPDATE->ENABLED
wlan0: AP-ENABLED
NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
...

Fix this problem by adding the BH locking around napi-schedule(),
in the same way it was done in commit e63052a5dd3c ("mlx5e: add
add missing BH locking around napi_schdule()").

Its commit log provides the following explanation:

"It's not correct to call napi_schedule() in pure process
context. Because we use __raise_softirq_irqoff() we require
callers to be in a context which will eventually lead to
softirq handling (hardirq, bh disabled, etc.).

With code as is users will see:

NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!!
"

Fixes: cfee8793a74d ("ath10k: enable napi on RX path for sdio")
Signed-off-by: Fabio Estevam <festevam@denx.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210824144339.2796122-1-festevam@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/sdio.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
index 81ddaafb6721..0fe639710a8b 100644
--- a/drivers/net/wireless/ath/ath10k/sdio.c
+++ b/drivers/net/wireless/ath/ath10k/sdio.c
@@ -1363,8 +1363,11 @@ static void ath10k_rx_indication_async_work(struct work_struct *work)
 		ep->ep_ops.ep_rx_complete(ar, skb);
 	}
 
-	if (test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags))
+	if (test_bit(ATH10K_FLAG_CORE_REGISTERED, &ar->dev_flags)) {
+		local_bh_disable();
 		napi_schedule(&ar->napi);
+		local_bh_enable();
+	}
 }
 
 static int ath10k_sdio_read_rtc_state(struct ath10k_sdio *ar_sdio, unsigned char *state)

From cbbf816cb7f9a84696b1f6277fee85c67a1c590c Mon Sep 17 00:00:00 2001
From: Matthew Auld <matthew.auld@intel.com>
Date: Mon, 27 Sep 2021 12:41:02 +0100
Subject: [PATCH 1435/1750] drm/ttm: stop calling tt_swapin in vm_access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit f5d28856b89baab4232a9f841e565763fcebcdf9 ]

In commit:

commit 09ac4fcb3f255e9225967c75f5893325c116cdbe
Author: Felix Kuehling <Felix.Kuehling@amd.com>
Date:   Thu Jul 13 17:01:16 2017 -0400

    drm/ttm: Implement vm_operations_struct.access v2

we added the vm_access hook, where we also directly call tt_swapin for
some reason. If something is swapped-out then the ttm_tt must also be
unpopulated, and since access_kmap should also call tt_populate, if
needed, then swapping-in will already be handled there.

If anything, calling tt_swapin directly here would likely always fail
since the tt->pages won't yet be populated, or worse since the tt->pages
array is never actually cleared in unpopulate this might lead to a nasty
uaf.

Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Christian König <christian.koenig@amd.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210927114114.152310-1-matthew.auld@intel.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/ttm/ttm_bo_vm.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
index 98a006fc30a5..0b1daf442425 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
@@ -500,11 +500,6 @@ int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr,
 
 	switch (bo->mem.mem_type) {
 	case TTM_PL_SYSTEM:
-		if (unlikely(bo->ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)) {
-			ret = ttm_tt_swapin(bo->ttm);
-			if (unlikely(ret != 0))
-				return ret;
-		}
 		fallthrough;
 	case TTM_PL_TT:
 		ret = ttm_bo_vm_access_kmap(bo, offset, buf, len, write);

From 8980f9d14481606d82a8643aee6f6d0d97fc0ea7 Mon Sep 17 00:00:00 2001
From: Sudarshan Rajagopalan <quic_sudaraja@quicinc.com>
Date: Tue, 28 Sep 2021 11:51:49 -0700
Subject: [PATCH 1436/1750] arm64: mm: update max_pfn after memory hotplug

[ Upstream commit 8fac67ca236b961b573355e203dbaf62a706a2e5 ]

After new memory blocks have been hotplugged, max_pfn and max_low_pfn
needs updating to reflect on new PFNs being hot added to system.
Without this patch, debug-related functions that use max_pfn such as
get_max_dump_pfn() or read_page_owner() will not work with any page in
memory that is hot-added after boot.

Fixes: 4ab215061554 ("arm64: Add memory hotplug support")
Signed-off-by: Sudarshan Rajagopalan <quic_sudaraja@quicinc.com>
Signed-off-by: Chris Goldsworthy <quic_cgoldswo@quicinc.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Georgi Djakov <quic_c_gdjako@quicinc.com>
Tested-by: Georgi Djakov <quic_c_gdjako@quicinc.com>
Link: https://lore.kernel.org/r/a51a27ee7be66024b5ce626310d673f24107bcb8.1632853776.git.quic_cgoldswo@quicinc.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/mm/mmu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 58dc93e56617..2601a514d8c4 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -1492,6 +1492,11 @@ int arch_add_memory(int nid, u64 start, u64 size,
 	if (ret)
 		__remove_pgd_mapping(swapper_pg_dir,
 				     __phys_to_virt(start), size);
+	else {
+		max_pfn = PFN_UP(start + size);
+		max_low_pfn = max_pfn;
+	}
+
 	return ret;
 }
 

From 375150b3aaf8cf7d01f6f0b582e264dd2fded814 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 27 Sep 2021 14:58:10 +0200
Subject: [PATCH 1437/1750] drm/amdgpu: fix warning for overflow check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 335aea75b0d95518951cad7c4c676e6f1c02c150 ]

The overflow check in amdgpu_bo_list_create() causes a warning with
clang-14 on 64-bit architectures, since the limit can never be
exceeded.

drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c:74:18: error: result of comparison of constant 256204778801521549 with expression of type 'unsigned int' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
        if (num_entries > (SIZE_MAX - sizeof(struct amdgpu_bo_list))
            ~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The check remains useful for 32-bit architectures, so just avoid the
warning by using size_t as the type for the count.

Fixes: 920990cb080a ("drm/amdgpu: allocate the bo_list array after the list")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
index 15c45b2a3983..714178f1b6c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
@@ -61,7 +61,7 @@ static void amdgpu_bo_list_free(struct kref *ref)
 
 int amdgpu_bo_list_create(struct amdgpu_device *adev, struct drm_file *filp,
 			  struct drm_amdgpu_bo_list_entry *info,
-			  unsigned num_entries, struct amdgpu_bo_list **result)
+			  size_t num_entries, struct amdgpu_bo_list **result)
 {
 	unsigned last_entry = 0, first_userptr = num_entries;
 	struct amdgpu_bo_list_entry *array;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
index a130e766cbdb..529d52a204cf 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.h
@@ -60,7 +60,7 @@ int amdgpu_bo_create_list_entry_array(struct drm_amdgpu_bo_list_in *in,
 int amdgpu_bo_list_create(struct amdgpu_device *adev,
 				 struct drm_file *filp,
 				 struct drm_amdgpu_bo_list_entry *info,
-				 unsigned num_entries,
+				 size_t num_entries,
 				 struct amdgpu_bo_list **list);
 
 static inline struct amdgpu_bo_list_entry *

From 4303b39b50758613ef45990440488a46febe4df9 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Thu, 29 Jul 2021 22:23:33 +0200
Subject: [PATCH 1438/1750] media: em28xx: add missing em28xx_close_extension

[ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ]

If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.

Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com

Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-cards.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
index 5144888ae36f..cf45cc566cbe 100644
--- a/drivers/media/usb/em28xx/em28xx-cards.c
+++ b/drivers/media/usb/em28xx/em28xx-cards.c
@@ -4089,8 +4089,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
 
 	em28xx_close_extension(dev);
 
-	if (dev->dev_next)
+	if (dev->dev_next) {
+		em28xx_close_extension(dev->dev_next);
 		em28xx_release_resources(dev->dev_next);
+	}
+
 	em28xx_release_resources(dev);
 
 	if (dev->dev_next) {

From 0a85325fc565d51beb94ad2c524dfba95f06371a Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Tue, 20 Jul 2021 18:07:49 +0200
Subject: [PATCH 1439/1750] media: cxd2880-spi: Fix a null pointer dereference
 on error handling path

[ Upstream commit 11b982e950d2138e90bd120501df10a439006ff8 ]

Currently the null pointer check on dvb_spi->vcc_supply is inverted and
this leads to only null values of the dvb_spi->vcc_supply being passed
to the call of regulator_disable causing null pointer dereferences.
Fix this by only calling regulator_disable if dvb_spi->vcc_supply is
not null.

Addresses-Coverity: ("Dereference after null check")

Fixes: dcb014582101 ("media: cxd2880-spi: Fix an error handling path")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/spi/cxd2880-spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c
index 93194f03764d..11273be702b6 100644
--- a/drivers/media/spi/cxd2880-spi.c
+++ b/drivers/media/spi/cxd2880-spi.c
@@ -618,7 +618,7 @@ cxd2880_spi_probe(struct spi_device *spi)
 fail_attach:
 	dvb_unregister_adapter(&dvb_spi->adapter);
 fail_adapter:
-	if (!dvb_spi->vcc_supply)
+	if (dvb_spi->vcc_supply)
 		regulator_disable(dvb_spi->vcc_supply);
 fail_regulator:
 	kfree(dvb_spi);

From e2f3608a0b5075774a422bf56745f56fc90a0f28 Mon Sep 17 00:00:00 2001
From: Pavel Skripkin <paskripkin@gmail.com>
Date: Fri, 13 Aug 2021 16:34:20 +0200
Subject: [PATCH 1440/1750] media: dvb-usb: fix ununit-value in az6027_rc_query

[ Upstream commit afae4ef7d5ad913cab1316137854a36bea6268a5 ]

Syzbot reported ununit-value bug in az6027_rc_query(). The problem was
in missing state pointer initialization. Since this function does nothing
we can simply initialize state to REMOTE_NO_KEY_PRESSED.

Reported-and-tested-by: syzbot+2cd8c5db4a85f0a04142@syzkaller.appspotmail.com

Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/az6027.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
index 1c39b61cde29..86788771175b 100644
--- a/drivers/media/usb/dvb-usb/az6027.c
+++ b/drivers/media/usb/dvb-usb/az6027.c
@@ -391,6 +391,7 @@ static struct rc_map_table rc_map_az6027_table[] = {
 /* remote control stuff (does not work with my box) */
 static int az6027_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
+	*state = REMOTE_NO_KEY_PRESSED;
 	return 0;
 }
 

From c85e591b77cacf73295da17f137597c0a6e04327 Mon Sep 17 00:00:00 2001
From: Ricardo Ribalda <ribalda@chromium.org>
Date: Fri, 18 Jun 2021 14:29:06 +0200
Subject: [PATCH 1441/1750] media: v4l2-ioctl: S_CTRL output the right value

[ Upstream commit c87ed93574e3cd8346c05bd934c617596c12541b ]

If the driver does not implement s_ctrl, but it does implement
s_ext_ctrls, we convert the call.

When that happens we have also to convert back the response from
s_ext_ctrls.

Fixes v4l2_compliance:
Control ioctls (Input 0):
		fail: v4l2-test-controls.cpp(411): returned control value out of range
		fail: v4l2-test-controls.cpp(507): invalid control 00980900
	test VIDIOC_G/S_CTRL: FAIL

Fixes: 35ea11ff8471 ("V4L/DVB (8430): videodev: move some functions from v4l2-dev.h to v4l2-common.h or v4l2-ioctl.h")
Reviewed-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/v4l2-core/v4l2-ioctl.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
index 42958ce22de1..4ffa14e44efe 100644
--- a/drivers/media/v4l2-core/v4l2-ioctl.c
+++ b/drivers/media/v4l2-core/v4l2-ioctl.c
@@ -2263,6 +2263,7 @@ static int v4l_s_ctrl(const struct v4l2_ioctl_ops *ops,
 		test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags) ? fh : NULL;
 	struct v4l2_ext_controls ctrls;
 	struct v4l2_ext_control ctrl;
+	int ret;
 
 	if (vfh && vfh->ctrl_handler)
 		return v4l2_s_ctrl(vfh, vfh->ctrl_handler, p);
@@ -2278,9 +2279,11 @@ static int v4l_s_ctrl(const struct v4l2_ioctl_ops *ops,
 	ctrls.controls = &ctrl;
 	ctrl.id = p->id;
 	ctrl.value = p->value;
-	if (check_ext_ctrls(&ctrls, VIDIOC_S_CTRL))
-		return ops->vidioc_s_ext_ctrls(file, fh, &ctrls);
-	return -EINVAL;
+	if (!check_ext_ctrls(&ctrls, VIDIOC_S_CTRL))
+		return -EINVAL;
+	ret = ops->vidioc_s_ext_ctrls(file, fh, &ctrls);
+	p->value = ctrl.value;
+	return ret;
 }
 
 static int v4l_g_ext_ctrls(const struct v4l2_ioctl_ops *ops,

From e43b301cb1ba05616c35ece3622b66ef3badac8b Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Thu, 12 Aug 2021 19:00:43 +0200
Subject: [PATCH 1442/1750] media: TDA1997x: handle short reads of hdmi info
 frame.

[ Upstream commit 48d219f9cc667bc6fbc3e3af0b1bfd75db94fce4 ]

Static analysis reports this representative problem

tda1997x.c:1939: warning: 7th function call argument is an uninitialized
value

The 7th argument is buffer[0], which is set in the earlier call to
io_readn().  When io_readn() call to io_read() fails with the first
read, buffer[0] is not set and 0 is returned and stored in len.

The later call to hdmi_infoframe_unpack()'s size parameter is the
static size of buffer, always 40, so a short read is not caught
in hdmi_infoframe_unpacks()'s checking.  The variable len should be
used instead.

Zero initialize buffer to 0 so it is in a known start state.

Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tda1997x.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 17cc69c3227f..8476330964fc 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -1247,13 +1247,13 @@ tda1997x_parse_infoframe(struct tda1997x_state *state, u16 addr)
 {
 	struct v4l2_subdev *sd = &state->sd;
 	union hdmi_infoframe frame;
-	u8 buffer[40];
+	u8 buffer[40] = { 0 };
 	u8 reg;
 	int len, err;
 
 	/* read data */
 	len = io_readn(sd, addr, sizeof(buffer), buffer);
-	err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer));
+	err = hdmi_infoframe_unpack(&frame, buffer, len);
 	if (err) {
 		v4l_err(state->client,
 			"failed parsing %d byte infoframe: 0x%04x/0x%02x\n",
@@ -1927,13 +1927,13 @@ static int tda1997x_log_infoframe(struct v4l2_subdev *sd, int addr)
 {
 	struct tda1997x_state *state = to_state(sd);
 	union hdmi_infoframe frame;
-	u8 buffer[40];
+	u8 buffer[40] = { 0 };
 	int len, err;
 
 	/* read data */
 	len = io_readn(sd, addr, sizeof(buffer), buffer);
 	v4l2_dbg(1, debug, sd, "infoframe: addr=%d len=%d\n", addr, len);
-	err = hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer));
+	err = hdmi_infoframe_unpack(&frame, buffer, len);
 	if (err) {
 		v4l_err(state->client,
 			"failed parsing %d byte infoframe: 0x%04x/0x%02x\n",

From 4280b30ea9b5054f4afa15ae0bb282fafd543e75 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Thu, 19 Aug 2021 22:21:25 +0200
Subject: [PATCH 1443/1750] media: mtk-vpu: Fix a resource leak in the error
 handling path of 'mtk_vpu_probe()'

[ Upstream commit 2143ad413c05c7be24c3a92760e367b7f6aaac92 ]

A successful 'clk_prepare()' call should be balanced by a corresponding
'clk_unprepare()' call in the error handling path of the probe, as already
done in the remove function.

Update the error handling path accordingly.

Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Houlong Wei <houlong.wei@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/mtk-vpu/mtk_vpu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c
index 36cb9b6131f7..c62eb212cca9 100644
--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c
+++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c
@@ -820,7 +820,8 @@ static int mtk_vpu_probe(struct platform_device *pdev)
 	vpu->wdt.wq = create_singlethread_workqueue("vpu_wdt");
 	if (!vpu->wdt.wq) {
 		dev_err(dev, "initialize wdt workqueue failed\n");
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto clk_unprepare;
 	}
 	INIT_WORK(&vpu->wdt.ws, vpu_wdt_reset_func);
 	mutex_init(&vpu->vpu_mutex);
@@ -914,6 +915,8 @@ static int mtk_vpu_probe(struct platform_device *pdev)
 	vpu_clock_disable(vpu);
 workqueue_destroy:
 	destroy_workqueue(vpu->wdt.wq);
+clk_unprepare:
+	clk_unprepare(vpu->clk);
 
 	return ret;
 }

From 88315edafe39246624d8b3142e6da34a28c714a3 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 3 Aug 2021 21:46:08 +0200
Subject: [PATCH 1444/1750] media: radio-wl1273: Avoid card name truncation

[ Upstream commit dfadec236aa99f6086141949c9dc3ec50f3ff20d ]

The "card" string only holds 31 characters (and the terminating NUL).
In order to avoid truncation, use a shorter card description instead of
the current result, "Texas Instruments Wl1273 FM Rad".

Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 87d1a50ce451 ("[media] V4L2: WL1273 FM Radio: TI WL1273 FM radio driver")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/radio/radio-wl1273.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
index 112376873167..484046471c03 100644
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@ -1279,7 +1279,7 @@ static int wl1273_fm_vidioc_querycap(struct file *file, void *priv,
 
 	strscpy(capability->driver, WL1273_FM_DRIVER_NAME,
 		sizeof(capability->driver));
-	strscpy(capability->card, "Texas Instruments Wl1273 FM Radio",
+	strscpy(capability->card, "TI Wl1273 FM Radio",
 		sizeof(capability->card));
 	strscpy(capability->bus_info, radio->bus_type,
 		sizeof(capability->bus_info));

From 86626be4b629c3248ef8f6bab8253e9c69246b61 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 3 Aug 2021 21:46:09 +0200
Subject: [PATCH 1445/1750] media: si470x: Avoid card name truncation

[ Upstream commit 2908249f3878a591f7918368fdf0b7b0a6c3158c ]

The "card" string only holds 31 characters (and the terminating NUL).
In order to avoid truncation, use a shorter card description instead of
the current result, "Silicon Labs Si470x FM Radio Re".

Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: 78656acdcf48 ("V4L/DVB (7038): USB radio driver for Silicon Labs Si470x FM Radio Receivers")
Fixes: cc35bbddfe10 ("V4L/DVB (12416): radio-si470x: add i2c driver for si470x")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +-
 drivers/media/radio/si470x/radio-si470x-usb.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index f491420d7b53..a972c0705ac7 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -11,7 +11,7 @@
 
 /* driver definitions */
 #define DRIVER_AUTHOR "Joonyoung Shim <jy0922.shim@samsung.com>";
-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver"
+#define DRIVER_CARD "Silicon Labs Si470x FM Radio"
 #define DRIVER_DESC "I2C radio driver for Si470x FM Radio Receivers"
 #define DRIVER_VERSION "1.0.2"
 
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
index fedff68d8c49..3f8634a46573 100644
--- a/drivers/media/radio/si470x/radio-si470x-usb.c
+++ b/drivers/media/radio/si470x/radio-si470x-usb.c
@@ -16,7 +16,7 @@
 
 /* driver definitions */
 #define DRIVER_AUTHOR "Tobias Lorenz <tobias.lorenz@gmx.net>"
-#define DRIVER_CARD "Silicon Labs Si470x FM Radio Receiver"
+#define DRIVER_CARD "Silicon Labs Si470x FM Radio"
 #define DRIVER_DESC "USB radio driver for Si470x FM Radio Receivers"
 #define DRIVER_VERSION "1.0.10"
 

From 388cebfa7342cbf0ad5522c570d7630f241ebeac Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Tue, 3 Aug 2021 21:46:10 +0200
Subject: [PATCH 1446/1750] media: tm6000: Avoid card name truncation

[ Upstream commit 42bb98e420d454fef3614b70ea11cc59068395f6 ]

The "card" string only holds 31 characters (and the terminating NUL).
In order to avoid truncation, use a shorter card description instead of
the current result, "Trident TVMaster TM5600/6000/60".

Suggested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Fixes: e28f49b0b2a8 ("V4L/DVB: tm6000: fix some info messages")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/tm6000/tm6000-video.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c
index 2df736c029d6..01071e6cd757 100644
--- a/drivers/media/usb/tm6000/tm6000-video.c
+++ b/drivers/media/usb/tm6000/tm6000-video.c
@@ -854,8 +854,7 @@ static int vidioc_querycap(struct file *file, void  *priv,
 	struct tm6000_core *dev = ((struct tm6000_fh *)priv)->dev;
 
 	strscpy(cap->driver, "tm6000", sizeof(cap->driver));
-	strscpy(cap->card, "Trident TVMaster TM5600/6000/6010",
-		sizeof(cap->card));
+	strscpy(cap->card, "Trident TM5600/6000/6010", sizeof(cap->card));
 	usb_make_path(dev->udev, cap->bus_info, sizeof(cap->bus_info));
 	cap->capabilities = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_READWRITE |
 			    V4L2_CAP_DEVICE_CAPS;

From c34bfe4204cdd234195f6695fccf3b2bfb87ecbd Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 4 Aug 2021 10:50:10 +0200
Subject: [PATCH 1447/1750] media: cx23885: Fix snd_card_free call on null card
 pointer

[ Upstream commit 7266dda2f1dfe151b12ef0c14eb4d4e622fb211c ]

Currently a call to snd_card_new that fails will set card with a NULL
pointer, this causes a null pointer dereference on the error cleanup
path when card it passed to snd_card_free. Fix this by adding a new
error exit path that does not call snd_card_free and exiting via this
new path.

Addresses-Coverity: ("Explicit null dereference")

Fixes: 9e44d63246a9 ("[media] cx23885: Add ALSA support")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/pci/cx23885/cx23885-alsa.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/cx23885/cx23885-alsa.c b/drivers/media/pci/cx23885/cx23885-alsa.c
index 13689c5dd47f..9154031c087d 100644
--- a/drivers/media/pci/cx23885/cx23885-alsa.c
+++ b/drivers/media/pci/cx23885/cx23885-alsa.c
@@ -550,7 +550,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev)
 			   SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1,
 			THIS_MODULE, sizeof(struct cx23885_audio_dev), &card);
 	if (err < 0)
-		goto error;
+		goto error_msg;
 
 	chip = (struct cx23885_audio_dev *) card->private_data;
 	chip->dev = dev;
@@ -576,6 +576,7 @@ struct cx23885_audio_dev *cx23885_audio_register(struct cx23885_dev *dev)
 
 error:
 	snd_card_free(card);
+error_msg:
 	pr_err("%s(): Failed to register analog audio adapter\n",
 	       __func__);
 

From 848f1f00c637da8cb5d5b4fb702fade5c03696df Mon Sep 17 00:00:00 2001
From: Punit Agrawal <punitagrawal@gmail.com>
Date: Tue, 14 Sep 2021 23:38:37 +0900
Subject: [PATCH 1448/1750] kprobes: Do not use local variable when creating
 debugfs file

[ Upstream commit 8f7262cd66699a4b02eb7549b35c81b2116aad95 ]

debugfs_create_file() takes a pointer argument that can be used during
file operation callbacks (accessible via i_private in the inode
structure). An obvious requirement is for the pointer to refer to
valid memory when used.

When creating the debugfs file to dynamically enable / disable
kprobes, a pointer to local variable is passed to
debugfs_create_file(); which will go out of scope when the init
function returns. The reason this hasn't triggered random memory
corruption is because the pointer is not accessed during the debugfs
file callbacks.

Since the enabled state is managed by the kprobes_all_disabled global
variable, the local variable is not needed. Fix the incorrect (and
unnecessary) usage of local variable during debugfs_file_create() by
passing NULL instead.

Link: https://lkml.kernel.org/r/163163031686.489837.4476867635937014973.stgit@devnote2

Fixes: bf8f6e5b3e51 ("Kprobes: The ON/OFF knob thru debugfs")
Signed-off-by: Punit Agrawal <punitagrawal@gmail.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/kprobes.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index f590e9ff3706..66a6ba81edb1 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2943,13 +2943,12 @@ static const struct file_operations fops_kp = {
 static int __init debugfs_kprobe_init(void)
 {
 	struct dentry *dir;
-	unsigned int value = 1;
 
 	dir = debugfs_create_dir("kprobes", NULL);
 
 	debugfs_create_file("list", 0400, dir, NULL, &kprobes_fops);
 
-	debugfs_create_file("enabled", 0600, dir, &value, &fops_kp);
+	debugfs_create_file("enabled", 0600, dir, NULL, &fops_kp);
 
 	debugfs_create_file("blacklist", 0400, dir, NULL,
 			    &kprobe_blacklist_fops);

From 66f7de13d1566017c02cfaa51d1e44690990ce03 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 20 Sep 2021 12:05:35 +0200
Subject: [PATCH 1449/1750] crypto: ecc - fix CRYPTO_DEFAULT_RNG dependency

[ Upstream commit 38aa192a05f22f9778f9420e630f0322525ef12e ]

The ecc.c file started out as part of the ECDH algorithm but got
moved out into a standalone module later. It does not build without
CRYPTO_DEFAULT_RNG, so now that other modules are using it as well we
can run into this link error:

aarch64-linux-ld: ecc.c:(.text+0xfc8): undefined reference to `crypto_default_rng'
aarch64-linux-ld: ecc.c:(.text+0xff4): undefined reference to `crypto_put_default_rng'

Move the 'select CRYPTO_DEFAULT_RNG' statement into the correct symbol.

Fixes: 0d7a78643f69 ("crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm")
Fixes: 4e6602916bc6 ("crypto: ecdsa - Add support for ECDSA signature verification")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/Kconfig b/crypto/Kconfig
index 774adc9846fa..1157f82dc9cf 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -238,12 +238,12 @@ config CRYPTO_DH
 
 config CRYPTO_ECC
 	tristate
+	select CRYPTO_RNG_DEFAULT
 
 config CRYPTO_ECDH
 	tristate "ECDH algorithm"
 	select CRYPTO_ECC
 	select CRYPTO_KPP
-	select CRYPTO_RNG_DEFAULT
 	help
 	  Generic implementation of the ECDH algorithm
 

From f03e0624e927579376fb0a7f260d5de4dfd4ecfc Mon Sep 17 00:00:00 2001
From: Anel Orazgaliyeva <anelkz@amazon.de>
Date: Mon, 6 Sep 2021 18:34:40 +0000
Subject: [PATCH 1450/1750] cpuidle: Fix kobject memory leaks in error paths

[ Upstream commit e5f5a66c9aa9c331da5527c2e3fd9394e7091e01 ]

Commit c343bf1ba5ef ("cpuidle: Fix three reference count leaks")
fixes the cleanup of kobjects; however, it removes kfree() calls
altogether, leading to memory leaks.

Fix those and also defer the initialization of dev->kobj_dev until
after the error check, so that we do not end up with a dangling
pointer.

Fixes: c343bf1ba5ef ("cpuidle: Fix three reference count leaks")
Signed-off-by: Anel Orazgaliyeva <anelkz@amazon.de>
Suggested-by: Aman Priyadarshi <apeureka@amazon.de>
[ rjw: Subject edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/cpuidle/sysfs.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 53ec9585ccd4..469e18547d06 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -488,6 +488,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
 					   &kdev->kobj, "state%d", i);
 		if (ret) {
 			kobject_put(&kobj->kobj);
+			kfree(kobj);
 			goto error_state;
 		}
 		cpuidle_add_s2idle_attr_group(kobj);
@@ -619,6 +620,7 @@ static int cpuidle_add_driver_sysfs(struct cpuidle_device *dev)
 				   &kdev->kobj, "driver");
 	if (ret) {
 		kobject_put(&kdrv->kobj);
+		kfree(kdrv);
 		return ret;
 	}
 
@@ -705,7 +707,6 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
 	if (!kdev)
 		return -ENOMEM;
 	kdev->dev = dev;
-	dev->kobj_dev = kdev;
 
 	init_completion(&kdev->kobj_unregister);
 
@@ -713,9 +714,11 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev)
 				   "cpuidle");
 	if (error) {
 		kobject_put(&kdev->kobj);
+		kfree(kdev);
 		return error;
 	}
 
+	dev->kobj_dev = kdev;
 	kobject_uevent(&kdev->kobj, KOBJ_ADD);
 
 	return 0;

From 52e3545eefb68414ec317aa0ac1356443984922b Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Fri, 17 Sep 2021 18:07:02 +0200
Subject: [PATCH 1451/1750] media: em28xx: Don't use ops->suspend if it is NULL

[ Upstream commit 51fa3b70d27342baf1ea8aaab3e96e5f4f26d5b2 ]

The call to ops->suspend for the dev->dev_next case can currently
trigger a call on a null function pointer if ops->suspend is null.
Skip over the use of function ops->suspend if it is null.

Addresses-Coverity: ("Dereference after null check")

Fixes: be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner functionality")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index 3daa64bb1e1d..af9216278024 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -1152,8 +1152,9 @@ int em28xx_suspend_extension(struct em28xx *dev)
 	dev_info(&dev->intf->dev, "Suspending extensions\n");
 	mutex_lock(&em28xx_devlist_mutex);
 	list_for_each_entry(ops, &em28xx_extension_devlist, next) {
-		if (ops->suspend)
-			ops->suspend(dev);
+		if (!ops->suspend)
+			continue;
+		ops->suspend(dev);
 		if (dev->dev_next)
 			ops->suspend(dev->dev_next);
 	}

From d01e847d84bf698206febd59a169b60eb2b3e077 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Linus=20L=C3=BCssing?= <ll@simonwunderlich.de>
Date: Tue, 5 Oct 2021 16:55:53 +0300
Subject: [PATCH 1452/1750] ath9k: Fix potential interrupt storm on queue reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4925642d541278575ad1948c5924d71ffd57ef14 ]

In tests with two Lima boards from 8devices (QCA4531 based) on OpenWrt
19.07 we could force a silent restart of a device with no serial
output when we were sending a high amount of UDP traffic (iperf3 at 80
MBit/s in both directions from external hosts, saturating the wifi and
causing a load of about 4.5 to 6) and were then triggering an
ath9k_queue_reset().

Further debugging showed that the restart was caused by the ath79
watchdog. With disabled watchdog we could observe that the device was
constantly going into ath_isr() interrupt handler and was returning
early after the ATH_OP_HW_RESET flag test, without clearing any
interrupts. Even though ath9k_queue_reset() calls
ath9k_hw_kill_interrupts().

With JTAG we could observe the following race condition:

1) ath9k_queue_reset()
   ...
   -> ath9k_hw_kill_interrupts()
   -> set_bit(ATH_OP_HW_RESET, &common->op_flags);
   ...
   <- returns

      2) ath9k_tasklet()
         ...
         -> ath9k_hw_resume_interrupts()
         ...
         <- returns

                 3) loops around:
                    ...
                    handle_int()
                    -> ath_isr()
                       ...
                       -> if (test_bit(ATH_OP_HW_RESET,
                                       &common->op_flags))
                            return IRQ_HANDLED;

                    x) ath_reset_internal():
                       => never reached <=

And in ath_isr() we would typically see the following interrupts /
interrupt causes:

* status: 0x00111030 or 0x00110030
* async_cause: 2 (AR_INTR_MAC_IPQ)
* sync_cause: 0

So the ath9k_tasklet() reenables the ath9k interrupts
through ath9k_hw_resume_interrupts() which ath9k_queue_reset() had just
disabled. And ath_isr() then keeps firing because it returns IRQ_HANDLED
without actually clearing the interrupt.

To fix this IRQ storm also clear/disable the interrupts again when we
are in reset state.

Cc: Sven Eckelmann <sven@narfation.org>
Cc: Simon Wunderlich <sw@simonwunderlich.de>
Cc: Linus Lüssing <linus.luessing@c0d3.blue>
Fixes: 872b5d814f99 ("ath9k: do not access hardware on IRQs during reset")
Signed-off-by: Linus Lüssing <ll@simonwunderlich.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210914192515.9273-3-linus.luessing@c0d3.blue
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 5739c1dbf166..af367696fd92 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -533,8 +533,10 @@ irqreturn_t ath_isr(int irq, void *dev)
 	ath9k_debug_sync_cause(sc, sync_cause);
 	status &= ah->imask;	/* discard unasked-for bits */
 
-	if (test_bit(ATH_OP_HW_RESET, &common->op_flags))
+	if (test_bit(ATH_OP_HW_RESET, &common->op_flags)) {
+		ath9k_hw_kill_interrupts(sc->sc_ah);
 		return IRQ_HANDLED;
+	}
 
 	/*
 	 * If there are no status bits set, then this interrupt was not

From 1b2d422a261b8dcf6168e2ac1fd5bd872f8d6aa9 Mon Sep 17 00:00:00 2001
From: Vincent Donnefort <vincent.donnefort@arm.com>
Date: Wed, 8 Sep 2021 15:05:22 +0100
Subject: [PATCH 1453/1750] PM: EM: Fix inefficient states detection

[ Upstream commit aa1a43262ad5df010768f69530fa179ff81651d3 ]

Currently, a debug message is printed if an inefficient state is detected
in the Energy Model. Unfortunately, it won't detect if the first state is
inefficient or if two successive states are. Fix this behavior.

Fixes: 27871f7a8a34 (PM: Introduce an Energy Model management framework)
Signed-off-by: Vincent Donnefort <vincent.donnefort@arm.com>
Reviewed-by: Quentin Perret <qperret@google.com>
Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/power/energy_model.c | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
index be381eb6116a..119b929dcff0 100644
--- a/kernel/power/energy_model.c
+++ b/kernel/power/energy_model.c
@@ -94,8 +94,7 @@ static void em_debug_remove_pd(struct device *dev) {}
 static int em_create_perf_table(struct device *dev, struct em_perf_domain *pd,
 				int nr_states, struct em_data_callback *cb)
 {
-	unsigned long opp_eff, prev_opp_eff = ULONG_MAX;
-	unsigned long power, freq, prev_freq = 0;
+	unsigned long power, freq, prev_freq = 0, prev_cost = ULONG_MAX;
 	struct em_perf_state *table;
 	int i, ret;
 	u64 fmax;
@@ -140,27 +139,21 @@ static int em_create_perf_table(struct device *dev, struct em_perf_domain *pd,
 
 		table[i].power = power;
 		table[i].frequency = prev_freq = freq;
-
-		/*
-		 * The hertz/watts efficiency ratio should decrease as the
-		 * frequency grows on sane platforms. But this isn't always
-		 * true in practice so warn the user if a higher OPP is more
-		 * power efficient than a lower one.
-		 */
-		opp_eff = freq / power;
-		if (opp_eff >= prev_opp_eff)
-			dev_dbg(dev, "EM: hertz/watts ratio non-monotonically decreasing: em_perf_state %d >= em_perf_state%d\n",
-					i, i - 1);
-		prev_opp_eff = opp_eff;
 	}
 
 	/* Compute the cost of each performance state. */
 	fmax = (u64) table[nr_states - 1].frequency;
-	for (i = 0; i < nr_states; i++) {
+	for (i = nr_states - 1; i >= 0; i--) {
 		unsigned long power_res = em_scale_power(table[i].power);
 
 		table[i].cost = div64_u64(fmax * power_res,
 					  table[i].frequency);
+		if (table[i].cost >= prev_cost) {
+			dev_dbg(dev, "EM: OPP:%lu is inefficient\n",
+				table[i].frequency);
+		} else {
+			prev_cost = table[i].cost;
+		}
 	}
 
 	pd->table = table;

From 68803253822c7f5b94bb23363a2a7621fa8e2ae9 Mon Sep 17 00:00:00 2001
From: Yazen Ghannam <yazen.ghannam@amd.com>
Date: Tue, 5 Oct 2021 15:44:19 +0000
Subject: [PATCH 1454/1750] EDAC/amd64: Handle three rank interleaving mode

[ Upstream commit 9f4873fb6af7966de8fcbd95c36b61351c1c4b1f ]

AMD Rome systems and later support interleaving between three identical
ranks within a channel.

Check for this mode by counting the number of enabled chip selects and
comparing their masks. If there are exactly three enabled chip selects
and their masks are identical, then three rank interleaving is enabled.

The size of a rank is determined from its mask value. However, three
rank interleaving doesn't follow the method of swapping an interleave
bit with the most significant bit. Rather, the interleave bit is flipped
and the most significant bit remains the same. There is only a single
interleave bit in this case.

Account for this when determining the chip select size by keeping the
most significant bit at its original value and ignoring any zero bits.
This will return a full bitmask in [MSB:1].

Fixes: e53a3b267fb0 ("EDAC/amd64: Find Chip Select memory size using Address Mask")
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20211005154419.2060504-1-yazen.ghannam@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/amd64_edac.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index b36d5879b91e..f5635dfa9acf 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -786,12 +786,14 @@ static void debug_dump_dramcfg_low(struct amd64_pvt *pvt, u32 dclr, int chan)
 #define CS_ODD_PRIMARY		BIT(1)
 #define CS_EVEN_SECONDARY	BIT(2)
 #define CS_ODD_SECONDARY	BIT(3)
+#define CS_3R_INTERLEAVE	BIT(4)
 
 #define CS_EVEN			(CS_EVEN_PRIMARY | CS_EVEN_SECONDARY)
 #define CS_ODD			(CS_ODD_PRIMARY | CS_ODD_SECONDARY)
 
 static int f17_get_cs_mode(int dimm, u8 ctrl, struct amd64_pvt *pvt)
 {
+	u8 base, count = 0;
 	int cs_mode = 0;
 
 	if (csrow_enabled(2 * dimm, ctrl, pvt))
@@ -804,6 +806,20 @@ static int f17_get_cs_mode(int dimm, u8 ctrl, struct amd64_pvt *pvt)
 	if (csrow_sec_enabled(2 * dimm + 1, ctrl, pvt))
 		cs_mode |= CS_ODD_SECONDARY;
 
+	/*
+	 * 3 Rank inteleaving support.
+	 * There should be only three bases enabled and their two masks should
+	 * be equal.
+	 */
+	for_each_chip_select(base, ctrl, pvt)
+		count += csrow_enabled(base, ctrl, pvt);
+
+	if (count == 3 &&
+	    pvt->csels[ctrl].csmasks[0] == pvt->csels[ctrl].csmasks[1]) {
+		edac_dbg(1, "3R interleaving in use.\n");
+		cs_mode |= CS_3R_INTERLEAVE;
+	}
+
 	return cs_mode;
 }
 
@@ -1612,10 +1628,14 @@ static int f17_addr_mask_to_cs_size(struct amd64_pvt *pvt, u8 umc,
 	 *
 	 * The MSB is the number of bits in the full mask because BIT[0] is
 	 * always 0.
+	 *
+	 * In the special 3 Rank interleaving case, a single bit is flipped
+	 * without swapping with the most significant bit. This can be handled
+	 * by keeping the MSB where it is and ignoring the single zero bit.
 	 */
 	msb = fls(addr_mask_orig) - 1;
 	weight = hweight_long(addr_mask_orig);
-	num_zero_bits = msb - weight;
+	num_zero_bits = msb - weight - !!(cs_mode & CS_3R_INTERLEAVE);
 
 	/* Take the number of zero bits off from the top of the mask. */
 	addr_mask_deinterleaved = GENMASK_ULL(msb - num_zero_bits, 1);

From af756be29c825f267e7a8870f9179d9c35c09eb8 Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Tue, 28 Sep 2021 10:40:21 +0200
Subject: [PATCH 1455/1750] rcu: Always inline
 rcu_dynticks_task*_{enter,exit}()

[ Upstream commit 7663ad9a5dbcc27f3090e6bfd192c7e59222709f ]

RCU managed to grow a few noinstr violations:

  vmlinux.o: warning: objtool: rcu_dynticks_eqs_enter()+0x0: call to rcu_dynticks_task_trace_enter() leaves .noinstr.text section
  vmlinux.o: warning: objtool: rcu_dynticks_eqs_exit()+0xe: call to rcu_dynticks_task_trace_exit() leaves .noinstr.text section

Fix them by adding __always_inline to the relevant trivial functions.

Also replace the noinstr with __always_inline for the existing
rcu_dynticks_task_*() functions since noinstr would force noinline
them, even when empty, which seems silly.

Fixes: 7d0c9c50c5a1 ("rcu-tasks: Avoid IPIing userspace/idle tasks if kernel is so built")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree_plugin.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index c5091aeaa37b..6ed153f226b3 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -2573,7 +2573,7 @@ static void rcu_bind_gp_kthread(void)
 }
 
 /* Record the current task on dyntick-idle entry. */
-static void noinstr rcu_dynticks_task_enter(void)
+static __always_inline void rcu_dynticks_task_enter(void)
 {
 #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL)
 	WRITE_ONCE(current->rcu_tasks_idle_cpu, smp_processor_id());
@@ -2581,7 +2581,7 @@ static void noinstr rcu_dynticks_task_enter(void)
 }
 
 /* Record no current task on dyntick-idle exit. */
-static void noinstr rcu_dynticks_task_exit(void)
+static __always_inline void rcu_dynticks_task_exit(void)
 {
 #if defined(CONFIG_TASKS_RCU) && defined(CONFIG_NO_HZ_FULL)
 	WRITE_ONCE(current->rcu_tasks_idle_cpu, -1);
@@ -2589,7 +2589,7 @@ static void noinstr rcu_dynticks_task_exit(void)
 }
 
 /* Turn on heavyweight RCU tasks trace readers on idle/user entry. */
-static void rcu_dynticks_task_trace_enter(void)
+static __always_inline void rcu_dynticks_task_trace_enter(void)
 {
 #ifdef CONFIG_TASKS_TRACE_RCU
 	if (IS_ENABLED(CONFIG_TASKS_TRACE_RCU_READ_MB))
@@ -2598,7 +2598,7 @@ static void rcu_dynticks_task_trace_enter(void)
 }
 
 /* Turn off heavyweight RCU tasks trace readers on idle/user exit. */
-static void rcu_dynticks_task_trace_exit(void)
+static __always_inline void rcu_dynticks_task_trace_exit(void)
 {
 #ifdef CONFIG_TASKS_TRACE_RCU
 	if (IS_ENABLED(CONFIG_TASKS_TRACE_RCU_READ_MB))

From 740a794e01c5f75b22044a06bfd16183baf2c352 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Sat, 25 Sep 2021 22:40:26 +0200
Subject: [PATCH 1456/1750] netfilter: nft_dynset: relax superfluous check on
 set updates

[ Upstream commit 7b1394892de8d95748d05e3ee41e85edb4abbfa1 ]

Relax this condition to make add and update commands idempotent for sets
with no timeout. The eval function already checks if the set element
timeout is available and updates it if the update command is used.

Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nft_dynset.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 5c84a968dae2..58904bee1a0d 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -141,17 +141,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
 		return -EBUSY;
 
 	priv->op = ntohl(nla_get_be32(tb[NFTA_DYNSET_OP]));
-	switch (priv->op) {
-	case NFT_DYNSET_OP_ADD:
-	case NFT_DYNSET_OP_DELETE:
-		break;
-	case NFT_DYNSET_OP_UPDATE:
-		if (!(set->flags & NFT_SET_TIMEOUT))
-			return -EOPNOTSUPP;
-		break;
-	default:
+	if (priv->op > NFT_DYNSET_OP_DELETE)
 		return -EOPNOTSUPP;
-	}
 
 	timeout = 0;
 	if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {

From 1fe4b244198201d4a6c23b1b5c23cab11a11c665 Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Sun, 22 Aug 2021 11:48:03 +0200
Subject: [PATCH 1457/1750] media: dvb-frontends: mn88443x: Handle errors of
 clk_prepare_enable()

[ Upstream commit 69a10678e2fba3d182e78ea041f2d1b1a6058764 ]

mn88443x_cmn_power_on() did not handle possible errors of
clk_prepare_enable() and always finished successfully so that its caller
mn88443x_probe() did not care about failed preparing/enabling of clocks
as well.

Add missed error handling in both mn88443x_cmn_power_on() and
mn88443x_probe(). This required to change the return value of the former
from "void" to "int".

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 0f408ce8941f ("media: dvb-frontends: add Socionext MN88443x ISDB-S/T demodulator driver")
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/dvb-frontends/mn88443x.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c
index e4528784f847..fff212c0bf3b 100644
--- a/drivers/media/dvb-frontends/mn88443x.c
+++ b/drivers/media/dvb-frontends/mn88443x.c
@@ -204,11 +204,18 @@ struct mn88443x_priv {
 	struct regmap *regmap_t;
 };
 
-static void mn88443x_cmn_power_on(struct mn88443x_priv *chip)
+static int mn88443x_cmn_power_on(struct mn88443x_priv *chip)
 {
+	struct device *dev = &chip->client_s->dev;
 	struct regmap *r_t = chip->regmap_t;
+	int ret;
 
-	clk_prepare_enable(chip->mclk);
+	ret = clk_prepare_enable(chip->mclk);
+	if (ret) {
+		dev_err(dev, "Failed to prepare and enable mclk: %d\n",
+			ret);
+		return ret;
+	}
 
 	gpiod_set_value_cansleep(chip->reset_gpio, 1);
 	usleep_range(100, 1000);
@@ -222,6 +229,8 @@ static void mn88443x_cmn_power_on(struct mn88443x_priv *chip)
 	} else {
 		regmap_write(r_t, HIZSET3, 0x8f);
 	}
+
+	return 0;
 }
 
 static void mn88443x_cmn_power_off(struct mn88443x_priv *chip)
@@ -738,7 +747,10 @@ static int mn88443x_probe(struct i2c_client *client,
 	chip->fe.demodulator_priv = chip;
 	i2c_set_clientdata(client, chip);
 
-	mn88443x_cmn_power_on(chip);
+	ret = mn88443x_cmn_power_on(chip);
+	if (ret)
+		goto err_i2c_t;
+
 	mn88443x_s_sleep(chip);
 	mn88443x_t_sleep(chip);
 

From d99fdd13a75a01e441a69534188ab48cb1d20fdc Mon Sep 17 00:00:00 2001
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Date: Tue, 28 Sep 2021 12:44:29 +0100
Subject: [PATCH 1458/1750] crypto: qat - detect PFVF collision after ACK

[ Upstream commit 9b768e8a3909ac1ab39ed44a3933716da7761a6f ]

Detect a PFVF collision between the local and the remote function by
checking if the message on the PFVF CSR has been overwritten.
This is done after the remote function confirms that the message has
been received, by clearing the interrupt bit, or the maximum number of
attempts (ADF_IOV_MSG_ACK_MAX_RETRY) to check the CSR has been exceeded.

Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Co-developed-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index e829c6aaf16f..a5bd77d0f048 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -150,6 +150,13 @@ static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
 		val = ADF_CSR_RD(pmisc_bar_addr, pf2vf_offset);
 	} while ((val & int_bit) && (count++ < ADF_IOV_MSG_ACK_MAX_RETRY));
 
+	if (val != msg) {
+		dev_dbg(&GET_DEV(accel_dev),
+			"Collision - PFVF CSR overwritten by remote function\n");
+		ret = -EIO;
+		goto out;
+	}
+
 	if (val & int_bit) {
 		dev_dbg(&GET_DEV(accel_dev), "ACK not received from remote\n");
 		val &= ~int_bit;

From 8d98683fa6df1edd86183250958a55899f4a689c Mon Sep 17 00:00:00 2001
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Date: Tue, 28 Sep 2021 12:44:30 +0100
Subject: [PATCH 1459/1750] crypto: qat - disregard spurious PFVF interrupts

[ Upstream commit 18fcba469ba5359c1de7e3fb16f7b9e8cd1b8e02 ]

Upon receiving a PFVF message, check if the interrupt bit is set in the
message. If it is not, that means that the interrupt was probably
triggered by a collision. In this case, disregard the message and
re-enable the interrupts.

Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 6 ++++++
 drivers/crypto/qat/qat_common/adf_vf_isr.c    | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index a5bd77d0f048..d7ca222f0df1 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -205,6 +205,11 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
 
 	/* Read message from the VF */
 	msg = ADF_CSR_RD(pmisc_addr, hw_data->get_pf2vf_offset(vf_nr));
+	if (!(msg & ADF_VF2PF_INT)) {
+		dev_info(&GET_DEV(accel_dev),
+			 "Spurious VF2PF interrupt, msg %X. Ignored\n", msg);
+		goto out;
+	}
 
 	/* To ACK, clear the VF2PFINT bit */
 	msg &= ~ADF_VF2PF_INT;
@@ -288,6 +293,7 @@ void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
 	if (resp && adf_iov_putmsg(accel_dev, resp, vf_nr))
 		dev_err(&GET_DEV(accel_dev), "Failed to send response to VF\n");
 
+out:
 	/* re-enable interrupt on PF from this VF */
 	adf_enable_vf2pf_interrupts(accel_dev, (1 << vf_nr));
 	return;
diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
index 024401ec9d1a..fa1b3a94155c 100644
--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
@@ -79,6 +79,11 @@ static void adf_pf2vf_bh_handler(void *data)
 
 	/* Read the message from PF */
 	msg = ADF_CSR_RD(pmisc_bar_addr, hw_data->get_pf2vf_offset(0));
+	if (!(msg & ADF_PF2VF_INT)) {
+		dev_info(&GET_DEV(accel_dev),
+			 "Spurious PF2VF interrupt, msg %X. Ignored\n", msg);
+		goto out;
+	}
 
 	if (!(msg & ADF_PF2VF_MSGORIGIN_SYSTEM))
 		/* Ignore legacy non-system (non-kernel) PF2VF messages */
@@ -127,6 +132,7 @@ static void adf_pf2vf_bh_handler(void *data)
 	msg &= ~ADF_PF2VF_INT;
 	ADF_CSR_WR(pmisc_bar_addr, hw_data->get_pf2vf_offset(0), msg);
 
+out:
 	/* Re-enable PF2VF interrupts */
 	adf_enable_pf2vf_interrupts(accel_dev);
 	return;

From 6a1610014181b13126c6e9a1a3b964675251d7d1 Mon Sep 17 00:00:00 2001
From: Markus Schneider-Pargmann <msp@baylibre.com>
Date: Thu, 30 Sep 2021 21:12:42 +0200
Subject: [PATCH 1460/1750] hwrng: mtk - Force runtime pm ops for sleep ops

[ Upstream commit b6f5f0c8f72d348b2d07b20d7b680ef13a7ffe98 ]

Currently mtk_rng_runtime_suspend/resume is called for both runtime pm
and system sleep operations.

This is wrong as these should only be runtime ops as the name already
suggests. Currently freezing the system will lead to a call to
mtk_rng_runtime_suspend even if the device currently isn't active. This
leads to a clock warning because it is disabled/unprepared although it
isn't enabled/prepared currently.

This patch fixes this by only setting the runtime pm ops and forces to
call the runtime pm ops from the system sleep ops as well if active but
not otherwise.

Fixes: 81d2b34508c6 ("hwrng: mtk - add runtime PM support")
Signed-off-by: Markus Schneider-Pargmann <msp@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/hw_random/mtk-rng.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c
index 8ad7b515a51b..6c00ea008555 100644
--- a/drivers/char/hw_random/mtk-rng.c
+++ b/drivers/char/hw_random/mtk-rng.c
@@ -166,8 +166,13 @@ static int mtk_rng_runtime_resume(struct device *dev)
 	return mtk_rng_init(&priv->rng);
 }
 
-static UNIVERSAL_DEV_PM_OPS(mtk_rng_pm_ops, mtk_rng_runtime_suspend,
-			    mtk_rng_runtime_resume, NULL);
+static const struct dev_pm_ops mtk_rng_pm_ops = {
+	SET_RUNTIME_PM_OPS(mtk_rng_runtime_suspend,
+			   mtk_rng_runtime_resume, NULL)
+	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+				pm_runtime_force_resume)
+};
+
 #define MTK_RNG_PM_OPS (&mtk_rng_pm_ops)
 #else	/* CONFIG_PM */
 #define MTK_RNG_PM_OPS NULL

From 508faf8721aea6b67a9e7d77b772f8649080c4f4 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 6 Oct 2021 10:35:42 +0300
Subject: [PATCH 1461/1750] b43legacy: fix a lower bounds test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c1c8380b0320ab757e60ed90efc8b1992a943256 ]

The problem is that "channel" is an unsigned int, when it's less 5 the
value of "channel - 5" is not a negative number as one would expect but
is very high positive value instead.

This means that "start" becomes a very high positive value.  The result
of that is that we never enter the "for (i = start; i <= end; i++) {"
loop.  Instead of storing the result from b43legacy_radio_aci_detect()
it just uses zero.

Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Büsch <m@bues.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211006073542.GD8404@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c
index 06891b4f837b..fdf78c10a05c 100644
--- a/drivers/net/wireless/broadcom/b43legacy/radio.c
+++ b/drivers/net/wireless/broadcom/b43legacy/radio.c
@@ -283,7 +283,7 @@ u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev)
 			    & 0x7FFF);
 	b43legacy_set_all_gains(dev, 3, 8, 1);
 
-	start = (channel - 5 > 0) ? channel - 5 : 1;
+	start = (channel > 5) ? channel - 5 : 1;
 	end = (channel + 5 < 14) ? channel + 5 : 13;
 
 	for (i = start; i <= end; i++) {

From 9e4f708df65e7da7a1a5677ee2f8205bef89e36b Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 6 Oct 2021 10:36:22 +0300
Subject: [PATCH 1462/1750] b43: fix a lower bounds test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 9b793db5fca44d01f72d3564a168171acf7c4076 ]

The problem is that "channel" is an unsigned int, when it's less 5 the
value of "channel - 5" is not a negative number as one would expect but
is very high positive value instead.

This means that "start" becomes a very high positive value.  The result
of that is that we never enter the "for (i = start; i <= end; i++) {"
loop.  Instead of storing the result from b43legacy_radio_aci_detect()
it just uses zero.

Fixes: ef1a628d83fc ("b43: Implement dynamic PHY API")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Büsch <m@bues.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211006073621.GE8404@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/b43/phy_g.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c
index d5a1a5c58236..ac72ca39e409 100644
--- a/drivers/net/wireless/broadcom/b43/phy_g.c
+++ b/drivers/net/wireless/broadcom/b43/phy_g.c
@@ -2297,7 +2297,7 @@ static u8 b43_gphy_aci_scan(struct b43_wldev *dev)
 	b43_phy_mask(dev, B43_PHY_G_CRS, 0x7FFF);
 	b43_set_all_gains(dev, 3, 8, 1);
 
-	start = (channel - 5 > 0) ? channel - 5 : 1;
+	start = (channel > 5) ? channel - 5 : 1;
 	end = (channel + 5 < 14) ? channel + 5 : 13;
 
 	for (i = start; i <= end; i++) {

From a9fbeb5bbc4699f13b7d10bcfce4b842eb9a9e37 Mon Sep 17 00:00:00 2001
From: John Fraker <jfraker@google.com>
Date: Mon, 11 Oct 2021 08:36:47 -0700
Subject: [PATCH 1463/1750] gve: Recover from queue stall due to missed IRQ

[ Upstream commit 87a7f321bb6a45e54b7d6c90d032ee5636a6ad97 ]

Don't always reset the driver on a TX timeout. Attempt to
recover by kicking the queue in case an IRQ was missed.

Fixes: 9e5f7d26a4c08 ("gve: Add workqueue and reset support")
Signed-off-by: John Fraker <jfraker@google.com>
Signed-off-by: David Awogbemila <awogbemila@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve.h        |  4 +-
 drivers/net/ethernet/google/gve/gve_adminq.h |  1 +
 drivers/net/ethernet/google/gve/gve_main.c   | 48 +++++++++++++++++++-
 3 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h
index cfb174624d4e..5c9a4d4362c7 100644
--- a/drivers/net/ethernet/google/gve/gve.h
+++ b/drivers/net/ethernet/google/gve/gve.h
@@ -28,7 +28,7 @@
 #define GVE_MIN_MSIX 3
 
 /* Numbers of gve tx/rx stats in stats report. */
-#define GVE_TX_STATS_REPORT_NUM	5
+#define GVE_TX_STATS_REPORT_NUM	6
 #define GVE_RX_STATS_REPORT_NUM	2
 
 /* Interval to schedule a stats report update, 20000ms. */
@@ -147,7 +147,9 @@ struct gve_tx_ring {
 	u32 q_num ____cacheline_aligned; /* queue idx */
 	u32 stop_queue; /* count of queue stops */
 	u32 wake_queue; /* count of queue wakes */
+	u32 queue_timeout; /* count of queue timeouts */
 	u32 ntfy_id; /* notification block index */
+	u32 last_kick_msec; /* Last time the queue was kicked */
 	dma_addr_t bus; /* dma address of the descr ring */
 	dma_addr_t q_resources_bus; /* dma address of the queue resources */
 	struct u64_stats_sync statss; /* sync stats for 32bit archs */
diff --git a/drivers/net/ethernet/google/gve/gve_adminq.h b/drivers/net/ethernet/google/gve/gve_adminq.h
index 015796a20118..8dbc2c03fbbd 100644
--- a/drivers/net/ethernet/google/gve/gve_adminq.h
+++ b/drivers/net/ethernet/google/gve/gve_adminq.h
@@ -212,6 +212,7 @@ enum gve_stat_names {
 	TX_LAST_COMPLETION_PROCESSED	= 5,
 	RX_NEXT_EXPECTED_SEQUENCE	= 6,
 	RX_BUFFERS_POSTED		= 7,
+	TX_TIMEOUT_CNT			= 8,
 	// stats from NIC
 	RX_QUEUE_DROP_CNT		= 65,
 	RX_NO_BUFFERS_POSTED		= 66,
diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index fd52218f4884..3e96b2a11c5b 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -23,6 +23,9 @@
 #define GVE_VERSION		"1.0.0"
 #define GVE_VERSION_PREFIX	"GVE-"
 
+// Minimum amount of time between queue kicks in msec (10 seconds)
+#define MIN_TX_TIMEOUT_GAP (1000 * 10)
+
 const char gve_version_str[] = GVE_VERSION;
 static const char gve_version_prefix[] = GVE_VERSION_PREFIX;
 
@@ -943,9 +946,47 @@ static void gve_turnup(struct gve_priv *priv)
 
 static void gve_tx_timeout(struct net_device *dev, unsigned int txqueue)
 {
-	struct gve_priv *priv = netdev_priv(dev);
+	struct gve_notify_block *block;
+	struct gve_tx_ring *tx = NULL;
+	struct gve_priv *priv;
+	u32 last_nic_done;
+	u32 current_time;
+	u32 ntfy_idx;
 
+	netdev_info(dev, "Timeout on tx queue, %d", txqueue);
+	priv = netdev_priv(dev);
+	if (txqueue > priv->tx_cfg.num_queues)
+		goto reset;
+
+	ntfy_idx = gve_tx_idx_to_ntfy(priv, txqueue);
+	if (ntfy_idx > priv->num_ntfy_blks)
+		goto reset;
+
+	block = &priv->ntfy_blocks[ntfy_idx];
+	tx = block->tx;
+
+	current_time = jiffies_to_msecs(jiffies);
+	if (tx->last_kick_msec + MIN_TX_TIMEOUT_GAP > current_time)
+		goto reset;
+
+	/* Check to see if there are missed completions, which will allow us to
+	 * kick the queue.
+	 */
+	last_nic_done = gve_tx_load_event_counter(priv, tx);
+	if (last_nic_done - tx->done) {
+		netdev_info(dev, "Kicking queue %d", txqueue);
+		iowrite32be(GVE_IRQ_MASK, gve_irq_doorbell(priv, block));
+		napi_schedule(&block->napi);
+		tx->last_kick_msec = current_time;
+		goto out;
+	} // Else reset.
+
+reset:
 	gve_schedule_reset(priv);
+
+out:
+	if (tx)
+		tx->queue_timeout++;
 	priv->tx_timeo_cnt++;
 }
 
@@ -1028,6 +1069,11 @@ void gve_handle_report_stats(struct gve_priv *priv)
 				.value = cpu_to_be64(priv->tx[idx].done),
 				.queue_id = cpu_to_be32(idx),
 			};
+			stats[stats_idx++] = (struct stats) {
+				.stat_name = cpu_to_be32(TX_TIMEOUT_CNT),
+				.value = cpu_to_be64(priv->tx[idx].queue_timeout),
+				.queue_id = cpu_to_be32(idx),
+			};
 		}
 	}
 	/* rx stats */

From 2fd26ec36ef0d6b78509a2953ad1e03c93ea7caf Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Tue, 21 Sep 2021 14:00:25 +0300
Subject: [PATCH 1464/1750] mmc: sdhci-omap: Fix NULL pointer exception if
 regulator is not configured

[ Upstream commit 8e0e7bd38b1ec7f9e5d18725ad41828be4e09859 ]

If sdhci-omap is configured for an unused device instance and the device
is not set as disabled, we can get a NULL pointer dereference:

Unable to handle kernel NULL pointer dereference at virtual address
00000045
...
(regulator_set_voltage) from [<c07d7008>] (mmc_regulator_set_ocr+0x44/0xd0)
(mmc_regulator_set_ocr) from [<c07e2d80>] (sdhci_set_ios+0xa4/0x490)
(sdhci_set_ios) from [<c07ea690>] (sdhci_omap_set_ios+0x124/0x160)
(sdhci_omap_set_ios) from [<c07c8e94>] (mmc_power_up.part.0+0x3c/0x154)
(mmc_power_up.part.0) from [<c07c9d20>] (mmc_start_host+0x88/0x9c)
(mmc_start_host) from [<c07cad34>] (mmc_add_host+0x58/0x7c)
(mmc_add_host) from [<c07e2574>] (__sdhci_add_host+0xf0/0x22c)
(__sdhci_add_host) from [<c07eaf68>] (sdhci_omap_probe+0x318/0x72c)
(sdhci_omap_probe) from [<c06a39d8>] (platform_probe+0x58/0xb8)

AFAIK we are not seeing this with the devices configured in the mainline
kernel but this can cause issues for folks bringing up their boards.

Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210921110029.21944-2-tony@atomide.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-omap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index 7893fd3599b6..8a669f57f14b 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -682,7 +682,8 @@ static void sdhci_omap_set_power(struct sdhci_host *host, unsigned char mode,
 {
 	struct mmc_host *mmc = host->mmc;
 
-	mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+	if (!IS_ERR(mmc->supply.vmmc))
+		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
 }
 
 static int sdhci_omap_enable_dma(struct sdhci_host *host)

From 72de92d33f83737688c5979915c5570fa597b979 Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Tue, 21 Sep 2021 14:00:26 +0300
Subject: [PATCH 1465/1750] mmc: sdhci-omap: Fix context restore

[ Upstream commit d806e334d0390502cd2a820ad33d65d7f9bba618 ]

We need to restore context in a specified order with HCTL set in two
phases. This is similar to what omap_hsmmc_context_restore() is doing.
Otherwise SDIO can stop working on resume.

And for PM runtime and SDIO cards, we need to also save SYSCTL, IE and
ISE.

This should not be a problem currently, and these patches can be applied
whenever suitable.

Fixes: ee0f309263a6 ("mmc: sdhci-omap: Add Support for Suspend/Resume")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210921110029.21944-3-tony@atomide.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci-omap.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c
index 8a669f57f14b..53c362bb2866 100644
--- a/drivers/mmc/host/sdhci-omap.c
+++ b/drivers/mmc/host/sdhci-omap.c
@@ -62,6 +62,8 @@
 #define SDHCI_OMAP_IE		0x234
 #define INT_CC_EN		BIT(0)
 
+#define SDHCI_OMAP_ISE		0x238
+
 #define SDHCI_OMAP_AC12		0x23c
 #define AC12_V1V8_SIGEN		BIT(19)
 #define AC12_SCLK_SEL		BIT(23)
@@ -113,6 +115,8 @@ struct sdhci_omap_host {
 	u32			hctl;
 	u32			sysctl;
 	u32			capa;
+	u32			ie;
+	u32			ise;
 };
 
 static void sdhci_omap_start_clock(struct sdhci_omap_host *omap_host);
@@ -1246,14 +1250,23 @@ static void sdhci_omap_context_save(struct sdhci_omap_host *omap_host)
 {
 	omap_host->con = sdhci_omap_readl(omap_host, SDHCI_OMAP_CON);
 	omap_host->hctl = sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL);
+	omap_host->sysctl = sdhci_omap_readl(omap_host, SDHCI_OMAP_SYSCTL);
 	omap_host->capa = sdhci_omap_readl(omap_host, SDHCI_OMAP_CAPA);
+	omap_host->ie = sdhci_omap_readl(omap_host, SDHCI_OMAP_IE);
+	omap_host->ise = sdhci_omap_readl(omap_host, SDHCI_OMAP_ISE);
 }
 
+/* Order matters here, HCTL must be restored in two phases */
 static void sdhci_omap_context_restore(struct sdhci_omap_host *omap_host)
 {
-	sdhci_omap_writel(omap_host, SDHCI_OMAP_CON, omap_host->con);
 	sdhci_omap_writel(omap_host, SDHCI_OMAP_HCTL, omap_host->hctl);
 	sdhci_omap_writel(omap_host, SDHCI_OMAP_CAPA, omap_host->capa);
+	sdhci_omap_writel(omap_host, SDHCI_OMAP_HCTL, omap_host->hctl);
+
+	sdhci_omap_writel(omap_host, SDHCI_OMAP_SYSCTL, omap_host->sysctl);
+	sdhci_omap_writel(omap_host, SDHCI_OMAP_CON, omap_host->con);
+	sdhci_omap_writel(omap_host, SDHCI_OMAP_IE, omap_host->ie);
+	sdhci_omap_writel(omap_host, SDHCI_OMAP_ISE, omap_host->ise);
 }
 
 static int __maybe_unused sdhci_omap_suspend(struct device *dev)

From 4756d7fbaf8c0c8465e7a3ca0243be1fb68ca6b6 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Mon, 27 Sep 2021 11:44:47 +0200
Subject: [PATCH 1466/1750] memstick: avoid out-of-range warning

[ Upstream commit 4853396f03c3019eccf5cd113e464231e9ddf0b3 ]

clang-14 complains about a sanity check that always passes when the
page size is 64KB or larger:

drivers/memstick/core/ms_block.c:1739:21: error: result of comparison of constant 65536 with expression of type 'unsigned short' is always false [-Werror,-Wtautological-constant-out-of-range-compare]
        if (msb->page_size > PAGE_SIZE) {
            ~~~~~~~~~~~~~~ ^ ~~~~~~~~~

This is fine, it will still work on all architectures, so just shut
up that warning with a cast.

Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210927094520.696665-1-arnd@kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/core/ms_block.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index 8004dd64d09a..bc1f484f50f1 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1727,7 +1727,7 @@ static int msb_init_card(struct memstick_dev *card)
 	msb->pages_in_block = boot_block->attr.block_size * 2;
 	msb->block_size = msb->page_size * msb->pages_in_block;
 
-	if (msb->page_size > PAGE_SIZE) {
+	if ((size_t)msb->page_size > PAGE_SIZE) {
 		/* this isn't supported by linux at all, anyway*/
 		dbg("device page %d size isn't supported", msb->page_size);
 		return -EINVAL;

From 41fe79cf115626c45d3e65f7ce890966acf2c4ec Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 11 Oct 2021 15:39:12 +0300
Subject: [PATCH 1467/1750] memstick: jmb38x_ms: use appropriate free function
 in jmb38x_ms_alloc_host()

[ Upstream commit beae4a6258e64af609ad5995cc6b6056eb0d898e ]

The "msh" pointer is device managed, meaning that memstick_alloc_host()
calls device_initialize() on it.  That means that it can't be free
using kfree() but must instead be freed with memstick_free_host().
Otherwise it leads to a tiny memory leak of device resources.

Fixes: 60fdd931d577 ("memstick: add support for JMicron jmb38x MemoryStick host controller")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211011123912.GD15188@kili
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memstick/host/jmb38x_ms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
index e83c3ada9389..9e8cccbd2817 100644
--- a/drivers/memstick/host/jmb38x_ms.c
+++ b/drivers/memstick/host/jmb38x_ms.c
@@ -882,7 +882,7 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt)
 
 	iounmap(host->addr);
 err_out_free:
-	kfree(msh);
+	memstick_free_host(msh);
 	return NULL;
 }
 

From e29352f162db6c06dc259d05ad538d350c82cd0b Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Mon, 11 Oct 2021 14:12:35 +0200
Subject: [PATCH 1468/1750] net, neigh: Fix NTF_EXT_LEARNED in combination with
 NTF_USE

[ Upstream commit e4400bbf5b15750e1b59bf4722d18d99be60c69f ]

The NTF_EXT_LEARNED neigh flag is usually propagated back to user space
upon dump of the neighbor table. However, when used in combination with
NTF_USE flag this is not the case despite exempting the entry from the
garbage collector. This results in inconsistent state since entries are
typically marked in neigh->flags with NTF_EXT_LEARNED, but here they are
not. Fix it by propagating the creation flag to ___neigh_create().

Before fix:

  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use extern_learn
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a REACHABLE
  [...]

After fix:

  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use extern_learn
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a extern_learn REACHABLE
  [...]

Fixes: 9ce33e46531d ("neighbour: support for NTF_EXT_LEARNED flag")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Roopa Prabhu <roopa@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/neighbour.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index c452ebf20939..01e243a578e9 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -380,7 +380,7 @@ EXPORT_SYMBOL(neigh_ifdown);
 
 static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 				     struct net_device *dev,
-				     bool exempt_from_gc)
+				     u8 flags, bool exempt_from_gc)
 {
 	struct neighbour *n = NULL;
 	unsigned long now = jiffies;
@@ -413,6 +413,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl,
 	n->updated	  = n->used = now;
 	n->nud_state	  = NUD_NONE;
 	n->output	  = neigh_blackhole;
+	n->flags	  = flags;
 	seqlock_init(&n->hh.hh_lock);
 	n->parms	  = neigh_parms_clone(&tbl->parms);
 	timer_setup(&n->timer, neigh_timer_handler, 0);
@@ -576,19 +577,18 @@ struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
 }
 EXPORT_SYMBOL(neigh_lookup_nodev);
 
-static struct neighbour *___neigh_create(struct neigh_table *tbl,
-					 const void *pkey,
-					 struct net_device *dev,
-					 bool exempt_from_gc, bool want_ref)
+static struct neighbour *
+___neigh_create(struct neigh_table *tbl, const void *pkey,
+		struct net_device *dev, u8 flags,
+		bool exempt_from_gc, bool want_ref)
 {
-	struct neighbour *n1, *rc, *n = neigh_alloc(tbl, dev, exempt_from_gc);
-	u32 hash_val;
-	unsigned int key_len = tbl->key_len;
-	int error;
+	u32 hash_val, key_len = tbl->key_len;
+	struct neighbour *n1, *rc, *n;
 	struct neigh_hash_table *nht;
+	int error;
 
+	n = neigh_alloc(tbl, dev, flags, exempt_from_gc);
 	trace_neigh_create(tbl, dev, pkey, n, exempt_from_gc);
-
 	if (!n) {
 		rc = ERR_PTR(-ENOBUFS);
 		goto out;
@@ -675,7 +675,7 @@ static struct neighbour *___neigh_create(struct neigh_table *tbl,
 struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey,
 				 struct net_device *dev, bool want_ref)
 {
-	return ___neigh_create(tbl, pkey, dev, false, want_ref);
+	return ___neigh_create(tbl, pkey, dev, 0, false, want_ref);
 }
 EXPORT_SYMBOL(__neigh_create);
 
@@ -1950,7 +1950,9 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 		exempt_from_gc = ndm->ndm_state & NUD_PERMANENT ||
 				 ndm->ndm_flags & NTF_EXT_LEARNED;
-		neigh = ___neigh_create(tbl, dst, dev, exempt_from_gc, true);
+		neigh = ___neigh_create(tbl, dst, dev,
+					ndm->ndm_flags & NTF_EXT_LEARNED,
+					exempt_from_gc, true);
 		if (IS_ERR(neigh)) {
 			err = PTR_ERR(neigh);
 			goto out;

From fbc80c83f1185bbbb92a899335894064e1ca69ab Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 12 Oct 2021 19:27:58 +0800
Subject: [PATCH 1469/1750] hwmon: Fix possible memleak in
 __hwmon_device_register()

[ Upstream commit ada61aa0b1184a8fda1a89a340c7d6cc4e59aee5 ]

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff888102740438 (size 8):
  comm "27", pid 859, jiffies 4295031351 (age 143.992s)
  hex dump (first 8 bytes):
    68 77 6d 6f 6e 30 00 00                          hwmon0..
  backtrace:
    [<00000000544b5996>] __kmalloc_track_caller+0x1a6/0x300
    [<00000000df0d62b9>] kvasprintf+0xad/0x140
    [<00000000d3d2a3da>] kvasprintf_const+0x62/0x190
    [<000000005f8f0f29>] kobject_set_name_vargs+0x56/0x140
    [<00000000b739e4b9>] dev_set_name+0xb0/0xe0
    [<0000000095b69c25>] __hwmon_device_register+0xf19/0x1e50 [hwmon]
    [<00000000a7e65b52>] hwmon_device_register_with_info+0xcb/0x110 [hwmon]
    [<000000006f181e86>] devm_hwmon_device_register_with_info+0x85/0x100 [hwmon]
    [<0000000081bdc567>] tmp421_probe+0x2d2/0x465 [tmp421]
    [<00000000502cc3f8>] i2c_device_probe+0x4e1/0xbb0
    [<00000000f90bda3b>] really_probe+0x285/0xc30
    [<000000007eac7b77>] __driver_probe_device+0x35f/0x4f0
    [<000000004953d43d>] driver_probe_device+0x4f/0x140
    [<000000002ada2d41>] __device_attach_driver+0x24c/0x330
    [<00000000b3977977>] bus_for_each_drv+0x15d/0x1e0
    [<000000005bf2a8e3>] __device_attach+0x267/0x410

When device_register() returns an error, the name allocated in
dev_set_name() will be leaked, the put_device() should be used
instead of calling hwmon_dev_release() to give up the device
reference, then the name will be freed in kobject_cleanup().

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: bab2243ce189 ("hwmon: Introduce hwmon_device_register_with_groups")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20211012112758.2681084-1-yangyingliang@huawei.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/hwmon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index 6c684058bfdf..e5a83f749267 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -760,8 +760,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
 	dev_set_drvdata(hdev, drvdata);
 	dev_set_name(hdev, HWMON_ID_FORMAT, id);
 	err = device_register(hdev);
-	if (err)
-		goto free_hwmon;
+	if (err) {
+		put_device(hdev);
+		goto ida_remove;
+	}
 
 	INIT_LIST_HEAD(&hwdev->tzdata);
 

From 786976b25ae0aaa58597a364e81e3ba3328f1211 Mon Sep 17 00:00:00 2001
From: Zev Weiss <zev@bewilderbeest.net>
Date: Tue, 28 Sep 2021 02:22:38 -0700
Subject: [PATCH 1470/1750] hwmon: (pmbus/lm25066) Let compiler determine outer
 dimension of lm25066_coeff

[ Upstream commit b7931a7b0e0df4d2a25fedd895ad32c746b77bc1 ]

Maintaining this manually is error prone (there are currently only
five chips supported, not six); gcc can do it for us automatically.

Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
Fixes: 666c14906b49 ("hwmon: (pmbus/lm25066) Drop support for LM25063")
Link: https://lore.kernel.org/r/20210928092242.30036-5-zev@bewilderbeest.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/lm25066.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hwmon/pmbus/lm25066.c b/drivers/hwmon/pmbus/lm25066.c
index d14f923b3740..17199a1104c7 100644
--- a/drivers/hwmon/pmbus/lm25066.c
+++ b/drivers/hwmon/pmbus/lm25066.c
@@ -51,7 +51,7 @@ struct __coeff {
 #define PSC_CURRENT_IN_L	(PSC_NUM_CLASSES)
 #define PSC_POWER_L		(PSC_NUM_CLASSES + 1)
 
-static struct __coeff lm25066_coeff[6][PSC_NUM_CLASSES + 2] = {
+static struct __coeff lm25066_coeff[][PSC_NUM_CLASSES + 2] = {
 	[lm25056] = {
 		[PSC_VOLTAGE_IN] = {
 			.m = 16296,

From e1ee11473a88d65d3abc26df976312d199139dd2 Mon Sep 17 00:00:00 2001
From: Sven Eckelmann <seckelmann@datto.com>
Date: Tue, 11 Jun 2019 19:21:31 +0200
Subject: [PATCH 1471/1750] ath10k: fix max antenna gain unit

[ Upstream commit 0a491167fe0cf9f26062462de2a8688b96125d48 ]

Most of the txpower for the ath10k firmware is stored as twicepower (0.5 dB
steps). This isn't the case for max_antenna_gain - which is still expected
by the firmware as dB.

The firmware is converting it from dB to the internal (twicepower)
representation when it calculates the limits of a channel. This can be seen
in tpc_stats when configuring "12" as max_antenna_gain. Instead of the
expected 12 (6 dB), the tpc_stats shows 24 (12 dB).

Tested on QCA9888 and IPQ4019 with firmware 10.4-3.5.3-00057.

Fixes: 02256930d9b8 ("ath10k: use proper tx power unit")
Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20190611172131.6064-1-sven@narfation.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 6 +++---
 drivers/net/wireless/ath/ath10k/wmi.h | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 90dc48f66fbf..c42977918e04 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -1041,7 +1041,7 @@ static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id)
 	arg.channel.min_power = 0;
 	arg.channel.max_power = channel->max_power * 2;
 	arg.channel.max_reg_power = channel->max_reg_power * 2;
-	arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
+	arg.channel.max_antenna_gain = channel->max_antenna_gain;
 
 	reinit_completion(&ar->vdev_setup_done);
 	reinit_completion(&ar->vdev_delete_done);
@@ -1487,7 +1487,7 @@ static int ath10k_vdev_start_restart(struct ath10k_vif *arvif,
 	arg.channel.min_power = 0;
 	arg.channel.max_power = chandef->chan->max_power * 2;
 	arg.channel.max_reg_power = chandef->chan->max_reg_power * 2;
-	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain * 2;
+	arg.channel.max_antenna_gain = chandef->chan->max_antenna_gain;
 
 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
 		arg.ssid = arvif->u.ap.ssid;
@@ -3258,7 +3258,7 @@ static int ath10k_update_channel_list(struct ath10k *ar)
 			ch->min_power = 0;
 			ch->max_power = channel->max_power * 2;
 			ch->max_reg_power = channel->max_reg_power * 2;
-			ch->max_antenna_gain = channel->max_antenna_gain * 2;
+			ch->max_antenna_gain = channel->max_antenna_gain;
 			ch->reg_class_id = 0; /* FIXME */
 
 			/* FIXME: why use only legacy modes, why not any
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 66ecf09068c1..e244b7038e60 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -2066,7 +2066,9 @@ struct wmi_channel {
 	union {
 		__le32 reginfo1;
 		struct {
+			/* note: power unit is 1 dBm */
 			u8 antenna_max;
+			/* note: power unit is 0.5 dBm */
 			u8 max_tx_power;
 		} __packed;
 	} __packed;
@@ -2086,6 +2088,7 @@ struct wmi_channel_arg {
 	u32 min_power;
 	u32 max_power;
 	u32 max_reg_power;
+	/* note: power unit is 1 dBm */
 	u32 max_antenna_gain;
 	u32 reg_class_id;
 	enum wmi_phy_mode mode;

From c85c6fadbef0a3eab41540ea628fa8fe8928c820 Mon Sep 17 00:00:00 2001
From: Zhang Qiao <zhangqiao22@huawei.com>
Date: Wed, 15 Sep 2021 14:40:30 +0800
Subject: [PATCH 1472/1750] kernel/sched: Fix sched_fork() access an invalid
 sched_task_group

[ Upstream commit 4ef0c5c6b5ba1f38f0ea1cedad0cad722f00c14a ]

There is a small race between copy_process() and sched_fork()
where child->sched_task_group point to an already freed pointer.

	parent doing fork()      | someone moving the parent
				 | to another cgroup
  -------------------------------+-------------------------------
  copy_process()
      + dup_task_struct()<1>
				  parent move to another cgroup,
				  and free the old cgroup. <2>
      + sched_fork()
	+ __set_task_cpu()<3>
	+ task_fork_fair()
	  + sched_slice()<4>

In the worst case, this bug can lead to "use-after-free" and
cause panic as shown above:

  (1) parent copy its sched_task_group to child at <1>;

  (2) someone move the parent to another cgroup and free the old
      cgroup at <2>;

  (3) the sched_task_group and cfs_rq that belong to the old cgroup
      will be accessed at <3> and <4>, which cause a panic:

  [] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
  [] PGD 8000001fa0a86067 P4D 8000001fa0a86067 PUD 2029955067 PMD 0
  [] Oops: 0000 [#1] SMP PTI
  [] CPU: 7 PID: 648398 Comm: ebizzy Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0.x86_64+ #1
  [] RIP: 0010:sched_slice+0x84/0xc0

  [] Call Trace:
  []  task_fork_fair+0x81/0x120
  []  sched_fork+0x132/0x240
  []  copy_process.part.5+0x675/0x20e0
  []  ? __handle_mm_fault+0x63f/0x690
  []  _do_fork+0xcd/0x3b0
  []  do_syscall_64+0x5d/0x1d0
  []  entry_SYSCALL_64_after_hwframe+0x65/0xca
  [] RIP: 0033:0x7f04418cd7e1

Between cgroup_can_fork() and cgroup_post_fork(), the cgroup
membership and thus sched_task_group can't change. So update child's
sched_task_group at sched_post_fork() and move task_fork() and
__set_task_cpu() (where accees the sched_task_group) from sched_fork()
to sched_post_fork().

Fixes: 8323f26ce342 ("sched: Fix race in task_group")
Signed-off-by: Zhang Qiao <zhangqiao22@huawei.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lkml.kernel.org/r/20210915064030.2231-1-zhangqiao22@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sched/task.h |  3 ++-
 kernel/fork.c              |  2 +-
 kernel/sched/core.c        | 43 +++++++++++++++++++-------------------
 3 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
index 85fb2f34c59b..24cacb1ca654 100644
--- a/include/linux/sched/task.h
+++ b/include/linux/sched/task.h
@@ -55,7 +55,8 @@ extern asmlinkage void schedule_tail(struct task_struct *prev);
 extern void init_idle(struct task_struct *idle, int cpu);
 
 extern int sched_fork(unsigned long clone_flags, struct task_struct *p);
-extern void sched_post_fork(struct task_struct *p);
+extern void sched_post_fork(struct task_struct *p,
+			    struct kernel_clone_args *kargs);
 extern void sched_dead(struct task_struct *p);
 
 void __noreturn do_task_dead(void);
diff --git a/kernel/fork.c b/kernel/fork.c
index 3f96400a0ac6..773b44be81f9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2310,7 +2310,7 @@ static __latent_entropy struct task_struct *copy_process(
 	write_unlock_irq(&tasklist_lock);
 
 	proc_fork_connector(p);
-	sched_post_fork(p);
+	sched_post_fork(p, args);
 	cgroup_post_fork(p, args);
 	perf_event_fork(p);
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index e4551d1736fa..bc8ff11e6024 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3231,8 +3231,6 @@ static inline void init_schedstats(void) {}
  */
 int sched_fork(unsigned long clone_flags, struct task_struct *p)
 {
-	unsigned long flags;
-
 	__sched_fork(clone_flags, p);
 	/*
 	 * We mark the process as NEW here. This guarantees that
@@ -3278,24 +3276,6 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
 
 	init_entity_runnable_average(&p->se);
 
-	/*
-	 * The child is not yet in the pid-hash so no cgroup attach races,
-	 * and the cgroup is pinned to this child due to cgroup_fork()
-	 * is ran before sched_fork().
-	 *
-	 * Silence PROVE_RCU.
-	 */
-	raw_spin_lock_irqsave(&p->pi_lock, flags);
-	rseq_migrate(p);
-	/*
-	 * We're setting the CPU for the first time, we don't migrate,
-	 * so use __set_task_cpu().
-	 */
-	__set_task_cpu(p, smp_processor_id());
-	if (p->sched_class->task_fork)
-		p->sched_class->task_fork(p);
-	raw_spin_unlock_irqrestore(&p->pi_lock, flags);
-
 #ifdef CONFIG_SCHED_INFO
 	if (likely(sched_info_on()))
 		memset(&p->sched_info, 0, sizeof(p->sched_info));
@@ -3311,8 +3291,29 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p)
 	return 0;
 }
 
-void sched_post_fork(struct task_struct *p)
+void sched_post_fork(struct task_struct *p, struct kernel_clone_args *kargs)
 {
+	unsigned long flags;
+#ifdef CONFIG_CGROUP_SCHED
+	struct task_group *tg;
+#endif
+
+	raw_spin_lock_irqsave(&p->pi_lock, flags);
+#ifdef CONFIG_CGROUP_SCHED
+	tg = container_of(kargs->cset->subsys[cpu_cgrp_id],
+			  struct task_group, css);
+	p->sched_task_group = autogroup_task_group(p, tg);
+#endif
+	rseq_migrate(p);
+	/*
+	 * We're setting the CPU for the first time, we don't migrate,
+	 * so use __set_task_cpu().
+	 */
+	__set_task_cpu(p, smp_processor_id());
+	if (p->sched_class->task_fork)
+		p->sched_class->task_fork(p);
+	raw_spin_unlock_irqrestore(&p->pi_lock, flags);
+
 	uclamp_post_fork(p);
 }
 

From a342cb4772f44915b1e6688b101a41c01f9e71aa Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Thu, 14 Oct 2021 06:41:26 -0700
Subject: [PATCH 1473/1750] tcp: switch orphan_count to bare per-cpu counters

[ Upstream commit 19757cebf0c5016a1f36f7fe9810a9f0b33c0832 ]

Use of percpu_counter structure to track count of orphaned
sockets is causing problems on modern hosts with 256 cpus
or more.

Stefan Bach reported a serious spinlock contention in real workloads,
that I was able to reproduce with a netfilter rule dropping
incoming FIN packets.

    53.56%  server  [kernel.kallsyms]      [k] queued_spin_lock_slowpath
            |
            ---queued_spin_lock_slowpath
               |
                --53.51%--_raw_spin_lock_irqsave
                          |
                           --53.51%--__percpu_counter_sum
                                     tcp_check_oom
                                     |
                                     |--39.03%--__tcp_close
                                     |          tcp_close
                                     |          inet_release
                                     |          inet6_release
                                     |          sock_close
                                     |          __fput
                                     |          ____fput
                                     |          task_work_run
                                     |          exit_to_usermode_loop
                                     |          do_syscall_64
                                     |          entry_SYSCALL_64_after_hwframe
                                     |          __GI___libc_close
                                     |
                                      --14.48%--tcp_out_of_resources
                                                tcp_write_timeout
                                                tcp_retransmit_timer
                                                tcp_write_timer_handler
                                                tcp_write_timer
                                                call_timer_fn
                                                expire_timers
                                                __run_timers
                                                run_timer_softirq
                                                __softirqentry_text_start

As explained in commit cf86a086a180 ("net/dst: use a smaller percpu_counter
batch for dst entries accounting"), default batch size is too big
for the default value of tcp_max_orphans (262144).

But even if we reduce batch sizes, there would still be cases
where the estimated count of orphans is beyond the limit,
and where tcp_too_many_orphans() has to call the expensive
percpu_counter_sum_positive().

One solution is to use plain per-cpu counters, and have
a timer to periodically refresh this cache.

Updating this cache every 100ms seems about right, tcp pressure
state is not radically changing over shorter periods.

percpu_counter was nice 15 years ago while hosts had less
than 16 cpus, not anymore by current standards.

v2: Fix the build issue for CONFIG_CRYPTO_DEV_CHELSIO_TLS=m,
    reported by kernel test robot <lkp@intel.com>
    Remove unused socket argument from tcp_too_many_orphans()

Fixes: dd24c00191d5 ("net: Use a percpu_counter for orphan_count")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Stefan Bach <sfb@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../chelsio/inline_crypto/chtls/chtls_cm.c    |  2 +-
 .../chelsio/inline_crypto/chtls/chtls_cm.h    |  2 +-
 include/net/inet_connection_sock.h            |  2 +-
 include/net/sock.h                            |  2 +-
 include/net/tcp.h                             | 17 ++-------
 net/dccp/dccp.h                               |  2 +-
 net/dccp/proto.c                              | 14 ++-----
 net/ipv4/inet_connection_sock.c               |  4 +-
 net/ipv4/inet_hashtables.c                    |  2 +-
 net/ipv4/proc.c                               |  2 +-
 net/ipv4/tcp.c                                | 38 ++++++++++++++++---
 11 files changed, 49 insertions(+), 38 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
index a262c949ed76..d6b6ebb3f1ec 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
@@ -870,7 +870,7 @@ static void do_abort_syn_rcv(struct sock *child, struct sock *parent)
 		 * created only after 3 way handshake is done.
 		 */
 		sock_orphan(child);
-		percpu_counter_inc((child)->sk_prot->orphan_count);
+		INC_ORPHAN_COUNT(child);
 		chtls_release_resources(child);
 		chtls_conn_done(child);
 	} else {
diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
index b1161bdeda4d..f61ca657601c 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
@@ -95,7 +95,7 @@ struct deferred_skb_cb {
 #define WSCALE_OK(tp) ((tp)->rx_opt.wscale_ok)
 #define TSTAMP_OK(tp) ((tp)->rx_opt.tstamp_ok)
 #define SACK_OK(tp) ((tp)->rx_opt.sack_ok)
-#define INC_ORPHAN_COUNT(sk) percpu_counter_inc((sk)->sk_prot->orphan_count)
+#define INC_ORPHAN_COUNT(sk) this_cpu_inc(*(sk)->sk_prot->orphan_count)
 
 /* TLS SKB */
 #define skb_ulp_tls_inline(skb)      (ULP_SKB_CB(skb)->ulp.tls.ofld)
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index aa92af3dd444..0b1864a82d4a 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -291,7 +291,7 @@ static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk)
 {
 	/* The below has to be done to allow calling inet_csk_destroy_sock */
 	sock_set_flag(sk, SOCK_DEAD);
-	percpu_counter_inc(sk->sk_prot->orphan_count);
+	this_cpu_inc(*sk->sk_prot->orphan_count);
 }
 
 void inet_csk_destroy_sock(struct sock *sk);
diff --git a/include/net/sock.h b/include/net/sock.h
index cdca984f3630..6270d1d9436b 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1214,7 +1214,7 @@ struct proto {
 	unsigned int		useroffset;	/* Usercopy region offset */
 	unsigned int		usersize;	/* Usercopy region size */
 
-	struct percpu_counter	*orphan_count;
+	unsigned int __percpu	*orphan_count;
 
 	struct request_sock_ops	*rsk_prot;
 	struct timewait_sock_ops *twsk_prot;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index eff611da5780..334b8d1b5442 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -48,7 +48,9 @@
 
 extern struct inet_hashinfo tcp_hashinfo;
 
-extern struct percpu_counter tcp_orphan_count;
+DECLARE_PER_CPU(unsigned int, tcp_orphan_count);
+int tcp_orphan_count_sum(void);
+
 void tcp_time_wait(struct sock *sk, int state, int timeo);
 
 #define MAX_TCP_HEADER	L1_CACHE_ALIGN(128 + MAX_HEADER)
@@ -290,19 +292,6 @@ static inline bool tcp_out_of_memory(struct sock *sk)
 
 void sk_forced_mem_schedule(struct sock *sk, int size);
 
-static inline bool tcp_too_many_orphans(struct sock *sk, int shift)
-{
-	struct percpu_counter *ocp = sk->sk_prot->orphan_count;
-	int orphans = percpu_counter_read_positive(ocp);
-
-	if (orphans << shift > sysctl_tcp_max_orphans) {
-		orphans = percpu_counter_sum_positive(ocp);
-		if (orphans << shift > sysctl_tcp_max_orphans)
-			return true;
-	}
-	return false;
-}
-
 bool tcp_check_oom(struct sock *sk, int shift);
 
 
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index c5c1d2b8045e..5183e627468d 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -48,7 +48,7 @@ extern bool dccp_debug;
 
 extern struct inet_hashinfo dccp_hashinfo;
 
-extern struct percpu_counter dccp_orphan_count;
+DECLARE_PER_CPU(unsigned int, dccp_orphan_count);
 
 void dccp_time_wait(struct sock *sk, int state, int timeo);
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 6d705d90c614..548cf0135647 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -42,8 +42,8 @@ DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
 
 EXPORT_SYMBOL_GPL(dccp_statistics);
 
-struct percpu_counter dccp_orphan_count;
-EXPORT_SYMBOL_GPL(dccp_orphan_count);
+DEFINE_PER_CPU(unsigned int, dccp_orphan_count);
+EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count);
 
 struct inet_hashinfo dccp_hashinfo;
 EXPORT_SYMBOL_GPL(dccp_hashinfo);
@@ -1055,7 +1055,7 @@ void dccp_close(struct sock *sk, long timeout)
 	bh_lock_sock(sk);
 	WARN_ON(sock_owned_by_user(sk));
 
-	percpu_counter_inc(sk->sk_prot->orphan_count);
+	this_cpu_inc(dccp_orphan_count);
 
 	/* Have we already been destroyed by a softirq or backlog? */
 	if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
@@ -1115,13 +1115,10 @@ static int __init dccp_init(void)
 
 	BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
 		     sizeof_field(struct sk_buff, cb));
-	rc = percpu_counter_init(&dccp_orphan_count, 0, GFP_KERNEL);
-	if (rc)
-		goto out_fail;
 	inet_hashinfo_init(&dccp_hashinfo);
 	rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
 	if (rc)
-		goto out_free_percpu;
+		goto out_fail;
 	rc = -ENOBUFS;
 	dccp_hashinfo.bind_bucket_cachep =
 		kmem_cache_create("dccp_bind_bucket",
@@ -1226,8 +1223,6 @@ static int __init dccp_init(void)
 	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
 out_free_hashinfo2:
 	inet_hashinfo2_free_mod(&dccp_hashinfo);
-out_free_percpu:
-	percpu_counter_destroy(&dccp_orphan_count);
 out_fail:
 	dccp_hashinfo.bhash = NULL;
 	dccp_hashinfo.ehash = NULL;
@@ -1250,7 +1245,6 @@ static void __exit dccp_fini(void)
 	dccp_ackvec_exit();
 	dccp_sysctl_exit();
 	inet_hashinfo2_free_mod(&dccp_hashinfo);
-	percpu_counter_destroy(&dccp_orphan_count);
 }
 
 module_init(dccp_init);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 1dfa561e8f98..addd595bb3fe 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -892,7 +892,7 @@ void inet_csk_destroy_sock(struct sock *sk)
 
 	sk_refcnt_debug_release(sk);
 
-	percpu_counter_dec(sk->sk_prot->orphan_count);
+	this_cpu_dec(*sk->sk_prot->orphan_count);
 
 	sock_put(sk);
 }
@@ -951,7 +951,7 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req,
 
 	sock_orphan(child);
 
-	percpu_counter_inc(sk->sk_prot->orphan_count);
+	this_cpu_inc(*sk->sk_prot->orphan_count);
 
 	if (sk->sk_protocol == IPPROTO_TCP && tcp_rsk(req)->tfo_listener) {
 		BUG_ON(rcu_access_pointer(tcp_sk(child)->fastopen_rsk) != req);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index f3fd5c911ed0..e093847c334d 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -598,7 +598,7 @@ bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, bool *found_dup_sk)
 	if (ok) {
 		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
 	} else {
-		percpu_counter_inc(sk->sk_prot->orphan_count);
+		this_cpu_inc(*sk->sk_prot->orphan_count);
 		inet_sk_set_state(sk, TCP_CLOSE);
 		sock_set_flag(sk, SOCK_DEAD);
 		inet_csk_destroy_sock(sk);
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 8d5e1695b9aa..80d13d8f982d 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -53,7 +53,7 @@ static int sockstat_seq_show(struct seq_file *seq, void *v)
 	struct net *net = seq->private;
 	int orphans, sockets;
 
-	orphans = percpu_counter_sum_positive(&tcp_orphan_count);
+	orphans = tcp_orphan_count_sum();
 	sockets = proto_sockets_allocated_sum_positive(&tcp_prot);
 
 	socket_seq_show(seq);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 54230852e5f9..65eb0a523e3f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -280,8 +280,8 @@
 #include <asm/ioctls.h>
 #include <net/busy_poll.h>
 
-struct percpu_counter tcp_orphan_count;
-EXPORT_SYMBOL_GPL(tcp_orphan_count);
+DEFINE_PER_CPU(unsigned int, tcp_orphan_count);
+EXPORT_PER_CPU_SYMBOL_GPL(tcp_orphan_count);
 
 long sysctl_tcp_mem[3] __read_mostly;
 EXPORT_SYMBOL(sysctl_tcp_mem);
@@ -2394,11 +2394,36 @@ void tcp_shutdown(struct sock *sk, int how)
 }
 EXPORT_SYMBOL(tcp_shutdown);
 
+int tcp_orphan_count_sum(void)
+{
+	int i, total = 0;
+
+	for_each_possible_cpu(i)
+		total += per_cpu(tcp_orphan_count, i);
+
+	return max(total, 0);
+}
+
+static int tcp_orphan_cache;
+static struct timer_list tcp_orphan_timer;
+#define TCP_ORPHAN_TIMER_PERIOD msecs_to_jiffies(100)
+
+static void tcp_orphan_update(struct timer_list *unused)
+{
+	WRITE_ONCE(tcp_orphan_cache, tcp_orphan_count_sum());
+	mod_timer(&tcp_orphan_timer, jiffies + TCP_ORPHAN_TIMER_PERIOD);
+}
+
+static bool tcp_too_many_orphans(int shift)
+{
+	return READ_ONCE(tcp_orphan_cache) << shift > sysctl_tcp_max_orphans;
+}
+
 bool tcp_check_oom(struct sock *sk, int shift)
 {
 	bool too_many_orphans, out_of_socket_memory;
 
-	too_many_orphans = tcp_too_many_orphans(sk, shift);
+	too_many_orphans = tcp_too_many_orphans(shift);
 	out_of_socket_memory = tcp_out_of_memory(sk);
 
 	if (too_many_orphans)
@@ -2508,7 +2533,7 @@ void tcp_close(struct sock *sk, long timeout)
 	/* remove backlog if any, without releasing ownership. */
 	__release_sock(sk);
 
-	percpu_counter_inc(sk->sk_prot->orphan_count);
+	this_cpu_inc(tcp_orphan_count);
 
 	/* Have we already been destroyed by a softirq or backlog? */
 	if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
@@ -4145,7 +4170,10 @@ void __init tcp_init(void)
 		     sizeof_field(struct sk_buff, cb));
 
 	percpu_counter_init(&tcp_sockets_allocated, 0, GFP_KERNEL);
-	percpu_counter_init(&tcp_orphan_count, 0, GFP_KERNEL);
+
+	timer_setup(&tcp_orphan_timer, tcp_orphan_update, TIMER_DEFERRABLE);
+	mod_timer(&tcp_orphan_timer, jiffies + TCP_ORPHAN_TIMER_PERIOD);
+
 	inet_hashinfo_init(&tcp_hashinfo);
 	inet_hashinfo2_init(&tcp_hashinfo, "tcp_listen_portaddr_hash",
 			    thash_entries, 21,  /* one slot per 2 MB*/

From 3424931fa39e90b9beeb309380189ff1d1b18cb5 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 4 Oct 2021 13:38:06 +0300
Subject: [PATCH 1474/1750] drm/msm: potential error pointer dereference in
 init()

[ Upstream commit b6816441a14bbe356ba8590de79cfea2de6a085c ]

The msm_iommu_new() returns error pointers on failure so check for that
to avoid an Oops.

Fixes: ccac7ce373c1 ("drm/msm: Refactor address space initialization")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20211004103806.GD25015@kili
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
index c8217f4858a1..b4a2e8eb35dd 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
@@ -846,6 +846,10 @@ static int _dpu_kms_mmu_init(struct dpu_kms *dpu_kms)
 		return 0;
 
 	mmu = msm_iommu_new(dpu_kms->dev->dev, domain);
+	if (IS_ERR(mmu)) {
+		iommu_domain_free(domain);
+		return PTR_ERR(mmu);
+	}
 	aspace = msm_gem_address_space_create(mmu, "dpu1",
 		0x1000, 0x100000000 - 0x1000);
 

From 14d24157722701de86fe45f917f6cdb62bd242f3 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 13 Oct 2021 11:13:15 +0300
Subject: [PATCH 1475/1750] drm/msm: uninitialized variable in msm_gem_import()

[ Upstream commit 2203bd0e5c12ffc53ffdd4fbd7b12d6ba27e0424 ]

The msm_gem_new_impl() function cleans up after itself so there is no
need to call drm_gem_object_put().  Conceptually, it does not make sense
to call a kref_put() function until after the reference counting has
been initialized which happens immediately after this call in the
drm_gem_(private_)object_init() functions.

In the msm_gem_import() function the "obj" pointer is uninitialized, so
it will lead to a crash.

Fixes: 05b849111c07 ("drm/msm: prime support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211013081315.GG6010@kili
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_gem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 04be4cfcccc1..819567e40565 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -1061,7 +1061,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev,
 
 	ret = msm_gem_new_impl(dev, size, flags, &obj);
 	if (ret)
-		goto fail;
+		return ERR_PTR(ret);
 
 	msm_obj = to_msm_bo(obj);
 
@@ -1149,7 +1149,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
 
 	ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj);
 	if (ret)
-		goto fail;
+		return ERR_PTR(ret);
 
 	drm_gem_private_object_init(dev, obj, size);
 

From daf15fa1fd997749e881aedd9f03f73a11240e82 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Fri, 15 Oct 2021 06:37:39 -0700
Subject: [PATCH 1476/1750] net: stream: don't purge sk_error_queue in
 sk_stream_kill_queues()

[ Upstream commit 24bcbe1cc69fa52dc4f7b5b2456678ed464724d8 ]

sk_stream_kill_queues() can be called on close when there are
still outstanding skbs to transmit. Those skbs may try to queue
notifications to the error queue (e.g. timestamps).
If sk_stream_kill_queues() purges the queue without taking
its lock the queue may get corrupted, and skbs leaked.

This shows up as a warning about an rmem leak:

WARNING: CPU: 24 PID: 0 at net/ipv4/af_inet.c:154 inet_sock_destruct+0x...

The leak is always a multiple of 0x300 bytes (the value is in
%rax on my builds, so RAX: 0000000000000300). 0x300 is truesize of
an empty sk_buff. Indeed if we dump the socket state at the time
of the warning the sk_error_queue is often (but not always)
corrupted. The ->next pointer points back at the list head,
but not the ->prev pointer. Indeed we can find the leaked skb
by scanning the kernel memory for something that looks like
an skb with ->sk = socket in question, and ->truesize = 0x300.
The contents of ->cb[] of the skb confirms the suspicion that
it is indeed a timestamp notification (as generated in
__skb_complete_tx_timestamp()).

Removing purging of sk_error_queue should be okay, since
inet_sock_destruct() does it again once all socket refs
are gone. Eric suggests this may cause sockets that go
thru disconnect() to maintain notifications from the
previous incarnations of the socket, but that should be
okay since the race was there anyway, and disconnect()
is not exactly dependable.

Thanks to Jonathan Lemon and Omar Sandoval for help at various
stages of tracing the issue.

Fixes: cb9eff097831 ("net: new user space API for time stamping of incoming and outgoing packets")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/stream.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/net/core/stream.c b/net/core/stream.c
index 4f1d4aa5fb38..a166a32b411f 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -195,9 +195,6 @@ void sk_stream_kill_queues(struct sock *sk)
 	/* First the read buffer. */
 	__skb_queue_purge(&sk->sk_receive_queue);
 
-	/* Next, the error queue. */
-	__skb_queue_purge(&sk->sk_error_queue);
-
 	/* Next, the write queue. */
 	WARN_ON(!skb_queue_empty(&sk->sk_write_queue));
 

From 7c1c7ac9d13addf1fbe27c86d2838ebeb0e3b0be Mon Sep 17 00:00:00 2001
From: Sean Young <sean@mess.org>
Date: Wed, 13 Oct 2021 09:14:10 +0100
Subject: [PATCH 1477/1750] media: ir_toy: assignment to be16 should be of
 correct type

[ Upstream commit febfe985fc2ea052a363f6525ff624b8efd5273c ]

commit f0c15b360fb6 ("media: ir_toy: prevent device from hanging during
transmit") removed a cpu_to_be16() cast, which causes a sparse warning.

Fixes: f0c15b360fb6 ("media: ir_toy: prevent device from hanging during transmit")
Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/rc/ir_toy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c
index 48d52baec1a1..1aa7989e756c 100644
--- a/drivers/media/rc/ir_toy.c
+++ b/drivers/media/rc/ir_toy.c
@@ -310,7 +310,7 @@ static int irtoy_tx(struct rc_dev *rc, uint *txbuf, uint count)
 		buf[i] = cpu_to_be16(v);
 	}
 
-	buf[count] = 0xffff;
+	buf[count] = cpu_to_be16(0xffff);
 
 	irtoy->tx_buf = buf;
 	irtoy->tx_len = size;

From 25c032c585a216b3b713408ee1a5c2f144dd84a0 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 16 Oct 2021 08:21:44 +0200
Subject: [PATCH 1478/1750] mmc: mxs-mmc: disable regulator on error and in the
 remove function

[ Upstream commit ce5f6c2c9b0fcb4094f8e162cfd37fb4294204f7 ]

The 'reg_vmmc' regulator is enabled in the probe. It is never disabled.
Neither in the error handling path of the probe nor in the remove
function.

Register a devm_action to disable it when needed.

Fixes: 4dc5a79f1350 ("mmc: mxs-mmc: enable regulator for mmc slot")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/4aadb3c97835f7b80f00819c3d549e6130384e67.1634365151.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/mxs-mmc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index 4fbbff03137c..2ec3eb651d6b 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -565,6 +565,11 @@ static const struct of_device_id mxs_mmc_dt_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids);
 
+static void mxs_mmc_regulator_disable(void *regulator)
+{
+	regulator_disable(regulator);
+}
+
 static int mxs_mmc_probe(struct platform_device *pdev)
 {
 	const struct of_device_id *of_id =
@@ -606,6 +611,11 @@ static int mxs_mmc_probe(struct platform_device *pdev)
 				"Failed to enable vmmc regulator: %d\n", ret);
 			goto out_mmc_free;
 		}
+
+		ret = devm_add_action_or_reset(&pdev->dev, mxs_mmc_regulator_disable,
+					       reg_vmmc);
+		if (ret)
+			goto out_mmc_free;
 	}
 
 	ssp->clk = devm_clk_get(&pdev->dev, NULL);

From 4187bf331010ae3cfb46de008d4f0d418c03ce08 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Mon, 18 Oct 2021 11:25:37 -0700
Subject: [PATCH 1479/1750] platform/x86: thinkpad_acpi: Fix bitwise vs.
 logical warning

[ Upstream commit fd96e35ea7b95f1e216277805be89d66e4ae962d ]

A new warning in clang points out a use of bitwise OR with boolean
expressions in this driver:

drivers/platform/x86/thinkpad_acpi.c:9061:11: error: use of bitwise '|' with boolean operands [-Werror,-Wbitwise-instead-of-logical]
        else if ((strlencmp(cmd, "level disengaged") == 0) |
                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                                           ||
drivers/platform/x86/thinkpad_acpi.c:9061:11: note: cast one or both operands to int to silence this warning
1 error generated.

This should clearly be a logical OR so change it to fix the warning.

Fixes: fe98a52ce754 ("ACPI: thinkpad-acpi: add sysfs support to fan subdriver")
Link: https://github.com/ClangBuiltLinux/linux/issues/1476
Reported-by: Tor Vic <torvic9@mailbox.org>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/r/20211018182537.2316800-1-nathan@kernel.org
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/platform/x86/thinkpad_acpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 5c2f2e337b57..2a313643e038 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -9097,7 +9097,7 @@ static int fan_write_cmd_level(const char *cmd, int *rc)
 
 	if (strlencmp(cmd, "level auto") == 0)
 		level = TP_EC_FAN_AUTO;
-	else if ((strlencmp(cmd, "level disengaged") == 0) |
+	else if ((strlencmp(cmd, "level disengaged") == 0) ||
 			(strlencmp(cmd, "level full-speed") == 0))
 		level = TP_EC_FAN_FULLSPEED;
 	else if (sscanf(cmd, "level %d", &level) != 1)

From 4d5c7f07c725607188781355fe5fead203658161 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Mon, 21 Jun 2021 23:53:22 +0200
Subject: [PATCH 1480/1750] mt76: mt7615: fix endianness warning in
 mt7615_mac_write_txwi

[ Upstream commit d81bfb41e30c42531536c5d2baa4d275a8309715 ]

Fix the following sparse warning in mt7615_mac_write_txwi routine:
drivers/net/wireless/mediatek/mt76/mt7615/mac.c:758:17:
	warning: incorrect type in assignment
	expected restricted __le32 [usertype]
	got unsigned long

Fixes: 04b8e65922f63 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets")
Fixes: d4bf77bd74930 ("mt76: mt7615: introduce mt7663u support to mt7615_write_txwi")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
index f44f478bb970..424be103093c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
@@ -672,12 +672,15 @@ int mt7615_mac_write_txwi(struct mt7615_dev *dev, __le32 *txwi,
 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
 		txwi[3] |= cpu_to_le32(MT_TXD3_NO_ACK);
 
-	txwi[7] = FIELD_PREP(MT_TXD7_TYPE, fc_type) |
-		  FIELD_PREP(MT_TXD7_SUB_TYPE, fc_stype) |
-		  FIELD_PREP(MT_TXD7_SPE_IDX, 0x18);
-	if (!is_mmio)
-		txwi[8] = FIELD_PREP(MT_TXD8_L_TYPE, fc_type) |
-			  FIELD_PREP(MT_TXD8_L_SUB_TYPE, fc_stype);
+	val = FIELD_PREP(MT_TXD7_TYPE, fc_type) |
+	      FIELD_PREP(MT_TXD7_SUB_TYPE, fc_stype) |
+	      FIELD_PREP(MT_TXD7_SPE_IDX, 0x18);
+	txwi[7] = cpu_to_le32(val);
+	if (!is_mmio) {
+		val = FIELD_PREP(MT_TXD8_L_TYPE, fc_type) |
+		      FIELD_PREP(MT_TXD8_L_SUB_TYPE, fc_stype);
+		txwi[8] = cpu_to_le32(val);
+	}
 
 	return 0;
 }

From 7a8e4effbbbcb04aa02e1d29909b751350b56fb3 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Tue, 22 Jun 2021 09:48:30 +0200
Subject: [PATCH 1481/1750] mt76: mt76x02: fix endianness warnings in
 mt76x02_mac.c

[ Upstream commit c33edef520213feccebc22c9474c685b9fb60611 ]

Fix the following sparse warning in mt76x02_mac_write_txwi and
mt76x02_mac_tx_rate_val routines:
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c:237:19:
	warning: restricted __le16 degrades to intege
	warning: cast from restricted __le16
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c:383:28:
	warning: incorrect type in assignment (different base types)
	expected restricted __le16 [usertype] rate
	got unsigned long

Fixes: db9f11d3433f7 ("mt76: store wcid tx rate info in one u32 reduce locking")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
index da6d3f51f6d4..677082d8659a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
@@ -176,7 +176,7 @@ void mt76x02_mac_wcid_set_drop(struct mt76x02_dev *dev, u8 idx, bool drop)
 		mt76_wr(dev, MT_WCID_DROP(idx), (val & ~bit) | (bit * drop));
 }
 
-static __le16
+static u16
 mt76x02_mac_tx_rate_val(struct mt76x02_dev *dev,
 			const struct ieee80211_tx_rate *rate, u8 *nss_val)
 {
@@ -222,14 +222,14 @@ mt76x02_mac_tx_rate_val(struct mt76x02_dev *dev,
 		rateval |= MT_RXWI_RATE_SGI;
 
 	*nss_val = nss;
-	return cpu_to_le16(rateval);
+	return rateval;
 }
 
 void mt76x02_mac_wcid_set_rate(struct mt76x02_dev *dev, struct mt76_wcid *wcid,
 			       const struct ieee80211_tx_rate *rate)
 {
 	s8 max_txpwr_adj = mt76x02_tx_get_max_txpwr_adj(dev, rate);
-	__le16 rateval;
+	u16 rateval;
 	u32 tx_info;
 	s8 nss;
 
@@ -342,7 +342,7 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
 	struct ieee80211_key_conf *key = info->control.hw_key;
 	u32 wcid_tx_info;
 	u16 rate_ht_mask = FIELD_PREP(MT_RXWI_RATE_PHY, BIT(1) | BIT(2));
-	u16 txwi_flags = 0;
+	u16 txwi_flags = 0, rateval;
 	u8 nss;
 	s8 txpwr_adj, max_txpwr_adj;
 	u8 ccmp_pn[8], nstreams = dev->chainmask & 0xf;
@@ -380,14 +380,15 @@ void mt76x02_mac_write_txwi(struct mt76x02_dev *dev, struct mt76x02_txwi *txwi,
 
 	if (wcid && (rate->idx < 0 || !rate->count)) {
 		wcid_tx_info = wcid->tx_info;
-		txwi->rate = FIELD_GET(MT_WCID_TX_INFO_RATE, wcid_tx_info);
+		rateval = FIELD_GET(MT_WCID_TX_INFO_RATE, wcid_tx_info);
 		max_txpwr_adj = FIELD_GET(MT_WCID_TX_INFO_TXPWR_ADJ,
 					  wcid_tx_info);
 		nss = FIELD_GET(MT_WCID_TX_INFO_NSS, wcid_tx_info);
 	} else {
-		txwi->rate = mt76x02_mac_tx_rate_val(dev, rate, &nss);
+		rateval = mt76x02_mac_tx_rate_val(dev, rate, &nss);
 		max_txpwr_adj = mt76x02_tx_get_max_txpwr_adj(dev, rate);
 	}
+	txwi->rate = cpu_to_le16(rateval);
 
 	txpwr_adj = mt76x02_tx_get_txpwr_adj(dev, dev->txpower_conf,
 					     max_txpwr_adj);

From 116652a3d5dd969ee649133afaef1636bf242b56 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Tue, 14 Sep 2021 18:42:51 +0200
Subject: [PATCH 1482/1750] mt76: mt7915: fix possible infinite loop release
 semaphore

[ Upstream commit e500c9470e26be66eb2bc6de773ae9091149118a ]

Fix possible infinite loop in mt7915_load_patch if
mt7915_mcu_patch_sem_ctrl always returns an error.

Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 7c2d09a64882..c36c7b0e918a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -2648,7 +2648,7 @@ static int mt7915_load_patch(struct mt7915_dev *dev)
 	default:
 		ret = -EAGAIN;
 		dev_err(dev->mt76.dev, "Failed to release patch semaphore\n");
-		goto out;
+		break;
 	}
 	release_firmware(fw);
 

From 1a270dada03552989f5b8619557f96c022263235 Mon Sep 17 00:00:00 2001
From: Shayne Chen <shayne.chen@mediatek.com>
Date: Mon, 18 Oct 2021 16:07:02 +0800
Subject: [PATCH 1483/1750] mt76: mt7915: fix sta_rec_wtbl tag len

[ Upstream commit afa0370f3a3a64af6d368da0bedd72ab2a026cd0 ]

Fix tag len error for sta_rec_wtbl, which causes fw parsing error for
the tags placed behind it.

Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index c36c7b0e918a..63bc4577c5c5 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -667,7 +667,7 @@ mt7915_mcu_alloc_wtbl_req(struct mt7915_dev *dev, struct mt7915_sta *msta,
 	}
 
 	if (sta_hdr)
-		sta_hdr->len = cpu_to_le16(sizeof(hdr));
+		le16_add_cpu(&sta_hdr->len, sizeof(hdr));
 
 	return skb_put_data(nskb, &hdr, sizeof(hdr));
 }

From e27022647529f4d9d313bae8f175bd7ac83f02cf Mon Sep 17 00:00:00 2001
From: Shayne Chen <shayne.chen@mediatek.com>
Date: Mon, 18 Oct 2021 16:07:04 +0800
Subject: [PATCH 1484/1750] mt76: mt7915: fix muar_idx in
 mt7915_mcu_alloc_sta_req()

[ Upstream commit 161cc13912d3c3e8857001988dfba39be842454a ]

For broadcast/multicast wcid, the muar_idx should be 0xe.

Fixes: e57b7901469f ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets")
Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 63bc4577c5c5..7b6e9a5352b3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -631,7 +631,7 @@ mt7915_mcu_alloc_sta_req(struct mt7915_dev *dev, struct mt7915_vif *mvif,
 		.bss_idx = mvif->idx,
 		.wlan_idx_lo = msta ? to_wcid_lo(msta->wcid.idx) : 0,
 		.wlan_idx_hi = msta ? to_wcid_hi(msta->wcid.idx) : 0,
-		.muar_idx = msta ? mvif->omac_idx : 0,
+		.muar_idx = msta && msta->wcid.sta ? mvif->omac_idx : 0xe,
 		.is_tlv_append = 1,
 	};
 	struct sk_buff *skb;

From 4ed5bb3df6c74b982800205ea566605e6ced6339 Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Fri, 15 Oct 2021 12:03:35 +0800
Subject: [PATCH 1485/1750] rsi: stop thread firstly in rsi_91x_init() error
 handling

[ Upstream commit 515e7184bdf0a3ebf1757cc77fb046b4fe282189 ]

When fail to init coex module, free 'common' and 'adapter' directly, but
common->tx_thread which will access 'common' and 'adapter' is running at
the same time. That will trigger the UAF bug.

==================================================================
BUG: KASAN: use-after-free in rsi_tx_scheduler_thread+0x50f/0x520 [rsi_91x]
Read of size 8 at addr ffff8880076dc000 by task Tx-Thread/124777
CPU: 0 PID: 124777 Comm: Tx-Thread Not tainted 5.15.0-rc5+ #19
Call Trace:
 dump_stack_lvl+0xe2/0x152
 print_address_description.constprop.0+0x21/0x140
 ? rsi_tx_scheduler_thread+0x50f/0x520
 kasan_report.cold+0x7f/0x11b
 ? rsi_tx_scheduler_thread+0x50f/0x520
 rsi_tx_scheduler_thread+0x50f/0x520
...

Freed by task 111873:
 kasan_save_stack+0x1b/0x40
 kasan_set_track+0x1c/0x30
 kasan_set_free_info+0x20/0x30
 __kasan_slab_free+0x109/0x140
 kfree+0x117/0x4c0
 rsi_91x_init+0x741/0x8a0 [rsi_91x]
 rsi_probe+0x9f/0x1750 [rsi_usb]

Stop thread before free 'common' and 'adapter' to fix it.

Fixes: 2108df3c4b18 ("rsi: add coex support")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211015040335.1021546-1-william.xuanziyang@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/rsi/rsi_91x_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c
index 0a2f8b4f447b..8c638cfeac52 100644
--- a/drivers/net/wireless/rsi/rsi_91x_main.c
+++ b/drivers/net/wireless/rsi/rsi_91x_main.c
@@ -369,6 +369,7 @@ struct rsi_hw *rsi_91x_init(u16 oper_mode)
 	if (common->coex_mode > 1) {
 		if (rsi_coex_attach(common)) {
 			rsi_dbg(ERR_ZONE, "Failed to init coex module\n");
+			rsi_kill_thread(&common->tx_thread);
 			goto err;
 		}
 	}

From 14e12b7a763e50776d6176639f375a34e3bc7ceb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jonas=20Dre=C3=9Fler?= <verdre@v0yd.nl>
Date: Sat, 16 Oct 2021 17:32:43 +0200
Subject: [PATCH 1486/1750] mwifiex: Send DELBA requests according to spec
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit cc8a8bc37466f79b24d972555237f3d591150602 ]

While looking at on-air packets using Wireshark, I noticed we're never
setting the initiator bit when sending DELBA requests to the AP: While
we set the bit on our del_ba_param_set bitmask, we forget to actually
copy that bitmask over to the command struct, which means we never
actually set the initiator bit.

Fix that and copy the bitmask over to the host_cmd_ds_11n_delba command
struct.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
Acked-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211016153244.24353-5-verdre@v0yd.nl
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/11n.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
index 6696bce56178..cf08a4af84d6 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n.c
@@ -657,14 +657,15 @@ int mwifiex_send_delba(struct mwifiex_private *priv, int tid, u8 *peer_mac,
 	uint16_t del_ba_param_set;
 
 	memset(&delba, 0, sizeof(delba));
-	delba.del_ba_param_set = cpu_to_le16(tid << DELBA_TID_POS);
 
-	del_ba_param_set = le16_to_cpu(delba.del_ba_param_set);
+	del_ba_param_set = tid << DELBA_TID_POS;
+
 	if (initiator)
 		del_ba_param_set |= IEEE80211_DELBA_PARAM_INITIATOR_MASK;
 	else
 		del_ba_param_set &= ~IEEE80211_DELBA_PARAM_INITIATOR_MASK;
 
+	delba.del_ba_param_set = cpu_to_le16(del_ba_param_set);
 	memcpy(&delba.peer_mac_addr, peer_mac, ETH_ALEN);
 
 	/* We don't wait for the response of this command */

From d405eb1150ce83f24bdaf935e362af2982db8a2f Mon Sep 17 00:00:00 2001
From: Tim Gardner <tim.gardner@canonical.com>
Date: Tue, 19 Oct 2021 12:19:50 -0600
Subject: [PATCH 1487/1750] net: enetc: unmap DMA in enetc_send_cmd()

[ Upstream commit cd4bc63de774eee95e9bac26a565cd80e0fca421 ]

Coverity complains of a possible dereference of a null return value.

   	5. returned_null: kzalloc returns NULL. [show details]
   	6. var_assigned: Assigning: si_data = NULL return value from kzalloc.
488        si_data = kzalloc(data_size, __GFP_DMA | GFP_KERNEL);
489        cbd.length = cpu_to_le16(data_size);
490
491        dma = dma_map_single(&priv->si->pdev->dev, si_data,
492                             data_size, DMA_FROM_DEVICE);

While this kzalloc() is unlikely to fail, I did notice that the function
returned without unmapping si_data.

Fix this by refactoring the error paths and checking for kzalloc()
failure.

Fixes: 888ae5a3952ba ("net: enetc: add tc flower psfp offload driver")
Cc: Claudiu Manoil <claudiu.manoil@nxp.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org (open list)
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Claudiu Manoil <claudiu.manoil@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/freescale/enetc/enetc_qos.c   | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/freescale/enetc/enetc_qos.c b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
index dbceb99c4441..9e6988fd3787 100644
--- a/drivers/net/ethernet/freescale/enetc/enetc_qos.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_qos.c
@@ -486,14 +486,16 @@ static int enetc_streamid_hw_set(struct enetc_ndev_priv *priv,
 
 	data_size = sizeof(struct streamid_data);
 	si_data = kzalloc(data_size, __GFP_DMA | GFP_KERNEL);
+	if (!si_data)
+		return -ENOMEM;
 	cbd.length = cpu_to_le16(data_size);
 
 	dma = dma_map_single(&priv->si->pdev->dev, si_data,
 			     data_size, DMA_FROM_DEVICE);
 	if (dma_mapping_error(&priv->si->pdev->dev, dma)) {
 		netdev_err(priv->si->ndev, "DMA mapping failed!\n");
-		kfree(si_data);
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto out;
 	}
 
 	cbd.addr[0] = lower_32_bits(dma);
@@ -513,12 +515,10 @@ static int enetc_streamid_hw_set(struct enetc_ndev_priv *priv,
 
 	err = enetc_send_cmd(priv->si, &cbd);
 	if (err)
-		return -EINVAL;
+		goto out;
 
-	if (!enable) {
-		kfree(si_data);
-		return 0;
-	}
+	if (!enable)
+		goto out;
 
 	/* Enable the entry overwrite again incase space flushed by hardware */
 	memset(&cbd, 0, sizeof(cbd));
@@ -563,6 +563,10 @@ static int enetc_streamid_hw_set(struct enetc_ndev_priv *priv,
 	}
 
 	err = enetc_send_cmd(priv->si, &cbd);
+out:
+	if (!dma_mapping_error(&priv->si->pdev->dev, dma))
+		dma_unmap_single(&priv->si->pdev->dev, dma, data_size, DMA_FROM_DEVICE);
+
 	kfree(si_data);
 
 	return err;

From 7668cbe0cb77fdbe8ae09146fe3b94392ec6eebf Mon Sep 17 00:00:00 2001
From: Stefan Agner <stefan@agner.ch>
Date: Tue, 19 Oct 2021 21:16:47 +0200
Subject: [PATCH 1488/1750] phy: micrel: ksz8041nl: do not use power down mode

[ Upstream commit 2641b62d2fab52648e34cdc6994b2eacde2d27c1 ]

Some Micrel KSZ8041NL PHY chips exhibit continuous RX errors after using
the power down mode bit (0.11). If the PHY is taken out of power down
mode in a certain temperature range, the PHY enters a weird state which
leads to continuously reporting RX errors. In that state, the MAC is not
able to receive or send any Ethernet frames and the activity LED is
constantly blinking. Since Linux is using the suspend callback when the
interface is taken down, ending up in that state can easily happen
during a normal startup.

Micrel confirmed the issue in errata DS80000700A [*], caused by abnormal
clock recovery when using power down mode. Even the latest revision (A4,
Revision ID 0x1513) seems to suffer that problem, and according to the
errata is not going to be fixed.

Remove the suspend/resume callback to avoid using the power down mode
completely.

[*] https://ww1.microchip.com/downloads/en/DeviceDoc/80000700A.pdf

Fixes: 1a5465f5d6a2 ("phy/micrel: Add suspend/resume support to Micrel PHYs")
Signed-off-by: Stefan Agner <stefan@agner.ch>
Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/micrel.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index b341a8be09f9..92e94ac94a34 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -1216,8 +1216,9 @@ static struct phy_driver ksphy_driver[] = {
 	.get_sset_count = kszphy_get_sset_count,
 	.get_strings	= kszphy_get_strings,
 	.get_stats	= kszphy_get_stats,
-	.suspend	= genphy_suspend,
-	.resume		= genphy_resume,
+	/* No suspend/resume callbacks because of errata DS80000700A,
+	 * receiver error following software power down.
+	 */
 }, {
 	.phy_id		= PHY_ID_KSZ8041RNLI,
 	.phy_id_mask	= MICREL_PHY_ID_MASK,

From e8c0b748456a42b619449e416529f497e01e19d7 Mon Sep 17 00:00:00 2001
From: Max Gurtovoy <mgurtovoy@nvidia.com>
Date: Sun, 17 Oct 2021 11:58:16 +0300
Subject: [PATCH 1489/1750] nvme-rdma: fix error code in nvme_rdma_setup_ctrl

[ Upstream commit 09748122009aed7bfaa7acc33c10c083a4758322 ]

In case that icdoff is not zero or mandatory keyed sgls are not
supported by the NVMe/RDMA target, we'll go to error flow but we'll
return 0 to the caller. Fix it by returning an appropriate error code.

Fixes: c66e2998c8ca ("nvme-rdma: centralize controller setup sequence")
Signed-off-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/rdma.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 51f4647ea214..1b9056381843 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1103,11 +1103,13 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new)
 		return ret;
 
 	if (ctrl->ctrl.icdoff) {
+		ret = -EOPNOTSUPP;
 		dev_err(ctrl->ctrl.device, "icdoff is not supported!\n");
 		goto destroy_admin;
 	}
 
 	if (!(ctrl->ctrl.sgls & (1 << 2))) {
+		ret = -EOPNOTSUPP;
 		dev_err(ctrl->ctrl.device,
 			"Mandatory keyed sgls are not supported!\n");
 		goto destroy_admin;

From b9f142d748b6db8e8c9850323d86651a10b77a44 Mon Sep 17 00:00:00 2001
From: Anders Roxell <anders.roxell@linaro.org>
Date: Thu, 7 Oct 2021 21:13:37 +0200
Subject: [PATCH 1490/1750] PM: hibernate: fix sparse warnings

[ Upstream commit 01de5fcd8b1ac0ca28d2bb0921226a54fdd62684 ]

When building the kernel with sparse enabled 'C=1' the following
warnings shows up:

kernel/power/swap.c:390:29: warning: incorrect type in assignment (different base types)
kernel/power/swap.c:390:29:    expected int ret
kernel/power/swap.c:390:29:    got restricted blk_status_t

This is due to function hib_wait_io() returns a 'blk_status_t' which is
a bitwise u8. Commit 5416da01ff6e ("PM: hibernate: Remove
blk_status_to_errno in hib_wait_io") seemed to have mixed up the return
type. However, the 4e4cbee93d56 ("block: switch bios to blk_status_t")
actually broke the behaviour by returning the wrong type.

Rework so function hib_wait_io() returns a 'int' instead of
'blk_status_t' and make sure to call function
blk_status_to_errno(hb->error)' when returning from function
hib_wait_io() a int gets returned.

Fixes: 4e4cbee93d56 ("block: switch bios to blk_status_t")
Fixes: 5416da01ff6e ("PM: hibernate: Remove blk_status_to_errno in hib_wait_io")
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/power/swap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index c9126606fa6f..25e7cb96bb88 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -299,7 +299,7 @@ static int hib_submit_io(int op, int op_flags, pgoff_t page_off, void *addr,
 	return error;
 }
 
-static blk_status_t hib_wait_io(struct hib_bio_batch *hb)
+static int hib_wait_io(struct hib_bio_batch *hb)
 {
 	/*
 	 * We are relying on the behavior of blk_plug that a thread with

From 8e2f97df6a0b489dd6e35d62082cdc3dc08d3ca3 Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Sat, 28 Aug 2021 10:57:47 -0700
Subject: [PATCH 1491/1750] clocksource/drivers/timer-ti-dm: Select TIMER_OF

[ Upstream commit eda9a4f7af6ee47e9e131f20e4f8a41a97379293 ]

When building OMAP_DM_TIMER without TIMER_OF, there are orphan sections
due to the use of TIMER_OF_DELCARE() without CONFIG_TIMER_OF. Select
CONFIG_TIMER_OF when enaling OMAP_DM_TIMER:

arm-linux-gnueabi-ld: warning: orphan section `__timer_of_table' from `drivers/clocksource/timer-ti-dm-systimer.o' being placed in section `__timer_of_table'

Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/202108282255.tkdt4ani-lkp@intel.com/
Cc: Tony Lindgren <tony@atomide.com>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Keerthy <j-keerthy@ti.com>
Cc: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Cc: Ladislav Michl <ladis@linux-mips.org>
Cc: Grygorii Strashko <grygorii.strashko@ti.com>
Cc: linux-omap@vger.kernel.org
Fixes: 52762fbd1c47 ("clocksource/drivers/timer-ti-dm: Add clockevent and clocksource support")
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210828175747.3777891-1-keescook@chromium.org
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 39f4d8866200..a0c6e88bebe0 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -24,6 +24,7 @@ config I8253_LOCK
 
 config OMAP_DM_TIMER
 	bool
+	select TIMER_OF
 
 config CLKBLD_I8253
 	def_bool y if CLKSRC_I8253 || CLKEVT_I8253 || I8253_LOCK

From 6d1f3157aa9b52fecb259916925ae164ebfa7ccb Mon Sep 17 00:00:00 2001
From: Joerg Roedel <jroedel@suse.de>
Date: Thu, 21 Oct 2021 10:08:32 +0200
Subject: [PATCH 1492/1750] x86/sev: Fix stack type check in
 vc_switch_off_ist()

[ Upstream commit 5681981fb788281b09a4ea14d310d30b2bd89132 ]

The value of STACK_TYPE_EXCEPTION_LAST points to the last _valid_
exception stack. Reflect that in the check done in the
vc_switch_off_ist() function.

Fixes: a13644f3a53de ("x86/entry/64: Add entry code for #VC handler")
Reported-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20211021080833.30875-2-joro@8bytes.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/traps.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 7692bf7908e6..143fcb8af38f 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -701,7 +701,7 @@ asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *r
 	stack = (unsigned long *)sp;
 
 	if (!get_stack_info_noinstr(stack, current, &info) || info.type == STACK_TYPE_ENTRY ||
-	    info.type >= STACK_TYPE_EXCEPTION_LAST)
+	    info.type > STACK_TYPE_EXCEPTION_LAST)
 		sp = __this_cpu_ist_top_va(VC2);
 
 sync:

From 807f01f60cd0a9b0c3154d7b635b02b8002d3c9f Mon Sep 17 00:00:00 2001
From: Jessica Zhang <jesszhan@codeaurora.org>
Date: Wed, 20 Oct 2021 10:57:33 -0700
Subject: [PATCH 1493/1750] drm/msm: Fix potential NULL dereference in DPU SSPP

[ Upstream commit 8bf71a5719b6cc5b6ba358096081e5d50ea23ab6 ]

Move initialization of sblk in _sspp_subblk_offset() after NULL check to
avoid potential NULL pointer dereference.

Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jessica Zhang <jesszhan@codeaurora.org>
Link: https://lore.kernel.org/r/20211020175733.3379-1-jesszhan@codeaurora.org
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
index c940b69435e1..016c462bdb5d 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c
@@ -138,11 +138,13 @@ static int _sspp_subblk_offset(struct dpu_hw_pipe *ctx,
 		u32 *idx)
 {
 	int rc = 0;
-	const struct dpu_sspp_sub_blks *sblk = ctx->cap->sblk;
+	const struct dpu_sspp_sub_blks *sblk;
 
-	if (!ctx)
+	if (!ctx || !ctx->cap || !ctx->cap->sblk)
 		return -EINVAL;
 
+	sblk = ctx->cap->sblk;
+
 	switch (s_id) {
 	case DPU_SSPP_SRC:
 		*idx = sblk->src_blk.base;
@@ -419,7 +421,7 @@ static void _dpu_hw_sspp_setup_scaler3(struct dpu_hw_pipe *ctx,
 
 	(void)pe;
 	if (_sspp_subblk_offset(ctx, DPU_SSPP_SCALER_QSEED3, &idx) || !sspp
-		|| !scaler3_cfg || !ctx || !ctx->cap || !ctx->cap->sblk)
+		|| !scaler3_cfg)
 		return;
 
 	dpu_hw_setup_scaler3(&ctx->hw, scaler3_cfg, idx,

From d33753718156254a474055817a72de83831e43bc Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Tue, 19 Oct 2021 20:27:26 +0900
Subject: [PATCH 1494/1750] smackfs: use netlbl_cfg_cipsov4_del() for deleting
 cipso_v4_doi

[ Upstream commit 0934ad42bb2c5df90a1b9de690f93de735b622fe ]

syzbot is reporting UAF at cipso_v4_doi_search() [1], for smk_cipso_doi()
is calling kfree() without removing from the cipso_v4_doi_list list after
netlbl_cfg_cipsov4_map_add() returned an error. We need to use
netlbl_cfg_cipsov4_del() in order to remove from the list and wait for
RCU grace period before kfree().

Link: https://syzkaller.appspot.com/bug?extid=93dba5b91f0fed312cbd [1]
Reported-by: syzbot <syzbot+93dba5b91f0fed312cbd@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 6c2e8ac0953fccdd ("netlabel: Update kernel configuration API")
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/smack/smackfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index ca0daba11f81..3eabcc469669 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -712,7 +712,7 @@ static void smk_cipso_doi(void)
 	if (rc != 0) {
 		printk(KERN_WARNING "%s:%d map add rc = %d\n",
 		       __func__, __LINE__, rc);
-		kfree(doip);
+		netlbl_cfg_cipsov4_del(doip->doi, &nai);
 		return;
 	}
 }

From 293fa72d62e46bc5f8044be7204869efad4b4d0c Mon Sep 17 00:00:00 2001
From: Ricardo Koller <ricarkol@google.com>
Date: Wed, 10 Feb 2021 03:17:19 +0000
Subject: [PATCH 1495/1750] KVM: selftests: Add operand to vmsave/vmload/vmrun
 in svm.c

[ Upstream commit 47bc726fe8d1910872dc3d7e7ec70f8b9e6043b7 ]

Building the KVM selftests with LLVM's integrated assembler fails with:

  $ CFLAGS=-fintegrated-as make -C tools/testing/selftests/kvm CC=clang
  lib/x86_64/svm.c:77:16: error: too few operands for instruction
          asm volatile ("vmsave\n\t" : : "a" (vmcb_gpa) : "memory");
                        ^
  <inline asm>:1:2: note: instantiated into assembly here
          vmsave
          ^
  lib/x86_64/svm.c:134:3: error: too few operands for instruction
                  "vmload\n\t"
                  ^
  <inline asm>:1:2: note: instantiated into assembly here
          vmload
          ^
This is because LLVM IAS does not currently support calling vmsave,
vmload, or vmload without an explicit %rax operand.

Add an explicit operand to vmsave, vmload, and vmrum in svm.c. Fixing
this was suggested by Sean Christopherson.

Tested: building without this error in clang 11. The following patch
(not queued yet) needs to be applied to solve the other remaining error:
"selftests: kvm: remove reassignment of non-absolute variables".

Suggested-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/kvm/X+Df2oQczVBmwEzi@google.com/
Reviewed-by: Jim Mattson <jmattson@google.com>
Signed-off-by: Ricardo Koller <ricarkol@google.com>
Message-Id: <20210210031719.769837-1-ricarkol@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/lib/x86_64/svm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/svm.c b/tools/testing/selftests/kvm/lib/x86_64/svm.c
index 3a5c72ed2b79..827fe6028dd4 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/svm.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/svm.c
@@ -74,7 +74,7 @@ void generic_svm_setup(struct svm_test_data *svm, void *guest_rip, void *guest_r
 	wrmsr(MSR_VM_HSAVE_PA, svm->save_area_gpa);
 
 	memset(vmcb, 0, sizeof(*vmcb));
-	asm volatile ("vmsave\n\t" : : "a" (vmcb_gpa) : "memory");
+	asm volatile ("vmsave %0\n\t" : : "a" (vmcb_gpa) : "memory");
 	vmcb_set_seg(&save->es, get_es(), 0, -1U, data_seg_attr);
 	vmcb_set_seg(&save->cs, get_cs(), 0, -1U, code_seg_attr);
 	vmcb_set_seg(&save->ss, get_ss(), 0, -1U, data_seg_attr);
@@ -131,19 +131,19 @@ void generic_svm_setup(struct svm_test_data *svm, void *guest_rip, void *guest_r
 void run_guest(struct vmcb *vmcb, uint64_t vmcb_gpa)
 {
 	asm volatile (
-		"vmload\n\t"
+		"vmload %[vmcb_gpa]\n\t"
 		"mov rflags, %%r15\n\t"	// rflags
 		"mov %%r15, 0x170(%[vmcb])\n\t"
 		"mov guest_regs, %%r15\n\t"	// rax
 		"mov %%r15, 0x1f8(%[vmcb])\n\t"
 		LOAD_GPR_C
-		"vmrun\n\t"
+		"vmrun %[vmcb_gpa]\n\t"
 		SAVE_GPR_C
 		"mov 0x170(%[vmcb]), %%r15\n\t"	// rflags
 		"mov %%r15, rflags\n\t"
 		"mov 0x1f8(%[vmcb]), %%r15\n\t"	// rax
 		"mov %%r15, guest_regs\n\t"
-		"vmsave\n\t"
+		"vmsave %[vmcb_gpa]\n\t"
 		: : [vmcb] "r" (vmcb), [vmcb_gpa] "a" (vmcb_gpa)
 		: "r15", "memory");
 }

From 7cd4af996cd296f36676416fc1618b3df6fbc985 Mon Sep 17 00:00:00 2001
From: Jim Mattson <jmattson@google.com>
Date: Wed, 29 Sep 2021 17:36:49 -0700
Subject: [PATCH 1496/1750] KVM: selftests: Fix nested SVM tests when built
 with clang

[ Upstream commit ed290e1c20da19fa100a3e0f421aa31b65984960 ]

Though gcc conveniently compiles a simple memset to "rep stos," clang
prefers to call the libc version of memset. If a test is dynamically
linked, the libc memset isn't available in L1 (nor is the PLT or the
GOT, for that matter). Even if the test is statically linked, the libc
memset may choose to use some CPU features, like AVX, which may not be
enabled in L1. Note that __builtin_memset doesn't solve the problem,
because (a) the compiler is free to call memset anyway, and (b)
__builtin_memset may also choose to use features like AVX, which may
not be available in L1.

To avoid a myriad of problems, use an explicit "rep stos" to clear the
VMCB in generic_svm_setup(), which is called both from L0 and L1.

Reported-by: Ricardo Koller <ricarkol@google.com>
Signed-off-by: Jim Mattson <jmattson@google.com>
Fixes: 20ba262f8631a ("selftests: KVM: AMD Nested test infrastructure")
Message-Id: <20210930003649.4026553-1-jmattson@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/lib/x86_64/svm.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/kvm/lib/x86_64/svm.c b/tools/testing/selftests/kvm/lib/x86_64/svm.c
index 827fe6028dd4..a58507a7b5d6 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/svm.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/svm.c
@@ -57,6 +57,18 @@ static void vmcb_set_seg(struct vmcb_seg *seg, u16 selector,
 	seg->base = base;
 }
 
+/*
+ * Avoid using memset to clear the vmcb, since libc may not be
+ * available in L1 (and, even if it is, features that libc memset may
+ * want to use, like AVX, may not be enabled).
+ */
+static void clear_vmcb(struct vmcb *vmcb)
+{
+	int n = sizeof(*vmcb) / sizeof(u32);
+
+	asm volatile ("rep stosl" : "+c"(n), "+D"(vmcb) : "a"(0) : "memory");
+}
+
 void generic_svm_setup(struct svm_test_data *svm, void *guest_rip, void *guest_rsp)
 {
 	struct vmcb *vmcb = svm->vmcb;
@@ -73,7 +85,7 @@ void generic_svm_setup(struct svm_test_data *svm, void *guest_rip, void *guest_r
 	wrmsr(MSR_EFER, efer | EFER_SVME);
 	wrmsr(MSR_VM_HSAVE_PA, svm->save_area_gpa);
 
-	memset(vmcb, 0, sizeof(*vmcb));
+	clear_vmcb(vmcb);
 	asm volatile ("vmsave %0\n\t" : : "a" (vmcb_gpa) : "memory");
 	vmcb_set_seg(&save->es, get_es(), 0, -1U, data_seg_attr);
 	vmcb_set_seg(&save->cs, get_cs(), 0, -1U, code_seg_attr);

From 0b95aaa493c6b3294a76eebe3930557512fbebfc Mon Sep 17 00:00:00 2001
From: Quentin Monnet <quentin@isovalent.com>
Date: Fri, 22 Oct 2021 10:47:43 +0100
Subject: [PATCH 1497/1750] bpftool: Avoid leaking the JSON writer prepared for
 program metadata

[ Upstream commit e89ef634f81c9d90e1824ab183721f3b361472e6 ]

Bpftool creates a new JSON object for writing program metadata in plain
text mode, regardless of metadata being present or not. Then this writer
is freed if any metadata has been found and printed, but it leaks
otherwise. We cannot destroy the object unconditionally, because the
destructor prints an undesirable line break. Instead, make sure the
writer is created only after we have found program metadata to print.

Found with valgrind.

Fixes: aff52e685eb3 ("bpftool: Support dumping metadata")
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20211022094743.11052-1-quentin@isovalent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/prog.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index 14237ffb90ba..592536904dde 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -304,18 +304,12 @@ static void show_prog_metadata(int fd, __u32 num_maps)
 		if (printed_header)
 			jsonw_end_object(json_wtr);
 	} else {
-		json_writer_t *btf_wtr = jsonw_new(stdout);
+		json_writer_t *btf_wtr;
 		struct btf_dumper d = {
 			.btf = btf,
-			.jw = btf_wtr,
 			.is_plain_text = true,
 		};
 
-		if (!btf_wtr) {
-			p_err("jsonw alloc failed");
-			goto out_free;
-		}
-
 		for (i = 0; i < vlen; i++, vsi++) {
 			t_var = btf__type_by_id(btf, vsi->type);
 			name = btf__name_by_offset(btf, t_var->name_off);
@@ -325,6 +319,14 @@ static void show_prog_metadata(int fd, __u32 num_maps)
 
 			if (!printed_header) {
 				printf("\tmetadata:");
+
+				btf_wtr = jsonw_new(stdout);
+				if (!btf_wtr) {
+					p_err("jsonw alloc failed");
+					goto out_free;
+				}
+				d.jw = btf_wtr,
+
 				printed_header = true;
 			}
 

From 4d4d6aa2ef803044badb1529a1bfb45680f4071e Mon Sep 17 00:00:00 2001
From: Andrii Nakryiko <andrii@kernel.org>
Date: Wed, 4 Nov 2020 20:33:57 -0800
Subject: [PATCH 1498/1750] libbpf: Fix BTF data layout checks and allow empty
 BTF

[ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ]

Make data section layout checks stricter, disallowing overlap of types and
strings data.

Additionally, allow BTFs with no type data. There is nothing inherently wrong
with having BTF with no types (put potentially with some strings). This could
be a situation with kernel module BTFs, if module doesn't introduce any new
type information.

Also fix invalid offset alignment check for btf->hdr->type_off.

Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/btf.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 231b07203e3d..987c1515b828 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -215,22 +215,18 @@ static int btf_parse_hdr(struct btf *btf)
 		return -EINVAL;
 	}
 
-	if (meta_left < hdr->type_off) {
-		pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off);
+	if (meta_left < hdr->str_off + hdr->str_len) {
+		pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
 		return -EINVAL;
 	}
 
-	if (meta_left < hdr->str_off) {
-		pr_debug("Invalid BTF string section offset:%u\n", hdr->str_off);
+	if (hdr->type_off + hdr->type_len > hdr->str_off) {
+		pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n",
+			 hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len);
 		return -EINVAL;
 	}
 
-	if (hdr->type_off >= hdr->str_off) {
-		pr_debug("BTF type section offset >= string section offset. No type?\n");
-		return -EINVAL;
-	}
-
-	if (hdr->type_off & 0x02) {
+	if (hdr->type_off % 4) {
 		pr_debug("BTF type section is not aligned to 4 bytes\n");
 		return -EINVAL;
 	}

From 255eb8f8affd23a37c8823c167da9f9e9ad416d0 Mon Sep 17 00:00:00 2001
From: Andrii Nakryiko <andrii@kernel.org>
Date: Sat, 9 Jan 2021 23:03:41 -0800
Subject: [PATCH 1499/1750] libbpf: Allow loading empty BTFs

[ Upstream commit b8d52264df85ec12f370c0a8b28d0ac59a05877a ]

Empty BTFs do come up (e.g., simple kernel modules with no new types and
strings, compared to the vmlinux BTF) and there is nothing technically wrong
with them. So remove unnecessary check preventing loading empty BTFs.

Fixes: d8123624506c ("libbpf: Fix BTF data layout checks and allow empty BTF")
Reported-by: Christopher William Snowhill <chris@kode54.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210110070341.1380086-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/btf.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index 987c1515b828..c8c751265e23 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -210,11 +210,6 @@ static int btf_parse_hdr(struct btf *btf)
 	}
 
 	meta_left = btf->raw_size - sizeof(*hdr);
-	if (!meta_left) {
-		pr_debug("BTF has no data\n");
-		return -EINVAL;
-	}
-
 	if (meta_left < hdr->str_off + hdr->str_len) {
 		pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
 		return -EINVAL;

From 12872fd7e40b08c92c90da6f7c16a11a65b68aa2 Mon Sep 17 00:00:00 2001
From: Andrii Nakryiko <andrii@kernel.org>
Date: Fri, 22 Oct 2021 17:31:56 -0700
Subject: [PATCH 1500/1750] libbpf: Fix overflow in BTF sanity checks

[ Upstream commit 5245dafe3d49efba4d3285cf27ee1cc1eeafafc6 ]

btf_header's str_off+str_len or type_off+type_len can overflow as they
are u32s. This will lead to bypassing the sanity checks during BTF
parsing, resulting in crashes afterwards. Fix by using 64-bit signed
integers for comparison.

Fixes: d8123624506c ("libbpf: Fix BTF data layout checks and allow empty BTF")
Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211023003157.726961-1-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/btf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index c8c751265e23..c15eb14a711e 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -210,12 +210,12 @@ static int btf_parse_hdr(struct btf *btf)
 	}
 
 	meta_left = btf->raw_size - sizeof(*hdr);
-	if (meta_left < hdr->str_off + hdr->str_len) {
+	if (meta_left < (long long)hdr->str_off + hdr->str_len) {
 		pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
 		return -EINVAL;
 	}
 
-	if (hdr->type_off + hdr->type_len > hdr->str_off) {
+	if ((long long)hdr->type_off + hdr->type_len > hdr->str_off) {
 		pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n",
 			 hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len);
 		return -EINVAL;

From 50fcaa7155214dbc57c985bb55edb1eb8e880fdb Mon Sep 17 00:00:00 2001
From: Andrii Nakryiko <andrii@kernel.org>
Date: Fri, 22 Oct 2021 17:31:57 -0700
Subject: [PATCH 1501/1750] libbpf: Fix BTF header parsing checks

[ Upstream commit c825f5fee19caf301d9821cd79abaa734322de26 ]

Original code assumed fixed and correct BTF header length. That's not
always the case, though, so fix this bug with a proper additional check.
And use actual header length instead of sizeof(struct btf_header) in
sanity checks.

Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf")
Reported-by: Evgeny Vereshchagin <evvers@ya.ru>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211023003157.726961-2-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/btf.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
index c15eb14a711e..e6f644cdc9f1 100644
--- a/tools/lib/bpf/btf.c
+++ b/tools/lib/bpf/btf.c
@@ -205,13 +205,19 @@ static int btf_parse_hdr(struct btf *btf)
 		}
 		btf_bswap_hdr(hdr);
 	} else if (hdr->magic != BTF_MAGIC) {
-		pr_debug("Invalid BTF magic:%x\n", hdr->magic);
+		pr_debug("Invalid BTF magic: %x\n", hdr->magic);
 		return -EINVAL;
 	}
 
-	meta_left = btf->raw_size - sizeof(*hdr);
+	if (btf->raw_size < hdr->hdr_len) {
+		pr_debug("BTF header len %u larger than data size %u\n",
+			 hdr->hdr_len, btf->raw_size);
+		return -EINVAL;
+	}
+
+	meta_left = btf->raw_size - hdr->hdr_len;
 	if (meta_left < (long long)hdr->str_off + hdr->str_len) {
-		pr_debug("Invalid BTF total size:%u\n", btf->raw_size);
+		pr_debug("Invalid BTF total size: %u\n", btf->raw_size);
 		return -EINVAL;
 	}
 

From a729eb55b3c7db244d6cc5a33739f25faf9b5c92 Mon Sep 17 00:00:00 2001
From: David Hildenbrand <david@redhat.com>
Date: Thu, 9 Sep 2021 18:22:41 +0200
Subject: [PATCH 1502/1750] s390/gmap: don't unconditionally call
 pte_unmap_unlock() in __gmap_zap()

[ Upstream commit b159f94c86b43cf7e73e654bc527255b1f4eafc4 ]

... otherwise we will try unlocking a spinlock that was never locked via a
garbage pointer.

At the time we reach this code path, we usually successfully looked up
a PGSTE already; however, evil user space could have manipulated the VMA
layout in the meantime and triggered removal of the page table.

Fixes: 1e133ab296f3 ("s390/mm: split arch/s390/mm/pgtable.c")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://lore.kernel.org/r/20210909162248.14969-3-david@redhat.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/mm/gmap.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index 64795d034926..f2d19d40272c 100644
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -684,9 +684,10 @@ void __gmap_zap(struct gmap *gmap, unsigned long gaddr)
 		vmaddr |= gaddr & ~PMD_MASK;
 		/* Get pointer to the page table entry */
 		ptep = get_locked_pte(gmap->mm, vmaddr, &ptl);
-		if (likely(ptep))
+		if (likely(ptep)) {
 			ptep_zap_unused(gmap->mm, vmaddr, ptep, 0);
-		pte_unmap_unlock(ptep, ptl);
+			pte_unmap_unlock(ptep, ptl);
+		}
 	}
 }
 EXPORT_SYMBOL_GPL(__gmap_zap);

From 759f27cfa344313149e76c662682639f7c5fdf36 Mon Sep 17 00:00:00 2001
From: Claudio Imbrenda <imbrenda@linux.ibm.com>
Date: Mon, 20 Sep 2021 15:24:50 +0200
Subject: [PATCH 1503/1750] KVM: s390: pv: avoid double free of sida page

[ Upstream commit d4074324b07a94a1fca476d452dfbb3a4e7bf656 ]

If kvm_s390_pv_destroy_cpu is called more than once, we risk calling
free_page on a random page, since the sidad field is aliased with the
gbea, which is not guaranteed to be zero.

This can happen, for example, if userspace calls the KVM_PV_DISABLE
IOCTL, and it fails, and then userspace calls the same IOCTL again.
This scenario is only possible if KVM has some serious bug or if the
hardware is broken.

The solution is to simply return successfully immediately if the vCPU
was already non secure.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Fixes: 19e1227768863a1469797c13ef8fea1af7beac2c ("KVM: S390: protvirt: Introduce instruction data area bounce buffer")
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Message-Id: <20210920132502.36111-3-imbrenda@linux.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kvm/pv.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c
index f5847f9dec7c..74265304dd9c 100644
--- a/arch/s390/kvm/pv.c
+++ b/arch/s390/kvm/pv.c
@@ -16,18 +16,17 @@
 
 int kvm_s390_pv_destroy_cpu(struct kvm_vcpu *vcpu, u16 *rc, u16 *rrc)
 {
-	int cc = 0;
+	int cc;
 
-	if (kvm_s390_pv_cpu_get_handle(vcpu)) {
-		cc = uv_cmd_nodata(kvm_s390_pv_cpu_get_handle(vcpu),
-				   UVC_CMD_DESTROY_SEC_CPU, rc, rrc);
+	if (!kvm_s390_pv_cpu_get_handle(vcpu))
+		return 0;
+
+	cc = uv_cmd_nodata(kvm_s390_pv_cpu_get_handle(vcpu), UVC_CMD_DESTROY_SEC_CPU, rc, rrc);
+
+	KVM_UV_EVENT(vcpu->kvm, 3, "PROTVIRT DESTROY VCPU %d: rc %x rrc %x",
+		     vcpu->vcpu_id, *rc, *rrc);
+	WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x", *rc, *rrc);
 
-		KVM_UV_EVENT(vcpu->kvm, 3,
-			     "PROTVIRT DESTROY VCPU %d: rc %x rrc %x",
-			     vcpu->vcpu_id, *rc, *rrc);
-		WARN_ONCE(cc, "protvirt destroy cpu failed rc %x rrc %x",
-			  *rc, *rrc);
-	}
 	/* Intended memory leak for something that should never happen. */
 	if (!cc)
 		free_pages(vcpu->arch.pv.stor_base,

From 29a1cc3b50113b78931627676071744f7d614766 Mon Sep 17 00:00:00 2001
From: Claudio Imbrenda <imbrenda@linux.ibm.com>
Date: Mon, 20 Sep 2021 15:24:51 +0200
Subject: [PATCH 1504/1750] KVM: s390: pv: avoid stalls for kvm_s390_pv_init_vm

[ Upstream commit 1e2aa46de526a5adafe580bca4c25856bb06f09e ]

When the system is heavily overcommitted, kvm_s390_pv_init_vm might
generate stall notifications.

Fix this by using uv_call_sched instead of just uv_call. This is ok because
we are not holding spinlocks.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Fixes: 214d9bbcd3a672 ("s390/mm: provide memory management functions for protected KVM guests")
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Message-Id: <20210920132502.36111-4-imbrenda@linux.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kvm/pv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kvm/pv.c b/arch/s390/kvm/pv.c
index 74265304dd9c..822887887222 100644
--- a/arch/s390/kvm/pv.c
+++ b/arch/s390/kvm/pv.c
@@ -190,7 +190,7 @@ int kvm_s390_pv_init_vm(struct kvm *kvm, u16 *rc, u16 *rrc)
 	uvcb.conf_base_stor_origin = (u64)kvm->arch.pv.stor_base;
 	uvcb.conf_virt_stor_origin = (u64)kvm->arch.pv.stor_var;
 
-	cc = uv_call(0, (u64)&uvcb);
+	cc = uv_call_sched(0, (u64)&uvcb);
 	*rc = uvcb.header.rc;
 	*rrc = uvcb.header.rrc;
 	KVM_UV_EVENT(kvm, 3, "PROTVIRT CREATE VM: handle %llx len %llx rc %x rrc %x",

From 43b4860b58f3cbfdc68bf8e58e9ac9e582bdfc6c Mon Sep 17 00:00:00 2001
From: Mark Rutland <mark.rutland@arm.com>
Date: Wed, 20 Oct 2021 17:25:22 +0100
Subject: [PATCH 1505/1750] irq: mips: avoid nested irq_enter()

[ Upstream commit c65b52d02f6c1a06ddb20cba175ad49eccd6410d ]

As bcm6345_l1_irq_handle() is a chained irqchip handler, it will be
invoked within the context of the root irqchip handler, which must have
entered IRQ context already.

When bcm6345_l1_irq_handle() calls arch/mips's do_IRQ() , this will nest
another call to irq_enter(), and the resulting nested increment to
`rcu_data.dynticks_nmi_nesting` will cause rcu_is_cpu_rrupt_from_idle()
to fail to identify wakeups from idle, resulting in failure to preempt,
and RCU stalls.

Chained irqchip handlers must invoke IRQ handlers by way of thee core
irqchip code, i.e. generic_handle_irq() or generic_handle_domain_irq()
and should not call do_IRQ(), which is intended only for root irqchip
handlers.

Fix bcm6345_l1_irq_handle() by calling generic_handle_irq() directly.

Fixes: c7c42ec2baa1de7a ("irqchips/bmips: Add bcm6345-l1 interrupt controller")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Acked-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-bcm6345-l1.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-bcm6345-l1.c b/drivers/irqchip/irq-bcm6345-l1.c
index e3483789f4df..1bd0621c4ce2 100644
--- a/drivers/irqchip/irq-bcm6345-l1.c
+++ b/drivers/irqchip/irq-bcm6345-l1.c
@@ -140,7 +140,7 @@ static void bcm6345_l1_irq_handle(struct irq_desc *desc)
 		for_each_set_bit(hwirq, &pending, IRQS_PER_WORD) {
 			irq = irq_linear_revmap(intc->domain, base + hwirq);
 			if (irq)
-				do_IRQ(irq);
+				generic_handle_irq(irq);
 			else
 				spurious_interrupt();
 		}

From ff1a0f71cc77ab431e5b7f8bc4bc6271931684f6 Mon Sep 17 00:00:00 2001
From: Hao Wu <hao.wu@rubrik.com>
Date: Wed, 8 Sep 2021 02:26:06 -0700
Subject: [PATCH 1506/1750] tpm: fix Atmel TPM crash caused by too frequent
 queries

[ Upstream commit 79ca6f74dae067681a779fd573c2eb59649989bc ]

The Atmel TPM 1.2 chips crash with error
`tpm_try_transmit: send(): error -62` since kernel 4.14.
It is observed from the kernel log after running `tpm_sealdata -z`.
The error thrown from the command is as follows
```
$ tpm_sealdata -z
Tspi_Key_LoadKey failed: 0x00001087 - layer=tddl,
code=0087 (135), I/O error
```

The issue was reproduced with the following Atmel TPM chip:
```
$ tpm_version
T0  TPM 1.2 Version Info:
  Chip Version:        1.2.66.1
  Spec Level:          2
  Errata Revision:     3
  TPM Vendor ID:       ATML
  TPM Version:         01010000
  Manufacturer Info:   41544d4c
```

The root cause of the issue is due to the TPM calls to msleep()
were replaced with usleep_range() [1], which reduces
the actual timeout. Via experiments, it is observed that
the original msleep(5) actually sleeps for 15ms.
Because of a known timeout issue in Atmel TPM 1.2 chip,
the shorter timeout than 15ms can cause the error described above.

A few further changes in kernel 4.16 [2] and 4.18 [3, 4] further
reduced the timeout to less than 1ms. With experiments,
the problematic timeout in the latest kernel is the one
for `wait_for_tpm_stat`.

To fix it, the patch reverts the timeout of `wait_for_tpm_stat`
to 15ms for all Atmel TPM 1.2 chips, but leave it untouched
for Ateml TPM 2.0 chip, and chips from other vendors.
As explained above, the chosen 15ms timeout is
the actual timeout before this issue introduced,
thus the old value is used here.
Particularly, TPM_ATML_TIMEOUT_WAIT_STAT_MIN is set to 14700us,
TPM_ATML_TIMEOUT_WAIT_STAT_MIN is set to 15000us according to
the existing TPM_TIMEOUT_RANGE_US (300us).
The fixed has been tested in the system with the affected Atmel chip
with no issues observed after boot up.

References:
[1] 9f3fc7bcddcb tpm: replace msleep() with usleep_range() in TPM
1.2/2.0 generic drivers
[2] cf151a9a44d5 tpm: reduce tpm polling delay in tpm_tis_core
[3] 59f5a6b07f64 tpm: reduce poll sleep time in tpm_transmit()
[4] 424eaf910c32 tpm: reduce polling time to usecs for even finer
granularity

Fixes: 9f3fc7bcddcb ("tpm: replace msleep() with usleep_range() in TPM 1.2/2.0 generic drivers")
Link: https://patchwork.kernel.org/project/linux-integrity/patch/20200926223150.109645-1-hao.wu@rubrik.com/
Signed-off-by: Hao Wu <hao.wu@rubrik.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_tis_core.c | 26 ++++++++++++++++++--------
 drivers/char/tpm/tpm_tis_core.h |  4 ++++
 include/linux/tpm.h             |  1 +
 3 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index 69579efb247b..b2659a4c4016 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -48,6 +48,7 @@ static int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask,
 		unsigned long timeout, wait_queue_head_t *queue,
 		bool check_cancel)
 {
+	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
 	unsigned long stop;
 	long rc;
 	u8 status;
@@ -80,8 +81,8 @@ static int wait_for_tpm_stat(struct tpm_chip *chip, u8 mask,
 		}
 	} else {
 		do {
-			usleep_range(TPM_TIMEOUT_USECS_MIN,
-				     TPM_TIMEOUT_USECS_MAX);
+			usleep_range(priv->timeout_min,
+				     priv->timeout_max);
 			status = chip->ops->status(chip);
 			if ((status & mask) == mask)
 				return 0;
@@ -945,7 +946,22 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
 	chip->timeout_b = msecs_to_jiffies(TIS_TIMEOUT_B_MAX);
 	chip->timeout_c = msecs_to_jiffies(TIS_TIMEOUT_C_MAX);
 	chip->timeout_d = msecs_to_jiffies(TIS_TIMEOUT_D_MAX);
+	priv->timeout_min = TPM_TIMEOUT_USECS_MIN;
+	priv->timeout_max = TPM_TIMEOUT_USECS_MAX;
 	priv->phy_ops = phy_ops;
+
+	rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor);
+	if (rc < 0)
+		goto out_err;
+
+	priv->manufacturer_id = vendor;
+
+	if (priv->manufacturer_id == TPM_VID_ATML &&
+		!(chip->flags & TPM_CHIP_FLAG_TPM2)) {
+		priv->timeout_min = TIS_TIMEOUT_MIN_ATML;
+		priv->timeout_max = TIS_TIMEOUT_MAX_ATML;
+	}
+
 	dev_set_drvdata(&chip->dev, priv);
 
 	if (is_bsw()) {
@@ -988,12 +1004,6 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq,
 	if (rc)
 		goto out_err;
 
-	rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor);
-	if (rc < 0)
-		goto out_err;
-
-	priv->manufacturer_id = vendor;
-
 	rc = tpm_tis_read8(priv, TPM_RID(0), &rid);
 	if (rc < 0)
 		goto out_err;
diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h
index b2a3c6c72882..3be24f221e32 100644
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -54,6 +54,8 @@ enum tis_defaults {
 	TIS_MEM_LEN = 0x5000,
 	TIS_SHORT_TIMEOUT = 750,	/* ms */
 	TIS_LONG_TIMEOUT = 2000,	/* 2 sec */
+	TIS_TIMEOUT_MIN_ATML = 14700,	/* usecs */
+	TIS_TIMEOUT_MAX_ATML = 15000,	/* usecs */
 };
 
 /* Some timeout values are needed before it is known whether the chip is
@@ -98,6 +100,8 @@ struct tpm_tis_data {
 	wait_queue_head_t read_queue;
 	const struct tpm_tis_phy_ops *phy_ops;
 	unsigned short rng_quality;
+	unsigned int timeout_min; /* usecs */
+	unsigned int timeout_max; /* usecs */
 };
 
 struct tpm_tis_phy_ops {
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index 804a3f69bbd9..95c3069823f9 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -262,6 +262,7 @@ enum tpm2_cc_attrs {
 #define TPM_VID_INTEL    0x8086
 #define TPM_VID_WINBOND  0x1050
 #define TPM_VID_STM      0x104A
+#define TPM_VID_ATML     0x1114
 
 enum tpm_chip_flags {
 	TPM_CHIP_FLAG_TPM2		= BIT(1),

From 227efdda51b4eddd10a0a5f29c0dae3eecfd265d Mon Sep 17 00:00:00 2001
From: Mark Brown <broonie@kernel.org>
Date: Fri, 24 Sep 2021 15:41:11 +0100
Subject: [PATCH 1507/1750] tpm_tis_spi: Add missing SPI ID

[ Upstream commit 7eba41fe8c7bb01ff3d4b757bd622375792bc720 ]

In commit c46ed2281bbe ("tpm_tis_spi: add missing SPI device ID entries")
we added SPI IDs for all the DT aliases to handle the fact that we always
use SPI modaliases to load modules even when probed via DT however the
mentioned commit missed that the SPI and OF device ID entries did not
match and were different and so DT nodes with compatible
"tcg,tpm_tis-spi" will not match.  Add an extra ID for tpm_tis-spi
rather than just fix the existing one since what's currently there is
going to be better for anyone actually using SPI IDs to instantiate.

Fixes: c46ed2281bbe ("tpm_tis_spi: add missing SPI device ID entries")
Fixes: 96c8395e2166 ("spi: Revert modalias changes")
Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_tis_spi_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c
index de4209003a44..d64bea3298a2 100644
--- a/drivers/char/tpm/tpm_tis_spi_main.c
+++ b/drivers/char/tpm/tpm_tis_spi_main.c
@@ -263,6 +263,7 @@ static const struct spi_device_id tpm_tis_spi_id[] = {
 	{ "st33htpm-spi", (unsigned long)tpm_tis_spi_probe },
 	{ "slb9670", (unsigned long)tpm_tis_spi_probe },
 	{ "tpm_tis_spi", (unsigned long)tpm_tis_spi_probe },
+	{ "tpm_tis-spi", (unsigned long)tpm_tis_spi_probe },
 	{ "cr50", (unsigned long)cr50_spi_probe },
 	{}
 };

From 3925134eff295ff12b2ca0ebd874eb058df5f21b Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Tue, 26 Oct 2021 03:08:26 +0200
Subject: [PATCH 1508/1750] libbpf: Fix endianness detection in
 BPF_CORE_READ_BITFIELD_PROBED()

[ Upstream commit 45f2bebc8079788f62f22d9e8b2819afb1789d7b ]

__BYTE_ORDER is supposed to be defined by a libc, and __BYTE_ORDER__ -
by a compiler. bpf_core_read.h checks __BYTE_ORDER == __LITTLE_ENDIAN,
which is true if neither are defined, leading to incorrect behavior on
big-endian hosts if libc headers are not included, which is often the
case.

Fixes: ee26dade0e3b ("libbpf: Add support for relocatable bitfields")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20211026010831.748682-2-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/bpf_core_read.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/bpf_core_read.h b/tools/lib/bpf/bpf_core_read.h
index 4538ed762a20..f05cfc082915 100644
--- a/tools/lib/bpf/bpf_core_read.h
+++ b/tools/lib/bpf/bpf_core_read.h
@@ -40,7 +40,7 @@ enum bpf_enum_value_kind {
 #define __CORE_RELO(src, field, info)					      \
 	__builtin_preserve_field_info((src)->field, BPF_FIELD_##info)
 
-#if __BYTE_ORDER == __LITTLE_ENDIAN
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
 #define __CORE_BITFIELD_PROBE_READ(dst, src, fld)			      \
 	bpf_probe_read_kernel(						      \
 			(void *)dst,				      \

From 5b7b4afead622a8ee80eb820d7150f02d7a7628f Mon Sep 17 00:00:00 2001
From: Jon Maxwell <jmaxwell37@gmail.com>
Date: Mon, 25 Oct 2021 10:59:03 +1100
Subject: [PATCH 1509/1750] tcp: don't free a FIN sk_buff in
 tcp_remove_empty_skb()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit cf12e6f9124629b18a6182deefc0315f0a73a199 ]

v1: Implement a more general statement as recommended by Eric Dumazet. The
sequence number will be advanced, so this check will fix the FIN case and
other cases.

A customer reported sockets stuck in the CLOSING state. A Vmcore revealed that
the write_queue was not empty as determined by tcp_write_queue_empty() but the
sk_buff containing the FIN flag had been freed and the socket was zombied in
that state. Corresponding pcaps show no FIN from the Linux kernel on the wire.

Some instrumentation was added to the kernel and it was found that there is a
timing window where tcp_sendmsg() can run after tcp_send_fin().

tcp_sendmsg() will hit an error, for example:

1269 ▹       if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))↩
1270 ▹       ▹       goto do_error;↩

tcp_remove_empty_skb() will then free the FIN sk_buff as "skb->len == 0". The
TCP socket is now wedged in the FIN-WAIT-1 state because the FIN is never sent.

If the other side sends a FIN packet the socket will transition to CLOSING and
remain that way until the system is rebooted.

Fix this by checking for the FIN flag in the sk_buff and don't free it if that
is the case. Testing confirmed that fixed the issue.

Fixes: fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases")
Signed-off-by: Jon Maxwell <jmaxwell37@gmail.com>
Reported-by: Monir Zouaoui <Monir.Zouaoui@mail.schwarz>
Reported-by: Simon Stier <simon.stier@mail.schwarz>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 65eb0a523e3f..e8aca226c4ae 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -956,7 +956,7 @@ int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
  */
 static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
 {
-	if (skb && !skb->len) {
+	if (skb && TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) {
 		tcp_unlink_write_queue(skb, sk);
 		if (tcp_write_queue_empty(sk))
 			tcp_chrono_stop(sk, TCP_CHRONO_BUSY);

From c3ac751944ab8ca89d8b2e33fa58920798a4400c Mon Sep 17 00:00:00 2001
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Date: Mon, 25 Oct 2021 21:56:27 +0100
Subject: [PATCH 1510/1750] spi: spi-rpc-if: Check return value of
 rpcif_sw_init()

[ Upstream commit 0b0a281ed7001d4c4f4c47bdc84680c4997761ca ]

rpcif_sw_init() can fail so make sure we check the return value
of it and on error exit rpcif_spi_probe() callback with error code.

Fixes: eb8d6d464a27 ("spi: add Renesas RPC-IF driver")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20211025205631.21151-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-rpc-if.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/spi/spi-rpc-if.c b/drivers/spi/spi-rpc-if.c
index 3579675485a5..727d7cf0a6ad 100644
--- a/drivers/spi/spi-rpc-if.c
+++ b/drivers/spi/spi-rpc-if.c
@@ -139,7 +139,9 @@ static int rpcif_spi_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	rpc = spi_controller_get_devdata(ctlr);
-	rpcif_sw_init(rpc, parent);
+	error = rpcif_sw_init(rpc, parent);
+	if (error)
+		return error;
 
 	platform_set_drvdata(pdev, ctlr);
 

From 5109802499fb8416a2381d05c90cd74695377251 Mon Sep 17 00:00:00 2001
From: Tiezhu Yang <yangtiezhu@loongson.cn>
Date: Tue, 26 Oct 2021 09:51:28 +0800
Subject: [PATCH 1511/1750] samples/kretprobes: Fix return value if
 register_kretprobe() failed

[ Upstream commit f76fbbbb5061fe14824ba5807c44bd7400a6b4e1 ]

Use the actual return value instead of always -1 if register_kretprobe()
failed.

E.g. without this patch:

 # insmod samples/kprobes/kretprobe_example.ko func=no_such_func
 insmod: ERROR: could not insert module samples/kprobes/kretprobe_example.ko: Operation not permitted

With this patch:

 # insmod samples/kprobes/kretprobe_example.ko func=no_such_func
 insmod: ERROR: could not insert module samples/kprobes/kretprobe_example.ko: Unknown symbol in module

Link: https://lkml.kernel.org/r/1635213091-24387-2-git-send-email-yangtiezhu@loongson.cn

Fixes: 804defea1c02 ("Kprobes: move kprobe examples to samples/")
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/kprobes/kretprobe_example.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/kprobes/kretprobe_example.c b/samples/kprobes/kretprobe_example.c
index 5dc1bf3baa98..228321ecb161 100644
--- a/samples/kprobes/kretprobe_example.c
+++ b/samples/kprobes/kretprobe_example.c
@@ -86,7 +86,7 @@ static int __init kretprobe_init(void)
 	ret = register_kretprobe(&my_kretprobe);
 	if (ret < 0) {
 		pr_err("register_kretprobe failed, returned %d\n", ret);
-		return -1;
+		return ret;
 	}
 	pr_info("Planted return probe at %s: %p\n",
 			my_kretprobe.kp.symbol_name, my_kretprobe.kp.addr);

From 3aa98ef8f7ad7869e4e4afb290aa713bc5380bac Mon Sep 17 00:00:00 2001
From: Janis Schoetterl-Glausch <scgl@linux.ibm.com>
Date: Fri, 22 Oct 2021 17:26:48 +0200
Subject: [PATCH 1512/1750] KVM: s390: Fix handle_sske page fault handling

[ Upstream commit 85f517b29418158d3e6e90c3f0fc01b306d2f1a1 ]

If handle_sske cannot set the storage key, because there is no
page table entry or no present large page entry, it calls
fixup_user_fault.
However, currently, if the call succeeds, handle_sske returns
-EAGAIN, without having set the storage key.
Instead, retry by continue'ing the loop without incrementing the
address.
The same issue in handle_pfmf was fixed by
a11bdb1a6b78 ("KVM: s390: Fix pfmf and conditional skey emulation").

Fixes: bd096f644319 ("KVM: s390: Add skey emulation fault handling")
Signed-off-by: Janis Schoetterl-Glausch <scgl@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Link: https://lore.kernel.org/r/20211022152648.26536-1-scgl@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kvm/priv.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index cd74989ce0b0..3b1a498e58d2 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -397,6 +397,8 @@ static int handle_sske(struct kvm_vcpu *vcpu)
 		mmap_read_unlock(current->mm);
 		if (rc == -EFAULT)
 			return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+		if (rc == -EAGAIN)
+			continue;
 		if (rc < 0)
 			return rc;
 		start += PAGE_SIZE;

From 975c15a19bbc9c1511c4004109fe30721cf8c8ec Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Wed, 20 Oct 2021 20:03:44 +0800
Subject: [PATCH 1513/1750] libertas_tf: Fix possible memory leak in probe and
 disconnect

[ Upstream commit d549107305b4634c81223a853701c06bcf657bc3 ]

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88810a2ddc00 (size 512):
  comm "kworker/6:1", pid 176, jiffies 4295009893 (age 757.220s)
  hex dump (first 32 bytes):
    00 50 05 18 81 88 ff ff 00 00 00 00 00 00 00 00  .P..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
    [<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
    [<ffffffffa02a1530>] if_usb_probe+0x60/0x37c [libertas_tf_usb]
    [<ffffffffa022668a>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
    [<ffffffff82b59630>] really_probe+0x190/0x480
    [<ffffffff82b59a19>] __driver_probe_device+0xf9/0x180
    [<ffffffff82b59af3>] driver_probe_device+0x53/0x130
    [<ffffffff82b5a075>] __device_attach_driver+0x105/0x130
    [<ffffffff82b55949>] bus_for_each_drv+0x129/0x190
    [<ffffffff82b593c9>] __device_attach+0x1c9/0x270
    [<ffffffff82b5a250>] device_initial_probe+0x20/0x30
    [<ffffffff82b579c2>] bus_probe_device+0x142/0x160
    [<ffffffff82b52e49>] device_add+0x829/0x1300
    [<ffffffffa02229b1>] usb_set_configuration+0xb01/0xcc0 [usbcore]
    [<ffffffffa0235c4e>] usb_generic_driver_probe+0x6e/0x90 [usbcore]
    [<ffffffffa022641f>] usb_probe_device+0x6f/0x130 [usbcore]

cardp is missing being freed in the error handling path of the probe
and the path of the disconnect, which will cause memory leak.

This patch adds the missing kfree().

Fixes: c305a19a0d0a ("libertas_tf: usb specific functions")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211020120345.2016045-2-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
index a92916dc81a9..ecce8b56f8a2 100644
--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c
@@ -230,6 +230,7 @@ static int if_usb_probe(struct usb_interface *intf,
 
 dealloc:
 	if_usb_free(cardp);
+	kfree(cardp);
 error:
 lbtf_deb_leave(LBTF_DEB_MAIN);
 	return -ENOMEM;
@@ -254,6 +255,7 @@ static void if_usb_disconnect(struct usb_interface *intf)
 
 	/* Unlink and free urb */
 	if_usb_free(cardp);
+	kfree(cardp);
 
 	usb_set_intfdata(intf, NULL);
 	usb_put_dev(interface_to_usbdev(intf));

From 62d12650b845669b17b6c546f8ce3bfa69bfb55f Mon Sep 17 00:00:00 2001
From: Wang Hai <wanghai38@huawei.com>
Date: Wed, 20 Oct 2021 20:03:45 +0800
Subject: [PATCH 1514/1750] libertas: Fix possible memory leak in probe and
 disconnect

[ Upstream commit 9692151e2fe7a326bafe99836fd1f20a2cc3a049 ]

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff88812c7d7400 (size 512):
  comm "kworker/6:1", pid 176, jiffies 4295003332 (age 822.830s)
  hex dump (first 32 bytes):
    00 68 1e 04 81 88 ff ff 01 00 00 00 00 00 00 00  .h..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
    [<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
    [<ffffffffa02c9873>] if_usb_probe+0x63/0x446 [usb8xxx]
    [<ffffffffa022668a>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
    [<ffffffff82b59630>] really_probe+0x190/0x480
    [<ffffffff82b59a19>] __driver_probe_device+0xf9/0x180
    [<ffffffff82b59af3>] driver_probe_device+0x53/0x130
    [<ffffffff82b5a075>] __device_attach_driver+0x105/0x130
    [<ffffffff82b55949>] bus_for_each_drv+0x129/0x190
    [<ffffffff82b593c9>] __device_attach+0x1c9/0x270
    [<ffffffff82b5a250>] device_initial_probe+0x20/0x30
    [<ffffffff82b579c2>] bus_probe_device+0x142/0x160
    [<ffffffff82b52e49>] device_add+0x829/0x1300
    [<ffffffffa02229b1>] usb_set_configuration+0xb01/0xcc0 [usbcore]
    [<ffffffffa0235c4e>] usb_generic_driver_probe+0x6e/0x90 [usbcore]
    [<ffffffffa022641f>] usb_probe_device+0x6f/0x130 [usbcore]

cardp is missing being freed in the error handling path of the probe
and the path of the disconnect, which will cause memory leak.

This patch adds the missing kfree().

Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211020120345.2016045-3-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/libertas/if_usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
index 20436a289d5c..5d6dc1dd050d 100644
--- a/drivers/net/wireless/marvell/libertas/if_usb.c
+++ b/drivers/net/wireless/marvell/libertas/if_usb.c
@@ -292,6 +292,7 @@ static int if_usb_probe(struct usb_interface *intf,
 	if_usb_reset_device(cardp);
 dealloc:
 	if_usb_free(cardp);
+	kfree(cardp);
 
 error:
 	return r;
@@ -316,6 +317,7 @@ static void if_usb_disconnect(struct usb_interface *intf)
 
 	/* Unlink and free urb */
 	if_usb_free(cardp);
+	kfree(cardp);
 
 	usb_set_intfdata(intf, NULL);
 	usb_put_dev(interface_to_usbdev(intf));

From 3965cc2e9fddcc57e23c9bfd133bda4711ea6343 Mon Sep 17 00:00:00 2001
From: Benjamin Li <benl@squareup.com>
Date: Fri, 22 Oct 2021 17:15:28 -0700
Subject: [PATCH 1515/1750] wcn36xx: add proper DMA memory barriers in rx path

[ Upstream commit 9bfe38e064af5decba2ffce66a2958ab8b10eaa4 ]

This is essentially exactly following the dma_wmb()/dma_rmb() usage
instructions in Documentation/memory-barriers.txt.

The theoretical races here are:

1. DXE (the DMA Transfer Engine in the Wi-Fi subsystem) seeing the
dxe->ctrl & WCN36xx_DXE_CTRL_VLD write before the dxe->dst_addr_l
write, thus performing DMA into the wrong address.

2. CPU reading dxe->dst_addr_l before DXE unsets dxe->ctrl &
WCN36xx_DXE_CTRL_VLD. This should generally be harmless since DXE
doesn't write dxe->dst_addr_l (no risk of freeing the wrong skb).

Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Benjamin Li <benl@squareup.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211023001528.3077822-1-benl@squareup.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/dxe.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c
index 70c46c327512..cf4eb0fb2815 100644
--- a/drivers/net/wireless/ath/wcn36xx/dxe.c
+++ b/drivers/net/wireless/ath/wcn36xx/dxe.c
@@ -606,6 +606,10 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
 	dxe = ctl->desc;
 
 	while (!(READ_ONCE(dxe->ctrl) & WCN36xx_DXE_CTRL_VLD)) {
+		/* do not read until we own DMA descriptor */
+		dma_rmb();
+
+		/* read/modify DMA descriptor */
 		skb = ctl->skb;
 		dma_addr = dxe->dst_addr_l;
 		ret = wcn36xx_dxe_fill_skb(wcn->dev, ctl, GFP_ATOMIC);
@@ -616,9 +620,15 @@ static int wcn36xx_rx_handle_packets(struct wcn36xx *wcn,
 			dma_unmap_single(wcn->dev, dma_addr, WCN36XX_PKT_SIZE,
 					DMA_FROM_DEVICE);
 			wcn36xx_rx_skb(wcn, skb);
-		} /* else keep old skb not submitted and use it for rx DMA */
+		}
+		/* else keep old skb not submitted and reuse it for rx DMA
+		 * (dropping the packet that it contained)
+		 */
 
+		/* flush descriptor changes before re-marking as valid */
+		dma_wmb();
 		dxe->ctrl = ctrl;
+
 		ctl = ctl->next;
 		dxe = ctl->desc;
 	}

From a586453da90c2211a7f8c227568db434c67f81dd Mon Sep 17 00:00:00 2001
From: Loic Poulain <loic.poulain@linaro.org>
Date: Mon, 25 Oct 2021 10:25:36 +0200
Subject: [PATCH 1516/1750] wcn36xx: Fix discarded frames due to wrong sequence
 number

[ Upstream commit 113f304dbc1627c6ec9d5329d839964095768980 ]

The firmware is offering features such as ARP offload, for which
firmware crafts its own (QoS)packets without waking up the host.
Point is that the sequence numbers generated by the firmware are
not in sync with the host mac80211 layer and can cause packets
such as firmware ARP reponses to be dropped by the AP (too old SN).

To fix this we need to let the firmware manages the sequence
numbers by its own (except for QoS null frames). There is a SN
counter for each QoS queue and one global/baseline counter for
Non-QoS.

Fixes: 84aff52e4f57 ("wcn36xx: Use sequence number allocated by mac80211")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/1635150336-18736-1-git-send-email-loic.poulain@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/wcn36xx/txrx.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c
index c0f51fa13dfa..bbd7194c82e2 100644
--- a/drivers/net/wireless/ath/wcn36xx/txrx.c
+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c
@@ -344,8 +344,6 @@ static void wcn36xx_set_tx_pdu(struct wcn36xx_tx_bd *bd,
 		bd->pdu.mpdu_header_off;
 	bd->pdu.mpdu_len = len;
 	bd->pdu.tid = tid;
-	/* Use seq number generated by mac80211 */
-	bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_HOST;
 }
 
 static inline struct wcn36xx_vif *get_vif_by_addr(struct wcn36xx *wcn,
@@ -442,6 +440,9 @@ static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
 		tid = ieee80211_get_tid(hdr);
 		/* TID->QID is one-to-one mapping */
 		bd->queue_id = tid;
+		bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_DPU_QOS;
+	} else {
+		bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_DPU_NON_QOS;
 	}
 
 	if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT ||
@@ -453,6 +454,8 @@ static void wcn36xx_set_tx_data(struct wcn36xx_tx_bd *bd,
 		/* Don't use a regular queue for null packet (no ampdu) */
 		bd->queue_id = WCN36XX_TX_U_WQ_ID;
 		bd->bd_rate = WCN36XX_BD_RATE_CTRL;
+		if (ieee80211_is_qos_nullfunc(hdr->frame_control))
+			bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_HOST;
 	}
 
 	if (bcast) {
@@ -512,6 +515,8 @@ static void wcn36xx_set_tx_mgmt(struct wcn36xx_tx_bd *bd,
 		bd->queue_id = WCN36XX_TX_U_WQ_ID;
 	*vif_priv = __vif_priv;
 
+	bd->pdu.bd_ssn = WCN36XX_TXBD_SSN_FILL_DPU_NON_QOS;
+
 	wcn36xx_set_tx_pdu(bd,
 			   ieee80211_is_data_qos(hdr->frame_control) ?
 			   sizeof(struct ieee80211_qos_hdr) :

From ae1f588ca1b0c9e2f82c14479e408759a786f701 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Wed, 27 Oct 2021 13:26:19 -0400
Subject: [PATCH 1517/1750] drm/amdgpu/gmc6: fix DMA mask from 44 to 40 bits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 403475be6d8b122c3e6b8a47e075926d7299e5ef ]

The DMA mask on SI parts is 40 bits not 44.  Copy
paste typo.

Fixes: 244511f386ccb9 ("drm/amdgpu: simplify and cleanup setting the dma mask")
Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1762
Acked-by: Christian König <christian.koenig@amd.com>
Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index 95a9117e9564..861d0cc45fc1 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -842,12 +842,12 @@ static int gmc_v6_0_sw_init(void *handle)
 
 	adev->gmc.mc_mask = 0xffffffffffULL;
 
-	r = dma_set_mask_and_coherent(adev->dev, DMA_BIT_MASK(44));
+	r = dma_set_mask_and_coherent(adev->dev, DMA_BIT_MASK(40));
 	if (r) {
 		dev_warn(adev->dev, "No suitable DMA available.\n");
 		return r;
 	}
-	adev->need_swiotlb = drm_need_swiotlb(44);
+	adev->need_swiotlb = drm_need_swiotlb(40);
 
 	r = gmc_v6_0_init_microcode(adev);
 	if (r) {

From 2989a396b891911cafd42465bd35622f5e797013 Mon Sep 17 00:00:00 2001
From: Lorenz Bauer <lmb@cloudflare.com>
Date: Wed, 3 Mar 2021 10:18:14 +0000
Subject: [PATCH 1518/1750] selftests: bpf: Convert sk_lookup ctx access tests
 to PROG_TEST_RUN

[ Upstream commit 509b2937bce90089fd2785db9f27951a3d850c34 ]

Convert the selftests for sk_lookup narrow context access to use
PROG_TEST_RUN instead of creating actual sockets. This ensures that
ctx is populated correctly when using PROG_TEST_RUN.

Assert concrete values since we now control remote_ip and remote_port.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210303101816.36774-4-lmb@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/bpf/prog_tests/sk_lookup.c      | 83 +++++++++++++++----
 .../selftests/bpf/progs/test_sk_lookup.c      | 62 +++++++++-----
 2 files changed, 109 insertions(+), 36 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
index 9ff0412e1fd3..45c82db3c58c 100644
--- a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
@@ -241,6 +241,48 @@ static int make_client(int sotype, const char *ip, int port)
 	return -1;
 }
 
+static __u64 socket_cookie(int fd)
+{
+	__u64 cookie;
+	socklen_t cookie_len = sizeof(cookie);
+
+	if (CHECK(getsockopt(fd, SOL_SOCKET, SO_COOKIE, &cookie, &cookie_len) < 0,
+		  "getsockopt(SO_COOKIE)", "%s\n", strerror(errno)))
+		return 0;
+	return cookie;
+}
+
+static int fill_sk_lookup_ctx(struct bpf_sk_lookup *ctx, const char *local_ip, __u16 local_port,
+			      const char *remote_ip, __u16 remote_port)
+{
+	void *local, *remote;
+	int err;
+
+	memset(ctx, 0, sizeof(*ctx));
+	ctx->local_port = local_port;
+	ctx->remote_port = htons(remote_port);
+
+	if (is_ipv6(local_ip)) {
+		ctx->family = AF_INET6;
+		local = &ctx->local_ip6[0];
+		remote = &ctx->remote_ip6[0];
+	} else {
+		ctx->family = AF_INET;
+		local = &ctx->local_ip4;
+		remote = &ctx->remote_ip4;
+	}
+
+	err = inet_pton(ctx->family, local_ip, local);
+	if (CHECK(err != 1, "inet_pton", "local_ip failed\n"))
+		return 1;
+
+	err = inet_pton(ctx->family, remote_ip, remote);
+	if (CHECK(err != 1, "inet_pton", "remote_ip failed\n"))
+		return 1;
+
+	return 0;
+}
+
 static int send_byte(int fd)
 {
 	ssize_t n;
@@ -1009,18 +1051,27 @@ static void test_drop_on_reuseport(struct test_sk_lookup *skel)
 
 static void run_sk_assign(struct test_sk_lookup *skel,
 			  struct bpf_program *lookup_prog,
-			  const char *listen_ip, const char *connect_ip)
+			  const char *remote_ip, const char *local_ip)
 {
-	int client_fd, peer_fd, server_fds[MAX_SERVERS] = { -1 };
-	struct bpf_link *lookup_link;
+	int server_fds[MAX_SERVERS] = { -1 };
+	struct bpf_sk_lookup ctx;
+	__u64 server_cookie;
 	int i, err;
 
-	lookup_link = attach_lookup_prog(lookup_prog);
-	if (!lookup_link)
+	DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
+		.ctx_in = &ctx,
+		.ctx_size_in = sizeof(ctx),
+		.ctx_out = &ctx,
+		.ctx_size_out = sizeof(ctx),
+	);
+
+	if (fill_sk_lookup_ctx(&ctx, local_ip, EXT_PORT, remote_ip, INT_PORT))
 		return;
 
+	ctx.protocol = IPPROTO_TCP;
+
 	for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
-		server_fds[i] = make_server(SOCK_STREAM, listen_ip, 0, NULL);
+		server_fds[i] = make_server(SOCK_STREAM, local_ip, 0, NULL);
 		if (server_fds[i] < 0)
 			goto close_servers;
 
@@ -1030,23 +1081,25 @@ static void run_sk_assign(struct test_sk_lookup *skel,
 			goto close_servers;
 	}
 
-	client_fd = make_client(SOCK_STREAM, connect_ip, EXT_PORT);
-	if (client_fd < 0)
+	server_cookie = socket_cookie(server_fds[SERVER_B]);
+	if (!server_cookie)
+		return;
+
+	err = bpf_prog_test_run_opts(bpf_program__fd(lookup_prog), &opts);
+	if (CHECK(err, "test_run", "failed with error %d\n", errno))
 		goto close_servers;
 
-	peer_fd = accept(server_fds[SERVER_B], NULL, NULL);
-	if (CHECK(peer_fd < 0, "accept", "failed\n"))
-		goto close_client;
+	if (CHECK(ctx.cookie == 0, "ctx.cookie", "no socket selected\n"))
+		goto close_servers;
+
+	CHECK(ctx.cookie != server_cookie, "ctx.cookie",
+	      "selected sk %llu instead of %llu\n", ctx.cookie, server_cookie);
 
-	close(peer_fd);
-close_client:
-	close(client_fd);
 close_servers:
 	for (i = 0; i < ARRAY_SIZE(server_fds); i++) {
 		if (server_fds[i] != -1)
 			close(server_fds[i]);
 	}
-	bpf_link__destroy(lookup_link);
 }
 
 static void run_sk_assign_v4(struct test_sk_lookup *skel,
diff --git a/tools/testing/selftests/bpf/progs/test_sk_lookup.c b/tools/testing/selftests/bpf/progs/test_sk_lookup.c
index 1032b292af5b..ac6f7f205e25 100644
--- a/tools/testing/selftests/bpf/progs/test_sk_lookup.c
+++ b/tools/testing/selftests/bpf/progs/test_sk_lookup.c
@@ -64,6 +64,10 @@ static const int PROG_DONE = 1;
 static const __u32 KEY_SERVER_A = SERVER_A;
 static const __u32 KEY_SERVER_B = SERVER_B;
 
+static const __u16 SRC_PORT = bpf_htons(8008);
+static const __u32 SRC_IP4 = IP4(127, 0, 0, 2);
+static const __u32 SRC_IP6[] = IP6(0xfd000000, 0x0, 0x0, 0x00000002);
+
 static const __u16 DST_PORT = 7007; /* Host byte order */
 static const __u32 DST_IP4 = IP4(127, 0, 0, 1);
 static const __u32 DST_IP6[] = IP6(0xfd000000, 0x0, 0x0, 0x00000001);
@@ -398,11 +402,12 @@ int ctx_narrow_access(struct bpf_sk_lookup *ctx)
 	if (LSW(ctx->protocol, 0) != IPPROTO_TCP)
 		return SK_DROP;
 
-	/* Narrow loads from remote_port field. Expect non-0 value. */
-	if (LSB(ctx->remote_port, 0) == 0 && LSB(ctx->remote_port, 1) == 0 &&
-	    LSB(ctx->remote_port, 2) == 0 && LSB(ctx->remote_port, 3) == 0)
+	/* Narrow loads from remote_port field. Expect SRC_PORT. */
+	if (LSB(ctx->remote_port, 0) != ((SRC_PORT >> 0) & 0xff) ||
+	    LSB(ctx->remote_port, 1) != ((SRC_PORT >> 8) & 0xff) ||
+	    LSB(ctx->remote_port, 2) != 0 || LSB(ctx->remote_port, 3) != 0)
 		return SK_DROP;
-	if (LSW(ctx->remote_port, 0) == 0)
+	if (LSW(ctx->remote_port, 0) != SRC_PORT)
 		return SK_DROP;
 
 	/* Narrow loads from local_port field. Expect DST_PORT. */
@@ -415,11 +420,14 @@ int ctx_narrow_access(struct bpf_sk_lookup *ctx)
 
 	/* Narrow loads from IPv4 fields */
 	if (v4) {
-		/* Expect non-0.0.0.0 in remote_ip4 */
-		if (LSB(ctx->remote_ip4, 0) == 0 && LSB(ctx->remote_ip4, 1) == 0 &&
-		    LSB(ctx->remote_ip4, 2) == 0 && LSB(ctx->remote_ip4, 3) == 0)
+		/* Expect SRC_IP4 in remote_ip4 */
+		if (LSB(ctx->remote_ip4, 0) != ((SRC_IP4 >> 0) & 0xff) ||
+		    LSB(ctx->remote_ip4, 1) != ((SRC_IP4 >> 8) & 0xff) ||
+		    LSB(ctx->remote_ip4, 2) != ((SRC_IP4 >> 16) & 0xff) ||
+		    LSB(ctx->remote_ip4, 3) != ((SRC_IP4 >> 24) & 0xff))
 			return SK_DROP;
-		if (LSW(ctx->remote_ip4, 0) == 0 && LSW(ctx->remote_ip4, 1) == 0)
+		if (LSW(ctx->remote_ip4, 0) != ((SRC_IP4 >> 0) & 0xffff) ||
+		    LSW(ctx->remote_ip4, 1) != ((SRC_IP4 >> 16) & 0xffff))
 			return SK_DROP;
 
 		/* Expect DST_IP4 in local_ip4 */
@@ -448,20 +456,32 @@ int ctx_narrow_access(struct bpf_sk_lookup *ctx)
 
 	/* Narrow loads from IPv6 fields */
 	if (!v4) {
-		/* Expect non-:: IP in remote_ip6 */
-		if (LSB(ctx->remote_ip6[0], 0) == 0 && LSB(ctx->remote_ip6[0], 1) == 0 &&
-		    LSB(ctx->remote_ip6[0], 2) == 0 && LSB(ctx->remote_ip6[0], 3) == 0 &&
-		    LSB(ctx->remote_ip6[1], 0) == 0 && LSB(ctx->remote_ip6[1], 1) == 0 &&
-		    LSB(ctx->remote_ip6[1], 2) == 0 && LSB(ctx->remote_ip6[1], 3) == 0 &&
-		    LSB(ctx->remote_ip6[2], 0) == 0 && LSB(ctx->remote_ip6[2], 1) == 0 &&
-		    LSB(ctx->remote_ip6[2], 2) == 0 && LSB(ctx->remote_ip6[2], 3) == 0 &&
-		    LSB(ctx->remote_ip6[3], 0) == 0 && LSB(ctx->remote_ip6[3], 1) == 0 &&
-		    LSB(ctx->remote_ip6[3], 2) == 0 && LSB(ctx->remote_ip6[3], 3) == 0)
+		/* Expect SRC_IP6 in remote_ip6 */
+		if (LSB(ctx->remote_ip6[0], 0) != ((SRC_IP6[0] >> 0) & 0xff) ||
+		    LSB(ctx->remote_ip6[0], 1) != ((SRC_IP6[0] >> 8) & 0xff) ||
+		    LSB(ctx->remote_ip6[0], 2) != ((SRC_IP6[0] >> 16) & 0xff) ||
+		    LSB(ctx->remote_ip6[0], 3) != ((SRC_IP6[0] >> 24) & 0xff) ||
+		    LSB(ctx->remote_ip6[1], 0) != ((SRC_IP6[1] >> 0) & 0xff) ||
+		    LSB(ctx->remote_ip6[1], 1) != ((SRC_IP6[1] >> 8) & 0xff) ||
+		    LSB(ctx->remote_ip6[1], 2) != ((SRC_IP6[1] >> 16) & 0xff) ||
+		    LSB(ctx->remote_ip6[1], 3) != ((SRC_IP6[1] >> 24) & 0xff) ||
+		    LSB(ctx->remote_ip6[2], 0) != ((SRC_IP6[2] >> 0) & 0xff) ||
+		    LSB(ctx->remote_ip6[2], 1) != ((SRC_IP6[2] >> 8) & 0xff) ||
+		    LSB(ctx->remote_ip6[2], 2) != ((SRC_IP6[2] >> 16) & 0xff) ||
+		    LSB(ctx->remote_ip6[2], 3) != ((SRC_IP6[2] >> 24) & 0xff) ||
+		    LSB(ctx->remote_ip6[3], 0) != ((SRC_IP6[3] >> 0) & 0xff) ||
+		    LSB(ctx->remote_ip6[3], 1) != ((SRC_IP6[3] >> 8) & 0xff) ||
+		    LSB(ctx->remote_ip6[3], 2) != ((SRC_IP6[3] >> 16) & 0xff) ||
+		    LSB(ctx->remote_ip6[3], 3) != ((SRC_IP6[3] >> 24) & 0xff))
 			return SK_DROP;
-		if (LSW(ctx->remote_ip6[0], 0) == 0 && LSW(ctx->remote_ip6[0], 1) == 0 &&
-		    LSW(ctx->remote_ip6[1], 0) == 0 && LSW(ctx->remote_ip6[1], 1) == 0 &&
-		    LSW(ctx->remote_ip6[2], 0) == 0 && LSW(ctx->remote_ip6[2], 1) == 0 &&
-		    LSW(ctx->remote_ip6[3], 0) == 0 && LSW(ctx->remote_ip6[3], 1) == 0)
+		if (LSW(ctx->remote_ip6[0], 0) != ((SRC_IP6[0] >> 0) & 0xffff) ||
+		    LSW(ctx->remote_ip6[0], 1) != ((SRC_IP6[0] >> 16) & 0xffff) ||
+		    LSW(ctx->remote_ip6[1], 0) != ((SRC_IP6[1] >> 0) & 0xffff) ||
+		    LSW(ctx->remote_ip6[1], 1) != ((SRC_IP6[1] >> 16) & 0xffff) ||
+		    LSW(ctx->remote_ip6[2], 0) != ((SRC_IP6[2] >> 0) & 0xffff) ||
+		    LSW(ctx->remote_ip6[2], 1) != ((SRC_IP6[2] >> 16) & 0xffff) ||
+		    LSW(ctx->remote_ip6[3], 0) != ((SRC_IP6[3] >> 0) & 0xffff) ||
+		    LSW(ctx->remote_ip6[3], 1) != ((SRC_IP6[3] >> 16) & 0xffff))
 			return SK_DROP;
 		/* Expect DST_IP6 in local_ip6 */
 		if (LSB(ctx->local_ip6[0], 0) != ((DST_IP6[0] >> 0) & 0xff) ||

From b17f424f88bad19282fc607ac654e88b51d03796 Mon Sep 17 00:00:00 2001
From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Date: Thu, 28 Oct 2021 12:05:00 +0530
Subject: [PATCH 1519/1750] selftests/bpf: Fix fd cleanup in sk_lookup test

[ Upstream commit c3fc706e94f5653def2783ffcd809a38676b7551 ]

Similar to the fix in commit:
e31eec77e4ab ("bpf: selftests: Fix fd cleanup in get_branch_snapshot")

We use designated initializer to set fds to -1 without breaking on
future changes to MAX_SERVER constant denoting the array size.

The particular close(0) occurs on non-reuseport tests, so it can be seen
with -n 115/{2,3} but not 115/4. This can cause problems with future
tests if they depend on BTF fd never being acquired as fd 0, breaking
internal libbpf assumptions.

Fixes: 0ab5539f8584 ("selftests/bpf: Tests for BPF_SK_LOOKUP attach point")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20211028063501.2239335-8-memxor@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/prog_tests/sk_lookup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
index 45c82db3c58c..b4c9f4a96ae4 100644
--- a/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
+++ b/tools/testing/selftests/bpf/prog_tests/sk_lookup.c
@@ -598,7 +598,7 @@ static void query_lookup_prog(struct test_sk_lookup *skel)
 
 static void run_lookup_prog(const struct test *t)
 {
-	int server_fds[MAX_SERVERS] = { -1 };
+	int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 };
 	int client_fd, reuse_conn_fd = -1;
 	struct bpf_link *lookup_link;
 	int i, err;
@@ -1053,7 +1053,7 @@ static void run_sk_assign(struct test_sk_lookup *skel,
 			  struct bpf_program *lookup_prog,
 			  const char *remote_ip, const char *local_ip)
 {
-	int server_fds[MAX_SERVERS] = { -1 };
+	int server_fds[] = { [0 ... MAX_SERVERS - 1] = -1 };
 	struct bpf_sk_lookup ctx;
 	__u64 server_cookie;
 	int i, err;

From 08449a5c0e56373847857cc20e2ea22a61bd6600 Mon Sep 17 00:00:00 2001
From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Date: Wed, 27 Oct 2021 15:27:27 +0530
Subject: [PATCH 1520/1750] net: amd-xgbe: Toggle PLL settings during rate
 change

[ Upstream commit daf182d360e509a494db18666799f4e85d83dda0 ]

For each rate change command submission, the FW has to do a phy
power off sequence internally. For this to happen correctly, the
PLL re-initialization control setting has to be turned off before
sending mailbox commands and re-enabled once the command submission
is complete.

Without the PLL control setting, the link up takes longer time in a
fixed phy configuration.

Fixes: 47f164deab22 ("amd-xgbe: Add PCI device support")
Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/xgbe/xgbe-common.h |  8 ++++++++
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 20 +++++++++++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
index b2cd3bdba9f8..533b8519ec35 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
@@ -1331,6 +1331,10 @@
 #define MDIO_VEND2_PMA_CDR_CONTROL	0x8056
 #endif
 
+#ifndef MDIO_VEND2_PMA_MISC_CTRL0
+#define MDIO_VEND2_PMA_MISC_CTRL0	0x8090
+#endif
+
 #ifndef MDIO_CTRL1_SPEED1G
 #define MDIO_CTRL1_SPEED1G		(MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
 #endif
@@ -1389,6 +1393,10 @@
 #define XGBE_PMA_RX_RST_0_RESET_ON	0x10
 #define XGBE_PMA_RX_RST_0_RESET_OFF	0x00
 
+#define XGBE_PMA_PLL_CTRL_MASK		BIT(15)
+#define XGBE_PMA_PLL_CTRL_ENABLE	BIT(15)
+#define XGBE_PMA_PLL_CTRL_DISABLE	0x0000
+
 /* Bit setting and getting macros
  *  The get macro will extract the current bit field value from within
  *  the variable
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
index 18e48b3bc402..213769054391 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
@@ -1977,12 +1977,26 @@ static void xgbe_phy_rx_reset(struct xgbe_prv_data *pdata)
 	}
 }
 
+static void xgbe_phy_pll_ctrl(struct xgbe_prv_data *pdata, bool enable)
+{
+	XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_MISC_CTRL0,
+			 XGBE_PMA_PLL_CTRL_MASK,
+			 enable ? XGBE_PMA_PLL_CTRL_ENABLE
+				: XGBE_PMA_PLL_CTRL_DISABLE);
+
+	/* Wait for command to complete */
+	usleep_range(100, 200);
+}
+
 static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
 					unsigned int cmd, unsigned int sub_cmd)
 {
 	unsigned int s0 = 0;
 	unsigned int wait;
 
+	/* Disable PLL re-initialization during FW command processing */
+	xgbe_phy_pll_ctrl(pdata, false);
+
 	/* Log if a previous command did not complete */
 	if (XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS)) {
 		netif_dbg(pdata, link, pdata->netdev,
@@ -2003,7 +2017,7 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
 	wait = XGBE_RATECHANGE_COUNT;
 	while (wait--) {
 		if (!XP_IOREAD_BITS(pdata, XP_DRIVER_INT_RO, STATUS))
-			return;
+			goto reenable_pll;
 
 		usleep_range(1000, 2000);
 	}
@@ -2013,6 +2027,10 @@ static void xgbe_phy_perform_ratechange(struct xgbe_prv_data *pdata,
 
 	/* Reset on error */
 	xgbe_phy_rx_reset(pdata);
+
+reenable_pll:
+	/* Enable PLL re-initialization */
+	xgbe_phy_pll_ctrl(pdata, true);
 }
 
 static void xgbe_phy_rrc(struct xgbe_prv_data *pdata)

From fb41b8f5e855794f180f0f8a118abeb662436a07 Mon Sep 17 00:00:00 2001
From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
Date: Thu, 28 Oct 2021 15:55:34 +0100
Subject: [PATCH 1521/1750] net: phylink: avoid mvneta warning when setting
 pause parameters

[ Upstream commit fd8d9731bcdfb22d28e45bce789bcb211c868c78 ]

mvneta does not support asymetric pause modes, and it flags this by the
lack of AsymPause in the supported field. When setting pause modes, we
check that pause->rx_pause == pause->tx_pause, but only when pause
autoneg is enabled. When pause autoneg is disabled, we still allow
pause->rx_pause != pause->tx_pause, which is incorrect when the MAC
does not support asymetric pause, and causes mvneta to issue a warning.

Fix this by removing the test for pause->autoneg, so we always check
that pause->rx_pause == pause->tx_pause for network devices that do not
support AsymPause.

Fixes: 9525ae83959b ("phylink: add phylink infrastructure")
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phylink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 025c3246f339..899496f089d2 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -1610,7 +1610,7 @@ int phylink_ethtool_set_pauseparam(struct phylink *pl,
 		return -EOPNOTSUPP;
 
 	if (!phylink_test(pl->supported, Asym_Pause) &&
-	    !pause->autoneg && pause->rx_pause != pause->tx_pause)
+	    pause->rx_pause != pause->tx_pause)
 		return -EINVAL;
 
 	pause_state = 0;

From 71ec65c7000425b2d7570a78ed9f42e3844169b1 Mon Sep 17 00:00:00 2001
From: Daniel Jordan <daniel.m.jordan@oracle.com>
Date: Thu, 21 Oct 2021 14:30:28 -0400
Subject: [PATCH 1522/1750] crypto: pcrypt - Delay write to padata->info

[ Upstream commit 68b6dea802cea0dbdd8bd7ccc60716b5a32a5d8a ]

These three events can race when pcrypt is used multiple times in a
template ("pcrypt(pcrypt(...))"):

  1.  [taskA] The caller makes the crypto request via crypto_aead_encrypt()
  2.  [kworkerB] padata serializes the inner pcrypt request
  3.  [kworkerC] padata serializes the outer pcrypt request

3 might finish before the call to crypto_aead_encrypt() returns in 1,
resulting in two possible issues.

First, a use-after-free of the crypto request's memory when, for
example, taskA writes to the outer pcrypt request's padata->info in
pcrypt_aead_enc() after kworkerC completes the request.

Second, the outer pcrypt request overwrites the inner pcrypt request's
return code with -EINPROGRESS, making a successful request appear to
fail.  For instance, kworkerB writes the outer pcrypt request's
padata->info in pcrypt_aead_done() and then taskA overwrites it
in pcrypt_aead_enc().

Avoid both situations by delaying the write of padata->info until after
the inner crypto request's return code is checked.  This prevents the
use-after-free by not touching the crypto request's memory after the
next-inner crypto request is made, and stops padata->info from being
overwritten.

Fixes: 5068c7a883d16 ("crypto: pcrypt - Add pcrypt crypto parallelization wrapper")
Reported-by: syzbot+b187b77c8474f9648fae@syzkaller.appspotmail.com
Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/pcrypt.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
index d569c7ed6c80..9d10b846ccf7 100644
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -78,12 +78,14 @@ static void pcrypt_aead_enc(struct padata_priv *padata)
 {
 	struct pcrypt_request *preq = pcrypt_padata_request(padata);
 	struct aead_request *req = pcrypt_request_ctx(preq);
+	int ret;
 
-	padata->info = crypto_aead_encrypt(req);
+	ret = crypto_aead_encrypt(req);
 
-	if (padata->info == -EINPROGRESS)
+	if (ret == -EINPROGRESS)
 		return;
 
+	padata->info = ret;
 	padata_do_serial(padata);
 }
 
@@ -123,12 +125,14 @@ static void pcrypt_aead_dec(struct padata_priv *padata)
 {
 	struct pcrypt_request *preq = pcrypt_padata_request(padata);
 	struct aead_request *req = pcrypt_request_ctx(preq);
+	int ret;
 
-	padata->info = crypto_aead_decrypt(req);
+	ret = crypto_aead_decrypt(req);
 
-	if (padata->info == -EINPROGRESS)
+	if (ret == -EINPROGRESS)
 		return;
 
+	padata->info = ret;
 	padata_do_serial(padata);
 }
 

From 8f3d88139df8c59f6a5e087f12d58a1ff3f3f531 Mon Sep 17 00:00:00 2001
From: Andrea Righi <andrea.righi@canonical.com>
Date: Tue, 26 Oct 2021 16:34:09 +0200
Subject: [PATCH 1523/1750] selftests/bpf: Fix fclose/pclose mismatch in
 test_progs

[ Upstream commit f48ad69097fe79d1de13c4d8fef556d4c11c5e68 ]

Make sure to use pclose() to properly close the pipe opened by popen().

Fixes: 81f77fd0deeb ("bpf: add selftest for stackmap with BPF_F_STACK_BUILD_ID")
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20211026143409.42666-1-andrea.righi@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_progs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c
index 22943b58d752..4a13477aef9d 100644
--- a/tools/testing/selftests/bpf/test_progs.c
+++ b/tools/testing/selftests/bpf/test_progs.c
@@ -347,7 +347,7 @@ int extract_build_id(char *build_id, size_t size)
 
 	if (getline(&line, &len, fp) == -1)
 		goto err;
-	fclose(fp);
+	pclose(fp);
 
 	if (len > size)
 		len = size;
@@ -356,7 +356,7 @@ int extract_build_id(char *build_id, size_t size)
 	free(line);
 	return 0;
 err:
-	fclose(fp);
+	pclose(fp);
 	return -1;
 }
 

From 366235d4bebc39363ed029176873097c66049954 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Fri, 29 Oct 2021 08:51:34 -0700
Subject: [PATCH 1524/1750] udp6: allow SO_MARK ctrl msg to affect routing

[ Upstream commit 42dcfd850e514b229d616a53dec06d0f2533217c ]

Commit c6af0c227a22 ("ip: support SO_MARK cmsg")
added propagation of SO_MARK from cmsg to skb->mark.
For IPv4 and raw sockets the mark also affects route
lookup, but in case of IPv6 the flow info is
initialized before cmsg is parsed.

Fixes: c6af0c227a22 ("ip: support SO_MARK cmsg")
Reported-and-tested-by: Xintong Hu <huxintong@fb.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/udp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index bae6b51a9bd4..8a1863146f34 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1420,7 +1420,6 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 	if (!fl6.flowi6_oif)
 		fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
 
-	fl6.flowi6_mark = ipc6.sockc.mark;
 	fl6.flowi6_uid = sk->sk_uid;
 
 	if (msg->msg_controllen) {
@@ -1456,6 +1455,7 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 	ipc6.opt = opt;
 
 	fl6.flowi6_proto = sk->sk_protocol;
+	fl6.flowi6_mark = ipc6.sockc.mark;
 	fl6.daddr = *daddr;
 	if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
 		fl6.saddr = np->saddr;

From 5b3f7204197af04b8dc8adea786052e1fa97b1e8 Mon Sep 17 00:00:00 2001
From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Date: Fri, 29 Oct 2021 15:03:14 -0700
Subject: [PATCH 1525/1750] ibmvnic: don't stop queue in xmit

[ Upstream commit 8878e46fcfd46b19964bd90e13b25dd94cbfc9be ]

If adapter's resetting bit is on, discard the packet but don't stop the
transmit queue - instead leave that to the reset code. With this change,
it is possible that we may get several calls to ibmvnic_xmit() that simply
discard packets and return.

But if we stop the queue here, we might end up doing so just after
__ibmvnic_open() started the queues (during a hard/soft reset) and before
the ->resetting bit was cleared. If that happens, there will be no one to
restart queue and transmissions will be blocked indefinitely.

This can cause a TIMEOUT reset and with auto priority failover enabled,
an unnecessary FAILOVER reset to less favored backing device and then a
FAILOVER back to the most favored backing device. If we hit the window
repeatedly, we can get stuck in a loop of TIMEOUT, FAILOVER, FAILOVER
resets leaving the adapter unusable for extended periods of time.

Fixes: 7f5b030830fe ("ibmvnic: Free skb's in cases of failure in transmit")
Reported-by: Abdul Haleem <abdhalee@in.ibm.com>
Reported-by: Vaishnavi Bhat <vaish123@in.ibm.com>
Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Reviewed-by: Dany Madden <drt@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index bb8d0a0f48ee..c470dbc03a23 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -1548,8 +1548,6 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev)
 	netdev_tx_t ret = NETDEV_TX_OK;
 
 	if (test_bit(0, &adapter->resetting)) {
-		if (!netif_subqueue_stopped(netdev, skb))
-			netif_stop_subqueue(netdev, queue_num);
 		dev_kfree_skb_any(skb);
 
 		tx_send_failed++;

From a3fdcd16b138c2f680f4949b0ed646e9d34b1eed Mon Sep 17 00:00:00 2001
From: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Date: Fri, 29 Oct 2021 15:03:15 -0700
Subject: [PATCH 1526/1750] ibmvnic: Process crqs after enabling interrupts

[ Upstream commit 6e20d00158f31f7631d68b86996b7e951c4451c8 ]

Soon after registering a CRQ it is possible that we get a fail over or
maybe a CRQ_INIT from the VIOS while interrupts were disabled.

Look for any such CRQs after enabling interrupts.

Otherwise we can intermittently fail to bring up ibmvnic adapters during
boot, specially in kexec/kdump kernels.

Fixes: 032c5e82847a ("Driver for IBM System i/p VNIC protocol")
Reported-by: Vaishnavi Bhat <vaish123@in.ibm.com>
Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.ibm.com>
Reviewed-by: Dany Madden <drt@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index c470dbc03a23..4f99d9763824 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -5185,6 +5185,9 @@ static int init_crq_queue(struct ibmvnic_adapter *adapter)
 	crq->cur = 0;
 	spin_lock_init(&crq->lock);
 
+	/* process any CRQs that were queued before we enabled interrupts */
+	tasklet_schedule(&adapter->tasklet);
+
 	return retrc;
 
 req_irq_failed:

From 9308f9c9c7a562e51abcbd4a32d0d30e2f01c384 Mon Sep 17 00:00:00 2001
From: Dan Schatzberg <schatzberg.dan@gmail.com>
Date: Thu, 28 Oct 2021 15:15:27 -0700
Subject: [PATCH 1527/1750] cgroup: Fix rootcg cpu.stat guest double counting

[ Upstream commit 81c49d39aea8a10e6d05d3aa1cb65ceb721e19b0 ]

In account_guest_time in kernel/sched/cputime.c guest time is
attributed to both CPUTIME_NICE and CPUTIME_USER in addition to
CPUTIME_GUEST_NICE and CPUTIME_GUEST respectively. Therefore, adding
both to calculate usage results in double counting any guest time at
the rootcg.

Fixes: 936f2a70f207 ("cgroup: add cpu.stat file to root cgroup")
Signed-off-by: Dan Schatzberg <schatzberg.dan@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/rstat.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/kernel/cgroup/rstat.c b/kernel/cgroup/rstat.c
index d51175cedfca..89ca9b61aa0d 100644
--- a/kernel/cgroup/rstat.c
+++ b/kernel/cgroup/rstat.c
@@ -421,8 +421,6 @@ static void root_cgroup_cputime(struct task_cputime *cputime)
 		cputime->sum_exec_runtime += user;
 		cputime->sum_exec_runtime += sys;
 		cputime->sum_exec_runtime += cpustat[CPUTIME_STEAL];
-		cputime->sum_exec_runtime += cpustat[CPUTIME_GUEST];
-		cputime->sum_exec_runtime += cpustat[CPUTIME_GUEST_NICE];
 	}
 }
 

From 84dde8c8c9335213f091977eb1e935f3f38da71c Mon Sep 17 00:00:00 2001
From: Alexei Starovoitov <ast@kernel.org>
Date: Mon, 1 Nov 2021 15:21:51 -0700
Subject: [PATCH 1528/1750] bpf: Fix propagation of bounds from 64-bit min/max
 into 32-bit and var_off.

[ Upstream commit b9979db8340154526d9ab38a1883d6f6ba9b6d47 ]

Before this fix:
166: (b5) if r2 <= 0x1 goto pc+22
from 166 to 189: R2=invP(id=1,umax_value=1,var_off=(0x0; 0xffffffff))

After this fix:
166: (b5) if r2 <= 0x1 goto pc+22
from 166 to 189: R2=invP(id=1,umax_value=1,var_off=(0x0; 0x1))

While processing BPF_JLE the reg_set_min_max() would set true_reg->umax_value = 1
and call __reg_combine_64_into_32(true_reg).

Without the fix it would not pass the condition:
if (__reg64_bound_u32(reg->umin_value) && __reg64_bound_u32(reg->umax_value))

since umin_value == 0 at this point.
Before commit 10bf4e83167c the umin was incorrectly ingored.
The commit 10bf4e83167c fixed the correctness issue, but pessimized
propagation of 64-bit min max into 32-bit min max and corresponding var_off.

Fixes: 10bf4e83167c ("bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20211101222153.78759-1-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/verifier.c                               | 2 +-
 tools/testing/selftests/bpf/verifier/array_access.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 0c26757ea7fb..c56739a4a421 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1303,7 +1303,7 @@ static bool __reg64_bound_s32(s64 a)
 
 static bool __reg64_bound_u32(u64 a)
 {
-	return a > U32_MIN && a < U32_MAX;
+	return a >= U32_MIN && a <= U32_MAX;
 }
 
 static void __reg_combine_64_into_32(struct bpf_reg_state *reg)
diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c
index 1b1c798e9248..1b138cd2b187 100644
--- a/tools/testing/selftests/bpf/verifier/array_access.c
+++ b/tools/testing/selftests/bpf/verifier/array_access.c
@@ -186,7 +186,7 @@
 	},
 	.fixup_map_hash_48b = { 3 },
 	.errstr_unpriv = "R0 leaks addr",
-	.errstr = "R0 unbounded memory access",
+	.errstr = "invalid access to map value, value_size=48 off=44 size=8",
 	.result_unpriv = REJECT,
 	.result = REJECT,
 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,

From 4a50bc00847635e092f8f447439d8263afaa65ed Mon Sep 17 00:00:00 2001
From: Alexei Starovoitov <ast@kernel.org>
Date: Mon, 1 Nov 2021 15:21:52 -0700
Subject: [PATCH 1529/1750] bpf: Fix propagation of signed bounds from 64-bit
 min/max into 32-bit.

[ Upstream commit 388e2c0b978339dee9b0a81a2e546f8979e021e2 ]

Similar to unsigned bounds propagation fix signed bounds.
The 'Fixes' tag is a hint. There is no security bug here.
The verifier was too conservative.

Fixes: 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20211101222153.78759-2-alexei.starovoitov@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/verifier.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c56739a4a421..a15826a9a644 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1298,7 +1298,7 @@ static void __reg_combine_32_into_64(struct bpf_reg_state *reg)
 
 static bool __reg64_bound_s32(s64 a)
 {
-	return a > S32_MIN && a < S32_MAX;
+	return a >= S32_MIN && a <= S32_MAX;
 }
 
 static bool __reg64_bound_u32(u64 a)

From f84c7a03d1ea9082e5ddd8d7d5605f35a4c7cb83 Mon Sep 17 00:00:00 2001
From: Frank Rowand <frank.rowand@sony.com>
Date: Thu, 28 Oct 2021 20:32:25 -0500
Subject: [PATCH 1530/1750] of: unittest: fix EXPECT text for gpio hog errors

[ Upstream commit e85860e5bc077865a04f0a88d0b0335d3200484a ]

The console message text for gpio hog errors does not match
what unittest expects.

Fixes: f4056e705b2ef ("of: unittest: add overlay gpio test to catch gpio hog problem")
Signed-off-by: Frank Rowand <frank.rowand@sony.com>
Link: https://lore.kernel.org/r/20211029013225.2048695-1-frowand.list@gmail.com
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/of/unittest.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index eb51bc147440..1d4b0b7d0cc1 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -1682,19 +1682,19 @@ static void __init of_unittest_overlay_gpio(void)
 	 */
 
 	EXPECT_BEGIN(KERN_INFO,
-		     "GPIO line <<int>> (line-B-input) hogged as input\n");
+		     "gpio-<<int>> (line-B-input): hogged as input\n");
 
 	EXPECT_BEGIN(KERN_INFO,
-		     "GPIO line <<int>> (line-A-input) hogged as input\n");
+		     "gpio-<<int>> (line-A-input): hogged as input\n");
 
 	ret = platform_driver_register(&unittest_gpio_driver);
 	if (unittest(ret == 0, "could not register unittest gpio driver\n"))
 		return;
 
 	EXPECT_END(KERN_INFO,
-		   "GPIO line <<int>> (line-A-input) hogged as input\n");
+		   "gpio-<<int>> (line-A-input): hogged as input\n");
 	EXPECT_END(KERN_INFO,
-		   "GPIO line <<int>> (line-B-input) hogged as input\n");
+		   "gpio-<<int>> (line-B-input): hogged as input\n");
 
 	unittest(probe_pass_count + 2 == unittest_gpio_probe_pass_count,
 		 "unittest_gpio_probe() failed or not called\n");
@@ -1721,7 +1721,7 @@ static void __init of_unittest_overlay_gpio(void)
 	chip_request_count = unittest_gpio_chip_request_count;
 
 	EXPECT_BEGIN(KERN_INFO,
-		     "GPIO line <<int>> (line-D-input) hogged as input\n");
+		     "gpio-<<int>> (line-D-input): hogged as input\n");
 
 	/* overlay_gpio_03 contains gpio node and child gpio hog node */
 
@@ -1729,7 +1729,7 @@ static void __init of_unittest_overlay_gpio(void)
 		 "Adding overlay 'overlay_gpio_03' failed\n");
 
 	EXPECT_END(KERN_INFO,
-		   "GPIO line <<int>> (line-D-input) hogged as input\n");
+		   "gpio-<<int>> (line-D-input): hogged as input\n");
 
 	unittest(probe_pass_count + 1 == unittest_gpio_probe_pass_count,
 		 "unittest_gpio_probe() failed or not called\n");
@@ -1768,7 +1768,7 @@ static void __init of_unittest_overlay_gpio(void)
 	 */
 
 	EXPECT_BEGIN(KERN_INFO,
-		     "GPIO line <<int>> (line-C-input) hogged as input\n");
+		     "gpio-<<int>> (line-C-input): hogged as input\n");
 
 	/* overlay_gpio_04b contains child gpio hog node */
 
@@ -1776,7 +1776,7 @@ static void __init of_unittest_overlay_gpio(void)
 		 "Adding overlay 'overlay_gpio_04b' failed\n");
 
 	EXPECT_END(KERN_INFO,
-		   "GPIO line <<int>> (line-C-input) hogged as input\n");
+		   "gpio-<<int>> (line-C-input): hogged as input\n");
 
 	unittest(chip_request_count + 1 == unittest_gpio_chip_request_count,
 		 "unittest_gpio_chip_request() called %d times (expected 1 time)\n",

From bfedc817769dc2361ac7c1a473ce5e3e7f789da5 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Wed, 14 Apr 2021 22:54:51 +0300
Subject: [PATCH 1531/1750] iio: st_sensors: Call st_sensors_power_enable()
 from bus drivers

[ Upstream commit 7db4f2cacbede1c6d95552c0d10e77398665a733 ]

In case we would initialize two IIO devices from one physical device,
we shouldn't have a clash on regulators. That's why move
st_sensors_power_enable() call from core to bus drivers.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20210414195454.84183-4-andriy.shevchenko@linux.intel.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/st_accel_core.c       | 21 +++++----------------
 drivers/iio/accel/st_accel_i2c.c        | 19 ++++++++++++++++---
 drivers/iio/accel/st_accel_spi.c        | 19 ++++++++++++++++---
 drivers/iio/gyro/st_gyro_core.c         | 15 +++------------
 drivers/iio/gyro/st_gyro_i2c.c          | 19 ++++++++++++++++---
 drivers/iio/gyro/st_gyro_spi.c          | 19 ++++++++++++++++---
 drivers/iio/magnetometer/st_magn_core.c | 15 +++------------
 drivers/iio/magnetometer/st_magn_i2c.c  | 16 ++++++++++++++--
 drivers/iio/magnetometer/st_magn_spi.c  | 16 ++++++++++++++--
 drivers/iio/pressure/st_pressure_core.c | 15 +++------------
 drivers/iio/pressure/st_pressure_i2c.c  | 19 ++++++++++++++++---
 drivers/iio/pressure/st_pressure_spi.c  | 19 ++++++++++++++++---
 12 files changed, 138 insertions(+), 74 deletions(-)

diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c
index 43c50167d220..bde0ca3ef7a4 100644
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -1255,13 +1255,9 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &accel_info;
 
-	err = st_sensors_power_enable(indio_dev);
-	if (err)
-		return err;
-
 	err = st_sensors_verify_id(indio_dev);
 	if (err < 0)
-		goto st_accel_power_off;
+		return err;
 
 	adata->num_data_channels = ST_ACCEL_NUMBER_DATA_CHANNELS;
 	indio_dev->num_channels = ST_SENSORS_NUMBER_ALL_CHANNELS;
@@ -1270,10 +1266,8 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
 	channels = devm_kmemdup(&indio_dev->dev,
 				adata->sensor_settings->ch,
 				channels_size, GFP_KERNEL);
-	if (!channels) {
-		err = -ENOMEM;
-		goto st_accel_power_off;
-	}
+	if (!channels)
+		return -ENOMEM;
 
 	if (apply_acpi_orientation(indio_dev, channels))
 		dev_warn(&indio_dev->dev,
@@ -1288,11 +1282,11 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
 
 	err = st_sensors_init_sensor(indio_dev, pdata);
 	if (err < 0)
-		goto st_accel_power_off;
+		return err;
 
 	err = st_accel_allocate_ring(indio_dev);
 	if (err < 0)
-		goto st_accel_power_off;
+		return err;
 
 	if (adata->irq > 0) {
 		err = st_sensors_allocate_trigger(indio_dev,
@@ -1315,9 +1309,6 @@ int st_accel_common_probe(struct iio_dev *indio_dev)
 		st_sensors_deallocate_trigger(indio_dev);
 st_accel_probe_trigger_error:
 	st_accel_deallocate_ring(indio_dev);
-st_accel_power_off:
-	st_sensors_power_disable(indio_dev);
-
 	return err;
 }
 EXPORT_SYMBOL(st_accel_common_probe);
@@ -1326,8 +1317,6 @@ void st_accel_common_remove(struct iio_dev *indio_dev)
 {
 	struct st_sensor_data *adata = iio_priv(indio_dev);
 
-	st_sensors_power_disable(indio_dev);
-
 	iio_device_unregister(indio_dev);
 	if (adata->irq > 0)
 		st_sensors_deallocate_trigger(indio_dev);
diff --git a/drivers/iio/accel/st_accel_i2c.c b/drivers/iio/accel/st_accel_i2c.c
index 360e16f2cadb..95e305b88d5e 100644
--- a/drivers/iio/accel/st_accel_i2c.c
+++ b/drivers/iio/accel/st_accel_i2c.c
@@ -174,16 +174,29 @@ static int st_accel_i2c_probe(struct i2c_client *client)
 	if (ret < 0)
 		return ret;
 
-	ret = st_accel_common_probe(indio_dev);
-	if (ret < 0)
+	ret = st_sensors_power_enable(indio_dev);
+	if (ret)
 		return ret;
 
+	ret = st_accel_common_probe(indio_dev);
+	if (ret < 0)
+		goto st_accel_power_off;
+
 	return 0;
+
+st_accel_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return ret;
 }
 
 static int st_accel_i2c_remove(struct i2c_client *client)
 {
-	st_accel_common_remove(i2c_get_clientdata(client));
+	struct iio_dev *indio_dev = i2c_get_clientdata(client);
+
+	st_sensors_power_disable(indio_dev);
+
+	st_accel_common_remove(indio_dev);
 
 	return 0;
 }
diff --git a/drivers/iio/accel/st_accel_spi.c b/drivers/iio/accel/st_accel_spi.c
index 568ff1bae0ee..83d3308ce5cc 100644
--- a/drivers/iio/accel/st_accel_spi.c
+++ b/drivers/iio/accel/st_accel_spi.c
@@ -123,16 +123,29 @@ static int st_accel_spi_probe(struct spi_device *spi)
 	if (err < 0)
 		return err;
 
-	err = st_accel_common_probe(indio_dev);
-	if (err < 0)
+	err = st_sensors_power_enable(indio_dev);
+	if (err)
 		return err;
 
+	err = st_accel_common_probe(indio_dev);
+	if (err < 0)
+		goto st_accel_power_off;
+
 	return 0;
+
+st_accel_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return err;
 }
 
 static int st_accel_spi_remove(struct spi_device *spi)
 {
-	st_accel_common_remove(spi_get_drvdata(spi));
+	struct iio_dev *indio_dev = spi_get_drvdata(spi);
+
+	st_sensors_power_disable(indio_dev);
+
+	st_accel_common_remove(indio_dev);
 
 	return 0;
 }
diff --git a/drivers/iio/gyro/st_gyro_core.c b/drivers/iio/gyro/st_gyro_core.c
index c8aa051995d3..8c87f85f20bd 100644
--- a/drivers/iio/gyro/st_gyro_core.c
+++ b/drivers/iio/gyro/st_gyro_core.c
@@ -466,13 +466,9 @@ int st_gyro_common_probe(struct iio_dev *indio_dev)
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &gyro_info;
 
-	err = st_sensors_power_enable(indio_dev);
-	if (err)
-		return err;
-
 	err = st_sensors_verify_id(indio_dev);
 	if (err < 0)
-		goto st_gyro_power_off;
+		return err;
 
 	gdata->num_data_channels = ST_GYRO_NUMBER_DATA_CHANNELS;
 	indio_dev->channels = gdata->sensor_settings->ch;
@@ -485,11 +481,11 @@ int st_gyro_common_probe(struct iio_dev *indio_dev)
 
 	err = st_sensors_init_sensor(indio_dev, pdata);
 	if (err < 0)
-		goto st_gyro_power_off;
+		return err;
 
 	err = st_gyro_allocate_ring(indio_dev);
 	if (err < 0)
-		goto st_gyro_power_off;
+		return err;
 
 	if (gdata->irq > 0) {
 		err = st_sensors_allocate_trigger(indio_dev,
@@ -512,9 +508,6 @@ int st_gyro_common_probe(struct iio_dev *indio_dev)
 		st_sensors_deallocate_trigger(indio_dev);
 st_gyro_probe_trigger_error:
 	st_gyro_deallocate_ring(indio_dev);
-st_gyro_power_off:
-	st_sensors_power_disable(indio_dev);
-
 	return err;
 }
 EXPORT_SYMBOL(st_gyro_common_probe);
@@ -523,8 +516,6 @@ void st_gyro_common_remove(struct iio_dev *indio_dev)
 {
 	struct st_sensor_data *gdata = iio_priv(indio_dev);
 
-	st_sensors_power_disable(indio_dev);
-
 	iio_device_unregister(indio_dev);
 	if (gdata->irq > 0)
 		st_sensors_deallocate_trigger(indio_dev);
diff --git a/drivers/iio/gyro/st_gyro_i2c.c b/drivers/iio/gyro/st_gyro_i2c.c
index 8190966e6ff0..a25cc0379e16 100644
--- a/drivers/iio/gyro/st_gyro_i2c.c
+++ b/drivers/iio/gyro/st_gyro_i2c.c
@@ -86,16 +86,29 @@ static int st_gyro_i2c_probe(struct i2c_client *client,
 	if (err < 0)
 		return err;
 
-	err = st_gyro_common_probe(indio_dev);
-	if (err < 0)
+	err = st_sensors_power_enable(indio_dev);
+	if (err)
 		return err;
 
+	err = st_gyro_common_probe(indio_dev);
+	if (err < 0)
+		goto st_gyro_power_off;
+
 	return 0;
+
+st_gyro_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return err;
 }
 
 static int st_gyro_i2c_remove(struct i2c_client *client)
 {
-	st_gyro_common_remove(i2c_get_clientdata(client));
+	struct iio_dev *indio_dev = i2c_get_clientdata(client);
+
+	st_sensors_power_disable(indio_dev);
+
+	st_gyro_common_remove(indio_dev);
 
 	return 0;
 }
diff --git a/drivers/iio/gyro/st_gyro_spi.c b/drivers/iio/gyro/st_gyro_spi.c
index efb862763ca3..18d6a2aeda45 100644
--- a/drivers/iio/gyro/st_gyro_spi.c
+++ b/drivers/iio/gyro/st_gyro_spi.c
@@ -90,16 +90,29 @@ static int st_gyro_spi_probe(struct spi_device *spi)
 	if (err < 0)
 		return err;
 
-	err = st_gyro_common_probe(indio_dev);
-	if (err < 0)
+	err = st_sensors_power_enable(indio_dev);
+	if (err)
 		return err;
 
+	err = st_gyro_common_probe(indio_dev);
+	if (err < 0)
+		goto st_gyro_power_off;
+
 	return 0;
+
+st_gyro_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return err;
 }
 
 static int st_gyro_spi_remove(struct spi_device *spi)
 {
-	st_gyro_common_remove(spi_get_drvdata(spi));
+	struct iio_dev *indio_dev = spi_get_drvdata(spi);
+
+	st_sensors_power_disable(indio_dev);
+
+	st_gyro_common_remove(indio_dev);
 
 	return 0;
 }
diff --git a/drivers/iio/magnetometer/st_magn_core.c b/drivers/iio/magnetometer/st_magn_core.c
index 79de721e6015..0fc38f17dbe0 100644
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -494,13 +494,9 @@ int st_magn_common_probe(struct iio_dev *indio_dev)
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &magn_info;
 
-	err = st_sensors_power_enable(indio_dev);
-	if (err)
-		return err;
-
 	err = st_sensors_verify_id(indio_dev);
 	if (err < 0)
-		goto st_magn_power_off;
+		return err;
 
 	mdata->num_data_channels = ST_MAGN_NUMBER_DATA_CHANNELS;
 	indio_dev->channels = mdata->sensor_settings->ch;
@@ -511,11 +507,11 @@ int st_magn_common_probe(struct iio_dev *indio_dev)
 
 	err = st_sensors_init_sensor(indio_dev, NULL);
 	if (err < 0)
-		goto st_magn_power_off;
+		return err;
 
 	err = st_magn_allocate_ring(indio_dev);
 	if (err < 0)
-		goto st_magn_power_off;
+		return err;
 
 	if (mdata->irq > 0) {
 		err = st_sensors_allocate_trigger(indio_dev,
@@ -538,9 +534,6 @@ int st_magn_common_probe(struct iio_dev *indio_dev)
 		st_sensors_deallocate_trigger(indio_dev);
 st_magn_probe_trigger_error:
 	st_magn_deallocate_ring(indio_dev);
-st_magn_power_off:
-	st_sensors_power_disable(indio_dev);
-
 	return err;
 }
 EXPORT_SYMBOL(st_magn_common_probe);
@@ -549,8 +542,6 @@ void st_magn_common_remove(struct iio_dev *indio_dev)
 {
 	struct st_sensor_data *mdata = iio_priv(indio_dev);
 
-	st_sensors_power_disable(indio_dev);
-
 	iio_device_unregister(indio_dev);
 	if (mdata->irq > 0)
 		st_sensors_deallocate_trigger(indio_dev);
diff --git a/drivers/iio/magnetometer/st_magn_i2c.c b/drivers/iio/magnetometer/st_magn_i2c.c
index c6bb4ce77594..7a7ab27379fc 100644
--- a/drivers/iio/magnetometer/st_magn_i2c.c
+++ b/drivers/iio/magnetometer/st_magn_i2c.c
@@ -78,16 +78,28 @@ static int st_magn_i2c_probe(struct i2c_client *client,
 	if (err < 0)
 		return err;
 
-	err = st_magn_common_probe(indio_dev);
-	if (err < 0)
+	err = st_sensors_power_enable(indio_dev);
+	if (err)
 		return err;
 
+	err = st_magn_common_probe(indio_dev);
+	if (err < 0)
+		goto st_magn_power_off;
+
 	return 0;
+
+st_magn_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return err;
 }
 
 static int st_magn_i2c_remove(struct i2c_client *client)
 {
 	struct iio_dev *indio_dev = i2c_get_clientdata(client);
+
+	st_sensors_power_disable(indio_dev);
+
 	st_magn_common_remove(indio_dev);
 
 	return 0;
diff --git a/drivers/iio/magnetometer/st_magn_spi.c b/drivers/iio/magnetometer/st_magn_spi.c
index 3d08d74c367d..ee352f083c02 100644
--- a/drivers/iio/magnetometer/st_magn_spi.c
+++ b/drivers/iio/magnetometer/st_magn_spi.c
@@ -72,16 +72,28 @@ static int st_magn_spi_probe(struct spi_device *spi)
 	if (err < 0)
 		return err;
 
-	err = st_magn_common_probe(indio_dev);
-	if (err < 0)
+	err = st_sensors_power_enable(indio_dev);
+	if (err)
 		return err;
 
+	err = st_magn_common_probe(indio_dev);
+	if (err < 0)
+		goto st_magn_power_off;
+
 	return 0;
+
+st_magn_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return err;
 }
 
 static int st_magn_spi_remove(struct spi_device *spi)
 {
 	struct iio_dev *indio_dev = spi_get_drvdata(spi);
+
+	st_sensors_power_disable(indio_dev);
+
 	st_magn_common_remove(indio_dev);
 
 	return 0;
diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c
index 789a2928504a..7912b5a68395 100644
--- a/drivers/iio/pressure/st_pressure_core.c
+++ b/drivers/iio/pressure/st_pressure_core.c
@@ -689,13 +689,9 @@ int st_press_common_probe(struct iio_dev *indio_dev)
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &press_info;
 
-	err = st_sensors_power_enable(indio_dev);
-	if (err)
-		return err;
-
 	err = st_sensors_verify_id(indio_dev);
 	if (err < 0)
-		goto st_press_power_off;
+		return err;
 
 	/*
 	 * Skip timestamping channel while declaring available channels to
@@ -718,11 +714,11 @@ int st_press_common_probe(struct iio_dev *indio_dev)
 
 	err = st_sensors_init_sensor(indio_dev, pdata);
 	if (err < 0)
-		goto st_press_power_off;
+		return err;
 
 	err = st_press_allocate_ring(indio_dev);
 	if (err < 0)
-		goto st_press_power_off;
+		return err;
 
 	if (press_data->irq > 0) {
 		err = st_sensors_allocate_trigger(indio_dev,
@@ -745,9 +741,6 @@ int st_press_common_probe(struct iio_dev *indio_dev)
 		st_sensors_deallocate_trigger(indio_dev);
 st_press_probe_trigger_error:
 	st_press_deallocate_ring(indio_dev);
-st_press_power_off:
-	st_sensors_power_disable(indio_dev);
-
 	return err;
 }
 EXPORT_SYMBOL(st_press_common_probe);
@@ -756,8 +749,6 @@ void st_press_common_remove(struct iio_dev *indio_dev)
 {
 	struct st_sensor_data *press_data = iio_priv(indio_dev);
 
-	st_sensors_power_disable(indio_dev);
-
 	iio_device_unregister(indio_dev);
 	if (press_data->irq > 0)
 		st_sensors_deallocate_trigger(indio_dev);
diff --git a/drivers/iio/pressure/st_pressure_i2c.c b/drivers/iio/pressure/st_pressure_i2c.c
index 09c6903f99b8..f0a5af314ceb 100644
--- a/drivers/iio/pressure/st_pressure_i2c.c
+++ b/drivers/iio/pressure/st_pressure_i2c.c
@@ -98,16 +98,29 @@ static int st_press_i2c_probe(struct i2c_client *client,
 	if (ret < 0)
 		return ret;
 
-	ret = st_press_common_probe(indio_dev);
-	if (ret < 0)
+	ret = st_sensors_power_enable(indio_dev);
+	if (ret)
 		return ret;
 
+	ret = st_press_common_probe(indio_dev);
+	if (ret < 0)
+		goto st_press_power_off;
+
 	return 0;
+
+st_press_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return ret;
 }
 
 static int st_press_i2c_remove(struct i2c_client *client)
 {
-	st_press_common_remove(i2c_get_clientdata(client));
+	struct iio_dev *indio_dev = i2c_get_clientdata(client);
+
+	st_sensors_power_disable(indio_dev);
+
+	st_press_common_remove(indio_dev);
 
 	return 0;
 }
diff --git a/drivers/iio/pressure/st_pressure_spi.c b/drivers/iio/pressure/st_pressure_spi.c
index b5ee3ec2764f..b48cf7d01cd7 100644
--- a/drivers/iio/pressure/st_pressure_spi.c
+++ b/drivers/iio/pressure/st_pressure_spi.c
@@ -82,16 +82,29 @@ static int st_press_spi_probe(struct spi_device *spi)
 	if (err < 0)
 		return err;
 
-	err = st_press_common_probe(indio_dev);
-	if (err < 0)
+	err = st_sensors_power_enable(indio_dev);
+	if (err)
 		return err;
 
+	err = st_press_common_probe(indio_dev);
+	if (err < 0)
+		goto st_press_power_off;
+
 	return 0;
+
+st_press_power_off:
+	st_sensors_power_disable(indio_dev);
+
+	return err;
 }
 
 static int st_press_spi_remove(struct spi_device *spi)
 {
-	st_press_common_remove(spi_get_drvdata(spi));
+	struct iio_dev *indio_dev = spi_get_drvdata(spi);
+
+	st_sensors_power_disable(indio_dev);
+
+	st_press_common_remove(indio_dev);
 
 	return 0;
 }

From a2c17c93b771242df31d03e62c0ac5b91bc11165 Mon Sep 17 00:00:00 2001
From: Alexandru Ardelean <aardelean@deviqon.com>
Date: Mon, 23 Aug 2021 14:22:00 +0300
Subject: [PATCH 1532/1750] iio: st_sensors: disable regulators after device
 unregistration

[ Upstream commit 9f0b3e0cc0c88618aa9e5cecef747b1337ae0a5d ]

Up until commit ea7e586bdd331 ("iio: st_sensors: move regulator retrieveal
to core") only the ST pressure driver seems to have had any regulator
disable. After that commit, the regulator handling was moved into the
common st_sensors logic.

In all instances of this regulator handling, the regulators were disabled
before unregistering the IIO device.
This can cause issues where the device would be powered down and still be
available to userspace, allowing it to send invalid/garbage data.

This change moves the st_sensors_power_disable() after the common probe
functions. These common probe functions also handle unregistering the IIO
device.

Fixes: 774487611c949 ("iio: pressure-core: st: Provide support for the Vdd power supply")
Fixes: ea7e586bdd331 ("iio: st_sensors: move regulator retrieveal to core")
Cc: Lee Jones <lee.jones@linaro.org>
Cc: Denis CIOCCA <denis.ciocca@st.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Alexandru Ardelean <aardelean@deviqon.com>
Link: https://lore.kernel.org/r/20210823112204.243255-2-aardelean@deviqon.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/accel/st_accel_i2c.c       | 4 ++--
 drivers/iio/accel/st_accel_spi.c       | 4 ++--
 drivers/iio/gyro/st_gyro_i2c.c         | 4 ++--
 drivers/iio/gyro/st_gyro_spi.c         | 4 ++--
 drivers/iio/magnetometer/st_magn_i2c.c | 4 ++--
 drivers/iio/magnetometer/st_magn_spi.c | 4 ++--
 drivers/iio/pressure/st_pressure_i2c.c | 4 ++--
 drivers/iio/pressure/st_pressure_spi.c | 4 ++--
 8 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/iio/accel/st_accel_i2c.c b/drivers/iio/accel/st_accel_i2c.c
index 95e305b88d5e..02c823b93ecd 100644
--- a/drivers/iio/accel/st_accel_i2c.c
+++ b/drivers/iio/accel/st_accel_i2c.c
@@ -194,10 +194,10 @@ static int st_accel_i2c_remove(struct i2c_client *client)
 {
 	struct iio_dev *indio_dev = i2c_get_clientdata(client);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_accel_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 
diff --git a/drivers/iio/accel/st_accel_spi.c b/drivers/iio/accel/st_accel_spi.c
index 83d3308ce5cc..386ae18d5f26 100644
--- a/drivers/iio/accel/st_accel_spi.c
+++ b/drivers/iio/accel/st_accel_spi.c
@@ -143,10 +143,10 @@ static int st_accel_spi_remove(struct spi_device *spi)
 {
 	struct iio_dev *indio_dev = spi_get_drvdata(spi);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_accel_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 
diff --git a/drivers/iio/gyro/st_gyro_i2c.c b/drivers/iio/gyro/st_gyro_i2c.c
index a25cc0379e16..3ed577977946 100644
--- a/drivers/iio/gyro/st_gyro_i2c.c
+++ b/drivers/iio/gyro/st_gyro_i2c.c
@@ -106,10 +106,10 @@ static int st_gyro_i2c_remove(struct i2c_client *client)
 {
 	struct iio_dev *indio_dev = i2c_get_clientdata(client);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_gyro_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 
diff --git a/drivers/iio/gyro/st_gyro_spi.c b/drivers/iio/gyro/st_gyro_spi.c
index 18d6a2aeda45..c04bcf2518c1 100644
--- a/drivers/iio/gyro/st_gyro_spi.c
+++ b/drivers/iio/gyro/st_gyro_spi.c
@@ -110,10 +110,10 @@ static int st_gyro_spi_remove(struct spi_device *spi)
 {
 	struct iio_dev *indio_dev = spi_get_drvdata(spi);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_gyro_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 
diff --git a/drivers/iio/magnetometer/st_magn_i2c.c b/drivers/iio/magnetometer/st_magn_i2c.c
index 7a7ab27379fc..4b6a251dd44e 100644
--- a/drivers/iio/magnetometer/st_magn_i2c.c
+++ b/drivers/iio/magnetometer/st_magn_i2c.c
@@ -98,10 +98,10 @@ static int st_magn_i2c_remove(struct i2c_client *client)
 {
 	struct iio_dev *indio_dev = i2c_get_clientdata(client);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_magn_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 
diff --git a/drivers/iio/magnetometer/st_magn_spi.c b/drivers/iio/magnetometer/st_magn_spi.c
index ee352f083c02..501eff32df78 100644
--- a/drivers/iio/magnetometer/st_magn_spi.c
+++ b/drivers/iio/magnetometer/st_magn_spi.c
@@ -92,10 +92,10 @@ static int st_magn_spi_remove(struct spi_device *spi)
 {
 	struct iio_dev *indio_dev = spi_get_drvdata(spi);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_magn_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 
diff --git a/drivers/iio/pressure/st_pressure_i2c.c b/drivers/iio/pressure/st_pressure_i2c.c
index f0a5af314ceb..8c26ff61e56a 100644
--- a/drivers/iio/pressure/st_pressure_i2c.c
+++ b/drivers/iio/pressure/st_pressure_i2c.c
@@ -118,10 +118,10 @@ static int st_press_i2c_remove(struct i2c_client *client)
 {
 	struct iio_dev *indio_dev = i2c_get_clientdata(client);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_press_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 
diff --git a/drivers/iio/pressure/st_pressure_spi.c b/drivers/iio/pressure/st_pressure_spi.c
index b48cf7d01cd7..8cf8cd3b4554 100644
--- a/drivers/iio/pressure/st_pressure_spi.c
+++ b/drivers/iio/pressure/st_pressure_spi.c
@@ -102,10 +102,10 @@ static int st_press_spi_remove(struct spi_device *spi)
 {
 	struct iio_dev *indio_dev = spi_get_drvdata(spi);
 
-	st_sensors_power_disable(indio_dev);
-
 	st_press_common_remove(indio_dev);
 
+	st_sensors_power_disable(indio_dev);
+
 	return 0;
 }
 

From 5282385ee65597cafdaf5fb45da470688e9c8681 Mon Sep 17 00:00:00 2001
From: Junji Wei <weijunji@bytedance.com>
Date: Tue, 31 Aug 2021 16:32:23 +0800
Subject: [PATCH 1533/1750] RDMA/rxe: Fix wrong port_cap_flags

[ Upstream commit dcd3f985b20ffcc375f82ca0ca9f241c7025eb5e ]

The port->attr.port_cap_flags should be set to enum
ib_port_capability_mask_bits in ib_mad.h, not
RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20210831083223.65797-1-weijunji@bytedance.com
Signed-off-by: Junji Wei <weijunji@bytedance.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/sw/rxe/rxe_param.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h
index 25ab50d9b7c2..f9fb56ec6dfd 100644
--- a/drivers/infiniband/sw/rxe/rxe_param.h
+++ b/drivers/infiniband/sw/rxe/rxe_param.h
@@ -108,7 +108,7 @@ enum rxe_device_param {
 /* default/initial rxe port parameters */
 enum rxe_port_param {
 	RXE_PORT_GID_TBL_LEN		= 1024,
-	RXE_PORT_PORT_CAP_FLAGS		= RDMA_CORE_CAP_PROT_ROCE_UDP_ENCAP,
+	RXE_PORT_PORT_CAP_FLAGS		= IB_PORT_CM_SUP,
 	RXE_PORT_MAX_MSG_SZ		= 0x800000,
 	RXE_PORT_BAD_PKEY_CNTR		= 0,
 	RXE_PORT_QKEY_VIOL_CNTR		= 0,

From 2fde76df1885a6bec04317e457121326070450eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
Date: Thu, 19 Aug 2021 08:57:02 +0200
Subject: [PATCH 1534/1750] ARM: dts: BCM5301X: Fix memory nodes names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c5e1df3276d7a500678da9453be31a66ad115150 ]

Thix fixes:
arch/arm/boot/dts/bcm4708-netgear-r6250.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728], [2281701376, 134217728]]}
arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728], [2281701376, 134217728]]}
arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728], [2281701376, 402653184]]}
arch/arm/boot/dts/bcm4709-linksys-ea9200.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728], [2281701376, 134217728]]}
arch/arm/boot/dts/bcm4709-netgear-r7000.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728], [2281701376, 134217728]]}
arch/arm/boot/dts/bcm4709-netgear-r8000.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728], [2281701376, 134217728]]}
arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728]]}
arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728], [2281701376, 402653184]]}
arch/arm/boot/dts/bcm53016-meraki-mr32.dt.yaml: /: memory: False schema does not allow {'reg': [[0, 134217728]], 'device_type': ['memory']}
arch/arm/boot/dts/bcm94708.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728]]}
arch/arm/boot/dts/bcm94709.dt.yaml: /: memory: False schema does not allow {'device_type': ['memory'], 'reg': [[0, 134217728]]}

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/bcm4708-netgear-r6250.dts       | 2 +-
 arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts       | 2 +-
 arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts | 2 +-
 arch/arm/boot/dts/bcm4709-linksys-ea9200.dts      | 2 +-
 arch/arm/boot/dts/bcm4709-netgear-r7000.dts       | 2 +-
 arch/arm/boot/dts/bcm4709-netgear-r8000.dts       | 2 +-
 arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts | 2 +-
 arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts     | 2 +-
 arch/arm/boot/dts/bcm53016-meraki-mr32.dts        | 2 +-
 arch/arm/boot/dts/bcm94708.dts                    | 2 +-
 arch/arm/boot/dts/bcm94709.dts                    | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
index 61c7b137607e..7900aac4f35a 100644
--- a/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
+++ b/arch/arm/boot/dts/bcm4708-netgear-r6250.dts
@@ -20,7 +20,7 @@ chosen {
 		bootargs = "console=ttyS0,115200 earlycon";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>,
 		      <0x88000000 0x08000000>;
diff --git a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
index 6c6bb7b17d27..7546c8d07bcd 100644
--- a/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
+++ b/arch/arm/boot/dts/bcm4709-asus-rt-ac87u.dts
@@ -19,7 +19,7 @@ chosen {
 		bootargs = "console=ttyS0,115200";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>,
 		      <0x88000000 0x08000000>;
diff --git a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
index d29e7f80ea6a..beae9eab9cb8 100644
--- a/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
+++ b/arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dts
@@ -19,7 +19,7 @@ chosen {
 		bootargs = "console=ttyS0,115200";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>,
 		      <0x88000000 0x18000000>;
diff --git a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
index 38fbefdf2e4e..ee94455a7236 100644
--- a/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
+++ b/arch/arm/boot/dts/bcm4709-linksys-ea9200.dts
@@ -16,7 +16,7 @@ chosen {
 		bootargs = "console=ttyS0,115200";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>,
 		      <0x88000000 0x08000000>;
diff --git a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
index 7989a53597d4..56d309dbc6b0 100644
--- a/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
+++ b/arch/arm/boot/dts/bcm4709-netgear-r7000.dts
@@ -19,7 +19,7 @@ chosen {
 		bootargs = "console=ttyS0,115200";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>,
 		      <0x88000000 0x08000000>;
diff --git a/arch/arm/boot/dts/bcm4709-netgear-r8000.dts b/arch/arm/boot/dts/bcm4709-netgear-r8000.dts
index 87b655be674c..184e3039aa86 100644
--- a/arch/arm/boot/dts/bcm4709-netgear-r8000.dts
+++ b/arch/arm/boot/dts/bcm4709-netgear-r8000.dts
@@ -30,7 +30,7 @@ chosen {
 		bootargs = "console=ttyS0,115200";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>,
 		      <0x88000000 0x08000000>;
diff --git a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
index f806be5da723..c2a266a439d0 100644
--- a/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
+++ b/arch/arm/boot/dts/bcm4709-tplink-archer-c9-v1.dts
@@ -15,7 +15,7 @@ chosen {
 		bootargs = "console=ttyS0,115200 earlycon";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>;
 	};
diff --git a/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts b/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts
index 2666195b6ffe..3d415d874bd3 100644
--- a/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts
+++ b/arch/arm/boot/dts/bcm47094-luxul-xwc-2000.dts
@@ -16,7 +16,7 @@ chosen {
 		bootargs = "earlycon";
 	};
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>,
 		      <0x88000000 0x18000000>;
diff --git a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
index 3b978dc8997a..612d61852bfb 100644
--- a/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
+++ b/arch/arm/boot/dts/bcm53016-meraki-mr32.dts
@@ -20,7 +20,7 @@ chosen {
 		bootargs = " console=ttyS0,115200n8 earlycon";
 	};
 
-	memory {
+	memory@0 {
 		reg = <0x00000000 0x08000000>;
 		device_type = "memory";
 	};
diff --git a/arch/arm/boot/dts/bcm94708.dts b/arch/arm/boot/dts/bcm94708.dts
index 3d13e46c6949..d9eb2040b963 100644
--- a/arch/arm/boot/dts/bcm94708.dts
+++ b/arch/arm/boot/dts/bcm94708.dts
@@ -38,7 +38,7 @@ / {
 	model = "NorthStar SVK (BCM94708)";
 	compatible = "brcm,bcm94708", "brcm,bcm4708";
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>;
 	};
diff --git a/arch/arm/boot/dts/bcm94709.dts b/arch/arm/boot/dts/bcm94709.dts
index 5017b7b259cb..618c812eef73 100644
--- a/arch/arm/boot/dts/bcm94709.dts
+++ b/arch/arm/boot/dts/bcm94709.dts
@@ -38,7 +38,7 @@ / {
 	model = "NorthStar SVK (BCM94709)";
 	compatible = "brcm,bcm94709", "brcm,bcm4709", "brcm,bcm4708";
 
-	memory {
+	memory@0 {
 		device_type = "memory";
 		reg = <0x00000000 0x08000000>;
 	};

From cdd3dd905ceac00f5929d5a23549d90f72d16f5c Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Fri, 23 Apr 2021 09:02:26 +0200
Subject: [PATCH 1535/1750] clk: mvebu: ap-cpu-clk: Fix a memory leak in error
 handling paths

[ Upstream commit af9617b419f77cf0b99702a7b2b0519da0d27715 ]

If we exit the for_each_of_cpu_node loop early, the reference on the
current node must be decremented, otherwise there is a leak.

Fixes: f756e362d938 ("clk: mvebu: add CPU clock driver for Armada 7K/8K")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/545df946044fc1fc05a4217cdf0054be7a79e49e.1619161112.git.christophe.jaillet@wanadoo.fr
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/mvebu/ap-cpu-clk.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/clk/mvebu/ap-cpu-clk.c b/drivers/clk/mvebu/ap-cpu-clk.c
index b4259b60dcfd..25de4b6da776 100644
--- a/drivers/clk/mvebu/ap-cpu-clk.c
+++ b/drivers/clk/mvebu/ap-cpu-clk.c
@@ -256,12 +256,15 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
 		int cpu, err;
 
 		err = of_property_read_u32(dn, "reg", &cpu);
-		if (WARN_ON(err))
+		if (WARN_ON(err)) {
+			of_node_put(dn);
 			return err;
+		}
 
 		/* If cpu2 or cpu3 is enabled */
 		if (cpu & APN806_CLUSTER_NUM_MASK) {
 			nclusters = 2;
+			of_node_put(dn);
 			break;
 		}
 	}
@@ -288,8 +291,10 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
 		int cpu, err;
 
 		err = of_property_read_u32(dn, "reg", &cpu);
-		if (WARN_ON(err))
+		if (WARN_ON(err)) {
+			of_node_put(dn);
 			return err;
+		}
 
 		cluster_index = cpu & APN806_CLUSTER_NUM_MASK;
 		cluster_index >>= APN806_CLUSTER_NUM_OFFSET;
@@ -301,6 +306,7 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
 		parent = of_clk_get(np, cluster_index);
 		if (IS_ERR(parent)) {
 			dev_err(dev, "Could not get the clock parent\n");
+			of_node_put(dn);
 			return -EINVAL;
 		}
 		parent_name =  __clk_get_name(parent);
@@ -319,8 +325,10 @@ static int ap_cpu_clock_probe(struct platform_device *pdev)
 		init.parent_names = &parent_name;
 
 		ret = devm_clk_hw_register(dev, &ap_cpu_clk[cluster_index].hw);
-		if (ret)
+		if (ret) {
+			of_node_put(dn);
 			return ret;
+		}
 		ap_cpu_data->hws[cluster_index] = &ap_cpu_clk[cluster_index].hw;
 	}
 

From 3f33f09d9f6aeb7a97d8ce8d9b1f501b81464110 Mon Sep 17 00:00:00 2001
From: Jackie Liu <liuyun01@kylinos.cn>
Date: Wed, 1 Sep 2021 20:35:57 +0800
Subject: [PATCH 1536/1750] ARM: s3c: irq-s3c24xx: Fix return value check for
 s3c24xx_init_intc()

[ Upstream commit 2aa717473ce96c93ae43a5dc8c23cedc8ce7dd9f ]

The s3c24xx_init_intc() returns an error pointer upon failure, not NULL.
let's add an error pointer check in s3c24xx_handle_irq.

s3c_intc[0] is not NULL or ERR, we can simplify the code.

Fixes: 1f629b7a3ced ("ARM: S3C24XX: transform irq handling into a declarative form")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Link: https://lore.kernel.org/r/20210901123557.1043953-1-liu.yun@linux.dev
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-s3c/irq-s3c24xx.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-s3c/irq-s3c24xx.c b/arch/arm/mach-s3c/irq-s3c24xx.c
index 79b5f19af7a5..19fb9bdf446b 100644
--- a/arch/arm/mach-s3c/irq-s3c24xx.c
+++ b/arch/arm/mach-s3c/irq-s3c24xx.c
@@ -360,11 +360,25 @@ static inline int s3c24xx_handle_intc(struct s3c_irq_intc *intc,
 asmlinkage void __exception_irq_entry s3c24xx_handle_irq(struct pt_regs *regs)
 {
 	do {
-		if (likely(s3c_intc[0]))
-			if (s3c24xx_handle_intc(s3c_intc[0], regs, 0))
-				continue;
+		/*
+		 * For platform based machines, neither ERR nor NULL can happen here.
+		 * The s3c24xx_handle_irq() will be set as IRQ handler iff this succeeds:
+		 *
+		 *    s3c_intc[0] = s3c24xx_init_intc()
+		 *
+		 * If this fails, the next calls to s3c24xx_init_intc() won't be executed.
+		 *
+		 * For DT machine, s3c_init_intc_of() could set the IRQ handler without
+		 * setting s3c_intc[0] only if it was called with num_ctrl=0. There is no
+		 * such code path, so again the s3c_intc[0] will have a valid pointer if
+		 * set_handle_irq() is called.
+		 *
+		 * Therefore in s3c24xx_handle_irq(), the s3c_intc[0] is always something.
+		 */
+		if (s3c24xx_handle_intc(s3c_intc[0], regs, 0))
+			continue;
 
-		if (s3c_intc[2])
+		if (!IS_ERR_OR_NULL(s3c_intc[2]))
 			if (s3c24xx_handle_intc(s3c_intc[2], regs, 64))
 				continue;
 

From 2887df89e7f6dab31deefc596d7ca6b9cb6fbbbe Mon Sep 17 00:00:00 2001
From: Alex Bee <knaerzche@gmail.com>
Date: Wed, 23 Jun 2021 13:59:26 +0200
Subject: [PATCH 1537/1750] arm64: dts: rockchip: Fix GPU register width for
 RK3328

[ Upstream commit 932b4610f55b49f3a158b0db451137bab7ed0e1f ]

As can be seen in RK3328's TRM the register range for the GPU is
0xff300000 to 0xff330000.
It would (and does in vendor kernel) overlap with the registers of
the HEVC encoder (node/driver do not exist yet in upstream kernel).
See already existing h265e_mmu node.

Fixes: 752fbc0c8da7 ("arm64: dts: rockchip: add rk3328 mali gpu node")
Signed-off-by: Alex Bee <knaerzche@gmail.com>
Link: https://lore.kernel.org/r/20210623115926.164861-1-knaerzche@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/rockchip/rk3328.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
index e546c9d1d646..72112fe05a5c 100644
--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi
@@ -603,7 +603,7 @@ saradc: adc@ff280000 {
 
 	gpu: gpu@ff300000 {
 		compatible = "rockchip,rk3328-mali", "arm,mali-450";
-		reg = <0x0 0xff300000 0x0 0x40000>;
+		reg = <0x0 0xff300000 0x0 0x30000>;
 		interrupts = <GIC_SPI 90 IRQ_TYPE_LEVEL_HIGH>,
 			     <GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>,
 			     <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,

From fe3c11fc627b52f18864ff26547b87134b1c6790 Mon Sep 17 00:00:00 2001
From: Marijn Suijten <marijn.suijten@somainline.org>
Date: Mon, 30 Aug 2021 19:57:39 +0200
Subject: [PATCH 1538/1750] ARM: dts: qcom: msm8974: Add xo_board reference
 clock to DSI0 PHY

[ Upstream commit 8ccecf6c710b8c048eecc65709640642e5357d6e ]

According to YAML validation, and for a future patchset putting this
xo_board reference clock to use as VCO reference parent, add the missing
clock to dsi_phy0.

Fixes: 5a9fc531f6ec ("ARM: dts: msm8974: add display support")
Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210830175739.143401-1-marijn.suijten@somainline.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/qcom-msm8974.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/qcom-msm8974.dtsi b/arch/arm/boot/dts/qcom-msm8974.dtsi
index 51f5f904f9eb..5f7426fb4e41 100644
--- a/arch/arm/boot/dts/qcom-msm8974.dtsi
+++ b/arch/arm/boot/dts/qcom-msm8974.dtsi
@@ -1528,8 +1528,8 @@ dsi_phy0: dsi-phy@fd922a00 {
 				#phy-cells = <0>;
 				qcom,dsi-phy-index = <0>;
 
-				clocks = <&mmcc MDSS_AHB_CLK>;
-				clock-names = "iface";
+				clocks = <&mmcc MDSS_AHB_CLK>, <&xo_board>;
+				clock-names = "iface", "ref";
 			};
 		};
 

From 64a43b771258a01e6690c1a1aa8266ec657e7dfe Mon Sep 17 00:00:00 2001
From: Selvin Xavier <selvin.xavier@broadcom.com>
Date: Wed, 15 Sep 2021 05:32:38 -0700
Subject: [PATCH 1539/1750] RDMA/bnxt_re: Fix query SRQ failure

[ Upstream commit 598d16fa1bf93431ad35bbab3ed1affe4fb7b562 ]

Fill the missing parameters for the FW command while querying SRQ.

Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
Link: https://lore.kernel.org/r/1631709163-2287-8-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index d4d4959c2434..bd153aa7e9ab 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -707,12 +707,13 @@ int bnxt_qplib_query_srq(struct bnxt_qplib_res *res,
 	int rc = 0;
 
 	RCFW_CMD_PREP(req, QUERY_SRQ, cmd_flags);
-	req.srq_cid = cpu_to_le32(srq->id);
 
 	/* Configure the request */
 	sbuf = bnxt_qplib_rcfw_alloc_sbuf(rcfw, sizeof(*sb));
 	if (!sbuf)
 		return -ENOMEM;
+	req.resp_size = sizeof(*sb) / BNXT_QPLIB_CMDQE_UNITS;
+	req.srq_cid = cpu_to_le32(srq->id);
 	sb = sbuf->sb;
 	rc = bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
 					  (void *)sbuf, 0);

From 7a1617a9919bfe82cc9d023c233f90ba11214b14 Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Wed, 15 Sep 2021 11:23:53 +0530
Subject: [PATCH 1540/1750] arm64: dts: ti: k3-j721e-main: Fix
 "max-virtual-functions" in PCIe EP nodes

[ Upstream commit 9af3ef954975c383eeb667aee207d9ce6fbef8c4 ]

commit 4e5833884f66 ("arm64: dts: ti: k3-j721e-main: Add PCIe device
tree nodes") added "max-virtual-functions" to have 16 bit values.
Fix "max-virtual-functions" in PCIe endpoint (EP) nodes to have 8 bit
values instead of 16.

Fixes: 4e5833884f66 ("arm64: dts: ti: k3-j721e-main: Add PCIe device tree nodes")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Reviewed-by: Aswath Govindraju <a-govindraju@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Link: https://lore.kernel.org/r/20210915055358.19997-2-kishon@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
index 6ffdebd60122..4e010253b028 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
@@ -656,7 +656,7 @@ pcie0_ep: pcie-ep@2900000 {
 		clock-names = "fck";
 		cdns,max-outbound-regions = <16>;
 		max-functions = /bits/ 8 <6>;
-		max-virtual-functions = /bits/ 16 <4 4 4 4 0 0>;
+		max-virtual-functions = /bits/ 8 <4 4 4 4 0 0>;
 		dma-coherent;
 	};
 
@@ -705,7 +705,7 @@ pcie1_ep: pcie-ep@2910000 {
 		clock-names = "fck";
 		cdns,max-outbound-regions = <16>;
 		max-functions = /bits/ 8 <6>;
-		max-virtual-functions = /bits/ 16 <4 4 4 4 0 0>;
+		max-virtual-functions = /bits/ 8 <4 4 4 4 0 0>;
 		dma-coherent;
 	};
 
@@ -754,7 +754,7 @@ pcie2_ep: pcie-ep@2920000 {
 		clock-names = "fck";
 		cdns,max-outbound-regions = <16>;
 		max-functions = /bits/ 8 <6>;
-		max-virtual-functions = /bits/ 16 <4 4 4 4 0 0>;
+		max-virtual-functions = /bits/ 8 <4 4 4 4 0 0>;
 		dma-coherent;
 	};
 
@@ -803,7 +803,7 @@ pcie3_ep: pcie-ep@2930000 {
 		clock-names = "fck";
 		cdns,max-outbound-regions = <16>;
 		max-functions = /bits/ 8 <6>;
-		max-virtual-functions = /bits/ 16 <4 4 4 4 0 0>;
+		max-virtual-functions = /bits/ 8 <4 4 4 4 0 0>;
 		dma-coherent;
 		#address-cells = <2>;
 		#size-cells = <2>;

From 20baf01638054058c96c678f53d408a70943a771 Mon Sep 17 00:00:00 2001
From: Kishon Vijay Abraham I <kishon@ti.com>
Date: Wed, 15 Sep 2021 11:23:54 +0530
Subject: [PATCH 1541/1750] arm64: dts: ti: k3-j721e-main: Fix "bus-range" upto
 256 bus number for PCIe

[ Upstream commit 5f46633565b1c1e1840a927676065d72b442dac4 ]

commit 4e5833884f66 ("arm64: dts: ti: k3-j721e-main: Add PCIe device
tree nodes") restricted PCIe bus numbers from 0 to 15 (due to SMMU
restriction in J721E). However since SMMU is not enabled, allow the full
supported bus numbers from 0 to 255.

Fixes: 4e5833884f66 ("arm64: dts: ti: k3-j721e-main: Add PCIe device tree nodes")
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Reviewed-by: Aswath Govindraju <a-govindraju@ti.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Link: https://lore.kernel.org/r/20210915055358.19997-3-kishon@ti.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
index 4e010253b028..85526f72b461 100644
--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
@@ -629,7 +629,7 @@ pcie0_rc: pcie@2900000 {
 		clock-names = "fck";
 		#address-cells = <3>;
 		#size-cells = <2>;
-		bus-range = <0x0 0xf>;
+		bus-range = <0x0 0xff>;
 		vendor-id = <0x104c>;
 		device-id = <0xb00d>;
 		msi-map = <0x0 &gic_its 0x0 0x10000>;
@@ -678,7 +678,7 @@ pcie1_rc: pcie@2910000 {
 		clock-names = "fck";
 		#address-cells = <3>;
 		#size-cells = <2>;
-		bus-range = <0x0 0xf>;
+		bus-range = <0x0 0xff>;
 		vendor-id = <0x104c>;
 		device-id = <0xb00d>;
 		msi-map = <0x0 &gic_its 0x10000 0x10000>;
@@ -727,7 +727,7 @@ pcie2_rc: pcie@2920000 {
 		clock-names = "fck";
 		#address-cells = <3>;
 		#size-cells = <2>;
-		bus-range = <0x0 0xf>;
+		bus-range = <0x0 0xff>;
 		vendor-id = <0x104c>;
 		device-id = <0xb00d>;
 		msi-map = <0x0 &gic_its 0x20000 0x10000>;
@@ -776,7 +776,7 @@ pcie3_rc: pcie@2930000 {
 		clock-names = "fck";
 		#address-cells = <3>;
 		#size-cells = <2>;
-		bus-range = <0x0 0xf>;
+		bus-range = <0x0 0xff>;
 		vendor-id = <0x104c>;
 		device-id = <0xb00d>;
 		msi-map = <0x0 &gic_its 0x30000 0x10000>;

From 4ccb7e4a972ce58fbf434d033ec9485d91b3c57a Mon Sep 17 00:00:00 2001
From: Anand Moon <linux.amoon@gmail.com>
Date: Sun, 19 Sep 2021 20:29:09 +0000
Subject: [PATCH 1542/1750] arm64: dts: meson-g12a: Fix the pwm regulator
 supply properties

[ Upstream commit 085675117ecf5e02c4220698fd549024ec64ad2c ]

After enabling CONFIG_REGULATOR_DEBUG=y we observe below debug logs.
Changes help link VDDCPU pwm regulator to 12V regulator supply
instead of dummy regulator.

[   11.602281] pwm-regulator regulator-vddcpu: Looking up pwm-supply property
               in node /regulator-vddcpu failed
[   11.602344] VDDCPU: supplied by regulator-dummy
[   11.602365] regulator-dummy: could not add device link regulator.11: -ENOENT
[   11.602548] VDDCPU: 721 <--> 1022 mV at 1022 mV, enabled

Fixes: e9bc0765cc12 ("arm64: dts: meson-g12a: enable DVFS on G12A boards")

Cc: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20210919202918.3556-2-linux.amoon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts  | 2 +-
 arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts    | 2 +-
 arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts
index b00d0468c753..4d5b3e514b51 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts
@@ -139,7 +139,7 @@ vddcpu: regulator-vddcpu {
 		regulator-min-microvolt = <721000>;
 		regulator-max-microvolt = <1022000>;
 
-		vin-supply = <&dc_in>;
+		pwm-supply = <&dc_in>;
 
 		pwms = <&pwm_AO_cd 1 1250 0>;
 		pwm-dutycycle-range = <100 0>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts
index a26bfe72550f..4b5d11e56364 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-u200.dts
@@ -139,7 +139,7 @@ vddcpu: regulator-vddcpu {
 		regulator-min-microvolt = <721000>;
 		regulator-max-microvolt = <1022000>;
 
-		vin-supply = <&main_12v>;
+		pwm-supply = <&main_12v>;
 
 		pwms = <&pwm_AO_cd 1 1250 0>;
 		pwm-dutycycle-range = <100 0>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
index 463a72d6bb7c..26b5d9327324 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
+++ b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts
@@ -139,7 +139,7 @@ vddcpu: regulator-vddcpu {
 		regulator-min-microvolt = <721000>;
 		regulator-max-microvolt = <1022000>;
 
-		vin-supply = <&dc_in>;
+		pwm-supply = <&dc_in>;
 
 		pwms = <&pwm_AO_cd 1 1250 0>;
 		pwm-dutycycle-range = <100 0>;

From 85085c34370583072bed3ad5e39b52288353a3a6 Mon Sep 17 00:00:00 2001
From: Anand Moon <linux.amoon@gmail.com>
Date: Sun, 19 Sep 2021 20:29:10 +0000
Subject: [PATCH 1543/1750] arm64: dts: meson-g12b: Fix the pwm regulator
 supply properties

[ Upstream commit 62183863f708c2464769e0d477c8ce9f3d326feb ]

After enabling CONFIG_REGULATOR_DEBUG=y we observer below debug logs.
Changes help link VDDCP_A and VDDCPU_B pwm regulator to 12V regulator
supply instead of dummy regulator.

[    4.147196] VDDCPU_A: will resolve supply early: pwm
[    4.147216] pwm-regulator regulator-vddcpu-a: Looking up pwm-supply from device tree
[    4.147227] pwm-regulator regulator-vddcpu-a: Looking up pwm-supply property in node /regulator-vddcpu-a failed
[    4.147258] VDDCPU_A: supplied by regulator-dummy
[    4.147288] regulator-dummy: could not add device link regulator.12: -ENOENT
[    4.147353] VDDCPU_A: 721 <--> 1022 mV at 871 mV, enabled
[    4.152014] VDDCPU_B: will resolve supply early: pwm
[    4.152035] pwm-regulator regulator-vddcpu-b: Looking up pwm-supply from device tree
[    4.152047] pwm-regulator regulator-vddcpu-b: Looking up pwm-supply property in node /regulator-vddcpu-b failed
[    4.152079] VDDCPU_B: supplied by regulator-dummy
[    4.152108] regulator-dummy: could not add device link regulator.13: -ENOENT

Fixes: c6d29c66e582 ("arm64: dts: meson-g12b-khadas-vim3: add initial device-tree")
Fixes: d14734a04a8a ("arm64: dts: meson-g12b-odroid-n2: enable DVFS")
Fixes: 3cb74db9b256 ("arm64: dts: meson: convert ugoos-am6 to common w400 dtsi")

Cc: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20210919202918.3556-3-linux.amoon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi | 4 ++--
 arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi   | 4 ++--
 arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi        | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
index f42cf4b8af2d..16dd409051b4 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
@@ -18,7 +18,7 @@ vddcpu_a: regulator-vddcpu-a {
 		regulator-min-microvolt = <690000>;
 		regulator-max-microvolt = <1050000>;
 
-		vin-supply = <&dc_in>;
+		pwm-supply = <&dc_in>;
 
 		pwms = <&pwm_ab 0 1250 0>;
 		pwm-dutycycle-range = <100 0>;
@@ -37,7 +37,7 @@ vddcpu_b: regulator-vddcpu-b {
 		regulator-min-microvolt = <690000>;
 		regulator-max-microvolt = <1050000>;
 
-		vin-supply = <&vsys_3v3>;
+		pwm-supply = <&vsys_3v3>;
 
 		pwms = <&pwm_AO_cd 1 1250 0>;
 		pwm-dutycycle-range = <100 0>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
index 39a09661c5f6..59b5f3908875 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-odroid-n2.dtsi
@@ -128,7 +128,7 @@ vddcpu_a: regulator-vddcpu-a {
 		regulator-min-microvolt = <721000>;
 		regulator-max-microvolt = <1022000>;
 
-		vin-supply = <&main_12v>;
+		pwm-supply = <&main_12v>;
 
 		pwms = <&pwm_ab 0 1250 0>;
 		pwm-dutycycle-range = <100 0>;
@@ -147,7 +147,7 @@ vddcpu_b: regulator-vddcpu-b {
 		regulator-min-microvolt = <721000>;
 		regulator-max-microvolt = <1022000>;
 
-		vin-supply = <&main_12v>;
+		pwm-supply = <&main_12v>;
 
 		pwms = <&pwm_AO_cd 1 1250 0>;
 		pwm-dutycycle-range = <100 0>;
diff --git a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
index feb088504740..b40d2c1002c9 100644
--- a/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-g12b-w400.dtsi
@@ -96,7 +96,7 @@ vddcpu_a: regulator-vddcpu-a {
 		regulator-min-microvolt = <721000>;
 		regulator-max-microvolt = <1022000>;
 
-		vin-supply = <&main_12v>;
+		pwm-supply = <&main_12v>;
 
 		pwms = <&pwm_ab 0 1250 0>;
 		pwm-dutycycle-range = <100 0>;
@@ -115,7 +115,7 @@ vddcpu_b: regulator-vddcpu-b {
 		regulator-min-microvolt = <721000>;
 		regulator-max-microvolt = <1022000>;
 
-		vin-supply = <&main_12v>;
+		pwm-supply = <&main_12v>;
 
 		pwms = <&pwm_AO_cd 1 1250 0>;
 		pwm-dutycycle-range = <100 0>;

From b6493c2b7ddb7a019908fa80fc4ebc323fe36ffb Mon Sep 17 00:00:00 2001
From: Tony Lindgren <tony@atomide.com>
Date: Tue, 21 Sep 2021 12:42:25 +0300
Subject: [PATCH 1544/1750] bus: ti-sysc: Fix timekeeping_suspended warning on
 resume

[ Upstream commit b3e9431854e8f305385d5de225441c0477b936cb ]

On resume we can get a warning at kernel/time/timekeeping.c:824 for
timekeeping_suspended.

Let's fix this by adding separate functions for sysc_poll_reset_sysstatus()
and sysc_poll_reset_sysconfig() and have the new functions handle also
timekeeping_suspended.

If iopoll at some point supports timekeeping_suspended, we can just drop
the custom handling from these functions.

Fixes: d46f9fbec719 ("bus: ti-sysc: Use optional clocks on for enable and wait for softreset bit")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bus/ti-sysc.c | 65 +++++++++++++++++++++++++++++++++++--------
 1 file changed, 53 insertions(+), 12 deletions(-)

diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index 02341fd66e8d..2ff437e5c705 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -17,6 +17,7 @@
 #include <linux/of_platform.h>
 #include <linux/slab.h>
 #include <linux/sys_soc.h>
+#include <linux/timekeeping.h>
 #include <linux/iopoll.h>
 
 #include <linux/platform_data/ti-sysc.h>
@@ -223,37 +224,77 @@ static u32 sysc_read_sysstatus(struct sysc *ddata)
 	return sysc_read(ddata, offset);
 }
 
-/* Poll on reset status */
-static int sysc_wait_softreset(struct sysc *ddata)
+static int sysc_poll_reset_sysstatus(struct sysc *ddata)
 {
-	u32 sysc_mask, syss_done, rstval;
-	int syss_offset, error = 0;
-
-	if (ddata->cap->regbits->srst_shift < 0)
-		return 0;
-
-	syss_offset = ddata->offsets[SYSC_SYSSTATUS];
-	sysc_mask = BIT(ddata->cap->regbits->srst_shift);
+	int error, retries;
+	u32 syss_done, rstval;
 
 	if (ddata->cfg.quirks & SYSS_QUIRK_RESETDONE_INVERTED)
 		syss_done = 0;
 	else
 		syss_done = ddata->cfg.syss_mask;
 
-	if (syss_offset >= 0) {
+	if (likely(!timekeeping_suspended)) {
 		error = readx_poll_timeout_atomic(sysc_read_sysstatus, ddata,
 				rstval, (rstval & ddata->cfg.syss_mask) ==
 				syss_done, 100, MAX_MODULE_SOFTRESET_WAIT);
+	} else {
+		retries = MAX_MODULE_SOFTRESET_WAIT;
+		while (retries--) {
+			rstval = sysc_read_sysstatus(ddata);
+			if ((rstval & ddata->cfg.syss_mask) == syss_done)
+				return 0;
+			udelay(2); /* Account for udelay flakeyness */
+		}
+		error = -ETIMEDOUT;
+	}
 
-	} else if (ddata->cfg.quirks & SYSC_QUIRK_RESET_STATUS) {
+	return error;
+}
+
+static int sysc_poll_reset_sysconfig(struct sysc *ddata)
+{
+	int error, retries;
+	u32 sysc_mask, rstval;
+
+	sysc_mask = BIT(ddata->cap->regbits->srst_shift);
+
+	if (likely(!timekeeping_suspended)) {
 		error = readx_poll_timeout_atomic(sysc_read_sysconfig, ddata,
 				rstval, !(rstval & sysc_mask),
 				100, MAX_MODULE_SOFTRESET_WAIT);
+	} else {
+		retries = MAX_MODULE_SOFTRESET_WAIT;
+		while (retries--) {
+			rstval = sysc_read_sysconfig(ddata);
+			if (!(rstval & sysc_mask))
+				return 0;
+			udelay(2); /* Account for udelay flakeyness */
+		}
+		error = -ETIMEDOUT;
 	}
 
 	return error;
 }
 
+/* Poll on reset status */
+static int sysc_wait_softreset(struct sysc *ddata)
+{
+	int syss_offset, error = 0;
+
+	if (ddata->cap->regbits->srst_shift < 0)
+		return 0;
+
+	syss_offset = ddata->offsets[SYSC_SYSSTATUS];
+
+	if (syss_offset >= 0)
+		error = sysc_poll_reset_sysstatus(ddata);
+	else if (ddata->cfg.quirks & SYSC_QUIRK_RESET_STATUS)
+		error = sysc_poll_reset_sysconfig(ddata);
+
+	return error;
+}
+
 static int sysc_add_named_clock_from_child(struct sysc *ddata,
 					   const char *name,
 					   const char *optfck_name)

From 6348983be709145bde3f648c59aab9fb24487cb5 Mon Sep 17 00:00:00 2001
From: Peter Rosin <peda@axentia.se>
Date: Mon, 20 Sep 2021 22:37:38 +0200
Subject: [PATCH 1545/1750] ARM: dts: at91: tse850: the emac<->phy interface is
 rmii

[ Upstream commit dcdbc335a91a26e022a803e1a6b837266989c032 ]

This went unnoticed until commit 7897b071ac3b ("net: macb: convert
to phylink") which tickled the problem. The sama5d3 emac has never
been capable of rgmii, and it all just happened to work before that
commit.

Fixes: 21dd0ece34c2 ("ARM: dts: at91: add devicetree for the Axentia TSE-850")
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/ea781f5e-422f-6cbf-3cf4-d5a7bac9392d@axentia.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/at91-tse850-3.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/at91-tse850-3.dts b/arch/arm/boot/dts/at91-tse850-3.dts
index 3ca97b47c69c..7e5c598e7e68 100644
--- a/arch/arm/boot/dts/at91-tse850-3.dts
+++ b/arch/arm/boot/dts/at91-tse850-3.dts
@@ -262,7 +262,7 @@ &pwm0 {
 &macb1 {
 	status = "okay";
 
-	phy-mode = "rgmii";
+	phy-mode = "rmii";
 
 	#address-cells = <1>;
 	#size-cells = <0>;

From 24149c954f329ace9db0214808a3acfa178f01e2 Mon Sep 17 00:00:00 2001
From: Tong Zhang <ztong0001@gmail.com>
Date: Mon, 6 Sep 2021 21:07:02 -0700
Subject: [PATCH 1546/1750] scsi: dc395: Fix error case unwinding

[ Upstream commit cbd9a3347c757383f3d2b50cf7cfd03eb479c481 ]

dc395x_init_one()->adapter_init() might fail. In this case, the acb is
already cleaned up by adapter_init(), no need to do that in
adapter_uninit(acb) again.

[    1.252251] dc395x: adapter init failed
[    1.254900] RIP: 0010:adapter_uninit+0x94/0x170 [dc395x]
[    1.260307] Call Trace:
[    1.260442]  dc395x_init_one.cold+0x72a/0x9bb [dc395x]

Link: https://lore.kernel.org/r/20210907040702.1846409-1-ztong0001@gmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Finn Thain <fthain@linux-m68k.org>
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/dc395x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index fa16894d8758..6cb48ae8e124 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -4658,6 +4658,7 @@ static int dc395x_init_one(struct pci_dev *dev, const struct pci_device_id *id)
 	/* initialise the adapter and everything we need */
  	if (adapter_init(acb, io_port_base, io_port_len, irq)) {
 		dprintkl(KERN_INFO, "adapter init failed\n");
+		acb = NULL;
 		goto fail;
 	}
 

From c4edd206d52ef9671b7af695d44d7d4521b248d2 Mon Sep 17 00:00:00 2001
From: Jackie Liu <liuyun01@kylinos.cn>
Date: Mon, 13 Sep 2021 14:19:08 +0800
Subject: [PATCH 1547/1750] MIPS: loongson64: make CPU_LOONGSON64 depends on
 MIPS_FP_SUPPORT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 7f3b3c2bfa9c93ab9b5595543496f570983dc330 ]

mach/loongson64 fails to build when the FPU support is disabled:

arch/mips/loongson64/cop2-ex.c:45:15: error: implicit declaration of function ‘__is_fpu_owner’; did you mean ‘is_fpu_owner’? [-Werror=implicit-function-declaration]
arch/mips/loongson64/cop2-ex.c:98:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:99:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:131:43: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:137:38: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:203:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:219:30: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:283:38: error: ‘struct thread_struct’ has no member named ‘fpu’
arch/mips/loongson64/cop2-ex.c:301:38: error: ‘struct thread_struct’ has no member named ‘fpu’

Fixes: ef2f826c8f2f ("MIPS: Loongson-3: Enable the COP2 usage")
Suggested-by: Huacai Chen <chenhuacai@kernel.org>
Reviewed-by: Huacai Chen <chenhuacai@kernel.org>
Reported-by: k2ci robot <kernel-bot@kylinos.cn>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 1a63f592034e..5c6e9ed9b2a7 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1380,6 +1380,7 @@ config CPU_LOONGSON64
 	select MIPS_ASID_BITS_VARIABLE
 	select MIPS_PGD_C0_CONTEXT
 	select MIPS_L1_CACHE_SHIFT_6
+	select MIPS_FP_SUPPORT
 	select GPIOLIB
 	select SWIOTLB
 	select HAVE_KVM

From 980c7bdd20fcc1a4fddb44f30a455ca313a82dfa Mon Sep 17 00:00:00 2001
From: Dongliang Mu <mudongliangabcd@gmail.com>
Date: Sat, 4 Sep 2021 10:37:41 +0800
Subject: [PATCH 1548/1750] JFS: fix memleak in jfs_mount

[ Upstream commit c48a14dca2cb57527dde6b960adbe69953935f10 ]

In jfs_mount, when diMount(ipaimap2) fails, it goes to errout35. However,
the following code does not free ipaimap2 allocated by diReadSpecial.

Fix this by refactoring the error handling code of jfs_mount. To be
specific, modify the lable name and free ipaimap2 when the above error
ocurrs.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/jfs/jfs_mount.c | 51 ++++++++++++++++++++--------------------------
 1 file changed, 22 insertions(+), 29 deletions(-)

diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
index 5d7d7170c03c..aa4ff7bcaff2 100644
--- a/fs/jfs/jfs_mount.c
+++ b/fs/jfs/jfs_mount.c
@@ -81,14 +81,14 @@ int jfs_mount(struct super_block *sb)
 	 * (initialize mount inode from the superblock)
 	 */
 	if ((rc = chkSuper(sb))) {
-		goto errout20;
+		goto out;
 	}
 
 	ipaimap = diReadSpecial(sb, AGGREGATE_I, 0);
 	if (ipaimap == NULL) {
 		jfs_err("jfs_mount: Failed to read AGGREGATE_I");
 		rc = -EIO;
-		goto errout20;
+		goto out;
 	}
 	sbi->ipaimap = ipaimap;
 
@@ -99,7 +99,7 @@ int jfs_mount(struct super_block *sb)
 	 */
 	if ((rc = diMount(ipaimap))) {
 		jfs_err("jfs_mount: diMount(ipaimap) failed w/rc = %d", rc);
-		goto errout21;
+		goto err_ipaimap;
 	}
 
 	/*
@@ -108,7 +108,7 @@ int jfs_mount(struct super_block *sb)
 	ipbmap = diReadSpecial(sb, BMAP_I, 0);
 	if (ipbmap == NULL) {
 		rc = -EIO;
-		goto errout22;
+		goto err_umount_ipaimap;
 	}
 
 	jfs_info("jfs_mount: ipbmap:0x%p", ipbmap);
@@ -120,7 +120,7 @@ int jfs_mount(struct super_block *sb)
 	 */
 	if ((rc = dbMount(ipbmap))) {
 		jfs_err("jfs_mount: dbMount failed w/rc = %d", rc);
-		goto errout22;
+		goto err_ipbmap;
 	}
 
 	/*
@@ -139,7 +139,7 @@ int jfs_mount(struct super_block *sb)
 		if (!ipaimap2) {
 			jfs_err("jfs_mount: Failed to read AGGREGATE_I");
 			rc = -EIO;
-			goto errout35;
+			goto err_umount_ipbmap;
 		}
 		sbi->ipaimap2 = ipaimap2;
 
@@ -151,7 +151,7 @@ int jfs_mount(struct super_block *sb)
 		if ((rc = diMount(ipaimap2))) {
 			jfs_err("jfs_mount: diMount(ipaimap2) failed, rc = %d",
 				rc);
-			goto errout35;
+			goto err_ipaimap2;
 		}
 	} else
 		/* Secondary aggregate inode table is not valid */
@@ -168,7 +168,7 @@ int jfs_mount(struct super_block *sb)
 		jfs_err("jfs_mount: Failed to read FILESYSTEM_I");
 		/* open fileset secondary inode allocation map */
 		rc = -EIO;
-		goto errout40;
+		goto err_umount_ipaimap2;
 	}
 	jfs_info("jfs_mount: ipimap:0x%p", ipimap);
 
@@ -178,41 +178,34 @@ int jfs_mount(struct super_block *sb)
 	/* initialize fileset inode allocation map */
 	if ((rc = diMount(ipimap))) {
 		jfs_err("jfs_mount: diMount failed w/rc = %d", rc);
-		goto errout41;
+		goto err_ipimap;
 	}
 
-	goto out;
+	return rc;
 
 	/*
 	 *	unwind on error
 	 */
-      errout41:		/* close fileset inode allocation map inode */
+err_ipimap:
+	/* close fileset inode allocation map inode */
 	diFreeSpecial(ipimap);
-
-      errout40:		/* fileset closed */
-
+err_umount_ipaimap2:
 	/* close secondary aggregate inode allocation map */
-	if (ipaimap2) {
+	if (ipaimap2)
 		diUnmount(ipaimap2, 1);
+err_ipaimap2:
+	/* close aggregate inodes */
+	if (ipaimap2)
 		diFreeSpecial(ipaimap2);
-	}
-
-      errout35:
-
-	/* close aggregate block allocation map */
+err_umount_ipbmap:	/* close aggregate block allocation map */
 	dbUnmount(ipbmap, 1);
+err_ipbmap:		/* close aggregate inodes */
 	diFreeSpecial(ipbmap);
-
-      errout22:		/* close aggregate inode allocation map */
-
+err_umount_ipaimap:	/* close aggregate inode allocation map */
 	diUnmount(ipaimap, 1);
-
-      errout21:		/* close aggregate inodes */
+err_ipaimap:		/* close aggregate inodes */
 	diFreeSpecial(ipaimap);
-      errout20:		/* aggregate closed */
-
-      out:
-
+out:
 	if (rc)
 		jfs_err("Mount JFS Failure: %d", rc);
 

From d70247b752f7ae233b966ad3e3be3d72b531abef Mon Sep 17 00:00:00 2001
From: Stephan Gerhold <stephan@gerhold.net>
Date: Mon, 16 Aug 2021 20:18:10 +0200
Subject: [PATCH 1549/1750] arm64: dts: qcom: msm8916: Fix Secondary MI2S bit
 clock

[ Upstream commit 8199a0b31e76d158ac14841e7119890461f8c595 ]

At the moment, playing audio on Secondary MI2S will just end up getting
stuck, without actually playing any audio. This happens because the wrong
bit clock is configured when playing audio on Secondary MI2S.

The PRI_I2S_CLK (better name: SPKR_I2S_CLK) is used by the SPKR audio mux
block that provides both Primary and Secondary MI2S.

The SEC_I2S_CLK (better name: MIC_I2S_CLK) is used by the MIC audio mux
block that provides Tertiary MI2S. Quaternary MI2S is also part of the
MIC audio mux but has its own clock (AUX_I2S_CLK).

This means that (quite confusingly) the SEC_I2S_CLK is not actually
used for Secondary MI2S as the name would suggest. Secondary MI2S
needs to have the same clock as Primary MI2S configured.

Fix the clock list for the lpass node in the device tree and add
a comment to clarify this confusing naming. With these changes,
audio can be played correctly on Secondary MI2S.

Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Fixes: 3761a3618f55 ("arm64: dts: qcom: add lpass node")
Tested-by: Vincent Knecht <vincent.knecht@mailoo.org>
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210816181810.2242-1-stephan@gerhold.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/msm8916.dtsi | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
index 0e34ed48b9fa..b1ffc056eea0 100644
--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
@@ -1322,11 +1322,17 @@ sound: sound@7702000 {
 		lpass: audio-controller@7708000 {
 			status = "disabled";
 			compatible = "qcom,lpass-cpu-apq8016";
+
+			/*
+			 * Note: Unlike the name would suggest, the SEC_I2S_CLK
+			 * is actually only used by Tertiary MI2S while
+			 * Primary/Secondary MI2S both use the PRI_I2S_CLK.
+			 */
 			clocks = <&gcc GCC_ULTAUDIO_AHBFABRIC_IXFABRIC_CLK>,
 				 <&gcc GCC_ULTAUDIO_PCNOC_MPORT_CLK>,
 				 <&gcc GCC_ULTAUDIO_PCNOC_SWAY_CLK>,
 				 <&gcc GCC_ULTAUDIO_LPAIF_PRI_I2S_CLK>,
-				 <&gcc GCC_ULTAUDIO_LPAIF_SEC_I2S_CLK>,
+				 <&gcc GCC_ULTAUDIO_LPAIF_PRI_I2S_CLK>,
 				 <&gcc GCC_ULTAUDIO_LPAIF_SEC_I2S_CLK>,
 				 <&gcc GCC_ULTAUDIO_LPAIF_AUX_I2S_CLK>;
 

From d833ddddec5b1ff44f2c241bf92361e87b228f53 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Fri, 24 Sep 2021 08:50:23 +0200
Subject: [PATCH 1550/1750] arm64: dts: renesas: beacon: Fix Ethernet PHY mode

[ Upstream commit 59a8bda062f8646d99ff8c4956adf37dee1cb75e ]

While networking works fine in RGMII mode when using the Linux generic
PHY driver, it fails when using the Atheros PHY driver.
Fix this by correcting the Ethernet PHY mode to RGMII-RXID, which works
fine with both drivers.

Fixes: a5200e63af57d05e ("arm64: dts: renesas: rzg2: Convert EtherAVB to explicit delay handling")
Reported-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/2a4c15b2df23bb63f15abf9dfb88860477f4f523.1632465965.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
index 3c73dfc430af..929c7910c68d 100644
--- a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
+++ b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi
@@ -54,6 +54,7 @@ wlan_pwrseq: wlan_pwrseq {
 &avb {
 	pinctrl-0 = <&avb_pins>;
 	pinctrl-names = "default";
+	phy-mode = "rgmii-rxid";
 	phy-handle = <&phy0>;
 	rx-internal-delay-ps = <1800>;
 	tx-internal-delay-ps = <2000>;

From 1db71de28bfc7536ea5de54ba40fb3f63b804035 Mon Sep 17 00:00:00 2001
From: Stephan Gerhold <stephan@gerhold.net>
Date: Tue, 28 Sep 2021 13:29:43 +0200
Subject: [PATCH 1551/1750] arm64: dts: qcom: pm8916: Remove wrong reg-names
 for rtc@6000

[ Upstream commit 483de2b44cd3a168458f8f9ff237e78a434729bc ]

While removing the size from the "reg" properties in pm8916.dtsi,
commit bd6429e81010 ("ARM64: dts: qcom: Remove size elements from
pmic reg properties") mistakenly also removed the second register
address for the rtc@6000 device. That one did not represent the size
of the register region but actually the address of the second "alarm"
register region of the rtc@6000 device.

Now there are "reg-names" for two "reg" elements, but there is actually
only one "reg" listed.

Since the DT schema for "qcom,pm8941-rtc" only expects one "reg"
element anyway, just drop the "reg-names" entirely to fix this.

Fixes: bd6429e81010 ("ARM64: dts: qcom: Remove size elements from pmic reg properties")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210928112945.25310-1-stephan@gerhold.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/pm8916.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/pm8916.dtsi b/arch/arm64/boot/dts/qcom/pm8916.dtsi
index f931cb0de231..42180f1b5dbb 100644
--- a/arch/arm64/boot/dts/qcom/pm8916.dtsi
+++ b/arch/arm64/boot/dts/qcom/pm8916.dtsi
@@ -86,7 +86,6 @@ adc-chan@f {
 		rtc@6000 {
 			compatible = "qcom,pm8941-rtc";
 			reg = <0x6000>;
-			reg-names = "rtc", "alarm";
 			interrupts = <0x0 0x61 0x1 IRQ_TYPE_EDGE_RISING>;
 		};
 

From 5972e974ebbb0b603eed3b876192e597808d7c94 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 29 Sep 2021 09:29:33 +0200
Subject: [PATCH 1552/1750] ALSA: hda: Reduce udelay() at SKL+ position
 reporting

[ Upstream commit 46243b85b0ec5d2cee7545e5ce18c015ce91957e ]

The position reporting on Intel Skylake and later chips via
azx_get_pos_skl() contains a udelay(20) call for the capture streams.
A call for this alone doesn't sound too harmful.  However, as the
pointer PCM ops is one of the hottest path in the PCM operations --
especially for the timer-scheduled operations like PulseAudio -- such
a delay hogs CPU usage significantly in the total performance.

The code there was taken from the original code in ASoC SST Skylake
driver blindly.  The udelay() is a workaround for the case where the
reported position is behind the period boundary at the timing
triggered from interrupts; applications often expect that the full
data is available for the whole period when returned (and also that's
the definition of the ALSA PCM period).

OTOH, HD-audio (legacy) driver has already some workarounds for the
delayed position reporting due to its relatively large FIFO, such as
the BDL position adjustment and the delayed period-elapsed call in the
work.  That said, the udelay() is almost superfluous for HD-audio
driver unlike SST, and we can drop the udelay().

Though, the current code doesn't guarantee the full period readiness
as mentioned in the above, but rather it checks the wallclock and
detects the unexpected jump.  That's one missing piece, and the drop
of udelay() needs a bit more sanity checks for the delayed handling.

This patch implements those: the drop of udelay() call in
azx_get_pos_skl() and the more proper check of hwptr in
azx_position_ok().  The latter change is applied only for the case
where the stream is running in the normal mode without
no_period_wakeup flag.  When no_period_wakeup is set, it essentially
ignores the period handling and rather concentrates only on the
current position; which implies that we don't need to care about the
period boundary at all.

Fixes: f87e7f25893d ("ALSA: hda - Improved position reporting on SKL+")
Reported-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210929072934.6809-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_intel.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 1bae0746e726..a8eae31e47ef 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -672,13 +672,17 @@ static int azx_position_check(struct azx *chip, struct azx_dev *azx_dev)
  * the update-IRQ timing.  The IRQ is issued before actually the
  * data is processed.  So, we need to process it afterwords in a
  * workqueue.
+ *
+ * Returns 1 if OK to proceed, 0 for delay handling, -1 for skipping update
  */
 static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
 {
 	struct snd_pcm_substream *substream = azx_dev->core.substream;
+	struct snd_pcm_runtime *runtime = substream->runtime;
 	int stream = substream->stream;
 	u32 wallclk;
 	unsigned int pos;
+	snd_pcm_uframes_t hwptr, target;
 
 	wallclk = azx_readl(chip, WALLCLK) - azx_dev->core.start_wallclk;
 	if (wallclk < (azx_dev->core.period_wallclk * 2) / 3)
@@ -715,6 +719,24 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
 		/* NG - it's below the first next period boundary */
 		return chip->bdl_pos_adj ? 0 : -1;
 	azx_dev->core.start_wallclk += wallclk;
+
+	if (azx_dev->core.no_period_wakeup)
+		return 1; /* OK, no need to check period boundary */
+
+	if (runtime->hw_ptr_base != runtime->hw_ptr_interrupt)
+		return 1; /* OK, already in hwptr updating process */
+
+	/* check whether the period gets really elapsed */
+	pos = bytes_to_frames(runtime, pos);
+	hwptr = runtime->hw_ptr_base + pos;
+	if (hwptr < runtime->status->hw_ptr)
+		hwptr += runtime->buffer_size;
+	target = runtime->hw_ptr_interrupt + runtime->period_size;
+	if (hwptr < target) {
+		/* too early wakeup, process it later */
+		return chip->bdl_pos_adj ? 0 : -1;
+	}
+
 	return 1; /* OK, it's fine */
 }
 
@@ -909,11 +931,7 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev)
 	if (azx_dev->core.substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
 		return azx_skl_get_dpib_pos(chip, azx_dev);
 
-	/* For capture, we need to read posbuf, but it requires a delay
-	 * for the possible boundary overlap; the read of DPIB fetches the
-	 * actual posbuf
-	 */
-	udelay(20);
+	/* read of DPIB fetches the actual posbuf */
 	azx_skl_get_dpib_pos(chip, azx_dev);
 	return azx_get_pos_posbuf(chip, azx_dev);
 }

From 23e8f775d962f4a859b1651ec9792cc8383e6c72 Mon Sep 17 00:00:00 2001
From: Imre Deak <imre.deak@intel.com>
Date: Wed, 23 Jun 2021 16:46:00 +0300
Subject: [PATCH 1553/1750] ALSA: hda: Release controller display power during
 shutdown/reboot

[ Upstream commit 472e18f63c425dda97b888f40f858ea54e3efc17 ]

Make sure the HDA driver's display power reference is released during
shutdown/reboot.

During the shutdown/reboot sequence the pci device core calls the
pm_runtime_resume handler for all devices before calling the driver's
shutdown callback and so the HDA driver's runtime resume callback will
acquire a display power reference (on HSW/BDW). This triggers a power
reference held WARN on HSW/BDW in the i915 driver's subsequent shutdown
handler, which expects all display power references to be released by
that time.

Since the HDA controller is stopped in the shutdown handler in any case,
let's follow here the same sequence as the one during runtime suspend.
This will also reset the HDA link and drop the display power reference,
getting rid of the above WARN.

Tested on HSW.

v2:
- Fix the build for CONFIG_PM=n (Takashi)
- s/__azx_runtime_suspend/azx_shutdown_chip/

Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/3618
References: https://lore.kernel.org/lkml/cea1f9a-52e0-b83-593d-52997fe1aaf6@er-systems.de
Reported-and-tested-by: Thomas Voegtle <tv@lio96.de>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://lore.kernel.org/r/20210623134601.2128663-1-imre.deak@intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_intel.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index a8eae31e47ef..e31eafe73661 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -936,6 +936,14 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev)
 	return azx_get_pos_posbuf(chip, azx_dev);
 }
 
+static void azx_shutdown_chip(struct azx *chip)
+{
+	azx_stop_chip(chip);
+	azx_enter_link_reset(chip);
+	azx_clear_irq_pending(chip);
+	display_power(chip, false);
+}
+
 #ifdef CONFIG_PM
 static DEFINE_MUTEX(card_list_lock);
 static LIST_HEAD(card_list);
@@ -995,14 +1003,6 @@ static bool azx_is_pm_ready(struct snd_card *card)
 	return true;
 }
 
-static void __azx_runtime_suspend(struct azx *chip)
-{
-	azx_stop_chip(chip);
-	azx_enter_link_reset(chip);
-	azx_clear_irq_pending(chip);
-	display_power(chip, false);
-}
-
 static void __azx_runtime_resume(struct azx *chip)
 {
 	struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
@@ -1081,7 +1081,7 @@ static int azx_suspend(struct device *dev)
 
 	chip = card->private_data;
 	bus = azx_bus(chip);
-	__azx_runtime_suspend(chip);
+	azx_shutdown_chip(chip);
 	if (bus->irq >= 0) {
 		free_irq(bus->irq, chip);
 		bus->irq = -1;
@@ -1160,7 +1160,7 @@ static int azx_runtime_suspend(struct device *dev)
 	/* enable controller wake up event */
 	azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) | STATESTS_INT_MASK);
 
-	__azx_runtime_suspend(chip);
+	azx_shutdown_chip(chip);
 	trace_azx_runtime_suspend(chip);
 	return 0;
 }
@@ -2461,7 +2461,7 @@ static void azx_shutdown(struct pci_dev *pci)
 		return;
 	chip = card->private_data;
 	if (chip && chip->running)
-		azx_stop_chip(chip);
+		azx_shutdown_chip(chip);
 }
 
 /* PCI IDs */

From c550c7c9ae9185d9bc30e29a2b85721933bb0bdf Mon Sep 17 00:00:00 2001
From: Imre Deak <imre.deak@intel.com>
Date: Mon, 16 Aug 2021 20:42:59 +0300
Subject: [PATCH 1554/1750] ALSA: hda: Fix hang during shutdown due to link
 reset

[ Upstream commit 0165c4e19f6ec76b535de090e4bd145c73810c51 ]

During system shutdown codecs may be still active, and resetting the
controller->codec HW link in this state - based on the bug reporter's
tests - leads to the shutdown sequence to get stuck. This happens at
least on the reporter's KBL system with an ALC662 codec.

For now fix the issue by skipping the link reset step.

Fixes: 472e18f63c42 ("ALSA: hda: Release controller display power during shutdown/reboot")
References: https://bugzilla.kernel.org/show_bug.cgi?id=214045
References: https://gitlab.freedesktop.org/drm/intel/-/issues/3618#note_1024665
Reported-and-tested-by: youling257@gmail.com
Cc: youling257@gmail.com
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://lore.kernel.org/r/20210816174259.2759103-1-imre.deak@intel.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_intel.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index e31eafe73661..a0955e17adee 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -936,10 +936,11 @@ static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev)
 	return azx_get_pos_posbuf(chip, azx_dev);
 }
 
-static void azx_shutdown_chip(struct azx *chip)
+static void __azx_shutdown_chip(struct azx *chip, bool skip_link_reset)
 {
 	azx_stop_chip(chip);
-	azx_enter_link_reset(chip);
+	if (!skip_link_reset)
+		azx_enter_link_reset(chip);
 	azx_clear_irq_pending(chip);
 	display_power(chip, false);
 }
@@ -948,6 +949,11 @@ static void azx_shutdown_chip(struct azx *chip)
 static DEFINE_MUTEX(card_list_lock);
 static LIST_HEAD(card_list);
 
+static void azx_shutdown_chip(struct azx *chip)
+{
+	__azx_shutdown_chip(chip, false);
+}
+
 static void azx_add_card_list(struct azx *chip)
 {
 	struct hda_intel *hda = container_of(chip, struct hda_intel, chip);
@@ -2461,7 +2467,7 @@ static void azx_shutdown(struct pci_dev *pci)
 		return;
 	chip = card->private_data;
 	if (chip && chip->running)
-		azx_shutdown_chip(chip);
+		__azx_shutdown_chip(chip, true);
 }
 
 /* PCI IDs */

From 3fe8d239e35b0aaf917b099bbe2ace64692f8f02 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Wed, 29 Sep 2021 09:29:34 +0200
Subject: [PATCH 1555/1750] ALSA: hda: Use position buffer for SKL+ again

[ Upstream commit c4ca3871e21fa085096316f5f8d9975cf3dfde1d ]

The commit f87e7f25893d ("ALSA: hda - Improved position reporting on
SKL+") changed the PCM position report for SKL+ chips to use DPIB, but
according to Pierre, DPIB is no best choice for the accurate position
reports and it often reports too early.  The recommended method is
rather the classical position buffer.

This patch makes the PCM position reporting on SKL+ back to the
position buffer again.

Fixes: f87e7f25893d ("ALSA: hda - Improved position reporting on SKL+")
Suggested-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210929072934.6809-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/pci/hda/hda_intel.c | 23 +----------------------
 1 file changed, 1 insertion(+), 22 deletions(-)

diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index a0955e17adee..64115a796af0 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -915,27 +915,6 @@ static int azx_get_delay_from_fifo(struct azx *chip, struct azx_dev *azx_dev,
 	return substream->runtime->delay;
 }
 
-static unsigned int azx_skl_get_dpib_pos(struct azx *chip,
-					 struct azx_dev *azx_dev)
-{
-	return _snd_hdac_chip_readl(azx_bus(chip),
-				    AZX_REG_VS_SDXDPIB_XBASE +
-				    (AZX_REG_VS_SDXDPIB_XINTERVAL *
-				     azx_dev->core.index));
-}
-
-/* get the current DMA position with correction on SKL+ chips */
-static unsigned int azx_get_pos_skl(struct azx *chip, struct azx_dev *azx_dev)
-{
-	/* DPIB register gives a more accurate position for playback */
-	if (azx_dev->core.substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-		return azx_skl_get_dpib_pos(chip, azx_dev);
-
-	/* read of DPIB fetches the actual posbuf */
-	azx_skl_get_dpib_pos(chip, azx_dev);
-	return azx_get_pos_posbuf(chip, azx_dev);
-}
-
 static void __azx_shutdown_chip(struct azx *chip, bool skip_link_reset)
 {
 	azx_stop_chip(chip);
@@ -1632,7 +1611,7 @@ static void assign_position_fix(struct azx *chip, int fix)
 		[POS_FIX_POSBUF] = azx_get_pos_posbuf,
 		[POS_FIX_VIACOMBO] = azx_via_get_position,
 		[POS_FIX_COMBO] = azx_get_pos_lpib,
-		[POS_FIX_SKL] = azx_get_pos_skl,
+		[POS_FIX_SKL] = azx_get_pos_posbuf,
 		[POS_FIX_FIFO] = azx_get_pos_fifo,
 	};
 

From 4438a7457063ea81a2c4d4ffefc38fdd79572535 Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Date: Tue, 7 Sep 2021 11:53:32 +0100
Subject: [PATCH 1556/1750] soundwire: debugfs: use controller id and link_id
 for debugfs

[ Upstream commit 75eac387a2539aa6c6bbee3affa23435f2096396 ]

link_id can be zero and if we have multiple controller instances
in a system like Qualcomm debugfs will end-up with duplicate namespace
resulting in incorrect debugfs entries.

Using bus-id and link-id combination should give a unique debugfs directory
entry and should fix below warning too.
"debugfs: Directory 'master-0' with parent 'soundwire' already present!"

Fixes: bf03473d5bcc ("soundwire: add debugfs support")
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210907105332.1257-1-srinivas.kandagatla@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soundwire/debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soundwire/debugfs.c b/drivers/soundwire/debugfs.c
index b6cad0d59b7b..49900cd207bc 100644
--- a/drivers/soundwire/debugfs.c
+++ b/drivers/soundwire/debugfs.c
@@ -19,7 +19,7 @@ void sdw_bus_debugfs_init(struct sdw_bus *bus)
 		return;
 
 	/* create the debugfs master-N */
-	snprintf(name, sizeof(name), "master-%d", bus->link_id);
+	snprintf(name, sizeof(name), "master-%d-%d", bus->id, bus->link_id);
 	bus->debugfs = debugfs_create_dir(name, sdw_debugfs_root);
 }
 

From ddb13ddacc605e071b6d006b0cda8365daf0c296 Mon Sep 17 00:00:00 2001
From: Igor Pylypiv <ipylypiv@google.com>
Date: Tue, 28 Sep 2021 19:58:47 -0700
Subject: [PATCH 1557/1750] scsi: pm80xx: Fix misleading log statement in
 pm8001_mpi_get_nvmd_resp()

[ Upstream commit 4084a7235d38311a77c86ba69ba849bd787db87b ]

pm8001_mpi_get_nvmd_resp() handles a GET_NVMD_DATA response, not a
SET_NVMD_DATA response, as the log statement implies.

Fixes: 1f889b58716a ("scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition")
Link: https://lore.kernel.org/r/20210929025847.646999-1-ipylypiv@google.com
Reviewed-by: Changyuan Lyu <changyuanl@google.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/pm8001/pm8001_hwi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index 2114d2dd3501..5d751628a634 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -3107,7 +3107,7 @@ pm8001_mpi_get_nvmd_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
 	 * fw_control_context->usrAddr
 	 */
 	complete(pm8001_ha->nvmd_completion);
-	pm8001_dbg(pm8001_ha, MSG, "Set nvm data complete!\n");
+	pm8001_dbg(pm8001_ha, MSG, "Get nvmd data complete!\n");
 	ccb->task = NULL;
 	ccb->ccb_tag = 0xFFFFFFFF;
 	pm8001_tag_free(pm8001_ha, tag);

From e1959450b77a2a9226a818993ea55700872c134b Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Thu, 30 Sep 2021 16:57:14 +0800
Subject: [PATCH 1558/1750] driver core: Fix possible memory leak in
 device_link_add()

[ Upstream commit df0a18149474c7e6b21f6367fbc6bc8d0f192444 ]

I got memory leak as follows:

unreferenced object 0xffff88801f0b2200 (size 64):
  comm "i2c-lis2hh12-21", pid 5455, jiffies 4294944606 (age 15.224s)
  hex dump (first 32 bytes):
    72 65 67 75 6c 61 74 6f 72 3a 72 65 67 75 6c 61  regulator:regula
    74 6f 72 2e 30 2d 2d 69 32 63 3a 31 2d 30 30 31  tor.0--i2c:1-001
  backtrace:
    [<00000000bf5b0c3b>] __kmalloc_track_caller+0x19f/0x3a0
    [<0000000050da42d9>] kvasprintf+0xb5/0x150
    [<000000004bbbed13>] kvasprintf_const+0x60/0x190
    [<00000000cdac7480>] kobject_set_name_vargs+0x56/0x150
    [<00000000bf83f8e8>] dev_set_name+0xc0/0x100
    [<00000000cc1cf7e3>] device_link_add+0x6b4/0x17c0
    [<000000009db9faed>] _regulator_get+0x297/0x680
    [<00000000845e7f2b>] _devm_regulator_get+0x5b/0xe0
    [<000000003958ee25>] st_sensors_power_enable+0x71/0x1b0 [st_sensors]
    [<000000005f450f52>] st_accel_i2c_probe+0xd9/0x150 [st_accel_i2c]
    [<00000000b5f2ab33>] i2c_device_probe+0x4d8/0xbe0
    [<0000000070fb977b>] really_probe+0x299/0xc30
    [<0000000088e226ce>] __driver_probe_device+0x357/0x500
    [<00000000c21dda32>] driver_probe_device+0x4e/0x140
    [<000000004e650441>] __device_attach_driver+0x257/0x340
    [<00000000cf1891b8>] bus_for_each_drv+0x166/0x1e0

When device_register() returns an error, the name allocated in dev_set_name()
will be leaked, the put_device() should be used instead of kfree() to give up
the device reference, then the name will be freed in kobject_cleanup() and the
references of consumer and supplier will be decreased in device_link_release_fn().

Fixes: 287905e68dd2 ("driver core: Expose device link details in sysfs")
Reported-by: Hulk Robot <hulkci@huawei.com>
Reviewed-by: Saravana Kannan <saravanak@google.com>
Reviewed-by: Rafael J. Wysocki <rafael@kernel.org>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20210930085714.2057460-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/core.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 2bc4db5ffe44..389d13616d1d 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -668,9 +668,7 @@ struct device_link *device_link_add(struct device *consumer,
 		     dev_bus_name(supplier), dev_name(supplier),
 		     dev_bus_name(consumer), dev_name(consumer));
 	if (device_register(&link->link_dev)) {
-		put_device(consumer);
-		put_device(supplier);
-		kfree(link);
+		put_device(&link->link_dev);
 		link = NULL;
 		goto out;
 	}

From 8b6124d9245c54d3472d808bedc8a477675c8179 Mon Sep 17 00:00:00 2001
From: Andreas Kemnade <andreas@kemnade.info>
Date: Fri, 1 Oct 2021 09:34:15 +0200
Subject: [PATCH 1559/1750] arm: dts: omap3-gta04a4: accelerometer irq fix

[ Upstream commit 884ea75d79a36faf3731ad9d6b9c29f58697638d ]

Fix typo in pinctrl. It did only work because the bootloader
seems to have initialized it.

Fixes: ee327111953b ("ARM: dts: omap3-gta04: Define and use bma180 irq pin")
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/omap3-gta04.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index 7b8c18e6605e..80c9e5e34136 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -515,7 +515,7 @@ bma180@41 {
 		compatible = "bosch,bma180";
 		reg = <0x41>;
 		pinctrl-names = "default";
-		pintcrl-0 = <&bma180_pins>;
+		pinctrl-0 = <&bma180_pins>;
 		interrupt-parent = <&gpio4>;
 		interrupts = <19 IRQ_TYPE_LEVEL_HIGH>; /* GPIO_115 */
 	};

From 9a2244200908d20310750fbfd04dc6b7997c4080 Mon Sep 17 00:00:00 2001
From: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Date: Wed, 6 Oct 2021 13:40:41 +0300
Subject: [PATCH 1560/1750] ASoC: SOF: topology: do not power down primary core
 during topology removal

[ Upstream commit ec626334eaffe101df9ed79e161eba95124e64ad ]

When removing the topology components, do not power down
the primary core. Doing so will result in an IPC timeout
when the SOF PCI device runtime suspends.

Fixes: 0dcdf84289fb ("ASoC: SOF: add a "core" parameter to widget loading functions")

Signed-off-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Link: https://lore.kernel.org/r/20211006104041.27183-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/sof/topology.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
index 69313fbdb636..b6327c30c2b5 100644
--- a/sound/soc/sof/topology.c
+++ b/sound/soc/sof/topology.c
@@ -2590,6 +2590,15 @@ static int sof_widget_unload(struct snd_soc_component *scomp,
 
 		/* power down the pipeline schedule core */
 		pipeline = swidget->private;
+
+		/*
+		 * Runtime PM should still function normally if topology loading fails and
+		 * it's components are unloaded. Do not power down the primary core so that the
+		 * CTX_SAVE IPC can succeed during runtime suspend.
+		 */
+		if (pipeline->core == SOF_DSP_PRIMARY_CORE)
+			break;
+
 		ret = snd_sof_dsp_core_power_down(sdev, 1 << pipeline->core);
 		if (ret < 0)
 			dev_err(scomp->dev, "error: powering down pipeline schedule core %d\n",

From d3833d3c569aae1395ac21665644b587e7a92ba0 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sun, 27 Jun 2021 17:54:31 +0200
Subject: [PATCH 1561/1750] soc/tegra: Fix an error handling path in
 tegra_powergate_power_up()

[ Upstream commit 986b5094708e508baa452a23ffe809870934a7df ]

If an error occurs after a successful tegra_powergate_enable_clocks()
call, it must be undone by a tegra_powergate_disable_clocks() call, as
already done in the below and above error handling paths of this function.

Update the 'goto' to branch at the correct place of the error handling
path.

Fixes: a38045121bf4 ("soc/tegra: pmc: Add generic PM domain support")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/tegra/pmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
index 0118bd986f90..857354a69c39 100644
--- a/drivers/soc/tegra/pmc.c
+++ b/drivers/soc/tegra/pmc.c
@@ -705,7 +705,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg,
 
 	err = reset_control_deassert(pg->reset);
 	if (err)
-		goto powergate_off;
+		goto disable_clks;
 
 	usleep_range(10, 20);
 

From 20cc0fa1d030aa49e268a23e71c7f1110f3060fa Mon Sep 17 00:00:00 2001
From: Dongliang Mu <mudongliangabcd@gmail.com>
Date: Sat, 25 Sep 2021 23:14:32 +0800
Subject: [PATCH 1562/1750] memory: fsl_ifc: fix leak of irq and nand_irq in
 fsl_ifc_ctrl_probe

[ Upstream commit 4ed2f3545c2e5acfbccd7f85fea5b1a82e9862d7 ]

The error handling code of fsl_ifc_ctrl_probe is problematic. When
fsl_ifc_ctrl_init fails or request_irq of fsl_ifc_ctrl_dev->irq fails,
it forgets to free the irq and nand_irq. Meanwhile, if request_irq of
fsl_ifc_ctrl_dev->nand_irq fails, it will still free nand_irq even if
the request_irq is not successful.

Fix this by refactoring the error handling code.

Fixes: d2ae2e20fbdd ("driver/memory:Move Freescale IFC driver to a common driver")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Link: https://lore.kernel.org/r/20210925151434.8170-1-mudongliangabcd@gmail.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/memory/fsl_ifc.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c
index d062c2f8250f..75a8c38df939 100644
--- a/drivers/memory/fsl_ifc.c
+++ b/drivers/memory/fsl_ifc.c
@@ -263,7 +263,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 
 	ret = fsl_ifc_ctrl_init(fsl_ifc_ctrl_dev);
 	if (ret < 0)
-		goto err;
+		goto err_unmap_nandirq;
 
 	init_waitqueue_head(&fsl_ifc_ctrl_dev->nand_wait);
 
@@ -272,7 +272,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 	if (ret != 0) {
 		dev_err(&dev->dev, "failed to install irq (%d)\n",
 			fsl_ifc_ctrl_dev->irq);
-		goto err_irq;
+		goto err_unmap_nandirq;
 	}
 
 	if (fsl_ifc_ctrl_dev->nand_irq) {
@@ -281,17 +281,16 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev)
 		if (ret != 0) {
 			dev_err(&dev->dev, "failed to install irq (%d)\n",
 				fsl_ifc_ctrl_dev->nand_irq);
-			goto err_nandirq;
+			goto err_free_irq;
 		}
 	}
 
 	return 0;
 
-err_nandirq:
-	free_irq(fsl_ifc_ctrl_dev->nand_irq, fsl_ifc_ctrl_dev);
-	irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq);
-err_irq:
+err_free_irq:
 	free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev);
+err_unmap_nandirq:
+	irq_dispose_mapping(fsl_ifc_ctrl_dev->nand_irq);
 	irq_dispose_mapping(fsl_ifc_ctrl_dev->irq);
 err:
 	iounmap(fsl_ifc_ctrl_dev->gregs);

From fb24243e6d7f2db95bd31d6a76e5dbe6e58425fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20L=C3=A9ger?= <clement.leger@bootlin.com>
Date: Mon, 13 Sep 2021 10:26:33 +0200
Subject: [PATCH 1563/1750] clk: at91: check pmc node status before registering
 syscore ops
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit c405f5c15e9f6094f2fa1658e73e56f3058e2122 ]

Currently, at91 pmc driver always register the syscore_ops whatever
the status of the pmc node that has been found. When set as secure
and disabled, the pmc should not be accessed or this will generate
abort exceptions.
To avoid this, add a check on node availability before registering
the syscore operations.

Signed-off-by: Clément Léger <clement.leger@bootlin.com>
Link: https://lore.kernel.org/r/20210913082633.110168-1-clement.leger@bootlin.com
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Fixes: b3b02eac33ed ("clk: at91: Add sama5d2 suspend/resume")
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/pmc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c
index 20ee9dccee78..b40035b011d0 100644
--- a/drivers/clk/at91/pmc.c
+++ b/drivers/clk/at91/pmc.c
@@ -267,6 +267,11 @@ static int __init pmc_register_ops(void)
 	if (!np)
 		return -ENODEV;
 
+	if (!of_device_is_available(np)) {
+		of_node_put(np);
+		return -ENODEV;
+	}
+
 	pmcreg = device_node_to_regmap(np);
 	of_node_put(np);
 	if (IS_ERR(pmcreg))

From 67074c63cd670878f81a50c8cc386e176ab8647a Mon Sep 17 00:00:00 2001
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Date: Wed, 15 Sep 2021 15:34:35 +0200
Subject: [PATCH 1564/1750] video: fbdev: chipsfb: use memset_io() instead of
 memset()

[ Upstream commit f2719b26ae27282c145202ffd656d5ff1fe737cc ]

While investigating a lockup at startup on Powerbook 3400C, it was
identified that the fbdev driver generates alignment exception at
startup:

  --- interrupt: 600 at memset+0x60/0xc0
  NIP:  c0021414 LR: c03fc49c CTR: 00007fff
  REGS: ca021c10 TRAP: 0600   Tainted: G        W          (5.14.2-pmac-00727-g12a41fa69492)
  MSR:  00009032 <EE,ME,IR,DR,RI>  CR: 44008442  XER: 20000100
  DAR: cab80020 DSISR: 00017c07
  GPR00: 00000007 ca021cd0 c14412e0 cab80000 00000000 00100000 cab8001c 00000004
  GPR08: 00100000 00007fff 00000000 00000000 84008442 00000000 c0006fb4 00000000
  GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00100000
  GPR24: 00000000 81800000 00000320 c15fa400 c14d1878 00000000 c14d1800 c094e19c
  NIP [c0021414] memset+0x60/0xc0
  LR [c03fc49c] chipsfb_pci_init+0x160/0x580
  --- interrupt: 600
  [ca021cd0] [c03fc46c] chipsfb_pci_init+0x130/0x580 (unreliable)
  [ca021d20] [c03a3a70] pci_device_probe+0xf8/0x1b8
  [ca021d50] [c043d584] really_probe.part.0+0xac/0x388
  [ca021d70] [c043d914] __driver_probe_device+0xb4/0x170
  [ca021d90] [c043da18] driver_probe_device+0x48/0x144
  [ca021dc0] [c043e318] __driver_attach+0x11c/0x1c4
  [ca021de0] [c043ad30] bus_for_each_dev+0x88/0xf0
  [ca021e10] [c043c724] bus_add_driver+0x190/0x22c
  [ca021e40] [c043ee94] driver_register+0x9c/0x170
  [ca021e60] [c0006c28] do_one_initcall+0x54/0x1ec
  [ca021ed0] [c08246e4] kernel_init_freeable+0x1c0/0x270
  [ca021f10] [c0006fdc] kernel_init+0x28/0x11c
  [ca021f30] [c0017148] ret_from_kernel_thread+0x14/0x1c
  Instruction dump:
  7d4601a4 39490777 7d4701a4 39490888 7d4801a4 39490999 7d4901a4 39290aaa
  7d2a01a4 4c00012c 4bfffe88 0fe00000 <4bfffe80> 9421fff0 38210010 48001970

This is due to 'dcbz' instruction being used on non-cached memory.
'dcbz' instruction is used by memset() to zeroize a complete
cacheline at once, and memset() is not expected to be used on non
cached memory.

When performing a 'sparse' check on fbdev driver, it also appears
that the use of memset() is unexpected:

  drivers/video/fbdev/chipsfb.c:334:17: warning: incorrect type in argument 1 (different address spaces)
  drivers/video/fbdev/chipsfb.c:334:17:    expected void *
  drivers/video/fbdev/chipsfb.c:334:17:    got char [noderef] __iomem *screen_base
  drivers/video/fbdev/chipsfb.c:334:15: warning: memset with byte count of 1048576

Use fb_memset() instead of memset(). fb_memset() is defined as
memset_io() for powerpc.

Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK")
Reported-by: Stan Johnson <userm57@yahoo.com>
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/884a54f1e5cb774c1d9b4db780209bee5d4f6718.1631712563.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/video/fbdev/chipsfb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
index 998067b701fa..393894af26f8 100644
--- a/drivers/video/fbdev/chipsfb.c
+++ b/drivers/video/fbdev/chipsfb.c
@@ -331,7 +331,7 @@ static const struct fb_var_screeninfo chipsfb_var = {
 
 static void init_chips(struct fb_info *p, unsigned long addr)
 {
-	memset(p->screen_base, 0, 0x100000);
+	fb_memset(p->screen_base, 0, 0x100000);
 
 	p->fix = chipsfb_fix;
 	p->fix.smem_start = addr;

From 61c5d9fa5671be8b55f7a2f04a29759d9ddaa693 Mon Sep 17 00:00:00 2001
From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Date: Wed, 2 Dec 2020 10:34:53 +0530
Subject: [PATCH 1565/1750] powerpc: Refactor is_kvm_guest() declaration to new
 header

[ Upstream commit 92cc6bf01c7f4c5cfefd1963985c0064687ebeda ]

Only code/declaration movement, in anticipation of doing a KVM-aware
vcpu_is_preempted(). No additional changes.

Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201202050456.164005-2-srikar@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/firmware.h  |  6 ------
 arch/powerpc/include/asm/kvm_guest.h | 15 +++++++++++++++
 arch/powerpc/include/asm/kvm_para.h  |  2 +-
 arch/powerpc/kernel/firmware.c       |  1 +
 arch/powerpc/platforms/pseries/smp.c |  1 +
 5 files changed, 18 insertions(+), 7 deletions(-)
 create mode 100644 arch/powerpc/include/asm/kvm_guest.h

diff --git a/arch/powerpc/include/asm/firmware.h b/arch/powerpc/include/asm/firmware.h
index 0b295bdb201e..aa6a5ef5d483 100644
--- a/arch/powerpc/include/asm/firmware.h
+++ b/arch/powerpc/include/asm/firmware.h
@@ -134,12 +134,6 @@ extern int ibm_nmi_interlock_token;
 
 extern unsigned int __start___fw_ftr_fixup, __stop___fw_ftr_fixup;
 
-#if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST)
-bool is_kvm_guest(void);
-#else
-static inline bool is_kvm_guest(void) { return false; }
-#endif
-
 #ifdef CONFIG_PPC_PSERIES
 void pseries_probe_fw_features(void);
 #else
diff --git a/arch/powerpc/include/asm/kvm_guest.h b/arch/powerpc/include/asm/kvm_guest.h
new file mode 100644
index 000000000000..d2c946dbbd2c
--- /dev/null
+++ b/arch/powerpc/include/asm/kvm_guest.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2020 IBM Corporation
+ */
+
+#ifndef _ASM_POWERPC_KVM_GUEST_H_
+#define _ASM_POWERPC_KVM_GUEST_H_
+
+#if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST)
+bool is_kvm_guest(void);
+#else
+static inline bool is_kvm_guest(void) { return false; }
+#endif
+
+#endif /* _ASM_POWERPC_KVM_GUEST_H_ */
diff --git a/arch/powerpc/include/asm/kvm_para.h b/arch/powerpc/include/asm/kvm_para.h
index 744612054c94..abe1b5e82547 100644
--- a/arch/powerpc/include/asm/kvm_para.h
+++ b/arch/powerpc/include/asm/kvm_para.h
@@ -8,7 +8,7 @@
 #ifndef __POWERPC_KVM_PARA_H__
 #define __POWERPC_KVM_PARA_H__
 
-#include <asm/firmware.h>
+#include <asm/kvm_guest.h>
 
 #include <uapi/asm/kvm_para.h>
 
diff --git a/arch/powerpc/kernel/firmware.c b/arch/powerpc/kernel/firmware.c
index fe48d319d490..5f48e5ad24cd 100644
--- a/arch/powerpc/kernel/firmware.c
+++ b/arch/powerpc/kernel/firmware.c
@@ -14,6 +14,7 @@
 #include <linux/of.h>
 
 #include <asm/firmware.h>
+#include <asm/kvm_guest.h>
 
 #ifdef CONFIG_PPC64
 unsigned long powerpc_firmware_features __read_mostly;
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 624e80b00eb1..7be7094075ab 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -42,6 +42,7 @@
 #include <asm/plpar_wrappers.h>
 #include <asm/code-patching.h>
 #include <asm/svm.h>
+#include <asm/kvm_guest.h>
 
 #include "pseries.h"
 

From 113207234aac0da666ef857c96de6f91d25d443c Mon Sep 17 00:00:00 2001
From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Date: Wed, 2 Dec 2020 10:34:54 +0530
Subject: [PATCH 1566/1750] powerpc: Rename is_kvm_guest() to check_kvm_guest()

[ Upstream commit 16520a858a995742c2d2248e86a6026bd0316562 ]

We want to reuse the is_kvm_guest() name in a subsequent patch but
with a new body. Hence rename is_kvm_guest() to check_kvm_guest(). No
additional changes.

Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: kernel test robot <lkp@intel.com> # int -> bool fix
[mpe: Fold in fix from lkp to use true/false not 0/1]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201202050456.164005-3-srikar@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/kvm_guest.h | 4 ++--
 arch/powerpc/include/asm/kvm_para.h  | 2 +-
 arch/powerpc/kernel/firmware.c       | 8 ++++----
 arch/powerpc/platforms/pseries/smp.c | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/powerpc/include/asm/kvm_guest.h b/arch/powerpc/include/asm/kvm_guest.h
index d2c946dbbd2c..d7749ecb30d4 100644
--- a/arch/powerpc/include/asm/kvm_guest.h
+++ b/arch/powerpc/include/asm/kvm_guest.h
@@ -7,9 +7,9 @@
 #define _ASM_POWERPC_KVM_GUEST_H_
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST)
-bool is_kvm_guest(void);
+bool check_kvm_guest(void);
 #else
-static inline bool is_kvm_guest(void) { return false; }
+static inline bool check_kvm_guest(void) { return false; }
 #endif
 
 #endif /* _ASM_POWERPC_KVM_GUEST_H_ */
diff --git a/arch/powerpc/include/asm/kvm_para.h b/arch/powerpc/include/asm/kvm_para.h
index abe1b5e82547..6fba06b6cfdb 100644
--- a/arch/powerpc/include/asm/kvm_para.h
+++ b/arch/powerpc/include/asm/kvm_para.h
@@ -14,7 +14,7 @@
 
 static inline int kvm_para_available(void)
 {
-	return IS_ENABLED(CONFIG_KVM_GUEST) && is_kvm_guest();
+	return IS_ENABLED(CONFIG_KVM_GUEST) && check_kvm_guest();
 }
 
 static inline unsigned int kvm_arch_para_features(void)
diff --git a/arch/powerpc/kernel/firmware.c b/arch/powerpc/kernel/firmware.c
index 5f48e5ad24cd..c3140c6084c9 100644
--- a/arch/powerpc/kernel/firmware.c
+++ b/arch/powerpc/kernel/firmware.c
@@ -22,17 +22,17 @@ EXPORT_SYMBOL_GPL(powerpc_firmware_features);
 #endif
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST)
-bool is_kvm_guest(void)
+bool check_kvm_guest(void)
 {
 	struct device_node *hyper_node;
 
 	hyper_node = of_find_node_by_path("/hypervisor");
 	if (!hyper_node)
-		return 0;
+		return false;
 
 	if (!of_device_is_compatible(hyper_node, "linux,kvm"))
-		return 0;
+		return false;
 
-	return 1;
+	return true;
 }
 #endif
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 7be7094075ab..9d596b41ec67 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -208,7 +208,7 @@ static __init void pSeries_smp_probe(void)
 	if (!cpu_has_feature(CPU_FTR_SMT))
 		return;
 
-	if (is_kvm_guest()) {
+	if (check_kvm_guest()) {
 		/*
 		 * KVM emulates doorbells by disabling FSCR[MSGP] so msgsndp
 		 * faults to the hypervisor which then reads the instruction

From e01a4d7560b64791c350cd531b84a6a53ba6325b Mon Sep 17 00:00:00 2001
From: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Date: Wed, 2 Dec 2020 10:34:55 +0530
Subject: [PATCH 1567/1750] powerpc: Reintroduce is_kvm_guest() as a fast-path
 check

[ Upstream commit a21d1becaa3f17a97b933ffa677b526afc514ec5 ]

Introduce a static branch that would be set during boot if the OS
happens to be a KVM guest. Subsequent checks to see if we are on KVM
will rely on this static branch. This static branch would be used in
vcpu_is_preempted() in a subsequent patch.

Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201202050456.164005-4-srikar@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/kvm_guest.h | 10 ++++++++++
 arch/powerpc/include/asm/kvm_para.h  |  2 +-
 arch/powerpc/kernel/firmware.c       |  2 ++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/include/asm/kvm_guest.h b/arch/powerpc/include/asm/kvm_guest.h
index d7749ecb30d4..2fca299f7e19 100644
--- a/arch/powerpc/include/asm/kvm_guest.h
+++ b/arch/powerpc/include/asm/kvm_guest.h
@@ -7,8 +7,18 @@
 #define _ASM_POWERPC_KVM_GUEST_H_
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST)
+#include <linux/jump_label.h>
+
+DECLARE_STATIC_KEY_FALSE(kvm_guest);
+
+static inline bool is_kvm_guest(void)
+{
+	return static_branch_unlikely(&kvm_guest);
+}
+
 bool check_kvm_guest(void);
 #else
+static inline bool is_kvm_guest(void) { return false; }
 static inline bool check_kvm_guest(void) { return false; }
 #endif
 
diff --git a/arch/powerpc/include/asm/kvm_para.h b/arch/powerpc/include/asm/kvm_para.h
index 6fba06b6cfdb..abe1b5e82547 100644
--- a/arch/powerpc/include/asm/kvm_para.h
+++ b/arch/powerpc/include/asm/kvm_para.h
@@ -14,7 +14,7 @@
 
 static inline int kvm_para_available(void)
 {
-	return IS_ENABLED(CONFIG_KVM_GUEST) && check_kvm_guest();
+	return IS_ENABLED(CONFIG_KVM_GUEST) && is_kvm_guest();
 }
 
 static inline unsigned int kvm_arch_para_features(void)
diff --git a/arch/powerpc/kernel/firmware.c b/arch/powerpc/kernel/firmware.c
index c3140c6084c9..c9e2819b095a 100644
--- a/arch/powerpc/kernel/firmware.c
+++ b/arch/powerpc/kernel/firmware.c
@@ -22,6 +22,7 @@ EXPORT_SYMBOL_GPL(powerpc_firmware_features);
 #endif
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST)
+DEFINE_STATIC_KEY_FALSE(kvm_guest);
 bool check_kvm_guest(void)
 {
 	struct device_node *hyper_node;
@@ -33,6 +34,7 @@ bool check_kvm_guest(void)
 	if (!of_device_is_compatible(hyper_node, "linux,kvm"))
 		return false;
 
+	static_branch_enable(&kvm_guest);
 	return true;
 }
 #endif

From 54965d92a4645e3606202544c3a74ac443fd5c22 Mon Sep 17 00:00:00 2001
From: Michael Ellerman <mpe@ellerman.id.au>
Date: Wed, 23 Jun 2021 23:05:14 +1000
Subject: [PATCH 1568/1750] powerpc: Fix is_kvm_guest() / kvm_para_available()

[ Upstream commit 95839225639ba7c3d8d7231b542728dcf222bf2d ]

Commit a21d1becaa3f ("powerpc: Reintroduce is_kvm_guest() as a fast-path
check") added is_kvm_guest() and changed kvm_para_available() to use it.

is_kvm_guest() checks a static key, kvm_guest, and that static key is
set in check_kvm_guest().

The problem is check_kvm_guest() is only called on pseries, and even
then only in some configurations. That means is_kvm_guest() always
returns false on all non-pseries and some pseries depending on
configuration. That's a bug.

For PR KVM guests this is noticable because they no longer do live
patching of themselves, which can be detected by the omission of a
message in dmesg such as:

  KVM: Live patching for a fast VM worked

To fix it make check_kvm_guest() an initcall, to ensure it's always
called at boot. It needs to be core so that it runs before
kvm_guest_init() which is postcore. To be an initcall it needs to return
int, where 0 means success, so update that.

We still call it manually in pSeries_smp_probe(), because that runs
before init calls are run.

Fixes: a21d1becaa3f ("powerpc: Reintroduce is_kvm_guest() as a fast-path check")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210623130514.2543232-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/include/asm/kvm_guest.h |  4 ++--
 arch/powerpc/kernel/firmware.c       | 10 ++++++----
 arch/powerpc/platforms/pseries/smp.c |  4 +++-
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/include/asm/kvm_guest.h b/arch/powerpc/include/asm/kvm_guest.h
index 2fca299f7e19..c63105d2c9e7 100644
--- a/arch/powerpc/include/asm/kvm_guest.h
+++ b/arch/powerpc/include/asm/kvm_guest.h
@@ -16,10 +16,10 @@ static inline bool is_kvm_guest(void)
 	return static_branch_unlikely(&kvm_guest);
 }
 
-bool check_kvm_guest(void);
+int check_kvm_guest(void);
 #else
 static inline bool is_kvm_guest(void) { return false; }
-static inline bool check_kvm_guest(void) { return false; }
+static inline int check_kvm_guest(void) { return 0; }
 #endif
 
 #endif /* _ASM_POWERPC_KVM_GUEST_H_ */
diff --git a/arch/powerpc/kernel/firmware.c b/arch/powerpc/kernel/firmware.c
index c9e2819b095a..c7022c41cc31 100644
--- a/arch/powerpc/kernel/firmware.c
+++ b/arch/powerpc/kernel/firmware.c
@@ -23,18 +23,20 @@ EXPORT_SYMBOL_GPL(powerpc_firmware_features);
 
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST)
 DEFINE_STATIC_KEY_FALSE(kvm_guest);
-bool check_kvm_guest(void)
+int __init check_kvm_guest(void)
 {
 	struct device_node *hyper_node;
 
 	hyper_node = of_find_node_by_path("/hypervisor");
 	if (!hyper_node)
-		return false;
+		return 0;
 
 	if (!of_device_is_compatible(hyper_node, "linux,kvm"))
-		return false;
+		return 0;
 
 	static_branch_enable(&kvm_guest);
-	return true;
+
+	return 0;
 }
+core_initcall(check_kvm_guest); // before kvm_guest_init()
 #endif
diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c
index 9d596b41ec67..f47429323eee 100644
--- a/arch/powerpc/platforms/pseries/smp.c
+++ b/arch/powerpc/platforms/pseries/smp.c
@@ -208,7 +208,9 @@ static __init void pSeries_smp_probe(void)
 	if (!cpu_has_feature(CPU_FTR_SMT))
 		return;
 
-	if (check_kvm_guest()) {
+	check_kvm_guest();
+
+	if (is_kvm_guest()) {
 		/*
 		 * KVM emulates doorbells by disabling FSCR[MSGP] so msgsndp
 		 * faults to the hypervisor which then reads the instruction

From cfbf58ac8ec25000ceb3ceae83b20efde1ece611 Mon Sep 17 00:00:00 2001
From: Nathan Lynch <nathanl@linux.ibm.com>
Date: Tue, 28 Sep 2021 07:45:50 -0500
Subject: [PATCH 1569/1750] powerpc: fix unbalanced node refcount in
 check_kvm_guest()

[ Upstream commit 56537faf8821e361d739fc5ff58c9c40f54a1d4c ]

When check_kvm_guest() succeeds in looking up a /hypervisor OF node, it
returns without performing a matching put for the lookup, leaving the
node's reference count elevated.

Add the necessary call to of_node_put(), rearranging the code slightly to
avoid repetition or goto.

Fixes: 107c55005fbd ("powerpc/pseries: Add KVM guest doorbell restrictions")
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Reviewed-by: Tyrel Datwyler <tyreld@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210928124550.132020-1-nathanl@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/kernel/firmware.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/kernel/firmware.c b/arch/powerpc/kernel/firmware.c
index c7022c41cc31..20328f72f9f2 100644
--- a/arch/powerpc/kernel/firmware.c
+++ b/arch/powerpc/kernel/firmware.c
@@ -31,11 +31,10 @@ int __init check_kvm_guest(void)
 	if (!hyper_node)
 		return 0;
 
-	if (!of_device_is_compatible(hyper_node, "linux,kvm"))
-		return 0;
-
-	static_branch_enable(&kvm_guest);
+	if (of_device_is_compatible(hyper_node, "linux,kvm"))
+		static_branch_enable(&kvm_guest);
 
+	of_node_put(hyper_node);
 	return 0;
 }
 core_initcall(check_kvm_guest); // before kvm_guest_init()

From 92a80e1ca20ea9f6099f967494cca0cb57b952a9 Mon Sep 17 00:00:00 2001
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Date: Tue, 5 Oct 2021 16:45:16 +0300
Subject: [PATCH 1570/1750] serial: 8250_dw: Drop wrong use of ACPI_PTR()

[ Upstream commit ebabb77a2a115b6c5e68f7364b598310b5f61fb2 ]

ACPI_PTR() is more harmful than helpful. For example, in this case
if CONFIG_ACPI=n, the ID table left unused which is not what we want.

Instead of adding ifdeffery here and there, drop ACPI_PTR().

Fixes: 6a7320c4669f ("serial: 8250_dw: Add ACPI 5.0 support")
Reported-by: Daniel Palmer <daniel@0x0f.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20211005134516.23218-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/8250/8250_dw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index a3a0154da567..49559731bbcf 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -726,7 +726,7 @@ static struct platform_driver dw8250_platform_driver = {
 		.name		= "dw-apb-uart",
 		.pm		= &dw8250_pm_ops,
 		.of_match_table	= dw8250_of_match,
-		.acpi_match_table = ACPI_PTR(dw8250_acpi_match),
+		.acpi_match_table = dw8250_acpi_match,
 	},
 	.probe			= dw8250_probe,
 	.remove			= dw8250_remove,

From d8da6328ecaed6cad8c63f27a47405aa0e22fe71 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 11 Oct 2021 15:37:39 +0300
Subject: [PATCH 1571/1750] usb: gadget: hid: fix error code in do_config()

[ Upstream commit 68e7c510fdf4f6167404609da52e1979165649f6 ]

Return an error code if usb_get_function() fails.  Don't return success.

Fixes: 4bc8a33f2407 ("usb: gadget: hid: convert to new interface of f_hid")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20211011123739.GC15188@kili
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/legacy/hid.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c
index 5b27d289443f..3912cc805f3a 100644
--- a/drivers/usb/gadget/legacy/hid.c
+++ b/drivers/usb/gadget/legacy/hid.c
@@ -99,8 +99,10 @@ static int do_config(struct usb_configuration *c)
 
 	list_for_each_entry(e, &hidg_func_list, node) {
 		e->f = usb_get_function(e->fi);
-		if (IS_ERR(e->f))
+		if (IS_ERR(e->f)) {
+			status = PTR_ERR(e->f);
 			goto put;
+		}
 		status = usb_add_function(c, e->f);
 		if (status < 0) {
 			usb_put_function(e->f);

From c553d673018df441a11120b3de12aa1025e88a72 Mon Sep 17 00:00:00 2001
From: Jakob Hauser <jahau@rocketmail.com>
Date: Fri, 8 Oct 2021 10:32:45 +0200
Subject: [PATCH 1572/1750] =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:?=
 =?UTF-8?q?=20Change=20voltage=20values=20to=20=C2=B5V?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit bf895295e9a73411889816f1a0c1f4f1a2d9c678 ]

Currently the rt5033_battery driver provides voltage values in mV. It
should be µV as stated in Documentation/power/power_supply_class.rst.

Fixes: b847dd96e659 ("power: rt5033_battery: Add RT5033 Fuel gauge device driver")
Cc: Beomho Seo <beomho.seo@samsung.com>
Cc: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Jakob Hauser <jahau@rocketmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/rt5033_battery.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c
index 9ad0afe83d1b..7a23c70f4879 100644
--- a/drivers/power/supply/rt5033_battery.c
+++ b/drivers/power/supply/rt5033_battery.c
@@ -60,7 +60,7 @@ static int rt5033_battery_get_watt_prop(struct i2c_client *client,
 	regmap_read(battery->regmap, regh, &msb);
 	regmap_read(battery->regmap, regl, &lsb);
 
-	ret = ((msb << 4) + (lsb >> 4)) * 1250 / 1000;
+	ret = ((msb << 4) + (lsb >> 4)) * 1250;
 
 	return ret;
 }

From 12c46732042c812a97f5d40cdb25aa21784d6079 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Fri, 8 Oct 2021 14:31:50 +0800
Subject: [PATCH 1573/1750] power: supply: max17040: fix null-ptr-deref in
 max17040_probe()

[ Upstream commit 1d422ecfc48ee683ae1ccc9217764f6310c0ffce ]

Add check the return value of devm_regmap_init_i2c(), otherwise
later access may cause null-ptr-deref as follows:

KASAN: null-ptr-deref in range [0x0000000000000360-0x0000000000000367]
RIP: 0010:regmap_read+0x33/0x170
Call Trace:
  max17040_probe+0x61b/0xff0 [max17040_battery]
 ? write_comp_data+0x2a/0x90
 ? max17040_set_property+0x1d0/0x1d0 [max17040_battery]
 ? tracer_hardirqs_on+0x33/0x520
 ? __sanitizer_cov_trace_pc+0x1d/0x50
 ? _raw_spin_unlock_irqrestore+0x4b/0x60
 ? trace_hardirqs_on+0x63/0x2d0
 ? write_comp_data+0x2a/0x90
 ? __sanitizer_cov_trace_pc+0x1d/0x50
 ? max17040_set_property+0x1d0/0x1d0 [max17040_battery]
 i2c_device_probe+0xa31/0xbe0

Fixes: 6455a8a84bdf ("power: supply: max17040: Use regmap i2c")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/max17040_battery.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/power/supply/max17040_battery.c b/drivers/power/supply/max17040_battery.c
index d956c67d5155..b6b29ec3d93e 100644
--- a/drivers/power/supply/max17040_battery.c
+++ b/drivers/power/supply/max17040_battery.c
@@ -482,6 +482,8 @@ static int max17040_probe(struct i2c_client *client,
 	chip->client = client;
 	chip->regmap = devm_regmap_init_i2c(client, &max17040_regmap);
 	chip->pdata = client->dev.platform_data;
+	if (IS_ERR(chip->regmap))
+		return PTR_ERR(chip->regmap);
 	chip_id = (enum chip_id) id->driver_data;
 	if (client->dev.of_node) {
 		ret = max17040_get_of_data(chip);

From bce61de56480e92e69e748671519ae342616324d Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 6 Oct 2021 10:32:43 +0300
Subject: [PATCH 1574/1750] scsi: csiostor: Uninitialized data in
 csio_ln_vnp_read_cbfn()

[ Upstream commit f4875d509a0a78ad294a1a538d534b5ba94e685a ]

This variable is just a temporary variable, used to do an endian
conversion.  The problem is that the last byte is not initialized.  After
the conversion is completely done, the last byte is discarded so it doesn't
cause a problem.  But static checkers and the KMSan runtime checker can
detect the uninitialized read and will complain about it.

Link: https://lore.kernel.org/r/20211006073242.GA8404@kili
Fixes: 5036f0a0ecd3 ("[SCSI] csiostor: Fix sparse warnings.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/csiostor/csio_lnode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
index dc98f51f466f..d5ac93897023 100644
--- a/drivers/scsi/csiostor/csio_lnode.c
+++ b/drivers/scsi/csiostor/csio_lnode.c
@@ -619,7 +619,7 @@ csio_ln_vnp_read_cbfn(struct csio_hw *hw, struct csio_mb *mbp)
 	struct fc_els_csp *csp;
 	struct fc_els_cssp *clsp;
 	enum fw_retval retval;
-	__be32 nport_id;
+	__be32 nport_id = 0;
 
 	retval = FW_CMD_RETVAL_G(ntohl(rsp->alloc_to_len16));
 	if (retval != FW_SUCCESS) {

From 0058f7fbea134a033fe35af7f5a8e8befe77ab13 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leonro@nvidia.com>
Date: Tue, 12 Oct 2021 10:28:43 +0300
Subject: [PATCH 1575/1750] RDMA/mlx4: Return missed an error if device doesn't
 support steering

[ Upstream commit f4e56ec4452f48b8292dcf0e1c4bdac83506fb8b ]

The error flow fixed in this patch is not possible because all kernel
users of create QP interface check that device supports steering before
set IB_QP_CREATE_NETIF_QP flag.

Fixes: c1c98501121e ("IB/mlx4: Add support for steerable IB UD QPs")
Link: https://lore.kernel.org/r/91c61f6e60eb0240f8bbc321fda7a1d2986dd03c.1634023677.git.leonro@nvidia.com
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/mlx4/qp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 6bc0818f4b2c..c6a815a705fe 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1099,8 +1099,10 @@ static int create_qp_common(struct ib_pd *pd, struct ib_qp_init_attr *init_attr,
 			if (dev->steering_support ==
 			    MLX4_STEERING_MODE_DEVICE_MANAGED)
 				qp->flags |= MLX4_IB_QP_NETIF;
-			else
+			else {
+				err = -EINVAL;
 				goto err;
+			}
 		}
 
 		err = set_kernel_sq_size(dev, &init_attr->cap, qp_type, qp);

From 8e1feecc04fc2f8ab2e8d817dc8ad60fb2924a1d Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Tue, 5 Oct 2021 16:57:47 -0700
Subject: [PATCH 1576/1750] usb: musb: select GENERIC_PHY instead of depending
 on it

[ Upstream commit fde1fbedbaed4e76cef4600d775b185f59b9b568 ]

The kconfig symbol GENERIC_PHY says:
  All the users of this framework should select this config.
and around 136 out of 138 drivers do so, so change USB_MUSB_MEDIATEK
to do so also.

This (also) fixes a long circular dependency problem for an upcoming
patch.

Fixes: 0990366bab3c ("usb: musb: Add support for MediaTek musb controller")
Cc: Bin Liu <b-liu@ti.com>
Cc: Min Guo <min.guo@mediatek.com>
Cc: Yonglong Wu <yonglong.wu@mediatek.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-mediatek@lists.infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20211005235747.5588-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/musb/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 8de143807c1a..4d61df6a9b5c 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -120,7 +120,7 @@ config USB_MUSB_MEDIATEK
 	tristate "MediaTek platforms"
 	depends on ARCH_MEDIATEK || COMPILE_TEST
 	depends on NOP_USB_XCEIV
-	depends on GENERIC_PHY
+	select GENERIC_PHY
 	select USB_ROLE_SWITCH
 
 comment "MUSB DMA mode"

From 0bb8359f9c0d985ca0929dedd3b0cae979b8b9c5 Mon Sep 17 00:00:00 2001
From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Date: Mon, 11 Oct 2021 09:11:18 +0300
Subject: [PATCH 1577/1750] staging: most: dim2: do not double-register the
 same device

[ Upstream commit 2ab189164056b05474275bb40caa038a37713061 ]

Commit 723de0f9171e ("staging: most: remove device from interface
structure") moved registration of driver-provided struct device to
the most subsystem.

Dim2 used to register the same struct device to provide a custom device
attribute. This causes double-registration of the same struct device.

Fix that by moving the custom attribute to driver's dev_groups.
This moves attribute to the platform_device object, which is a better
location for platform-specific attributes anyway.

Fixes: 723de0f9171e ("staging: most: remove device from interface structure")
Acked-by: Christian Gromm <christian.gromm@microchip.com>
Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Link: https://lore.kernel.org/r/20211011061117.21435-1-nikita.yoush@cogentembedded.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/most/dim2/Makefile |  2 +-
 drivers/staging/most/dim2/dim2.c   | 24 ++++++++-------
 drivers/staging/most/dim2/sysfs.c  | 49 ------------------------------
 drivers/staging/most/dim2/sysfs.h  | 11 -------
 4 files changed, 14 insertions(+), 72 deletions(-)
 delete mode 100644 drivers/staging/most/dim2/sysfs.c

diff --git a/drivers/staging/most/dim2/Makefile b/drivers/staging/most/dim2/Makefile
index 861adacf6c72..5f9612af3fa3 100644
--- a/drivers/staging/most/dim2/Makefile
+++ b/drivers/staging/most/dim2/Makefile
@@ -1,4 +1,4 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-$(CONFIG_MOST_DIM2) += most_dim2.o
 
-most_dim2-objs := dim2.o hal.o sysfs.o
+most_dim2-objs := dim2.o hal.o
diff --git a/drivers/staging/most/dim2/dim2.c b/drivers/staging/most/dim2/dim2.c
index b34e3c130f53..8c2f384233aa 100644
--- a/drivers/staging/most/dim2/dim2.c
+++ b/drivers/staging/most/dim2/dim2.c
@@ -115,7 +115,8 @@ struct dim2_platform_data {
 	(((p)[1] == 0x18) && ((p)[2] == 0x05) && ((p)[3] == 0x0C) && \
 	 ((p)[13] == 0x3C) && ((p)[14] == 0x00) && ((p)[15] == 0x0A))
 
-bool dim2_sysfs_get_state_cb(void)
+static ssize_t state_show(struct device *dev, struct device_attribute *attr,
+			  char *buf)
 {
 	bool state;
 	unsigned long flags;
@@ -124,9 +125,18 @@ bool dim2_sysfs_get_state_cb(void)
 	state = dim_get_lock_state();
 	spin_unlock_irqrestore(&dim_lock, flags);
 
-	return state;
+	return sysfs_emit(buf, "%s\n", state ? "locked" : "");
 }
 
+static DEVICE_ATTR_RO(state);
+
+static struct attribute *dim2_attrs[] = {
+	&dev_attr_state.attr,
+	NULL,
+};
+
+ATTRIBUTE_GROUPS(dim2);
+
 /**
  * dimcb_on_error - callback from HAL to report miscommunication between
  * HDM and HAL
@@ -863,16 +873,8 @@ static int dim2_probe(struct platform_device *pdev)
 		goto err_stop_thread;
 	}
 
-	ret = dim2_sysfs_probe(&dev->dev);
-	if (ret) {
-		dev_err(&pdev->dev, "failed to create sysfs attribute\n");
-		goto err_unreg_iface;
-	}
-
 	return 0;
 
-err_unreg_iface:
-	most_deregister_interface(&dev->most_iface);
 err_stop_thread:
 	kthread_stop(dev->netinfo_task);
 err_shutdown_dim:
@@ -895,7 +897,6 @@ static int dim2_remove(struct platform_device *pdev)
 	struct dim2_hdm *dev = platform_get_drvdata(pdev);
 	unsigned long flags;
 
-	dim2_sysfs_destroy(&dev->dev);
 	most_deregister_interface(&dev->most_iface);
 	kthread_stop(dev->netinfo_task);
 
@@ -1079,6 +1080,7 @@ static struct platform_driver dim2_driver = {
 	.driver = {
 		.name = "hdm_dim2",
 		.of_match_table = dim2_of_match,
+		.dev_groups = dim2_groups,
 	},
 };
 
diff --git a/drivers/staging/most/dim2/sysfs.c b/drivers/staging/most/dim2/sysfs.c
deleted file mode 100644
index c85b2cdcdca3..000000000000
--- a/drivers/staging/most/dim2/sysfs.c
+++ /dev/null
@@ -1,49 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * sysfs.c - MediaLB sysfs information
- *
- * Copyright (C) 2015, Microchip Technology Germany II GmbH & Co. KG
- */
-
-/* Author: Andrey Shvetsov <andrey.shvetsov@k2l.de> */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/kernel.h>
-#include "sysfs.h"
-#include <linux/device.h>
-
-static ssize_t state_show(struct device *dev, struct device_attribute *attr,
-			  char *buf)
-{
-	bool state = dim2_sysfs_get_state_cb();
-
-	return sprintf(buf, "%s\n", state ? "locked" : "");
-}
-
-static DEVICE_ATTR_RO(state);
-
-static struct attribute *dev_attrs[] = {
-	&dev_attr_state.attr,
-	NULL,
-};
-
-static struct attribute_group dev_attr_group = {
-	.attrs = dev_attrs,
-};
-
-static const struct attribute_group *dev_attr_groups[] = {
-	&dev_attr_group,
-	NULL,
-};
-
-int dim2_sysfs_probe(struct device *dev)
-{
-	dev->groups = dev_attr_groups;
-	return device_register(dev);
-}
-
-void dim2_sysfs_destroy(struct device *dev)
-{
-	device_unregister(dev);
-}
diff --git a/drivers/staging/most/dim2/sysfs.h b/drivers/staging/most/dim2/sysfs.h
index 24277a17cff3..09115cf4ed00 100644
--- a/drivers/staging/most/dim2/sysfs.h
+++ b/drivers/staging/most/dim2/sysfs.h
@@ -16,15 +16,4 @@ struct medialb_bus {
 	struct kobject kobj_group;
 };
 
-struct device;
-
-int dim2_sysfs_probe(struct device *dev);
-void dim2_sysfs_destroy(struct device *dev);
-
-/*
- * callback,
- * must deliver MediaLB state as true if locked or false if unlocked
- */
-bool dim2_sysfs_get_state_cb(void);
-
 #endif	/* DIM2_SYSFS_H */

From 51bcffb3951c0d2c82942ed012715706190f6a49 Mon Sep 17 00:00:00 2001
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Mon, 11 Oct 2021 17:29:41 +0200
Subject: [PATCH 1578/1750] staging: ks7010: select
 CRYPTO_HASH/CRYPTO_MICHAEL_MIC

[ Upstream commit 9ca0e55e52c7b2a99f3c2051fc4bd1c63a061519 ]

Fix the following build/link errors:

  ld: drivers/staging/ks7010/ks_hostif.o: in function `michael_mic.constprop.0':
  ks_hostif.c:(.text+0x95b): undefined reference to `crypto_alloc_shash'
  ld: ks_hostif.c:(.text+0x97a): undefined reference to `crypto_shash_setkey'
  ld: ks_hostif.c:(.text+0xa13): undefined reference to `crypto_shash_update'
  ld: ks_hostif.c:(.text+0xa28): undefined reference to `crypto_shash_update'
  ld: ks_hostif.c:(.text+0xa48): undefined reference to `crypto_shash_finup'
  ld: ks_hostif.c:(.text+0xa6d): undefined reference to `crypto_destroy_tfm'

Fixes: 8b523f20417d ("staging: ks7010: removed custom Michael MIC implementation.")
Fixes: 3e5bc68fa5968 ("staging: ks7010: Fix build error")
Fixes: a4961427e7494 ("Revert "staging: ks7010: Fix build error"")
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Link: https://lore.kernel.org/r/20211011152941.12847-1-vegard.nossum@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/ks7010/Kconfig | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/staging/ks7010/Kconfig b/drivers/staging/ks7010/Kconfig
index 0987fdc2f70d..8ea6c0928679 100644
--- a/drivers/staging/ks7010/Kconfig
+++ b/drivers/staging/ks7010/Kconfig
@@ -5,6 +5,9 @@ config KS7010
 	select WIRELESS_EXT
 	select WEXT_PRIV
 	select FW_LOADER
+	select CRYPTO
+	select CRYPTO_HASH
+	select CRYPTO_MICHAEL_MIC
 	help
 	  This is a driver for KeyStream KS7010 based SDIO WIFI cards. It is
 	  found on at least later Spectec SDW-821 (FCC-ID "S2Y-WLAN-11G-K" only,

From 78238479b93be46f4be18496b3ac9d50aab80e05 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Thu, 7 Oct 2021 16:38:47 +0200
Subject: [PATCH 1579/1750] pinctrl: renesas: checker: Fix off-by-one bug in
 drive register check

[ Upstream commit 28e7f8ff90583791a034d43b5d2e3fe394142e13 ]

The GENMASK(h, l) macro creates a contiguous bitmask starting at bit
position @l and ending at position @h, inclusive.

This did not trigger any error checks, as the individual register fields
cover at most 3 of the 4 available bits.

Fixes: 08df16e07ad0a1ec ("pinctrl: sh-pfc: checker: Add drive strength register checks")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/8f82d6147fbe3367d4c83962480e97f58d9c96a2.1633615652.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/renesas/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/renesas/core.c b/drivers/pinctrl/renesas/core.c
index c528c124fb0e..9d168b90cd28 100644
--- a/drivers/pinctrl/renesas/core.c
+++ b/drivers/pinctrl/renesas/core.c
@@ -890,7 +890,7 @@ static void __init sh_pfc_check_drive_reg(const struct sh_pfc_soc_info *info,
 		if (!field->pin && !field->offset && !field->size)
 			continue;
 
-		mask = GENMASK(field->offset + field->size, field->offset);
+		mask = GENMASK(field->offset + field->size - 1, field->offset);
 		if (mask & seen)
 			sh_pfc_err("drive_reg 0x%x: field %u overlap\n",
 				   drive->reg, i);

From 3fb75227bdce2cc8f1815f298a447f85534a6565 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Mon, 9 Aug 2021 14:13:24 +0200
Subject: [PATCH 1580/1750] ARM: dts: stm32: Reduce DHCOR SPI NOR frequency to
 50 MHz

[ Upstream commit 2012579b31293d0a8cf2024e9dab66810bf1a15e ]

The SPI NOR is a bit further away from the SoC on DHCOR than on DHCOM,
which causes additional signal delay. At 108 MHz, this delay triggers
a sporadic issue where the first bit of RX data is not received by the
QSPI controller.

There are two options of addressing this problem, either by using the
DLYB block to compensate the extra delay, or by reducing the QSPI bus
clock frequency. The former requires calibration and that is overly
complex, so opt for the second option.

Fixes: 76045bc457104 ("ARM: dts: stm32: Add QSPI NOR on AV96")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: Patrice Chotard <patrice.chotard@foss.st.com>
Cc: Patrick Delaunay <patrick.delaunay@foss.st.com>
Cc: linux-stm32@st-md-mailman.stormreply.com
To: linux-arm-kernel@lists.infradead.org
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
index a9eb82b2f170..5af32140e128 100644
--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
+++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-som.dtsi
@@ -198,7 +198,7 @@ flash0: flash@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
 		spi-rx-bus-width = <4>;
-		spi-max-frequency = <108000000>;
+		spi-max-frequency = <50000000>;
 		#address-cells = <1>;
 		#size-cells = <1>;
 	};

From 602fefd4561e07debd885e2f80c6b4569d7e0921 Mon Sep 17 00:00:00 2001
From: Olivier Moysan <olivier.moysan@foss.st.com>
Date: Fri, 24 Sep 2021 18:02:21 +0200
Subject: [PATCH 1581/1750] ARM: dts: stm32: fix SAI sub nodes register range

[ Upstream commit 6f87a74d31277f0896dcf8c0850ec14bde03c423 ]

The STM32 SAI subblocks registers offsets are in the range
0x0004 (SAIx_CR1) to 0x0020 (SAIx_DR).
The corresponding range length is 0x20 instead of 0x1c.
Change reg property accordingly.

Fixes: 5afd65c3a060 ("ARM: dts: stm32: add sai support on stm32mp157c")

Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp151.dtsi | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp151.dtsi b/arch/arm/boot/dts/stm32mp151.dtsi
index b479016fef00..7a0ef01de969 100644
--- a/arch/arm/boot/dts/stm32mp151.dtsi
+++ b/arch/arm/boot/dts/stm32mp151.dtsi
@@ -811,7 +811,7 @@ sai1a: audio-controller@4400a004 {
 				#sound-dai-cells = <0>;
 
 				compatible = "st,stm32-sai-sub-a";
-				reg = <0x4 0x1c>;
+				reg = <0x4 0x20>;
 				clocks = <&rcc SAI1_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 87 0x400 0x01>;
@@ -821,7 +821,7 @@ sai1a: audio-controller@4400a004 {
 			sai1b: audio-controller@4400a024 {
 				#sound-dai-cells = <0>;
 				compatible = "st,stm32-sai-sub-b";
-				reg = <0x24 0x1c>;
+				reg = <0x24 0x20>;
 				clocks = <&rcc SAI1_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 88 0x400 0x01>;
@@ -842,7 +842,7 @@ sai2: sai@4400b000 {
 			sai2a: audio-controller@4400b004 {
 				#sound-dai-cells = <0>;
 				compatible = "st,stm32-sai-sub-a";
-				reg = <0x4 0x1c>;
+				reg = <0x4 0x20>;
 				clocks = <&rcc SAI2_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 89 0x400 0x01>;
@@ -852,7 +852,7 @@ sai2a: audio-controller@4400b004 {
 			sai2b: audio-controller@4400b024 {
 				#sound-dai-cells = <0>;
 				compatible = "st,stm32-sai-sub-b";
-				reg = <0x24 0x1c>;
+				reg = <0x24 0x20>;
 				clocks = <&rcc SAI2_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 90 0x400 0x01>;
@@ -873,7 +873,7 @@ sai3: sai@4400c000 {
 			sai3a: audio-controller@4400c004 {
 				#sound-dai-cells = <0>;
 				compatible = "st,stm32-sai-sub-a";
-				reg = <0x04 0x1c>;
+				reg = <0x04 0x20>;
 				clocks = <&rcc SAI3_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 113 0x400 0x01>;
@@ -883,7 +883,7 @@ sai3a: audio-controller@4400c004 {
 			sai3b: audio-controller@4400c024 {
 				#sound-dai-cells = <0>;
 				compatible = "st,stm32-sai-sub-b";
-				reg = <0x24 0x1c>;
+				reg = <0x24 0x20>;
 				clocks = <&rcc SAI3_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 114 0x400 0x01>;
@@ -1250,7 +1250,7 @@ sai4: sai@50027000 {
 			sai4a: audio-controller@50027004 {
 				#sound-dai-cells = <0>;
 				compatible = "st,stm32-sai-sub-a";
-				reg = <0x04 0x1c>;
+				reg = <0x04 0x20>;
 				clocks = <&rcc SAI4_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 99 0x400 0x01>;
@@ -1260,7 +1260,7 @@ sai4a: audio-controller@50027004 {
 			sai4b: audio-controller@50027024 {
 				#sound-dai-cells = <0>;
 				compatible = "st,stm32-sai-sub-b";
-				reg = <0x24 0x1c>;
+				reg = <0x24 0x20>;
 				clocks = <&rcc SAI4_K>;
 				clock-names = "sai_ck";
 				dmas = <&dmamux1 100 0x400 0x01>;

From d34982c08714043cfab89406f36d8826c55b8baf Mon Sep 17 00:00:00 2001
From: Olivier Moysan <olivier.moysan@foss.st.com>
Date: Mon, 4 Oct 2021 11:03:04 +0200
Subject: [PATCH 1582/1750] ARM: dts: stm32: fix AV96 board SAI2 pin muxing on
 stm32mp15

[ Upstream commit 1a9a9d226f0f0ef5d9bf588ab432e0d679bb1954 ]

Fix SAI2A and SAI2B pin muxings for AV96 board on STM32MP15.
Change sai2a-4 & sai2a-5 to sai2a-2 & sai2a-2.
Change sai2a-4 & sai2a-sleep-5 to sai2b-2 & sai2b-sleep-2

Fixes: dcf185ca8175 ("ARM: dts: stm32: Add alternate pinmux for SAI2 pins on stm32mp15")

Signed-off-by: Olivier Moysan <olivier.moysan@foss.st.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/stm32mp15-pinctrl.dtsi | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
index dee4d32ab32c..ccf66adbbf62 100644
--- a/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stm32mp15-pinctrl.dtsi
@@ -1091,7 +1091,7 @@ pins {
 		};
 	};
 
-	sai2a_pins_c: sai2a-4 {
+	sai2a_pins_c: sai2a-2 {
 		pins {
 			pinmux = <STM32_PINMUX('D', 13, AF10)>, /* SAI2_SCK_A */
 				 <STM32_PINMUX('D', 11, AF10)>, /* SAI2_SD_A */
@@ -1102,7 +1102,7 @@ pins {
 		};
 	};
 
-	sai2a_sleep_pins_c: sai2a-5 {
+	sai2a_sleep_pins_c: sai2a-2 {
 		pins {
 			pinmux = <STM32_PINMUX('D', 13, ANALOG)>, /* SAI2_SCK_A */
 				 <STM32_PINMUX('D', 11, ANALOG)>, /* SAI2_SD_A */
@@ -1147,14 +1147,14 @@ pins {
 		};
 	};
 
-	sai2b_pins_c: sai2a-4 {
+	sai2b_pins_c: sai2b-2 {
 		pins1 {
 			pinmux = <STM32_PINMUX('F', 11, AF10)>; /* SAI2_SD_B */
 			bias-disable;
 		};
 	};
 
-	sai2b_sleep_pins_c: sai2a-sleep-5 {
+	sai2b_sleep_pins_c: sai2b-sleep-2 {
 		pins {
 			pinmux = <STM32_PINMUX('F', 11, ANALOG)>; /* SAI2_SD_B */
 		};

From 1812deb08f86db26741f801efda1b803ffc1a411 Mon Sep 17 00:00:00 2001
From: Richard Fitzgerald <rf@opensource.cirrus.com>
Date: Fri, 15 Oct 2021 14:36:06 +0100
Subject: [PATCH 1583/1750] ASoC: cs42l42: Correct some register default values

[ Upstream commit d591d4b32aa9552af14a0c7c586a2d3fe9ecc6e0 ]

Some registers had wrong default values in cs42l42_reg_defaults[].

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec")
Link: https://lore.kernel.org/r/20211015133619.4698-4-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs42l42.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index 828dc78202e8..8e44d0f34194 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -91,7 +91,7 @@ static const struct reg_default cs42l42_reg_defaults[] = {
 	{ CS42L42_ASP_RX_INT_MASK,		0x1F },
 	{ CS42L42_ASP_TX_INT_MASK,		0x0F },
 	{ CS42L42_CODEC_INT_MASK,		0x03 },
-	{ CS42L42_SRCPL_INT_MASK,		0xFF },
+	{ CS42L42_SRCPL_INT_MASK,		0x7F },
 	{ CS42L42_VPMON_INT_MASK,		0x01 },
 	{ CS42L42_PLL_LOCK_INT_MASK,		0x01 },
 	{ CS42L42_TSRS_PLUG_INT_MASK,		0x0F },
@@ -128,7 +128,7 @@ static const struct reg_default cs42l42_reg_defaults[] = {
 	{ CS42L42_MIXER_CHA_VOL,		0x3F },
 	{ CS42L42_MIXER_ADC_VOL,		0x3F },
 	{ CS42L42_MIXER_CHB_VOL,		0x3F },
-	{ CS42L42_EQ_COEF_IN0,			0x22 },
+	{ CS42L42_EQ_COEF_IN0,			0x00 },
 	{ CS42L42_EQ_COEF_IN1,			0x00 },
 	{ CS42L42_EQ_COEF_IN2,			0x00 },
 	{ CS42L42_EQ_COEF_IN3,			0x00 },

From b288b841c1d82182fbedeea912eba62f11a702ad Mon Sep 17 00:00:00 2001
From: Richard Fitzgerald <rf@opensource.cirrus.com>
Date: Fri, 15 Oct 2021 14:36:08 +0100
Subject: [PATCH 1584/1750] ASoC: cs42l42: Defer probe if
 request_threaded_irq() returns EPROBE_DEFER

[ Upstream commit 0306988789d9d91a18ff70bd2bf165d3ae0ef1dd ]

The driver can run without an interrupt so if devm_request_threaded_irq()
failed, the probe() just carried on. But if this was EPROBE_DEFER the
driver would continue without an interrupt instead of deferring to wait
for the interrupt to become available.

Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec")
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20211015133619.4698-6-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs42l42.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index 8e44d0f34194..191431868c67 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -1796,8 +1796,9 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
 			NULL, cs42l42_irq_thread,
 			IRQF_ONESHOT | IRQF_TRIGGER_LOW,
 			"cs42l42", cs42l42);
-
-	if (ret != 0)
+	if (ret == -EPROBE_DEFER)
+		goto err_disable;
+	else if (ret != 0)
 		dev_err(&i2c_client->dev,
 			"Failed to request IRQ: %d\n", ret);
 

From 81e37cf40dbbbedc7f6f74657cf4837fd2887cde Mon Sep 17 00:00:00 2001
From: Lee Jones <lee.jones@linaro.org>
Date: Tue, 3 Nov 2020 15:28:34 +0000
Subject: [PATCH 1585/1750] soc: qcom: rpmhpd: Provide some missing struct
 member descriptions

[ Upstream commit 5d16af6a921f5a4e7038671be5478cba4b7cfe81 ]

Fixes the following W=1 kernel build warning(s):

 drivers/soc/qcom/rpmhpd.c:52: warning: Function parameter or member 'parent' not described in 'rpmhpd'
 drivers/soc/qcom/rpmhpd.c:52: warning: Function parameter or member 'corner' not described in 'rpmhpd'
 drivers/soc/qcom/rpmhpd.c:52: warning: Function parameter or member 'active_corner' not described in 'rpmhpd'

Cc: Andy Gross <agross@kernel.org>
Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
Cc: linux-arm-msm@vger.kernel.org
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20201103152838.1290217-22-lee.jones@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/rpmhpd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/soc/qcom/rpmhpd.c b/drivers/soc/qcom/rpmhpd.c
index c8b584d0c8fb..e7cb40144f9b 100644
--- a/drivers/soc/qcom/rpmhpd.c
+++ b/drivers/soc/qcom/rpmhpd.c
@@ -24,9 +24,12 @@
  * struct rpmhpd - top level RPMh power domain resource data structure
  * @dev:		rpmh power domain controller device
  * @pd:			generic_pm_domain corrresponding to the power domain
+ * @parent:		generic_pm_domain corrresponding to the parent's power domain
  * @peer:		A peer power domain in case Active only Voting is
  *			supported
  * @active_only:	True if it represents an Active only peer
+ * @corner:		current corner
+ * @active_corner:	current active corner
  * @level:		An array of level (vlvl) to corner (hlvl) mappings
  *			derived from cmd-db
  * @level_count:	Number of levels supported by the power domain. max

From 503d6e5fb878256e49eb1b030dafb3bd3beac419 Mon Sep 17 00:00:00 2001
From: Bjorn Andersson <bjorn.andersson@linaro.org>
Date: Mon, 4 Oct 2021 20:37:32 -0700
Subject: [PATCH 1586/1750] soc: qcom: rpmhpd: Make power_on actually enable
 the domain

[ Upstream commit e3e56c050ab6e3f1bd811f0787f50709017543e4 ]

The general expectation is that powering on a power-domain should make
the power domain deliver some power, and if a specific performance state
is needed further requests has to be made.

But in contrast with other power-domain implementations (e.g. rpmpd) the
RPMh does not have an interface to enable the power, so the driver has
to vote for a particular corner (performance level) in rpmh_power_on().

But the corner is never initialized, so a typical request to simply
enable the power domain would not actually turn on the hardware. Further
more, when no more clients vote for a performance state (i.e. the
aggregated vote is 0) the power domain would be turned off.

Fix both of these issues by always voting for a corner with non-zero
value, when the power domain is enabled.

The tracking of the lowest non-zero corner is performed to handle the
corner case if there's ever a domain with a non-zero lowest corner, in
which case both rpmh_power_on() and rpmh_rpmhpd_set_performance_state()
would be allowed to use this lowest corner.

Fixes: 279b7e8a62cc ("soc: qcom: rpmhpd: Add RPMh power domain driver")
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20211005033732.2284447-1-bjorn.andersson@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/rpmhpd.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/soc/qcom/rpmhpd.c b/drivers/soc/qcom/rpmhpd.c
index e7cb40144f9b..436ec79122ed 100644
--- a/drivers/soc/qcom/rpmhpd.c
+++ b/drivers/soc/qcom/rpmhpd.c
@@ -30,6 +30,7 @@
  * @active_only:	True if it represents an Active only peer
  * @corner:		current corner
  * @active_corner:	current active corner
+ * @enable_corner:	lowest non-zero corner
  * @level:		An array of level (vlvl) to corner (hlvl) mappings
  *			derived from cmd-db
  * @level_count:	Number of levels supported by the power domain. max
@@ -47,6 +48,7 @@ struct rpmhpd {
 	const bool	active_only;
 	unsigned int	corner;
 	unsigned int	active_corner;
+	unsigned int	enable_corner;
 	u32		level[RPMH_ARC_MAX_LEVELS];
 	size_t		level_count;
 	bool		enabled;
@@ -295,13 +297,13 @@ static int rpmhpd_aggregate_corner(struct rpmhpd *pd, unsigned int corner)
 static int rpmhpd_power_on(struct generic_pm_domain *domain)
 {
 	struct rpmhpd *pd = domain_to_rpmhpd(domain);
-	int ret = 0;
+	unsigned int corner;
+	int ret;
 
 	mutex_lock(&rpmhpd_lock);
 
-	if (pd->corner)
-		ret = rpmhpd_aggregate_corner(pd, pd->corner);
-
+	corner = max(pd->corner, pd->enable_corner);
+	ret = rpmhpd_aggregate_corner(pd, corner);
 	if (!ret)
 		pd->enabled = true;
 
@@ -346,6 +348,10 @@ static int rpmhpd_set_performance_state(struct generic_pm_domain *domain,
 		i--;
 
 	if (pd->enabled) {
+		/* Ensure that the domain isn't turn off */
+		if (i < pd->enable_corner)
+			i = pd->enable_corner;
+
 		ret = rpmhpd_aggregate_corner(pd, i);
 		if (ret)
 			goto out;
@@ -382,6 +388,10 @@ static int rpmhpd_update_level_mapping(struct rpmhpd *rpmhpd)
 	for (i = 0; i < rpmhpd->level_count; i++) {
 		rpmhpd->level[i] = buf[i];
 
+		/* Remember the first corner with non-zero level */
+		if (!rpmhpd->level[rpmhpd->enable_corner] && rpmhpd->level[i])
+			rpmhpd->enable_corner = i;
+
 		/*
 		 * The AUX data may be zero padded.  These 0 valued entries at
 		 * the end of the map must be ignored.

From c8e5edca68a312770df85cc6690f729a2a2df99e Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Thu, 14 Oct 2021 18:36:09 -0700
Subject: [PATCH 1587/1750] usb: typec: STUSB160X should select REGMAP_I2C

[ Upstream commit 8ef1e58783b9f55daa4a865c7801dc75cbeb8260 ]

REGMAP_I2C is not a user visible kconfig symbol so driver configs
should not "depend on" it. They should depend on I2C and then
select REGMAP_I2C.

If this worked, it was only because some other driver had set/enabled
REGMAP_I2C.

Fixes: da0cb6310094 ("usb: typec: add support for STUSB160x Type-C controller family")
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Amelie Delaunay <amelie.delaunay@st.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Reviewed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20211015013609.7300-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/typec/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/Kconfig b/drivers/usb/typec/Kconfig
index e7f120874c48..0d953c6805f0 100644
--- a/drivers/usb/typec/Kconfig
+++ b/drivers/usb/typec/Kconfig
@@ -75,9 +75,9 @@ config TYPEC_TPS6598X
 
 config TYPEC_STUSB160X
 	tristate "STMicroelectronics STUSB160x Type-C controller driver"
-	depends on I2C
-	depends on REGMAP_I2C
 	depends on USB_ROLE_SWITCH || !USB_ROLE_SWITCH
+	depends on I2C
+	select REGMAP_I2C
 	help
 	  Say Y or M here if your system has STMicroelectronics STUSB160x
 	  Type-C port controller.

From 948d8f2f2fd5f55f93538ed3fb3f1eea0a8dffb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
Date: Fri, 3 Sep 2021 16:14:19 +0200
Subject: [PATCH 1588/1750] iio: adis: do not disabe IRQs in 'adis_init()'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit b600bd7eb333554518b4dd36b882b2ae58a5149e ]

With commit ecb010d441088 ("iio: imu: adis: Refactor adis_initial_startup")
we are doing a HW or SW reset to the device which means that we'll get
the default state of the data ready pin (which is enabled). Hence there's
no point in disabling the IRQ in the init function. Moreover, this
function is intended to initialize internal data structures and not
really do anything on the device.

As a result of this, some devices were left with the data ready pin enabled
after probe which was not the desired behavior. Thus, we move the call to
'adis_enable_irq()' to the initial startup function where it makes more
sense for it to be.

Note that for devices that cannot mask/unmask the pin, it makes no sense
to call the function at this point since the IRQ should not have been
yet requested. This will be improved in a follow up change.

Fixes: ecb010d441088 ("iio: imu: adis: Refactor adis_initial_startup")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20210903141423.517028-2-nuno.sa@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/imu/adis.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/imu/adis.c b/drivers/iio/imu/adis.c
index f8b7837d8b8f..715eef81bc24 100644
--- a/drivers/iio/imu/adis.c
+++ b/drivers/iio/imu/adis.c
@@ -434,6 +434,8 @@ int __adis_initial_startup(struct adis *adis)
 	if (ret)
 		return ret;
 
+	adis_enable_irq(adis, false);
+
 	if (!adis->data->prod_id_reg)
 		return 0;
 
@@ -530,7 +532,7 @@ int adis_init(struct adis *adis, struct iio_dev *indio_dev,
 		adis->current_page = 0;
 	}
 
-	return adis_enable_irq(adis, false);
+	return 0;
 }
 EXPORT_SYMBOL_GPL(adis_init);
 

From 75df593941266161df034af8fd6c562a08e632e8 Mon Sep 17 00:00:00 2001
From: Can Guo <cang@codeaurora.org>
Date: Wed, 25 Nov 2020 18:01:00 -0800
Subject: [PATCH 1589/1750] scsi: ufs: Refactor ufshcd_setup_clocks() to remove
 skip_ref_clk

[ Upstream commit 81309c247a4dcd597cbda5254fd0afdd61b93f14 ]

Remove the param skip_ref_clk from __ufshcd_setup_clocks(), but keep a flag
in struct ufs_clk_info to tell whether a clock can be disabled or not while
the link is active.

Link: https://lore.kernel.org/r/1606356063-38380-2-git-send-email-cang@codeaurora.org
Reviewed-by: Hongwu Su <hongwus@codeaurora.org>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd-pltfrm.c |  2 ++
 drivers/scsi/ufs/ufshcd.c        | 29 +++++++++--------------------
 drivers/scsi/ufs/ufshcd.h        |  3 +++
 3 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index 24927cf485b4..68ce209577ec 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -92,6 +92,8 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
 		clki->min_freq = clkfreq[i];
 		clki->max_freq = clkfreq[i+1];
 		clki->name = kstrdup(name, GFP_KERNEL);
+		if (!strcmp(name, "ref_clk"))
+			clki->keep_link_active = true;
 		dev_dbg(dev, "%s: min %u max %u name %s\n", "freq-table-hz",
 				clki->min_freq, clki->max_freq, clki->name);
 		list_add_tail(&clki->list, &hba->clk_list_head);
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 3139d9df6f32..930f35863cbb 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -221,8 +221,6 @@ static int ufshcd_eh_host_reset_handler(struct scsi_cmnd *cmd);
 static int ufshcd_clear_tm_cmd(struct ufs_hba *hba, int tag);
 static void ufshcd_hba_exit(struct ufs_hba *hba);
 static int ufshcd_probe_hba(struct ufs_hba *hba, bool async);
-static int __ufshcd_setup_clocks(struct ufs_hba *hba, bool on,
-				 bool skip_ref_clk);
 static int ufshcd_setup_clocks(struct ufs_hba *hba, bool on);
 static int ufshcd_uic_hibern8_enter(struct ufs_hba *hba);
 static inline void ufshcd_add_delay_before_dme_cmd(struct ufs_hba *hba);
@@ -1714,11 +1712,7 @@ static void ufshcd_gate_work(struct work_struct *work)
 
 	ufshcd_disable_irq(hba);
 
-	if (!ufshcd_is_link_active(hba))
-		ufshcd_setup_clocks(hba, false);
-	else
-		/* If link is active, device ref_clk can't be switched off */
-		__ufshcd_setup_clocks(hba, false, true);
+	ufshcd_setup_clocks(hba, false);
 
 	/*
 	 * In case you are here to cancel this work the gating state
@@ -8055,8 +8049,7 @@ static int ufshcd_init_hba_vreg(struct ufs_hba *hba)
 	return 0;
 }
 
-static int __ufshcd_setup_clocks(struct ufs_hba *hba, bool on,
-					bool skip_ref_clk)
+static int ufshcd_setup_clocks(struct ufs_hba *hba, bool on)
 {
 	int ret = 0;
 	struct ufs_clk_info *clki;
@@ -8074,7 +8067,12 @@ static int __ufshcd_setup_clocks(struct ufs_hba *hba, bool on,
 
 	list_for_each_entry(clki, head, list) {
 		if (!IS_ERR_OR_NULL(clki->clk)) {
-			if (skip_ref_clk && !strcmp(clki->name, "ref_clk"))
+			/*
+			 * Don't disable clocks which are needed
+			 * to keep the link active.
+			 */
+			if (ufshcd_is_link_active(hba) &&
+			    clki->keep_link_active)
 				continue;
 
 			clk_state_changed = on ^ clki->enabled;
@@ -8119,11 +8117,6 @@ static int __ufshcd_setup_clocks(struct ufs_hba *hba, bool on,
 	return ret;
 }
 
-static int ufshcd_setup_clocks(struct ufs_hba *hba, bool on)
-{
-	return  __ufshcd_setup_clocks(hba, on, false);
-}
-
 static int ufshcd_init_clocks(struct ufs_hba *hba)
 {
 	int ret = 0;
@@ -8642,11 +8635,7 @@ static int ufshcd_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op)
 	 */
 	ufshcd_disable_irq(hba);
 
-	if (!ufshcd_is_link_active(hba))
-		ufshcd_setup_clocks(hba, false);
-	else
-		/* If link is active, device ref_clk can't be switched off */
-		__ufshcd_setup_clocks(hba, false, true);
+	ufshcd_setup_clocks(hba, false);
 
 	if (ufshcd_is_clkgating_allowed(hba)) {
 		hba->clk_gating.state = CLKS_OFF;
diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
index 812aa348751e..1ba9c786feb6 100644
--- a/drivers/scsi/ufs/ufshcd.h
+++ b/drivers/scsi/ufs/ufshcd.h
@@ -229,6 +229,8 @@ struct ufs_dev_cmd {
  * @max_freq: maximum frequency supported by the clock
  * @min_freq: min frequency that can be used for clock scaling
  * @curr_freq: indicates the current frequency that it is set to
+ * @keep_link_active: indicates that the clk should not be disabled if
+		      link is active
  * @enabled: variable to check against multiple enable/disable
  */
 struct ufs_clk_info {
@@ -238,6 +240,7 @@ struct ufs_clk_info {
 	u32 max_freq;
 	u32 min_freq;
 	u32 curr_freq;
+	bool keep_link_active;
 	bool enabled;
 };
 

From d293bd40fbad2b9b87af9aaae63314d4434cac50 Mon Sep 17 00:00:00 2001
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Date: Tue, 14 Sep 2021 10:22:14 +0100
Subject: [PATCH 1590/1750] scsi: ufs: ufshcd-pltfrm: Fix memory leak due to
 probe defer

[ Upstream commit b6ca770ae7f2c560a29bbd02c4e3d734fafaf804 ]

UFS drivers that probe defer will end up leaking memory allocated for clk
and regulator names via kstrdup() because the structure that is holding
this memory is allocated via devm_* variants which will be freed during
probe defer but the names are never freed.

Use same devm_* variant of kstrdup to free the memory allocated to name
when driver probe defers.

Kmemleak found around 11 leaks on Qualcomm Dragon Board RB5:

unreferenced object 0xffff66f243fb2c00 (size 128):
  comm "kworker/u16:0", pid 7, jiffies 4294893319 (age 94.848s)
  hex dump (first 32 bytes):
    63 6f 72 65 5f 63 6c 6b 00 76 69 72 74 75 61 6c  core_clk.virtual
    2f 77 6f 72 6b 71 75 65 75 65 2f 73 63 73 69 5f  /workqueue/scsi_
  backtrace:
    [<000000006f788cd1>] slab_post_alloc_hook+0x88/0x410
    [<00000000cfd1372b>] __kmalloc_track_caller+0x138/0x230
    [<00000000a92ab17b>] kstrdup+0xb0/0x110
    [<0000000037263ab6>] ufshcd_pltfrm_init+0x1a8/0x500
    [<00000000a20a5caa>] ufs_qcom_probe+0x20/0x58
    [<00000000a5e43067>] platform_probe+0x6c/0x118
    [<00000000ef686e3f>] really_probe+0xc4/0x330
    [<000000005b18792c>] __driver_probe_device+0x88/0x118
    [<00000000a5d295e8>] driver_probe_device+0x44/0x158
    [<000000007e83f58d>] __device_attach_driver+0xb4/0x128
    [<000000004bfa4470>] bus_for_each_drv+0x68/0xd0
    [<00000000b89a83bc>] __device_attach+0xec/0x170
    [<00000000ada2beea>] device_initial_probe+0x14/0x20
    [<0000000079921612>] bus_probe_device+0x9c/0xa8
    [<00000000d268bf7c>] deferred_probe_work_func+0x90/0xd0
    [<000000009ef64bfa>] process_one_work+0x29c/0x788
unreferenced object 0xffff66f243fb2c80 (size 128):
  comm "kworker/u16:0", pid 7, jiffies 4294893319 (age 94.848s)
  hex dump (first 32 bytes):
    62 75 73 5f 61 67 67 72 5f 63 6c 6b 00 00 00 00  bus_aggr_clk....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

With this patch no memory leaks are reported.

Link: https://lore.kernel.org/r/20210914092214.6468-1-srinivas.kandagatla@linaro.org
Fixes: aa4976130934 ("ufs: Add regulator enable support")
Fixes: c6e79dacd86f ("ufs: Add clock initialization support")
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd-pltfrm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c
index 68ce209577ec..8c92d1bde64b 100644
--- a/drivers/scsi/ufs/ufshcd-pltfrm.c
+++ b/drivers/scsi/ufs/ufshcd-pltfrm.c
@@ -91,7 +91,7 @@ static int ufshcd_parse_clock_info(struct ufs_hba *hba)
 
 		clki->min_freq = clkfreq[i];
 		clki->max_freq = clkfreq[i+1];
-		clki->name = kstrdup(name, GFP_KERNEL);
+		clki->name = devm_kstrdup(dev, name, GFP_KERNEL);
 		if (!strcmp(name, "ref_clk"))
 			clki->keep_link_active = true;
 		dev_dbg(dev, "%s: min %u max %u name %s\n", "freq-table-hz",
@@ -127,7 +127,7 @@ static int ufshcd_populate_vreg(struct device *dev, const char *name,
 	if (!vreg)
 		return -ENOMEM;
 
-	vreg->name = kstrdup(name, GFP_KERNEL);
+	vreg->name = devm_kstrdup(dev, name, GFP_KERNEL);
 
 	snprintf(prop_name, MAX_PROP_SIZE, "%s-max-microamp", name);
 	if (of_property_read_u32(np, prop_name, &vreg->max_uA)) {

From 068dfa570d8c36da0f1493d97695a04e8e84d8bd Mon Sep 17 00:00:00 2001
From: Stefan Agner <stefan@agner.ch>
Date: Wed, 20 Oct 2021 21:26:42 +0200
Subject: [PATCH 1591/1750] serial: imx: fix detach/attach of serial console
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 6d0d1b5a1b4870911beb89544ec1a9751c42fec7 ]

If the device used as a serial console gets detached/attached at runtime,
register_console() will try to call imx_uart_setup_console(), but this
is not possible since it is marked as __init.

For instance

  # cat /sys/devices/virtual/tty/console/active
  tty1 ttymxc0
  # echo -n N > /sys/devices/virtual/tty/console/subsystem/ttymxc0/console
  # echo -n Y > /sys/devices/virtual/tty/console/subsystem/ttymxc0/console

[   73.166649] 8<--- cut here ---
[   73.167005] Unable to handle kernel paging request at virtual address c154d928
[   73.167601] pgd = 55433e84
[   73.167875] [c154d928] *pgd=8141941e(bad)
[   73.168304] Internal error: Oops: 8000000d [#1] SMP ARM
[   73.168429] Modules linked in:
[   73.168522] CPU: 0 PID: 536 Comm: sh Not tainted 5.15.0-rc6-00056-g3968ddcf05fb #3
[   73.168675] Hardware name: Freescale i.MX6 Ultralite (Device Tree)
[   73.168791] PC is at imx_uart_console_setup+0x0/0x238
[   73.168927] LR is at try_enable_new_console+0x98/0x124
[   73.169056] pc : [<c154d928>]    lr : [<c0196f44>]    psr: a0000013
[   73.169178] sp : c2ef5e70  ip : 00000000  fp : 00000000
[   73.169281] r10: 00000000  r9 : c02cf970  r8 : 00000000
[   73.169389] r7 : 00000001  r6 : 00000001  r5 : c1760164  r4 : c1e0fb08
[   73.169512] r3 : c154d928  r2 : 00000000  r1 : efffcbd1  r0 : c1760164
[   73.169641] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   73.169782] Control: 10c5387d  Table: 8345406a  DAC: 00000051
[   73.169895] Register r0 information: non-slab/vmalloc memory
[   73.170032] Register r1 information: non-slab/vmalloc memory
[   73.170158] Register r2 information: NULL pointer
[   73.170273] Register r3 information: non-slab/vmalloc memory
[   73.170397] Register r4 information: non-slab/vmalloc memory
[   73.170521] Register r5 information: non-slab/vmalloc memory
[   73.170647] Register r6 information: non-paged memory
[   73.170771] Register r7 information: non-paged memory
[   73.170892] Register r8 information: NULL pointer
[   73.171009] Register r9 information: non-slab/vmalloc memory
[   73.171142] Register r10 information: NULL pointer
[   73.171259] Register r11 information: NULL pointer
[   73.171375] Register r12 information: NULL pointer
[   73.171494] Process sh (pid: 536, stack limit = 0xcd1ba82f)
[   73.171621] Stack: (0xc2ef5e70 to 0xc2ef6000)
[   73.171731] 5e60:                                     ???????? ???????? ???????? ????????
[   73.171899] 5e80: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.172059] 5ea0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.172217] 5ec0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.172377] 5ee0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.172537] 5f00: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.172698] 5f20: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.172856] 5f40: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.173016] 5f60: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.173177] 5f80: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.173336] 5fa0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.173496] 5fc0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.173654] 5fe0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.173826] [<c0196f44>] (try_enable_new_console) from [<c01984a8>] (register_console+0x10c/0x2ec)
[   73.174053] [<c01984a8>] (register_console) from [<c06e2c90>] (console_store+0x14c/0x168)
[   73.174262] [<c06e2c90>] (console_store) from [<c0383718>] (kernfs_fop_write_iter+0x110/0x1cc)
[   73.174470] [<c0383718>] (kernfs_fop_write_iter) from [<c02cf5f4>] (vfs_write+0x31c/0x548)
[   73.174679] [<c02cf5f4>] (vfs_write) from [<c02cf970>] (ksys_write+0x60/0xec)
[   73.174863] [<c02cf970>] (ksys_write) from [<c0100080>] (ret_fast_syscall+0x0/0x1c)
[   73.175052] Exception stack(0xc2ef5fa8 to 0xc2ef5ff0)
[   73.175167] 5fa0:                   ???????? ???????? ???????? ???????? ???????? ????????
[   73.175327] 5fc0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
[   73.175486] 5fe0: ???????? ???????? ???????? ????????
[   73.175608] Code: 00000000 00000000 00000000 00000000 (00000000)
[   73.175744] ---[ end trace 9b75121265109bf1 ]---

A similar issue could be triggered by unbinding/binding the serial
console device [*].

Drop __init so that imx_uart_setup_console() can be safely called at
runtime.

[*] https://lore.kernel.org/all/20181114174940.7865-3-stefan@agner.ch/

Fixes: a3cb39d258ef ("serial: core: Allow detach and attach serial device for console")
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://lore.kernel.org/r/20211020192643.476895-2-francesco.dolcini@toradex.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/imx.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index cacf7266a262..28cc328ddb6e 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2049,7 +2049,7 @@ imx_uart_console_write(struct console *co, const char *s, unsigned int count)
  * If the port was already initialised (eg, by a boot loader),
  * try to determine the current setup.
  */
-static void __init
+static void
 imx_uart_console_get_options(struct imx_port *sport, int *baud,
 			     int *parity, int *bits)
 {
@@ -2108,7 +2108,7 @@ imx_uart_console_get_options(struct imx_port *sport, int *baud,
 	}
 }
 
-static int __init
+static int
 imx_uart_console_setup(struct console *co, char *options)
 {
 	struct imx_port *sport;

From 6774a429327d55d163f7f106ce90620ce94fac7c Mon Sep 17 00:00:00 2001
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
Date: Tue, 5 Oct 2021 11:53:03 +0200
Subject: [PATCH 1592/1750] usb: dwc2: drd: fix dwc2_force_mode call in
 dwc2_ovr_init

[ Upstream commit b2cab2a24fb5d13ce1d384ecfb6de827fa08a048 ]

Instead of forcing the role to Device, check the dr_mode configuration.
If the core is Host only, force the mode to Host, this to avoid the
dwc2_force_mode warning:
WARNING: CPU: 1 PID: 21 at drivers/usb/dwc2/core.c:615 dwc2_drd_init+0x104/0x17c

When forcing mode to Host, dwc2_force_mode may sleep the time the host
role is applied. To avoid sleeping while atomic context, move the call
to dwc2_force_mode after spin_unlock_irqrestore. It is safe, as
interrupts are not yet unmasked here.

Fixes: 17f934024e84 ("usb: dwc2: override PHY input signals with usb role switch support")
Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://lore.kernel.org/r/20211005095305.66397-2-amelie.delaunay@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/drd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc2/drd.c b/drivers/usb/dwc2/drd.c
index 2d4176f5788e..80eae88d76dd 100644
--- a/drivers/usb/dwc2/drd.c
+++ b/drivers/usb/dwc2/drd.c
@@ -25,9 +25,9 @@ static void dwc2_ovr_init(struct dwc2_hsotg *hsotg)
 	gotgctl &= ~(GOTGCTL_BVALOVAL | GOTGCTL_AVALOVAL | GOTGCTL_VBVALOVAL);
 	dwc2_writel(hsotg, gotgctl, GOTGCTL);
 
-	dwc2_force_mode(hsotg, false);
-
 	spin_unlock_irqrestore(&hsotg->lock, flags);
+
+	dwc2_force_mode(hsotg, (hsotg->dr_mode == USB_DR_MODE_HOST));
 }
 
 static int dwc2_ovr_avalid(struct dwc2_hsotg *hsotg, bool valid)

From fc86da757db716f5def66ec954d4e07da7948bac Mon Sep 17 00:00:00 2001
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
Date: Tue, 5 Oct 2021 11:53:04 +0200
Subject: [PATCH 1593/1750] usb: dwc2: drd: fix dwc2_drd_role_sw_set when clock
 could be disabled

[ Upstream commit 8d387f61b0240854e81450c261beb775065bad5d ]

In case of USB_DR_MODE_PERIPHERAL, the OTG clock is disabled at the end of
the probe (it is not the case if USB_DR_MODE_HOST or USB_DR_MODE_OTG).
The clock is then enabled on udc_start.
If dwc2_drd_role_sw_set is called before udc_start (it is the case if the
usb cable is plugged at boot), GOTGCTL and GUSBCFG registers cannot be
read/written, so session cannot be overridden.
To avoid this case, check the ll_hw_enabled value and enable the clock if
it is available, and disable it after the override.

Fixes: 17f934024e84 ("usb: dwc2: override PHY input signals with usb role switch support")
Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://lore.kernel.org/r/20211005095305.66397-3-amelie.delaunay@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/drd.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/usb/dwc2/drd.c b/drivers/usb/dwc2/drd.c
index 80eae88d76dd..99672360f34b 100644
--- a/drivers/usb/dwc2/drd.c
+++ b/drivers/usb/dwc2/drd.c
@@ -7,6 +7,7 @@
  * Author(s): Amelie Delaunay <amelie.delaunay@st.com>
  */
 
+#include <linux/clk.h>
 #include <linux/iopoll.h>
 #include <linux/platform_device.h>
 #include <linux/usb/role.h>
@@ -86,6 +87,20 @@ static int dwc2_drd_role_sw_set(struct usb_role_switch *sw, enum usb_role role)
 	}
 #endif
 
+	/*
+	 * In case of USB_DR_MODE_PERIPHERAL, clock is disabled at the end of
+	 * the probe and enabled on udc_start.
+	 * If role-switch set is called before the udc_start, we need to enable
+	 * the clock to read/write GOTGCTL and GUSBCFG registers to override
+	 * mode and sessions. It is the case if cable is plugged at boot.
+	 */
+	if (!hsotg->ll_hw_enabled && hsotg->clk) {
+		int ret = clk_prepare_enable(hsotg->clk);
+
+		if (ret)
+			return ret;
+	}
+
 	spin_lock_irqsave(&hsotg->lock, flags);
 
 	if (role == USB_ROLE_HOST) {
@@ -110,6 +125,9 @@ static int dwc2_drd_role_sw_set(struct usb_role_switch *sw, enum usb_role role)
 		/* This will raise a Connector ID Status Change Interrupt */
 		dwc2_force_mode(hsotg, role == USB_ROLE_HOST);
 
+	if (!hsotg->ll_hw_enabled && hsotg->clk)
+		clk_disable_unprepare(hsotg->clk);
+
 	dev_dbg(hsotg->dev, "%s-session valid\n",
 		role == USB_ROLE_NONE ? "No" :
 		role == USB_ROLE_HOST ? "A" : "B");

From 31e7a836e2a2e473e170c251897384a58e496c05 Mon Sep 17 00:00:00 2001
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
Date: Tue, 5 Oct 2021 11:53:05 +0200
Subject: [PATCH 1594/1750] usb: dwc2: drd: reset current session before
 setting the new one

[ Upstream commit 1ad707f559f7cb12c64f3d7cb37f0b1ea27c1058 ]

If role is changed without the "none" step, A- and B- valid session could
be set at the same time. It is an issue.
This patch resets A-session if role switch sets B-session, and resets
B-session if role switch sets A-session.
Then, it is possible to change the role without the "none" step.

Fixes: 17f934024e84 ("usb: dwc2: override PHY input signals with usb role switch support")
Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Link: https://lore.kernel.org/r/20211005095305.66397-4-amelie.delaunay@foss.st.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc2/drd.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/dwc2/drd.c b/drivers/usb/dwc2/drd.c
index 99672360f34b..aa6eb76f64dd 100644
--- a/drivers/usb/dwc2/drd.c
+++ b/drivers/usb/dwc2/drd.c
@@ -40,6 +40,7 @@ static int dwc2_ovr_avalid(struct dwc2_hsotg *hsotg, bool valid)
 	    (!valid && !(gotgctl & GOTGCTL_ASESVLD)))
 		return -EALREADY;
 
+	gotgctl &= ~GOTGCTL_BVALOVAL;
 	if (valid)
 		gotgctl |= GOTGCTL_AVALOVAL | GOTGCTL_VBVALOVAL;
 	else
@@ -58,6 +59,7 @@ static int dwc2_ovr_bvalid(struct dwc2_hsotg *hsotg, bool valid)
 	    (!valid && !(gotgctl & GOTGCTL_BSESVLD)))
 		return -EALREADY;
 
+	gotgctl &= ~GOTGCTL_AVALOVAL;
 	if (valid)
 		gotgctl |= GOTGCTL_BVALOVAL | GOTGCTL_VBVALOVAL;
 	else

From b41c528b14fe7aa3d2453e2b53143e4f19096608 Mon Sep 17 00:00:00 2001
From: Guru Das Srinagesh <quic_gurus@quicinc.com>
Date: Mon, 11 Oct 2021 13:00:14 -0700
Subject: [PATCH 1595/1750] firmware: qcom_scm: Fix error retval in
 __qcom_scm_is_call_available()

[ Upstream commit 38212b2a8a6fc4c3a6fa99d7445b833bedc9a67c ]

Since __qcom_scm_is_call_available() returns bool, have it return false
instead of -EINVAL if an invalid SMC convention is detected.

This fixes the Smatch static checker warning:

	drivers/firmware/qcom_scm.c:255 __qcom_scm_is_call_available()
	warn: signedness bug returning '(-22)'

Fixes: 9d11af8b06a8 ("firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Guru Das Srinagesh <quic_gurus@quicinc.com>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/1633982414-28347-1-git-send-email-quic_gurus@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/qcom_scm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
index c5b20bdc08e9..e10a99860ca4 100644
--- a/drivers/firmware/qcom_scm.c
+++ b/drivers/firmware/qcom_scm.c
@@ -252,7 +252,7 @@ static bool __qcom_scm_is_call_available(struct device *dev, u32 svc_id,
 		break;
 	default:
 		pr_err("Unknown SMC convention being used\n");
-		return -EINVAL;
+		return false;
 	}
 
 	ret = qcom_scm_call(dev, &desc, &res);

From a0467ca4d25fff27ca3ed1c289ed486ec9acc71e Mon Sep 17 00:00:00 2001
From: Wan Jiabing <wanjiabing@vivo.com>
Date: Thu, 14 Oct 2021 04:30:17 -0400
Subject: [PATCH 1596/1750] soc: qcom: apr: Add of_node_put() before return

[ Upstream commit 72f1aa6205d84337b90b065f602a8fe190821781 ]

Fix following coccicheck warning:

./drivers/soc/qcom/apr.c:485:1-23: WARNING: Function
for_each_child_of_node should have of_node_put() before return

Early exits from for_each_child_of_node should decrement the
node reference counter.

Fixes: 834735662602 ("soc: qcom: apr: Add avs/audio tracking functionality")
Signed-off-by: Wan Jiabing <wanjiabing@vivo.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20211014083017.19714-1-wanjiabing@vivo.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/apr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c
index 7abfc8c4fdc7..f736d208362c 100644
--- a/drivers/soc/qcom/apr.c
+++ b/drivers/soc/qcom/apr.c
@@ -323,12 +323,14 @@ static int of_apr_add_pd_lookups(struct device *dev)
 						    1, &service_path);
 		if (ret < 0) {
 			dev_err(dev, "pdr service path missing: %d\n", ret);
+			of_node_put(node);
 			return ret;
 		}
 
 		pds = pdr_add_lookup(apr->pdr, service_name, service_path);
 		if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) {
 			dev_err(dev, "pdr add lookup failed: %ld\n", PTR_ERR(pds));
+			of_node_put(node);
 			return PTR_ERR(pds);
 		}
 	}

From ec40a28495a892d7a99bf7f7e3ad72ea67fbf3b4 Mon Sep 17 00:00:00 2001
From: Rahul Tanwar <rtanwar@maxlinear.com>
Date: Wed, 20 Oct 2021 17:38:15 +0800
Subject: [PATCH 1597/1750] pinctrl: equilibrium: Fix function addition in
 multiple groups

[ Upstream commit 53b3947ddb7f309d1f611f8dc9bfd6ea9d699907 ]

Ignore the same function with multiple groups.
Fix a typo in error print.

Fixes: 1948d5c51dba ("pinctrl: Add pinmux & GPIO controller driver for a new SoC")
Signed-off-by: Rahul Tanwar <rtanwar@maxlinear.com>
Link: https://lore.kernel.org/r/20211020093815.20870-1-rtanwar@maxlinear.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-equilibrium.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/pinctrl/pinctrl-equilibrium.c b/drivers/pinctrl/pinctrl-equilibrium.c
index ac1c47f542c1..3b6dcaa80e00 100644
--- a/drivers/pinctrl/pinctrl-equilibrium.c
+++ b/drivers/pinctrl/pinctrl-equilibrium.c
@@ -674,6 +674,11 @@ static int eqbr_build_functions(struct eqbr_pinctrl_drv_data *drvdata)
 		return ret;
 
 	for (i = 0; i < nr_funcs; i++) {
+
+		/* Ignore the same function with multiple groups */
+		if (funcs[i].name == NULL)
+			continue;
+
 		ret = pinmux_generic_add_function(drvdata->pctl_dev,
 						  funcs[i].name,
 						  funcs[i].groups,
@@ -805,7 +810,7 @@ static int pinctrl_reg(struct eqbr_pinctrl_drv_data *drvdata)
 
 	ret = eqbr_build_functions(drvdata);
 	if (ret) {
-		dev_err(dev, "Failed to build groups\n");
+		dev_err(dev, "Failed to build functions\n");
 		return ret;
 	}
 

From 0a46740a0af08e3ee1a572bf4073a564c9cb160a Mon Sep 17 00:00:00 2001
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Date: Thu, 23 Sep 2021 02:35:48 +0300
Subject: [PATCH 1598/1750] phy: qcom-qusb2: Fix a memory leak on probe

[ Upstream commit bf7ffcd0069d30e2e7ba2b827f08c89f471cd1f3 ]

On success nvmem_cell_read() returns a pointer to a dynamically allocated
buffer, and therefore it shall be freed after usage.

The issue is reported by kmemleak:

  # cat /sys/kernel/debug/kmemleak
  unreferenced object 0xffff3b3803e4b280 (size 128):
    comm "kworker/u16:1", pid 107, jiffies 4294892861 (age 94.120s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<000000007739afdc>] __kmalloc+0x27c/0x41c
      [<0000000071c0fbf8>] nvmem_cell_read+0x40/0xe0
      [<00000000e803ef1f>] qusb2_phy_init+0x258/0x5bc
      [<00000000fc81fcfa>] phy_init+0x70/0x110
      [<00000000e3d48a57>] dwc3_core_soft_reset+0x4c/0x234
      [<0000000027d1dbd4>] dwc3_core_init+0x68/0x990
      [<000000001965faf9>] dwc3_probe+0x4f4/0x730
      [<000000002f7617ca>] platform_probe+0x74/0xf0
      [<00000000a2576cac>] really_probe+0xc4/0x470
      [<00000000bc77f2c5>] __driver_probe_device+0x11c/0x190
      [<00000000130db71f>] driver_probe_device+0x48/0x110
      [<0000000019f36c2b>] __device_attach_driver+0xa4/0x140
      [<00000000e5812ff7>]  bus_for_each_drv+0x84/0xe0
      [<00000000f4bac574>] __device_attach+0xe4/0x1c0
      [<00000000d3beb631>] device_initial_probe+0x20/0x30
      [<000000008019b9db>] bus_probe_device+0xa4/0xb0

Fixes: ca04d9d3e1b1 ("phy: qcom-qusb2: New driver for QUSB2 PHY on Qcom chips")
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/20210922233548.2150244-1-vladimir.zapolskiy@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/qualcomm/phy-qcom-qusb2.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c
index 557547dabfd5..f531043ec3de 100644
--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c
+++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c
@@ -474,7 +474,7 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
 {
 	struct device *dev = &qphy->phy->dev;
 	const struct qusb2_phy_cfg *cfg = qphy->cfg;
-	u8 *val;
+	u8 *val, hstx_trim;
 
 	/* efuse register is optional */
 	if (!qphy->cell)
@@ -488,7 +488,13 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
 	 * set while configuring the phy.
 	 */
 	val = nvmem_cell_read(qphy->cell, NULL);
-	if (IS_ERR(val) || !val[0]) {
+	if (IS_ERR(val)) {
+		dev_dbg(dev, "failed to read a valid hs-tx trim value\n");
+		return;
+	}
+	hstx_trim = val[0];
+	kfree(val);
+	if (!hstx_trim) {
 		dev_dbg(dev, "failed to read a valid hs-tx trim value\n");
 		return;
 	}
@@ -496,12 +502,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy)
 	/* Fused TUNE1/2 value is the higher nibble only */
 	if (cfg->update_tune1_with_efuse)
 		qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE1],
-				 val[0] << HSTX_TRIM_SHIFT,
-				 HSTX_TRIM_MASK);
+				 hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK);
 	else
 		qusb2_write_mask(qphy->base, cfg->regs[QUSB2PHY_PORT_TUNE2],
-				 val[0] << HSTX_TRIM_SHIFT,
-				 HSTX_TRIM_MASK);
+				 hstx_trim << HSTX_TRIM_SHIFT, HSTX_TRIM_MASK);
 }
 
 static int qusb2_phy_set_mode(struct phy *phy,

From fd056574a7e8322c847b458cfe7c1343dcc32497 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 14 Sep 2021 14:00:38 +0300
Subject: [PATCH 1599/1750] phy: ti: gmii-sel: check of_get_address() for
 failure

[ Upstream commit 8d55027f4e2c04146a75fb63371ab96ccc887f2c ]

Smatch complains that if of_get_address() returns NULL, then "size"
isn't initialized.  Also it would lead to an Oops.

Fixes: 7f78322cdd67 ("phy: ti: gmii-sel: retrieve ports number and base offset from dt")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Link: https://lore.kernel.org/r/20210914110038.GB11657@kili
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/ti/phy-gmii-sel.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
index 5fd2e8a08bfc..d0ab69750c6b 100644
--- a/drivers/phy/ti/phy-gmii-sel.c
+++ b/drivers/phy/ti/phy-gmii-sel.c
@@ -320,6 +320,8 @@ static int phy_gmii_sel_init_ports(struct phy_gmii_sel_priv *priv)
 		u64 size;
 
 		offset = of_get_address(dev->of_node, 0, &size, NULL);
+		if (!offset)
+			return -EINVAL;
 		priv->num_ports = size / sizeof(u32);
 		if (!priv->num_ports)
 			return -EINVAL;

From 515778f9d841c54b7aed8ee88940426c0987b649 Mon Sep 17 00:00:00 2001
From: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
Date: Mon, 25 Oct 2021 09:49:35 +0530
Subject: [PATCH 1600/1750] phy: qcom-snps: Correct the FSEL_MASK

[ Upstream commit b475bf0ec40a2b13fb32ef62f5706576d5858460 ]

The FSEL_MASK which selects the refclock is defined incorrectly.
It should be [4:6] not [5:7]. Due to this incorrect definition, the BIT(7)
in USB2_PHY_USB_PHY_HS_PHY_CTRL_COMMON0 is reset which keeps PHY analog
blocks ON during suspend.
Fix this issue by correctly defining the FSEL_MASK.

Fixes: 51e8114f80d0 ("phy: qcom-snps: Add SNPS USB PHY driver for QCOM based SOCs")
Signed-off-by: Sandeep Maheswaram <quic_c_sanm@quicinc.com>
Link: https://lore.kernel.org/r/1635135575-5668-1-git-send-email-quic_c_sanm@quicinc.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
index ae4bac024c7b..7e61202aa234 100644
--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
+++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
@@ -33,7 +33,7 @@
 
 #define USB2_PHY_USB_PHY_HS_PHY_CTRL_COMMON0	(0x54)
 #define RETENABLEN				BIT(3)
-#define FSEL_MASK				GENMASK(7, 5)
+#define FSEL_MASK				GENMASK(6, 4)
 #define FSEL_DEFAULT				(0x3 << 4)
 
 #define USB2_PHY_USB_PHY_HS_PHY_CTRL_COMMON1	(0x58)

From f2886010a8d1a87e4c667f0670839a374ec34a71 Mon Sep 17 00:00:00 2001
From: Anssi Hannula <anssi.hannula@bitwise.fi>
Date: Tue, 26 Oct 2021 13:27:41 +0300
Subject: [PATCH 1601/1750] serial: xilinx_uartps: Fix race condition causing
 stuck TX

[ Upstream commit 88b20f84f0fe47409342669caf3e58a3fc64c316 ]

xilinx_uartps .start_tx() clears TXEMPTY when enabling TXEMPTY to avoid
any previous TXEVENT event asserting the UART interrupt. This clear
operation is done immediately after filling the TX FIFO.

However, if the bytes inserted by cdns_uart_handle_tx() are consumed by
the UART before the TXEMPTY is cleared, the clear operation eats the new
TXEMPTY event as well, causing cdns_uart_isr() to never receive the
TXEMPTY event. If there are bytes still queued in circbuf, TX will get
stuck as they will never get transferred to FIFO (unless new bytes are
queued to circbuf in which case .start_tx() is called again).

While the racy missed TXEMPTY occurs fairly often with short data
sequences (e.g. write 1 byte), in those cases circbuf is usually empty
so no action on TXEMPTY would have been needed anyway. On the other
hand, longer data sequences make the race much more unlikely as UART
takes longer to consume the TX FIFO. Therefore it is rare for this race
to cause visible issues in general.

Fix the race by clearing the TXEMPTY bit in ISR *before* filling the
FIFO.

The TXEMPTY bit in ISR will only get asserted at the exact moment the
TX FIFO *becomes* empty, so clearing the bit before filling FIFO does
not cause an extra immediate assertion even if the FIFO is initially
empty.

This is hard to reproduce directly on a normal system, but inserting
e.g. udelay(200) after cdns_uart_handle_tx(port), setting 4000000 baud,
and then running "dd if=/dev/zero bs=128 of=/dev/ttyPS0 count=50"
reliably reproduces the issue on my ZynqMP test system unless this fix
is applied.

Fixes: 85baf542d54e ("tty: xuartps: support 64 byte FIFO size")
Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
Link: https://lore.kernel.org/r/20211026102741.2910441-1-anssi.hannula@bitwise.fi
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/xilinx_uartps.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
index a9b1ee27183a..b5a8afbc452b 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -601,9 +601,10 @@ static void cdns_uart_start_tx(struct uart_port *port)
 	if (uart_circ_empty(&port->state->xmit))
 		return;
 
+	writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR);
+
 	cdns_uart_handle_tx(port);
 
-	writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_ISR);
 	/* Enable the TX Empty interrupt */
 	writel(CDNS_UART_IXR_TXEMPTY, port->membase + CDNS_UART_IER);
 }

From 26be378079fc335d8ecb2113b58788d141b035df Mon Sep 17 00:00:00 2001
From: Claudiu Beznea <claudiu.beznea@microchip.com>
Date: Mon, 11 Oct 2021 14:27:11 +0300
Subject: [PATCH 1602/1750] clk: at91: sam9x60-pll: use DIV_ROUND_CLOSEST_ULL

[ Upstream commit f12d028b743bb6136da60b17228a1b6162886444 ]

Use DIV_ROUND_CLOSEST_ULL() to avoid any inconsistency b/w the rate
computed in sam9x60_frac_pll_recalc_rate() and the one computed in
sam9x60_frac_pll_compute_mul_frac().

Fixes: 43b1bb4a9b3e1 ("clk: at91: clk-sam9x60-pll: re-factor to support plls with multiple outputs")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20211011112719.3951784-8-claudiu.beznea@microchip.com
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clk/at91/clk-sam9x60-pll.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/clk/at91/clk-sam9x60-pll.c b/drivers/clk/at91/clk-sam9x60-pll.c
index 78f458a7b2ef..5a9daa3643a7 100644
--- a/drivers/clk/at91/clk-sam9x60-pll.c
+++ b/drivers/clk/at91/clk-sam9x60-pll.c
@@ -71,8 +71,8 @@ static unsigned long sam9x60_frac_pll_recalc_rate(struct clk_hw *hw,
 	struct sam9x60_pll_core *core = to_sam9x60_pll_core(hw);
 	struct sam9x60_frac *frac = to_sam9x60_frac(core);
 
-	return (parent_rate * (frac->mul + 1) +
-		((u64)parent_rate * frac->frac >> 22));
+	return parent_rate * (frac->mul + 1) +
+		DIV_ROUND_CLOSEST_ULL((u64)parent_rate * frac->frac, (1 << 22));
 }
 
 static int sam9x60_frac_pll_prepare(struct clk_hw *hw)

From e2f0bff411f5245ecd01061e5c17eff461ff6625 Mon Sep 17 00:00:00 2001
From: Andrej Shadura <andrew.shadura@collabora.co.uk>
Date: Tue, 19 Oct 2021 17:29:16 +0200
Subject: [PATCH 1603/1750] HID: u2fzero: clarify error check and length
 calculations

[ Upstream commit b7abf78b7a6c4a29a6e0ba0bb883fe44a2f3d693 ]

The previous commit fixed handling of incomplete packets but broke error
handling: offsetof returns an unsigned value (size_t), but when compared
against the signed return value, the return value is interpreted as if
it were unsigned, so negative return values are never less than the
offset.

To make the code easier to read, calculate the minimal packet length
once and separately, and assign it to a signed int variable to eliminate
unsigned math and the need for type casts. It then becomes immediately
obvious how the actual data length is calculated and why the return
value cannot be less than the minimal length.

Fixes: 22d65765f211 ("HID: u2fzero: ignore incomplete packets without data")
Fixes: 42337b9d4d95 ("HID: add driver for U2F Zero built-in LED and RNG")
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-u2fzero.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index d70cd3d7f583..94f78ffb76d0 100644
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -191,6 +191,8 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data,
 	struct u2f_hid_msg resp;
 	int ret;
 	size_t actual_length;
+	/* valid packets must have a correct header */
+	int min_length = offsetof(struct u2f_hid_msg, init.data);
 
 	if (!dev->present) {
 		hid_dbg(dev->hdev, "device not present");
@@ -200,12 +202,12 @@ static int u2fzero_rng_read(struct hwrng *rng, void *data,
 	ret = u2fzero_recv(dev, &req, &resp);
 
 	/* ignore errors or packets without data */
-	if (ret < offsetof(struct u2f_hid_msg, init.data))
+	if (ret < min_length)
 		return 0;
 
 	/* only take the minimum amount of data it is safe to take */
-	actual_length = min3((size_t)ret - offsetof(struct u2f_hid_msg,
-		init.data), U2F_HID_MSG_LEN(resp), max);
+	actual_length = min3((size_t)ret - min_length,
+		U2F_HID_MSG_LEN(resp), max);
 
 	memcpy(data, resp.init.data, actual_length);
 

From 4310970d0b4db03e769dcfc8e3f756ce4b789a01 Mon Sep 17 00:00:00 2001
From: Andrej Shadura <andrew.shadura@collabora.co.uk>
Date: Tue, 19 Oct 2021 17:29:17 +0200
Subject: [PATCH 1604/1750] HID: u2fzero: properly handle timeouts in
 usb_submit_urb

[ Upstream commit 43775e62c4b784f44a159e13ba80e6146a42d502 ]

The wait_for_completion_timeout function returns 0 if timed out or a
positive value if completed. Hence, "less than zero" comparison always
misses timeouts and doesn't kill the URB as it should, leading to
re-sending it while it is active.

Fixes: 42337b9d4d95 ("HID: add driver for U2F Zero built-in LED and RNG")
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-u2fzero.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-u2fzero.c b/drivers/hid/hid-u2fzero.c
index 94f78ffb76d0..67ae2b18e33a 100644
--- a/drivers/hid/hid-u2fzero.c
+++ b/drivers/hid/hid-u2fzero.c
@@ -132,7 +132,7 @@ static int u2fzero_recv(struct u2fzero_device *dev,
 
 	ret = (wait_for_completion_timeout(
 		&ctx.done, msecs_to_jiffies(USB_CTRL_SET_TIMEOUT)));
-	if (ret < 0) {
+	if (ret == 0) {
 		usb_kill_urb(dev->urb);
 		hid_err(hdev, "urb submission timed out");
 	} else {

From c0faad6e9d56ef6ef95a6798a6ce3ef2b9d70709 Mon Sep 17 00:00:00 2001
From: Bixuan Cui <cuibixuan@linux.alibaba.com>
Date: Thu, 28 Oct 2021 15:28:22 +0800
Subject: [PATCH 1605/1750] powerpc/44x/fsp2: add missing of_node_put

[ Upstream commit 290fe8aa69ef5c51c778c0bb33f8ef0181c769f5 ]

Early exits from for_each_compatible_node() should decrement the
node reference counter.  Reported by Coccinelle:

./arch/powerpc/platforms/44x/fsp2.c:206:1-25: WARNING: Function
"for_each_compatible_node" should have of_node_put() before return
around line 218.

Fixes: 7813043e1bbc ("powerpc/44x/fsp2: Add irq error handlers")
Signed-off-by: Bixuan Cui <cuibixuan@linux.alibaba.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1635406102-88719-1-git-send-email-cuibixuan@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/powerpc/platforms/44x/fsp2.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/powerpc/platforms/44x/fsp2.c b/arch/powerpc/platforms/44x/fsp2.c
index b299e43f5ef9..823397c802de 100644
--- a/arch/powerpc/platforms/44x/fsp2.c
+++ b/arch/powerpc/platforms/44x/fsp2.c
@@ -208,6 +208,7 @@ static void node_irq_request(const char *compat, irq_handler_t errirq_handler)
 		if (irq == NO_IRQ) {
 			pr_err("device tree node %pOFn is missing a interrupt",
 			      np);
+			of_node_put(np);
 			return;
 		}
 
@@ -215,6 +216,7 @@ static void node_irq_request(const char *compat, irq_handler_t errirq_handler)
 		if (rc) {
 			pr_err("fsp_of_probe: request_irq failed: np=%pOF rc=%d",
 			      np, rc);
+			of_node_put(np);
 			return;
 		}
 	}

From ef9d007a91f556e9b5b46477dfa27cc91d5baca9 Mon Sep 17 00:00:00 2001
From: Lucas Tanure <tanureal@opensource.cirrus.com>
Date: Sat, 6 Mar 2021 18:55:45 +0000
Subject: [PATCH 1606/1750] ASoC: cs42l42: Disable regulators if probe fails

[ Upstream commit 1abca8e1c77bd9c5f5c0bed21c5b075b6852a178 ]

In case of cs42l42_i2c_probe() fail, the regulators were left enabled.

Signed-off-by: Lucas Tanure <tanureal@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20210306185553.62053-8-tanureal@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs42l42.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index 191431868c67..eb1fcc5be057 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -1781,8 +1781,10 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
 	/* Reset the Device */
 	cs42l42->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
 		"reset", GPIOD_OUT_LOW);
-	if (IS_ERR(cs42l42->reset_gpio))
-		return PTR_ERR(cs42l42->reset_gpio);
+	if (IS_ERR(cs42l42->reset_gpio)) {
+		ret = PTR_ERR(cs42l42->reset_gpio);
+		goto err_disable;
+	}
 
 	if (cs42l42->reset_gpio) {
 		dev_dbg(&i2c_client->dev, "Found reset GPIO\n");
@@ -1817,13 +1819,13 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
 		dev_err(&i2c_client->dev,
 			"CS42L42 Device ID (%X). Expected %X\n",
 			devid, CS42L42_CHIP_ID);
-		return ret;
+		goto err_disable;
 	}
 
 	ret = regmap_read(cs42l42->regmap, CS42L42_REVID, &reg);
 	if (ret < 0) {
 		dev_err(&i2c_client->dev, "Get Revision ID failed\n");
-		return ret;
+		goto err_disable;
 	}
 
 	dev_info(&i2c_client->dev,
@@ -1849,7 +1851,7 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
 	if (i2c_client->dev.of_node) {
 		ret = cs42l42_handle_device_data(i2c_client, cs42l42);
 		if (ret != 0)
-			return ret;
+			goto err_disable;
 	}
 
 	/* Setup headset detection */

From cb0fdd9aae01df8444a490b570770ea332a34322 Mon Sep 17 00:00:00 2001
From: Richard Fitzgerald <rf@opensource.cirrus.com>
Date: Mon, 26 Apr 2021 16:53:02 +0100
Subject: [PATCH 1607/1750] ASoC: cs42l42: Use device_property API instead of
 of_property

[ Upstream commit ab78322a0dc8e5e472ff66ac7e18c94acc17587f ]

Use the device_property APIs so that the code will work on devicetree
and ACPI systems.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Lucas Tanure <tanureal@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20210426155303.853236-2-tanureal@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs42l42.c | 60 +++++++++++++++-----------------------
 1 file changed, 24 insertions(+), 36 deletions(-)

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index eb1fcc5be057..e56d3c9c3975 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -20,10 +20,9 @@
 #include <linux/regmap.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
+#include <linux/property.h>
 #include <linux/regulator/consumer.h>
 #include <linux/gpio/consumer.h>
-#include <linux/of.h>
-#include <linux/of_gpio.h>
 #include <linux/of_device.h>
 #include <sound/core.h>
 #include <sound/pcm.h>
@@ -1554,17 +1553,15 @@ static const unsigned int threshold_defaults[] = {
 	CS42L42_HS_DET_LEVEL_1
 };
 
-static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
+static int cs42l42_handle_device_data(struct device *dev,
 					struct cs42l42_private *cs42l42)
 {
-	struct device_node *np = i2c_client->dev.of_node;
 	unsigned int val;
-	unsigned int thresholds[CS42L42_NUM_BIASES];
+	u32 thresholds[CS42L42_NUM_BIASES];
 	int ret;
 	int i;
 
-	ret = of_property_read_u32(np, "cirrus,ts-inv", &val);
-
+	ret = device_property_read_u32(dev, "cirrus,ts-inv", &val);
 	if (!ret) {
 		switch (val) {
 		case CS42L42_TS_INV_EN:
@@ -1572,7 +1569,7 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			cs42l42->ts_inv = val;
 			break;
 		default:
-			dev_err(&i2c_client->dev,
+			dev_err(dev,
 				"Wrong cirrus,ts-inv DT value %d\n",
 				val);
 			cs42l42->ts_inv = CS42L42_TS_INV_DIS;
@@ -1585,8 +1582,7 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			CS42L42_TS_INV_MASK,
 			(cs42l42->ts_inv << CS42L42_TS_INV_SHIFT));
 
-	ret = of_property_read_u32(np, "cirrus,ts-dbnc-rise", &val);
-
+	ret = device_property_read_u32(dev, "cirrus,ts-dbnc-rise", &val);
 	if (!ret) {
 		switch (val) {
 		case CS42L42_TS_DBNCE_0:
@@ -1600,7 +1596,7 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			cs42l42->ts_dbnc_rise = val;
 			break;
 		default:
-			dev_err(&i2c_client->dev,
+			dev_err(dev,
 				"Wrong cirrus,ts-dbnc-rise DT value %d\n",
 				val);
 			cs42l42->ts_dbnc_rise = CS42L42_TS_DBNCE_1000;
@@ -1614,8 +1610,7 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			(cs42l42->ts_dbnc_rise <<
 			CS42L42_TS_RISE_DBNCE_TIME_SHIFT));
 
-	ret = of_property_read_u32(np, "cirrus,ts-dbnc-fall", &val);
-
+	ret = device_property_read_u32(dev, "cirrus,ts-dbnc-fall", &val);
 	if (!ret) {
 		switch (val) {
 		case CS42L42_TS_DBNCE_0:
@@ -1629,7 +1624,7 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			cs42l42->ts_dbnc_fall = val;
 			break;
 		default:
-			dev_err(&i2c_client->dev,
+			dev_err(dev,
 				"Wrong cirrus,ts-dbnc-fall DT value %d\n",
 				val);
 			cs42l42->ts_dbnc_fall = CS42L42_TS_DBNCE_0;
@@ -1643,13 +1638,12 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			(cs42l42->ts_dbnc_fall <<
 			CS42L42_TS_FALL_DBNCE_TIME_SHIFT));
 
-	ret = of_property_read_u32(np, "cirrus,btn-det-init-dbnce", &val);
-
+	ret = device_property_read_u32(dev, "cirrus,btn-det-init-dbnce", &val);
 	if (!ret) {
 		if (val <= CS42L42_BTN_DET_INIT_DBNCE_MAX)
 			cs42l42->btn_det_init_dbnce = val;
 		else {
-			dev_err(&i2c_client->dev,
+			dev_err(dev,
 				"Wrong cirrus,btn-det-init-dbnce DT value %d\n",
 				val);
 			cs42l42->btn_det_init_dbnce =
@@ -1660,14 +1654,13 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			CS42L42_BTN_DET_INIT_DBNCE_DEFAULT;
 	}
 
-	ret = of_property_read_u32(np, "cirrus,btn-det-event-dbnce", &val);
-
+	ret = device_property_read_u32(dev, "cirrus,btn-det-event-dbnce", &val);
 	if (!ret) {
 		if (val <= CS42L42_BTN_DET_EVENT_DBNCE_MAX)
 			cs42l42->btn_det_event_dbnce = val;
 		else {
-			dev_err(&i2c_client->dev,
-			"Wrong cirrus,btn-det-event-dbnce DT value %d\n", val);
+			dev_err(dev,
+				"Wrong cirrus,btn-det-event-dbnce DT value %d\n", val);
 			cs42l42->btn_det_event_dbnce =
 				CS42L42_BTN_DET_EVENT_DBNCE_DEFAULT;
 		}
@@ -1676,19 +1669,17 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			CS42L42_BTN_DET_EVENT_DBNCE_DEFAULT;
 	}
 
-	ret = of_property_read_u32_array(np, "cirrus,bias-lvls",
-				   (u32 *)thresholds, CS42L42_NUM_BIASES);
-
+	ret = device_property_read_u32_array(dev, "cirrus,bias-lvls",
+					     thresholds, ARRAY_SIZE(thresholds));
 	if (!ret) {
 		for (i = 0; i < CS42L42_NUM_BIASES; i++) {
 			if (thresholds[i] <= CS42L42_HS_DET_LEVEL_MAX)
 				cs42l42->bias_thresholds[i] = thresholds[i];
 			else {
-				dev_err(&i2c_client->dev,
-				"Wrong cirrus,bias-lvls[%d] DT value %d\n", i,
+				dev_err(dev,
+					"Wrong cirrus,bias-lvls[%d] DT value %d\n", i,
 					thresholds[i]);
-				cs42l42->bias_thresholds[i] =
-					threshold_defaults[i];
+				cs42l42->bias_thresholds[i] = threshold_defaults[i];
 			}
 		}
 	} else {
@@ -1696,8 +1687,7 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			cs42l42->bias_thresholds[i] = threshold_defaults[i];
 	}
 
-	ret = of_property_read_u32(np, "cirrus,hs-bias-ramp-rate", &val);
-
+	ret = device_property_read_u32(dev, "cirrus,hs-bias-ramp-rate", &val);
 	if (!ret) {
 		switch (val) {
 		case CS42L42_HSBIAS_RAMP_FAST_RISE_SLOW_FALL:
@@ -1717,7 +1707,7 @@ static int cs42l42_handle_device_data(struct i2c_client *i2c_client,
 			cs42l42->hs_bias_ramp_time = CS42L42_HSBIAS_RAMP_TIME3;
 			break;
 		default:
-			dev_err(&i2c_client->dev,
+			dev_err(dev,
 				"Wrong cirrus,hs-bias-ramp-rate DT value %d\n",
 				val);
 			cs42l42->hs_bias_ramp_rate = CS42L42_HSBIAS_RAMP_SLOW;
@@ -1848,11 +1838,9 @@ static int cs42l42_i2c_probe(struct i2c_client *i2c_client,
 			(1 << CS42L42_ADC_PDN_SHIFT) |
 			(0 << CS42L42_PDN_ALL_SHIFT));
 
-	if (i2c_client->dev.of_node) {
-		ret = cs42l42_handle_device_data(i2c_client, cs42l42);
-		if (ret != 0)
-			goto err_disable;
-	}
+	ret = cs42l42_handle_device_data(&i2c_client->dev, cs42l42);
+	if (ret != 0)
+		goto err_disable;
 
 	/* Setup headset detection */
 	cs42l42_setup_hs_type_detect(cs42l42);

From 80e6643393b7c44342d2347281c98db6069ee466 Mon Sep 17 00:00:00 2001
From: Richard Fitzgerald <rf@opensource.cirrus.com>
Date: Thu, 28 Oct 2021 15:09:01 +0100
Subject: [PATCH 1608/1750] ASoC: cs42l42: Correct configuring of switch
 inversion from ts-inv

[ Upstream commit 778a0cbef5fb76bf506f84938517bb77e7a1c478 ]

The setting from the cirrus,ts-inv property should be applied to the
TIP_SENSE_INV bit, as this is the one that actually affects the jack
detect block. The TS_INV bit only swaps the meaning of the PLUG and
UNPLUG interrupts and should always be 1 for the interrupts to have
the normal meaning.

Due to some misunderstanding the driver had been implemented to
configure the TS_INV bit based on the jack switch polarity. This made
the interrupts behave the correct way around, but left the jack detect
block, button detect and analogue circuits always interpreting an open
switch as unplugged.

The signal chain inside the codec is:

SENSE pin -> TIP_SENSE_INV -> TS_INV -> (invert) -> interrupts
                  |
                  v
             Jack detect,
          button detect and
            analog control

As the TIP_SENSE_INV already performs the necessary inversion the
TS_INV bit never needs to change. It must always be 1 to yield the
expected interrupt behaviour.

Some extra confusion has arisen because of the additional invert in the
interrupt path, meaning that a value applied to the TS_INV bit produces
the opposite effect of applying it to the TIP_SENSE_INV bit. The ts-inv
property has therefore always had the opposite effect to what might be
expected (0 = inverted, 1 = not inverted). To maintain the meaning of
the ts-inv property it must be inverted when applied to TIP_SENSE_INV.

Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec")
Link: https://lore.kernel.org/r/20211028140902.11786-3-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/cs42l42.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/sound/soc/codecs/cs42l42.c b/sound/soc/codecs/cs42l42.c
index e56d3c9c3975..54c1ede59b8b 100644
--- a/sound/soc/codecs/cs42l42.c
+++ b/sound/soc/codecs/cs42l42.c
@@ -1529,12 +1529,15 @@ static void cs42l42_setup_hs_type_detect(struct cs42l42_private *cs42l42)
 			(1 << CS42L42_HS_CLAMP_DISABLE_SHIFT));
 
 	/* Enable the tip sense circuit */
+	regmap_update_bits(cs42l42->regmap, CS42L42_TSENSE_CTL,
+			   CS42L42_TS_INV_MASK, CS42L42_TS_INV_MASK);
+
 	regmap_update_bits(cs42l42->regmap, CS42L42_TIPSENSE_CTL,
 			CS42L42_TIP_SENSE_CTRL_MASK |
 			CS42L42_TIP_SENSE_INV_MASK |
 			CS42L42_TIP_SENSE_DEBOUNCE_MASK,
 			(3 << CS42L42_TIP_SENSE_CTRL_SHIFT) |
-			(0 << CS42L42_TIP_SENSE_INV_SHIFT) |
+			(!cs42l42->ts_inv << CS42L42_TIP_SENSE_INV_SHIFT) |
 			(2 << CS42L42_TIP_SENSE_DEBOUNCE_SHIFT));
 
 	/* Save the initial status of the tip sense */
@@ -1578,10 +1581,6 @@ static int cs42l42_handle_device_data(struct device *dev,
 		cs42l42->ts_inv = CS42L42_TS_INV_DIS;
 	}
 
-	regmap_update_bits(cs42l42->regmap, CS42L42_TSENSE_CTL,
-			CS42L42_TS_INV_MASK,
-			(cs42l42->ts_inv << CS42L42_TS_INV_SHIFT));
-
 	ret = device_property_read_u32(dev, "cirrus,ts-dbnc-rise", &val);
 	if (!ret) {
 		switch (val) {

From c8447cb14a125ba25255e4d6b380ce7a14a3fecd Mon Sep 17 00:00:00 2001
From: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Date: Wed, 20 Oct 2021 19:23:23 +0800
Subject: [PATCH 1609/1750] virtio_ring: check desc == NULL when using indirect
 with packed

[ Upstream commit fc6d70f40b3d0b3219e2026d05be0409695f620d ]

When using indirect with packed, we don't check for allocation failures.
This patch checks that and fall back on direct.

Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support")
Signed-off-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Link: https://lore.kernel.org/r/20211020112323.67466-3-xuanzhuo@linux.alibaba.com
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/virtio/virtio_ring.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 6c730d6d50f7..e9432dbbec0a 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -992,6 +992,8 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq,
 
 	head = vq->packed.next_avail_idx;
 	desc = alloc_indirect_packed(total_sg, gfp);
+	if (!desc)
+		return -ENOMEM;
 
 	if (unlikely(vq->vq.num_free < 1)) {
 		pr_debug("Can't add buf len 1 - avail = 0\n");
@@ -1103,6 +1105,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq,
 	unsigned int i, n, c, descs_used, err_idx;
 	__le16 head_flags, flags;
 	u16 head, id, prev, curr, avail_used_flags;
+	int err;
 
 	START_USE(vq);
 
@@ -1118,9 +1121,14 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq,
 
 	BUG_ON(total_sg == 0);
 
-	if (virtqueue_use_indirect(_vq, total_sg))
-		return virtqueue_add_indirect_packed(vq, sgs, total_sg,
-				out_sgs, in_sgs, data, gfp);
+	if (virtqueue_use_indirect(_vq, total_sg)) {
+		err = virtqueue_add_indirect_packed(vq, sgs, total_sg, out_sgs,
+						    in_sgs, data, gfp);
+		if (err != -ENOMEM)
+			return err;
+
+		/* fall back on direct */
+	}
 
 	head = vq->packed.next_avail_idx;
 	avail_used_flags = vq->packed.avail_used_flags;

From dbdf0f2207596c0d48f5db9d70f6e4c5a299d761 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert+renesas@glider.be>
Date: Fri, 29 Oct 2021 11:58:16 +0200
Subject: [PATCH 1610/1750] mips: cm: Convert to bitfield API to fix
 out-of-bounds access

[ Upstream commit 18b8f5b6fc53d097cadb94a93d8d6566ba88e389 ]

mips_cm_error_report() extracts the cause and other cause from the error
register using shifts.  This works fine for the former, as it is stored
in the top bits, and the shift will thus remove all non-related bits.
However, the latter is stored in the bottom bits, hence thus needs masking
to get rid of non-related bits.  Without such masking, using it as an
index into the cm2_causes[] array will lead to an out-of-bounds access,
probably causing a crash.

Fix this by using FIELD_GET() instead.  Bite the bullet and convert all
MIPS CM handling to the bitfield API, to improve readability and safety.

Fixes: 3885c2b463f6a236 ("MIPS: CM: Add support for reporting CM cache errors")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/include/asm/mips-cm.h | 12 ++++++------
 arch/mips/kernel/mips-cm.c      | 21 ++++++++++-----------
 2 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
index aeae2effa123..23c67c0871b1 100644
--- a/arch/mips/include/asm/mips-cm.h
+++ b/arch/mips/include/asm/mips-cm.h
@@ -11,6 +11,7 @@
 #ifndef __MIPS_ASM_MIPS_CM_H__
 #define __MIPS_ASM_MIPS_CM_H__
 
+#include <linux/bitfield.h>
 #include <linux/bitops.h>
 #include <linux/errno.h>
 
@@ -153,8 +154,8 @@ GCR_ACCESSOR_RO(32, 0x030, rev)
 #define CM_GCR_REV_MINOR			GENMASK(7, 0)
 
 #define CM_ENCODE_REV(major, minor) \
-		(((major) << __ffs(CM_GCR_REV_MAJOR)) | \
-		 ((minor) << __ffs(CM_GCR_REV_MINOR)))
+		(FIELD_PREP(CM_GCR_REV_MAJOR, major) | \
+		 FIELD_PREP(CM_GCR_REV_MINOR, minor))
 
 #define CM_REV_CM2				CM_ENCODE_REV(6, 0)
 #define CM_REV_CM2_5				CM_ENCODE_REV(7, 0)
@@ -362,10 +363,10 @@ static inline int mips_cm_revision(void)
 static inline unsigned int mips_cm_max_vp_width(void)
 {
 	extern int smp_num_siblings;
-	uint32_t cfg;
 
 	if (mips_cm_revision() >= CM_REV_CM3)
-		return read_gcr_sys_config2() & CM_GCR_SYS_CONFIG2_MAXVPW;
+		return FIELD_GET(CM_GCR_SYS_CONFIG2_MAXVPW,
+				 read_gcr_sys_config2());
 
 	if (mips_cm_present()) {
 		/*
@@ -373,8 +374,7 @@ static inline unsigned int mips_cm_max_vp_width(void)
 		 * number of VP(E)s, and if that ever changes then this will
 		 * need revisiting.
 		 */
-		cfg = read_gcr_cl_config() & CM_GCR_Cx_CONFIG_PVPE;
-		return (cfg >> __ffs(CM_GCR_Cx_CONFIG_PVPE)) + 1;
+		return FIELD_GET(CM_GCR_Cx_CONFIG_PVPE, read_gcr_cl_config()) + 1;
 	}
 
 	if (IS_ENABLED(CONFIG_SMP))
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index f60af512c877..72c8374a3900 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -221,8 +221,7 @@ static void mips_cm_probe_l2sync(void)
 	phys_addr_t addr;
 
 	/* L2-only sync was introduced with CM major revision 6 */
-	major_rev = (read_gcr_rev() & CM_GCR_REV_MAJOR) >>
-		__ffs(CM_GCR_REV_MAJOR);
+	major_rev = FIELD_GET(CM_GCR_REV_MAJOR, read_gcr_rev());
 	if (major_rev < 6)
 		return;
 
@@ -305,13 +304,13 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
 	preempt_disable();
 
 	if (cm_rev >= CM_REV_CM3) {
-		val = core << __ffs(CM3_GCR_Cx_OTHER_CORE);
-		val |= vp << __ffs(CM3_GCR_Cx_OTHER_VP);
+		val = FIELD_PREP(CM3_GCR_Cx_OTHER_CORE, core) |
+		      FIELD_PREP(CM3_GCR_Cx_OTHER_VP, vp);
 
 		if (cm_rev >= CM_REV_CM3_5) {
 			val |= CM_GCR_Cx_OTHER_CLUSTER_EN;
-			val |= cluster << __ffs(CM_GCR_Cx_OTHER_CLUSTER);
-			val |= block << __ffs(CM_GCR_Cx_OTHER_BLOCK);
+			val |= FIELD_PREP(CM_GCR_Cx_OTHER_CLUSTER, cluster);
+			val |= FIELD_PREP(CM_GCR_Cx_OTHER_BLOCK, block);
 		} else {
 			WARN_ON(cluster != 0);
 			WARN_ON(block != CM_GCR_Cx_OTHER_BLOCK_LOCAL);
@@ -341,7 +340,7 @@ void mips_cm_lock_other(unsigned int cluster, unsigned int core,
 		spin_lock_irqsave(&per_cpu(cm_core_lock, curr_core),
 				  per_cpu(cm_core_lock_flags, curr_core));
 
-		val = core << __ffs(CM_GCR_Cx_OTHER_CORENUM);
+		val = FIELD_PREP(CM_GCR_Cx_OTHER_CORENUM, core);
 	}
 
 	write_gcr_cl_other(val);
@@ -385,8 +384,8 @@ void mips_cm_error_report(void)
 	cm_other = read_gcr_error_mult();
 
 	if (revision < CM_REV_CM3) { /* CM2 */
-		cause = cm_error >> __ffs(CM_GCR_ERROR_CAUSE_ERRTYPE);
-		ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND);
+		cause = FIELD_GET(CM_GCR_ERROR_CAUSE_ERRTYPE, cm_error);
+		ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other);
 
 		if (!cause)
 			return;
@@ -444,8 +443,8 @@ void mips_cm_error_report(void)
 		ulong core_id_bits, vp_id_bits, cmd_bits, cmd_group_bits;
 		ulong cm3_cca_bits, mcp_bits, cm3_tr_bits, sched_bit;
 
-		cause = cm_error >> __ffs64(CM3_GCR_ERROR_CAUSE_ERRTYPE);
-		ocause = cm_other >> __ffs(CM_GCR_ERROR_MULT_ERR2ND);
+		cause = FIELD_GET(CM3_GCR_ERROR_CAUSE_ERRTYPE, cm_error);
+		ocause = FIELD_GET(CM_GCR_ERROR_MULT_ERR2ND, cm_other);
 
 		if (!cause)
 			return;

From 9c9c33ea4cabd76348bdd006ca9b6bf55c217733 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 31 Oct 2021 16:25:22 +0100
Subject: [PATCH 1611/1750] power: supply: bq27xxx: Fix kernel crash on IRQ
 handler register error

[ Upstream commit cdf10ffe8f626d8a2edc354abf063df0078b2d71 ]

When registering the IRQ handler fails, do not just return the error code,
this will free the devm_kzalloc()-ed data struct while leaving the queued
work queued and the registered power_supply registered with both of them
now pointing to free-ed memory, resulting in various kernel crashes
soon afterwards.

Instead properly tear-down things on IRQ handler register errors.

Fixes: 703df6c09795 ("power: bq27xxx_battery: Reorganize I2C into a module")
Cc: Andrew F. Davis <afd@ti.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/bq27xxx_battery_i2c.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/bq27xxx_battery_i2c.c b/drivers/power/supply/bq27xxx_battery_i2c.c
index eb4f4284982f..3012eb13a08c 100644
--- a/drivers/power/supply/bq27xxx_battery_i2c.c
+++ b/drivers/power/supply/bq27xxx_battery_i2c.c
@@ -187,7 +187,8 @@ static int bq27xxx_battery_i2c_probe(struct i2c_client *client,
 			dev_err(&client->dev,
 				"Unable to register IRQ %d error %d\n",
 				client->irq, ret);
-			return ret;
+			bq27xxx_battery_teardown(di);
+			goto err_failed;
 		}
 	}
 

From 851b622e7b4f28c0fdbc543fadf4256e29927b04 Mon Sep 17 00:00:00 2001
From: Tom Rix <trix@redhat.com>
Date: Sun, 4 Oct 2020 07:24:22 -0700
Subject: [PATCH 1612/1750] apparmor: fix error check

[ Upstream commit d108370c644b153382632b3e5511ade575c91c86 ]

clang static analysis reports this representative problem:

label.c:1463:16: warning: Assigned value is garbage or undefined
        label->hname = name;
                     ^ ~~~~

In aa_update_label_name(), this the problem block of code

	if (aa_label_acntsxprint(&name, ...) == -1)
		return res;

On failure, aa_label_acntsxprint() has a more complicated return
that just -1.  So check for a negative return.

It was also noted that the aa_label_acntsxprint() main comment refers
to a nonexistent parameter, so clean up the comment.

Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels")
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 security/apparmor/label.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index e68bcedca976..6222fdfebe4e 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -1454,7 +1454,7 @@ bool aa_update_label_name(struct aa_ns *ns, struct aa_label *label, gfp_t gfp)
 	if (label->hname || labels_ns(label) != ns)
 		return res;
 
-	if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) == -1)
+	if (aa_label_acntsxprint(&name, ns, label, FLAGS_NONE, gfp) < 0)
 		return res;
 
 	ls = labels_set(label);
@@ -1704,7 +1704,7 @@ int aa_label_asxprint(char **strp, struct aa_ns *ns, struct aa_label *label,
 
 /**
  * aa_label_acntsxprint - allocate a __counted string buffer and print label
- * @strp: buffer to write to. (MAY BE NULL if @size == 0)
+ * @strp: buffer to write to.
  * @ns: namespace profile is being viewed from
  * @label: label to view (NOT NULL)
  * @flags: flags controlling what label info is printed

From 602ab1fd40e2c5cb8d3664379da967528833844c Mon Sep 17 00:00:00 2001
From: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Date: Mon, 12 Jul 2021 14:39:12 +0200
Subject: [PATCH 1613/1750] rpmsg: Fix rpmsg_create_ept return when RPMSG
 config is not defined

[ Upstream commit 537d3af1bee8ad1415fda9b622d1ea6d1ae76dfa ]

According to the description of the rpmsg_create_ept in rpmsg_core.c
the function should return NULL on error.

Fixes: 2c8a57088045 ("rpmsg: Provide function stubs for API")
Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20210712123912.10672-1-arnaud.pouliquen@foss.st.com
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/rpmsg.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h
index 9fe156d1c018..a68972b097b7 100644
--- a/include/linux/rpmsg.h
+++ b/include/linux/rpmsg.h
@@ -177,7 +177,7 @@ static inline struct rpmsg_endpoint *rpmsg_create_ept(struct rpmsg_device *rpdev
 	/* This shouldn't be possible */
 	WARN_ON(1);
 
-	return ERR_PTR(-ENXIO);
+	return NULL;
 }
 
 static inline int rpmsg_send(struct rpmsg_endpoint *ept, void *data, int len)

From f3492c4a92644cb54ec2c6daff6c428aebfc36dc Mon Sep 17 00:00:00 2001
From: "J. Bruce Fields" <bfields@redhat.com>
Date: Tue, 14 Sep 2021 12:30:32 -0400
Subject: [PATCH 1614/1750] nfsd: don't alloc under spinlock in
 rpc_parse_scope_id

[ Upstream commit 9b6e27d01adcec58e046c624874f8a124e8b07ec ]

Dan Carpenter says:

  The patch d20c11d86d8f: "nfsd: Protect session creation and client
  confirm using client_lock" from Jul 30, 2014, leads to the following
  Smatch static checker warning:

        net/sunrpc/addr.c:178 rpc_parse_scope_id()
        warn: sleeping in atomic context

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: d20c11d86d8f ("nfsd: Protect session creation and client...")
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sunrpc/addr.c | 36 ++++++++++++++++--------------------
 1 file changed, 16 insertions(+), 20 deletions(-)

diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
index 6e4dbd577a39..d435bffc6199 100644
--- a/net/sunrpc/addr.c
+++ b/net/sunrpc/addr.c
@@ -162,8 +162,10 @@ static int rpc_parse_scope_id(struct net *net, const char *buf,
 			      const size_t buflen, const char *delim,
 			      struct sockaddr_in6 *sin6)
 {
-	char *p;
+	char p[IPV6_SCOPE_ID_LEN + 1];
 	size_t len;
+	u32 scope_id = 0;
+	struct net_device *dev;
 
 	if ((buf + buflen) == delim)
 		return 1;
@@ -175,29 +177,23 @@ static int rpc_parse_scope_id(struct net *net, const char *buf,
 		return 0;
 
 	len = (buf + buflen) - delim - 1;
-	p = kmemdup_nul(delim + 1, len, GFP_KERNEL);
-	if (p) {
-		u32 scope_id = 0;
-		struct net_device *dev;
+	if (len > IPV6_SCOPE_ID_LEN)
+		return 0;
 
-		dev = dev_get_by_name(net, p);
-		if (dev != NULL) {
-			scope_id = dev->ifindex;
-			dev_put(dev);
-		} else {
-			if (kstrtou32(p, 10, &scope_id) != 0) {
-				kfree(p);
-				return 0;
-			}
-		}
+	memcpy(p, delim + 1, len);
+	p[len] = 0;
 
-		kfree(p);
-
-		sin6->sin6_scope_id = scope_id;
-		return 1;
+	dev = dev_get_by_name(net, p);
+	if (dev != NULL) {
+		scope_id = dev->ifindex;
+		dev_put(dev);
+	} else {
+		if (kstrtou32(p, 10, &scope_id) != 0)
+			return 0;
 	}
 
-	return 0;
+	sin6->sin6_scope_id = scope_id;
+	return 1;
 }
 
 static size_t rpc_pton6(struct net *net, const char *buf, const size_t buflen,

From 9d438dbf7342f5cd231b8009bc30076db0f5b925 Mon Sep 17 00:00:00 2001
From: Kewei Xu <kewei.xu@mediatek.com>
Date: Fri, 17 Sep 2021 18:14:10 +0800
Subject: [PATCH 1615/1750] i2c: mediatek: fixing the incorrect register offset

[ Upstream commit b8228aea5a19d5111a7bf44f7de6749d1f5d487a ]

The reason for the modification here is that the previous
offset information is incorrect, OFFSET_DEBUGSTAT = 0xE4 is
the correct value.

Fixes: 25708278f810 ("i2c: mediatek: Add i2c support for MediaTek MT8183")
Signed-off-by: Kewei Xu <kewei.xu@mediatek.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Qii Wang <qii.wang@mediatek.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-mt65xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 0af2784cbd0d..265635db29aa 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -195,7 +195,7 @@ static const u16 mt_i2c_regs_v2[] = {
 	[OFFSET_CLOCK_DIV] = 0x48,
 	[OFFSET_SOFTRESET] = 0x50,
 	[OFFSET_SCL_MIS_COMP_POINT] = 0x90,
-	[OFFSET_DEBUGSTAT] = 0xe0,
+	[OFFSET_DEBUGSTAT] = 0xe4,
 	[OFFSET_DEBUGCTRL] = 0xe8,
 	[OFFSET_FIFO_STAT] = 0xf4,
 	[OFFSET_FIFO_THRESH] = 0xf8,

From 8ac076ce719321901ebd2df30fba690671adbd7e Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Wed, 29 Sep 2021 08:12:53 -0400
Subject: [PATCH 1616/1750] NFS: Fix dentry verifier races

[ Upstream commit cec08f452a687fce9dfdf47946d00a1d12a8bec5 ]

If the directory changed while we were revalidating the dentry, then
don't update the dentry verifier. There is no value in setting the
verifier to an older value, and we could end up overwriting a more up to
date verifier from a parallel revalidation.

Fixes: efeda80da38d ("NFSv4: Fix revalidation of dentries with delegations")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Tested-by: Benjamin Coddington <bcodding@redhat.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/dir.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index c837675cd395..8b963c72dd3b 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1061,13 +1061,12 @@ static bool nfs_verifier_is_delegated(struct dentry *dentry)
 static void nfs_set_verifier_locked(struct dentry *dentry, unsigned long verf)
 {
 	struct inode *inode = d_inode(dentry);
+	struct inode *dir = d_inode(dentry->d_parent);
 
-	if (!nfs_verifier_is_delegated(dentry) &&
-	    !nfs_verify_change_attribute(d_inode(dentry->d_parent), verf))
-		goto out;
+	if (!nfs_verify_change_attribute(dir, verf))
+		return;
 	if (inode && NFS_PROTO(inode)->have_delegation(inode, FMODE_READ))
 		nfs_set_verifier_delegated(&verf);
-out:
 	dentry->d_time = verf;
 }
 

From e94c59b64e6ceb7b78fcdcb9a927f7b07461fff4 Mon Sep 17 00:00:00 2001
From: Baptiste Lepers <baptiste.lepers@gmail.com>
Date: Mon, 6 Sep 2021 11:59:24 +1000
Subject: [PATCH 1617/1750] pnfs/flexfiles: Fix misplaced barrier in
 nfs4_ff_layout_prepare_ds

[ Upstream commit a2915fa06227b056a8f9b0d79b61dca08ad5cfc6 ]

_nfs4_pnfs_v3/v4_ds_connect do
   some work
   smp_wmb
   ds->ds_clp = clp;

And nfs4_ff_layout_prepare_ds currently does
   smp_rmb
   if(ds->ds_clp)
      ...

This patch places the smp_rmb after the if. This ensures that following
reads only happen once nfs4_ff_layout_prepare_ds has checked that data
has been properly initialized.

Fixes: d67ae825a59d6 ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Signed-off-by: Baptiste Lepers <baptiste.lepers@gmail.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/flexfilelayout/flexfilelayoutdev.c | 4 ++--
 fs/nfs/pnfs_nfs.c                         | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 3eda40a320a5..1f12297109b4 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -378,10 +378,10 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg,
 		goto noconnect;
 
 	ds = mirror->mirror_ds->ds;
+	if (READ_ONCE(ds->ds_clp))
+		goto out;
 	/* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
 	smp_rmb();
-	if (ds->ds_clp)
-		goto out;
 
 	/* FIXME: For now we assume the server sent only one version of NFS
 	 * to use for the DS.
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 251c4a3aef9a..37b52b53a7e5 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -876,7 +876,7 @@ static int _nfs4_pnfs_v3_ds_connect(struct nfs_server *mds_srv,
 	}
 
 	smp_wmb();
-	ds->ds_clp = clp;
+	WRITE_ONCE(ds->ds_clp, clp);
 	dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
 out:
 	return status;
@@ -949,7 +949,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,
 	}
 
 	smp_wmb();
-	ds->ds_clp = clp;
+	WRITE_ONCE(ds->ds_clp, clp);
 	dprintk("%s [new] addr: %s\n", __func__, ds->ds_remotestr);
 out:
 	return status;

From 2e548581fe5b48730d814916bd6bb8f8d8b5375a Mon Sep 17 00:00:00 2001
From: "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
Date: Thu, 7 Oct 2021 02:37:06 -0400
Subject: [PATCH 1618/1750] drm/plane-helper: fix uninitialized variable
 reference

[ Upstream commit 7be28bd73f23e53d6e7f5fe891ba9503fc0c7210 ]

drivers/gpu/drm/drm_plane_helper.c: In function 'drm_primary_helper_update':
drivers/gpu/drm/drm_plane_helper.c:113:32: error: 'visible' is used uninitialized [-Werror=uninitialized]
  113 |         struct drm_plane_state plane_state = {
      |                                ^~~~~~~~~~~
drivers/gpu/drm/drm_plane_helper.c:178:14: note: 'visible' was declared here
  178 |         bool visible;
      |              ^~~~~~~
cc1: all warnings being treated as errors

visible is an output, not an input. in practice this use might turn out
OK but it's still UB.

Fixes: df86af9133b4 ("drm/plane-helper: Add drm_plane_helper_check_state()")
Reviewed-by: Simon Ser <contact@emersion.fr>
Signed-off-by: Alex Xu (Hello71) <alex_y_xu@yahoo.ca>
Signed-off-by: Simon Ser <contact@emersion.fr>
Link: https://patchwork.freedesktop.org/patch/msgid/20211007063706.305984-1-alex_y_xu@yahoo.ca
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_plane_helper.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_plane_helper.c b/drivers/gpu/drm/drm_plane_helper.c
index 3aae7ea522f2..c3f2292dc93d 100644
--- a/drivers/gpu/drm/drm_plane_helper.c
+++ b/drivers/gpu/drm/drm_plane_helper.c
@@ -123,7 +123,6 @@ static int drm_plane_helper_check_update(struct drm_plane *plane,
 		.crtc_w = drm_rect_width(dst),
 		.crtc_h = drm_rect_height(dst),
 		.rotation = rotation,
-		.visible = *visible,
 	};
 	struct drm_crtc_state crtc_state = {
 		.crtc = crtc,

From ec6dba3ffe3fff8297d88edc983900352a10ba4d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Tue, 5 Oct 2021 20:09:42 +0200
Subject: [PATCH 1619/1750] PCI: aardvark: Don't spam about PIO Response Status
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 464de7e7fff767e87429cd7be09c4f2cb50a6ccb ]

Use dev_dbg() instead of dev_err() in advk_pcie_check_pio_status().

For example CRS is not an error status, it just says that the request
should be retried.

Link: https://lore.kernel.org/r/20211005180952.6812-4-kabel@kernel.org
Fixes: 8c39d710363c1 ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pci-aardvark.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index ec7bafbe813f..65762fddd9fc 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -778,7 +778,7 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u3
 	else
 		str_posted = "Posted";
 
-	dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
+	dev_dbg(dev, "%s PIO Response Status: %s, %#x @ %#x\n",
 		str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS));
 
 	return -EFAULT;

From bea3213f191a36e34e652c0d964fc3977886a408 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:43 +0200
Subject: [PATCH 1620/1750] PCI: aardvark: Fix preserving PCI_EXP_RTCTL_CRSSVE
 flag on emulated bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit d419052bc6c60fa4ab2b5a51d5f1e55a66e2b4ff ]

Commit 43f5c77bcbd2 ("PCI: aardvark: Fix reporting CRS value") started
using CRSSVE flag for handling CRS responses.

PCI_EXP_RTCTL_CRSSVE flag is stored only in emulated config space buffer
and there is handler for PCI_EXP_RTCTL register. So every read operation
from config space automatically clears CRSSVE flag as it is not defined in
PCI_EXP_RTCTL read handler.

Fix this by reading current CRSSVE bit flag from emulated space buffer and
appending it to PCI_EXP_RTCTL read response.

Link: https://lore.kernel.org/r/20211005180952.6812-5-kabel@kernel.org
Fixes: 43f5c77bcbd2 ("PCI: aardvark: Fix reporting CRS value")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/pci-aardvark.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 65762fddd9fc..5b34dea80885 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -885,6 +885,7 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
 	case PCI_EXP_RTCTL: {
 		u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG);
 		*value = (val & PCIE_MSG_PM_PME_MASK) ? 0 : PCI_EXP_RTCTL_PMEIE;
+		*value |= le16_to_cpu(bridge->pcie_conf.rootctl) & PCI_EXP_RTCTL_CRSSVE;
 		*value |= PCI_EXP_RTCAP_CRSVIS << 16;
 		return PCI_BRIDGE_EMUL_HANDLED;
 	}

From 14943891857da24abe5bba4fa132986eb7842713 Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Fri, 8 Oct 2021 15:46:52 +0800
Subject: [PATCH 1621/1750] opp: Fix return in _opp_add_static_v2()

[ Upstream commit 27ff8187f13ecfec8a26fb1928e906f46f326cc5 ]

Fix sparse warning:
drivers/opp/of.c:924 _opp_add_static_v2() warn: passing zero to 'ERR_PTR'

For duplicate OPPs 'ret' be set to zero.

Fixes: deac8703da5f ("PM / OPP: _of_add_opp_table_v2(): increment count only if OPP is added")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/opp/of.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/opp/of.c b/drivers/opp/of.c
index f83f4f6d7034..5de46aa99d24 100644
--- a/drivers/opp/of.c
+++ b/drivers/opp/of.c
@@ -827,7 +827,7 @@ static struct dev_pm_opp *_opp_add_static_v2(struct opp_table *opp_table,
 free_opp:
 	_opp_free(new_opp);
 
-	return ERR_PTR(ret);
+	return ret ? ERR_PTR(ret) : NULL;
 }
 
 /* Initializes OPP tables based on new bindings */

From 3e7b08ebf40fd1283c1d005362fe2a81902e027a Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 4 Oct 2021 15:44:16 -0400
Subject: [PATCH 1622/1750] NFS: Fix deadlocks in nfs_scan_commit_list()

[ Upstream commit 64a93dbf25d3a1368bb58ddf0f61d0a92d7479e3 ]

Partially revert commit 2ce209c42c01 ("NFS: Wait for requests that are
locked on the commit list"), since it can lead to deadlocks between
commit requests and nfs_join_page_group().
For now we should assume that any locked requests on the commit list are
either about to be removed and committed by another task, or the writes
they describe are about to be retransmitted. In either case, we should
not need to worry.

Fixes: 2ce209c42c01 ("NFS: Wait for requests that are locked on the commit list")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/write.c | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)

diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 639c34fec04a..dc7201c83bc2 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1034,25 +1034,11 @@ nfs_scan_commit_list(struct list_head *src, struct list_head *dst,
 	struct nfs_page *req, *tmp;
 	int ret = 0;
 
-restart:
 	list_for_each_entry_safe(req, tmp, src, wb_list) {
 		kref_get(&req->wb_kref);
 		if (!nfs_lock_request(req)) {
-			int status;
-
-			/* Prevent deadlock with nfs_lock_and_join_requests */
-			if (!list_empty(dst)) {
-				nfs_release_request(req);
-				continue;
-			}
-			/* Ensure we make progress to prevent livelock */
-			mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
-			status = nfs_wait_on_request(req);
 			nfs_release_request(req);
-			mutex_lock(&NFS_I(cinfo->inode)->commit_mutex);
-			if (status < 0)
-				break;
-			goto restart;
+			continue;
 		}
 		nfs_request_remove_commit_list(req, cinfo);
 		clear_bit(PG_COMMIT_TO_DS, &req->wb_flags);
@@ -1924,6 +1910,7 @@ static int __nfs_commit_inode(struct inode *inode, int how,
 	int may_wait = how & FLUSH_SYNC;
 	int ret, nscan;
 
+	how &= ~FLUSH_SYNC;
 	nfs_init_cinfo_from_inode(&cinfo, inode);
 	nfs_commit_begin(cinfo.mds);
 	for (;;) {

From c4eb6849909a8b444d79efceb52d4ae454e9cdc5 Mon Sep 17 00:00:00 2001
From: Jia-Ju Bai <baijiaju1990@gmail.com>
Date: Tue, 9 Mar 2021 00:00:20 -0800
Subject: [PATCH 1623/1750] fs: orangefs: fix error return code of
 orangefs_revalidate_lookup()

[ Upstream commit 4c2b46c824a78fc8190d8eafaaea5a9078fe7479 ]

When op_alloc() returns NULL to new_op, no error return code of
orangefs_revalidate_lookup() is assigned.
To fix this bug, ret is assigned with -ENOMEM in this case.

Fixes: 8bb8aefd5afb ("OrangeFS: Change almost all instances of the string PVFS2 to OrangeFS.")
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/orangefs/dcache.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/orangefs/dcache.c b/fs/orangefs/dcache.c
index fe484cf93e5c..8bbe9486e3a6 100644
--- a/fs/orangefs/dcache.c
+++ b/fs/orangefs/dcache.c
@@ -26,8 +26,10 @@ static int orangefs_revalidate_lookup(struct dentry *dentry)
 	gossip_debug(GOSSIP_DCACHE_DEBUG, "%s: attempting lookup.\n", __func__);
 
 	new_op = op_alloc(ORANGEFS_VFS_OP_LOOKUP);
-	if (!new_op)
+	if (!new_op) {
+		ret = -ENOMEM;
 		goto out_put_parent;
+	}
 
 	new_op->upcall.req.lookup.sym_follow = ORANGEFS_LOOKUP_LINK_NO_FOLLOW;
 	new_op->upcall.req.lookup.parent_refn = parent->refn;

From d2ff7a8b079d4b996c28611d48fc4b0746bee77d Mon Sep 17 00:00:00 2001
From: Evgeny Novikov <novikov@ispras.ru>
Date: Fri, 9 Jul 2021 17:45:29 +0300
Subject: [PATCH 1624/1750] mtd: spi-nor: hisi-sfc: Remove excessive
 clk_disable_unprepare()

[ Upstream commit 78e4d342187625585932bb437ec26e1060f7fc6f ]

hisi_spi_nor_probe() invokes clk_disable_unprepare() on all paths after
successful call of clk_prepare_enable(). Besides, the clock is enabled by
hispi_spi_nor_prep() and disabled by hispi_spi_nor_unprep(). So at remove
time it is not possible to have the clock enabled. The patch removes
excessive clk_disable_unprepare() from hisi_spi_nor_remove().

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: e523f11141bd ("mtd: spi-nor: add hisilicon spi-nor flash controller driver")
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Reviewed-by: Pratyush Yadav <p.yadav@ti.com>
Link: https://lore.kernel.org/r/20210709144529.31379-1-novikov@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/spi-nor/controllers/hisi-sfc.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/mtd/spi-nor/controllers/hisi-sfc.c b/drivers/mtd/spi-nor/controllers/hisi-sfc.c
index 440fc5ae7d34..fd2c19a04748 100644
--- a/drivers/mtd/spi-nor/controllers/hisi-sfc.c
+++ b/drivers/mtd/spi-nor/controllers/hisi-sfc.c
@@ -477,7 +477,6 @@ static int hisi_spi_nor_remove(struct platform_device *pdev)
 
 	hisi_spi_nor_unregister_all(host);
 	mutex_destroy(&host->lock);
-	clk_disable_unprepare(host->clk);
 	return 0;
 }
 

From 0b73c025bfcf462b467ec176ddbcbbb47efdef8a Mon Sep 17 00:00:00 2001
From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Date: Sat, 18 Sep 2021 09:22:59 +0900
Subject: [PATCH 1625/1750] PCI: uniphier: Serialize INTx masking/unmasking and
 fix the bit operation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 4caab28a6215da5f3c1b505ff08810bc6acfe365 ]

The condition register PCI_RCV_INTX is used in irq_mask() and irq_unmask()
callbacks. Accesses to register can occur at the same time without a lock.
Add a lock into each callback to prevent the issue.

And INTX mask and unmask fields in PCL_RCV_INTX register should only be
set/reset for each bit. Clearing by PCL_RCV_INTX_ALL_MASK should be
removed.

INTX status fields in PCL_RCV_INTX register only indicates each INTX
interrupt status, so the handler can't clear by writing 1 to the field.
The status is expected to be cleared by the interrupt origin.
The ack function has no meaning, so should remove it.

Suggested-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/1631924579-24567-1-git-send-email-hayashi.kunihiko@socionext.com
Fixes: 7e6d5cd88a6f ("PCI: uniphier: Add UniPhier PCIe host controller support")
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Pali Rohár <pali@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/controller/dwc/pcie-uniphier.c | 26 +++++++++-------------
 1 file changed, 10 insertions(+), 16 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-uniphier.c b/drivers/pci/controller/dwc/pcie-uniphier.c
index 48176265c867..527ec8aeb602 100644
--- a/drivers/pci/controller/dwc/pcie-uniphier.c
+++ b/drivers/pci/controller/dwc/pcie-uniphier.c
@@ -171,30 +171,21 @@ static void uniphier_pcie_irq_enable(struct uniphier_pcie_priv *priv)
 	writel(PCL_RCV_INTX_ALL_ENABLE, priv->base + PCL_RCV_INTX);
 }
 
-static void uniphier_pcie_irq_ack(struct irq_data *d)
-{
-	struct pcie_port *pp = irq_data_get_irq_chip_data(d);
-	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
-	struct uniphier_pcie_priv *priv = to_uniphier_pcie(pci);
-	u32 val;
-
-	val = readl(priv->base + PCL_RCV_INTX);
-	val &= ~PCL_RCV_INTX_ALL_STATUS;
-	val |= BIT(irqd_to_hwirq(d) + PCL_RCV_INTX_STATUS_SHIFT);
-	writel(val, priv->base + PCL_RCV_INTX);
-}
-
 static void uniphier_pcie_irq_mask(struct irq_data *d)
 {
 	struct pcie_port *pp = irq_data_get_irq_chip_data(d);
 	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
 	struct uniphier_pcie_priv *priv = to_uniphier_pcie(pci);
+	unsigned long flags;
 	u32 val;
 
+	raw_spin_lock_irqsave(&pp->lock, flags);
+
 	val = readl(priv->base + PCL_RCV_INTX);
-	val &= ~PCL_RCV_INTX_ALL_MASK;
 	val |= BIT(irqd_to_hwirq(d) + PCL_RCV_INTX_MASK_SHIFT);
 	writel(val, priv->base + PCL_RCV_INTX);
+
+	raw_spin_unlock_irqrestore(&pp->lock, flags);
 }
 
 static void uniphier_pcie_irq_unmask(struct irq_data *d)
@@ -202,17 +193,20 @@ static void uniphier_pcie_irq_unmask(struct irq_data *d)
 	struct pcie_port *pp = irq_data_get_irq_chip_data(d);
 	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
 	struct uniphier_pcie_priv *priv = to_uniphier_pcie(pci);
+	unsigned long flags;
 	u32 val;
 
+	raw_spin_lock_irqsave(&pp->lock, flags);
+
 	val = readl(priv->base + PCL_RCV_INTX);
-	val &= ~PCL_RCV_INTX_ALL_MASK;
 	val &= ~BIT(irqd_to_hwirq(d) + PCL_RCV_INTX_MASK_SHIFT);
 	writel(val, priv->base + PCL_RCV_INTX);
+
+	raw_spin_unlock_irqrestore(&pp->lock, flags);
 }
 
 static struct irq_chip uniphier_pcie_irq_chip = {
 	.name = "PCI",
-	.irq_ack = uniphier_pcie_irq_ack,
 	.irq_mask = uniphier_pcie_irq_mask,
 	.irq_unmask = uniphier_pcie_irq_unmask,
 };

From 36104e1f71ddb0fb39c49a7bbc375894085acb26 Mon Sep 17 00:00:00 2001
From: Zev Weiss <zev@bewilderbeest.net>
Date: Thu, 14 Oct 2021 13:39:52 -0700
Subject: [PATCH 1626/1750] mtd: core: don't remove debugfs directory if device
 is in use

[ Upstream commit c13de2386c78e890d4ae6f01a85eefd0b293fb08 ]

Previously, if del_mtd_device() failed with -EBUSY due to a non-zero
usecount, a subsequent call to attempt the deletion again would try to
remove a debugfs directory that had already been removed and panic.
With this change the second call can instead proceed safely.

Fixes: e8e3edb95ce6 ("mtd: create per-device and module-scope debugfs entries")
Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20211014203953.5424-1-zev@bewilderbeest.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mtd/mtdcore.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 1c8c40728678..a5197a481902 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -721,8 +721,6 @@ int del_mtd_device(struct mtd_info *mtd)
 
 	mutex_lock(&mtd_table_mutex);
 
-	debugfs_remove_recursive(mtd->dbg.dfs_dir);
-
 	if (idr_find(&mtd_idr, mtd->index) != mtd) {
 		ret = -ENODEV;
 		goto out_error;
@@ -738,6 +736,8 @@ int del_mtd_device(struct mtd_info *mtd)
 		       mtd->index, mtd->name, mtd->usecount);
 		ret = -EBUSY;
 	} else {
+		debugfs_remove_recursive(mtd->dbg.dfs_dir);
+
 		/* Try to remove the NVMEM provider */
 		if (mtd->nvmem)
 			nvmem_unregister(mtd->nvmem);

From 5061e102346e30bb71342c0549042a891eefef17 Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Sat, 4 Sep 2021 13:37:32 +0200
Subject: [PATCH 1627/1750] remoteproc: Fix a memory leak in an error handling
 path in 'rproc_handle_vdev()'

[ Upstream commit 0374a4ea7269645c46c3eb288526ea072fa19e79 ]

If 'copy_dma_range_map() fails, the memory allocated for 'rvdev' will leak.
Move the 'copy_dma_range_map()' call after the device registration so
that 'rproc_rvdev_release()' can be called to free some resources.

Also, branch to the error handling path if 'copy_dma_range_map()' instead
of a direct return to avoid some other leaks.

Fixes: e0d072782c73 ("dma-mapping: introduce DMA range map, supplanting dma_pfn_offset")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jim Quinlan <james.quinlan@broadcom.com>
Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://lore.kernel.org/r/e6d0dad6620da4fdf847faa903f79b735d35f262.1630755377.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/remoteproc/remoteproc_core.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 47924d5ed4f5..369a97f3eca9 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -550,9 +550,6 @@ static int rproc_handle_vdev(struct rproc *rproc, struct fw_rsc_vdev *rsc,
 	/* Initialise vdev subdevice */
 	snprintf(name, sizeof(name), "vdev%dbuffer", rvdev->index);
 	rvdev->dev.parent = &rproc->dev;
-	ret = copy_dma_range_map(&rvdev->dev, rproc->dev.parent);
-	if (ret)
-		return ret;
 	rvdev->dev.release = rproc_rvdev_release;
 	dev_set_name(&rvdev->dev, "%s#%s", dev_name(rvdev->dev.parent), name);
 	dev_set_drvdata(&rvdev->dev, rvdev);
@@ -562,6 +559,11 @@ static int rproc_handle_vdev(struct rproc *rproc, struct fw_rsc_vdev *rsc,
 		put_device(&rvdev->dev);
 		return ret;
 	}
+
+	ret = copy_dma_range_map(&rvdev->dev, rproc->dev.parent);
+	if (ret)
+		goto free_rvdev;
+
 	/* Make device dma capable by inheriting from parent's capabilities */
 	set_dma_ops(&rvdev->dev, get_dma_ops(rproc->dev.parent));
 

From 038dfd67d375b10c9dc6d67dd4db3f1e1e45ce5c Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 12 Oct 2021 13:10:28 +0300
Subject: [PATCH 1628/1750] rtc: rv3032: fix error handling in
 rv3032_clkout_set_rate()

[ Upstream commit c3336b8ac6091df60a5c1049a8c685d0b947cc61 ]

Do not call rv3032_exit_eerd() if the enter function fails but don't
forget to call the exit when the enter succeeds.

Fixes: 2eeaa532acca ("rtc: rv3032: Add a driver for Microcrystal RV-3032")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20211012101028.GT2083@kadam
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/rtc/rtc-rv3032.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/rtc/rtc-rv3032.c b/drivers/rtc/rtc-rv3032.c
index 3e67f71f4261..9e6166864bd7 100644
--- a/drivers/rtc/rtc-rv3032.c
+++ b/drivers/rtc/rtc-rv3032.c
@@ -617,11 +617,11 @@ static int rv3032_clkout_set_rate(struct clk_hw *hw, unsigned long rate,
 
 	ret = rv3032_enter_eerd(rv3032, &eerd);
 	if (ret)
-		goto exit_eerd;
+		return ret;
 
 	ret = regmap_write(rv3032->regmap, RV3032_CLKOUT1, hfd & 0xff);
 	if (ret)
-		return ret;
+		goto exit_eerd;
 
 	ret = regmap_write(rv3032->regmap, RV3032_CLKOUT2, RV3032_CLKOUT2_OS |
 			    FIELD_PREP(RV3032_CLKOUT2_HFD_MSK, hfd >> 8));

From 91e43a8500f40108c82e9c82d84571b638529f15 Mon Sep 17 00:00:00 2001
From: Claudiu Beznea <claudiu.beznea@microchip.com>
Date: Thu, 7 Oct 2021 14:12:28 +0300
Subject: [PATCH 1629/1750] dmaengine: at_xdmac: fix AT_XDMAC_CC_PERID() macro

[ Upstream commit 320c88a3104dc955f928a1eecebd551ff89530c0 ]

AT_XDMAC_CC_PERID() should be used to setup bits 24..30 of XDMAC_CC
register. Using it without parenthesis around 0x7f & (i) will lead to
setting all the time zero for bits 24..30 of XDMAC_CC as the << operator
has higher precedence over bitwise &. Thus, add paranthesis around
0x7f & (i).

Fixes: 15a03850ab8f ("dmaengine: at_xdmac: fix macro typo")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
Link: https://lore.kernel.org/r/20211007111230.2331837-3-claudiu.beznea@microchip.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/at_xdmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 3b53115db268..627ad74c879f 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -145,7 +145,7 @@
 #define		AT_XDMAC_CC_WRIP	(0x1 << 23)	/* Write in Progress (read only) */
 #define			AT_XDMAC_CC_WRIP_DONE		(0x0 << 23)
 #define			AT_XDMAC_CC_WRIP_IN_PROGRESS	(0x1 << 23)
-#define		AT_XDMAC_CC_PERID(i)	(0x7f & (i) << 24)	/* Channel Peripheral Identifier */
+#define		AT_XDMAC_CC_PERID(i)	((0x7f & (i)) << 24)	/* Channel Peripheral Identifier */
 #define AT_XDMAC_CDS_MSP	0x2C	/* Channel Data Stride Memory Set Pattern */
 #define AT_XDMAC_CSUS		0x30	/* Channel Source Microblock Stride */
 #define AT_XDMAC_CDUS		0x34	/* Channel Destination Microblock Stride */

From 10f21087173651d41ea308b4a0c3a13188418aaa Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 4 Oct 2021 15:37:42 -0400
Subject: [PATCH 1630/1750] NFS: Fix up commit deadlocks

[ Upstream commit 133a48abf6ecc535d7eddc6da1c3e4c972445882 ]

If O_DIRECT bumps the commit_info rpcs_out field, then that could lead
to fsync() hangs. The fix is to ensure that O_DIRECT calls
nfs_commit_end().

Fixes: 723c921e7dfc ("sched/wait, fs/nfs: Convert wait_on_atomic_t() usage to the new wait_var_event() API")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/direct.c        | 2 +-
 fs/nfs/pnfs_nfs.c      | 2 --
 fs/nfs/write.c         | 9 ++++++---
 include/linux/nfs_fs.h | 1 +
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 2e894fec036b..3c0335c15a73 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -620,7 +620,7 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)
 		nfs_unlock_and_release_request(req);
 	}
 
-	if (atomic_dec_and_test(&cinfo.mds->rpcs_out))
+	if (nfs_commit_end(cinfo.mds))
 		nfs_direct_write_complete(dreq);
 }
 
diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
index 37b52b53a7e5..7b9d701bef01 100644
--- a/fs/nfs/pnfs_nfs.c
+++ b/fs/nfs/pnfs_nfs.c
@@ -468,7 +468,6 @@ pnfs_bucket_alloc_ds_commits(struct list_head *list,
 				goto out_error;
 			data->ds_commit_index = i;
 			list_add_tail(&data->list, list);
-			atomic_inc(&cinfo->mds->rpcs_out);
 			nreq++;
 		}
 		mutex_unlock(&NFS_I(cinfo->inode)->commit_mutex);
@@ -520,7 +519,6 @@ pnfs_generic_commit_pagelist(struct inode *inode, struct list_head *mds_pages,
 		data->ds_commit_index = -1;
 		list_splice_init(mds_pages, &data->pages);
 		list_add_tail(&data->list, &list);
-		atomic_inc(&cinfo->mds->rpcs_out);
 		nreq++;
 	}
 
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index dc7201c83bc2..bde4c362841f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1649,10 +1649,13 @@ static void nfs_commit_begin(struct nfs_mds_commit_info *cinfo)
 	atomic_inc(&cinfo->rpcs_out);
 }
 
-static void nfs_commit_end(struct nfs_mds_commit_info *cinfo)
+bool nfs_commit_end(struct nfs_mds_commit_info *cinfo)
 {
-	if (atomic_dec_and_test(&cinfo->rpcs_out))
+	if (atomic_dec_and_test(&cinfo->rpcs_out)) {
 		wake_up_var(&cinfo->rpcs_out);
+		return true;
+	}
+	return false;
 }
 
 void nfs_commitdata_release(struct nfs_commit_data *data)
@@ -1752,6 +1755,7 @@ void nfs_init_commit(struct nfs_commit_data *data,
 	data->res.fattr   = &data->fattr;
 	data->res.verf    = &data->verf;
 	nfs_fattr_init(&data->fattr);
+	nfs_commit_begin(cinfo->mds);
 }
 EXPORT_SYMBOL_GPL(nfs_init_commit);
 
@@ -1797,7 +1801,6 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how,
 
 	/* Set up the argument struct */
 	nfs_init_commit(data, head, NULL, cinfo);
-	atomic_inc(&cinfo->mds->rpcs_out);
 	return nfs_initiate_commit(NFS_CLIENT(inode), data, NFS_PROTO(inode),
 				   data->mds_ops, how, RPC_TASK_CRED_NOREF);
 }
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 91a6525a98cb..aff5cd382fef 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -553,6 +553,7 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);
 extern int  nfs_commit_inode(struct inode *, int);
 extern struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail);
 extern void nfs_commit_free(struct nfs_commit_data *data);
+bool nfs_commit_end(struct nfs_mds_commit_info *cinfo);
 
 static inline int
 nfs_have_writebacks(struct inode *inode)

From 90e7415221e1aa91e0ed676879e3f31125058d11 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Tue, 5 Oct 2021 14:05:02 -0400
Subject: [PATCH 1631/1750] NFS: Fix an Oops in pnfs_mark_request_commit()

[ Upstream commit f0caea8882a7412a2ad4d8274f0280cdf849c9e2 ]

Olga reports seeing the following Oops when doing O_DIRECT writes to a
pNFS flexfiles server:

Oops: 0000 [#1] SMP PTI
CPU: 1 PID: 234186 Comm: kworker/u8:1 Not tainted 5.15.0-rc4+ #4
Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.13.0-2.module+el8.3.0+7353+9de0a3cc 04/01/2014
Workqueue: nfsiod rpc_async_release [sunrpc]
RIP: 0010:nfs_mark_request_commit+0x12/0x30 [nfs]
Code: ff ff be 03 00 00 00 e8 ac 34 83 eb e9 29 ff ff
ff e8 22 bc d7 eb 66 90 0f 1f 44 00 00 48 85 f6 74 16 48 8b 42 10 48
8b 40 18 <48> 8b 40 18 48 85 c0 74 05 e9 70 fc 15 ec 48 89 d6 e9 68 ed
ff ff
RSP: 0018:ffffa82f0159fe00 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff8f3393141880 RCX: 0000000000000000
RDX: ffffa82f0159fe08 RSI: ffff8f3381252500 RDI: ffff8f3393141880
RBP: ffff8f33ac317c00 R08: 0000000000000000 R09: ffff8f3487724cb0
R10: 0000000000000008 R11: 0000000000000001 R12: 0000000000000001
R13: ffff8f3485bccee0 R14: ffff8f33ac317c10 R15: ffff8f33ac317cd8
FS:  0000000000000000(0000) GS:ffff8f34fbc80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 0000000122120006 CR4: 0000000000770ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 nfs_direct_write_completion+0x13b/0x250 [nfs]
 rpc_free_task+0x39/0x60 [sunrpc]
 rpc_async_release+0x29/0x40 [sunrpc]
 process_one_work+0x1ce/0x370
 worker_thread+0x30/0x380
 ? process_one_work+0x370/0x370
 kthread+0x11a/0x140
 ? set_kthread_struct+0x40/0x40
 ret_from_fork+0x22/0x30

Reported-by: Olga Kornievskaia <aglo@umich.edu>
Fixes: 9c455a8c1e14 ("NFS/pNFS: Clean up pNFS commit operations")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/pnfs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 132a345e9373..0212fe32e63a 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -515,7 +515,7 @@ pnfs_mark_request_commit(struct nfs_page *req, struct pnfs_layout_segment *lseg,
 {
 	struct pnfs_ds_commit_info *fl_cinfo = cinfo->ds;
 
-	if (!lseg || !fl_cinfo->ops->mark_request_commit)
+	if (!lseg || !fl_cinfo->ops || !fl_cinfo->ops->mark_request_commit)
 		return false;
 	fl_cinfo->ops->mark_request_commit(req, lseg, cinfo, ds_commit_idx);
 	return true;

From 0e1709b2a07ad18742808a7088468b0b3477aa96 Mon Sep 17 00:00:00 2001
From: Alexey Gladkov <legion@kernel.org>
Date: Thu, 14 Oct 2021 18:02:30 +0200
Subject: [PATCH 1632/1750] Fix user namespace leak

[ Upstream commit d5f458a979650e5ed37212f6134e4ee2b28cb6ed ]

Fixes: 61ca2c4afd9d ("NFS: Only reference user namespace from nfs4idmap struct instead of cred")
Signed-off-by: Alexey Gladkov <legion@kernel.org>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4idmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index 8d8aba305ecc..f331866dd418 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -487,7 +487,7 @@ nfs_idmap_new(struct nfs_client *clp)
 err_destroy_pipe:
 	rpc_destroy_pipe_data(idmap->idmap_pipe);
 err:
-	get_user_ns(idmap->user_ns);
+	put_user_ns(idmap->user_ns);
 	kfree(idmap);
 	return error;
 }

From a1d6a60ee00ceed18001fec3e6cbb9bc62b8b98d Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Tue, 19 Oct 2021 16:45:02 +0200
Subject: [PATCH 1633/1750] auxdisplay: img-ascii-lcd: Fix lock-up when
 displaying empty string

[ Upstream commit afcb5a811ff3ab3969f09666535eb6018a160358 ]

While writing an empty string to a device attribute is a no-op, and thus
does not need explicit safeguards, the user can still write a single
newline to an attribute file:

    echo > .../message

If that happens, img_ascii_lcd_display() trims the newline, yielding an
empty string, and causing an infinite loop in img_ascii_lcd_scroll().

Fix this by adding a check for empty strings.  Clear the display in case
one is encountered.

Fixes: 0cad855fbd083ee5 ("auxdisplay: img-ascii-lcd: driver for simple ASCII LCD displays")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/auxdisplay/img-ascii-lcd.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 1cce409ce5ca..e33ce0151cdf 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -280,6 +280,16 @@ static int img_ascii_lcd_display(struct img_ascii_lcd_ctx *ctx,
 	if (msg[count - 1] == '\n')
 		count--;
 
+	if (!count) {
+		/* clear the LCD */
+		devm_kfree(&ctx->pdev->dev, ctx->message);
+		ctx->message = NULL;
+		ctx->message_len = 0;
+		memset(ctx->curr, ' ', ctx->cfg->num_chars);
+		ctx->cfg->update(ctx);
+		return 0;
+	}
+
 	new_msg = devm_kmalloc(&ctx->pdev->dev, count + 1, GFP_KERNEL);
 	if (!new_msg)
 		return -ENOMEM;

From 178522aa755f009e050b002c6ee699c3c5bf4d0c Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Tue, 19 Oct 2021 16:45:08 +0200
Subject: [PATCH 1634/1750] auxdisplay: ht16k33: Connect backlight to fbdev

[ Upstream commit 80f9eb70fd9276938f0a131f76d438021bfd8b34 ]

Currently /sys/class/graphics/fb0/bl_curve is not accessible (-ENODEV),
as the driver does not connect the backlight to the frame buffer device.
Fix this moving backlight initialization up, and filling in
fb_info.bl_dev.

Fixes: 8992da44c6805d53 ("auxdisplay: ht16k33: Driver for LED controller")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Reviewed-by: Robin van der Gracht <robin@protonic.nl>
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/auxdisplay/ht16k33.c | 56 ++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index d8602843e8a5..b8c25a17186b 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -418,6 +418,33 @@ static int ht16k33_probe(struct i2c_client *client,
 	if (err)
 		return err;
 
+	/* Backlight */
+	memset(&bl_props, 0, sizeof(struct backlight_properties));
+	bl_props.type = BACKLIGHT_RAW;
+	bl_props.max_brightness = MAX_BRIGHTNESS;
+
+	bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl",
+					    &client->dev, priv,
+					    &ht16k33_bl_ops, &bl_props);
+	if (IS_ERR(bl)) {
+		dev_err(&client->dev, "failed to register backlight\n");
+		return PTR_ERR(bl);
+	}
+
+	err = of_property_read_u32(node, "default-brightness-level",
+				   &dft_brightness);
+	if (err) {
+		dft_brightness = MAX_BRIGHTNESS;
+	} else if (dft_brightness > MAX_BRIGHTNESS) {
+		dev_warn(&client->dev,
+			 "invalid default brightness level: %u, using %u\n",
+			 dft_brightness, MAX_BRIGHTNESS);
+		dft_brightness = MAX_BRIGHTNESS;
+	}
+
+	bl->props.brightness = dft_brightness;
+	ht16k33_bl_update_status(bl);
+
 	/* Framebuffer (2 bytes per column) */
 	BUILD_BUG_ON(PAGE_SIZE < HT16K33_FB_SIZE);
 	fbdev->buffer = (unsigned char *) get_zeroed_page(GFP_KERNEL);
@@ -450,6 +477,7 @@ static int ht16k33_probe(struct i2c_client *client,
 	fbdev->info->screen_size = HT16K33_FB_SIZE;
 	fbdev->info->fix = ht16k33_fb_fix;
 	fbdev->info->var = ht16k33_fb_var;
+	fbdev->info->bl_dev = bl;
 	fbdev->info->pseudo_palette = NULL;
 	fbdev->info->flags = FBINFO_FLAG_DEFAULT;
 	fbdev->info->par = priv;
@@ -462,34 +490,6 @@ static int ht16k33_probe(struct i2c_client *client,
 	if (err)
 		goto err_fbdev_unregister;
 
-	/* Backlight */
-	memset(&bl_props, 0, sizeof(struct backlight_properties));
-	bl_props.type = BACKLIGHT_RAW;
-	bl_props.max_brightness = MAX_BRIGHTNESS;
-
-	bl = devm_backlight_device_register(&client->dev, DRIVER_NAME"-bl",
-					    &client->dev, priv,
-					    &ht16k33_bl_ops, &bl_props);
-	if (IS_ERR(bl)) {
-		dev_err(&client->dev, "failed to register backlight\n");
-		err = PTR_ERR(bl);
-		goto err_fbdev_unregister;
-	}
-
-	err = of_property_read_u32(node, "default-brightness-level",
-				   &dft_brightness);
-	if (err) {
-		dft_brightness = MAX_BRIGHTNESS;
-	} else if (dft_brightness > MAX_BRIGHTNESS) {
-		dev_warn(&client->dev,
-			 "invalid default brightness level: %u, using %u\n",
-			 dft_brightness, MAX_BRIGHTNESS);
-		dft_brightness = MAX_BRIGHTNESS;
-	}
-
-	bl->props.brightness = dft_brightness;
-	ht16k33_bl_update_status(bl);
-
 	ht16k33_fb_queue(priv);
 	return 0;
 

From 6caab6c96b67b0751b3ad7f4d14d6e298a3b3790 Mon Sep 17 00:00:00 2001
From: Geert Uytterhoeven <geert@linux-m68k.org>
Date: Tue, 19 Oct 2021 16:45:09 +0200
Subject: [PATCH 1635/1750] auxdisplay: ht16k33: Fix frame buffer device
 blanking

[ Upstream commit 840fe258332544aa7321921e1723d37b772af7a9 ]

As the ht16k33 frame buffer sub-driver does not register an
fb_ops.fb_blank() handler, blanking does not work:

    $ echo 1 > /sys/class/graphics/fb0/blank
    sh: write error: Invalid argument

Fix this by providing a handler that always returns zero, to make sure
blank events will be sent to the actual device handling the backlight.

Reported-by: Robin van der Gracht <robin@protonic.nl>
Suggested-by: Robin van der Gracht <robin@protonic.nl>
Fixes: 8992da44c6805d53 ("auxdisplay: ht16k33: Driver for LED controller")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/auxdisplay/ht16k33.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/auxdisplay/ht16k33.c b/drivers/auxdisplay/ht16k33.c
index b8c25a17186b..7e3858c4e030 100644
--- a/drivers/auxdisplay/ht16k33.c
+++ b/drivers/auxdisplay/ht16k33.c
@@ -219,6 +219,15 @@ static const struct backlight_ops ht16k33_bl_ops = {
 	.check_fb	= ht16k33_bl_check_fb,
 };
 
+/*
+ * Blank events will be passed to the actual device handling the backlight when
+ * we return zero here.
+ */
+static int ht16k33_blank(int blank, struct fb_info *info)
+{
+	return 0;
+}
+
 static int ht16k33_mmap(struct fb_info *info, struct vm_area_struct *vma)
 {
 	struct ht16k33_priv *priv = info->par;
@@ -231,6 +240,7 @@ static const struct fb_ops ht16k33_fb_ops = {
 	.owner = THIS_MODULE,
 	.fb_read = fb_sys_read,
 	.fb_write = fb_sys_write,
+	.fb_blank = ht16k33_blank,
 	.fb_fillrect = sys_fillrect,
 	.fb_copyarea = sys_copyarea,
 	.fb_imageblit = sys_imageblit,

From 41968262bb24772280a0b6fbc808cf740ae961d4 Mon Sep 17 00:00:00 2001
From: Robert-Ionut Alexa <robert-ionut.alexa@nxp.com>
Date: Fri, 23 Apr 2021 12:01:51 +0300
Subject: [PATCH 1636/1750] soc: fsl: dpaa2-console: free buffer before
 returning from dpaa2_console_read

[ Upstream commit 8120bd469f5525da229953c1197f2b826c0109f4 ]

Free the kbuf buffer before returning from the dpaa2_console_read()
function. The variable no longer goes out of scope, leaking the storage
it points to.

Fixes: c93349d8c170 ("soc: fsl: add DPAA2 console support")
Signed-off-by: Robert-Ionut Alexa <robert-ionut.alexa@nxp.com>
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Signed-off-by: Li Yang <leoyang.li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/fsl/dpaa2-console.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/soc/fsl/dpaa2-console.c b/drivers/soc/fsl/dpaa2-console.c
index 27243f706f37..53917410f2bd 100644
--- a/drivers/soc/fsl/dpaa2-console.c
+++ b/drivers/soc/fsl/dpaa2-console.c
@@ -231,6 +231,7 @@ static ssize_t dpaa2_console_read(struct file *fp, char __user *buf,
 	cd->cur_ptr += bytes;
 	written += bytes;
 
+	kfree(kbuf);
 	return written;
 
 err_free_buf:

From bba31f3b1f43625496b42eb7bae534262ba3391e Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@strlen.de>
Date: Wed, 20 Oct 2021 18:08:10 +0200
Subject: [PATCH 1637/1750] netfilter: nfnetlink_queue: fix OOB when mac header
 was cleared

[ Upstream commit 5648b5e1169ff1d6d6a46c35c0b5fbebd2a5cbb2 ]

On 64bit platforms the MAC header is set to 0xffff on allocation and
also when a helper like skb_unset_mac_header() is called.

dev_parse_header may call skb_mac_header() which assumes valid mac offset:

 BUG: KASAN: use-after-free in eth_header_parse+0x75/0x90
 Read of size 6 at addr ffff8881075a5c05 by task nf-queue/1364
 Call Trace:
  memcpy+0x20/0x60
  eth_header_parse+0x75/0x90
  __nfqnl_enqueue_packet+0x1a61/0x3380
  __nf_queue+0x597/0x1300
  nf_queue+0xf/0x40
  nf_hook_slow+0xed/0x190
  nf_hook+0x184/0x440
  ip_output+0x1c0/0x2a0
  nf_reinject+0x26f/0x700
  nfqnl_recv_verdict+0xa16/0x18b0
  nfnetlink_rcv_msg+0x506/0xe70

The existing code only works if the skb has a mac header.

Fixes: 2c38de4c1f8da7 ("netfilter: fix looped (broad|multi)cast's MAC handling")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netfilter/nfnetlink_queue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index d1d8bca03b4f..98994fe677fe 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -562,7 +562,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
 		goto nla_put_failure;
 
 	if (indev && entskb->dev &&
-	    entskb->mac_header != entskb->network_header) {
+	    skb_mac_header_was_set(entskb)) {
 		struct nfqnl_msg_packet_hw phw;
 		int len;
 

From b04c17acf42ad96ade2c34d7892a6b0bd034b37f Mon Sep 17 00:00:00 2001
From: Lars-Peter Clausen <lars@metafoo.de>
Date: Sat, 23 Oct 2021 15:41:01 +0200
Subject: [PATCH 1638/1750] dmaengine: dmaengine_desc_callback_valid(): Check
 for `callback_result`

[ Upstream commit e7e1e880b114ca640a2f280b0d5d38aed98f98c6 ]

Before the `callback_result` callback was introduced drivers coded their
invocation to the callback in a similar way to:

	if (cb->callback) {
		spin_unlock(&dma->lock);
		cb->callback(cb->callback_param);
		spin_lock(&dma->lock);
	}

With the introduction of `callback_result` two helpers where introduced to
transparently handle both types of callbacks. And drivers where updated to
look like this:

	if (dmaengine_desc_callback_valid(cb)) {
		spin_unlock(&dma->lock);
		dmaengine_desc_callback_invoke(cb, ...);
		spin_lock(&dma->lock);
	}

dmaengine_desc_callback_invoke() correctly handles both `callback_result`
and `callback`. But we forgot to update the dmaengine_desc_callback_valid()
function to check for `callback_result`. As a result DMA descriptors that
use the `callback_result` rather than `callback` don't have their callback
invoked by drivers that follow the pattern above.

Fix this by checking for both `callback` and `callback_result` in
dmaengine_desc_callback_valid().

Fixes: f067025bc676 ("dmaengine: add support to provide error result from a DMA transation")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Dave Jiang <dave.jiang@intel.com>
Link: https://lore.kernel.org/r/20211023134101.28042-1-lars@metafoo.de
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/dma/dmaengine.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/dmaengine.h b/drivers/dma/dmaengine.h
index 1bfbd64b1371..53f16d3f0029 100644
--- a/drivers/dma/dmaengine.h
+++ b/drivers/dma/dmaengine.h
@@ -176,7 +176,7 @@ dmaengine_desc_get_callback_invoke(struct dma_async_tx_descriptor *tx,
 static inline bool
 dmaengine_desc_callback_valid(struct dmaengine_desc_callback *cb)
 {
-	return (cb->callback) ? true : false;
+	return cb->callback || cb->callback_result;
 }
 
 struct dma_chan *dma_get_slave_channel(struct dma_chan *chan);

From a4cbf00e5ab8022f45ffc93c10feced1b2334892 Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xmission.com>
Date: Wed, 20 Oct 2021 12:43:52 -0500
Subject: [PATCH 1639/1750] signal/sh: Use force_sig(SIGKILL) instead of
 do_group_exit(SIGKILL)

[ Upstream commit ce0ee4e6ac99606f3945f4d47775544edc3f7985 ]

Today the sh code allocates memory the first time a process uses
the fpu.  If that memory allocation fails, kill the affected task
with force_sig(SIGKILL) rather than do_group_exit(SIGKILL).

Calling do_group_exit from an exception handler can potentially lead
to dead locks as do_group_exit is not designed to be called from
interrupt context.  Instead use force_sig(SIGKILL) to kill the
userspace process.  Sending signals in general and force_sig in
particular has been tested from interrupt context so there should be
no problems.

Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Rich Felker <dalias@libc.org>
Cc: linux-sh@vger.kernel.org
Fixes: 0ea820cf9bf5 ("sh: Move over to dynamically allocated FPU context.")
Link: https://lkml.kernel.org/r/20211020174406.17889-6-ebiederm@xmission.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sh/kernel/cpu/fpu.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/sh/kernel/cpu/fpu.c b/arch/sh/kernel/cpu/fpu.c
index ae354a2931e7..fd6db0ab1928 100644
--- a/arch/sh/kernel/cpu/fpu.c
+++ b/arch/sh/kernel/cpu/fpu.c
@@ -62,18 +62,20 @@ void fpu_state_restore(struct pt_regs *regs)
 	}
 
 	if (!tsk_used_math(tsk)) {
-		local_irq_enable();
+		int ret;
 		/*
 		 * does a slab alloc which can sleep
 		 */
-		if (init_fpu(tsk)) {
+		local_irq_enable();
+		ret = init_fpu(tsk);
+		local_irq_disable();
+		if (ret) {
 			/*
 			 * ran out of memory!
 			 */
-			do_group_exit(SIGKILL);
+			force_sig(SIGKILL);
 			return;
 		}
-		local_irq_disable();
 	}
 
 	grab_fpu(regs);

From aaa64ee14ac97df8d35aa901c258937973c126ff Mon Sep 17 00:00:00 2001
From: Randy Dunlap <rdunlap@infradead.org>
Date: Sat, 2 Oct 2021 17:02:23 -0700
Subject: [PATCH 1640/1750] m68k: set a default value for MEMORY_RESERVE

[ Upstream commit 1aaa557b2db95c9506ed0981bc34505c32d6b62b ]

'make randconfig' can produce a .config file with
"CONFIG_MEMORY_RESERVE=" (no value) since it has no default.
When a subsequent 'make all' is done, kconfig restarts the config
and prompts for a value for MEMORY_RESERVE. This breaks
scripting/automation where there is no interactive user input.

Add a default value for MEMORY_RESERVE. (Any integer value will
work here for kconfig.)

Fixes a kconfig warning:

.config:214:warning: symbol value '' invalid for MEMORY_RESERVE
* Restart config...
Memory reservation (MiB) (MEMORY_RESERVE) [] (NEW)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") # from beginning of git history
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Greg Ungerer <gerg@linux-m68k.org>
Cc: linux-m68k@lists.linux-m68k.org
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/Kconfig.machine | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine
index e161a4e1493b..51a878803fb6 100644
--- a/arch/m68k/Kconfig.machine
+++ b/arch/m68k/Kconfig.machine
@@ -191,6 +191,7 @@ config INIT_LCD
 config MEMORY_RESERVE
 	int "Memory reservation (MiB)"
 	depends on (UCSIMM || UCDIMM)
+	default 0
 	help
 	  Reserve certain memory regions on 68x328 based boards.
 

From ef9f7ab9ba207b909bffdeda6643cd6c14e8775b Mon Sep 17 00:00:00 2001
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
Date: Mon, 9 Aug 2021 18:20:31 +0200
Subject: [PATCH 1641/1750] watchdog: f71808e_wdt: fix inaccurate report in
 WDIOC_GETTIMEOUT

[ Upstream commit 164483c735190775f29d0dcbac0363adc51a068d ]

The fintek watchdog timer can configure timeouts of second granularity
only up to 255 seconds. Beyond that, the timeout needs to be configured
with minute granularity. WDIOC_GETTIMEOUT should report the actual
timeout configured, not just echo back the timeout configured by the
user. Do so.

Fixes: 96cb4eb019ce ("watchdog: f71808e_wdt: new watchdog driver for Fintek F71808E and F71882FG")
Suggested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.kernel.org/r/5e17960fe8cc0e3cb2ba53de4730b75d9a0f33d5.1628525954.git-series.a.fatoum@pengutronix.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/f71808e_wdt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
index f60beec1bbae..f7d82d261913 100644
--- a/drivers/watchdog/f71808e_wdt.c
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -228,15 +228,17 @@ static int watchdog_set_timeout(int timeout)
 
 	mutex_lock(&watchdog.lock);
 
-	watchdog.timeout = timeout;
 	if (timeout > 0xff) {
 		watchdog.timer_val = DIV_ROUND_UP(timeout, 60);
 		watchdog.minutes_mode = true;
+		timeout = watchdog.timer_val * 60;
 	} else {
 		watchdog.timer_val = timeout;
 		watchdog.minutes_mode = false;
 	}
 
+	watchdog.timeout = timeout;
+
 	mutex_unlock(&watchdog.lock);
 
 	return 0;

From ba5eb0e44346fa672a34e661e6678d2d244383ec Mon Sep 17 00:00:00 2001
From: Jackie Liu <liuyun01@kylinos.cn>
Date: Tue, 7 Sep 2021 10:49:04 +0800
Subject: [PATCH 1642/1750] ar7: fix kernel builds for compiler test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ Upstream commit 28b7ee33a2122569ac065cad578bf23f50cc65c3 ]

TI AR7 Watchdog Timer is only build for 32bit.

Avoid error like:
In file included from drivers/watchdog/ar7_wdt.c:29:
./arch/mips/include/asm/mach-ar7/ar7.h: In function ‘ar7_is_titan’:
./arch/mips/include/asm/mach-ar7/ar7.h:111:24: error: implicit declaration of function ‘KSEG1ADDR’; did you mean ‘CKSEG1ADDR’? [-Werror=implicit-function-declaration]
  111 |  return (readl((void *)KSEG1ADDR(AR7_REGS_GPIO + 0x24)) & 0xffff) ==
      |                        ^~~~~~~~~
      |                        CKSEG1ADDR

Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20210907024904.4127611-1-liu.yun@linux.dev
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/watchdog/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index db935d6b10c2..01ce3f41cc21 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1723,7 +1723,7 @@ config SIBYTE_WDOG
 
 config AR7_WDT
 	tristate "TI AR7 Watchdog Timer"
-	depends on AR7 || (MIPS && COMPILE_TEST)
+	depends on AR7 || (MIPS && 32BIT && COMPILE_TEST)
 	help
 	  Hardware driver for the TI AR7 Watchdog Timer.
 

From bc3f207ed99ab47c9370301a4be69a75a188929e Mon Sep 17 00:00:00 2001
From: Saurav Kashyap <skashyap@marvell.com>
Date: Mon, 9 Aug 2021 21:37:10 -0700
Subject: [PATCH 1643/1750] scsi: qla2xxx: Changes to support FCP2 Target

[ Upstream commit 44c57f205876518b14ab2b4b5d88a181f41260bb ]

Add changes to support FCP2 Target.

Link: https://lore.kernel.org/r/20210810043720.1137-5-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_dbg.c  |  3 +--
 drivers/scsi/qla2xxx/qla_init.c |  6 ++++++
 drivers/scsi/qla2xxx/qla_os.c   | 10 ++++++++++
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 144a893e7335..3a20bf8ce5ab 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -12,8 +12,7 @@
  * ----------------------------------------------------------------------
  * | Module Init and Probe        |       0x0199       |                |
  * | Mailbox commands             |       0x1206       | 0x11a5-0x11ff	|
- * | Device Discovery             |       0x2134       | 0x210e-0x2116  |
- * |				  | 		       | 0x211a         |
+ * | Device Discovery             |       0x2134       | 0x210e-0x2115  |
  * |                              |                    | 0x211c-0x2128  |
  * |                              |                    | 0x212c-0x2134  |
  * | Queue Command and IO tracing |       0x3074       | 0x300b         |
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index b7aac3116f2d..e893b42e51a3 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1710,6 +1710,12 @@ void qla2x00_handle_rscn(scsi_qla_host_t *vha, struct event_arg *ea)
 
 	fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1);
 	if (fcport) {
+		if (fcport->flags & FCF_FCP2_DEVICE) {
+			ql_dbg(ql_dbg_disc, vha, 0x2115,
+			       "Delaying session delete for FCP2 portid=%06x %8phC ",
+			       fcport->d_id.b24, fcport->port_name);
+			return;
+		}
 		fcport->scan_needed = 1;
 		fcport->rscn_gen++;
 	}
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 813abaf1b087..30ce84468c75 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3955,6 +3955,16 @@ qla2x00_mark_all_devices_lost(scsi_qla_host_t *vha)
 	    "Mark all dev lost\n");
 
 	list_for_each_entry(fcport, &vha->vp_fcports, list) {
+		if (fcport->loop_id != FC_NO_LOOP_ID &&
+		    (fcport->flags & FCF_FCP2_DEVICE) &&
+		    fcport->port_type == FCT_TARGET &&
+		    !qla2x00_reset_active(vha)) {
+			ql_dbg(ql_dbg_disc, vha, 0x211a,
+			       "Delaying session delete for FCP2 flags 0x%x port_type = 0x%x port_id=%06x %phC",
+			       fcport->flags, fcport->port_type,
+			       fcport->d_id.b24, fcport->port_name);
+			continue;
+		}
 		fcport->scan_state = 0;
 		qlt_schedule_sess_for_deletion(fcport);
 	}

From cbe31149e5a708e50eea1e69d6fd4643226e7769 Mon Sep 17 00:00:00 2001
From: Quinn Tran <qutran@marvell.com>
Date: Tue, 26 Oct 2021 04:54:00 -0700
Subject: [PATCH 1644/1750] scsi: qla2xxx: Relogin during fabric disturbance

[ Upstream commit bb2ca6b3f09ac20e8357d257d0557ab5ddf6adcd ]

For RSCN of type "Area, Domain, or Fabric", which indicate a portion or
entire fabric was disturbed, current driver does not set the scan_need flag
to indicate a session was affected by the disturbance. This in turn can
lead to I/O timeout and delay of relogin. Hence initiate relogin in the
event of fabric disturbance.

Link: https://lore.kernel.org/r/20211026115412.27691-2-njavali@marvell.com
Fixes: 1560bafdff9e ("scsi: qla2xxx: Use complete switch scan for RSCN events")
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_init.c | 54 +++++++++++++++++++++++++++------
 1 file changed, 45 insertions(+), 9 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index e893b42e51a3..5bbdaefb44ef 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1708,16 +1708,52 @@ void qla2x00_handle_rscn(scsi_qla_host_t *vha, struct event_arg *ea)
 	fc_port_t *fcport;
 	unsigned long flags;
 
-	fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1);
-	if (fcport) {
-		if (fcport->flags & FCF_FCP2_DEVICE) {
-			ql_dbg(ql_dbg_disc, vha, 0x2115,
-			       "Delaying session delete for FCP2 portid=%06x %8phC ",
-			       fcport->d_id.b24, fcport->port_name);
-			return;
+	switch (ea->id.b.rsvd_1) {
+	case RSCN_PORT_ADDR:
+		fcport = qla2x00_find_fcport_by_nportid(vha, &ea->id, 1);
+		if (fcport) {
+			if (fcport->flags & FCF_FCP2_DEVICE) {
+				ql_dbg(ql_dbg_disc, vha, 0x2115,
+				       "Delaying session delete for FCP2 portid=%06x %8phC ",
+					fcport->d_id.b24, fcport->port_name);
+				return;
+			}
+			fcport->scan_needed = 1;
+			fcport->rscn_gen++;
 		}
-		fcport->scan_needed = 1;
-		fcport->rscn_gen++;
+		break;
+	case RSCN_AREA_ADDR:
+		list_for_each_entry(fcport, &vha->vp_fcports, list) {
+			if (fcport->flags & FCF_FCP2_DEVICE)
+				continue;
+
+			if ((ea->id.b24 & 0xffff00) == (fcport->d_id.b24 & 0xffff00)) {
+				fcport->scan_needed = 1;
+				fcport->rscn_gen++;
+			}
+		}
+		break;
+	case RSCN_DOM_ADDR:
+		list_for_each_entry(fcport, &vha->vp_fcports, list) {
+			if (fcport->flags & FCF_FCP2_DEVICE)
+				continue;
+
+			if ((ea->id.b24 & 0xff0000) == (fcport->d_id.b24 & 0xff0000)) {
+				fcport->scan_needed = 1;
+				fcport->rscn_gen++;
+			}
+		}
+		break;
+	case RSCN_FAB_ADDR:
+	default:
+		list_for_each_entry(fcport, &vha->vp_fcports, list) {
+			if (fcport->flags & FCF_FCP2_DEVICE)
+				continue;
+
+			fcport->scan_needed = 1;
+			fcport->rscn_gen++;
+		}
+		break;
 	}
 
 	spin_lock_irqsave(&vha->work_lock, flags);

From 09595fd2cef53cc4e87d04d7387906bf54beb92c Mon Sep 17 00:00:00 2001
From: Quinn Tran <qutran@marvell.com>
Date: Tue, 26 Oct 2021 04:54:01 -0700
Subject: [PATCH 1645/1750] scsi: qla2xxx: Fix gnl list corruption

[ Upstream commit c98c5daaa24b583cba1369b7d167f93c6ae7299c ]

Current code does list element deletion and addition in and out of lock
protection. This patch moves deletion behind lock.

list_add double add: new=ffff9130b5eb89f8, prev=ffff9130b5eb89f8,
    next=ffff9130c6a715f0.
 ------------[ cut here ]------------
 kernel BUG at lib/list_debug.c:31!
 invalid opcode: 0000 [#1] SMP PTI
 CPU: 1 PID: 182395 Comm: kworker/1:37 Kdump: loaded Tainted: G W  OE
 --------- -  - 4.18.0-193.el8.x86_64 #1
 Hardware name: HP ProLiant DL160 Gen8, BIOS J03 02/10/2014
 Workqueue: qla2xxx_wq qla2x00_iocb_work_fn [qla2xxx]
 RIP: 0010:__list_add_valid+0x41/0x50
 Code: 85 94 00 00 00 48 39 c7 74 0b 48 39 d7 74 06 b8 01 00 00 00 c3 48 89 f2
 4c 89 c1 48 89 fe 48 c7 c7 60 83 ad 97 e8 4d bd ce ff <0f> 0b 0f 1f 00 66 2e
 0f 1f 84 00 00 00 00 00 48 8b 07 48 8b 57 08
 RSP: 0018:ffffaba306f47d68 EFLAGS: 00010046
 RAX: 0000000000000058 RBX: ffff9130b5eb8800 RCX: 0000000000000006
 RDX: 0000000000000000 RSI: 0000000000000096 RDI: ffff9130b7456a00
 RBP: ffff9130c6a70a58 R08: 000000000008d7be R09: 0000000000000001
 R10: 0000000000000000 R11: 0000000000000001 R12: ffff9130c6a715f0
 R13: ffff9130b5eb8824 R14: ffff9130b5eb89f8 R15: ffff9130b5eb89f8
 FS:  0000000000000000(0000) GS:ffff9130b7440000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00007efcaaef11a0 CR3: 000000005200a002 CR4: 00000000000606e0
 Call Trace:
  qla24xx_async_gnl+0x113/0x3c0 [qla2xxx]
  ? qla2x00_iocb_work_fn+0x53/0x80 [qla2xxx]
  ? process_one_work+0x1a7/0x3b0
  ? worker_thread+0x30/0x390
  ? create_worker+0x1a0/0x1a0
  ? kthread+0x112/0x130

Link: https://lore.kernel.org/r/20211026115412.27691-3-njavali@marvell.com
Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery")
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_init.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 5bbdaefb44ef..fdae25ec554d 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -976,8 +976,6 @@ static void qla24xx_async_gnl_sp_done(srb_t *sp, int res)
 	    sp->name, res, sp->u.iocb_cmd.u.mbx.in_mb[1],
 	    sp->u.iocb_cmd.u.mbx.in_mb[2]);
 
-	if (res == QLA_FUNCTION_TIMEOUT)
-		return;
 
 	sp->fcport->flags &= ~(FCF_ASYNC_SENT|FCF_ASYNC_ACTIVE);
 	memset(&ea, 0, sizeof(ea));
@@ -1015,8 +1013,8 @@ static void qla24xx_async_gnl_sp_done(srb_t *sp, int res)
 	spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
 
 	list_for_each_entry_safe(fcport, tf, &h, gnl_entry) {
-		list_del_init(&fcport->gnl_entry);
 		spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
+		list_del_init(&fcport->gnl_entry);
 		fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE);
 		spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
 		ea.fcport = fcport;

From 0afb3bc53435b31fe66bb9305cdd8a3a80f181ca Mon Sep 17 00:00:00 2001
From: Quinn Tran <qutran@marvell.com>
Date: Tue, 26 Oct 2021 04:54:02 -0700
Subject: [PATCH 1646/1750] scsi: qla2xxx: Turn off target reset during
 issue_lip

[ Upstream commit 0b7a9fd934a68ebfc1019811b7bdc1742072ad7b ]

When user uses issue_lip to do link bounce, driver sends additional target
reset to remote device before resetting the link. The target reset would
affect other paths with active I/Os. This patch will remove the unnecessary
target reset.

Link: https://lore.kernel.org/r/20211026115412.27691-4-njavali@marvell.com
Fixes: 5854771e314e ("[SCSI] qla2xxx: Add ISPFX00 specific bus reset routine")
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/qla2xxx/qla_gbl.h |  2 --
 drivers/scsi/qla2xxx/qla_mr.c  | 23 -----------------------
 drivers/scsi/qla2xxx/qla_os.c  | 27 ++-------------------------
 3 files changed, 2 insertions(+), 50 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index e39b4f2da73a..3bc185027342 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -158,7 +158,6 @@ extern int ql2xasynctmfenable;
 extern int ql2xgffidenable;
 extern int ql2xenabledif;
 extern int ql2xenablehba_err_chk;
-extern int ql2xtargetreset;
 extern int ql2xdontresethba;
 extern uint64_t ql2xmaxlun;
 extern int ql2xmdcapmask;
@@ -791,7 +790,6 @@ extern void qlafx00_abort_iocb(srb_t *, struct abort_iocb_entry_fx00 *);
 extern void qlafx00_fxdisc_iocb(srb_t *, struct fxdisc_entry_fx00 *);
 extern void qlafx00_timer_routine(scsi_qla_host_t *);
 extern int qlafx00_rescan_isp(scsi_qla_host_t *);
-extern int qlafx00_loop_reset(scsi_qla_host_t *vha);
 
 /* qla82xx related functions */
 
diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c
index ca7306685325..7178646ee0f0 100644
--- a/drivers/scsi/qla2xxx/qla_mr.c
+++ b/drivers/scsi/qla2xxx/qla_mr.c
@@ -738,29 +738,6 @@ qlafx00_lun_reset(fc_port_t *fcport, uint64_t l, int tag)
 	return qla2x00_async_tm_cmd(fcport, TCF_LUN_RESET, l, tag);
 }
 
-int
-qlafx00_loop_reset(scsi_qla_host_t *vha)
-{
-	int ret;
-	struct fc_port *fcport;
-	struct qla_hw_data *ha = vha->hw;
-
-	if (ql2xtargetreset) {
-		list_for_each_entry(fcport, &vha->vp_fcports, list) {
-			if (fcport->port_type != FCT_TARGET)
-				continue;
-
-			ret = ha->isp_ops->target_reset(fcport, 0, 0);
-			if (ret != QLA_SUCCESS) {
-				ql_dbg(ql_dbg_taskm, vha, 0x803d,
-				    "Bus Reset failed: Reset=%d "
-				    "d_id=%x.\n", ret, fcport->d_id.b24);
-			}
-		}
-	}
-	return QLA_SUCCESS;
-}
-
 int
 qlafx00_iospace_config(struct qla_hw_data *ha)
 {
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 30ce84468c75..e7f73a167fbd 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -197,12 +197,6 @@ MODULE_PARM_DESC(ql2xdbwr,
 		" 0 -- Regular doorbell.\n"
 		" 1 -- CAMRAM doorbell (faster).\n");
 
-int ql2xtargetreset = 1;
-module_param(ql2xtargetreset, int, S_IRUGO);
-MODULE_PARM_DESC(ql2xtargetreset,
-		 "Enable target reset."
-		 "Default is 1 - use hw defaults.");
-
 int ql2xgffidenable;
 module_param(ql2xgffidenable, int, S_IRUGO);
 MODULE_PARM_DESC(ql2xgffidenable,
@@ -1652,27 +1646,10 @@ int
 qla2x00_loop_reset(scsi_qla_host_t *vha)
 {
 	int ret;
-	struct fc_port *fcport;
 	struct qla_hw_data *ha = vha->hw;
 
-	if (IS_QLAFX00(ha)) {
-		return qlafx00_loop_reset(vha);
-	}
-
-	if (ql2xtargetreset == 1 && ha->flags.enable_target_reset) {
-		list_for_each_entry(fcport, &vha->vp_fcports, list) {
-			if (fcport->port_type != FCT_TARGET)
-				continue;
-
-			ret = ha->isp_ops->target_reset(fcport, 0, 0);
-			if (ret != QLA_SUCCESS) {
-				ql_dbg(ql_dbg_taskm, vha, 0x802c,
-				    "Bus Reset failed: Reset=%d "
-				    "d_id=%x.\n", ret, fcport->d_id.b24);
-			}
-		}
-	}
-
+	if (IS_QLAFX00(ha))
+		return QLA_SUCCESS;
 
 	if (ha->flags.enable_lip_full_login && !IS_CNA_CAPABLE(ha)) {
 		atomic_set(&vha->loop_state, LOOP_DOWN);

From 8c3e204fb6bc035aa18188eaef069bb0c2480d9a Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Tue, 26 Oct 2021 21:56:40 -0400
Subject: [PATCH 1647/1750] NFSv4: Fix a regression in
 nfs_set_open_stateid_locked()

[ Upstream commit 01d29f87fcfef38d51ce2b473981a5c1e861ac0a ]

If we already hold open state on the client, yet the server gives us a
completely different stateid to the one we already hold, then we
currently treat it as if it were an out-of-sequence update, and wait for
5 seconds for other updates to come in.
This commit fixes the behaviour so that we immediately start processing
of the new stateid, and then leave it to the call to
nfs4_test_and_free_stateid() to decide what to do with the old stateid.

Fixes: b4868b44c562 ("NFSv4: Wait for stateid updates after CLOSE/OPEN_DOWNGRADE")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfs/nfs4proc.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 5365000e83bd..3106bd28b113 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1590,15 +1590,16 @@ static bool nfs_stateid_is_sequential(struct nfs4_state *state,
 {
 	if (test_bit(NFS_OPEN_STATE, &state->flags)) {
 		/* The common case - we're updating to a new sequence number */
-		if (nfs4_stateid_match_other(stateid, &state->open_stateid) &&
-			nfs4_stateid_is_next(&state->open_stateid, stateid)) {
-			return true;
+		if (nfs4_stateid_match_other(stateid, &state->open_stateid)) {
+			if (nfs4_stateid_is_next(&state->open_stateid, stateid))
+				return true;
+			return false;
 		}
-	} else {
-		/* This is the first OPEN in this generation */
-		if (stateid->seqid == cpu_to_be32(1))
-			return true;
+		/* The server returned a new stateid */
 	}
+	/* This is the first OPEN in this generation */
+	if (stateid->seqid == cpu_to_be32(1))
+		return true;
 	return false;
 }
 

From de9721ee8ad30ddc625dea12dee849b8cff1ffcf Mon Sep 17 00:00:00 2001
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Date: Thu, 19 Aug 2021 22:48:08 +0200
Subject: [PATCH 1648/1750] i2c: xlr: Fix a resource leak in the error handling
 path of 'xlr_i2c_probe()'

[ Upstream commit 7f98960c046ee1136e7096aee168eda03aef8a5d ]

A successful 'clk_prepare()' call should be balanced by a corresponding
'clk_unprepare()' call in the error handling path of the probe, as already
done in the remove function.

More specifically, 'clk_prepare_enable()' is used, but 'clk_disable()' is
also already called. So just the unprepare step has still to be done.

Update the error handling path accordingly.

Fixes: 75d31c2372e4 ("i2c: xlr: add support for Sigma Designs controller variant")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-xlr.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-xlr.c b/drivers/i2c/busses/i2c-xlr.c
index 126d1393e548..9ce20652d494 100644
--- a/drivers/i2c/busses/i2c-xlr.c
+++ b/drivers/i2c/busses/i2c-xlr.c
@@ -431,11 +431,15 @@ static int xlr_i2c_probe(struct platform_device *pdev)
 	i2c_set_adapdata(&priv->adap, priv);
 	ret = i2c_add_numbered_adapter(&priv->adap);
 	if (ret < 0)
-		return ret;
+		goto err_unprepare_clk;
 
 	platform_set_drvdata(pdev, priv);
 	dev_info(&priv->adap.dev, "Added I2C Bus.\n");
 	return 0;
+
+err_unprepare_clk:
+	clk_unprepare(clk);
+	return ret;
 }
 
 static int xlr_i2c_remove(struct platform_device *pdev)

From 111f77594ddfe43224faac85e6b9fb40ce54262f Mon Sep 17 00:00:00 2001
From: YueHaibing <yuehaibing@huawei.com>
Date: Fri, 8 Oct 2021 15:44:17 +0800
Subject: [PATCH 1649/1750] xen-pciback: Fix return in pm_ctrl_init()

[ Upstream commit 4745ea2628bb43a7ec34b71763b5a56407b33990 ]

Return NULL instead of passing to ERR_PTR while err is zero,
this fix smatch warnings:
drivers/xen/xen-pciback/conf_space_capability.c:163
 pm_ctrl_init() warn: passing zero to 'ERR_PTR'

Fixes: a92336a1176b ("xen/pciback: Drop two backends, squash and cleanup some code.")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20211008074417.8260-1-yuehaibing@huawei.com
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/xen/xen-pciback/conf_space_capability.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/xen-pciback/conf_space_capability.c b/drivers/xen/xen-pciback/conf_space_capability.c
index 22f13abbe913..5e53b4817f16 100644
--- a/drivers/xen/xen-pciback/conf_space_capability.c
+++ b/drivers/xen/xen-pciback/conf_space_capability.c
@@ -160,7 +160,7 @@ static void *pm_ctrl_init(struct pci_dev *dev, int offset)
 	}
 
 out:
-	return ERR_PTR(err);
+	return err ? ERR_PTR(err) : NULL;
 }
 
 static const struct config_field caplist_pm[] = {

From e78c267eb74e012063c185356c1dce62e045918c Mon Sep 17 00:00:00 2001
From: Maxim Kiselev <bigunclemax@gmail.com>
Date: Mon, 1 Nov 2021 18:23:41 +0300
Subject: [PATCH 1650/1750] net: davinci_emac: Fix interrupt pacing disable

[ Upstream commit d52bcb47bdf971a59a2467975d2405fcfcb2fa19 ]

This patch allows to use 0 for `coal->rx_coalesce_usecs` param to
disable rx irq coalescing.

Previously we could enable rx irq coalescing via ethtool
(For ex: `ethtool -C eth0 rx-usecs 2000`) but we couldn't disable
it because this part rejects 0 value:

       if (!coal->rx_coalesce_usecs)
               return -EINVAL;

Fixes: 84da2658a619 ("TI DaVinci EMAC : Implement interrupt pacing functionality.")
Signed-off-by: Maxim Kiselev <bigunclemax@gmail.com>
Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
Link: https://lore.kernel.org/r/20211101152343.4193233-1-bigunclemax@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ti/davinci_emac.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 03055c96f076..ad5293571af4 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -412,8 +412,20 @@ static int emac_set_coalesce(struct net_device *ndev,
 	u32 int_ctrl, num_interrupts = 0;
 	u32 prescale = 0, addnl_dvdr = 1, coal_intvl = 0;
 
-	if (!coal->rx_coalesce_usecs)
-		return -EINVAL;
+	if (!coal->rx_coalesce_usecs) {
+		priv->coal_intvl = 0;
+
+		switch (priv->version) {
+		case EMAC_VERSION_2:
+			emac_ctrl_write(EMAC_DM646X_CMINTCTRL, 0);
+			break;
+		default:
+			emac_ctrl_write(EMAC_CTRL_EWINTTCNT, 0);
+			break;
+		}
+
+		return 0;
+	}
 
 	coal_intvl = coal->rx_coalesce_usecs;
 

From 628773a759d54e83bb967078c0ce359efbae1cc1 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Tue, 2 Nov 2021 15:02:36 -0700
Subject: [PATCH 1651/1750] ethtool: fix ethtool msg len calculation for pause
 stats

[ Upstream commit 1aabe578dd86e9f2867c4db4fba9a15f4ba1825d ]

ETHTOOL_A_PAUSE_STAT_MAX is the MAX attribute id,
so we need to subtract non-stats and add one to
get a count (IOW -2+1 == -1).

Otherwise we'll see:

  ethnl cmd 21: calculated reply length 40, but consumed 52

Fixes: 9a27a33027f2 ("ethtool: add standard pause stats")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/ethtool_netlink.h      | 3 +++
 include/uapi/linux/ethtool_netlink.h | 4 +++-
 net/ethtool/pause.c                  | 3 +--
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/include/linux/ethtool_netlink.h b/include/linux/ethtool_netlink.h
index 1e7bf78cb382..aba348d58ff6 100644
--- a/include/linux/ethtool_netlink.h
+++ b/include/linux/ethtool_netlink.h
@@ -10,6 +10,9 @@
 #define __ETHTOOL_LINK_MODE_MASK_NWORDS \
 	DIV_ROUND_UP(__ETHTOOL_LINK_MODE_MASK_NBITS, 32)
 
+#define ETHTOOL_PAUSE_STAT_CNT	(__ETHTOOL_A_PAUSE_STAT_CNT -		\
+				 ETHTOOL_A_PAUSE_STAT_TX_FRAMES)
+
 enum ethtool_multicast_groups {
 	ETHNL_MCGRP_MONITOR,
 };
diff --git a/include/uapi/linux/ethtool_netlink.h b/include/uapi/linux/ethtool_netlink.h
index e2bf36e6964b..c94fa2941502 100644
--- a/include/uapi/linux/ethtool_netlink.h
+++ b/include/uapi/linux/ethtool_netlink.h
@@ -394,7 +394,9 @@ enum {
 	ETHTOOL_A_PAUSE_STAT_TX_FRAMES,
 	ETHTOOL_A_PAUSE_STAT_RX_FRAMES,
 
-	/* add new constants above here */
+	/* add new constants above here
+	 * adjust ETHTOOL_PAUSE_STAT_CNT if adding non-stats!
+	 */
 	__ETHTOOL_A_PAUSE_STAT_CNT,
 	ETHTOOL_A_PAUSE_STAT_MAX = (__ETHTOOL_A_PAUSE_STAT_CNT - 1)
 };
diff --git a/net/ethtool/pause.c b/net/ethtool/pause.c
index d4ac02718b72..c7bc704c8862 100644
--- a/net/ethtool/pause.c
+++ b/net/ethtool/pause.c
@@ -62,8 +62,7 @@ static int pause_reply_size(const struct ethnl_req_info *req_base,
 
 	if (req_base->flags & ETHTOOL_FLAG_STATS)
 		n += nla_total_size(0) +	/* _PAUSE_STATS */
-			nla_total_size_64bit(sizeof(u64)) *
-				(ETHTOOL_A_PAUSE_STAT_MAX - 2);
+		     nla_total_size_64bit(sizeof(u64)) * ETHTOOL_PAUSE_STAT_CNT;
 	return n;
 }
 

From 3fe164e7197b7e9cf214671f938aa4b37b0f577e Mon Sep 17 00:00:00 2001
From: Stafford Horne <shorne@gmail.com>
Date: Wed, 3 Nov 2021 20:19:33 +0900
Subject: [PATCH 1652/1750] openrisc: fix SMP tlb flush NULL pointer
 dereference

[ Upstream commit 27dff9a9c247d4e38d82c2e7234914cfe8499294 ]

Throughout the OpenRISC kernel port VMA is passed as NULL when flushing
kernel tlb entries.  Somehow this was missed when I was testing
c28b27416da9 ("openrisc: Implement proper SMP tlb flushing") and now the
SMP kernel fails to completely boot.

In OpenRISC VMA is used only to determine which cores need to have their
TLB entries flushed.

This patch updates the logic to flush tlbs on all cores when the VMA is
passed as NULL.  Also, we update places VMA is passed as NULL to use
flush_tlb_kernel_range instead.  Now, the only place VMA is passed as
NULL is in the implementation of flush_tlb_kernel_range.

Fixes: c28b27416da9 ("openrisc: Implement proper SMP tlb flushing")
Reported-by: Jan Henrik Weinstock <jan.weinstock@rwth-aachen.de>
Signed-off-by: Stafford Horne <shorne@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/openrisc/kernel/dma.c | 4 ++--
 arch/openrisc/kernel/smp.c | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/arch/openrisc/kernel/dma.c b/arch/openrisc/kernel/dma.c
index 1b16d97e7da7..a82b2caaa560 100644
--- a/arch/openrisc/kernel/dma.c
+++ b/arch/openrisc/kernel/dma.c
@@ -33,7 +33,7 @@ page_set_nocache(pte_t *pte, unsigned long addr,
 	 * Flush the page out of the TLB so that the new page flags get
 	 * picked up next time there's an access
 	 */
-	flush_tlb_page(NULL, addr);
+	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
 
 	/* Flush page out of dcache */
 	for (cl = __pa(addr); cl < __pa(next); cl += cpuinfo->dcache_block_size)
@@ -56,7 +56,7 @@ page_clear_nocache(pte_t *pte, unsigned long addr,
 	 * Flush the page out of the TLB so that the new page flags get
 	 * picked up next time there's an access
 	 */
-	flush_tlb_page(NULL, addr);
+	flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
 
 	return 0;
 }
diff --git a/arch/openrisc/kernel/smp.c b/arch/openrisc/kernel/smp.c
index e4dad76066ae..18b320a06fe5 100644
--- a/arch/openrisc/kernel/smp.c
+++ b/arch/openrisc/kernel/smp.c
@@ -261,7 +261,7 @@ static inline void ipi_flush_tlb_range(void *info)
 	local_flush_tlb_range(NULL, fd->addr1, fd->addr2);
 }
 
-static void smp_flush_tlb_range(struct cpumask *cmask, unsigned long start,
+static void smp_flush_tlb_range(const struct cpumask *cmask, unsigned long start,
 				unsigned long end)
 {
 	unsigned int cpuid;
@@ -309,7 +309,9 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long uaddr)
 void flush_tlb_range(struct vm_area_struct *vma,
 		     unsigned long start, unsigned long end)
 {
-	smp_flush_tlb_range(mm_cpumask(vma->vm_mm), start, end);
+	const struct cpumask *cmask = vma ? mm_cpumask(vma->vm_mm)
+					  : cpu_online_mask;
+	smp_flush_tlb_range(cmask, start, end);
 }
 
 /* Instruction cache invalidate - performed on each cpu */

From e04a7a84bb77f9cdf4475340fe931389bc72331c Mon Sep 17 00:00:00 2001
From: Ziyang Xuan <william.xuanziyang@huawei.com>
Date: Tue, 2 Nov 2021 10:12:18 +0800
Subject: [PATCH 1653/1750] net: vlan: fix a UAF in vlan_dev_real_dev()

[ Upstream commit 563bcbae3ba233c275c244bfce2efe12938f5363 ]

The real_dev of a vlan net_device may be freed after
unregister_vlan_dev(). Access the real_dev continually by
vlan_dev_real_dev() will trigger the UAF problem for the
real_dev like following:

==================================================================
BUG: KASAN: use-after-free in vlan_dev_real_dev+0xf9/0x120
Call Trace:
 kasan_report.cold+0x83/0xdf
 vlan_dev_real_dev+0xf9/0x120
 is_eth_port_of_netdev_filter.part.0+0xb1/0x2c0
 is_eth_port_of_netdev_filter+0x28/0x40
 ib_enum_roce_netdev+0x1a3/0x300
 ib_enum_all_roce_netdevs+0xc7/0x140
 netdevice_event_work_handler+0x9d/0x210
...

Freed by task 9288:
 kasan_save_stack+0x1b/0x40
 kasan_set_track+0x1c/0x30
 kasan_set_free_info+0x20/0x30
 __kasan_slab_free+0xfc/0x130
 slab_free_freelist_hook+0xdd/0x240
 kfree+0xe4/0x690
 kvfree+0x42/0x50
 device_release+0x9f/0x240
 kobject_put+0x1c8/0x530
 put_device+0x1b/0x30
 free_netdev+0x370/0x540
 ppp_destroy_interface+0x313/0x3d0
...

Move the put_device(real_dev) to vlan_dev_free(). Ensure
real_dev not be freed before vlan_dev unregistered.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+e4df4e1389e28972e955@syzkaller.appspotmail.com
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/8021q/vlan.c     | 3 ---
 net/8021q/vlan_dev.c | 3 +++
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 15bbfaf943fd..ad3780067a7d 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -120,9 +120,6 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 	}
 
 	vlan_vid_del(real_dev, vlan->vlan_proto, vlan_id);
-
-	/* Get rid of the vlan's reference to real_dev */
-	dev_put(real_dev);
 }
 
 int vlan_check_real_dev(struct net_device *real_dev,
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index ec8408d1638f..c7eba7dab093 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -813,6 +813,9 @@ static void vlan_dev_free(struct net_device *dev)
 
 	free_percpu(vlan->vlan_pcpu_stats);
 	vlan->vlan_pcpu_stats = NULL;
+
+	/* Get rid of the vlan's reference to real_dev */
+	dev_put(vlan->real_dev);
 }
 
 void vlan_setup(struct net_device *dev)

From 354ae5ca6ce17ed270650436f8449acecb032278 Mon Sep 17 00:00:00 2001
From: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
Date: Thu, 6 May 2021 08:40:03 -0700
Subject: [PATCH 1654/1750] ice: Fix replacing VF hardware MAC to existing MAC
 filter

[ Upstream commit ce572a5b88d5ca6737b5e23da9892792fd708ad3 ]

VF was not able to change its hardware MAC address in case
the new address was already present in the MAC filter list.
Change the handling of VF add mac request to not return
if requested MAC address is already present on the list
and check if its hardware MAC needs to be updated in this case.

Fixes: ed4c068d46f6 ("ice: Enable ip link show on the PF to display VF unicast MAC(s)")
Signed-off-by: Sylwester Dziedziuch <sylwesterx.dziedziuch@intel.com>
Tested-by: Tony Brelinski <tony.brelinski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
index c9f82fd3cf48..22e23199c92c 100644
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
@@ -3068,6 +3068,7 @@ ice_vc_add_mac_addr(struct ice_vf *vf, struct ice_vsi *vsi, u8 *mac_addr)
 {
 	struct device *dev = ice_pf_to_dev(vf->pf);
 	enum ice_status status;
+	int ret = 0;
 
 	/* default unicast MAC already added */
 	if (ether_addr_equal(mac_addr, vf->dflt_lan_addr.addr))
@@ -3080,13 +3081,18 @@ ice_vc_add_mac_addr(struct ice_vf *vf, struct ice_vsi *vsi, u8 *mac_addr)
 
 	status = ice_fltr_add_mac(vsi, mac_addr, ICE_FWD_TO_VSI);
 	if (status == ICE_ERR_ALREADY_EXISTS) {
-		dev_err(dev, "MAC %pM already exists for VF %d\n", mac_addr,
+		dev_dbg(dev, "MAC %pM already exists for VF %d\n", mac_addr,
 			vf->vf_id);
-		return -EEXIST;
+		/* don't return since we might need to update
+		 * the primary MAC in ice_vfhw_mac_add() below
+		 */
+		ret = -EEXIST;
 	} else if (status) {
 		dev_err(dev, "Failed to add MAC %pM for VF %d\n, error %s\n",
 			mac_addr, vf->vf_id, ice_stat_str(status));
 		return -EIO;
+	} else {
+		vf->num_mac++;
 	}
 
 	/* Set the default LAN address to the latest unicast MAC address added
@@ -3096,9 +3102,7 @@ ice_vc_add_mac_addr(struct ice_vf *vf, struct ice_vsi *vsi, u8 *mac_addr)
 	if (is_unicast_ether_addr(mac_addr))
 		ether_addr_copy(vf->dflt_lan_addr.addr, mac_addr);
 
-	vf->num_mac++;
-
-	return 0;
+	return ret;
 }
 
 /**

From d83832d4a838e94282205b565c9c411d00ebceee Mon Sep 17 00:00:00 2001
From: Brett Creeley <brett.creeley@intel.com>
Date: Thu, 9 Sep 2021 14:38:08 -0700
Subject: [PATCH 1655/1750] ice: Fix not stopping Tx queues for VFs

[ Upstream commit b385cca47363316c6d9a74ae9db407bbc281f815 ]

When a VF is removed and/or reset its Tx queues need to be
stopped from the PF. This is done by calling the ice_dis_vf_qs()
function, which calls ice_vsi_stop_lan_tx_rings(). Currently
ice_dis_vf_qs() is protected by the VF state bit ICE_VF_STATE_QS_ENA.
Unfortunately, this is causing the Tx queues to not be disabled in some
cases and when the VF tries to re-enable/reconfigure its Tx queues over
virtchnl the op is failing. This is because a VF can be reset and/or
removed before the ICE_VF_STATE_QS_ENA bit is set, but the Tx queues
were already configured via ice_vsi_cfg_single_txq() in the
VIRTCHNL_OP_CONFIG_VSI_QUEUES op. However, the ICE_VF_STATE_QS_ENA bit
is set on a successful VIRTCHNL_OP_ENABLE_QUEUES, which will always
happen after the VIRTCHNL_OP_CONFIG_VSI_QUEUES op.

This was causing the following error message when loading the ice
driver, creating VFs, and modifying VF trust in an endless loop:

[35274.192484] ice 0000:88:00.0: Failed to set LAN Tx queue context, error: ICE_ERR_PARAM
[35274.193074] ice 0000:88:00.0: VF 0 failed opcode 6, retval: -5
[35274.193640] iavf 0000:88:01.0: PF returned error -5 (IAVF_ERR_PARAM) to our request 6

Fix this by always calling ice_dis_vf_qs() and silencing the error
message in ice_vsi_stop_tx_ring() since the calling code ignores the
return anyway. Also, all other places that call ice_vsi_stop_tx_ring()
catch the error, so this doesn't affect those flows since there was no
change to the values the function returns.

Other solutions were considered (i.e. tracking which VF queues had been
"started/configured" in VIRTCHNL_OP_CONFIG_VSI_QUEUES, but it seemed
more complicated than it was worth. This solution also brings in the
chance for other unexpected conditions due to invalid state bit checks.
So, the proposed solution seemed like the best option since there is no
harm in failing to stop Tx queues that were never started.

This issue can be seen using the following commands:

for i in {0..50}; do
        rmmod ice
        modprobe ice

        sleep 1

        echo 1 > /sys/class/net/ens785f0/device/sriov_numvfs
        echo 1 > /sys/class/net/ens785f1/device/sriov_numvfs

        ip link set ens785f1 vf 0 trust on
        ip link set ens785f0 vf 0 trust on

        sleep 2

        echo 0 > /sys/class/net/ens785f0/device/sriov_numvfs
        echo 0 > /sys/class/net/ens785f1/device/sriov_numvfs
        sleep 1
        echo 1 > /sys/class/net/ens785f0/device/sriov_numvfs
        echo 1 > /sys/class/net/ens785f1/device/sriov_numvfs

        ip link set ens785f1 vf 0 trust on
        ip link set ens785f0 vf 0 trust on
done

Fixes: 77ca27c41705 ("ice: add support for virtchnl_queue_select.[tx|rx]_queues bitmap")
Signed-off-by: Brett Creeley <brett.creeley@intel.com>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_base.c        | 2 +-
 drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 6 ++----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_base.c b/drivers/net/ethernet/intel/ice/ice_base.c
index fe4320e2d1f2..1929847b8c40 100644
--- a/drivers/net/ethernet/intel/ice/ice_base.c
+++ b/drivers/net/ethernet/intel/ice/ice_base.c
@@ -839,7 +839,7 @@ ice_vsi_stop_tx_ring(struct ice_vsi *vsi, enum ice_disq_rst_src rst_src,
 	} else if (status == ICE_ERR_DOES_NOT_EXIST) {
 		dev_dbg(ice_pf_to_dev(vsi->back), "LAN Tx queues do not exist, nothing to disable\n");
 	} else if (status) {
-		dev_err(ice_pf_to_dev(vsi->back), "Failed to disable LAN Tx queues, error: %s\n",
+		dev_dbg(ice_pf_to_dev(vsi->back), "Failed to disable LAN Tx queues, error: %s\n",
 			ice_stat_str(status));
 		return -ENODEV;
 	}
diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
index 22e23199c92c..69ce5d60a857 100644
--- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c
@@ -362,8 +362,7 @@ void ice_free_vfs(struct ice_pf *pf)
 
 	/* Avoid wait time by stopping all VFs at the same time */
 	ice_for_each_vf(pf, i)
-		if (test_bit(ICE_VF_STATE_QS_ENA, pf->vf[i].vf_states))
-			ice_dis_vf_qs(&pf->vf[i]);
+		ice_dis_vf_qs(&pf->vf[i]);
 
 	tmp = pf->num_alloc_vfs;
 	pf->num_qps_per_vf = 0;
@@ -1291,8 +1290,7 @@ bool ice_reset_vf(struct ice_vf *vf, bool is_vflr)
 
 	vsi = pf->vsi[vf->lan_vsi_idx];
 
-	if (test_bit(ICE_VF_STATE_QS_ENA, vf->vf_states))
-		ice_dis_vf_qs(vf);
+	ice_dis_vf_qs(vf);
 
 	/* Call Disable LAN Tx queue AQ whether or not queues are
 	 * enabled. This is needed for successful completion of VFR.

From ee8a3ae48a94763fe446349614a11f3cd6b90f43 Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Sun, 31 Oct 2021 16:31:35 +0100
Subject: [PATCH 1656/1750] ACPI: PMIC: Fix intel_pmic_regs_handler() read
 accesses

[ Upstream commit 009a789443fe4c8e6b1ecb7c16b4865c026184cd ]

The handling of PMIC register reads through writing 0 to address 4
of the OpRegion is wrong. Instead of returning the read value
through the value64, which is a no-op for function == ACPI_WRITE calls,
store the value and then on a subsequent function == ACPI_READ with
address == 3 (the address for the value field of the OpRegion)
return the stored value.

This has been tested on a Xiaomi Mi Pad 2 and makes the ACPI battery dev
there mostly functional (unfortunately there are still other issues).

Here are the SET() / GET() functions of the PMIC ACPI device,
which use this OpRegion, which clearly show the new behavior to
be correct:

OperationRegion (REGS, 0x8F, Zero, 0x50)
Field (REGS, ByteAcc, NoLock, Preserve)
{
    CLNT,   8,
    SA,     8,
    OFF,    8,
    VAL,    8,
    RWM,    8
}

Method (GET, 3, Serialized)
{
    If ((AVBE == One))
    {
        CLNT = Arg0
        SA = Arg1
        OFF = Arg2
        RWM = Zero
        If ((AVBG == One))
        {
            GPRW = Zero
        }
    }

    Return (VAL) /* \_SB_.PCI0.I2C7.PMI5.VAL_ */
}

Method (SET, 4, Serialized)
{
    If ((AVBE == One))
    {
        CLNT = Arg0
        SA = Arg1
        OFF = Arg2
        VAL = Arg3
        RWM = One
        If ((AVBG == One))
        {
            GPRW = One
        }
    }
}

Fixes: 0afa877a5650 ("ACPI / PMIC: intel: add REGS operation region support")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/pmic/intel_pmic.c | 51 +++++++++++++++++++---------------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/drivers/acpi/pmic/intel_pmic.c b/drivers/acpi/pmic/intel_pmic.c
index a371f273f99d..9cde299eba88 100644
--- a/drivers/acpi/pmic/intel_pmic.c
+++ b/drivers/acpi/pmic/intel_pmic.c
@@ -211,31 +211,36 @@ static acpi_status intel_pmic_regs_handler(u32 function,
 		void *handler_context, void *region_context)
 {
 	struct intel_pmic_opregion *opregion = region_context;
-	int result = 0;
+	int result = -EINVAL;
 
-	switch (address) {
-	case 0:
-		return AE_OK;
-	case 1:
-		opregion->ctx.addr |= (*value64 & 0xff) << 8;
-		return AE_OK;
-	case 2:
-		opregion->ctx.addr |= *value64 & 0xff;
-		return AE_OK;
-	case 3:
-		opregion->ctx.val = *value64 & 0xff;
-		return AE_OK;
-	case 4:
-		if (*value64) {
-			result = regmap_write(opregion->regmap, opregion->ctx.addr,
-					      opregion->ctx.val);
-		} else {
-			result = regmap_read(opregion->regmap, opregion->ctx.addr,
-					     &opregion->ctx.val);
-			if (result == 0)
-				*value64 = opregion->ctx.val;
+	if (function == ACPI_WRITE) {
+		switch (address) {
+		case 0:
+			return AE_OK;
+		case 1:
+			opregion->ctx.addr |= (*value64 & 0xff) << 8;
+			return AE_OK;
+		case 2:
+			opregion->ctx.addr |= *value64 & 0xff;
+			return AE_OK;
+		case 3:
+			opregion->ctx.val = *value64 & 0xff;
+			return AE_OK;
+		case 4:
+			if (*value64) {
+				result = regmap_write(opregion->regmap, opregion->ctx.addr,
+						      opregion->ctx.val);
+			} else {
+				result = regmap_read(opregion->regmap, opregion->ctx.addr,
+						     &opregion->ctx.val);
+			}
+			opregion->ctx.addr = 0;
 		}
-		memset(&opregion->ctx, 0x00, sizeof(opregion->ctx));
+	}
+
+	if (function == ACPI_READ && address == 3) {
+		*value64 = opregion->ctx.val;
+		return AE_OK;
 	}
 
 	if (result < 0) {

From 090e17075f6780dba35f91bf34f98170f29cb44f Mon Sep 17 00:00:00 2001
From: Chenyuan Mi <cymi20@fudan.edu.cn>
Date: Tue, 7 Sep 2021 20:26:33 +0800
Subject: [PATCH 1657/1750] drm/nouveau/svm: Fix refcount leak bug and missing
 check against null bug

[ Upstream commit 6bb8c2d51811eb5e6504f49efe3b089d026009d2 ]

The reference counting issue happens in one exception handling path of
nouveau_svmm_bind(). When cli->svm.svmm is null, the function forgets
to decrease the refcount of mm increased by get_task_mm(), causing a
refcount leak.

Fix this issue by using mmput() to decrease the refcount in the
exception handling path.

Also, the function forgets to do check against null when get mm
by get_task_mm().

Fix this issue by adding null check after get mm by get_task_mm().

Signed-off-by: Chenyuan Mi <cymi20@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Fixes: 822cab6150d3 ("drm/nouveau/svm: check for SVM initialized before migrating")
Reviewed-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
Reviewed-by: Karol Herbst <kherbst@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210907122633.16665-1-cymi20@fudan.edu.cn
Link: https://gitlab.freedesktop.org/drm/nouveau/-/merge_requests/14
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
index 1c3f890377d2..f67700c028c7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_svm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
@@ -156,10 +156,14 @@ nouveau_svmm_bind(struct drm_device *dev, void *data,
 	 */
 
 	mm = get_task_mm(current);
+	if (!mm) {
+		return -EINVAL;
+	}
 	mmap_read_lock(mm);
 
 	if (!cli->svm.svmm) {
 		mmap_read_unlock(mm);
+		mmput(mm);
 		return -EINVAL;
 	}
 

From acb01e962af7d6867516a6f36e181301642af059 Mon Sep 17 00:00:00 2001
From: Heiner Kallweit <hkallweit1@gmail.com>
Date: Wed, 3 Nov 2021 22:08:28 +0100
Subject: [PATCH 1658/1750] net: phy: fix duplex out of sync problem while
 changing settings

[ Upstream commit a4db9055fdb9cf607775c66d39796caf6439ec92 ]

As reported by Zhang there's a small issue if in forced mode the duplex
mode changes with the link staying up [0]. In this case the MAC isn't
notified about the change.

The proposed patch relies on the phylib state machine and ignores the
fact that there are drivers that uses phylib but not the phylib state
machine. So let's don't change the behavior for such drivers and fix
it w/o re-adding state PHY_FORCING for the case that phylib state
machine is used.

[0] https://lore.kernel.org/netdev/a5c26ffd-4ee4-a5e6-4103-873208ce0dc5@huawei.com/T/

Fixes: 2bd229df5e2e ("net: phy: remove state PHY_FORCING")
Reported-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Tested-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/7b8b9456-a93f-abbc-1dc5-a2c2542f932c@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/phy.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 5ee7cde0c2e9..db7866b6f752 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -831,7 +831,12 @@ int phy_ethtool_ksettings_set(struct phy_device *phydev,
 	phydev->mdix_ctrl = cmd->base.eth_tp_mdix_ctrl;
 
 	/* Restart the PHY */
-	_phy_start_aneg(phydev);
+	if (phy_is_started(phydev)) {
+		phydev->state = PHY_UP;
+		phy_trigger_machine(phydev);
+	} else {
+		_phy_start_aneg(phydev);
+	}
 
 	mutex_unlock(&phydev->lock);
 	return 0;

From 6439b91fef2c5f49df7f4dbb9fe5c2f4317ab828 Mon Sep 17 00:00:00 2001
From: Huang Guobin <huangguobin4@huawei.com>
Date: Tue, 2 Nov 2021 17:37:33 +0800
Subject: [PATCH 1659/1750] bonding: Fix a use-after-free problem when
 bond_sysfs_slave_add() failed

[ Upstream commit b93c6a911a3fe926b00add28f3b932007827c4ca ]

When I do fuzz test for bonding device interface, I got the following
use-after-free Calltrace:

==================================================================
BUG: KASAN: use-after-free in bond_enslave+0x1521/0x24f0
Read of size 8 at addr ffff88825bc11c00 by task ifenslave/7365

CPU: 5 PID: 7365 Comm: ifenslave Tainted: G            E     5.15.0-rc1+ #13
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1 04/01/2014
Call Trace:
 dump_stack_lvl+0x6c/0x8b
 print_address_description.constprop.0+0x48/0x70
 kasan_report.cold+0x82/0xdb
 __asan_load8+0x69/0x90
 bond_enslave+0x1521/0x24f0
 bond_do_ioctl+0x3e0/0x450
 dev_ifsioc+0x2ba/0x970
 dev_ioctl+0x112/0x710
 sock_do_ioctl+0x118/0x1b0
 sock_ioctl+0x2e0/0x490
 __x64_sys_ioctl+0x118/0x150
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f19159cf577
Code: b3 66 90 48 8b 05 11 89 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 78
RSP: 002b:00007ffeb3083c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffeb3084bca RCX: 00007f19159cf577
RDX: 00007ffeb3083ce0 RSI: 0000000000008990 RDI: 0000000000000003
RBP: 00007ffeb3084bc4 R08: 0000000000000040 R09: 0000000000000000
R10: 00007ffeb3084bc0 R11: 0000000000000246 R12: 00007ffeb3083ce0
R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffeb3083cb0

Allocated by task 7365:
 kasan_save_stack+0x23/0x50
 __kasan_kmalloc+0x83/0xa0
 kmem_cache_alloc_trace+0x22e/0x470
 bond_enslave+0x2e1/0x24f0
 bond_do_ioctl+0x3e0/0x450
 dev_ifsioc+0x2ba/0x970
 dev_ioctl+0x112/0x710
 sock_do_ioctl+0x118/0x1b0
 sock_ioctl+0x2e0/0x490
 __x64_sys_ioctl+0x118/0x150
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 7365:
 kasan_save_stack+0x23/0x50
 kasan_set_track+0x20/0x30
 kasan_set_free_info+0x24/0x40
 __kasan_slab_free+0xf2/0x130
 kfree+0xd1/0x5c0
 slave_kobj_release+0x61/0x90
 kobject_put+0x102/0x180
 bond_sysfs_slave_add+0x7a/0xa0
 bond_enslave+0x11b6/0x24f0
 bond_do_ioctl+0x3e0/0x450
 dev_ifsioc+0x2ba/0x970
 dev_ioctl+0x112/0x710
 sock_do_ioctl+0x118/0x1b0
 sock_ioctl+0x2e0/0x490
 __x64_sys_ioctl+0x118/0x150
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Last potentially related work creation:
 kasan_save_stack+0x23/0x50
 kasan_record_aux_stack+0xb7/0xd0
 insert_work+0x43/0x190
 __queue_work+0x2e3/0x970
 delayed_work_timer_fn+0x3e/0x50
 call_timer_fn+0x148/0x470
 run_timer_softirq+0x8a8/0xc50
 __do_softirq+0x107/0x55f

Second to last potentially related work creation:
 kasan_save_stack+0x23/0x50
 kasan_record_aux_stack+0xb7/0xd0
 insert_work+0x43/0x190
 __queue_work+0x2e3/0x970
 __queue_delayed_work+0x130/0x180
 queue_delayed_work_on+0xa7/0xb0
 bond_enslave+0xe25/0x24f0
 bond_do_ioctl+0x3e0/0x450
 dev_ifsioc+0x2ba/0x970
 dev_ioctl+0x112/0x710
 sock_do_ioctl+0x118/0x1b0
 sock_ioctl+0x2e0/0x490
 __x64_sys_ioctl+0x118/0x150
 do_syscall_64+0x35/0xb0
 entry_SYSCALL_64_after_hwframe+0x44/0xae

The buggy address belongs to the object at ffff88825bc11c00
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes inside of
 1024-byte region [ffff88825bc11c00, ffff88825bc12000)
The buggy address belongs to the page:
page:ffffea00096f0400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25bc10
head:ffffea00096f0400 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000010200 ffffea0009a71c08 ffff888240001968 ffff88810004dbc0
raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88825bc11b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88825bc11b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88825bc11c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88825bc11c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88825bc11d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Put new_slave in bond_sysfs_slave_add() will cause use-after-free problems
when new_slave is accessed in the subsequent error handling process. Since
new_slave will be put in the subsequent error handling process, remove the
unnecessary put to fix it.
In addition, when sysfs_create_file() fails, if some files have been crea-
ted successfully, we need to call sysfs_remove_file() to remove them.
Since there are sysfs_create_files() & sysfs_remove_files() can be used,
use these two functions instead.

Fixes: 7afcaec49696 (bonding: use kobject_put instead of _del after kobject_add)
Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_sysfs_slave.c | 36 ++++++++------------------
 1 file changed, 11 insertions(+), 25 deletions(-)

diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
index fd07561da034..6a6cdd0bb258 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c
@@ -108,15 +108,15 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf)
 }
 static SLAVE_ATTR_RO(ad_partner_oper_port_state);
 
-static const struct slave_attribute *slave_attrs[] = {
-	&slave_attr_state,
-	&slave_attr_mii_status,
-	&slave_attr_link_failure_count,
-	&slave_attr_perm_hwaddr,
-	&slave_attr_queue_id,
-	&slave_attr_ad_aggregator_id,
-	&slave_attr_ad_actor_oper_port_state,
-	&slave_attr_ad_partner_oper_port_state,
+static const struct attribute *slave_attrs[] = {
+	&slave_attr_state.attr,
+	&slave_attr_mii_status.attr,
+	&slave_attr_link_failure_count.attr,
+	&slave_attr_perm_hwaddr.attr,
+	&slave_attr_queue_id.attr,
+	&slave_attr_ad_aggregator_id.attr,
+	&slave_attr_ad_actor_oper_port_state.attr,
+	&slave_attr_ad_partner_oper_port_state.attr,
 	NULL
 };
 
@@ -137,24 +137,10 @@ const struct sysfs_ops slave_sysfs_ops = {
 
 int bond_sysfs_slave_add(struct slave *slave)
 {
-	const struct slave_attribute **a;
-	int err;
-
-	for (a = slave_attrs; *a; ++a) {
-		err = sysfs_create_file(&slave->kobj, &((*a)->attr));
-		if (err) {
-			kobject_put(&slave->kobj);
-			return err;
-		}
-	}
-
-	return 0;
+	return sysfs_create_files(&slave->kobj, slave_attrs);
 }
 
 void bond_sysfs_slave_del(struct slave *slave)
 {
-	const struct slave_attribute **a;
-
-	for (a = slave_attrs; *a; ++a)
-		sysfs_remove_file(&slave->kobj, &((*a)->attr));
+	sysfs_remove_files(&slave->kobj, slave_attrs);
 }

From 300d874748166515581ea13030b4d2060ca5b3e0 Mon Sep 17 00:00:00 2001
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Date: Fri, 28 May 2021 07:51:26 -0400
Subject: [PATCH 1660/1750] mfd: core: Add missing of_node_put for loop
 iteration

[ Upstream commit 002be81140075e17a1ebd5c3c55e356fbab0ddad ]

Early exits from for_each_child_of_node() should decrement the
node reference counter.  Reported by Coccinelle:

  drivers/mfd/mfd-core.c:197:2-24: WARNING:
    Function "for_each_child_of_node" should have of_node_put() before goto around lines 209.

Fixes: c94bb233a9fe ("mfd: Make MFD core code Device Tree and IRQ domain aware")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20210528115126.18370-1-krzysztof.kozlowski@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mfd/mfd-core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index fc00aaccb5f7..a3a6faa99de0 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -210,6 +210,7 @@ static int mfd_add_device(struct device *parent, int id,
 			if (of_device_is_compatible(np, cell->of_compatible)) {
 				/* Ignore 'disabled' devices error free */
 				if (!of_device_is_available(np)) {
+					of_node_put(np);
 					ret = 0;
 					goto fail_alias;
 				}
@@ -217,6 +218,7 @@ static int mfd_add_device(struct device *parent, int id,
 				ret = mfd_match_of_node_to_dev(pdev, np, cell);
 				if (ret == -EAGAIN)
 					continue;
+				of_node_put(np);
 				if (ret)
 					goto fail_alias;
 

From a3c205c017f8996b0a706a908f4d8480296d6ec0 Mon Sep 17 00:00:00 2001
From: Marc Kleine-Budde <mkl@pengutronix.de>
Date: Tue, 19 Oct 2021 17:00:04 +0200
Subject: [PATCH 1661/1750] can: mcp251xfd: mcp251xfd_chip_start(): fix error
 handling for mcp251xfd_chip_rx_int_enable()

[ Upstream commit 69c55f6e7669d46bb40e41f6e2b218428178368a ]

This patch fixes the error handling for mcp251xfd_chip_rx_int_enable().
Instead just returning the error, properly shut down the chip.

Link: https://lore.kernel.org/all/20211106201526.44292-2-mkl@pengutronix.de
Fixes: 55e5b97f003e ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
index 68ff931993c2..4e13f6dfb91a 100644
--- a/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
+++ b/drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c
@@ -1041,7 +1041,7 @@ static int mcp251xfd_chip_start(struct mcp251xfd_priv *priv)
 
 	err = mcp251xfd_chip_rx_int_enable(priv);
 	if (err)
-		return err;
+		goto out_chip_stop;
 
 	err = mcp251xfd_chip_ecc_init(priv);
 	if (err)

From 64bde0c2db50c87df4dffd8c0e86443546a41844 Mon Sep 17 00:00:00 2001
From: Miaohe Lin <linmiaohe@huawei.com>
Date: Fri, 5 Nov 2021 13:45:03 -0700
Subject: [PATCH 1662/1750] mm/zsmalloc.c: close race window between
 zs_pool_dec_isolated() and zs_unregister_migration()

[ Upstream commit afe8605ca45424629fdddfd85984b442c763dc47 ]

There is one possible race window between zs_pool_dec_isolated() and
zs_unregister_migration() because wait_for_isolated_drain() checks the
isolated count without holding class->lock and there is no order inside
zs_pool_dec_isolated().  Thus the below race window could be possible:

  zs_pool_dec_isolated		zs_unregister_migration
    check pool->destroying != 0
				  pool->destroying = true;
				  smp_mb();
				  wait_for_isolated_drain()
				    wait for pool->isolated_pages == 0
    atomic_long_dec(&pool->isolated_pages);
    atomic_long_read(&pool->isolated_pages) == 0

Since we observe the pool->destroying (false) before atomic_long_dec()
for pool->isolated_pages, waking pool->migration_wait up is missed.

Fix this by ensure checking pool->destroying happens after the
atomic_long_dec(&pool->isolated_pages).

Link: https://lkml.kernel.org/r/20210708115027.7557-1-linmiaohe@huawei.com
Fixes: 701d678599d0 ("mm/zsmalloc.c: fix race condition in zs_destroy_pool")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Henry Burns <henryburns@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 mm/zsmalloc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 7a0b79b0a689..73cd50735df2 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -1835,10 +1835,11 @@ static inline void zs_pool_dec_isolated(struct zs_pool *pool)
 	VM_BUG_ON(atomic_long_read(&pool->isolated_pages) <= 0);
 	atomic_long_dec(&pool->isolated_pages);
 	/*
-	 * There's no possibility of racing, since wait_for_isolated_drain()
-	 * checks the isolated count under &class->lock after enqueuing
-	 * on migration_wait.
+	 * Checking pool->destroying must happen after atomic_long_dec()
+	 * for pool->isolated_pages above. Paired with the smp_mb() in
+	 * zs_unregister_migration().
 	 */
+	smp_mb__after_atomic();
 	if (atomic_long_read(&pool->isolated_pages) == 0 && pool->destroying)
 		wake_up_all(&pool->migration_wait);
 }

From 7091fcc75ff655435402609cbccf74ce36758730 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 5 Nov 2021 13:45:12 -0700
Subject: [PATCH 1663/1750] zram: off by one in read_block_state()

[ Upstream commit a88e03cf3d190cf46bc4063a9b7efe87590de5f4 ]

snprintf() returns the number of bytes it would have printed if there
were space.  But it does not count the NUL terminator.  So that means
that if "count == copied" then this has already overflowed by one
character.

This bug likely isn't super harmful in real life.

Link: https://lkml.kernel.org/r/20210916130404.GA25094@kili
Fixes: c0265342bff4 ("zram: introduce zram memory tracking")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/zram/zram_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 7dce17fd59ba..0636df6b67db 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -907,7 +907,7 @@ static ssize_t read_block_state(struct file *file, char __user *buf,
 			zram_test_flag(zram, index, ZRAM_HUGE) ? 'h' : '.',
 			zram_test_flag(zram, index, ZRAM_IDLE) ? 'i' : '.');
 
-		if (count < copied) {
+		if (count <= copied) {
 			zram_slot_unlock(zram, index);
 			break;
 		}

From b833274ae6d97294db0fcb55751c6f5b9af151df Mon Sep 17 00:00:00 2001
From: Ian Rogers <irogers@google.com>
Date: Fri, 5 Nov 2021 22:37:33 -0700
Subject: [PATCH 1664/1750] perf bpf: Add missing free to
 bpf_event__print_bpf_prog_info()

[ Upstream commit 88c42f4d6cb249eb68524282f8d4cc32f9059984 ]

If btf__new() is called then there needs to be a corresponding btf__free().

Fixes: f8dfeae009effc0b ("perf bpf: Show more BPF program info in print_bpf_prog_info()")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andrii Nakryiko <andrii@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
Cc: Yonghong Song <yhs@fb.com>
Cc: bpf@vger.kernel.org
Cc: netdev@vger.kernel.org
Link: http://lore.kernel.org/lkml/20211106053733.3580931-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/util/bpf-event.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 3742511a08d1..c8101575dbf4 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -557,7 +557,7 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
 		synthesize_bpf_prog_name(name, KSYM_NAME_LEN, info, btf, 0);
 		fprintf(fp, "# bpf_prog_info %u: %s addr 0x%llx size %u\n",
 			info->id, name, prog_addrs[0], prog_lens[0]);
-		return;
+		goto out;
 	}
 
 	fprintf(fp, "# bpf_prog_info %u:\n", info->id);
@@ -567,4 +567,6 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
 		fprintf(fp, "# \tsub_prog %u: %s addr 0x%llx size %u\n",
 			i, name, prog_addrs[i], prog_lens[i]);
 	}
+out:
+	btf__free(btf);
 }

From 9f0e683e1bd4b59c7866c564dd8dce700d7d5365 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Fri, 5 Nov 2021 14:42:14 -0700
Subject: [PATCH 1665/1750] llc: fix out-of-bound array index in
 llc_sk_dev_hash()

[ Upstream commit 8ac9dfd58b138f7e82098a4e0a0d46858b12215b ]

Both ifindex and LLC_SK_DEV_HASH_ENTRIES are signed.

This means that (ifindex % LLC_SK_DEV_HASH_ENTRIES) is negative
if @ifindex is negative.

We could simply make LLC_SK_DEV_HASH_ENTRIES unsigned.

In this patch I chose to use hash_32() to get more entropy
from @ifindex, like llc_sk_laddr_hashfn().

UBSAN: array-index-out-of-bounds in ./include/net/llc.h:75:26
index -43 is out of range for type 'hlist_head [64]'
CPU: 1 PID: 20999 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:291
 llc_sk_dev_hash include/net/llc.h:75 [inline]
 llc_sap_add_socket+0x49c/0x520 net/llc/llc_conn.c:697
 llc_ui_bind+0x680/0xd70 net/llc/af_llc.c:404
 __sys_bind+0x1e9/0x250 net/socket.c:1693
 __do_sys_bind net/socket.c:1704 [inline]
 __se_sys_bind net/socket.c:1702 [inline]
 __x64_sys_bind+0x6f/0xb0 net/socket.c:1702
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fa503407ae9

Fixes: 6d2e3ea28446 ("llc: use a device based hash table to speed up multicast delivery")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/llc.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/net/llc.h b/include/net/llc.h
index df282d9b4017..9c10b121b49b 100644
--- a/include/net/llc.h
+++ b/include/net/llc.h
@@ -72,7 +72,9 @@ struct llc_sap {
 static inline
 struct hlist_head *llc_sk_dev_hash(struct llc_sap *sap, int ifindex)
 {
-	return &sap->sk_dev_hash[ifindex % LLC_SK_DEV_HASH_ENTRIES];
+	u32 bucket = hash_32(ifindex, LLC_SK_DEV_HASH_BITS);
+
+	return &sap->sk_dev_hash[bucket];
 }
 
 static inline

From 727c812433b6087ddc48e519a614e4fe23c9c5c6 Mon Sep 17 00:00:00 2001
From: Chengfeng Ye <cyeaa@connect.ust.hk>
Date: Fri, 5 Nov 2021 06:36:36 -0700
Subject: [PATCH 1666/1750] nfc: pn533: Fix double free when
 pn533_fill_fragment_skbs() fails

[ Upstream commit 9fec40f850658e00a14a7dd9e06f7fbc7e59cc4a ]

skb is already freed by dev_kfree_skb in pn533_fill_fragment_skbs,
but follow error handler branch when pn533_fill_fragment_skbs()
fails, skb is freed again, results in double free issue. Fix this
by not free skb in error path of pn533_fill_fragment_skbs.

Fixes: 963a82e07d4e ("NFC: pn533: Split large Tx frames in chunks")
Fixes: 93ad42020c2d ("NFC: pn533: Target mode Tx fragmentation support")
Signed-off-by: Chengfeng Ye <cyeaa@connect.ust.hk>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nfc/pn533/pn533.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index 18e3435ab8f3..d2c011615775 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2258,7 +2258,7 @@ static int pn533_fill_fragment_skbs(struct pn533 *dev, struct sk_buff *skb)
 		frag = pn533_alloc_skb(dev, frag_size);
 		if (!frag) {
 			skb_queue_purge(&dev->fragment_skb);
-			break;
+			return -ENOMEM;
 		}
 
 		if (!dev->tgt_mode) {
@@ -2329,7 +2329,7 @@ static int pn533_transceive(struct nfc_dev *nfc_dev,
 		/* jumbo frame ? */
 		if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
 			rc = pn533_fill_fragment_skbs(dev, skb);
-			if (rc <= 0)
+			if (rc < 0)
 				goto error;
 
 			skb = skb_dequeue(&dev->fragment_skb);
@@ -2401,7 +2401,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
 	/* let's split in multiple chunks if size's too big */
 	if (skb->len > PN533_CMD_DATAEXCH_DATA_MAXLEN) {
 		rc = pn533_fill_fragment_skbs(dev, skb);
-		if (rc <= 0)
+		if (rc < 0)
 			goto error;
 
 		/* get the first skb */

From 0fe81d7a202d79fc2d03556ae284445733cb0946 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Fri, 5 Nov 2021 08:54:03 +0100
Subject: [PATCH 1667/1750] arm64: pgtable: make
 __pte_to_phys/__phys_to_pte_val inline functions

[ Upstream commit c7c386fbc20262c1d911c615c65db6a58667d92c ]

gcc warns about undefined behavior the vmalloc code when building
with CONFIG_ARM64_PA_BITS_52, when the 'idx++' in the argument to
__phys_to_pte_val() is evaluated twice:

mm/vmalloc.c: In function 'vmap_pfn_apply':
mm/vmalloc.c:2800:58: error: operation on 'data->idx' may be undefined [-Werror=sequence-point]
 2800 |         *pte = pte_mkspecial(pfn_pte(data->pfns[data->idx++], data->prot));
      |                                                 ~~~~~~~~~^~
arch/arm64/include/asm/pgtable-types.h:25:37: note: in definition of macro '__pte'
   25 | #define __pte(x)        ((pte_t) { (x) } )
      |                                     ^
arch/arm64/include/asm/pgtable.h:80:15: note: in expansion of macro '__phys_to_pte_val'
   80 |         __pte(__phys_to_pte_val((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot))
      |               ^~~~~~~~~~~~~~~~~
mm/vmalloc.c:2800:30: note: in expansion of macro 'pfn_pte'
 2800 |         *pte = pte_mkspecial(pfn_pte(data->pfns[data->idx++], data->prot));
      |                              ^~~~~~~

I have no idea why this never showed up earlier, but the safest
workaround appears to be changing those macros into inline functions
so the arguments get evaluated only once.

Cc: Matthew Wilcox <willy@infradead.org>
Fixes: 75387b92635e ("arm64: handle 52-bit physical addresses in page table entries")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211105075414.2553155-1-arnd@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/pgtable.h | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 10ffbc96ac31..f3a70dc7c594 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -69,9 +69,15 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
  * page table entry, taking care of 52-bit addresses.
  */
 #ifdef CONFIG_ARM64_PA_BITS_52
-#define __pte_to_phys(pte)	\
-	((pte_val(pte) & PTE_ADDR_LOW) | ((pte_val(pte) & PTE_ADDR_HIGH) << 36))
-#define __phys_to_pte_val(phys)	(((phys) | ((phys) >> 36)) & PTE_ADDR_MASK)
+static inline phys_addr_t __pte_to_phys(pte_t pte)
+{
+	return (pte_val(pte) & PTE_ADDR_LOW) |
+		((pte_val(pte) & PTE_ADDR_HIGH) << 36);
+}
+static inline pteval_t __phys_to_pte_val(phys_addr_t phys)
+{
+	return (phys | (phys >> 36)) & PTE_ADDR_MASK;
+}
 #else
 #define __pte_to_phys(pte)	(pte_val(pte) & PTE_ADDR_MASK)
 #define __phys_to_pte_val(phys)	(phys)

From 8b5c98a67c1b6a569957af64bb65ce39c5431d80 Mon Sep 17 00:00:00 2001
From: John Fastabend <john.fastabend@gmail.com>
Date: Wed, 3 Nov 2021 13:47:33 -0700
Subject: [PATCH 1668/1750] bpf, sockmap: Remove unhash handler for BPF sockmap
 usage

[ Upstream commit b8b8315e39ffaca82e79d86dde26e9144addf66b ]

We do not need to handle unhash from BPF side we can simply wait for the
close to happen. The original concern was a socket could transition from
ESTABLISHED state to a new state while the BPF hook was still attached.
But, we convinced ourself this is no longer possible and we also improved
BPF sockmap to handle listen sockets so this is no longer a problem.

More importantly though there are cases where unhash is called when data is
in the receive queue. The BPF unhash logic will flush this data which is
wrong. To be correct it should keep the data in the receive queue and allow
a receiving application to continue reading the data. This may happen when
tcp_abort() is received for example. Instead of complicating the logic in
unhash simply moving all this to tcp_close() hook solves this.

Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Jussi Maki <joamaki@gmail.com>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/20211103204736.248403-3-john.fastabend@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_bpf.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index 9194070c6725..6b745ce4108c 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -573,7 +573,6 @@ static void tcp_bpf_rebuild_protos(struct proto prot[TCP_BPF_NUM_CFGS],
 				   struct proto *base)
 {
 	prot[TCP_BPF_BASE]			= *base;
-	prot[TCP_BPF_BASE].unhash		= sock_map_unhash;
 	prot[TCP_BPF_BASE].close		= sock_map_close;
 	prot[TCP_BPF_BASE].recvmsg		= tcp_bpf_recvmsg;
 	prot[TCP_BPF_BASE].stream_memory_read	= tcp_bpf_stream_read;

From c842a4c4ae7fd604effbbb36bde7e1c251cb5c47 Mon Sep 17 00:00:00 2001
From: John Fastabend <john.fastabend@gmail.com>
Date: Wed, 3 Nov 2021 13:47:35 -0700
Subject: [PATCH 1669/1750] bpf: sockmap, strparser, and tls are reusing
 qdisc_skb_cb and colliding

[ Upstream commit e0dc3b93bd7bcff8c3813d1df43e0908499c7cf0 ]

Strparser is reusing the qdisc_skb_cb struct to stash the skb message handling
progress, e.g. offset and length of the skb. First this is poorly named and
inherits a struct from qdisc that doesn't reflect the actual usage of cb[] at
this layer.

But, more importantly strparser is using the following to access its metadata.

  (struct _strp_msg *)((void *)skb->cb + offsetof(struct qdisc_skb_cb, data))

Where _strp_msg is defined as:

  struct _strp_msg {
        struct strp_msg            strp;                 /*     0     8 */
        int                        accum_len;            /*     8     4 */

        /* size: 12, cachelines: 1, members: 2 */
        /* last cacheline: 12 bytes */
  };

So we use 12 bytes of ->data[] in struct. However in BPF code running parser
and verdict the user has read capabilities into the data[] array as well. Its
not too problematic, but we should not be exposing internal state to BPF
program. If its really needed then we can use the probe_read() APIs which allow
reading kernel memory. And I don't believe cb[] layer poses any API breakage by
moving this around because programs can't depend on cb[] across layers.

In order to fix another issue with a ctx rewrite we need to stash a temp
variable somewhere. To make this work cleanly this patch builds a cb struct
for sk_skb types called sk_skb_cb struct. Then we can use this consistently
in the strparser, sockmap space. Additionally we can start allowing ->cb[]
write access after this.

Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Jussi Maki <joamaki@gmail.com>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/20211103204736.248403-5-john.fastabend@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/strparser.h   | 16 +++++++++++++++-
 net/core/filter.c         | 21 +++++++++++++++++++++
 net/strparser/strparser.c | 10 +---------
 3 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/include/net/strparser.h b/include/net/strparser.h
index 1d20b98493a1..bec1439bd3be 100644
--- a/include/net/strparser.h
+++ b/include/net/strparser.h
@@ -54,10 +54,24 @@ struct strp_msg {
 	int offset;
 };
 
+struct _strp_msg {
+	/* Internal cb structure. struct strp_msg must be first for passing
+	 * to upper layer.
+	 */
+	struct strp_msg strp;
+	int accum_len;
+};
+
+struct sk_skb_cb {
+#define SK_SKB_CB_PRIV_LEN 20
+	unsigned char data[SK_SKB_CB_PRIV_LEN];
+	struct _strp_msg strp;
+};
+
 static inline struct strp_msg *strp_msg(struct sk_buff *skb)
 {
 	return (struct strp_msg *)((void *)skb->cb +
-		offsetof(struct qdisc_skb_cb, data));
+		offsetof(struct sk_skb_cb, strp));
 }
 
 /* Structure for an attached lower socket */
diff --git a/net/core/filter.c b/net/core/filter.c
index 7ea752af7894..abd58dce49bb 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -9493,6 +9493,27 @@ static u32 sk_skb_convert_ctx_access(enum bpf_access_type type,
 		*insn++ = BPF_LDX_MEM(BPF_SIZEOF(void *), si->dst_reg,
 				      si->src_reg, off);
 		break;
+	case offsetof(struct __sk_buff, cb[0]) ...
+	     offsetofend(struct __sk_buff, cb[4]) - 1:
+		BUILD_BUG_ON(sizeof_field(struct sk_skb_cb, data) < 20);
+		BUILD_BUG_ON((offsetof(struct sk_buff, cb) +
+			      offsetof(struct sk_skb_cb, data)) %
+			     sizeof(__u64));
+
+		prog->cb_access = 1;
+		off  = si->off;
+		off -= offsetof(struct __sk_buff, cb[0]);
+		off += offsetof(struct sk_buff, cb);
+		off += offsetof(struct sk_skb_cb, data);
+		if (type == BPF_WRITE)
+			*insn++ = BPF_STX_MEM(BPF_SIZE(si->code), si->dst_reg,
+					      si->src_reg, off);
+		else
+			*insn++ = BPF_LDX_MEM(BPF_SIZE(si->code), si->dst_reg,
+					      si->src_reg, off);
+		break;
+
+
 	default:
 		return bpf_convert_ctx_access(type, si, insn_buf, prog,
 					      target_size);
diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index b3815c1e8f2e..cd9954c4ad80 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -27,18 +27,10 @@
 
 static struct workqueue_struct *strp_wq;
 
-struct _strp_msg {
-	/* Internal cb structure. struct strp_msg must be first for passing
-	 * to upper layer.
-	 */
-	struct strp_msg strp;
-	int accum_len;
-};
-
 static inline struct _strp_msg *_strp_msg(struct sk_buff *skb)
 {
 	return (struct _strp_msg *)((void *)skb->cb +
-		offsetof(struct qdisc_skb_cb, data));
+		offsetof(struct sk_skb_cb, strp));
 }
 
 /* Lower lock held */

From 4af0cd17e72461ec03d59b6a4d7cc769bf41b546 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue, 9 Nov 2021 14:47:36 +0300
Subject: [PATCH 1670/1750] gve: Fix off by one in gve_tx_timeout()

[ Upstream commit 1c360cc1cc883fbdf0a258b4df376571fbeac5ee ]

The priv->ntfy_blocks[] has "priv->num_ntfy_blks" elements so this >
needs to be >= to prevent an off by one bug.  The priv->ntfy_blocks[]
array is allocated in gve_alloc_notify_blocks().

Fixes: 87a7f321bb6a ("gve: Recover from queue stall due to missed IRQ")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c
index 3e96b2a11c5b..6cb75bb1ed05 100644
--- a/drivers/net/ethernet/google/gve/gve_main.c
+++ b/drivers/net/ethernet/google/gve/gve_main.c
@@ -959,7 +959,7 @@ static void gve_tx_timeout(struct net_device *dev, unsigned int txqueue)
 		goto reset;
 
 	ntfy_idx = gve_tx_idx_to_ntfy(priv, txqueue);
-	if (ntfy_idx > priv->num_ntfy_blks)
+	if (ntfy_idx >= priv->num_ntfy_blks)
 		goto reset;
 
 	block = &priv->ntfy_blocks[ntfy_idx];

From b5703462a42805cb1a9611a7e0b421343e67ffda Mon Sep 17 00:00:00 2001
From: Muchun Song <songmuchun@bytedance.com>
Date: Mon, 8 Nov 2021 18:35:19 -0800
Subject: [PATCH 1671/1750] seq_file: fix passing wrong private data

[ Upstream commit 10a6de19cad6efb9b49883513afb810dc265fca2 ]

DEFINE_PROC_SHOW_ATTRIBUTE() is supposed to be used to define a series
of functions and variables to register proc file easily. And the users
can use proc_create_data() to pass their own private data and get it
via seq->private in the callback. Unfortunately, the proc file system
use PDE_DATA() to get private data instead of inode->i_private. So fix
it. Fortunately, there only one user of it which does not pass any
private data, so this bug does not break any in-tree codes.

Link: https://lkml.kernel.org/r/20211029032638.84884-1-songmuchun@bytedance.com
Fixes: 97a32539b956 ("proc: convert everything to "struct proc_ops"")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Florent Revest <revest@chromium.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/seq_file.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
index b83b3ae3c877..662a8cfa1bcd 100644
--- a/include/linux/seq_file.h
+++ b/include/linux/seq_file.h
@@ -182,7 +182,7 @@ static const struct file_operations __name ## _fops = {			\
 #define DEFINE_PROC_SHOW_ATTRIBUTE(__name)				\
 static int __name ## _open(struct inode *inode, struct file *file)	\
 {									\
-	return single_open(file, __name ## _show, inode->i_private);	\
+	return single_open(file, __name ## _show, PDE_DATA(inode));	\
 }									\
 									\
 static const struct proc_ops __name ## _proc_ops = {			\

From 79aa8706b45c110de1188bcca0212dc362b5d353 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Mon, 8 Nov 2021 10:08:15 -0800
Subject: [PATCH 1672/1750] net/sched: sch_taprio: fix undefined behavior in
 ktime_mono_to_any

[ Upstream commit 6dc25401cba4d428328eade8ceae717633fdd702 ]

1) if q->tk_offset == TK_OFFS_MAX, then get_tcp_tstamp() calls
   ktime_mono_to_any() with out-of-bound value.

2) if q->tk_offset is changed in taprio_parse_clockid(),
   taprio_get_time() might also call ktime_mono_to_any()
   with out-of-bound value as sysbot found:

UBSAN: array-index-out-of-bounds in kernel/time/timekeeping.c:908:27
index 3 is out of range for type 'ktime_t *[3]'
CPU: 1 PID: 25668 Comm: kworker/u4:0 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
 __ubsan_handle_out_of_bounds.cold+0x62/0x6c lib/ubsan.c:291
 ktime_mono_to_any+0x1d4/0x1e0 kernel/time/timekeeping.c:908
 get_tcp_tstamp net/sched/sch_taprio.c:322 [inline]
 get_packet_txtime net/sched/sch_taprio.c:353 [inline]
 taprio_enqueue_one+0x5b0/0x1460 net/sched/sch_taprio.c:420
 taprio_enqueue+0x3b1/0x730 net/sched/sch_taprio.c:485
 dev_qdisc_enqueue+0x40/0x300 net/core/dev.c:3785
 __dev_xmit_skb net/core/dev.c:3869 [inline]
 __dev_queue_xmit+0x1f6e/0x3630 net/core/dev.c:4194
 batadv_send_skb_packet+0x4a9/0x5f0 net/batman-adv/send.c:108
 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline]
 batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline]
 batadv_iv_send_outstanding_bat_ogm_packet+0x6d7/0x8e0 net/batman-adv/bat_iv_ogm.c:1701
 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
 kthread+0x405/0x4f0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Fixes: 7ede7b03484b ("taprio: make clock reference conversions easier")
Fixes: 54002066100b ("taprio: Adjust timestamps for TCP packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Vedang Patel <vedang.patel@intel.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reviewed-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
Link: https://lore.kernel.org/r/20211108180815.1822479-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_taprio.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c
index 93899559ba6d..806babdd838d 100644
--- a/net/sched/sch_taprio.c
+++ b/net/sched/sch_taprio.c
@@ -94,18 +94,22 @@ static ktime_t sched_base_time(const struct sched_gate_list *sched)
 	return ns_to_ktime(sched->base_time);
 }
 
-static ktime_t taprio_get_time(struct taprio_sched *q)
+static ktime_t taprio_mono_to_any(const struct taprio_sched *q, ktime_t mono)
 {
-	ktime_t mono = ktime_get();
+	/* This pairs with WRITE_ONCE() in taprio_parse_clockid() */
+	enum tk_offsets tk_offset = READ_ONCE(q->tk_offset);
 
-	switch (q->tk_offset) {
+	switch (tk_offset) {
 	case TK_OFFS_MAX:
 		return mono;
 	default:
-		return ktime_mono_to_any(mono, q->tk_offset);
+		return ktime_mono_to_any(mono, tk_offset);
 	}
+}
 
-	return KTIME_MAX;
+static ktime_t taprio_get_time(const struct taprio_sched *q)
+{
+	return taprio_mono_to_any(q, ktime_get());
 }
 
 static void taprio_free_sched_cb(struct rcu_head *head)
@@ -321,7 +325,7 @@ static ktime_t get_tcp_tstamp(struct taprio_sched *q, struct sk_buff *skb)
 		return 0;
 	}
 
-	return ktime_mono_to_any(skb->skb_mstamp_ns, q->tk_offset);
+	return taprio_mono_to_any(q, skb->skb_mstamp_ns);
 }
 
 /* There are a few scenarios where we will have to modify the txtime from
@@ -1341,6 +1345,7 @@ static int taprio_parse_clockid(struct Qdisc *sch, struct nlattr **tb,
 		}
 	} else if (tb[TCA_TAPRIO_ATTR_SCHED_CLOCKID]) {
 		int clockid = nla_get_s32(tb[TCA_TAPRIO_ATTR_SCHED_CLOCKID]);
+		enum tk_offsets tk_offset;
 
 		/* We only support static clockids and we don't allow
 		 * for it to be modified after the first init.
@@ -1355,22 +1360,24 @@ static int taprio_parse_clockid(struct Qdisc *sch, struct nlattr **tb,
 
 		switch (clockid) {
 		case CLOCK_REALTIME:
-			q->tk_offset = TK_OFFS_REAL;
+			tk_offset = TK_OFFS_REAL;
 			break;
 		case CLOCK_MONOTONIC:
-			q->tk_offset = TK_OFFS_MAX;
+			tk_offset = TK_OFFS_MAX;
 			break;
 		case CLOCK_BOOTTIME:
-			q->tk_offset = TK_OFFS_BOOT;
+			tk_offset = TK_OFFS_BOOT;
 			break;
 		case CLOCK_TAI:
-			q->tk_offset = TK_OFFS_TAI;
+			tk_offset = TK_OFFS_TAI;
 			break;
 		default:
 			NL_SET_ERR_MSG(extack, "Invalid 'clockid'");
 			err = -EINVAL;
 			goto out;
 		}
+		/* This pairs with READ_ONCE() in taprio_mono_to_any */
+		WRITE_ONCE(q->tk_offset, tk_offset);
 
 		q->clockid = clockid;
 	} else {

From ee11f16fee9528dd3cc0710847ada5403b02705d Mon Sep 17 00:00:00 2001
From: Yufeng Mo <moyufeng@huawei.com>
Date: Wed, 10 Nov 2021 21:42:53 +0800
Subject: [PATCH 1673/1750] net: hns3: fix kernel crash when unload VF while it
 is being reset

[ Upstream commit e140c7983e3054be0652bf914f4454f16c5520b0 ]

When fully configure VLANs for a VF, then unload the VF while
triggering a reset to PF, will cause a kernel crash because the
irq is already uninit.

[ 293.177579] ------------[ cut here ]------------
[ 293.183502] kernel BUG at drivers/pci/msi.c:352!
[ 293.189547] Internal error: Oops - BUG: 0 [#1] SMP
......
[ 293.390124] Workqueue: hclgevf hclgevf_service_task [hclgevf]
[ 293.402627] pstate: 80c00009 (Nzcv daif +PAN +UAO)
[ 293.414324] pc : free_msi_irqs+0x19c/0x1b8
[ 293.425429] lr : free_msi_irqs+0x18c/0x1b8
[ 293.436545] sp : ffff00002716fbb0
[ 293.446950] x29: ffff00002716fbb0 x28: 0000000000000000
[ 293.459519] x27: 0000000000000000 x26: ffff45b91ea16b00
[ 293.472183] x25: 0000000000000000 x24: ffffa587b08f4700
[ 293.484717] x23: ffffc591ac30e000 x22: ffffa587b08f8428
[ 293.497190] x21: ffffc591ac30e300 x20: 0000000000000000
[ 293.509594] x19: ffffa58a062a8300 x18: 0000000000000000
[ 293.521949] x17: 0000000000000000 x16: ffff45b91dcc3f48
[ 293.534013] x15: 0000000000000000 x14: 0000000000000000
[ 293.545883] x13: 0000000000000040 x12: 0000000000000228
[ 293.557508] x11: 0000000000000020 x10: 0000000000000040
[ 293.568889] x9 : ffff45b91ea1e190 x8 : ffffc591802d0000
[ 293.580123] x7 : ffffc591802d0148 x6 : 0000000000000120
[ 293.591190] x5 : ffffc591802d0000 x4 : 0000000000000000
[ 293.602015] x3 : 0000000000000000 x2 : 0000000000000000
[ 293.612624] x1 : 00000000000004a4 x0 : ffffa58a1e0c6b80
[ 293.623028] Call trace:
[ 293.630340] free_msi_irqs+0x19c/0x1b8
[ 293.638849] pci_disable_msix+0x118/0x140
[ 293.647452] pci_free_irq_vectors+0x20/0x38
[ 293.656081] hclgevf_uninit_msi+0x44/0x58 [hclgevf]
[ 293.665309] hclgevf_reset_rebuild+0x1ac/0x2e0 [hclgevf]
[ 293.674866] hclgevf_reset+0x358/0x400 [hclgevf]
[ 293.683545] hclgevf_reset_service_task+0xd0/0x1b0 [hclgevf]
[ 293.693325] hclgevf_service_task+0x4c/0x2e8 [hclgevf]
[ 293.702307] process_one_work+0x1b0/0x448
[ 293.710034] worker_thread+0x54/0x468
[ 293.717331] kthread+0x134/0x138
[ 293.724114] ret_from_fork+0x10/0x18
[ 293.731324] Code: f940b000 b4ffff00 a903e7b8 f90017b6 (d4210000)

This patch fixes the problem by waiting for the VF reset done
while unloading the VF.

Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 5 +++++
 drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
index a47f23f27a11..e27af38f6b16 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
@@ -2887,7 +2887,10 @@ static void hclgevf_uninit_client_instance(struct hnae3_client *client,
 
 	/* un-init roce, if it exists */
 	if (hdev->roce_client) {
+		while (test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state))
+			msleep(HCLGEVF_WAIT_RESET_DONE);
 		clear_bit(HCLGEVF_STATE_ROCE_REGISTERED, &hdev->state);
+
 		hdev->roce_client->ops->uninit_instance(&hdev->roce, 0);
 		hdev->roce_client = NULL;
 		hdev->roce.client = NULL;
@@ -2896,6 +2899,8 @@ static void hclgevf_uninit_client_instance(struct hnae3_client *client,
 	/* un-init nic/unic, if this was not called by roce client */
 	if (client->ops->uninit_instance && hdev->nic_client &&
 	    client->type != HNAE3_CLIENT_ROCE) {
+		while (test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state))
+			msleep(HCLGEVF_WAIT_RESET_DONE);
 		clear_bit(HCLGEVF_STATE_NIC_REGISTERED, &hdev->state);
 
 		client->ops->uninit_instance(&hdev->nic, 0);
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
index 526a62f97046..c9b0fa5e8589 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h
@@ -106,6 +106,8 @@
 #define HCLGEVF_VF_RST_ING		0x07008
 #define HCLGEVF_VF_RST_ING_BIT		BIT(16)
 
+#define HCLGEVF_WAIT_RESET_DONE		100
+
 #define HCLGEVF_RSS_IND_TBL_SIZE		512
 #define HCLGEVF_RSS_SET_BITMAP_MSK	0xffff
 #define HCLGEVF_RSS_KEY_SIZE		40

From b30459c0ca0dce0db6168bcbfb640763734faacf Mon Sep 17 00:00:00 2001
From: Guangbin Huang <huangguangbin2@huawei.com>
Date: Wed, 10 Nov 2021 21:42:56 +0800
Subject: [PATCH 1674/1750] net: hns3: allow configure ETS bandwidth of all TCs

[ Upstream commit 688db0c7a4a69ddc8b8143a1cac01eb20082a3aa ]

Currently, driver only allow configuring ETS bandwidth of TCs according
to the max TC number queried from firmware. However, the hardware actually
supports 8 TCs and users may need to configure ETS bandwidth of all TCs,
so remove the restriction.

Fixes: 330baff5423b ("net: hns3: add ETS TC weight setting in SSU module")
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c  | 9 +--------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
index 8e6085753b9f..5bab885744fc 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
@@ -126,7 +126,7 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
 	if (ret)
 		return ret;
 
-	for (i = 0; i < hdev->tc_max; i++) {
+	for (i = 0; i < HNAE3_MAX_TC; i++) {
 		switch (ets->tc_tsa[i]) {
 		case IEEE_8021QAZ_TSA_STRICT:
 			if (hdev->tm_info.tc_info[i].tc_sch_mode !=
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
index 71aa6d16fc19..9168e39b6364 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
@@ -1039,7 +1039,6 @@ static int hclge_tm_pri_tc_base_dwrr_cfg(struct hclge_dev *hdev)
 
 static int hclge_tm_ets_tc_dwrr_cfg(struct hclge_dev *hdev)
 {
-#define DEFAULT_TC_WEIGHT	1
 #define DEFAULT_TC_OFFSET	14
 
 	struct hclge_ets_tc_weight_cmd *ets_weight;
@@ -1052,13 +1051,7 @@ static int hclge_tm_ets_tc_dwrr_cfg(struct hclge_dev *hdev)
 	for (i = 0; i < HNAE3_MAX_TC; i++) {
 		struct hclge_pg_info *pg_info;
 
-		ets_weight->tc_weight[i] = DEFAULT_TC_WEIGHT;
-
-		if (!(hdev->hw_tc_map & BIT(i)))
-			continue;
-
-		pg_info =
-			&hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid];
+		pg_info = &hdev->tm_info.pg_info[hdev->tm_info.tc_info[i].pgid];
 		ets_weight->tc_weight[i] = pg_info->tc_dwrr[i];
 	}
 

From ad3d219e843df0abcb5ee390b9cf416216db13e2 Mon Sep 17 00:00:00 2001
From: Vladimir Oltean <vladimir.oltean@nxp.com>
Date: Mon, 8 Nov 2021 22:28:54 +0200
Subject: [PATCH 1675/1750] net: stmmac: allow a tc-taprio base-time of zero

[ Upstream commit f64ab8e4f368f48afb08ae91928e103d17b235e9 ]

Commit fe28c53ed71d ("net: stmmac: fix taprio configuration when
base_time is in the past") allowed some base time values in the past,
but apparently not all, the base-time value of 0 (Jan 1st 1970) is still
explicitly denied by the driver.

Remove the bogus check.

Fixes: b60189e0392f ("net: stmmac: Integrate EST with TAPRIO scheduler API")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
index 639980306115..43165c662740 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
@@ -679,8 +679,6 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
 		goto disable;
 	if (qopt->num_entries >= dep)
 		return -EINVAL;
-	if (!qopt->base_time)
-		return -ERANGE;
 	if (!qopt->cycle_time)
 		return -ERANGE;
 

From 7e03b797bee0b9da2d329c3edbc6937062f01215 Mon Sep 17 00:00:00 2001
From: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Date: Tue, 9 Nov 2021 00:15:02 +0000
Subject: [PATCH 1676/1750] vsock: prevent unnecessary refcnt inc for
 nonblocking connect

[ Upstream commit c7cd82b90599fa10915f41e3dd9098a77d0aa7b6 ]

Currently vosck_connect() increments sock refcount for nonblocking
socket each time it's called, which can lead to memory leak if
it's called multiple times because connect timeout function decrements
sock refcount only once.

Fixes it by making vsock_connect() return -EALREADY immediately when
sock state is already SS_CONNECTING.

Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/vmw_vsock/af_vsock.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 326250513570..7fe36dbcbe18 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1279,6 +1279,8 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
 		 * non-blocking call.
 		 */
 		err = -EALREADY;
+		if (flags & O_NONBLOCK)
+			goto out;
 		break;
 	default:
 		if ((sk->sk_state == TCP_LISTEN) ||

From 93bc3ef607589354d411302c57ff08e666ceefe9 Mon Sep 17 00:00:00 2001
From: Dust Li <dust.li@linux.alibaba.com>
Date: Wed, 10 Nov 2021 15:02:34 +0800
Subject: [PATCH 1677/1750] net/smc: fix sk_refcnt underflow on linkdown and
 fallback

[ Upstream commit e5d5aadcf3cd59949316df49c27cb21788d7efe4 ]

We got the following WARNING when running ab/nginx
test with RDMA link flapping (up-down-up).
The reason is when smc_sock fallback and at linkdown
happens simultaneously, we may got the following situation:

__smc_lgr_terminate()
 --> smc_conn_kill()
    --> smc_close_active_abort()
           smc_sock->sk_state = SMC_CLOSED
           sock_put(smc_sock)

smc_sock was set to SMC_CLOSED and sock_put() been called
when terminate the link group. But later application call
close() on the socket, then we got:

__smc_release():
    if (smc_sock->fallback)
        smc_sock->sk_state = SMC_CLOSED
        sock_put(smc_sock)

Again we set the smc_sock to CLOSED through it's already
in CLOSED state, and double put the refcnt, so the following
warning happens:

refcount_t: underflow; use-after-free.
WARNING: CPU: 5 PID: 860 at lib/refcount.c:28 refcount_warn_saturate+0x8d/0xf0
Modules linked in:
CPU: 5 PID: 860 Comm: nginx Not tainted 5.10.46+ #403
Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/01/2014
RIP: 0010:refcount_warn_saturate+0x8d/0xf0
Code: 05 5c 1e b5 01 01 e8 52 25 bc ff 0f 0b c3 80 3d 4f 1e b5 01 00 75 ad 48

RSP: 0018:ffffc90000527e50 EFLAGS: 00010286
RAX: 0000000000000026 RBX: ffff8881300df2c0 RCX: 0000000000000027
RDX: 0000000000000000 RSI: ffff88813bd58040 RDI: ffff88813bd58048
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000001
R10: ffff8881300df2c0 R11: ffffc90000527c78 R12: ffff8881300df340
R13: ffff8881300df930 R14: ffff88810b3dad80 R15: ffff8881300df4f8
FS:  00007f739de8fb80(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000a01b008 CR3: 0000000111b64003 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 smc_release+0x353/0x3f0
 __sock_release+0x3d/0xb0
 sock_close+0x11/0x20
 __fput+0x93/0x230
 task_work_run+0x65/0xa0
 exit_to_user_mode_prepare+0xf9/0x100
 syscall_exit_to_user_mode+0x27/0x190
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

This patch adds check in __smc_release() to make
sure we won't do an extra sock_put() and set the
socket to CLOSED when its already in CLOSED state.

Fixes: 51f1de79ad8e (net/smc: replace sock_put worker by socket refcounting)
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Acked-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/smc/af_smc.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
index cc2af94e7450..cfb5b9be0569 100644
--- a/net/smc/af_smc.c
+++ b/net/smc/af_smc.c
@@ -146,14 +146,18 @@ static int __smc_release(struct smc_sock *smc)
 		sock_set_flag(sk, SOCK_DEAD);
 		sk->sk_shutdown |= SHUTDOWN_MASK;
 	} else {
-		if (sk->sk_state != SMC_LISTEN && sk->sk_state != SMC_INIT)
-			sock_put(sk); /* passive closing */
-		if (sk->sk_state == SMC_LISTEN) {
-			/* wake up clcsock accept */
-			rc = kernel_sock_shutdown(smc->clcsock, SHUT_RDWR);
+		if (sk->sk_state != SMC_CLOSED) {
+			if (sk->sk_state != SMC_LISTEN &&
+			    sk->sk_state != SMC_INIT)
+				sock_put(sk); /* passive closing */
+			if (sk->sk_state == SMC_LISTEN) {
+				/* wake up clcsock accept */
+				rc = kernel_sock_shutdown(smc->clcsock,
+							  SHUT_RDWR);
+			}
+			sk->sk_state = SMC_CLOSED;
+			sk->sk_state_change(sk);
 		}
-		sk->sk_state = SMC_CLOSED;
-		sk->sk_state_change(sk);
 		smc_restore_fallback_changes(smc);
 	}
 

From 8b215edb7a38c4fdf78ef94a0704694c59e6f8d4 Mon Sep 17 00:00:00 2001
From: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
Date: Thu, 11 Nov 2021 15:55:16 +0530
Subject: [PATCH 1678/1750] cxgb4: fix eeprom len when diagnostics not
 implemented

[ Upstream commit 4ca110bf8d9b31a60f8f8ff6706ea147d38ad97c ]

Ensure diagnostics monitoring support is implemented for the SFF 8472
compliant port module and set the correct length for ethtool port
module eeprom read.

Fixes: f56ec6766dcf ("cxgb4: Add support for ethtool i2c dump")
Signed-off-by: Manoj Malviya <manojmalviya@chelsio.com>
Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 7 +++++--
 drivers/net/ethernet/chelsio/cxgb4/t4_hw.h         | 2 ++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
index 83ed10ac8660..7080cb6c83e4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c
@@ -2011,12 +2011,15 @@ static int cxgb4_get_module_info(struct net_device *dev,
 		if (ret)
 			return ret;
 
-		if (!sff8472_comp || (sff_diag_type & 4)) {
+		if (!sff8472_comp || (sff_diag_type & SFP_DIAG_ADDRMODE)) {
 			modinfo->type = ETH_MODULE_SFF_8079;
 			modinfo->eeprom_len = ETH_MODULE_SFF_8079_LEN;
 		} else {
 			modinfo->type = ETH_MODULE_SFF_8472;
-			modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+			if (sff_diag_type & SFP_DIAG_IMPLEMENTED)
+				modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+			else
+				modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN / 2;
 		}
 		break;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
index 002fc62ea726..63bc956d2037 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.h
@@ -293,6 +293,8 @@ enum {
 #define I2C_PAGE_SIZE		0x100
 #define SFP_DIAG_TYPE_ADDR	0x5c
 #define SFP_DIAG_TYPE_LEN	0x1
+#define SFP_DIAG_ADDRMODE	BIT(2)
+#define SFP_DIAG_IMPLEMENTED	BIT(6)
 #define SFF_8472_COMP_ADDR	0x5e
 #define SFF_8472_COMP_LEN	0x1
 #define SFF_REV_ADDR		0x1

From ee79560cb768ef56d91452868d01888e97373ccb Mon Sep 17 00:00:00 2001
From: Willem de Bruijn <willemb@google.com>
Date: Thu, 11 Nov 2021 06:57:17 -0500
Subject: [PATCH 1679/1750] selftests/net: udpgso_bench_rx: fix port argument

[ Upstream commit d336509cb9d03970911878bb77f0497f64fda061 ]

The below commit added optional support for passing a bind address.
It configures the sockaddr bind arguments before parsing options and
reconfigures on options -b and -4.

This broke support for passing port (-p) on its own.

Configure sockaddr after parsing all arguments.

Fixes: 3327a9c46352 ("selftests: add functionals test for UDP GRO")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/net/udpgso_bench_rx.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c
index 76a24052f4b4..6a193425c367 100644
--- a/tools/testing/selftests/net/udpgso_bench_rx.c
+++ b/tools/testing/selftests/net/udpgso_bench_rx.c
@@ -293,19 +293,17 @@ static void usage(const char *filepath)
 
 static void parse_opts(int argc, char **argv)
 {
+	const char *bind_addr = NULL;
 	int c;
 
-	/* bind to any by default */
-	setup_sockaddr(PF_INET6, "::", &cfg_bind_addr);
 	while ((c = getopt(argc, argv, "4b:C:Gl:n:p:rR:S:tv")) != -1) {
 		switch (c) {
 		case '4':
 			cfg_family = PF_INET;
 			cfg_alen = sizeof(struct sockaddr_in);
-			setup_sockaddr(PF_INET, "0.0.0.0", &cfg_bind_addr);
 			break;
 		case 'b':
-			setup_sockaddr(cfg_family, optarg, &cfg_bind_addr);
+			bind_addr = optarg;
 			break;
 		case 'C':
 			cfg_connect_timeout_ms = strtoul(optarg, NULL, 0);
@@ -341,6 +339,11 @@ static void parse_opts(int argc, char **argv)
 		}
 	}
 
+	if (!bind_addr)
+		bind_addr = cfg_family == PF_INET6 ? "::" : "0.0.0.0";
+
+	setup_sockaddr(cfg_family, bind_addr, &cfg_bind_addr);
+
 	if (optind != argc)
 		usage(argv[0]);
 

From 03f2578153eb09b386ef237be4cb285f3389f8fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
Date: Thu, 4 Nov 2021 17:28:28 +0100
Subject: [PATCH 1680/1750] ARM: 9155/1: fix early early_iounmap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 0d08e7bf0d0d1a29aff7b16ef516f7415eb1aa05 upstream.

Currently __set_fixmap() bails out with a warning when called in early boot
from early_iounmap(). Fix it, and while at it, make the comment a bit easier
to understand.

Cc: <stable@vger.kernel.org>
Fixes: b089c31c519c ("ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap")
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/mm/mmu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index fa259825310c..4df688f41072 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -391,9 +391,9 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot)
 		     FIXADDR_END);
 	BUG_ON(idx >= __end_of_fixed_addresses);
 
-	/* we only support device mappings until pgprot_kernel has been set */
+	/* We support only device mappings before pgprot_kernel is set. */
 	if (WARN_ON(pgprot_val(prot) != pgprot_val(FIXMAP_PAGE_IO) &&
-		    pgprot_val(pgprot_kernel) == 0))
+		    pgprot_val(prot) && pgprot_val(pgprot_kernel) == 0))
 		return;
 
 	if (pgprot_val(prot))

From 241c74cc655540fd34df083832e40fb6050d70b5 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Sat, 6 Nov 2021 19:42:29 +0100
Subject: [PATCH 1681/1750] ARM: 9156/1: drop cc-option fallbacks for
 architecture selection

commit 418ace9992a7647c446ed3186df40cf165b67298 upstream.

Naresh and Antonio ran into a build failure with latest Debian
armhf compilers, with lots of output like

 tmp/ccY3nOAs.s:2215: Error: selected processor does not support `cpsid i' in ARM mode

As it turns out, $(cc-option) fails early here when the FPU is not
selected before CPU architecture is selected, as the compiler
option check runs before enabling -msoft-float, which causes
a problem when testing a target architecture level without an FPU:

cc1: error: '-mfloat-abi=hard': selected architecture lacks an FPU

Passing e.g. -march=armv6k+fp in place of -march=armv6k would avoid this
issue, but the fallback logic is already broken because all supported
compilers (gcc-5 and higher) are much more recent than these options,
and building with -march=armv5t as a fallback no longer works.

The best way forward that I see is to just remove all the checks, which
also has the nice side-effect of slightly improving the startup time for
'make'.

The -mtune=marvell-f option was apparently never supported by any mainline
compiler, and the custom Codesourcery gcc build that did support is
now too old to build kernels, so just use -mtune=xscale unconditionally
for those.

This should be safe to apply on all stable kernels, and will be required
in order to keep building them with gcc-11 and higher.

Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996419

Reported-by: Antonio Terceiro <antonio.terceiro@linaro.org>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Reported-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Cc: Matthias Klose <doko@debian.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/Makefile | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index e15f76ca2887..0e5a8765e60b 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -60,15 +60,15 @@ KBUILD_CFLAGS	+= $(call cc-option,-fno-ipa-sra)
 # Note that GCC does not numerically define an architecture version
 # macro, but instead defines a whole series of macros which makes
 # testing for a specific architecture or later rather impossible.
-arch-$(CONFIG_CPU_32v7M)	=-D__LINUX_ARM_ARCH__=7 -march=armv7-m -Wa,-march=armv7-m
-arch-$(CONFIG_CPU_32v7)		=-D__LINUX_ARM_ARCH__=7 $(call cc-option,-march=armv7-a,-march=armv5t -Wa$(comma)-march=armv7-a)
-arch-$(CONFIG_CPU_32v6)		=-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6,-march=armv5t -Wa$(comma)-march=armv6)
+arch-$(CONFIG_CPU_32v7M)	=-D__LINUX_ARM_ARCH__=7 -march=armv7-m
+arch-$(CONFIG_CPU_32v7)		=-D__LINUX_ARM_ARCH__=7 -march=armv7-a
+arch-$(CONFIG_CPU_32v6)		=-D__LINUX_ARM_ARCH__=6 -march=armv6
 # Only override the compiler option if ARMv6. The ARMv6K extensions are
 # always available in ARMv7
 ifeq ($(CONFIG_CPU_32v6),y)
-arch-$(CONFIG_CPU_32v6K)	=-D__LINUX_ARM_ARCH__=6 $(call cc-option,-march=armv6k,-march=armv5t -Wa$(comma)-march=armv6k)
+arch-$(CONFIG_CPU_32v6K)	=-D__LINUX_ARM_ARCH__=6 -march=armv6k
 endif
-arch-$(CONFIG_CPU_32v5)		=-D__LINUX_ARM_ARCH__=5 $(call cc-option,-march=armv5te,-march=armv4t)
+arch-$(CONFIG_CPU_32v5)		=-D__LINUX_ARM_ARCH__=5 -march=armv5te
 arch-$(CONFIG_CPU_32v4T)	=-D__LINUX_ARM_ARCH__=4 -march=armv4t
 arch-$(CONFIG_CPU_32v4)		=-D__LINUX_ARM_ARCH__=4 -march=armv4
 arch-$(CONFIG_CPU_32v3)		=-D__LINUX_ARM_ARCH__=3 -march=armv3m
@@ -82,7 +82,7 @@ tune-$(CONFIG_CPU_ARM720T)	=-mtune=arm7tdmi
 tune-$(CONFIG_CPU_ARM740T)	=-mtune=arm7tdmi
 tune-$(CONFIG_CPU_ARM9TDMI)	=-mtune=arm9tdmi
 tune-$(CONFIG_CPU_ARM940T)	=-mtune=arm9tdmi
-tune-$(CONFIG_CPU_ARM946E)	=$(call cc-option,-mtune=arm9e,-mtune=arm9tdmi)
+tune-$(CONFIG_CPU_ARM946E)	=-mtune=arm9e
 tune-$(CONFIG_CPU_ARM920T)	=-mtune=arm9tdmi
 tune-$(CONFIG_CPU_ARM922T)	=-mtune=arm9tdmi
 tune-$(CONFIG_CPU_ARM925T)	=-mtune=arm9tdmi
@@ -90,11 +90,11 @@ tune-$(CONFIG_CPU_ARM926T)	=-mtune=arm9tdmi
 tune-$(CONFIG_CPU_FA526)	=-mtune=arm9tdmi
 tune-$(CONFIG_CPU_SA110)	=-mtune=strongarm110
 tune-$(CONFIG_CPU_SA1100)	=-mtune=strongarm1100
-tune-$(CONFIG_CPU_XSCALE)	=$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale
-tune-$(CONFIG_CPU_XSC3)		=$(call cc-option,-mtune=xscale,-mtune=strongarm110) -Wa,-mcpu=xscale
-tune-$(CONFIG_CPU_FEROCEON)	=$(call cc-option,-mtune=marvell-f,-mtune=xscale)
-tune-$(CONFIG_CPU_V6)		=$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm)
-tune-$(CONFIG_CPU_V6K)		=$(call cc-option,-mtune=arm1136j-s,-mtune=strongarm)
+tune-$(CONFIG_CPU_XSCALE)	=-mtune=xscale
+tune-$(CONFIG_CPU_XSC3)		=-mtune=xscale
+tune-$(CONFIG_CPU_FEROCEON)	=-mtune=xscale
+tune-$(CONFIG_CPU_V6)		=-mtune=arm1136j-s
+tune-$(CONFIG_CPU_V6K)		=-mtune=arm1136j-s
 
 # Evaluate tune cc-option calls now
 tune-y := $(tune-y)

From fc42bbb7827be96c4a77c5ff490b84316c5f963b Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Thu, 4 Nov 2021 20:19:00 +0100
Subject: [PATCH 1682/1750] parisc: Fix backtrace to always include init
 funtion names

commit 279917e27edc293eb645a25428c6ab3f3bca3f86 upstream.

I noticed that sometimes at kernel startup the backtraces did not
included the function names of init functions. Their address were not
resolved to function names and instead only the address was printed.

Debugging shows that the culprit is is_ksym_addr() which is called
by the backtrace functions to check if an address belongs to a function in
the kernel. The problem occurs only for CONFIG_KALLSYMS_ALL=y.

When looking at is_ksym_addr() one can see that for CONFIG_KALLSYMS_ALL=y
the function only tries to resolve the address via is_kernel() function,
which checks like this:
	if (addr >= _stext && addr <= _end)
                return 1;
On parisc the init functions are located before _stext, so this check fails.
Other platforms seem to have all functions (including init functions)
behind _stext.

The following patch moves the _stext symbol at the beginning of the
kernel and thus includes the init section. This fixes the check and does
not seem to have any negative side effects on where the kernel mapping
happens in the map_pages() function in arch/parisc/mm/init.c.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@kernel.org # 5.4+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/vmlinux.lds.S | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index 2769eb991f58..3d208afd15bc 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -57,6 +57,8 @@ SECTIONS
 {
 	. = KERNEL_BINARY_TEXT_START;
 
+	_stext = .;	/* start of kernel text, includes init code & data */
+
 	__init_begin = .;
 	HEAD_TEXT_SECTION
 	MLONGCALL_DISCARD(INIT_TEXT_SECTION(8))
@@ -80,7 +82,6 @@ SECTIONS
 	/* freed after init ends here */
 
 	_text = .;		/* Text and read-only data */
-	_stext = .;
 	MLONGCALL_KEEP(INIT_TEXT_SECTION(8))
 	.text ALIGN(PAGE_SIZE) : {
 		TEXT_TEXT

From 1ee5bc2ba83f49dfcae9329cd531a2797af134a7 Mon Sep 17 00:00:00 2001
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
Date: Fri, 22 Oct 2021 00:58:23 +0200
Subject: [PATCH 1683/1750] MIPS: Fix assembly error from MIPSr2 code used
 within MIPS_ISA_ARCH_LEVEL

commit a923a2676e60683aee46aa4b93c30aff240ac20d upstream.

Fix assembly errors like:

{standard input}: Assembler messages:
{standard input}:287: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32'
{standard input}:680: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32'
{standard input}:1274: Error: opcode not supported on this processor: mips3 (mips3) `dins $12,$9,32,32'
{standard input}:2175: Error: opcode not supported on this processor: mips3 (mips3) `dins $10,$7,32,32'
make[1]: *** [scripts/Makefile.build:277: mm/highmem.o] Error 1

with code produced from `__cmpxchg64' for MIPS64r2 CPU configurations
using CONFIG_32BIT and CONFIG_PHYS_ADDR_T_64BIT.

This is due to MIPS_ISA_ARCH_LEVEL downgrading the assembly architecture
to `r4000' i.e. MIPS III for MIPS64r2 configurations, while there is a
block of code containing a DINS MIPS64r2 instruction conditionalized on
MIPS_ISA_REV >= 2 within the scope of the downgrade.

The assembly architecture override code pattern has been put there for
LL/SC instructions, so that code compiles for configurations that select
a processor to build for that does not support these instructions while
still providing run-time support for processors that do, dynamically
switched by non-constant `cpu_has_llsc'.  It went in with linux-mips.org
commit aac8aa7717a2 ("Enable a suitable ISA for the assembler around
ll/sc so that code builds even for processors that don't support the
instructions. Plus minor formatting fixes.") back in 2005.

Fix the problem by wrapping these instructions along with the adjacent
SYNC instructions only, following the practice established with commit
cfd54de3b0e4 ("MIPS: Avoid move psuedo-instruction whilst using
MIPS_ISA_LEVEL") and commit 378ed6f0e3c5 ("MIPS: Avoid using .set mips0
to restore ISA").  Strictly speaking the SYNC instructions do not have
to be wrapped as they are only used as a Loongson3 erratum workaround,
so they will be enabled in the assembler by default, but do this so as
to keep code consistent with other places.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: c7e2d71dda7a ("MIPS: Fix set_pte() for Netlogic XLR using cmpxchg64()")
Cc: stable@vger.kernel.org # v5.1+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/mips/include/asm/cmpxchg.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/cmpxchg.h b/arch/mips/include/asm/cmpxchg.h
index ed8f3f3c4304..3e9c41f69165 100644
--- a/arch/mips/include/asm/cmpxchg.h
+++ b/arch/mips/include/asm/cmpxchg.h
@@ -249,6 +249,7 @@ static inline unsigned long __cmpxchg64(volatile void *ptr,
 	/* Load 64 bits from ptr */
 	"	" __SYNC(full, loongson3_war) "		\n"
 	"1:	lld	%L0, %3		# __cmpxchg64	\n"
+	"	.set	pop				\n"
 	/*
 	 * Split the 64 bit value we loaded into the 2 registers that hold the
 	 * ret variable.
@@ -276,12 +277,14 @@ static inline unsigned long __cmpxchg64(volatile void *ptr,
 	"	or	%L1, %L1, $at			\n"
 	"	.set	at				\n"
 #  endif
+	"	.set	push				\n"
+	"	.set	" MIPS_ISA_ARCH_LEVEL "		\n"
 	/* Attempt to store new at ptr */
 	"	scd	%L1, %2				\n"
 	/* If we failed, loop! */
 	"\t" __SC_BEQZ "%L1, 1b				\n"
-	"	.set	pop				\n"
 	"2:	" __SYNC(full, loongson3_war) "		\n"
+	"	.set	pop				\n"
 	: "=&r"(ret),
 	  "=&r"(tmp),
 	  "=" GCC_OFF_SMALL_ASM() (*(unsigned long long *)ptr)

From 1372eb1871085a65940491d27f12f9e19b4927b3 Mon Sep 17 00:00:00 2001
From: Dave Jones <davej@codemonkey.org.uk>
Date: Fri, 29 Oct 2021 16:57:59 -0400
Subject: [PATCH 1684/1750] x86/mce: Add errata workaround for Skylake SKX37

commit e629fc1407a63dbb748f828f9814463ffc2a0af0 upstream.

Errata SKX37 is word-for-word identical to the other errata listed in
this workaround.   I happened to notice this after investigating a CMCI
storm on a Skylake host.  While I can't confirm this was the root cause,
spurious corrected errors does sound like a likely suspect.

Fixes: 2976908e4198 ("x86/mce: Do not log spurious corrected mce errors")
Signed-off-by: Dave Jones <davej@codemonkey.org.uk>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20211029205759.GA7385@codemonkey.org.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kernel/cpu/mce/intel.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/cpu/mce/intel.c b/arch/x86/kernel/cpu/mce/intel.c
index abe9fe0fb851..2577d7875781 100644
--- a/arch/x86/kernel/cpu/mce/intel.c
+++ b/arch/x86/kernel/cpu/mce/intel.c
@@ -526,12 +526,13 @@ bool intel_filter_mce(struct mce *m)
 {
 	struct cpuinfo_x86 *c = &boot_cpu_data;
 
-	/* MCE errata HSD131, HSM142, HSW131, BDM48, and HSM142 */
+	/* MCE errata HSD131, HSM142, HSW131, BDM48, HSM142 and SKX37 */
 	if ((c->x86 == 6) &&
 	    ((c->x86_model == INTEL_FAM6_HASWELL) ||
 	     (c->x86_model == INTEL_FAM6_HASWELL_L) ||
 	     (c->x86_model == INTEL_FAM6_BROADWELL) ||
-	     (c->x86_model == INTEL_FAM6_HASWELL_G)) &&
+	     (c->x86_model == INTEL_FAM6_HASWELL_G) ||
+	     (c->x86_model == INTEL_FAM6_SKYLAKE_X)) &&
 	    (m->bank == 0) &&
 	    ((m->status & 0xa0000000ffffffff) == 0x80000000000f0005))
 		return true;

From f67f6eb717ae6277ddd6c1685b0e85ef17420096 Mon Sep 17 00:00:00 2001
From: Michael Pratt <mpratt@google.com>
Date: Mon, 1 Nov 2021 17:06:15 -0400
Subject: [PATCH 1685/1750] posix-cpu-timers: Clear task::posix_cputimers_work
 in copy_process()

commit ca7752caeaa70bd31d1714af566c9809688544af upstream.

copy_process currently copies task_struct.posix_cputimers_work as-is. If a
timer interrupt arrives while handling clone and before dup_task_struct
completes then the child task will have:

1. posix_cputimers_work.scheduled = true
2. posix_cputimers_work.work queued.

copy_process clears task_struct.task_works, so (2) will have no effect and
posix_cpu_timers_work will never run (not to mention it doesn't make sense
for two tasks to share a common linked list).

Since posix_cpu_timers_work never runs, posix_cputimers_work.scheduled is
never cleared. Since scheduled is set, future timer interrupts will skip
scheduling work, with the ultimate result that the task will never receive
timer expirations.

Together, the complete flow is:

1. Task 1 calls clone(), enters kernel.
2. Timer interrupt fires, schedules task work on Task 1.
   2a. task_struct.posix_cputimers_work.scheduled = true
   2b. task_struct.posix_cputimers_work.work added to
       task_struct.task_works.
3. dup_task_struct() copies Task 1 to Task 2.
4. copy_process() clears task_struct.task_works for Task 2.
5. Future timer interrupts on Task 2 see
   task_struct.posix_cputimers_work.scheduled = true and skip scheduling
   work.

Fix this by explicitly clearing contents of task_struct.posix_cputimers_work
in copy_process(). This was never meant to be shared or inherited across
tasks in the first place.

Fixes: 1fb497dd0030 ("posix-cpu-timers: Provide mechanisms to defer timer handling to task_work")
Reported-by: Rhys Hiltner <rhys@justin.tv>
Signed-off-by: Michael Pratt <mpratt@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20211101210615.716522-1-mpratt@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/posix-timers.h   |  2 ++
 kernel/fork.c                  |  1 +
 kernel/time/posix-cpu-timers.c | 19 +++++++++++++++++--
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
index 896c16d2c5fb..913aa60228b1 100644
--- a/include/linux/posix-timers.h
+++ b/include/linux/posix-timers.h
@@ -177,8 +177,10 @@ static inline void posix_cputimers_group_init(struct posix_cputimers *pct,
 #endif
 
 #ifdef CONFIG_POSIX_CPU_TIMERS_TASK_WORK
+void clear_posix_cputimers_work(struct task_struct *p);
 void posix_cputimers_init_work(void);
 #else
+static inline void clear_posix_cputimers_work(struct task_struct *p) { }
 static inline void posix_cputimers_init_work(void) { }
 #endif
 
diff --git a/kernel/fork.c b/kernel/fork.c
index 773b44be81f9..e465903abed9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2191,6 +2191,7 @@ static __latent_entropy struct task_struct *copy_process(
 	p->pdeath_signal = 0;
 	INIT_LIST_HEAD(&p->thread_group);
 	p->task_works = NULL;
+	clear_posix_cputimers_work(p);
 
 	/*
 	 * Ensure that the cgroup subsystem policies allow the new process to be
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 08c033b80256..5d76edd0ad9c 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1100,14 +1100,29 @@ static void posix_cpu_timers_work(struct callback_head *work)
 	handle_posix_cpu_timers(current);
 }
 
+/*
+ * Clear existing posix CPU timers task work.
+ */
+void clear_posix_cputimers_work(struct task_struct *p)
+{
+	/*
+	 * A copied work entry from the old task is not meaningful, clear it.
+	 * N.B. init_task_work will not do this.
+	 */
+	memset(&p->posix_cputimers_work.work, 0,
+	       sizeof(p->posix_cputimers_work.work));
+	init_task_work(&p->posix_cputimers_work.work,
+		       posix_cpu_timers_work);
+	p->posix_cputimers_work.scheduled = false;
+}
+
 /*
  * Initialize posix CPU timers task work in init task. Out of line to
  * keep the callback static and to avoid header recursion hell.
  */
 void __init posix_cputimers_init_work(void)
 {
-	init_task_work(&current->posix_cputimers_work.work,
-		       posix_cpu_timers_work);
+	clear_posix_cputimers_work(current);
 }
 
 /*

From 7930892cbd4008c353c8d397d0d3a18f8ad9f9ed Mon Sep 17 00:00:00 2001
From: Guo Ren <guoren@linux.alibaba.com>
Date: Fri, 5 Nov 2021 17:47:48 +0800
Subject: [PATCH 1686/1750] irqchip/sifive-plic: Fixup EOI failed when masked

commit 69ea463021be0d159ab30f96195fb0dd18ee2272 upstream.

When using "devm_request_threaded_irq(,,,,IRQF_ONESHOT,,)" in a driver,
only the first interrupt is handled, and following interrupts are never
delivered (initially reported in [1]).

That's because the RISC-V PLIC cannot EOI masked interrupts, as explained
in the description of Interrupt Completion in the PLIC spec [2]:

<quote>
The PLIC signals it has completed executing an interrupt handler by
writing the interrupt ID it received from the claim to the claim/complete
register. The PLIC does not check whether the completion ID is the same
as the last claim ID for that target. If the completion ID does not match
an interrupt source that *is currently enabled* for the target, the
completion is silently ignored.
</quote>

Re-enable the interrupt before completion if it has been masked during
the handling, and remask it afterwards.

[1] http://lists.infradead.org/pipermail/linux-riscv/2021-July/007441.html
[2] https://github.com/riscv/riscv-plic-spec/blob/8bc15a35d07c9edf7b5d23fec9728302595ffc4d/riscv-plic.adoc

Fixes: bb0fed1c60cc ("irqchip/sifive-plic: Switch to fasteoi flow")
Reported-by: Vincent Pelletier <plr.vincent@gmail.com>
Tested-by: Nikita Shubin <nikita.shubin@maquefel.me>
Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
Cc: stable@vger.kernel.org
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Atish Patra <atish.patra@wdc.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
[maz: amended commit message]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20211105094748.3894453-1-guoren@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/irqchip/irq-sifive-plic.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
index 6f432d2a5ceb..926e55d838cb 100644
--- a/drivers/irqchip/irq-sifive-plic.c
+++ b/drivers/irqchip/irq-sifive-plic.c
@@ -163,7 +163,13 @@ static void plic_irq_eoi(struct irq_data *d)
 {
 	struct plic_handler *handler = this_cpu_ptr(&plic_handlers);
 
-	writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM);
+	if (irqd_irq_masked(d)) {
+		plic_irq_unmask(d);
+		writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM);
+		plic_irq_mask(d);
+	} else {
+		writel(d->hwirq, handler->hart_base + CONTEXT_CLAIM);
+	}
 }
 
 static struct irq_chip plic_chip = {

From 0bf5c6a1e43fe8697b7df4d640fa59964c557bc6 Mon Sep 17 00:00:00 2001
From: Jaegeuk Kim <jaegeuk@kernel.org>
Date: Tue, 7 Sep 2021 10:24:21 -0700
Subject: [PATCH 1687/1750] f2fs: should use GFP_NOFS for directory inodes

commit 92d602bc7177325e7453189a22e0c8764ed3453e upstream.

We use inline_dentry which requires to allocate dentry page when adding a link.
If we allow to reclaim memory from filesystem, we do down_read(&sbi->cp_rwsem)
twice by f2fs_lock_op(). I think this should be okay, but how about stopping
the lockdep complaint [1]?

f2fs_create()
 - f2fs_lock_op()
 - f2fs_do_add_link()
  - __f2fs_find_entry
   - f2fs_get_read_data_page()
   -> kswapd
    - shrink_node
     - f2fs_evict_inode
      - f2fs_lock_op()

[1]

fs_reclaim
){+.+.}-{0:0}
:
kswapd0:        lock_acquire+0x114/0x394
kswapd0:        __fs_reclaim_acquire+0x40/0x50
kswapd0:        prepare_alloc_pages+0x94/0x1ec
kswapd0:        __alloc_pages_nodemask+0x78/0x1b0
kswapd0:        pagecache_get_page+0x2e0/0x57c
kswapd0:        f2fs_get_read_data_page+0xc0/0x394
kswapd0:        f2fs_find_data_page+0xa4/0x23c
kswapd0:        find_in_level+0x1a8/0x36c
kswapd0:        __f2fs_find_entry+0x70/0x100
kswapd0:        f2fs_do_add_link+0x84/0x1ec
kswapd0:        f2fs_mkdir+0xe4/0x1e4
kswapd0:        vfs_mkdir+0x110/0x1c0
kswapd0:        do_mkdirat+0xa4/0x160
kswapd0:        __arm64_sys_mkdirat+0x24/0x34
kswapd0:        el0_svc_common.llvm.17258447499513131576+0xc4/0x1e8
kswapd0:        do_el0_svc+0x28/0xa0
kswapd0:        el0_svc+0x24/0x38
kswapd0:        el0_sync_handler+0x88/0xec
kswapd0:        el0_sync+0x1c0/0x200
kswapd0:
-> #1
(
&sbi->cp_rwsem
){++++}-{3:3}
:
kswapd0:        lock_acquire+0x114/0x394
kswapd0:        down_read+0x7c/0x98
kswapd0:        f2fs_do_truncate_blocks+0x78/0x3dc
kswapd0:        f2fs_truncate+0xc8/0x128
kswapd0:        f2fs_evict_inode+0x2b8/0x8b8
kswapd0:        evict+0xd4/0x2f8
kswapd0:        iput+0x1c0/0x258
kswapd0:        do_unlinkat+0x170/0x2a0
kswapd0:        __arm64_sys_unlinkat+0x4c/0x68
kswapd0:        el0_svc_common.llvm.17258447499513131576+0xc4/0x1e8
kswapd0:        do_el0_svc+0x28/0xa0
kswapd0:        el0_svc+0x24/0x38
kswapd0:        el0_sync_handler+0x88/0xec
kswapd0:        el0_sync+0x1c0/0x200

Cc: stable@vger.kernel.org
Fixes: bdbc90fa55af ("f2fs: don't put dentry page in pagecache into highmem")
Reviewed-by: Chao Yu <chao@kernel.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Light Hsieh <light.hsieh@mediatek.com>
Tested-by: Light Hsieh <light.hsieh@mediatek.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/inode.c | 2 +-
 fs/f2fs/namei.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index 657db2fb6739..a35fcf43ad5a 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -511,7 +511,7 @@ struct inode *f2fs_iget(struct super_block *sb, unsigned long ino)
 		inode->i_op = &f2fs_dir_inode_operations;
 		inode->i_fop = &f2fs_dir_operations;
 		inode->i_mapping->a_ops = &f2fs_dblock_aops;
-		inode_nohighmem(inode);
+		mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
 	} else if (S_ISLNK(inode->i_mode)) {
 		if (file_is_encrypt(inode))
 			inode->i_op = &f2fs_encrypted_symlink_inode_operations;
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 710a6f73a685..6ae2beabe578 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -744,7 +744,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 	inode->i_op = &f2fs_dir_inode_operations;
 	inode->i_fop = &f2fs_dir_operations;
 	inode->i_mapping->a_ops = &f2fs_dblock_aops;
-	inode_nohighmem(inode);
+	mapping_set_gfp_mask(inode->i_mapping, GFP_NOFS);
 
 	set_inode_flag(inode, FI_INC_LINK);
 	f2fs_lock_op(sbi);

From a8cdf34ff8b7ed659e81f1feb8ce3cd035ab8497 Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Mon, 11 Oct 2021 14:12:36 +0200
Subject: [PATCH 1688/1750] net, neigh: Enable state migration between
 NUD_PERMANENT and NTF_USE

[ Upstream commit 3dc20f4762c62d3b3f0940644881ed818aa7b2f5 ]

Currently, it is not possible to migrate a neighbor entry between NUD_PERMANENT
state and NTF_USE flag with a dynamic NUD state from a user space control plane.
Similarly, it is not possible to add/remove NTF_EXT_LEARNED flag from an existing
neighbor entry in combination with NTF_USE flag.

This is due to the latter directly calling into neigh_event_send() without any
meta data updates as happening in __neigh_update(). Thus, to enable this use
case, extend the latter with a NEIGH_UPDATE_F_USE flag where we break the
NUD_PERMANENT state in particular so that a latter neigh_event_send() is able
to re-resolve a neighbor entry.

Before fix, NUD_PERMANENT -> NUD_* & NTF_USE:

  # ./ip/ip n replace 192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a PERMANENT
  [...]
  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use extern_learn
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a PERMANENT
  [...]

As can be seen, despite the admin-triggered replace, the entry remains in the
NUD_PERMANENT state.

After fix, NUD_PERMANENT -> NUD_* & NTF_USE:

  # ./ip/ip n replace 192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a PERMANENT
  [...]
  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use extern_learn
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a extern_learn REACHABLE
  [...]
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a extern_learn STALE
  [...]
  # ./ip/ip n replace 192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a PERMANENT
  [...]

After the fix, the admin-triggered replace switches to a dynamic state from
the NTF_USE flag which triggered a new neighbor resolution. Likewise, we can
transition back from there, if needed, into NUD_PERMANENT.

Similar before/after behavior can be observed for below transitions:

Before fix, NTF_USE -> NTF_USE | NTF_EXT_LEARNED -> NTF_USE:

  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a REACHABLE
  [...]
  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use extern_learn
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a REACHABLE
  [...]

After fix, NTF_USE -> NTF_USE | NTF_EXT_LEARNED -> NTF_USE:

  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a REACHABLE
  [...]
  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use extern_learn
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a extern_learn REACHABLE
  [...]
  # ./ip/ip n replace 192.168.178.30 dev enp5s0 use
  # ./ip/ip n
  192.168.178.30 dev enp5s0 lladdr f4:8c:50:5e:71:9a REACHABLE
  [..]

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Roopa Prabhu <roopa@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/net/neighbour.h |  1 +
 net/core/neighbour.c    | 22 +++++++++++++---------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index 990f9b1d1709..d5767e25509c 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -253,6 +253,7 @@ static inline void *neighbour_priv(const struct neighbour *n)
 #define NEIGH_UPDATE_F_OVERRIDE			0x00000001
 #define NEIGH_UPDATE_F_WEAK_OVERRIDE		0x00000002
 #define NEIGH_UPDATE_F_OVERRIDE_ISROUTER	0x00000004
+#define NEIGH_UPDATE_F_USE			0x10000000
 #define NEIGH_UPDATE_F_EXT_LEARNED		0x20000000
 #define NEIGH_UPDATE_F_ISROUTER			0x40000000
 #define NEIGH_UPDATE_F_ADMIN			0x80000000
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 01e243a578e9..8eec7667aa76 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1222,7 +1222,7 @@ static void neigh_update_hhs(struct neighbour *neigh)
 				lladdr instead of overriding it
 				if it is different.
 	NEIGH_UPDATE_F_ADMIN	means that the change is administrative.
-
+	NEIGH_UPDATE_F_USE	means that the entry is user triggered.
 	NEIGH_UPDATE_F_OVERRIDE_ISROUTER allows to override existing
 				NTF_ROUTER flag.
 	NEIGH_UPDATE_F_ISROUTER	indicates if the neighbour is known as
@@ -1260,6 +1260,12 @@ static int __neigh_update(struct neighbour *neigh, const u8 *lladdr,
 		goto out;
 
 	ext_learn_change = neigh_update_ext_learned(neigh, flags, &notify);
+	if (flags & NEIGH_UPDATE_F_USE) {
+		new = old & ~NUD_PERMANENT;
+		neigh->nud_state = new;
+		err = 0;
+		goto out;
+	}
 
 	if (!(new & NUD_VALID)) {
 		neigh_del_timer(neigh);
@@ -1971,22 +1977,20 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	if (protocol)
 		neigh->protocol = protocol;
-
 	if (ndm->ndm_flags & NTF_EXT_LEARNED)
 		flags |= NEIGH_UPDATE_F_EXT_LEARNED;
-
 	if (ndm->ndm_flags & NTF_ROUTER)
 		flags |= NEIGH_UPDATE_F_ISROUTER;
+	if (ndm->ndm_flags & NTF_USE)
+		flags |= NEIGH_UPDATE_F_USE;
 
-	if (ndm->ndm_flags & NTF_USE) {
+	err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
+			     NETLINK_CB(skb).portid, extack);
+	if (!err && ndm->ndm_flags & NTF_USE) {
 		neigh_event_send(neigh, NULL);
 		err = 0;
-	} else
-		err = __neigh_update(neigh, lladdr, ndm->ndm_state, flags,
-				     NETLINK_CB(skb).portid, extack);
-
+	}
 	neigh_release(neigh);
-
 out:
 	return err;
 }

From 32246cefb9920e6f72a121f43cc3e06037fab63c Mon Sep 17 00:00:00 2001
From: Dominique Martinet <asmadeus@codewreck.org>
Date: Tue, 2 Nov 2021 19:47:47 +0900
Subject: [PATCH 1689/1750] 9p/net: fix missing error check in p9_check_errors

commit 27eb4c3144f7a5ebef3c9a261d80cb3e1fa784dc upstream.

Link: https://lkml.kernel.org/r/99338965-d36c-886e-cd0e-1d8fff2b4746@gmail.com
Reported-by: syzbot+06472778c97ed94af66d@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/9p/client.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/9p/client.c b/net/9p/client.c
index eb42bbb72f52..bf6ed00d7c37 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -538,6 +538,8 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
 		kfree(ename);
 	} else {
 		err = p9pdu_readf(&req->rc, c->proto_version, "d", &ecode);
+		if (err)
+			goto out_err;
 		err = -ecode;
 
 		p9_debug(P9_DEBUG_9P, "<<< RLERROR (%d)\n", -ecode);

From 74293225f50391620aaef3507ebd6fd17e0003e1 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Fri, 5 Nov 2021 13:38:09 -0700
Subject: [PATCH 1690/1750] memcg: prohibit unconditional exceeding the limit
 of dying tasks

commit a4ebf1b6ca1e011289677239a2a361fde4a88076 upstream.

Memory cgroup charging allows killed or exiting tasks to exceed the hard
limit.  It is assumed that the amount of the memory charged by those
tasks is bound and most of the memory will get released while the task
is exiting.  This is resembling a heuristic for the global OOM situation
when tasks get access to memory reserves.  There is no global memory
shortage at the memcg level so the memcg heuristic is more relieved.

The above assumption is overly optimistic though.  E.g.  vmalloc can
scale to really large requests and the heuristic would allow that.  We
used to have an early break in the vmalloc allocator for killed tasks
but this has been reverted by commit b8c8a338f75e ("Revert "vmalloc:
back off when the current task is killed"").  There are likely other
similar code paths which do not check for fatal signals in an
allocation&charge loop.  Also there are some kernel objects charged to a
memcg which are not bound to a process life time.

It has been observed that it is not really hard to trigger these
bypasses and cause global OOM situation.

One potential way to address these runaways would be to limit the amount
of excess (similar to the global OOM with limited oom reserves).  This
is certainly possible but it is not really clear how much of an excess
is desirable and still protects from global OOMs as that would have to
consider the overall memcg configuration.

This patch is addressing the problem by removing the heuristic
altogether.  Bypass is only allowed for requests which either cannot
fail or where the failure is not desirable while excess should be still
limited (e.g.  atomic requests).  Implementation wise a killed or dying
task fails to charge if it has passed the OOM killer stage.  That should
give all forms of reclaim chance to restore the limit before the failure
(ENOMEM) and tell the caller to back off.

In addition, this patch renames should_force_charge() helper to
task_is_dying() because now its use is not associated witch forced
charging.

This patch depends on pagefault_out_of_memory() to not trigger
out_of_memory(), because then a memcg failure can unwind to VM_FAULT_OOM
and cause a global OOM killer.

Link: https://lkml.kernel.org/r/8f5cebbb-06da-4902-91f0-6566fc4b4203@virtuozzo.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Suggested-by: Michal Hocko <mhocko@suse.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/memcontrol.c | 27 ++++++++-------------------
 1 file changed, 8 insertions(+), 19 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 92bf987d0a41..4bb2a4c593f7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -230,7 +230,7 @@ enum res_type {
 	     iter != NULL;				\
 	     iter = mem_cgroup_iter(NULL, iter, NULL))
 
-static inline bool should_force_charge(void)
+static inline bool task_is_dying(void)
 {
 	return tsk_is_oom_victim(current) || fatal_signal_pending(current) ||
 		(current->flags & PF_EXITING);
@@ -1729,7 +1729,7 @@ static bool mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	 * A few threads which were not waiting at mutex_lock_killable() can
 	 * fail to bail out. Therefore, check again after holding oom_lock.
 	 */
-	ret = should_force_charge() || out_of_memory(&oc);
+	ret = task_is_dying() || out_of_memory(&oc);
 
 unlock:
 	mutex_unlock(&oom_lock);
@@ -2683,6 +2683,7 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	struct page_counter *counter;
 	enum oom_status oom_status;
 	unsigned long nr_reclaimed;
+	bool passed_oom = false;
 	bool may_swap = true;
 	bool drained = false;
 	unsigned long pflags;
@@ -2719,15 +2720,6 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	if (gfp_mask & __GFP_ATOMIC)
 		goto force;
 
-	/*
-	 * Unlike in global OOM situations, memcg is not in a physical
-	 * memory shortage.  Allow dying and OOM-killed tasks to
-	 * bypass the last charges so that they can exit quickly and
-	 * free their memory.
-	 */
-	if (unlikely(should_force_charge()))
-		goto force;
-
 	/*
 	 * Prevent unbounded recursion when reclaim operations need to
 	 * allocate memory. This might exceed the limits temporarily,
@@ -2788,8 +2780,9 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	if (gfp_mask & __GFP_NOFAIL)
 		goto force;
 
-	if (fatal_signal_pending(current))
-		goto force;
+	/* Avoid endless loop for tasks bypassed by the oom killer */
+	if (passed_oom && task_is_dying())
+		goto nomem;
 
 	/*
 	 * keep retrying as long as the memcg oom killer is able to make
@@ -2798,14 +2791,10 @@ static int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	 */
 	oom_status = mem_cgroup_oom(mem_over_limit, gfp_mask,
 		       get_order(nr_pages * PAGE_SIZE));
-	switch (oom_status) {
-	case OOM_SUCCESS:
+	if (oom_status == OOM_SUCCESS) {
+		passed_oom = true;
 		nr_retries = MAX_RECLAIM_RETRIES;
 		goto retry;
-	case OOM_FAILED:
-		goto force;
-	default:
-		goto nomem;
 	}
 nomem:
 	if (!(gfp_mask & __GFP_NOFAIL))

From 51cf71d5cb03c38fed74588ea79ed8673a8446f9 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Mon, 15 Nov 2021 16:36:27 +0530
Subject: [PATCH 1691/1750] powerpc/lib: Add helper to check if offset is
 within conditional branch range

upstream commit 4549c3ea3160fa8b3f37dfe2f957657bb265eda9

Add a helper to check if a given offset is within the branch range for a
powerpc conditional branch instruction, and update some sites to use the
new helper.

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/442b69a34ced32ca346a0d9a855f3f6cfdbbbd41.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/code-patching.h | 1 +
 arch/powerpc/lib/code-patching.c         | 7 ++++++-
 arch/powerpc/net/bpf_jit.h               | 7 +------
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
index d5b3c3bb95b4..fa8746c32006 100644
--- a/arch/powerpc/include/asm/code-patching.h
+++ b/arch/powerpc/include/asm/code-patching.h
@@ -23,6 +23,7 @@
 #define BRANCH_ABSOLUTE	0x2
 
 bool is_offset_in_branch_range(long offset);
+bool is_offset_in_cond_branch_range(long offset);
 int create_branch(struct ppc_inst *instr, const struct ppc_inst *addr,
 		  unsigned long target, int flags);
 int create_cond_branch(struct ppc_inst *instr, const struct ppc_inst *addr,
diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
index 2333625b5e31..a2e4f864b63d 100644
--- a/arch/powerpc/lib/code-patching.c
+++ b/arch/powerpc/lib/code-patching.c
@@ -230,6 +230,11 @@ bool is_offset_in_branch_range(long offset)
 	return (offset >= -0x2000000 && offset <= 0x1fffffc && !(offset & 0x3));
 }
 
+bool is_offset_in_cond_branch_range(long offset)
+{
+	return offset >= -0x8000 && offset <= 0x7fff && !(offset & 0x3);
+}
+
 /*
  * Helper to check if a given instruction is a conditional branch
  * Derived from the conditional checks in analyse_instr()
@@ -283,7 +288,7 @@ int create_cond_branch(struct ppc_inst *instr, const struct ppc_inst *addr,
 		offset = offset - (unsigned long)addr;
 
 	/* Check we can represent the target in the instruction format */
-	if (offset < -0x8000 || offset > 0x7FFF || offset & 0x3)
+	if (!is_offset_in_cond_branch_range(offset))
 		return 1;
 
 	/* Mask out the flags and target, so they don't step on each other. */
diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
index d0a67a1bbaf1..8f88b3d43f0a 100644
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -71,11 +71,6 @@
 #define PPC_FUNC_ADDR(d,i) do { PPC_LI32(d, i); } while(0)
 #endif
 
-static inline bool is_nearbranch(int offset)
-{
-	return (offset < 32768) && (offset >= -32768);
-}
-
 /*
  * The fly in the ointment of code size changing from pass to pass is
  * avoided by padding the short branch case with a NOP.	 If code size differs
@@ -84,7 +79,7 @@ static inline bool is_nearbranch(int offset)
  * state.
  */
 #define PPC_BCC(cond, dest)	do {					      \
-		if (is_nearbranch((dest) - (ctx->idx * 4))) {		      \
+		if (is_offset_in_cond_branch_range((long)(dest) - (ctx->idx * 4))) {	\
 			PPC_BCC_SHORT(cond, dest);			      \
 			EMIT(PPC_RAW_NOP());				      \
 		} else {						      \

From 951fb7bf387fdb65712d53c48ac6a90ec258173f Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Mon, 15 Nov 2021 16:36:28 +0530
Subject: [PATCH 1692/1750] powerpc/bpf: Validate branch ranges

upstream commit 3832ba4e283d7052b783dab8311df7e3590fed93

Add checks to ensure that we never emit branch instructions with
truncated branch offsets.

Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/71d33a6b7603ec1013c9734dd8bdd4ff5e929142.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
[drop ppc32 changes]
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/net/bpf_jit.h        | 26 ++++++++++++++++++++------
 arch/powerpc/net/bpf_jit_comp64.c |  8 ++++++--
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
index 8f88b3d43f0a..1a5b4da8a235 100644
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -12,6 +12,7 @@
 
 #include <asm/types.h>
 #include <asm/ppc-opcode.h>
+#include <asm/code-patching.h>
 
 #ifdef PPC64_ELF_ABI_v1
 #define FUNCTION_DESCR_SIZE	24
@@ -24,13 +25,26 @@
 #define EMIT(instr)		PLANT_INSTR(image, ctx->idx, instr)
 
 /* Long jump; (unconditional 'branch') */
-#define PPC_JMP(dest)		EMIT(PPC_INST_BRANCH |			      \
-				     (((dest) - (ctx->idx * 4)) & 0x03fffffc))
+#define PPC_JMP(dest)							      \
+	do {								      \
+		long offset = (long)(dest) - (ctx->idx * 4);		      \
+		if (!is_offset_in_branch_range(offset)) {		      \
+			pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx);			\
+			return -ERANGE;					      \
+		}							      \
+		EMIT(PPC_INST_BRANCH | (offset & 0x03fffffc));		      \
+	} while (0)
 /* "cond" here covers BO:BI fields. */
-#define PPC_BCC_SHORT(cond, dest)	EMIT(PPC_INST_BRANCH_COND |	      \
-					     (((cond) & 0x3ff) << 16) |	      \
-					     (((dest) - (ctx->idx * 4)) &     \
-					      0xfffc))
+#define PPC_BCC_SHORT(cond, dest)					      \
+	do {								      \
+		long offset = (long)(dest) - (ctx->idx * 4);		      \
+		if (!is_offset_in_cond_branch_range(offset)) {		      \
+			pr_err_ratelimited("Conditional branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx);		\
+			return -ERANGE;					      \
+		}							      \
+		EMIT(PPC_INST_BRANCH_COND | (((cond) & 0x3ff) << 16) | (offset & 0xfffc));					\
+	} while (0)
+
 /* Sign-extended 32-bit immediate load */
 #define PPC_LI32(d, i)		do {					      \
 		if ((int)(uintptr_t)(i) >= -32768 &&			      \
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index a2750d6ffd0f..803d95af2755 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -224,7 +224,7 @@ static void bpf_jit_emit_func_call_rel(u32 *image, struct codegen_context *ctx,
 	EMIT(PPC_RAW_BLRL());
 }
 
-static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
+static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 out)
 {
 	/*
 	 * By now, the eBPF program has already setup parameters in r3, r4 and r5
@@ -285,7 +285,9 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32
 	bpf_jit_emit_common_epilogue(image, ctx);
 
 	EMIT(PPC_RAW_BCTR());
+
 	/* out: */
+	return 0;
 }
 
 /* Assemble the body code between the prologue & epilogue */
@@ -1010,7 +1012,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 		 */
 		case BPF_JMP | BPF_TAIL_CALL:
 			ctx->seen |= SEEN_TAILCALL;
-			bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
+			ret = bpf_jit_emit_tail_call(image, ctx, addrs[i + 1]);
+			if (ret < 0)
+				return ret;
 			break;
 
 		default:

From 7fcf86565bb67de1118b446397b5670fc69d3f51 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Mon, 15 Nov 2021 16:36:29 +0530
Subject: [PATCH 1693/1750] powerpc/security: Add a helper to query stf_barrier
 type

upstream commit 030905920f32e91a52794937f67434ac0b3ea41a

Add a helper to return the stf_barrier type for the current processor.

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/3bd5d7f96ea1547991ac2ce3137dc2b220bae285.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/include/asm/security_features.h | 5 +++++
 arch/powerpc/kernel/security.c               | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h
index b774a4477d5f..e380acc6e413 100644
--- a/arch/powerpc/include/asm/security_features.h
+++ b/arch/powerpc/include/asm/security_features.h
@@ -39,6 +39,11 @@ static inline bool security_ftr_enabled(u64 feature)
 	return !!(powerpc_security_features & feature);
 }
 
+#ifdef CONFIG_PPC_BOOK3S_64
+enum stf_barrier_type stf_barrier_type_get(void);
+#else
+static inline enum stf_barrier_type stf_barrier_type_get(void) { return STF_BARRIER_NONE; }
+#endif
 
 // Features indicating support for Spectre/Meltdown mitigations
 
diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
index e4e1a94ccf6a..3f510c911b10 100644
--- a/arch/powerpc/kernel/security.c
+++ b/arch/powerpc/kernel/security.c
@@ -261,6 +261,11 @@ static int __init handle_no_stf_barrier(char *p)
 
 early_param("no_stf_barrier", handle_no_stf_barrier);
 
+enum stf_barrier_type stf_barrier_type_get(void)
+{
+	return stf_enabled_flush_types;
+}
+
 /* This is the generic flag used by other architectures */
 static int __init handle_ssbd(char *p)
 {

From 1ada86999dc84b852fcc32962f4002e939f4beb7 Mon Sep 17 00:00:00 2001
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Date: Mon, 15 Nov 2021 16:36:30 +0530
Subject: [PATCH 1694/1750] powerpc/bpf: Emit stf barrier instruction sequences
 for BPF_NOSPEC

upstream commit b7540d62509453263604a155bf2d5f0ed450cba2

Emit similar instruction sequences to commit a048a07d7f4535
("powerpc/64s: Add support for a store forwarding barrier at kernel
entry/exit") when encountering BPF_NOSPEC.

Mitigations are enabled depending on what the firmware advertises. In
particular, we do not gate these mitigations based on current settings,
just like in x86. Due to this, we don't need to take any action if
mitigations are enabled or disabled at runtime.

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/956570cbc191cd41f8274bed48ee757a86dac62a.1633464148.git.naveen.n.rao@linux.vnet.ibm.com
[adjust macros to account for commits 1c9debbc2eb539 and ef909ba954145e.
adjust security feature checks to account for commit 84ed26fd00c514]
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/net/bpf_jit64.h      |  8 ++---
 arch/powerpc/net/bpf_jit_comp64.c | 56 ++++++++++++++++++++++++++++---
 2 files changed, 56 insertions(+), 8 deletions(-)

diff --git a/arch/powerpc/net/bpf_jit64.h b/arch/powerpc/net/bpf_jit64.h
index 2e33c6673ff9..4d164e865b39 100644
--- a/arch/powerpc/net/bpf_jit64.h
+++ b/arch/powerpc/net/bpf_jit64.h
@@ -16,18 +16,18 @@
  * with our redzone usage.
  *
  *		[	prev sp		] <-------------
- *		[   nv gpr save area	] 6*8		|
+ *		[   nv gpr save area	] 5*8		|
  *		[    tail_call_cnt	] 8		|
- *		[    local_tmp_var	] 8		|
+ *		[    local_tmp_var	] 16		|
  * fp (r31) -->	[   ebpf stack space	] upto 512	|
  *		[     frame header	] 32/112	|
  * sp (r1) --->	[    stack pointer	] --------------
  */
 
 /* for gpr non volatile registers BPG_REG_6 to 10 */
-#define BPF_PPC_STACK_SAVE	(6*8)
+#define BPF_PPC_STACK_SAVE	(5*8)
 /* for bpf JIT code internal usage */
-#define BPF_PPC_STACK_LOCALS	16
+#define BPF_PPC_STACK_LOCALS	24
 /* stack frame excluding BPF stack, ensure this is quadword aligned */
 #define BPF_PPC_STACKFRAME	(STACK_FRAME_MIN_SIZE + \
 				 BPF_PPC_STACK_LOCALS + BPF_PPC_STACK_SAVE)
diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
index 803d95af2755..8936090acb57 100644
--- a/arch/powerpc/net/bpf_jit_comp64.c
+++ b/arch/powerpc/net/bpf_jit_comp64.c
@@ -15,6 +15,7 @@
 #include <linux/if_vlan.h>
 #include <asm/kprobes.h>
 #include <linux/bpf.h>
+#include <asm/security_features.h>
 
 #include "bpf_jit64.h"
 
@@ -56,9 +57,9 @@ static inline bool bpf_has_stack_frame(struct codegen_context *ctx)
  *		[	prev sp		] <-------------
  *		[	  ...       	] 		|
  * sp (r1) --->	[    stack pointer	] --------------
- *		[   nv gpr save area	] 6*8
+ *		[   nv gpr save area	] 5*8
  *		[    tail_call_cnt	] 8
- *		[    local_tmp_var	] 8
+ *		[    local_tmp_var	] 16
  *		[   unused red zone	] 208 bytes protected
  */
 static int bpf_jit_stack_local(struct codegen_context *ctx)
@@ -66,12 +67,12 @@ static int bpf_jit_stack_local(struct codegen_context *ctx)
 	if (bpf_has_stack_frame(ctx))
 		return STACK_FRAME_MIN_SIZE + ctx->stack_size;
 	else
-		return -(BPF_PPC_STACK_SAVE + 16);
+		return -(BPF_PPC_STACK_SAVE + 24);
 }
 
 static int bpf_jit_stack_tailcallcnt(struct codegen_context *ctx)
 {
-	return bpf_jit_stack_local(ctx) + 8;
+	return bpf_jit_stack_local(ctx) + 16;
 }
 
 static int bpf_jit_stack_offsetof(struct codegen_context *ctx, int reg)
@@ -290,11 +291,34 @@ static int bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 o
 	return 0;
 }
 
+/*
+ * We spill into the redzone always, even if the bpf program has its own stackframe.
+ * Offsets hardcoded based on BPF_PPC_STACK_SAVE -- see bpf_jit_stack_local()
+ */
+void bpf_stf_barrier(void);
+
+asm (
+"		.global bpf_stf_barrier		;"
+"	bpf_stf_barrier:			;"
+"		std	21,-64(1)		;"
+"		std	22,-56(1)		;"
+"		sync				;"
+"		ld	21,-64(1)		;"
+"		ld	22,-56(1)		;"
+"		ori	31,31,0			;"
+"		.rept 14			;"
+"		b	1f			;"
+"	1:					;"
+"		.endr				;"
+"		blr				;"
+);
+
 /* Assemble the body code between the prologue & epilogue */
 static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 			      struct codegen_context *ctx,
 			      u32 *addrs, bool extra_pass)
 {
+	enum stf_barrier_type stf_barrier = stf_barrier_type_get();
 	const struct bpf_insn *insn = fp->insnsi;
 	int flen = fp->len;
 	int i, ret;
@@ -665,6 +689,30 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
 		 * BPF_ST NOSPEC (speculation barrier)
 		 */
 		case BPF_ST | BPF_NOSPEC:
+			if (!security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) ||
+					(!security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) &&
+					 (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) || !cpu_has_feature(CPU_FTR_HVMODE))))
+				break;
+
+			switch (stf_barrier) {
+			case STF_BARRIER_EIEIO:
+				EMIT(0x7c0006ac | 0x02000000);
+				break;
+			case STF_BARRIER_SYNC_ORI:
+				EMIT(PPC_INST_SYNC);
+				EMIT(PPC_RAW_LD(b2p[TMP_REG_1], 13, 0));
+				EMIT(PPC_RAW_ORI(31, 31, 0));
+				break;
+			case STF_BARRIER_FALLBACK:
+				EMIT(PPC_INST_MFLR | ___PPC_RT(b2p[TMP_REG_1]));
+				PPC_LI64(12, dereference_kernel_function_descriptor(bpf_stf_barrier));
+				EMIT(PPC_RAW_MTCTR(12));
+				EMIT(PPC_INST_BCTR | 0x1);
+				EMIT(PPC_RAW_MTLR(b2p[TMP_REG_1]));
+				break;
+			case STF_BARRIER_NONE:
+				break;
+			}
 			break;
 
 		/*

From ac7f6befc3d1a58728ce3b93546aa24967ad90e7 Mon Sep 17 00:00:00 2001
From: Vasily Averin <vvs@virtuozzo.com>
Date: Fri, 5 Nov 2021 13:38:02 -0700
Subject: [PATCH 1695/1750] mm, oom: pagefault_out_of_memory: don't force
 global OOM for dying tasks

commit 0b28179a6138a5edd9d82ad2687c05b3773c387b upstream.

Patch series "memcg: prohibit unconditional exceeding the limit of dying tasks", v3.

Memory cgroup charging allows killed or exiting tasks to exceed the hard
limit.  It can be misused and allowed to trigger global OOM from inside
a memcg-limited container.  On the other hand if memcg fails allocation,
called from inside #PF handler it triggers global OOM from inside
pagefault_out_of_memory().

To prevent these problems this patchset:
 (a) removes execution of out_of_memory() from
     pagefault_out_of_memory(), becasue nobody can explain why it is
     necessary.
 (b) allow memcg to fail allocation of dying/killed tasks.

This patch (of 3):

Any allocation failure during the #PF path will return with VM_FAULT_OOM
which in turn results in pagefault_out_of_memory which in turn executes
out_out_memory() and can kill a random task.

An allocation might fail when the current task is the oom victim and
there are no memory reserves left.  The OOM killer is already handled at
the page allocator level for the global OOM and at the charging level
for the memcg one.  Both have much more information about the scope of
allocation/charge request.  This means that either the OOM killer has
been invoked properly and didn't lead to the allocation success or it
has been skipped because it couldn't have been invoked.  In both cases
triggering it from here is pointless and even harmful.

It makes much more sense to let the killed task die rather than to wake
up an eternally hungry oom-killer and send him to choose a fatter victim
for breakfast.

Link: https://lkml.kernel.org/r/0828a149-786e-7c06-b70a-52d086818ea3@virtuozzo.com
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Suggested-by: Michal Hocko <mhocko@suse.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Roman Gushchin <guro@fb.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/oom_kill.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 8b84661a6410..ea58ac23bbc5 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -1135,6 +1135,9 @@ void pagefault_out_of_memory(void)
 	if (mem_cgroup_oom_synchronize(true))
 		return;
 
+	if (fatal_signal_pending(current))
+		return;
+
 	if (!mutex_trylock(&oom_lock))
 		return;
 	out_of_memory(&oc);

From 1d457987366f7a92d03e03df80f9a63040133233 Mon Sep 17 00:00:00 2001
From: Michal Hocko <mhocko@suse.com>
Date: Fri, 5 Nov 2021 13:38:06 -0700
Subject: [PATCH 1696/1750] mm, oom: do not trigger out_of_memory from the #PF

commit 60e2793d440a3ec95abb5d6d4fc034a4b480472d upstream.

Any allocation failure during the #PF path will return with VM_FAULT_OOM
which in turn results in pagefault_out_of_memory.  This can happen for 2
different reasons.  a) Memcg is out of memory and we rely on
mem_cgroup_oom_synchronize to perform the memcg OOM handling or b)
normal allocation fails.

The latter is quite problematic because allocation paths already trigger
out_of_memory and the page allocator tries really hard to not fail
allocations.  Anyway, if the OOM killer has been already invoked there
is no reason to invoke it again from the #PF path.  Especially when the
OOM condition might be gone by that time and we have no way to find out
other than allocate.

Moreover if the allocation failed and the OOM killer hasn't been invoked
then we are unlikely to do the right thing from the #PF context because
we have already lost the allocation context and restictions and
therefore might oom kill a task from a different NUMA domain.

This all suggests that there is no legitimate reason to trigger
out_of_memory from pagefault_out_of_memory so drop it.  Just to be sure
that no #PF path returns with VM_FAULT_OOM without allocation print a
warning that this is happening before we restart the #PF.

[VvS: #PF allocation can hit into limit of cgroup v1 kmem controller.
This is a local problem related to memcg, however, it causes unnecessary
global OOM kills that are repeated over and over again and escalate into a
real disaster.  This has been broken since kmem accounting has been
introduced for cgroup v1 (3.8).  There was no kmem specific reclaim for
the separate limit so the only way to handle kmem hard limit was to return
with ENOMEM.  In upstream the problem will be fixed by removing the
outdated kmem limit, however stable and LTS kernels cannot do it and are
still affected.  This patch fixes the problem and should be backported
into stable/LTS.]

Link: https://lkml.kernel.org/r/f5fd8dd8-0ad4-c524-5f65-920b01972a42@virtuozzo.com
Signed-off-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Roman Gushchin <guro@fb.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/oom_kill.c | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index ea58ac23bbc5..419a814f467e 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -1118,19 +1118,15 @@ bool out_of_memory(struct oom_control *oc)
 }
 
 /*
- * The pagefault handler calls here because it is out of memory, so kill a
- * memory-hogging task. If oom_lock is held by somebody else, a parallel oom
- * killing is already in progress so do nothing.
+ * The pagefault handler calls here because some allocation has failed. We have
+ * to take care of the memcg OOM here because this is the only safe context without
+ * any locks held but let the oom killer triggered from the allocation context care
+ * about the global OOM.
  */
 void pagefault_out_of_memory(void)
 {
-	struct oom_control oc = {
-		.zonelist = NULL,
-		.nodemask = NULL,
-		.memcg = NULL,
-		.gfp_mask = 0,
-		.order = 0,
-	};
+	static DEFINE_RATELIMIT_STATE(pfoom_rs, DEFAULT_RATELIMIT_INTERVAL,
+				      DEFAULT_RATELIMIT_BURST);
 
 	if (mem_cgroup_oom_synchronize(true))
 		return;
@@ -1138,8 +1134,6 @@ void pagefault_out_of_memory(void)
 	if (fatal_signal_pending(current))
 		return;
 
-	if (!mutex_trylock(&oom_lock))
-		return;
-	out_of_memory(&oc);
-	mutex_unlock(&oom_lock);
+	if (__ratelimit(&pfoom_rs))
+		pr_warn("Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF\n");
 }

From 332306b1e731bde88fa748690450603265ab0637 Mon Sep 17 00:00:00 2001
From: Jack Andersen <jackoalan@gmail.com>
Date: Mon, 18 Oct 2021 13:25:41 +0200
Subject: [PATCH 1697/1750] mfd: dln2: Add cell for initializing DLN2 ADC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 313c84b5ae4104e48c661d5d706f9f4c425fd50f upstream.

This patch extends the DLN2 driver; adding cell for adc_dln2 module.

The original patch[1] fell through the cracks when the driver was added
so ADC has never actually been usable. That patch did not have ACPI
support which was added in v5.9, so the oldest supported version this
current patch can be backported to is 5.10.

[1] https://www.spinics.net/lists/linux-iio/msg33975.html

Cc: <stable@vger.kernel.org> # 5.10+
Signed-off-by: Jack Andersen <jackoalan@gmail.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Link: https://lore.kernel.org/r/20211018112541.25466-1-noralf@tronnes.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mfd/dln2.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
index 83e676a096dc..852129ea0766 100644
--- a/drivers/mfd/dln2.c
+++ b/drivers/mfd/dln2.c
@@ -50,6 +50,7 @@ enum dln2_handle {
 	DLN2_HANDLE_GPIO,
 	DLN2_HANDLE_I2C,
 	DLN2_HANDLE_SPI,
+	DLN2_HANDLE_ADC,
 	DLN2_HANDLES
 };
 
@@ -653,6 +654,7 @@ enum {
 	DLN2_ACPI_MATCH_GPIO	= 0,
 	DLN2_ACPI_MATCH_I2C	= 1,
 	DLN2_ACPI_MATCH_SPI	= 2,
+	DLN2_ACPI_MATCH_ADC	= 3,
 };
 
 static struct dln2_platform_data dln2_pdata_gpio = {
@@ -683,6 +685,16 @@ static struct mfd_cell_acpi_match dln2_acpi_match_spi = {
 	.adr = DLN2_ACPI_MATCH_SPI,
 };
 
+/* Only one ADC port supported */
+static struct dln2_platform_data dln2_pdata_adc = {
+	.handle = DLN2_HANDLE_ADC,
+	.port = 0,
+};
+
+static struct mfd_cell_acpi_match dln2_acpi_match_adc = {
+	.adr = DLN2_ACPI_MATCH_ADC,
+};
+
 static const struct mfd_cell dln2_devs[] = {
 	{
 		.name = "dln2-gpio",
@@ -702,6 +714,12 @@ static const struct mfd_cell dln2_devs[] = {
 		.platform_data = &dln2_pdata_spi,
 		.pdata_size = sizeof(struct dln2_platform_data),
 	},
+	{
+		.name = "dln2-adc",
+		.acpi_match = &dln2_acpi_match_adc,
+		.platform_data = &dln2_pdata_adc,
+		.pdata_size = sizeof(struct dln2_platform_data),
+	},
 };
 
 static void dln2_stop(struct dln2_dev *dln2)

From 7d0341b37d9763a6e7e1a3b7464d115839e30246 Mon Sep 17 00:00:00 2001
From: Marek Vasut <marex@denx.de>
Date: Tue, 21 Sep 2021 19:35:06 +0200
Subject: [PATCH 1698/1750] video: backlight: Drop maximum brightness override
 for brightness zero
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 33a5471f8da976bf271a1ebbd6b9d163cb0cb6aa upstream.

The note in c2adda27d202f ("video: backlight: Add of_find_backlight helper
in backlight.c") says that gpio-backlight uses brightness as power state.
This has been fixed since in ec665b756e6f7 ("backlight: gpio-backlight:
Correct initial power state handling") and other backlight drivers do not
require this workaround. Drop the workaround.

This fixes the case where e.g. pwm-backlight can perfectly well be set to
brightness 0 on boot in DT, which without this patch leads to the display
brightness to be max instead of off.

Fixes: c2adda27d202f ("video: backlight: Add of_find_backlight helper in backlight.c")
Cc: <stable@vger.kernel.org> # 5.4+
Cc: <stable@vger.kernel.org> # 4.19.x: ec665b756e6f7: backlight: gpio-backlight: Correct initial power state handling
Signed-off-by: Marek Vasut <marex@denx.de>
Acked-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/backlight/backlight.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 537fe1b376ad..fc990e576340 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -688,12 +688,6 @@ static struct backlight_device *of_find_backlight(struct device *dev)
 			of_node_put(np);
 			if (!bd)
 				return ERR_PTR(-EPROBE_DEFER);
-			/*
-			 * Note: gpio_backlight uses brightness as
-			 * power state during probe
-			 */
-			if (!bd->props.brightness)
-				bd->props.brightness = bd->props.max_brightness;
 		}
 	}
 

From 1174298a5b31ba566a4dee424230c10673014ea7 Mon Sep 17 00:00:00 2001
From: Vineeth Vijayan <vneethv@linux.ibm.com>
Date: Fri, 5 Nov 2021 16:44:51 +0100
Subject: [PATCH 1699/1750] s390/cio: check the subchannel validity for
 dev_busid

commit a4751f157c194431fae9e9c493f456df8272b871 upstream.

Check the validity of subchanel before reading other fields in
the schib.

Fixes: d3683c055212 ("s390/cio: add dev_busid sysfs entry for each subchannel")
CC: <stable@vger.kernel.org>
Reported-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Link: https://lore.kernel.org/r/20211105154451.847288-1-vneethv@linux.ibm.com
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/cio/css.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 305db4173dcf..cf2c3c4c590f 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -433,8 +433,8 @@ static ssize_t dev_busid_show(struct device *dev,
 	struct subchannel *sch = to_subchannel(dev);
 	struct pmcw *pmcw = &sch->schib.pmcw;
 
-	if ((pmcw->st == SUBCHANNEL_TYPE_IO ||
-	     pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv)
+	if ((pmcw->st == SUBCHANNEL_TYPE_IO && pmcw->dnv) ||
+	    (pmcw->st == SUBCHANNEL_TYPE_MSG && pmcw->w))
 		return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid,
 				  pmcw->dev);
 	else

From 57de1fbecff0bfe56d6db4af2b51741596968600 Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@linux.ibm.com>
Date: Tue, 2 Nov 2021 10:55:30 +0100
Subject: [PATCH 1700/1750] s390/tape: fix timer initialization in
 tape_std_assign()

commit 213fca9e23b59581c573d558aa477556f00b8198 upstream.

commit 9c6c273aa424 ("timer: Remove init_timer_on_stack() in favor
of timer_setup_on_stack()") changed the timer setup from
init_timer_on_stack(() to timer_setup(), but missed to change the
mod_timer() call. And while at it, use msecs_to_jiffies() instead
of the open coded timeout calculation.

Cc: stable@vger.kernel.org
Fixes: 9c6c273aa424 ("timer: Remove init_timer_on_stack() in favor of timer_setup_on_stack()")
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/char/tape_std.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/s390/char/tape_std.c b/drivers/s390/char/tape_std.c
index 1f5fab617b67..f7e75d9fedf6 100644
--- a/drivers/s390/char/tape_std.c
+++ b/drivers/s390/char/tape_std.c
@@ -53,7 +53,6 @@ int
 tape_std_assign(struct tape_device *device)
 {
 	int                  rc;
-	struct timer_list    timeout;
 	struct tape_request *request;
 
 	request = tape_alloc_request(2, 11);
@@ -70,7 +69,7 @@ tape_std_assign(struct tape_device *device)
 	 * So we set up a timeout for this call.
 	 */
 	timer_setup(&request->timer, tape_std_assign_timeout, 0);
-	mod_timer(&timeout, jiffies + 2 * HZ);
+	mod_timer(&request->timer, jiffies + msecs_to_jiffies(2000));
 
 	rc = tape_do_io_interruptible(device, request);
 

From c9ca9669dec322335da6f6ce0c6da7c48391f032 Mon Sep 17 00:00:00 2001
From: Harald Freudenberger <freude@linux.ibm.com>
Date: Thu, 14 Oct 2021 09:58:24 +0200
Subject: [PATCH 1701/1750] s390/ap: Fix hanging ioctl caused by orphaned
 replies

commit 3826350e6dd435e244eb6e47abad5a47c169ebc2 upstream.

When a queue is switched to soft offline during heavy load and later
switched to soft online again and now used, it may be that the caller
is blocked forever in the ioctl call.

The failure occurs because there is a pending reply after the queue(s)
have been switched to offline. This orphaned reply is received when
the queue is switched to online and is accidentally counted for the
outstanding replies. So when there was a valid outstanding reply and
this orphaned reply is received it counts as the outstanding one thus
dropping the outstanding counter to 0. Voila, with this counter the
receive function is not called any more and the real outstanding reply
is never received (until another request comes in...) and the ioctl
blocks.

The fix is simple. However, instead of readjusting the counter when an
orphaned reply is detected, I check the queue status for not empty and
compare this to the outstanding counter. So if the queue is not empty
then the counter must not drop to 0 but at least have a value of 1.

Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/crypto/ap_queue.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 639f8d25679c..ff0018f5bbe5 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -142,6 +142,8 @@ static struct ap_queue_status ap_sm_recv(struct ap_queue *aq)
 	switch (status.response_code) {
 	case AP_RESPONSE_NORMAL:
 		aq->queue_count = max_t(int, 0, aq->queue_count - 1);
+		if (!status.queue_empty && !aq->queue_count)
+			aq->queue_count++;
 		if (aq->queue_count > 0)
 			mod_timer(&aq->timeout,
 				  jiffies + aq->request_timeout);

From 1f420818dfca148afbb87abd556357c7a142ebb2 Mon Sep 17 00:00:00 2001
From: Halil Pasic <pasic@linux.ibm.com>
Date: Wed, 8 Sep 2021 17:36:23 +0200
Subject: [PATCH 1702/1750] s390/cio: make ccw_device_dma_* more robust

commit ad9a14517263a16af040598c7920c09ca9670a31 upstream.

Since commit 48720ba56891 ("virtio/s390: use DMA memory for ccw I/O and
classic notifiers") we were supposed to make sure that
virtio_ccw_release_dev() completes before the ccw device and the
attached dma pool are torn down, but unfortunately we did not.  Before
that commit it used to be OK to delay cleaning up the memory allocated
by virtio-ccw indefinitely (which isn't really intuitive for guys used
to destruction happens in reverse construction order), but now we
trigger a BUG_ON if the genpool is destroyed before all memory allocated
from it is deallocated. Which brings down the guest. We can observe this
problem, when unregister_virtio_device() does not give up the last
reference to the virtio_device (e.g. because a virtio-scsi attached scsi
disk got removed without previously unmounting its previously mounted
partition).

To make sure that the genpool is only destroyed after all the necessary
freeing is done let us take a reference on the ccw device on each
ccw_device_dma_zalloc() and give it up on each ccw_device_dma_free().

Actually there are multiple approaches to fixing the problem at hand
that can work. The upside of this one is that it is the safest one while
remaining simple. We don't crash the guest even if the driver does not
pair allocations and frees. The downside is the reference counting
overhead, that the reference counting for ccw devices becomes more
complex, in a sense that we need to pair the calls to the aforementioned
functions for it to be correct, and that if we happen to leak, we leak
more than necessary (the whole ccw device instead of just the genpool).

Some alternatives to this approach are taking a reference in
virtio_ccw_online() and giving it up in virtio_ccw_release_dev() or
making sure virtio_ccw_release_dev() completes its work before
virtio_ccw_remove() returns. The downside of these approaches is that
these are less safe against programming errors.

Cc: <stable@vger.kernel.org> # v5.3
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Fixes: 48720ba56891 ("virtio/s390: use DMA memory for ccw I/O and classic notifiers")
Reported-by: bfu@redhat.com
Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/s390/cio/device_ops.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 0fe7b2f2e7f5..c533d1dadc6b 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -825,13 +825,23 @@ EXPORT_SYMBOL_GPL(ccw_device_get_chid);
  */
 void *ccw_device_dma_zalloc(struct ccw_device *cdev, size_t size)
 {
-	return cio_gp_dma_zalloc(cdev->private->dma_pool, &cdev->dev, size);
+	void *addr;
+
+	if (!get_device(&cdev->dev))
+		return NULL;
+	addr = cio_gp_dma_zalloc(cdev->private->dma_pool, &cdev->dev, size);
+	if (IS_ERR_OR_NULL(addr))
+		put_device(&cdev->dev);
+	return addr;
 }
 EXPORT_SYMBOL(ccw_device_dma_zalloc);
 
 void ccw_device_dma_free(struct ccw_device *cdev, void *cpu_addr, size_t size)
 {
+	if (!cpu_addr)
+		return;
 	cio_gp_dma_free(cdev->private->dma_pool, cpu_addr, size);
+	put_device(&cdev->dev);
 }
 EXPORT_SYMBOL(ccw_device_dma_free);
 

From cbc55cf4a35867c158b03dd09fa9001c528a8d85 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:40 +0200
Subject: [PATCH 1703/1750] mtd: rawnand: ams-delta: Keep the driver compatible
 with on-die ECC engines

commit d707bb74daae07879e0fc1b4b960f8f2d0a5fe5d upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: 59d93473323a ("mtd: rawnand: ams-delta: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-2-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/ams-delta.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/ams-delta.c b/drivers/mtd/nand/raw/ams-delta.c
index ff1697f899ba..13de39aa3288 100644
--- a/drivers/mtd/nand/raw/ams-delta.c
+++ b/drivers/mtd/nand/raw/ams-delta.c
@@ -217,9 +217,8 @@ static int gpio_nand_setup_interface(struct nand_chip *this, int csline,
 
 static int gpio_nand_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -370,6 +369,13 @@ static int gpio_nand_probe(struct platform_device *pdev)
 	/* Release write protection */
 	gpiod_set_value(priv->gpiod_nwp, 0);
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	this->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	/* Scan to find existence of the device */
 	err = nand_scan(this, 1);
 	if (err)

From 9b366f5221d8aa64b22f35be137a5749326444ce Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:48 +0200
Subject: [PATCH 1704/1750] mtd: rawnand: xway: Keep the driver compatible with
 on-die ECC engines

commit 6bcd2960af1b7bacb2f1e710ab0c0b802d900501 upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: d525914b5bd8 ("mtd: rawnand: xway: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Cc: Jan Hoffmann <jan@3e8.eu>
Cc: Kestrel seventyfour <kestrelseventyfour@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Jan Hoffmann <jan@3e8.eu>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-10-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/xway_nand.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/xway_nand.c b/drivers/mtd/nand/raw/xway_nand.c
index 26751976e502..236fd8c5a958 100644
--- a/drivers/mtd/nand/raw/xway_nand.c
+++ b/drivers/mtd/nand/raw/xway_nand.c
@@ -148,9 +148,8 @@ static void xway_write_buf(struct nand_chip *chip, const u_char *buf, int len)
 
 static int xway_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -219,6 +218,13 @@ static int xway_nand_probe(struct platform_device *pdev)
 		    | NAND_CON_SE_P | NAND_CON_WP_P | NAND_CON_PRE_P
 		    | cs_flag, EBU_NAND_CON);
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	data->chip.ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	/* Scan to find existence of the device */
 	err = nand_scan(&data->chip, 1);
 	if (err)

From 13566bc111ee900a7c64733b526ca318d52d1e63 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:43 +0200
Subject: [PATCH 1705/1750] mtd: rawnand: mpc5121: Keep the driver compatible
 with on-die ECC engines

commit f9d8570b7fd6f4f08528ce2f5e39787a8a260cd6 upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: 6dd09f775b72 ("mtd: rawnand: mpc5121: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-5-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/mpc5121_nfc.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/mpc5121_nfc.c b/drivers/mtd/nand/raw/mpc5121_nfc.c
index bcd4a556c959..cb293c50acb8 100644
--- a/drivers/mtd/nand/raw/mpc5121_nfc.c
+++ b/drivers/mtd/nand/raw/mpc5121_nfc.c
@@ -605,9 +605,8 @@ static void mpc5121_nfc_free(struct device *dev, struct mtd_info *mtd)
 
 static int mpc5121_nfc_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -772,6 +771,13 @@ static int mpc5121_nfc_probe(struct platform_device *op)
 		goto error;
 	}
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	/* Detect NAND chips */
 	retval = nand_scan(chip, be32_to_cpup(chips_no));
 	if (retval) {

From 963db3ccc15bbb23cf4218cf377f258b76844a2c Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:42 +0200
Subject: [PATCH 1706/1750] mtd: rawnand: gpio: Keep the driver compatible with
 on-die ECC engines

commit b5b5b4dc6fcd8194b9dd38c8acdc5ab71adf44f8 upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: f6341f6448e0 ("mtd: rawnand: gpio: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-4-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/gpio.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/gpio.c b/drivers/mtd/nand/raw/gpio.c
index fb7a086de35e..fdf073d2e1b6 100644
--- a/drivers/mtd/nand/raw/gpio.c
+++ b/drivers/mtd/nand/raw/gpio.c
@@ -163,9 +163,8 @@ static int gpio_nand_exec_op(struct nand_chip *chip,
 
 static int gpio_nand_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -365,6 +364,13 @@ static int gpio_nand_probe(struct platform_device *pdev)
 	if (gpiomtd->nwp && !IS_ERR(gpiomtd->nwp))
 		gpiod_direction_output(gpiomtd->nwp, 1);
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	ret = nand_scan(chip, 1);
 	if (ret)
 		goto err_wp;

From b4e2e9fbd1949bca187acfa06bf4ea1f81658fff Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:45 +0200
Subject: [PATCH 1707/1750] mtd: rawnand: pasemi: Keep the driver compatible
 with on-die ECC engines

commit f16b7d2a5e810fcf4b15d096246d0d445da9cc88 upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: 8fc6f1f042b2 ("mtd: rawnand: pasemi: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-7-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/pasemi_nand.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/pasemi_nand.c b/drivers/mtd/nand/raw/pasemi_nand.c
index 68c08772d7c2..b0ba1fdbf5f2 100644
--- a/drivers/mtd/nand/raw/pasemi_nand.c
+++ b/drivers/mtd/nand/raw/pasemi_nand.c
@@ -76,9 +76,8 @@ static int pasemi_device_ready(struct nand_chip *chip)
 
 static int pasemi_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -155,6 +154,13 @@ static int pasemi_nand_probe(struct platform_device *ofdev)
 	/* Enable the following for a flash based bad block table */
 	chip->bbt_options = NAND_BBT_USE_FLASH;
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	/* Scan to find existence of the device */
 	err = nand_scan(chip, 1);
 	if (err)

From e1de04df8eb11087f8bd15e1d58e99dc25f82874 Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:44 +0200
Subject: [PATCH 1708/1750] mtd: rawnand: orion: Keep the driver compatible
 with on-die ECC engines

commit 194ac63de6ff56d30c48e3ac19c8a412f9c1408e upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: 553508cec2e8 ("mtd: rawnand: orion: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-6-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/orion_nand.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/orion_nand.c b/drivers/mtd/nand/raw/orion_nand.c
index 66211c9311d2..2c87c7d89205 100644
--- a/drivers/mtd/nand/raw/orion_nand.c
+++ b/drivers/mtd/nand/raw/orion_nand.c
@@ -85,9 +85,8 @@ static void orion_nand_read_buf(struct nand_chip *chip, uint8_t *buf, int len)
 
 static int orion_nand_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -190,6 +189,13 @@ static int __init orion_nand_probe(struct platform_device *pdev)
 		return ret;
 	}
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	nc->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	ret = nand_scan(nc, 1);
 	if (ret)
 		goto no_dev;

From 51e34fcf72a39fb02d9ad287716d3f0cdff5f1ce Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:46 +0200
Subject: [PATCH 1709/1750] mtd: rawnand: plat_nand: Keep the driver compatible
 with on-die ECC engines

commit 325fd539fc84f0aaa0ceb9d7d3b8718582473dc5 upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: 612e048e6aab ("mtd: rawnand: plat_nand: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-8-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/plat_nand.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/plat_nand.c b/drivers/mtd/nand/raw/plat_nand.c
index 7711e1020c21..0ee08c42cc35 100644
--- a/drivers/mtd/nand/raw/plat_nand.c
+++ b/drivers/mtd/nand/raw/plat_nand.c
@@ -21,9 +21,8 @@ struct plat_nand_data {
 
 static int plat_nand_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -94,6 +93,13 @@ static int plat_nand_probe(struct platform_device *pdev)
 			goto out;
 	}
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	data->chip.ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	/* Scan to find existence of the device */
 	err = nand_scan(&data->chip, pdata->chip.nr_chips);
 	if (err)

From 9dcdadd6cc73525e038b9621a6e9ee814dd63bda Mon Sep 17 00:00:00 2001
From: Miquel Raynal <miquel.raynal@bootlin.com>
Date: Wed, 29 Sep 2021 00:22:41 +0200
Subject: [PATCH 1710/1750] mtd: rawnand: au1550nd: Keep the driver compatible
 with on-die ECC engines

commit 7e3cdba176ba59eaf4d463d273da0718e3626140 upstream.

Following the introduction of the generic ECC engine infrastructure, it
was necessary to reorganize the code and move the ECC configuration in
the ->attach_chip() hook. Failing to do that properly lead to a first
series of fixes supposed to stabilize the situation. Unfortunately, this
only fixed the use of software ECC engines, preventing any other kind of
engine to be used, including on-die ones.

It is now time to (finally) fix the situation by ensuring that we still
provide a default (eg. software ECC) but will still support different
ECC engines such as on-die ECC engines if properly described in the
device tree.

There are no changes needed on the core side in order to do this, but we
just need to leverage the logic there which allows:
1- a subsystem default (set to Host engines in the raw NAND world)
2- a driver specific default (here set to software ECC engines)
3- any type of engine requested by the user (ie. described in the DT)

As the raw NAND subsystem has not yet been fully converted to the ECC
engine infrastructure, in order to provide a default ECC engine for this
driver we need to set chip->ecc.engine_type *before* calling
nand_scan(). During the initialization step, the core will consider this
entry as the default engine for this driver. This value may of course
be overloaded by the user if the usual DT properties are provided.

Fixes: dbffc8ccdf3a ("mtd: rawnand: au1550: Move the ECC initialization to ->attach_chip()")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-3-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mtd/nand/raw/au1550nd.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/nand/raw/au1550nd.c b/drivers/mtd/nand/raw/au1550nd.c
index 7b6b354f2d39..48901a1b8bf5 100644
--- a/drivers/mtd/nand/raw/au1550nd.c
+++ b/drivers/mtd/nand/raw/au1550nd.c
@@ -238,9 +238,8 @@ static int au1550nd_exec_op(struct nand_chip *this,
 
 static int au1550nd_attach_chip(struct nand_chip *chip)
 {
-	chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
-
-	if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
+	if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT &&
+	    chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN)
 		chip->ecc.algo = NAND_ECC_ALGO_HAMMING;
 
 	return 0;
@@ -309,6 +308,13 @@ static int au1550nd_probe(struct platform_device *pdev)
 	if (pd->devwidth)
 		this->options |= NAND_BUSWIDTH_16;
 
+	/*
+	 * This driver assumes that the default ECC engine should be TYPE_SOFT.
+	 * Set ->engine_type before registering the NAND devices in order to
+	 * provide a driver specific default value.
+	 */
+	this->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT;
+
 	ret = nand_scan(this, 1);
 	if (ret) {
 		dev_err(&pdev->dev, "NAND scan failed with %d\n", ret);

From 77d543e687952581e81fe07fe17b7bafa7773f5c Mon Sep 17 00:00:00 2001
From: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Date: Thu, 28 Oct 2021 22:27:16 +0530
Subject: [PATCH 1711/1750] powerpc/powernv/prd: Unregister OPAL_MSG_PRD2
 notifier during module unload

commit 52862ab33c5d97490f3fa345d6529829e6d6637b upstream.

Commit 587164cd, introduced new opal message type (OPAL_MSG_PRD2) and
added opal notifier. But I missed to unregister the notifier during
module unload path. This results in below call trace if you try to
unload and load opal_prd module.

Also add new notifier_block for OPAL_MSG_PRD2 message.

Sample calltrace (modprobe -r opal_prd; modprobe opal_prd)
  BUG: Unable to handle kernel data access on read at 0xc0080000192200e0
  Faulting instruction address: 0xc00000000018d1cc
  Oops: Kernel access of bad area, sig: 11 [#1]
  LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
  CPU: 66 PID: 7446 Comm: modprobe Kdump: loaded Tainted: G            E     5.14.0prd #759
  NIP:  c00000000018d1cc LR: c00000000018d2a8 CTR: c0000000000cde10
  REGS: c0000003c4c0f0a0 TRAP: 0300   Tainted: G            E      (5.14.0prd)
  MSR:  9000000002009033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE>  CR: 24224824  XER: 20040000
  CFAR: c00000000018d2a4 DAR: c0080000192200e0 DSISR: 40000000 IRQMASK: 1
  ...
  NIP notifier_chain_register+0x2c/0xc0
  LR  atomic_notifier_chain_register+0x48/0x80
  Call Trace:
    0xc000000002090610 (unreliable)
    atomic_notifier_chain_register+0x58/0x80
    opal_message_notifier_register+0x7c/0x1e0
    opal_prd_probe+0x84/0x150 [opal_prd]
    platform_probe+0x78/0x130
    really_probe+0x110/0x5d0
    __driver_probe_device+0x17c/0x230
    driver_probe_device+0x60/0x130
    __driver_attach+0xfc/0x220
    bus_for_each_dev+0xa8/0x130
    driver_attach+0x34/0x50
    bus_add_driver+0x1b0/0x300
    driver_register+0x98/0x1a0
    __platform_driver_register+0x38/0x50
    opal_prd_driver_init+0x34/0x50 [opal_prd]
    do_one_initcall+0x60/0x2d0
    do_init_module+0x7c/0x320
    load_module+0x3394/0x3650
    __do_sys_finit_module+0xd4/0x160
    system_call_exception+0x140/0x290
    system_call_common+0xf4/0x258

Fixes: 587164cd593c ("powerpc/powernv: Add new opal message type")
Cc: stable@vger.kernel.org # v5.4+
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211028165716.41300-1-hegdevasant@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/powernv/opal-prd.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/platforms/powernv/opal-prd.c b/arch/powerpc/platforms/powernv/opal-prd.c
index deddaebf8c14..17a2874d1256 100644
--- a/arch/powerpc/platforms/powernv/opal-prd.c
+++ b/arch/powerpc/platforms/powernv/opal-prd.c
@@ -372,6 +372,12 @@ static struct notifier_block opal_prd_event_nb = {
 	.priority	= 0,
 };
 
+static struct notifier_block opal_prd_event_nb2 = {
+	.notifier_call	= opal_prd_msg_notifier,
+	.next		= NULL,
+	.priority	= 0,
+};
+
 static int opal_prd_probe(struct platform_device *pdev)
 {
 	int rc;
@@ -393,9 +399,10 @@ static int opal_prd_probe(struct platform_device *pdev)
 		return rc;
 	}
 
-	rc = opal_message_notifier_register(OPAL_MSG_PRD2, &opal_prd_event_nb);
+	rc = opal_message_notifier_register(OPAL_MSG_PRD2, &opal_prd_event_nb2);
 	if (rc) {
 		pr_err("Couldn't register PRD2 event notifier\n");
+		opal_message_notifier_unregister(OPAL_MSG_PRD, &opal_prd_event_nb);
 		return rc;
 	}
 
@@ -404,6 +411,8 @@ static int opal_prd_probe(struct platform_device *pdev)
 		pr_err("failed to register miscdev\n");
 		opal_message_notifier_unregister(OPAL_MSG_PRD,
 				&opal_prd_event_nb);
+		opal_message_notifier_unregister(OPAL_MSG_PRD2,
+				&opal_prd_event_nb2);
 		return rc;
 	}
 
@@ -414,6 +423,7 @@ static int opal_prd_remove(struct platform_device *pdev)
 {
 	misc_deregister(&opal_prd_dev);
 	opal_message_notifier_unregister(OPAL_MSG_PRD, &opal_prd_event_nb);
+	opal_message_notifier_unregister(OPAL_MSG_PRD2, &opal_prd_event_nb2);
 	return 0;
 }
 

From 1023355234ca441c7296a58e762b420eef88884e Mon Sep 17 00:00:00 2001
From: Xiaoming Ni <nixiaoming@huawei.com>
Date: Wed, 29 Sep 2021 11:36:46 +0800
Subject: [PATCH 1712/1750] powerpc/85xx: fix timebase sync issue when
 CONFIG_HOTPLUG_CPU=n

commit c45361abb9185b1e172bd75eff51ad5f601ccae4 upstream.

When CONFIG_SMP=y, timebase synchronization is required when the second
kernel is started.

arch/powerpc/kernel/smp.c:
  int __cpu_up(unsigned int cpu, struct task_struct *tidle)
  {
  	...
  	if (smp_ops->give_timebase)
  		smp_ops->give_timebase();
  	...
  }

  void start_secondary(void *unused)
  {
  	...
  	if (smp_ops->take_timebase)
  		smp_ops->take_timebase();
  	...
  }

When CONFIG_HOTPLUG_CPU=n and CONFIG_KEXEC_CORE=n,
 smp_85xx_ops.give_timebase is NULL,
 smp_85xx_ops.take_timebase is NULL,
As a result, the timebase is not synchronized.

Timebase  synchronization does not depend on CONFIG_HOTPLUG_CPU.

Fixes: 56f1ba280719 ("powerpc/mpc85xx: refactor the PM operations")
Cc: stable@vger.kernel.org # v4.6+
Signed-off-by: Xiaoming Ni <nixiaoming@huawei.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20210929033646.39630-3-nixiaoming@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/powerpc/platforms/85xx/Makefile         |  4 +++-
 arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c |  4 ++++
 arch/powerpc/platforms/85xx/smp.c            | 12 ++++++------
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/arch/powerpc/platforms/85xx/Makefile b/arch/powerpc/platforms/85xx/Makefile
index d1dd0dca5ebf..bd750edeb105 100644
--- a/arch/powerpc/platforms/85xx/Makefile
+++ b/arch/powerpc/platforms/85xx/Makefile
@@ -3,7 +3,9 @@
 # Makefile for the PowerPC 85xx linux kernel.
 #
 obj-$(CONFIG_SMP) += smp.o
-obj-$(CONFIG_FSL_PMC)		  += mpc85xx_pm_ops.o
+ifneq ($(CONFIG_FSL_CORENET_RCPM),y)
+obj-$(CONFIG_SMP) += mpc85xx_pm_ops.o
+endif
 
 obj-y += common.o
 
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
index ffa8a7a6a2db..4a8af80011a6 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_pm_ops.c
@@ -17,6 +17,7 @@
 
 static struct ccsr_guts __iomem *guts;
 
+#ifdef CONFIG_FSL_PMC
 static void mpc85xx_irq_mask(int cpu)
 {
 
@@ -49,6 +50,7 @@ static void mpc85xx_cpu_up_prepare(int cpu)
 {
 
 }
+#endif
 
 static void mpc85xx_freeze_time_base(bool freeze)
 {
@@ -76,10 +78,12 @@ static const struct of_device_id mpc85xx_smp_guts_ids[] = {
 
 static const struct fsl_pm_ops mpc85xx_pm_ops = {
 	.freeze_time_base = mpc85xx_freeze_time_base,
+#ifdef CONFIG_FSL_PMC
 	.irq_mask = mpc85xx_irq_mask,
 	.irq_unmask = mpc85xx_irq_unmask,
 	.cpu_die = mpc85xx_cpu_die,
 	.cpu_up_prepare = mpc85xx_cpu_up_prepare,
+#endif
 };
 
 int __init mpc85xx_setup_pmc(void)
diff --git a/arch/powerpc/platforms/85xx/smp.c b/arch/powerpc/platforms/85xx/smp.c
index c6df294054fe..83f4a6389a28 100644
--- a/arch/powerpc/platforms/85xx/smp.c
+++ b/arch/powerpc/platforms/85xx/smp.c
@@ -40,7 +40,6 @@ struct epapr_spin_table {
 	u32	pir;
 };
 
-#ifdef CONFIG_HOTPLUG_CPU
 static u64 timebase;
 static int tb_req;
 static int tb_valid;
@@ -112,6 +111,7 @@ static void mpc85xx_take_timebase(void)
 	local_irq_restore(flags);
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 static void smp_85xx_cpu_offline_self(void)
 {
 	unsigned int cpu = smp_processor_id();
@@ -495,21 +495,21 @@ void __init mpc85xx_smp_init(void)
 		smp_85xx_ops.probe = NULL;
 	}
 
-#ifdef CONFIG_HOTPLUG_CPU
 #ifdef CONFIG_FSL_CORENET_RCPM
+	/* Assign a value to qoriq_pm_ops on PPC_E500MC */
 	fsl_rcpm_init();
-#endif
-
-#ifdef CONFIG_FSL_PMC
+#else
+	/* Assign a value to qoriq_pm_ops on !PPC_E500MC */
 	mpc85xx_setup_pmc();
 #endif
 	if (qoriq_pm_ops) {
 		smp_85xx_ops.give_timebase = mpc85xx_give_timebase;
 		smp_85xx_ops.take_timebase = mpc85xx_take_timebase;
+#ifdef CONFIG_HOTPLUG_CPU
 		smp_85xx_ops.cpu_offline_self = smp_85xx_cpu_offline_self;
 		smp_85xx_ops.cpu_die = qoriq_cpu_kill;
-	}
 #endif
+	}
 	smp_ops = &smp_85xx_ops;
 
 #ifdef CONFIG_KEXEC_CORE

From f3396f6d8345821578fafc953888df1b1df6d780 Mon Sep 17 00:00:00 2001
From: Jernej Skrabec <jernej.skrabec@gmail.com>
Date: Tue, 31 Aug 2021 20:48:19 +0200
Subject: [PATCH 1713/1750] drm/sun4i: Fix macros in sun8i_csc.h

commit c302c98da646409d657a473da202f10f417f3ff1 upstream.

Macros SUN8I_CSC_CTRL() and SUN8I_CSC_COEFF() don't follow usual
recommendation of having arguments enclosed in parenthesis. While that
didn't change anything for quite sometime, it actually become important
after CSC code rework with commit ea067aee45a8 ("drm/sun4i: de2/de3:
Remove redundant CSC matrices").

Without this fix, colours are completely off for supported YVU formats
on SoCs with DE2 (A64, H3, R40, etc.).

Fix the issue by enclosing macro arguments in parenthesis.

Cc: stable@vger.kernel.org # 5.12+
Fixes: 883029390550 ("drm/sun4i: Add DE2 CSC library")
Reported-by: Roman Stratiienko <r.stratiienko@gmail.com>
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://patchwork.freedesktop.org/patch/msgid/20210831184819.93670-1-jernej.skrabec@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/sun4i/sun8i_csc.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/sun4i/sun8i_csc.h b/drivers/gpu/drm/sun4i/sun8i_csc.h
index a55a38ad849c..022cafa6c06c 100644
--- a/drivers/gpu/drm/sun4i/sun8i_csc.h
+++ b/drivers/gpu/drm/sun4i/sun8i_csc.h
@@ -16,8 +16,8 @@ struct sun8i_mixer;
 #define CCSC10_OFFSET 0xA0000
 #define CCSC11_OFFSET 0xF0000
 
-#define SUN8I_CSC_CTRL(base)		(base + 0x0)
-#define SUN8I_CSC_COEFF(base, i)	(base + 0x10 + 4 * i)
+#define SUN8I_CSC_CTRL(base)		((base) + 0x0)
+#define SUN8I_CSC_COEFF(base, i)	((base) + 0x10 + 4 * (i))
 
 #define SUN8I_CSC_CTRL_EN		BIT(0)
 

From f967d120a5b51b8bda9e2ad030726f12925fd709 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:40 +0200
Subject: [PATCH 1714/1750] PCI: Add PCI_EXP_DEVCTL_PAYLOAD_* macros
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit 460275f124fb072dca218a6b43b6370eebbab20d upstream.

Define a macro PCI_EXP_DEVCTL_PAYLOAD_* for every possible Max Payload
Size in linux/pci_regs.h, in the same style as PCI_EXP_DEVCTL_READRQ_*.

Link: https://lore.kernel.org/r/20211005180952.6812-2-kabel@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Reviewed-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/uapi/linux/pci_regs.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h
index a95d55f9f257..142b184eca8b 100644
--- a/include/uapi/linux/pci_regs.h
+++ b/include/uapi/linux/pci_regs.h
@@ -504,6 +504,12 @@
 #define  PCI_EXP_DEVCTL_URRE	0x0008	/* Unsupported Request Reporting En. */
 #define  PCI_EXP_DEVCTL_RELAX_EN 0x0010 /* Enable relaxed ordering */
 #define  PCI_EXP_DEVCTL_PAYLOAD	0x00e0	/* Max_Payload_Size */
+#define  PCI_EXP_DEVCTL_PAYLOAD_128B 0x0000 /* 128 Bytes */
+#define  PCI_EXP_DEVCTL_PAYLOAD_256B 0x0020 /* 256 Bytes */
+#define  PCI_EXP_DEVCTL_PAYLOAD_512B 0x0040 /* 512 Bytes */
+#define  PCI_EXP_DEVCTL_PAYLOAD_1024B 0x0060 /* 1024 Bytes */
+#define  PCI_EXP_DEVCTL_PAYLOAD_2048B 0x0080 /* 2048 Bytes */
+#define  PCI_EXP_DEVCTL_PAYLOAD_4096B 0x00a0 /* 4096 Bytes */
 #define  PCI_EXP_DEVCTL_EXT_TAG	0x0100	/* Extended Tag Field Enable */
 #define  PCI_EXP_DEVCTL_PHANTOM	0x0200	/* Phantom Functions Enable */
 #define  PCI_EXP_DEVCTL_AUX_PME	0x0400	/* Auxiliary Power PM Enable */

From c7a440cd30798042f3346cbb3b3a056df638f66c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
Date: Tue, 5 Oct 2021 20:09:41 +0200
Subject: [PATCH 1715/1750] PCI: aardvark: Fix PCIe Max Payload Size setting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

commit a4e17d65dafdd3513042d8f00404c9b6068a825c upstream.

Change PCIe Max Payload Size setting in PCIe Device Control register to 512
bytes to align with PCIe Link Initialization sequence as defined in Marvell
Armada 3700 Functional Specification. According to the specification,
maximal Max Payload Size supported by this device is 512 bytes.

Without this kernel prints suspicious line:

    pci 0000:01:00.0: Upstream bridge's Max Payload Size set to 256 (was 16384, max 512)

With this change it changes to:

    pci 0000:01:00.0: Upstream bridge's Max Payload Size set to 256 (was 512, max 512)

Link: https://lore.kernel.org/r/20211005180952.6812-3-kabel@kernel.org
Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Reviewed-by: Marek Behún <kabel@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/controller/pci-aardvark.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
index 5b34dea80885..434522465d98 100644
--- a/drivers/pci/controller/pci-aardvark.c
+++ b/drivers/pci/controller/pci-aardvark.c
@@ -597,8 +597,9 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
 	reg = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + PCI_EXP_DEVCTL);
 	reg &= ~PCI_EXP_DEVCTL_RELAX_EN;
 	reg &= ~PCI_EXP_DEVCTL_NOSNOOP_EN;
+	reg &= ~PCI_EXP_DEVCTL_PAYLOAD;
 	reg &= ~PCI_EXP_DEVCTL_READRQ;
-	reg |= PCI_EXP_DEVCTL_PAYLOAD; /* Set max payload size */
+	reg |= PCI_EXP_DEVCTL_PAYLOAD_512B;
 	reg |= PCI_EXP_DEVCTL_READRQ_512B;
 	advk_writel(pcie, reg, PCIE_CORE_PCIEXP_CAP + PCI_EXP_DEVCTL);
 

From d41f4d4dd7c8fc045859258abdc3fb453ab8c790 Mon Sep 17 00:00:00 2001
From: Trond Myklebust <trond.myklebust@hammerspace.com>
Date: Mon, 12 Jul 2021 09:52:59 -0400
Subject: [PATCH 1716/1750] SUNRPC: Partial revert of commit 6f9f17287e78

commit ea7a1019d8baf8503ecd6e3ec8436dec283569e6 upstream.

The premise of commit 6f9f17287e78 ("SUNRPC: Mitigate cond_resched() in
xprt_transmit()") was that cond_resched() is expensive and unnecessary
when there has been just a single send.
The point of cond_resched() is to ensure that tasks that should pre-empt
this one get a chance to do so when it is safe to do so. The code prior
to commit 6f9f17287e78 failed to take into account that it was keeping a
rpc_task pinned for longer than it needed to, and so rather than doing a
full revert, let's just move the cond_resched.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sunrpc/xprt.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 8201531ce5d9..04aaca4b8bf9 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1552,15 +1552,14 @@ xprt_transmit(struct rpc_task *task)
 {
 	struct rpc_rqst *next, *req = task->tk_rqstp;
 	struct rpc_xprt	*xprt = req->rq_xprt;
-	int counter, status;
+	int status;
 
 	spin_lock(&xprt->queue_lock);
-	counter = 0;
-	while (!list_empty(&xprt->xmit_queue)) {
-		if (++counter == 20)
+	for (;;) {
+		next = list_first_entry_or_null(&xprt->xmit_queue,
+						struct rpc_rqst, rq_xmit);
+		if (!next)
 			break;
-		next = list_first_entry(&xprt->xmit_queue,
-				struct rpc_rqst, rq_xmit);
 		xprt_pin_rqst(next);
 		spin_unlock(&xprt->queue_lock);
 		status = xprt_request_transmit(next, task);
@@ -1568,13 +1567,16 @@ xprt_transmit(struct rpc_task *task)
 			status = 0;
 		spin_lock(&xprt->queue_lock);
 		xprt_unpin_rqst(next);
-		if (status == 0) {
-			if (!xprt_request_data_received(task) ||
-			    test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate))
-				continue;
-		} else if (test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate))
-			task->tk_status = status;
-		break;
+		if (status < 0) {
+			if (test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate))
+				task->tk_status = status;
+			break;
+		}
+		/* Was @task transmitted, and has it received a reply? */
+		if (xprt_request_data_received(task) &&
+		    !test_bit(RPC_TASK_NEED_XMIT, &task->tk_runstate))
+			break;
+		cond_resched_lock(&xprt->queue_lock);
 	}
 	spin_unlock(&xprt->queue_lock);
 }

From 188bf40391a5a296e91d40c6f83bd4f07a0a8559 Mon Sep 17 00:00:00 2001
From: Arnd Bergmann <arnd@arndb.de>
Date: Wed, 20 Oct 2021 11:59:07 +0300
Subject: [PATCH 1717/1750] ath10k: fix invalid dma_addr_t token assignment

commit 937e79c67740d1d84736730d679f3cb2552f990e upstream.

Using a kernel pointer in place of a dma_addr_t token can
lead to undefined behavior if that makes it into cache
management functions. The compiler caught one such attempt
in a cast:

drivers/net/wireless/ath/ath10k/mac.c: In function 'ath10k_add_interface':
drivers/net/wireless/ath/ath10k/mac.c:5586:47: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
 5586 |                         arvif->beacon_paddr = (dma_addr_t)arvif->beacon_buf;
      |                                               ^

Looking through how this gets used down the way, I'm fairly
sure that beacon_paddr is never accessed again for ATH10K_DEV_TYPE_HL
devices, and if it was accessed, that would be a bug.

Change the assignment to use a known-invalid address token
instead, which avoids the warning and makes it easier to catch
bugs if it does end up getting used.

Fixes: e263bdab9c0e ("ath10k: high latency fixes for beacon buffer")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211014075153.3655910-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/ath/ath10k/mac.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index c42977918e04..b59d482d9c23 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -5473,7 +5473,15 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 		if (ar->bus_param.dev_type == ATH10K_DEV_TYPE_HL) {
 			arvif->beacon_buf = kmalloc(IEEE80211_MAX_FRAME_LEN,
 						    GFP_KERNEL);
-			arvif->beacon_paddr = (dma_addr_t)arvif->beacon_buf;
+
+			/* Using a kernel pointer in place of a dma_addr_t
+			 * token can lead to undefined behavior if that
+			 * makes it into cache management functions. Use a
+			 * known-invalid address token instead, which
+			 * avoids the warning and makes it easier to catch
+			 * bugs if it does end up getting used.
+			 */
+			arvif->beacon_paddr = DMA_MAPPING_ERROR;
 		} else {
 			arvif->beacon_buf =
 				dma_alloc_coherent(ar->dev,

From 1e7340950dc22687e5f7741a1dcf1a2d3fee062a Mon Sep 17 00:00:00 2001
From: Colin Ian King <colin.king@canonical.com>
Date: Wed, 13 Oct 2021 11:00:52 +0100
Subject: [PATCH 1718/1750] mmc: moxart: Fix null pointer dereference on
 pointer host

commit 0eab756f8821d255016c63bb55804c429ff4bdb1 upstream.

There are several error return paths that dereference the null pointer
host because the pointer has not yet been set to a valid value.
Fix this by adding a new out_mmc label and exiting via this label
to avoid the host clean up and hence the null pointer dereference.

Addresses-Coverity: ("Explicit null dereference")
Fixes: 8105c2abbf36 ("mmc: moxart: Fix reference count leaks in moxart_probe")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20211013100052.125461-1-colin.king@canonical.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/mmc/host/moxart-mmc.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
index dcd128ecdf15..7697068ad969 100644
--- a/drivers/mmc/host/moxart-mmc.c
+++ b/drivers/mmc/host/moxart-mmc.c
@@ -569,37 +569,37 @@ static int moxart_probe(struct platform_device *pdev)
 	if (!mmc) {
 		dev_err(dev, "mmc_alloc_host failed\n");
 		ret = -ENOMEM;
-		goto out;
+		goto out_mmc;
 	}
 
 	ret = of_address_to_resource(node, 0, &res_mmc);
 	if (ret) {
 		dev_err(dev, "of_address_to_resource failed\n");
-		goto out;
+		goto out_mmc;
 	}
 
 	irq = irq_of_parse_and_map(node, 0);
 	if (irq <= 0) {
 		dev_err(dev, "irq_of_parse_and_map failed\n");
 		ret = -EINVAL;
-		goto out;
+		goto out_mmc;
 	}
 
 	clk = devm_clk_get(dev, NULL);
 	if (IS_ERR(clk)) {
 		ret = PTR_ERR(clk);
-		goto out;
+		goto out_mmc;
 	}
 
 	reg_mmc = devm_ioremap_resource(dev, &res_mmc);
 	if (IS_ERR(reg_mmc)) {
 		ret = PTR_ERR(reg_mmc);
-		goto out;
+		goto out_mmc;
 	}
 
 	ret = mmc_of_parse(mmc);
 	if (ret)
-		goto out;
+		goto out_mmc;
 
 	host = mmc_priv(mmc);
 	host->mmc = mmc;
@@ -690,6 +690,7 @@ static int moxart_probe(struct platform_device *pdev)
 		dma_release_channel(host->dma_chan_tx);
 	if (!IS_ERR_OR_NULL(host->dma_chan_rx))
 		dma_release_channel(host->dma_chan_rx);
+out_mmc:
 	if (mmc)
 		mmc_free_host(mmc);
 	return ret;

From 5be42b203f2c4b72205b4ecd72c0558dfdb3a552 Mon Sep 17 00:00:00 2001
From: Andrii Nakryiko <andrii@kernel.org>
Date: Mon, 1 Nov 2021 16:01:18 -0700
Subject: [PATCH 1719/1750] selftests/bpf: Fix also no-alu32 strobemeta
 selftest

commit a20eac0af02810669e187cb623bc904908c423af upstream.

Previous fix aded bpf_clamp_umax() helper use to re-validate boundaries.
While that works correctly, it introduces more branches, which blows up
past 1 million instructions in no-alu32 variant of strobemeta selftests.

Switching len variable from u32 to u64 also fixes the issue and reduces
the number of validated instructions, so use that instead. Fix this
patch and bpf_clamp_umax() removed, both alu32 and no-alu32 selftests
pass.

Fixes: 0133c20480b1 ("selftests/bpf: Fix strobemeta selftest regression")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211101230118.1273019-1-andrii@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/bpf/progs/strobemeta.h | 15 ++-------------
 1 file changed, 2 insertions(+), 13 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/strobemeta.h b/tools/testing/selftests/bpf/progs/strobemeta.h
index 3687ea755ab5..60c93aee2f4a 100644
--- a/tools/testing/selftests/bpf/progs/strobemeta.h
+++ b/tools/testing/selftests/bpf/progs/strobemeta.h
@@ -10,14 +10,6 @@
 #include <linux/types.h>
 #include <bpf/bpf_helpers.h>
 
-#define bpf_clamp_umax(VAR, UMAX)					\
-	asm volatile (							\
-		"if %0 <= %[max] goto +1\n"				\
-		"%0 = %[max]\n"						\
-		: "+r"(VAR)						\
-		: [max]"i"(UMAX)					\
-	)
-
 typedef uint32_t pid_t;
 struct task_struct {};
 
@@ -366,7 +358,7 @@ static __always_inline uint64_t read_str_var(struct strobemeta_cfg *cfg,
 					     void *payload)
 {
 	void *location;
-	uint32_t len;
+	uint64_t len;
 
 	data->str_lens[idx] = 0;
 	location = calc_location(&cfg->str_locs[idx], tls_base);
@@ -398,7 +390,7 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg,
 	struct strobe_map_descr* descr = &data->map_descrs[idx];
 	struct strobe_map_raw map;
 	void *location;
-	uint32_t len;
+	uint64_t len;
 	int i;
 
 	descr->tag_len = 0; /* presume no tag is set */
@@ -421,7 +413,6 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg,
 
 	len = bpf_probe_read_user_str(payload, STROBE_MAX_STR_LEN, map.tag);
 	if (len <= STROBE_MAX_STR_LEN) {
-		bpf_clamp_umax(len, STROBE_MAX_STR_LEN);
 		descr->tag_len = len;
 		payload += len;
 	}
@@ -439,7 +430,6 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg,
 		len = bpf_probe_read_user_str(payload, STROBE_MAX_STR_LEN,
 					      map.entries[i].key);
 		if (len <= STROBE_MAX_STR_LEN) {
-			bpf_clamp_umax(len, STROBE_MAX_STR_LEN);
 			descr->key_lens[i] = len;
 			payload += len;
 		}
@@ -447,7 +437,6 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg,
 		len = bpf_probe_read_user_str(payload, STROBE_MAX_STR_LEN,
 					      map.entries[i].val);
 		if (len <= STROBE_MAX_STR_LEN) {
-			bpf_clamp_umax(len, STROBE_MAX_STR_LEN);
 			descr->val_lens[i] = len;
 			payload += len;
 		}

From 74ba917cfdddbb6b1ad9c2fc4833bf1f810b27f9 Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Wed, 8 Sep 2021 17:58:33 -0500
Subject: [PATCH 1720/1750] arch/cc: Introduce a function to check for
 confidential computing features

commit 46b49b12f3fc5e1347dba37d4639e2165f447871 upstream.

In preparation for other confidential computing technologies, introduce
a generic helper function, cc_platform_has(), that can be used to
check for specific active confidential computing attributes, like
memory encryption. This is intended to eliminate having to add multiple
technology-specific checks to the code (e.g. if (sev_active() ||
tdx_active() || ... ).

 [ bp: s/_CC_PLATFORM_H/_LINUX_CC_PLATFORM_H/g ]

Co-developed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Co-developed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210928191009.32551-3-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/Kconfig                |  3 ++
 include/linux/cc_platform.h | 88 +++++++++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+)
 create mode 100644 include/linux/cc_platform.h

diff --git a/arch/Kconfig b/arch/Kconfig
index 69fe7133c765..632d60e13494 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -1026,6 +1026,9 @@ config RELR
 config ARCH_HAS_MEM_ENCRYPT
 	bool
 
+config ARCH_HAS_CC_PLATFORM
+	bool
+
 config HAVE_SPARSE_SYSCALL_NR
        bool
        help
diff --git a/include/linux/cc_platform.h b/include/linux/cc_platform.h
new file mode 100644
index 000000000000..a075b70b9a70
--- /dev/null
+++ b/include/linux/cc_platform.h
@@ -0,0 +1,88 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Confidential Computing Platform Capability checks
+ *
+ * Copyright (C) 2021 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ */
+
+#ifndef _LINUX_CC_PLATFORM_H
+#define _LINUX_CC_PLATFORM_H
+
+#include <linux/types.h>
+#include <linux/stddef.h>
+
+/**
+ * enum cc_attr - Confidential computing attributes
+ *
+ * These attributes represent confidential computing features that are
+ * currently active.
+ */
+enum cc_attr {
+	/**
+	 * @CC_ATTR_MEM_ENCRYPT: Memory encryption is active
+	 *
+	 * The platform/OS is running with active memory encryption. This
+	 * includes running either as a bare-metal system or a hypervisor
+	 * and actively using memory encryption or as a guest/virtual machine
+	 * and actively using memory encryption.
+	 *
+	 * Examples include SME, SEV and SEV-ES.
+	 */
+	CC_ATTR_MEM_ENCRYPT,
+
+	/**
+	 * @CC_ATTR_HOST_MEM_ENCRYPT: Host memory encryption is active
+	 *
+	 * The platform/OS is running as a bare-metal system or a hypervisor
+	 * and actively using memory encryption.
+	 *
+	 * Examples include SME.
+	 */
+	CC_ATTR_HOST_MEM_ENCRYPT,
+
+	/**
+	 * @CC_ATTR_GUEST_MEM_ENCRYPT: Guest memory encryption is active
+	 *
+	 * The platform/OS is running as a guest/virtual machine and actively
+	 * using memory encryption.
+	 *
+	 * Examples include SEV and SEV-ES.
+	 */
+	CC_ATTR_GUEST_MEM_ENCRYPT,
+
+	/**
+	 * @CC_ATTR_GUEST_STATE_ENCRYPT: Guest state encryption is active
+	 *
+	 * The platform/OS is running as a guest/virtual machine and actively
+	 * using memory encryption and register state encryption.
+	 *
+	 * Examples include SEV-ES.
+	 */
+	CC_ATTR_GUEST_STATE_ENCRYPT,
+};
+
+#ifdef CONFIG_ARCH_HAS_CC_PLATFORM
+
+/**
+ * cc_platform_has() - Checks if the specified cc_attr attribute is active
+ * @attr: Confidential computing attribute to check
+ *
+ * The cc_platform_has() function will return an indicator as to whether the
+ * specified Confidential Computing attribute is currently active.
+ *
+ * Context: Any context
+ * Return:
+ * * TRUE  - Specified Confidential Computing attribute is active
+ * * FALSE - Specified Confidential Computing attribute is not active
+ */
+bool cc_platform_has(enum cc_attr attr);
+
+#else	/* !CONFIG_ARCH_HAS_CC_PLATFORM */
+
+static inline bool cc_platform_has(enum cc_attr attr) { return false; }
+
+#endif	/* CONFIG_ARCH_HAS_CC_PLATFORM */
+
+#endif	/* _LINUX_CC_PLATFORM_H */

From fc25889a6617559aa1ba904d1c0873541d3c85bf Mon Sep 17 00:00:00 2001
From: Tom Lendacky <thomas.lendacky@amd.com>
Date: Wed, 8 Sep 2021 17:58:34 -0500
Subject: [PATCH 1721/1750] x86/sev: Add an x86 version of cc_platform_has()

commit aa5a461171f98fde0df78c4f6b5018a1e967cf81 upstream.

Introduce an x86 version of the cc_platform_has() function. This will be
used to replace vendor specific calls like sme_active(), sev_active(),
etc.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210928191009.32551-4-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/Kconfig                   |  1 +
 arch/x86/include/asm/mem_encrypt.h |  1 +
 arch/x86/kernel/Makefile           |  6 +++
 arch/x86/kernel/cc_platform.c      | 69 ++++++++++++++++++++++++++++++
 arch/x86/mm/mem_encrypt.c          |  1 +
 5 files changed, 78 insertions(+)
 create mode 100644 arch/x86/kernel/cc_platform.c

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c3d9f56c9018..2b5957b27a3d 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1527,6 +1527,7 @@ config AMD_MEM_ENCRYPT
 	select ARCH_USE_MEMREMAP_PROT
 	select ARCH_HAS_FORCE_DMA_UNENCRYPTED
 	select INSTRUCTION_DECODER
+	select ARCH_HAS_CC_PLATFORM
 	help
 	  Say yes to enable support for the encryption of system memory.
 	  This requires an AMD processor that supports Secure Memory
diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h
index 2f62bbdd9d12..8f3fa55d43ce 100644
--- a/arch/x86/include/asm/mem_encrypt.h
+++ b/arch/x86/include/asm/mem_encrypt.h
@@ -13,6 +13,7 @@
 #ifndef __ASSEMBLY__
 
 #include <linux/init.h>
+#include <linux/cc_platform.h>
 
 #include <asm/bootparam.h>
 
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 68608bd892c0..c06f3a961d64 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -21,6 +21,7 @@ CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_early_printk.o = -pg
 CFLAGS_REMOVE_head64.o = -pg
 CFLAGS_REMOVE_sev-es.o = -pg
+CFLAGS_REMOVE_cc_platform.o = -pg
 endif
 
 KASAN_SANITIZE_head$(BITS).o				:= n
@@ -29,6 +30,7 @@ KASAN_SANITIZE_dumpstack_$(BITS).o			:= n
 KASAN_SANITIZE_stacktrace.o				:= n
 KASAN_SANITIZE_paravirt.o				:= n
 KASAN_SANITIZE_sev-es.o					:= n
+KASAN_SANITIZE_cc_platform.o				:= n
 
 # With some compiler versions the generated code results in boot hangs, caused
 # by several compilation units. To be safe, disable all instrumentation.
@@ -48,6 +50,7 @@ endif
 KCOV_INSTRUMENT		:= n
 
 CFLAGS_head$(BITS).o	+= -fno-stack-protector
+CFLAGS_cc_platform.o	+= -fno-stack-protector
 
 CFLAGS_irq.o := -I $(srctree)/$(src)/../include/asm/trace
 
@@ -151,6 +154,9 @@ obj-$(CONFIG_UNWINDER_FRAME_POINTER)	+= unwind_frame.o
 obj-$(CONFIG_UNWINDER_GUESS)		+= unwind_guess.o
 
 obj-$(CONFIG_AMD_MEM_ENCRYPT)		+= sev-es.o
+
+obj-$(CONFIG_ARCH_HAS_CC_PLATFORM)	+= cc_platform.o
+
 ###
 # 64 bit specific files
 ifeq ($(CONFIG_X86_64),y)
diff --git a/arch/x86/kernel/cc_platform.c b/arch/x86/kernel/cc_platform.c
new file mode 100644
index 000000000000..03bb2f343ddb
--- /dev/null
+++ b/arch/x86/kernel/cc_platform.c
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Confidential Computing Platform Capability checks
+ *
+ * Copyright (C) 2021 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ */
+
+#include <linux/export.h>
+#include <linux/cc_platform.h>
+#include <linux/mem_encrypt.h>
+
+#include <asm/processor.h>
+
+static bool __maybe_unused intel_cc_platform_has(enum cc_attr attr)
+{
+#ifdef CONFIG_INTEL_TDX_GUEST
+	return false;
+#else
+	return false;
+#endif
+}
+
+/*
+ * SME and SEV are very similar but they are not the same, so there are
+ * times that the kernel will need to distinguish between SME and SEV. The
+ * cc_platform_has() function is used for this.  When a distinction isn't
+ * needed, the CC_ATTR_MEM_ENCRYPT attribute can be used.
+ *
+ * The trampoline code is a good example for this requirement.  Before
+ * paging is activated, SME will access all memory as decrypted, but SEV
+ * will access all memory as encrypted.  So, when APs are being brought
+ * up under SME the trampoline area cannot be encrypted, whereas under SEV
+ * the trampoline area must be encrypted.
+ */
+static bool amd_cc_platform_has(enum cc_attr attr)
+{
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+	switch (attr) {
+	case CC_ATTR_MEM_ENCRYPT:
+		return sme_me_mask;
+
+	case CC_ATTR_HOST_MEM_ENCRYPT:
+		return sme_me_mask && !(sev_status & MSR_AMD64_SEV_ENABLED);
+
+	case CC_ATTR_GUEST_MEM_ENCRYPT:
+		return sev_status & MSR_AMD64_SEV_ENABLED;
+
+	case CC_ATTR_GUEST_STATE_ENCRYPT:
+		return sev_status & MSR_AMD64_SEV_ES_ENABLED;
+
+	default:
+		return false;
+	}
+#else
+	return false;
+#endif
+}
+
+
+bool cc_platform_has(enum cc_attr attr)
+{
+	if (sme_me_mask)
+		return amd_cc_platform_has(attr);
+
+	return false;
+}
+EXPORT_SYMBOL_GPL(cc_platform_has);
diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
index cc85e199108e..97f7eb5d15c2 100644
--- a/arch/x86/mm/mem_encrypt.c
+++ b/arch/x86/mm/mem_encrypt.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/bitops.h>
 #include <linux/dma-mapping.h>
+#include <linux/cc_platform.h>
 
 #include <asm/tlbflush.h>
 #include <asm/fixmap.h>

From 45490bfa1ebb7dd8c7f9e77d72e5d006c1162219 Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Fri, 1 Oct 2021 21:41:20 +0200
Subject: [PATCH 1722/1750] x86/sev: Make the #VC exception stacks part of the
 default stacks storage

commit 541ac97186d9ea88491961a46284de3603c914fd upstream.

The size of the exception stacks was increased by the commit in Fixes,
resulting in stack sizes greater than a page in size. The #VC exception
handling was only mapping the first (bottom) page, resulting in an
SEV-ES guest failing to boot.

Make the #VC exception stacks part of the default exception stacks
storage and allocate them with a CONFIG_AMD_MEM_ENCRYPT=y .config. Map
them only when a SEV-ES guest has been detected.

Rip out the custom VC stacks mapping and storage code.

 [ bp: Steal and adapt Tom's commit message. ]

Fixes: 7fae4c24a2b8 ("x86: Increase exception stack sizes")
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Tom Lendacky <thomas.lendacky@amd.com>
Tested-by: Brijesh Singh <brijesh.singh@amd.com>
Link: https://lkml.kernel.org/r/YVt1IMjIs7pIZTRR@zn.tnic
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/cpu_entry_area.h |  8 ++++++-
 arch/x86/kernel/sev-es.c              | 32 ---------------------------
 arch/x86/mm/cpu_entry_area.c          |  7 ++++++
 3 files changed, 14 insertions(+), 33 deletions(-)

diff --git a/arch/x86/include/asm/cpu_entry_area.h b/arch/x86/include/asm/cpu_entry_area.h
index 3d52b094850a..dd5ea1bdf04c 100644
--- a/arch/x86/include/asm/cpu_entry_area.h
+++ b/arch/x86/include/asm/cpu_entry_area.h
@@ -10,6 +10,12 @@
 
 #ifdef CONFIG_X86_64
 
+#ifdef CONFIG_AMD_MEM_ENCRYPT
+#define VC_EXCEPTION_STKSZ	EXCEPTION_STKSZ
+#else
+#define VC_EXCEPTION_STKSZ	0
+#endif
+
 /* Macro to enforce the same ordering and stack sizes */
 #define ESTACKS_MEMBERS(guardsize, optional_stack_size)		\
 	char	DF_stack_guard[guardsize];			\
@@ -28,7 +34,7 @@
 
 /* The exception stacks' physical storage. No guard pages required */
 struct exception_stacks {
-	ESTACKS_MEMBERS(0, 0)
+	ESTACKS_MEMBERS(0, VC_EXCEPTION_STKSZ)
 };
 
 /* The effective cpu entry area mapping with guard pages. */
diff --git a/arch/x86/kernel/sev-es.c b/arch/x86/kernel/sev-es.c
index f3202b2e3c15..865e234ea24b 100644
--- a/arch/x86/kernel/sev-es.c
+++ b/arch/x86/kernel/sev-es.c
@@ -46,16 +46,6 @@ static struct ghcb __initdata *boot_ghcb;
 struct sev_es_runtime_data {
 	struct ghcb ghcb_page;
 
-	/* Physical storage for the per-CPU IST stack of the #VC handler */
-	char ist_stack[EXCEPTION_STKSZ] __aligned(PAGE_SIZE);
-
-	/*
-	 * Physical storage for the per-CPU fall-back stack of the #VC handler.
-	 * The fall-back stack is used when it is not safe to switch back to the
-	 * interrupted stack in the #VC entry code.
-	 */
-	char fallback_stack[EXCEPTION_STKSZ] __aligned(PAGE_SIZE);
-
 	/*
 	 * Reserve one page per CPU as backup storage for the unencrypted GHCB.
 	 * It is needed when an NMI happens while the #VC handler uses the real
@@ -99,27 +89,6 @@ DEFINE_STATIC_KEY_FALSE(sev_es_enable_key);
 /* Needed in vc_early_forward_exception */
 void do_early_exception(struct pt_regs *regs, int trapnr);
 
-static void __init setup_vc_stacks(int cpu)
-{
-	struct sev_es_runtime_data *data;
-	struct cpu_entry_area *cea;
-	unsigned long vaddr;
-	phys_addr_t pa;
-
-	data = per_cpu(runtime_data, cpu);
-	cea  = get_cpu_entry_area(cpu);
-
-	/* Map #VC IST stack */
-	vaddr = CEA_ESTACK_BOT(&cea->estacks, VC);
-	pa    = __pa(data->ist_stack);
-	cea_set_pte((void *)vaddr, pa, PAGE_KERNEL);
-
-	/* Map VC fall-back stack */
-	vaddr = CEA_ESTACK_BOT(&cea->estacks, VC2);
-	pa    = __pa(data->fallback_stack);
-	cea_set_pte((void *)vaddr, pa, PAGE_KERNEL);
-}
-
 static __always_inline bool on_vc_stack(struct pt_regs *regs)
 {
 	unsigned long sp = regs->sp;
@@ -753,7 +722,6 @@ void __init sev_es_init_vc_handling(void)
 	for_each_possible_cpu(cpu) {
 		alloc_runtime_data(cpu);
 		init_ghcb(cpu);
-		setup_vc_stacks(cpu);
 	}
 
 	sev_es_setup_play_dead();
diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
index f5e1e60c9095..6c2f1b76a0b6 100644
--- a/arch/x86/mm/cpu_entry_area.c
+++ b/arch/x86/mm/cpu_entry_area.c
@@ -110,6 +110,13 @@ static void __init percpu_setup_exception_stacks(unsigned int cpu)
 	cea_map_stack(NMI);
 	cea_map_stack(DB);
 	cea_map_stack(MCE);
+
+	if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT)) {
+		if (cc_platform_has(CC_ATTR_GUEST_STATE_ENCRYPT)) {
+			cea_map_stack(VC);
+			cea_map_stack(VC2);
+		}
+	}
 }
 #else
 static inline void percpu_setup_exception_stacks(unsigned int cpu)

From 1e49a79bc312571093ba0dbd7f9df490c7afee22 Mon Sep 17 00:00:00 2001
From: Dmitry Osipenko <digetx@gmail.com>
Date: Tue, 2 Mar 2021 15:24:58 +0300
Subject: [PATCH 1723/1750] soc/tegra: pmc: Fix imbalanced clock disabling in
 error code path

commit 19221e3083020bd9537624caa0ee0145ed92ba36 upstream.

The tegra_powergate_power_up() has a typo in the error code path where it
will try to disable clocks twice, fix it. In practice that error never
happens, so this is a minor correction.

Tested-by: Peter Geis <pgwipeout@gmail.com> # Ouya T30
Tested-by: Nicolas Chauvet <kwizart@gmail.com> # PAZ00 T20 and TK1 T124
Tested-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/soc/tegra/pmc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
index 857354a69c39..5726c232e61d 100644
--- a/drivers/soc/tegra/pmc.c
+++ b/drivers/soc/tegra/pmc.c
@@ -693,7 +693,7 @@ static int tegra_powergate_power_up(struct tegra_powergate *pg,
 
 	err = tegra_powergate_enable_clocks(pg);
 	if (err)
-		goto disable_clks;
+		goto powergate_off;
 
 	usleep_range(10, 20);
 

From f884bb85b8d877d4e0c670403754813a7901705b Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 18 Nov 2021 14:04:33 +0100
Subject: [PATCH 1724/1750] Linux 5.10.80

Link: https://lore.kernel.org/r/20211115165343.579890274@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Hulk Robot <hulkrobot@huawei.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Link: https://lore.kernel.org/r/20211116142545.607076484@linuxfoundation.org
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Link: https://lore.kernel.org/r/20211117101457.890809587@linuxfoundation.org
Tested-by: Fox Chen <foxhlchen@gmail.com>
Link: https://lore.kernel.org/r/20211117144602.341592498@linuxfoundation.org
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 756479b101f8..71fdc74801e0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 79
+SUBLEVEL = 80
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 2d94ebb760009c35d8338b21c5a59139e79821bd Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Fri, 19 Nov 2021 12:04:53 +0100
Subject: [PATCH 1725/1750] Revert "serial: core: Fix initializing and
 restoring termios speed"

This reverts commit 47462c5e600fbaffd755cd13dedd80d04e41ff83 which is
commit 027b57170bf8bb6999a28e4a5f3d78bf1db0f90c upstream.

It breaks the kernel abi and is not something that is necessary in
Android systems, so it is safe to revert.

Bug: 161946584
Fixes: 47462c5e600f ("serial: core: Fix initializing and restoring termios speed")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I158a28eb7a1ac7892c836abcdbc178129de69391
---
 drivers/tty/serial/serial_core.c | 16 ++--------------
 include/linux/console.h          |  2 --
 2 files changed, 2 insertions(+), 16 deletions(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index e6fb5077fe34..68a0ff605476 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -222,11 +222,7 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state,
 	if (retval == 0) {
 		if (uart_console(uport) && uport->cons->cflag) {
 			tty->termios.c_cflag = uport->cons->cflag;
-			tty->termios.c_ispeed = uport->cons->ispeed;
-			tty->termios.c_ospeed = uport->cons->ospeed;
 			uport->cons->cflag = 0;
-			uport->cons->ispeed = 0;
-			uport->cons->ospeed = 0;
 		}
 		/*
 		 * Initialise the hardware port settings.
@@ -294,11 +290,8 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
 		/*
 		 * Turn off DTR and RTS early.
 		 */
-		if (uport && uart_console(uport) && tty) {
+		if (uport && uart_console(uport) && tty)
 			uport->cons->cflag = tty->termios.c_cflag;
-			uport->cons->ispeed = tty->termios.c_ispeed;
-			uport->cons->ospeed = tty->termios.c_ospeed;
-		}
 
 		if (!tty || C_HUPCL(tty))
 			uart_port_dtr_rts(uport, 0);
@@ -2130,11 +2123,8 @@ uart_set_options(struct uart_port *port, struct console *co,
 	 * Allow the setting of the UART parameters with a NULL console
 	 * too:
 	 */
-	if (co) {
+	if (co)
 		co->cflag = termios.c_cflag;
-		co->ispeed = termios.c_ispeed;
-		co->ospeed = termios.c_ospeed;
-	}
 
 	return 0;
 }
@@ -2268,8 +2258,6 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
 		 */
 		memset(&termios, 0, sizeof(struct ktermios));
 		termios.c_cflag = uport->cons->cflag;
-		termios.c_ispeed = uport->cons->ispeed;
-		termios.c_ospeed = uport->cons->ospeed;
 
 		/*
 		 * If that's unset, use the tty termios setting.
diff --git a/include/linux/console.h b/include/linux/console.h
index bc2a749e6f0d..4b1e26c4cb42 100644
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -150,8 +150,6 @@ struct console {
 	short	flags;
 	short	index;
 	int	cflag;
-	uint	ispeed;
-	uint	ospeed;
 	void	*data;
 	struct	 console *next;
 };

From e101be336e04a4189d35578f6e8bde4ed7ca005f Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Fri, 19 Nov 2021 12:20:53 +0100
Subject: [PATCH 1726/1750] Revert "net: sched: update default qdisc visibility
 after Tx queue cnt changes"

This reverts commit 8d433ab5c8c26fa33ef9013b375a74d30918ac03 which is
commit 1e080f17750d1083e8a32f7b350584ae1cd7ff20 upstream.

It breaks the current kernel abi and is not necessary for Android
systems, so it can be safely reverted.

Bug: 161946584
Fixes: 8d433ab5c8c2 ("net: sched: update default qdisc visibility after Tx queue cnt changes")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9844bcc7deae772026e0dc7b1265b39e392342ec
---
 include/net/sch_generic.h |  4 ----
 net/core/dev.c            |  2 --
 net/sched/sch_generic.c   |  9 ---------
 net/sched/sch_mq.c        | 24 ------------------------
 net/sched/sch_mqprio.c    | 23 -----------------------
 5 files changed, 62 deletions(-)

diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index be3680b73fb3..2faae277f042 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -307,8 +307,6 @@ struct Qdisc_ops {
 					  struct netlink_ext_ack *extack);
 	void			(*attach)(struct Qdisc *sch);
 	int			(*change_tx_queue_len)(struct Qdisc *, unsigned int);
-	void			(*change_real_num_tx)(struct Qdisc *sch,
-						      unsigned int new_real_tx);
 
 	int			(*dump)(struct Qdisc *, struct sk_buff *);
 	int			(*dump_stats)(struct Qdisc *, struct gnet_dump *);
@@ -692,8 +690,6 @@ void qdisc_class_hash_grow(struct Qdisc *, struct Qdisc_class_hash *);
 void qdisc_class_hash_destroy(struct Qdisc_class_hash *);
 
 int dev_qdisc_change_tx_queue_len(struct net_device *dev);
-void dev_qdisc_change_real_num_tx(struct net_device *dev,
-				  unsigned int new_real_tx);
 void dev_init_scheduler(struct net_device *dev);
 void dev_shutdown(struct net_device *dev);
 void dev_activate(struct net_device *dev);
diff --git a/net/core/dev.c b/net/core/dev.c
index 9f8998f57cbe..db9550c66399 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2980,8 +2980,6 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 		if (dev->num_tc)
 			netif_setup_tc(dev, txq);
 
-		dev_qdisc_change_real_num_tx(dev, txq);
-
 		dev->real_num_tx_queues = txq;
 
 		if (disabling) {
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 6a9c1a39874a..05aa2571a409 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -1303,15 +1303,6 @@ static int qdisc_change_tx_queue_len(struct net_device *dev,
 	return 0;
 }
 
-void dev_qdisc_change_real_num_tx(struct net_device *dev,
-				  unsigned int new_real_tx)
-{
-	struct Qdisc *qdisc = dev->qdisc;
-
-	if (qdisc->ops->change_real_num_tx)
-		qdisc->ops->change_real_num_tx(qdisc, new_real_tx);
-}
-
 int dev_qdisc_change_tx_queue_len(struct net_device *dev)
 {
 	bool up = dev->flags & IFF_UP;
diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c
index db18d8a860f9..e79f1afe0cfd 100644
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -125,29 +125,6 @@ static void mq_attach(struct Qdisc *sch)
 	priv->qdiscs = NULL;
 }
 
-static void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx)
-{
-#ifdef CONFIG_NET_SCHED
-	struct net_device *dev = qdisc_dev(sch);
-	struct Qdisc *qdisc;
-	unsigned int i;
-
-	for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
-		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
-		/* Only update the default qdiscs we created,
-		 * qdiscs with handles are always hashed.
-		 */
-		if (qdisc != &noop_qdisc && !qdisc->handle)
-			qdisc_hash_del(qdisc);
-	}
-	for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
-		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
-		if (qdisc != &noop_qdisc && !qdisc->handle)
-			qdisc_hash_add(qdisc, false);
-	}
-#endif
-}
-
 static int mq_dump(struct Qdisc *sch, struct sk_buff *skb)
 {
 	struct net_device *dev = qdisc_dev(sch);
@@ -311,7 +288,6 @@ struct Qdisc_ops mq_qdisc_ops __read_mostly = {
 	.init		= mq_init,
 	.destroy	= mq_destroy,
 	.attach		= mq_attach,
-	.change_real_num_tx = mq_change_real_num_tx,
 	.dump		= mq_dump,
 	.owner		= THIS_MODULE,
 };
diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c
index 50e15add6068..5eb3b1b7ae5e 100644
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -306,28 +306,6 @@ static void mqprio_attach(struct Qdisc *sch)
 	priv->qdiscs = NULL;
 }
 
-static void mqprio_change_real_num_tx(struct Qdisc *sch,
-				      unsigned int new_real_tx)
-{
-	struct net_device *dev = qdisc_dev(sch);
-	struct Qdisc *qdisc;
-	unsigned int i;
-
-	for (i = new_real_tx; i < dev->real_num_tx_queues; i++) {
-		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
-		/* Only update the default qdiscs we created,
-		 * qdiscs with handles are always hashed.
-		 */
-		if (qdisc != &noop_qdisc && !qdisc->handle)
-			qdisc_hash_del(qdisc);
-	}
-	for (i = dev->real_num_tx_queues; i < new_real_tx; i++) {
-		qdisc = netdev_get_tx_queue(dev, i)->qdisc_sleeping;
-		if (qdisc != &noop_qdisc && !qdisc->handle)
-			qdisc_hash_add(qdisc, false);
-	}
-}
-
 static struct netdev_queue *mqprio_queue_get(struct Qdisc *sch,
 					     unsigned long cl)
 {
@@ -651,7 +629,6 @@ static struct Qdisc_ops mqprio_qdisc_ops __read_mostly = {
 	.init		= mqprio_init,
 	.destroy	= mqprio_destroy,
 	.attach		= mqprio_attach,
-	.change_real_num_tx = mqprio_change_real_num_tx,
 	.dump		= mqprio_dump,
 	.owner		= THIS_MODULE,
 };

From 971945b72224824ab41bf8c264b71bff7cb20326 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Fri, 19 Nov 2021 14:21:03 +0100
Subject: [PATCH 1727/1750] Revert "tcp: switch orphan_count to bare per-cpu
 counters"

This reverts commit a342cb4772f44915b1e6688b101a41c01f9e71aa which is
commit 19757cebf0c5016a1f36f7fe9810a9f0b33c0832 upstream.

The commit breaks the abi and we don't really need to worry about
Android on systems with greater than 256 CPUs at this point in time.

Bug: 161946584
Fixes: a342cb4772f4 ("tcp: switch orphan_count to bare per-cpu counters")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifeb445b4490db185eacc379fbcab2a3ed3b966fb
---
 .../chelsio/inline_crypto/chtls/chtls_cm.c    |  2 +-
 .../chelsio/inline_crypto/chtls/chtls_cm.h    |  2 +-
 include/net/inet_connection_sock.h            |  2 +-
 include/net/sock.h                            |  2 +-
 include/net/tcp.h                             | 17 +++++++--
 net/dccp/dccp.h                               |  2 +-
 net/dccp/proto.c                              | 14 +++++--
 net/ipv4/inet_connection_sock.c               |  4 +-
 net/ipv4/inet_hashtables.c                    |  2 +-
 net/ipv4/proc.c                               |  2 +-
 net/ipv4/tcp.c                                | 38 +++----------------
 11 files changed, 38 insertions(+), 49 deletions(-)

diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
index d6b6ebb3f1ec..a262c949ed76 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c
@@ -870,7 +870,7 @@ static void do_abort_syn_rcv(struct sock *child, struct sock *parent)
 		 * created only after 3 way handshake is done.
 		 */
 		sock_orphan(child);
-		INC_ORPHAN_COUNT(child);
+		percpu_counter_inc((child)->sk_prot->orphan_count);
 		chtls_release_resources(child);
 		chtls_conn_done(child);
 	} else {
diff --git a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
index f61ca657601c..b1161bdeda4d 100644
--- a/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
+++ b/drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.h
@@ -95,7 +95,7 @@ struct deferred_skb_cb {
 #define WSCALE_OK(tp) ((tp)->rx_opt.wscale_ok)
 #define TSTAMP_OK(tp) ((tp)->rx_opt.tstamp_ok)
 #define SACK_OK(tp) ((tp)->rx_opt.sack_ok)
-#define INC_ORPHAN_COUNT(sk) this_cpu_inc(*(sk)->sk_prot->orphan_count)
+#define INC_ORPHAN_COUNT(sk) percpu_counter_inc((sk)->sk_prot->orphan_count)
 
 /* TLS SKB */
 #define skb_ulp_tls_inline(skb)      (ULP_SKB_CB(skb)->ulp.tls.ofld)
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 5894b5b44365..8177cb94958c 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -296,7 +296,7 @@ static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk)
 {
 	/* The below has to be done to allow calling inet_csk_destroy_sock */
 	sock_set_flag(sk, SOCK_DEAD);
-	this_cpu_inc(*sk->sk_prot->orphan_count);
+	percpu_counter_inc(sk->sk_prot->orphan_count);
 }
 
 void inet_csk_destroy_sock(struct sock *sk);
diff --git a/include/net/sock.h b/include/net/sock.h
index f913c45db396..d50823df426c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1235,7 +1235,7 @@ struct proto {
 	unsigned int		useroffset;	/* Usercopy region offset */
 	unsigned int		usersize;	/* Usercopy region size */
 
-	unsigned int __percpu	*orphan_count;
+	struct percpu_counter	*orphan_count;
 
 	struct request_sock_ops	*rsk_prot;
 	struct timewait_sock_ops *twsk_prot;
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 334b8d1b5442..eff611da5780 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -48,9 +48,7 @@
 
 extern struct inet_hashinfo tcp_hashinfo;
 
-DECLARE_PER_CPU(unsigned int, tcp_orphan_count);
-int tcp_orphan_count_sum(void);
-
+extern struct percpu_counter tcp_orphan_count;
 void tcp_time_wait(struct sock *sk, int state, int timeo);
 
 #define MAX_TCP_HEADER	L1_CACHE_ALIGN(128 + MAX_HEADER)
@@ -292,6 +290,19 @@ static inline bool tcp_out_of_memory(struct sock *sk)
 
 void sk_forced_mem_schedule(struct sock *sk, int size);
 
+static inline bool tcp_too_many_orphans(struct sock *sk, int shift)
+{
+	struct percpu_counter *ocp = sk->sk_prot->orphan_count;
+	int orphans = percpu_counter_read_positive(ocp);
+
+	if (orphans << shift > sysctl_tcp_max_orphans) {
+		orphans = percpu_counter_sum_positive(ocp);
+		if (orphans << shift > sysctl_tcp_max_orphans)
+			return true;
+	}
+	return false;
+}
+
 bool tcp_check_oom(struct sock *sk, int shift);
 
 
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 5183e627468d..c5c1d2b8045e 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -48,7 +48,7 @@ extern bool dccp_debug;
 
 extern struct inet_hashinfo dccp_hashinfo;
 
-DECLARE_PER_CPU(unsigned int, dccp_orphan_count);
+extern struct percpu_counter dccp_orphan_count;
 
 void dccp_time_wait(struct sock *sk, int state, int timeo);
 
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 548cf0135647..6d705d90c614 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -42,8 +42,8 @@ DEFINE_SNMP_STAT(struct dccp_mib, dccp_statistics) __read_mostly;
 
 EXPORT_SYMBOL_GPL(dccp_statistics);
 
-DEFINE_PER_CPU(unsigned int, dccp_orphan_count);
-EXPORT_PER_CPU_SYMBOL_GPL(dccp_orphan_count);
+struct percpu_counter dccp_orphan_count;
+EXPORT_SYMBOL_GPL(dccp_orphan_count);
 
 struct inet_hashinfo dccp_hashinfo;
 EXPORT_SYMBOL_GPL(dccp_hashinfo);
@@ -1055,7 +1055,7 @@ void dccp_close(struct sock *sk, long timeout)
 	bh_lock_sock(sk);
 	WARN_ON(sock_owned_by_user(sk));
 
-	this_cpu_inc(dccp_orphan_count);
+	percpu_counter_inc(sk->sk_prot->orphan_count);
 
 	/* Have we already been destroyed by a softirq or backlog? */
 	if (state != DCCP_CLOSED && sk->sk_state == DCCP_CLOSED)
@@ -1115,10 +1115,13 @@ static int __init dccp_init(void)
 
 	BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
 		     sizeof_field(struct sk_buff, cb));
+	rc = percpu_counter_init(&dccp_orphan_count, 0, GFP_KERNEL);
+	if (rc)
+		goto out_fail;
 	inet_hashinfo_init(&dccp_hashinfo);
 	rc = inet_hashinfo2_init_mod(&dccp_hashinfo);
 	if (rc)
-		goto out_fail;
+		goto out_free_percpu;
 	rc = -ENOBUFS;
 	dccp_hashinfo.bind_bucket_cachep =
 		kmem_cache_create("dccp_bind_bucket",
@@ -1223,6 +1226,8 @@ static int __init dccp_init(void)
 	kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
 out_free_hashinfo2:
 	inet_hashinfo2_free_mod(&dccp_hashinfo);
+out_free_percpu:
+	percpu_counter_destroy(&dccp_orphan_count);
 out_fail:
 	dccp_hashinfo.bhash = NULL;
 	dccp_hashinfo.ehash = NULL;
@@ -1245,6 +1250,7 @@ static void __exit dccp_fini(void)
 	dccp_ackvec_exit();
 	dccp_sysctl_exit();
 	inet_hashinfo2_free_mod(&dccp_hashinfo);
+	percpu_counter_destroy(&dccp_orphan_count);
 }
 
 module_init(dccp_init);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index addd595bb3fe..1dfa561e8f98 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -892,7 +892,7 @@ void inet_csk_destroy_sock(struct sock *sk)
 
 	sk_refcnt_debug_release(sk);
 
-	this_cpu_dec(*sk->sk_prot->orphan_count);
+	percpu_counter_dec(sk->sk_prot->orphan_count);
 
 	sock_put(sk);
 }
@@ -951,7 +951,7 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req,
 
 	sock_orphan(child);
 
-	this_cpu_inc(*sk->sk_prot->orphan_count);
+	percpu_counter_inc(sk->sk_prot->orphan_count);
 
 	if (sk->sk_protocol == IPPROTO_TCP && tcp_rsk(req)->tfo_listener) {
 		BUG_ON(rcu_access_pointer(tcp_sk(child)->fastopen_rsk) != req);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index e093847c334d..f3fd5c911ed0 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -598,7 +598,7 @@ bool inet_ehash_nolisten(struct sock *sk, struct sock *osk, bool *found_dup_sk)
 	if (ok) {
 		sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
 	} else {
-		this_cpu_inc(*sk->sk_prot->orphan_count);
+		percpu_counter_inc(sk->sk_prot->orphan_count);
 		inet_sk_set_state(sk, TCP_CLOSE);
 		sock_set_flag(sk, SOCK_DEAD);
 		inet_csk_destroy_sock(sk);
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 80d13d8f982d..8d5e1695b9aa 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -53,7 +53,7 @@ static int sockstat_seq_show(struct seq_file *seq, void *v)
 	struct net *net = seq->private;
 	int orphans, sockets;
 
-	orphans = tcp_orphan_count_sum();
+	orphans = percpu_counter_sum_positive(&tcp_orphan_count);
 	sockets = proto_sockets_allocated_sum_positive(&tcp_prot);
 
 	socket_seq_show(seq);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 55dbcac8425d..0f9d44d5202a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -282,8 +282,8 @@
 
 #include <trace/hooks/ipv4.h>
 
-DEFINE_PER_CPU(unsigned int, tcp_orphan_count);
-EXPORT_PER_CPU_SYMBOL_GPL(tcp_orphan_count);
+struct percpu_counter tcp_orphan_count;
+EXPORT_SYMBOL_GPL(tcp_orphan_count);
 
 long sysctl_tcp_mem[3] __read_mostly;
 EXPORT_SYMBOL(sysctl_tcp_mem);
@@ -2399,36 +2399,11 @@ void tcp_shutdown(struct sock *sk, int how)
 }
 EXPORT_SYMBOL(tcp_shutdown);
 
-int tcp_orphan_count_sum(void)
-{
-	int i, total = 0;
-
-	for_each_possible_cpu(i)
-		total += per_cpu(tcp_orphan_count, i);
-
-	return max(total, 0);
-}
-
-static int tcp_orphan_cache;
-static struct timer_list tcp_orphan_timer;
-#define TCP_ORPHAN_TIMER_PERIOD msecs_to_jiffies(100)
-
-static void tcp_orphan_update(struct timer_list *unused)
-{
-	WRITE_ONCE(tcp_orphan_cache, tcp_orphan_count_sum());
-	mod_timer(&tcp_orphan_timer, jiffies + TCP_ORPHAN_TIMER_PERIOD);
-}
-
-static bool tcp_too_many_orphans(int shift)
-{
-	return READ_ONCE(tcp_orphan_cache) << shift > sysctl_tcp_max_orphans;
-}
-
 bool tcp_check_oom(struct sock *sk, int shift)
 {
 	bool too_many_orphans, out_of_socket_memory;
 
-	too_many_orphans = tcp_too_many_orphans(shift);
+	too_many_orphans = tcp_too_many_orphans(sk, shift);
 	out_of_socket_memory = tcp_out_of_memory(sk);
 
 	if (too_many_orphans)
@@ -2538,7 +2513,7 @@ void tcp_close(struct sock *sk, long timeout)
 	/* remove backlog if any, without releasing ownership. */
 	__release_sock(sk);
 
-	this_cpu_inc(tcp_orphan_count);
+	percpu_counter_inc(sk->sk_prot->orphan_count);
 
 	/* Have we already been destroyed by a softirq or backlog? */
 	if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
@@ -4175,10 +4150,7 @@ void __init tcp_init(void)
 		     sizeof_field(struct sk_buff, cb));
 
 	percpu_counter_init(&tcp_sockets_allocated, 0, GFP_KERNEL);
-
-	timer_setup(&tcp_orphan_timer, tcp_orphan_update, TIMER_DEFERRABLE);
-	mod_timer(&tcp_orphan_timer, jiffies + TCP_ORPHAN_TIMER_PERIOD);
-
+	percpu_counter_init(&tcp_orphan_count, 0, GFP_KERNEL);
 	inet_hashinfo_init(&tcp_hashinfo);
 	inet_hashinfo2_init(&tcp_hashinfo, "tcp_listen_portaddr_hash",
 			    thash_entries, 21,  /* one slot per 2 MB*/

From eaafc590053b314d4907017044ba2e739893c17c Mon Sep 17 00:00:00 2001
From: Kees Cook <keescook@chromium.org>
Date: Wed, 12 May 2021 21:51:10 -0700
Subject: [PATCH 1728/1750] fortify: Explicitly disable Clang support

commit a52f8a59aef46b59753e583bf4b28fccb069ce64 upstream.

Clang has never correctly compiled the FORTIFY_SOURCE defenses due to
a couple bugs:

	Eliding inlines with matching __builtin_* names
	https://bugs.llvm.org/show_bug.cgi?id=50322

	Incorrect __builtin_constant_p() of some globals
	https://bugs.llvm.org/show_bug.cgi?id=41459

In the process of making improvements to the FORTIFY_SOURCE defenses, the
first (silent) bug (coincidentally) becomes worked around, but exposes
the latter which breaks the build. As such, Clang must not be used with
CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13),
and the fortify routines have been rearranged.

Update the Kconfig to reflect the reality of the current situation.

Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/Kconfig | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/security/Kconfig b/security/Kconfig
index 7561f6f99f1d..0548db16c49d 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -191,6 +191,9 @@ config HARDENED_USERCOPY_PAGESPAN
 config FORTIFY_SOURCE
 	bool "Harden common str/mem functions against buffer overflows"
 	depends on ARCH_HAS_FORTIFY_SOURCE
+	# https://bugs.llvm.org/show_bug.cgi?id=50322
+	# https://bugs.llvm.org/show_bug.cgi?id=41459
+	depends on !CC_IS_CLANG
 	help
 	  Detect overflows of buffers in common string and memory functions
 	  where the compiler can determine and validate the buffer sizes.

From 79ff56c613c193744d6be77d4c50a7ae22d6dd01 Mon Sep 17 00:00:00 2001
From: Xie Yongji <xieyongji@bytedance.com>
Date: Tue, 26 Oct 2021 22:40:12 +0800
Subject: [PATCH 1729/1750] block: Add a helper to validate the block size

commit 570b1cac477643cbf01a45fa5d018430a1fddbce upstream.

There are some duplicated codes to validate the block
size in block drivers. This limitation actually comes
from block layer, so this patch tries to add a new block
layer helper for that.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: https://lore.kernel.org/r/20211026144015.188-2-xieyongji@bytedance.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/blkdev.h | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4ba17736b614..98fdf5a31fd6 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -59,6 +59,14 @@ struct blk_keyslot_manager;
  */
 #define BLKCG_MAX_POLS		5
 
+static inline int blk_validate_block_size(unsigned int bsize)
+{
+	if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
+		return -EINVAL;
+
+	return 0;
+}
+
 typedef void (rq_end_io_fn)(struct request *, blk_status_t);
 
 /*

From 04e46514fef692ccd0bca6fbab7fa1e63e5cd05a Mon Sep 17 00:00:00 2001
From: Xie Yongji <xieyongji@bytedance.com>
Date: Tue, 26 Oct 2021 22:40:14 +0800
Subject: [PATCH 1730/1750] loop: Use blk_validate_block_size() to validate
 block size

commit af3c570fb0df422b4906ebd11c1bf363d89961d5 upstream.

Remove loop_validate_block_size() and use the block layer helper
to validate block size.

Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: https://lore.kernel.org/r/20211026144015.188-4-xieyongji@bytedance.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Cc: Tadeusz Struk <tadeusz.struk@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/block/loop.c | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index f0fa0c8e7ec6..ee537a9f1d1a 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -228,19 +228,6 @@ static void __loop_update_dio(struct loop_device *lo, bool dio)
 		blk_mq_unfreeze_queue(lo->lo_queue);
 }
 
-/**
- * loop_validate_block_size() - validates the passed in block size
- * @bsize: size to validate
- */
-static int
-loop_validate_block_size(unsigned short bsize)
-{
-	if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize))
-		return -EINVAL;
-
-	return 0;
-}
-
 /**
  * loop_set_size() - sets device size and notifies userspace
  * @lo: struct loop_device to set the size for
@@ -1121,7 +1108,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode,
 	}
 
 	if (config->block_size) {
-		error = loop_validate_block_size(config->block_size);
+		error = blk_validate_block_size(config->block_size);
 		if (error)
 			goto out_unlock;
 	}
@@ -1617,7 +1604,7 @@ static int loop_set_block_size(struct loop_device *lo, unsigned long arg)
 	if (lo->lo_state != Lo_bound)
 		return -ENXIO;
 
-	err = loop_validate_block_size(arg);
+	err = blk_validate_block_size(arg);
 	if (err)
 		return err;
 

From f27060e28efcbd939e4ae6cd2ecc2ba7d2f5d93d Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: Thu, 16 Sep 2021 15:23:12 +0900
Subject: [PATCH 1731/1750] bootconfig: init: Fix memblock leak in
 xbc_make_cmdline()

commit 1ae43851b18afe861120ebd7c426dc44f06bb2bd upstream.

Free unused memblock in a error case to fix memblock leak
in xbc_make_cmdline().

Link: https://lkml.kernel.org/r/163177339181.682366.8713781325929549256.stgit@devnote2

Fixes: 51887d03aca1 ("bootconfig: init: Allow admin to use bootconfig for kernel command line")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 init/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/init/main.c b/init/main.c
index dd26a42e80a8..4fe58ed4aca7 100644
--- a/init/main.c
+++ b/init/main.c
@@ -380,6 +380,7 @@ static char * __init xbc_make_cmdline(const char *key)
 	ret = xbc_snprint_cmdline(new_cmdline, len + 1, root);
 	if (ret < 0 || ret > len) {
 		pr_err("Failed to print extra kernel cmdline.\n");
+		memblock_free(__pa(new_cmdline), len + 1);
 		return NULL;
 	}
 

From 3afe11be6435e126f1507ddf1a9d0e5a0d90b336 Mon Sep 17 00:00:00 2001
From: Joakim Zhang <qiangqing.zhang@nxp.com>
Date: Fri, 19 Nov 2021 10:53:54 +0800
Subject: [PATCH 1732/1750] net: stmmac: add clocks management for gmac driver

commit 5ec55823438e850c91c6b92aec93fb04ebde29e2 upstream.

This patch intends to add clocks management for stmmac driver:

If CONFIG_PM enabled:
1. Keep clocks disabled after driver probed.
2. Enable clocks when up the net device, and disable clocks when down
the net device.

If CONFIG_PM disabled:
Keep clocks always enabled after driver probed.

Note:
1. It is fine for ethtool, since the way of implementing ethtool_ops::begin
in stmmac is only can be accessed when interface is enabled, so the clocks
are ticked.
2. The MDIO bus has a different life cycle to the MAC, need ensure
clocks are enabled when _mdio_read/write() need clocks, because these
functions can be called while the interface it not opened.

Stable backport notes:
When run below command to remove ethernet driver on
stratix10 platform, there will be warning trace as below:

$ cd /sys/class/net/eth0/device/driver/
$ echo ff800000.ethernet > unbind

WARNING: CPU: 3 PID: 386 at drivers/clk/clk.c:810 clk_core_unprepare+0x114/0x274
Modules linked in: sch_fq_codel
CPU: 3 PID: 386 Comm: sh Tainted: G        W         5.10.74-yocto-standard #1
Hardware name: SoCFPGA Stratix 10 SoCDK (DT)
pstate: 00000005 (nzcv daif -PAN -UAO -TCO BTYPE=--)
pc : clk_core_unprepare+0x114/0x274
lr : clk_core_unprepare+0x114/0x274
sp : ffff800011bdbb10
clk_core_unprepare+0x114/0x274
 clk_unprepare+0x38/0x50
 stmmac_remove_config_dt+0x40/0x80
 stmmac_pltfr_remove+0x64/0x80
 platform_drv_remove+0x38/0x60
 ... ..
 el0_sync_handler+0x1a4/0x1b0
 el0_sync+0x180/0x1c0
This issue is introduced by introducing upstream commit 8f269102baf7
("net: stmmac: disable clocks in stmmac_remove_config_dt()")

But in latest mainline kernel, there is no this issue. Because this
patch improved clocks management for stmmac driver.
Therefore, backport it and its fixing patches to stable kernel v5.10.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: stable@vger.kernel.org
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac.h  |   1 +
 .../net/ethernet/stmicro/stmmac/stmmac_main.c |  75 ++++++++++--
 .../net/ethernet/stmicro/stmmac/stmmac_mdio.c | 111 ++++++++++++++----
 .../ethernet/stmicro/stmmac/stmmac_platform.c |  24 +++-
 4 files changed, 174 insertions(+), 37 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 727e68dfaf1c..a4ca283e0228 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -270,6 +270,7 @@ void stmmac_disable_eee_mode(struct stmmac_priv *priv);
 bool stmmac_eee_init(struct stmmac_priv *priv);
 int stmmac_reinit_queues(struct net_device *dev, u32 rx_cnt, u32 tx_cnt);
 int stmmac_reinit_ringparam(struct net_device *dev, u32 rx_size, u32 tx_size);
+int stmmac_bus_clks_config(struct stmmac_priv *priv, bool enabled);
 
 #if IS_ENABLED(CONFIG_STMMAC_SELFTESTS)
 void stmmac_selftest_run(struct net_device *dev,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 0ac61e7ab43c..498962c4b59e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -28,6 +28,7 @@
 #include <linux/if_vlan.h>
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
+#include <linux/pm_runtime.h>
 #include <linux/prefetch.h>
 #include <linux/pinctrl/consumer.h>
 #ifdef CONFIG_DEBUG_FS
@@ -113,6 +114,28 @@ static void stmmac_exit_fs(struct net_device *dev);
 
 #define STMMAC_COAL_TIMER(x) (jiffies + usecs_to_jiffies(x))
 
+int stmmac_bus_clks_config(struct stmmac_priv *priv, bool enabled)
+{
+	int ret = 0;
+
+	if (enabled) {
+		ret = clk_prepare_enable(priv->plat->stmmac_clk);
+		if (ret)
+			return ret;
+		ret = clk_prepare_enable(priv->plat->pclk);
+		if (ret) {
+			clk_disable_unprepare(priv->plat->stmmac_clk);
+			return ret;
+		}
+	} else {
+		clk_disable_unprepare(priv->plat->stmmac_clk);
+		clk_disable_unprepare(priv->plat->pclk);
+	}
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(stmmac_bus_clks_config);
+
 /**
  * stmmac_verify_args - verify the driver parameters.
  * Description: it checks the driver parameters and set a default in case of
@@ -2792,6 +2815,12 @@ static int stmmac_open(struct net_device *dev)
 	u32 chan;
 	int ret;
 
+	ret = pm_runtime_get_sync(priv->device);
+	if (ret < 0) {
+		pm_runtime_put_noidle(priv->device);
+		return ret;
+	}
+
 	if (priv->hw->pcs != STMMAC_PCS_TBI &&
 	    priv->hw->pcs != STMMAC_PCS_RTBI &&
 	    priv->hw->xpcs == NULL) {
@@ -2800,7 +2829,7 @@ static int stmmac_open(struct net_device *dev)
 			netdev_err(priv->dev,
 				   "%s: Cannot attach to PHY (error: %d)\n",
 				   __func__, ret);
-			return ret;
+			goto init_phy_error;
 		}
 	}
 
@@ -2915,6 +2944,8 @@ static int stmmac_open(struct net_device *dev)
 	free_dma_desc_resources(priv);
 dma_desc_error:
 	phylink_disconnect_phy(priv->phylink);
+init_phy_error:
+	pm_runtime_put(priv->device);
 	return ret;
 }
 
@@ -2965,6 +2996,8 @@ static int stmmac_release(struct net_device *dev)
 
 	stmmac_release_ptp(priv);
 
+	pm_runtime_put(priv->device);
+
 	return 0;
 }
 
@@ -4616,6 +4649,12 @@ static int stmmac_vlan_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vi
 	bool is_double = false;
 	int ret;
 
+	ret = pm_runtime_get_sync(priv->device);
+	if (ret < 0) {
+		pm_runtime_put_noidle(priv->device);
+		return ret;
+	}
+
 	if (be16_to_cpu(proto) == ETH_P_8021AD)
 		is_double = true;
 
@@ -4624,10 +4663,15 @@ static int stmmac_vlan_rx_kill_vid(struct net_device *ndev, __be16 proto, u16 vi
 	if (priv->hw->num_vlan) {
 		ret = stmmac_del_hw_vlan_rx_fltr(priv, ndev, priv->hw, proto, vid);
 		if (ret)
-			return ret;
+			goto del_vlan_error;
 	}
 
-	return stmmac_vlan_update(priv, is_double);
+	ret = stmmac_vlan_update(priv, is_double);
+
+del_vlan_error:
+	pm_runtime_put(priv->device);
+
+	return ret;
 }
 
 static const struct net_device_ops stmmac_netdev_ops = {
@@ -5066,6 +5110,10 @@ int stmmac_dvr_probe(struct device *device,
 
 	stmmac_check_pcs_mode(priv);
 
+	pm_runtime_get_noresume(device);
+	pm_runtime_set_active(device);
+	pm_runtime_enable(device);
+
 	if (priv->hw->pcs != STMMAC_PCS_TBI &&
 	    priv->hw->pcs != STMMAC_PCS_RTBI) {
 		/* MDIO bus Registration */
@@ -5103,6 +5151,11 @@ int stmmac_dvr_probe(struct device *device,
 	stmmac_init_fs(ndev);
 #endif
 
+	/* Let pm_runtime_put() disable the clocks.
+	 * If CONFIG_PM is not enabled, the clocks will stay powered.
+	 */
+	pm_runtime_put(device);
+
 	return ret;
 
 error_serdes_powerup:
@@ -5117,6 +5170,7 @@ int stmmac_dvr_probe(struct device *device,
 	stmmac_napi_del(ndev);
 error_hw_init:
 	destroy_workqueue(priv->wq);
+	stmmac_bus_clks_config(priv, false);
 
 	return ret;
 }
@@ -5152,8 +5206,8 @@ int stmmac_dvr_remove(struct device *dev)
 	phylink_destroy(priv->phylink);
 	if (priv->plat->stmmac_rst)
 		reset_control_assert(priv->plat->stmmac_rst);
-	clk_disable_unprepare(priv->plat->pclk);
-	clk_disable_unprepare(priv->plat->stmmac_clk);
+	pm_runtime_put(dev);
+	pm_runtime_disable(dev);
 	if (priv->hw->pcs != STMMAC_PCS_TBI &&
 	    priv->hw->pcs != STMMAC_PCS_RTBI)
 		stmmac_mdio_unregister(ndev);
@@ -5176,6 +5230,7 @@ int stmmac_suspend(struct device *dev)
 	struct net_device *ndev = dev_get_drvdata(dev);
 	struct stmmac_priv *priv = netdev_priv(ndev);
 	u32 chan;
+	int ret;
 
 	if (!ndev || !netif_running(ndev))
 		return 0;
@@ -5219,8 +5274,9 @@ int stmmac_suspend(struct device *dev)
 		pinctrl_pm_select_sleep_state(priv->device);
 		/* Disable clock in case of PWM is off */
 		clk_disable_unprepare(priv->plat->clk_ptp_ref);
-		clk_disable_unprepare(priv->plat->pclk);
-		clk_disable_unprepare(priv->plat->stmmac_clk);
+		ret = pm_runtime_force_suspend(dev);
+		if (ret)
+			return ret;
 	}
 	mutex_unlock(&priv->lock);
 
@@ -5286,8 +5342,9 @@ int stmmac_resume(struct device *dev)
 	} else {
 		pinctrl_pm_select_default_state(priv->device);
 		/* enable the clk previously disabled */
-		clk_prepare_enable(priv->plat->stmmac_clk);
-		clk_prepare_enable(priv->plat->pclk);
+		ret = pm_runtime_force_resume(dev);
+		if (ret)
+			return ret;
 		if (priv->plat->clk_ptp_ref)
 			clk_prepare_enable(priv->plat->clk_ptp_ref);
 		/* reset the phy so that it's ready */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index 678726c62a8a..7c1a14b256da 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -15,6 +15,7 @@
 #include <linux/iopoll.h>
 #include <linux/mii.h>
 #include <linux/of_mdio.h>
+#include <linux/pm_runtime.h>
 #include <linux/phy.h>
 #include <linux/property.h>
 #include <linux/slab.h>
@@ -87,21 +88,29 @@ static int stmmac_xgmac2_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
 	u32 tmp, addr, value = MII_XGMAC_BUSY;
 	int ret;
 
+	ret = pm_runtime_get_sync(priv->device);
+	if (ret < 0) {
+		pm_runtime_put_noidle(priv->device);
+		return ret;
+	}
+
 	/* Wait until any existing MII operation is complete */
 	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
-			       !(tmp & MII_XGMAC_BUSY), 100, 10000))
-		return -EBUSY;
+			       !(tmp & MII_XGMAC_BUSY), 100, 10000)) {
+		ret = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	if (phyreg & MII_ADDR_C45) {
 		phyreg &= ~MII_ADDR_C45;
 
 		ret = stmmac_xgmac2_c45_format(priv, phyaddr, phyreg, &addr);
 		if (ret)
-			return ret;
+			goto err_disable_clks;
 	} else {
 		ret = stmmac_xgmac2_c22_format(priv, phyaddr, phyreg, &addr);
 		if (ret)
-			return ret;
+			goto err_disable_clks;
 
 		value |= MII_XGMAC_SADDR;
 	}
@@ -112,8 +121,10 @@ static int stmmac_xgmac2_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
 
 	/* Wait until any existing MII operation is complete */
 	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
-			       !(tmp & MII_XGMAC_BUSY), 100, 10000))
-		return -EBUSY;
+			       !(tmp & MII_XGMAC_BUSY), 100, 10000)) {
+		ret = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	/* Set the MII address register to read */
 	writel(addr, priv->ioaddr + mii_address);
@@ -121,11 +132,18 @@ static int stmmac_xgmac2_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
 
 	/* Wait until any existing MII operation is complete */
 	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
-			       !(tmp & MII_XGMAC_BUSY), 100, 10000))
-		return -EBUSY;
+			       !(tmp & MII_XGMAC_BUSY), 100, 10000)) {
+		ret = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	/* Read the data from the MII data register */
-	return readl(priv->ioaddr + mii_data) & GENMASK(15, 0);
+	ret = (int)readl(priv->ioaddr + mii_data) & GENMASK(15, 0);
+
+err_disable_clks:
+	pm_runtime_put(priv->device);
+
+	return ret;
 }
 
 static int stmmac_xgmac2_mdio_write(struct mii_bus *bus, int phyaddr,
@@ -138,21 +156,29 @@ static int stmmac_xgmac2_mdio_write(struct mii_bus *bus, int phyaddr,
 	u32 addr, tmp, value = MII_XGMAC_BUSY;
 	int ret;
 
+	ret = pm_runtime_get_sync(priv->device);
+	if (ret < 0) {
+		pm_runtime_put_noidle(priv->device);
+		return ret;
+	}
+
 	/* Wait until any existing MII operation is complete */
 	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
-			       !(tmp & MII_XGMAC_BUSY), 100, 10000))
-		return -EBUSY;
+			       !(tmp & MII_XGMAC_BUSY), 100, 10000)) {
+		ret = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	if (phyreg & MII_ADDR_C45) {
 		phyreg &= ~MII_ADDR_C45;
 
 		ret = stmmac_xgmac2_c45_format(priv, phyaddr, phyreg, &addr);
 		if (ret)
-			return ret;
+			goto err_disable_clks;
 	} else {
 		ret = stmmac_xgmac2_c22_format(priv, phyaddr, phyreg, &addr);
 		if (ret)
-			return ret;
+			goto err_disable_clks;
 
 		value |= MII_XGMAC_SADDR;
 	}
@@ -164,16 +190,23 @@ static int stmmac_xgmac2_mdio_write(struct mii_bus *bus, int phyaddr,
 
 	/* Wait until any existing MII operation is complete */
 	if (readl_poll_timeout(priv->ioaddr + mii_data, tmp,
-			       !(tmp & MII_XGMAC_BUSY), 100, 10000))
-		return -EBUSY;
+			       !(tmp & MII_XGMAC_BUSY), 100, 10000)) {
+		ret = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	/* Set the MII address register to write */
 	writel(addr, priv->ioaddr + mii_address);
 	writel(value, priv->ioaddr + mii_data);
 
 	/* Wait until any existing MII operation is complete */
-	return readl_poll_timeout(priv->ioaddr + mii_data, tmp,
-				  !(tmp & MII_XGMAC_BUSY), 100, 10000);
+	ret = readl_poll_timeout(priv->ioaddr + mii_data, tmp,
+				 !(tmp & MII_XGMAC_BUSY), 100, 10000);
+
+err_disable_clks:
+	pm_runtime_put(priv->device);
+
+	return ret;
 }
 
 /**
@@ -196,6 +229,12 @@ static int stmmac_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
 	int data = 0;
 	u32 v;
 
+	data = pm_runtime_get_sync(priv->device);
+	if (data < 0) {
+		pm_runtime_put_noidle(priv->device);
+		return data;
+	}
+
 	value |= (phyaddr << priv->hw->mii.addr_shift)
 		& priv->hw->mii.addr_mask;
 	value |= (phyreg << priv->hw->mii.reg_shift) & priv->hw->mii.reg_mask;
@@ -216,19 +255,26 @@ static int stmmac_mdio_read(struct mii_bus *bus, int phyaddr, int phyreg)
 	}
 
 	if (readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
-			       100, 10000))
-		return -EBUSY;
+			       100, 10000)) {
+		data = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	writel(data, priv->ioaddr + mii_data);
 	writel(value, priv->ioaddr + mii_address);
 
 	if (readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
-			       100, 10000))
-		return -EBUSY;
+			       100, 10000)) {
+		data = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	/* Read the data from the MII data register */
 	data = (int)readl(priv->ioaddr + mii_data) & MII_DATA_MASK;
 
+err_disable_clks:
+	pm_runtime_put(priv->device);
+
 	return data;
 }
 
@@ -247,10 +293,16 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
 	struct stmmac_priv *priv = netdev_priv(ndev);
 	unsigned int mii_address = priv->hw->mii.addr;
 	unsigned int mii_data = priv->hw->mii.data;
+	int ret, data = phydata;
 	u32 value = MII_BUSY;
-	int data = phydata;
 	u32 v;
 
+	ret = pm_runtime_get_sync(priv->device);
+	if (ret < 0) {
+		pm_runtime_put_noidle(priv->device);
+		return ret;
+	}
+
 	value |= (phyaddr << priv->hw->mii.addr_shift)
 		& priv->hw->mii.addr_mask;
 	value |= (phyreg << priv->hw->mii.reg_shift) & priv->hw->mii.reg_mask;
@@ -275,16 +327,23 @@ static int stmmac_mdio_write(struct mii_bus *bus, int phyaddr, int phyreg,
 
 	/* Wait until any existing MII operation is complete */
 	if (readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
-			       100, 10000))
-		return -EBUSY;
+			       100, 10000)) {
+		ret = -EBUSY;
+		goto err_disable_clks;
+	}
 
 	/* Set the MII address register to write */
 	writel(data, priv->ioaddr + mii_data);
 	writel(value, priv->ioaddr + mii_address);
 
 	/* Wait until any existing MII operation is complete */
-	return readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
-				  100, 10000);
+	ret = readl_poll_timeout(priv->ioaddr + mii_address, v, !(v & MII_BUSY),
+				 100, 10000);
+
+err_disable_clks:
+	pm_runtime_put(priv->device);
+
+	return ret;
 }
 
 /**
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 48186cd32ce1..332afe8519f4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -760,10 +760,30 @@ static int stmmac_pltfr_resume(struct device *dev)
 
 	return stmmac_resume(dev);
 }
+
+static int stmmac_runtime_suspend(struct device *dev)
+{
+	struct net_device *ndev = dev_get_drvdata(dev);
+	struct stmmac_priv *priv = netdev_priv(ndev);
+
+	stmmac_bus_clks_config(priv, false);
+
+	return 0;
+}
+
+static int stmmac_runtime_resume(struct device *dev)
+{
+	struct net_device *ndev = dev_get_drvdata(dev);
+	struct stmmac_priv *priv = netdev_priv(ndev);
+
+	return stmmac_bus_clks_config(priv, true);
+}
 #endif /* CONFIG_PM_SLEEP */
 
-SIMPLE_DEV_PM_OPS(stmmac_pltfr_pm_ops, stmmac_pltfr_suspend,
-				       stmmac_pltfr_resume);
+const struct dev_pm_ops stmmac_pltfr_pm_ops = {
+	SET_SYSTEM_SLEEP_PM_OPS(stmmac_pltfr_suspend, stmmac_pltfr_resume)
+	SET_RUNTIME_PM_OPS(stmmac_runtime_suspend, stmmac_runtime_resume, NULL)
+};
 EXPORT_SYMBOL_GPL(stmmac_pltfr_pm_ops);
 
 MODULE_DESCRIPTION("STMMAC 10/100/1000 Ethernet platform support");

From 483ed89522b0f28e8bb0947646330c9200bf69d8 Mon Sep 17 00:00:00 2001
From: Wei Yongjun <weiyongjun1@huawei.com>
Date: Fri, 19 Nov 2021 10:53:55 +0800
Subject: [PATCH 1733/1750] net: stmmac: platform: fix build error with
 !CONFIG_PM_SLEEP

commit 7ec05a6035480f3a5934b2b31222620b2e906163 upstream

Get rid of the CONFIG_PM_SLEEP ifdefery to fix the build error
and use __maybe_unused for the suspend()/resume() hooks to avoid
build warning:

drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c:769:21:
 error: 'stmmac_runtime_suspend' undeclared here (not in a function); did you mean 'stmmac_suspend'?
  769 |  SET_RUNTIME_PM_OPS(stmmac_runtime_suspend, stmmac_runtime_resume, NULL)
      |                     ^~~~~~~~~~~~~~~~~~~~~~
./include/linux/pm.h:342:21: note: in definition of macro 'SET_RUNTIME_PM_OPS'
  342 |  .runtime_suspend = suspend_fn, \
      |                     ^~~~~~~~~~
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c:769:45:
 error: 'stmmac_runtime_resume' undeclared here (not in a function)
  769 |  SET_RUNTIME_PM_OPS(stmmac_runtime_suspend, stmmac_runtime_resume, NULL)
      |                                             ^~~~~~~~~~~~~~~~~~~~~
./include/linux/pm.h:343:20: note: in definition of macro 'SET_RUNTIME_PM_OPS'
  343 |  .runtime_resume = resume_fn, \
      |                    ^~~~~~~~~

Fixes: 5ec55823438e ("net: stmmac: add clocks management for gmac driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 332afe8519f4..035f9aef4308 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -720,7 +720,6 @@ int stmmac_pltfr_remove(struct platform_device *pdev)
 }
 EXPORT_SYMBOL_GPL(stmmac_pltfr_remove);
 
-#ifdef CONFIG_PM_SLEEP
 /**
  * stmmac_pltfr_suspend
  * @dev: device pointer
@@ -728,7 +727,7 @@ EXPORT_SYMBOL_GPL(stmmac_pltfr_remove);
  * call the main suspend function and then, if required, on some platform, it
  * can call an exit helper.
  */
-static int stmmac_pltfr_suspend(struct device *dev)
+static int __maybe_unused stmmac_pltfr_suspend(struct device *dev)
 {
 	int ret;
 	struct net_device *ndev = dev_get_drvdata(dev);
@@ -749,7 +748,7 @@ static int stmmac_pltfr_suspend(struct device *dev)
  * the main resume function, on some platforms, it can call own init helper
  * if required.
  */
-static int stmmac_pltfr_resume(struct device *dev)
+static int __maybe_unused stmmac_pltfr_resume(struct device *dev)
 {
 	struct net_device *ndev = dev_get_drvdata(dev);
 	struct stmmac_priv *priv = netdev_priv(ndev);
@@ -761,7 +760,7 @@ static int stmmac_pltfr_resume(struct device *dev)
 	return stmmac_resume(dev);
 }
 
-static int stmmac_runtime_suspend(struct device *dev)
+static int __maybe_unused stmmac_runtime_suspend(struct device *dev)
 {
 	struct net_device *ndev = dev_get_drvdata(dev);
 	struct stmmac_priv *priv = netdev_priv(ndev);
@@ -771,14 +770,13 @@ static int stmmac_runtime_suspend(struct device *dev)
 	return 0;
 }
 
-static int stmmac_runtime_resume(struct device *dev)
+static int __maybe_unused stmmac_runtime_resume(struct device *dev)
 {
 	struct net_device *ndev = dev_get_drvdata(dev);
 	struct stmmac_priv *priv = netdev_priv(ndev);
 
 	return stmmac_bus_clks_config(priv, true);
 }
-#endif /* CONFIG_PM_SLEEP */
 
 const struct dev_pm_ops stmmac_pltfr_pm_ops = {
 	SET_SYSTEM_SLEEP_PM_OPS(stmmac_pltfr_suspend, stmmac_pltfr_resume)

From bcf37522432dcacae18e1cec7c41308505d5ea22 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Fri, 19 Nov 2021 10:53:56 +0800
Subject: [PATCH 1734/1750] net: stmmac: fix missing unlock on error in
 stmmac_suspend()

commit 30f347ae7cc1178c431f968a89d4b4a375bc0d39 upstream

Add the missing unlock before return from stmmac_suspend()
in the error handling case.

Fixes: 5ec55823438e ("net: stmmac: add clocks management for gmac driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 498962c4b59e..51626edc6a4c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5275,8 +5275,10 @@ int stmmac_suspend(struct device *dev)
 		/* Disable clock in case of PWM is off */
 		clk_disable_unprepare(priv->plat->clk_ptp_ref);
 		ret = pm_runtime_force_suspend(dev);
-		if (ret)
+		if (ret) {
+			mutex_unlock(&priv->lock);
 			return ret;
+		}
 	}
 	mutex_unlock(&priv->lock);
 

From ac4bb9951c2cb9e40d5cf9a010ac8dead6f46501 Mon Sep 17 00:00:00 2001
From: Joakim Zhang <qiangqing.zhang@nxp.com>
Date: Fri, 19 Nov 2021 10:53:57 +0800
Subject: [PATCH 1735/1750] net: stmmac: fix system hang if change mac address
 after interface ifdown

commit 4691ffb18ac908609aab07d13af7995b6b89d33c upstream.

Fix system hang with below sequences:
~# ifconfig ethx down
~# ifconfig ethx hw ether xx:xx:xx:xx:xx:xx

After ethx down, stmmac all clocks gated off and then register access causes
system hang.

Fixes: 5ec55823438e ("net: stmmac: add clocks management for gmac driver")
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 51626edc6a4c..cccf98f66ff4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -4324,12 +4324,21 @@ static int stmmac_set_mac_address(struct net_device *ndev, void *addr)
 	struct stmmac_priv *priv = netdev_priv(ndev);
 	int ret = 0;
 
+	ret = pm_runtime_get_sync(priv->device);
+	if (ret < 0) {
+		pm_runtime_put_noidle(priv->device);
+		return ret;
+	}
+
 	ret = eth_mac_addr(ndev, addr);
 	if (ret)
-		return ret;
+		goto set_mac_error;
 
 	stmmac_set_umac_addr(priv, priv->hw, ndev->dev_addr, 0);
 
+set_mac_error:
+	pm_runtime_put(priv->device);
+
 	return ret;
 }
 

From 80407c6ad9da25f52f8091cdd8c7b80168d5c3d5 Mon Sep 17 00:00:00 2001
From: Wong Vee Khee <vee.khee.wong@linux.intel.com>
Date: Fri, 19 Nov 2021 10:53:58 +0800
Subject: [PATCH 1736/1750] net: stmmac: fix issue where clk is being
 unprepared twice

commit ab00f3e051e851a8458f0d0eb1bb426deadb6619 upstream.

In the case of MDIO bus registration failure due to no external PHY
devices is connected to the MAC, clk_disable_unprepare() is called in
stmmac_bus_clk_config() and intel_eth_pci_probe() respectively.

The second call in intel_eth_pci_probe() will caused the following:-

[   16.578605] intel-eth-pci 0000:00:1e.5: No PHY found
[   16.583778] intel-eth-pci 0000:00:1e.5: stmmac_dvr_probe: MDIO bus (id: 2) registration failed
[   16.680181] ------------[ cut here ]------------
[   16.684861] stmmac-0000:00:1e.5 already disabled
[   16.689547] WARNING: CPU: 13 PID: 2053 at drivers/clk/clk.c:952 clk_core_disable+0x96/0x1b0
[   16.697963] Modules linked in: dwc3 iTCO_wdt mei_hdcp iTCO_vendor_support udc_core x86_pkg_temp_thermal kvm_intel marvell10g kvm sch_fq_codel nfsd irqbypass dwmac_intel(+) stmmac uio ax88179_178a pcs_xpcs phylink uhid spi_pxa2xx_platform usbnet mei_me pcspkr tpm_crb mii i2c_i801 dw_dmac dwc3_pci thermal dw_dmac_core intel_rapl_msr libphy i2c_smbus mei tpm_tis intel_th_gth tpm_tis_core tpm intel_th_acpi intel_pmc_core intel_th i915 fuse configfs snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_pcm snd_timer snd soundcore
[   16.746785] CPU: 13 PID: 2053 Comm: systemd-udevd Tainted: G     U            5.13.0-rc3-intel-lts #76
[   16.756134] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-S ADP-S DRR4 CRB, BIOS ADLIFSI1.R00.1494.B00.2012031421 12/03/2020
[   16.769465] RIP: 0010:clk_core_disable+0x96/0x1b0
[   16.774222] Code: 00 8b 05 45 96 17 01 85 c0 7f 24 48 8b 5b 30 48 85 db 74 a5 8b 43 7c 85 c0 75 93 48 8b 33 48 c7 c7 6e 32 cc b7 e8 b2 5d 52 00 <0f> 0b 5b 5d c3 65 8b 05 76 31 18 49 89 c0 48 0f a3 05 bc 92 1a 01
[   16.793016] RSP: 0018:ffffa44580523aa0 EFLAGS: 00010086
[   16.798287] RAX: 0000000000000000 RBX: ffff8d7d0eb70a00 RCX: 0000000000000000
[   16.805435] RDX: 0000000000000002 RSI: ffffffffb7c62d5f RDI: 00000000ffffffff
[   16.812610] RBP: 0000000000000287 R08: 0000000000000000 R09: ffffa445805238d0
[   16.819759] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8d7d0eb70a00
[   16.826904] R13: ffff8d7d027370c8 R14: 0000000000000006 R15: ffffa44580523ad0
[   16.834047] FS:  00007f9882fa2600(0000) GS:ffff8d80a0940000(0000) knlGS:0000000000000000
[   16.842177] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   16.847966] CR2: 00007f9882bea3d8 CR3: 000000010b126001 CR4: 0000000000370ee0
[   16.855144] Call Trace:
[   16.857614]  clk_core_disable_lock+0x1b/0x30
[   16.861941]  intel_eth_pci_probe.cold+0x11d/0x136 [dwmac_intel]
[   16.867913]  pci_device_probe+0xcf/0x150
[   16.871890]  really_probe+0xf5/0x3e0
[   16.875526]  driver_probe_device+0x64/0x150
[   16.879763]  device_driver_attach+0x53/0x60
[   16.883998]  __driver_attach+0x9f/0x150
[   16.887883]  ? device_driver_attach+0x60/0x60
[   16.892288]  ? device_driver_attach+0x60/0x60
[   16.896698]  bus_for_each_dev+0x77/0xc0
[   16.900583]  bus_add_driver+0x184/0x1f0
[   16.904469]  driver_register+0x6c/0xc0
[   16.908268]  ? 0xffffffffc07ae000
[   16.911598]  do_one_initcall+0x4a/0x210
[   16.915489]  ? kmem_cache_alloc_trace+0x305/0x4e0
[   16.920247]  do_init_module+0x5c/0x230
[   16.924057]  load_module+0x2894/0x2b70
[   16.927857]  ? __do_sys_finit_module+0xb5/0x120
[   16.932441]  __do_sys_finit_module+0xb5/0x120
[   16.936845]  do_syscall_64+0x42/0x80
[   16.940476]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   16.945586] RIP: 0033:0x7f98830e5ccd
[   16.949177] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 93 31 0c 00 f7 d8 64 89 01 48
[   16.967970] RSP: 002b:00007ffc66b60168 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   16.975583] RAX: ffffffffffffffda RBX: 000055885de35ef0 RCX: 00007f98830e5ccd
[   16.982725] RDX: 0000000000000000 RSI: 00007f98832541e3 RDI: 0000000000000012
[   16.989868] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000000
[   16.997042] R10: 0000000000000012 R11: 0000000000000246 R12: 00007f98832541e3
[   17.004222] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffc66b60328
[   17.011369] ---[ end trace df06a3dab26b988c ]---
[   17.016062] ------------[ cut here ]------------
[   17.020701] stmmac-0000:00:1e.5 already unprepared

Removing the stmmac_bus_clks_config() call in stmmac_dvr_probe and let
dwmac-intel to handle the unprepare and disable of the clk device.

Fixes: 5ec55823438e ("net: stmmac: add clocks management for gmac driver")
Cc: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: Wong Vee Khee <vee.khee.wong@linux.intel.com>
Reviewed-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index cccf98f66ff4..4a75e73f06bb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5179,7 +5179,6 @@ int stmmac_dvr_probe(struct device *device,
 	stmmac_napi_del(ndev);
 error_hw_init:
 	destroy_workqueue(priv->wq);
-	stmmac_bus_clks_config(priv, false);
 
 	return ret;
 }

From a0958a5354f7bcade6557003eac23a77b7d26fb4 Mon Sep 17 00:00:00 2001
From: Michael Riesch <michael.riesch@wolfvision.net>
Date: Fri, 19 Nov 2021 10:53:59 +0800
Subject: [PATCH 1737/1750] net: stmmac: dwmac-rk: fix unbalanced
 pm_runtime_enable warnings

commit 2d26f6e39afb88d32b8f39e76a51b542c3c51674 upstream.

This reverts commit 2c896fb02e7f65299646f295a007bda043e0f382
"net: stmmac: dwmac-rk: add pd_gmac support for rk3399" and fixes
unbalanced pm_runtime_enable warnings.

In the commit to be reverted, support for power management was
introduced to the Rockchip glue code. Later, power management support
was introduced to the stmmac core code, resulting in multiple
invocations of pm_runtime_{enable,disable,get_sync,put_sync}.

The multiple invocations happen in rk_gmac_powerup and
stmmac_{dvr_probe, resume} as well as in rk_gmac_powerdown and
stmmac_{dvr_remove, suspend}, respectively, which are always called
in conjunction.

Fixes: 5ec55823438e850c91c6b92aec93fb04ebde29e2 ("net: stmmac: add clocks management for gmac driver")
Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Meng Li <Meng.Li@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
index 6ef30252bfe0..143b2cb13bf9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -21,7 +21,6 @@
 #include <linux/delay.h>
 #include <linux/mfd/syscon.h>
 #include <linux/regmap.h>
-#include <linux/pm_runtime.h>
 
 #include "stmmac_platform.h"
 
@@ -1336,9 +1335,6 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
 		return ret;
 	}
 
-	pm_runtime_enable(dev);
-	pm_runtime_get_sync(dev);
-
 	if (bsp_priv->integrated_phy)
 		rk_gmac_integrated_phy_powerup(bsp_priv);
 
@@ -1347,14 +1343,9 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv)
 
 static void rk_gmac_powerdown(struct rk_priv_data *gmac)
 {
-	struct device *dev = &gmac->pdev->dev;
-
 	if (gmac->integrated_phy)
 		rk_gmac_integrated_phy_powerdown(gmac);
 
-	pm_runtime_put_sync(dev);
-	pm_runtime_disable(dev);
-
 	phy_power_on(gmac, false);
 	gmac_clk_enable(gmac, false);
 }

From b31bac061918936d6f6d647878bd45a2c81b446b Mon Sep 17 00:00:00 2001
From: Peter Zijlstra <peterz@infradead.org>
Date: Fri, 17 Sep 2021 11:20:04 +0200
Subject: [PATCH 1738/1750] x86/iopl: Fake iopl(3) CLI/STI usage

commit b968e84b509da593c50dc3db679e1d33de701f78 upstream.

Since commit c8137ace5638 ("x86/iopl: Restrict iopl() permission
scope") it's possible to emulate iopl(3) using ioperm(), except for
the CLI/STI usage.

Userspace CLI/STI usage is very dubious (read broken), since any
exception taken during that window can lead to rescheduling anyway (or
worse). The IOPL(2) manpage even states that usage of CLI/STI is highly
discouraged and might even crash the system.

Of course, that won't stop people and HP has the dubious honour of
being the first vendor to be found using this in their hp-health
package.

In order to enable this 'software' to still 'work', have the #GP treat
the CLI/STI instructions as NOPs when iopl(3). Warn the user that
their program is doing dubious things.

Fixes: a24ca9976843 ("x86/iopl: Remove legacy IOPL option")
Reported-by: Ondrej Zary <linux@zary.sk>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@kernel.org # v5.5+
Link: https://lkml.kernel.org/r/20210918090641.GD5106@worktop.programming.kicks-ass.net
Signed-off-by: Ondrej Zary <linux@zary.sk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/include/asm/insn-eval.h |  1 +
 arch/x86/include/asm/processor.h |  1 +
 arch/x86/kernel/process.c        |  1 +
 arch/x86/kernel/traps.c          | 34 ++++++++++++++++++++++++++++++++
 arch/x86/lib/insn-eval.c         |  2 +-
 5 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/insn-eval.h b/arch/x86/include/asm/insn-eval.h
index 98b4dae5e8bc..c1438f9239e4 100644
--- a/arch/x86/include/asm/insn-eval.h
+++ b/arch/x86/include/asm/insn-eval.h
@@ -21,6 +21,7 @@ int insn_get_modrm_rm_off(struct insn *insn, struct pt_regs *regs);
 int insn_get_modrm_reg_off(struct insn *insn, struct pt_regs *regs);
 unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx);
 int insn_get_code_seg_params(struct pt_regs *regs);
+unsigned long insn_get_effective_ip(struct pt_regs *regs);
 int insn_fetch_from_user(struct pt_regs *regs,
 			 unsigned char buf[MAX_INSN_SIZE]);
 int insn_fetch_from_user_inatomic(struct pt_regs *regs,
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 50d02db72317..d428d611a43a 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -534,6 +534,7 @@ struct thread_struct {
 	 */
 	unsigned long		iopl_emul;
 
+	unsigned int		iopl_warn:1;
 	unsigned int		sig_on_uaccess_err:1;
 
 	/* Floating point and extended processor state */
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 145a7ac0c19a..0aa1baf9a3af 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -138,6 +138,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp, unsigned long arg,
 	frame->ret_addr = (unsigned long) ret_from_fork;
 	p->thread.sp = (unsigned long) fork_frame;
 	p->thread.io_bitmap = NULL;
+	p->thread.iopl_warn = 0;
 	memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 143fcb8af38f..2d4ecd50e69b 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -523,6 +523,37 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs,
 
 #define GPFSTR "general protection fault"
 
+static bool fixup_iopl_exception(struct pt_regs *regs)
+{
+	struct thread_struct *t = &current->thread;
+	unsigned char byte;
+	unsigned long ip;
+
+	if (!IS_ENABLED(CONFIG_X86_IOPL_IOPERM) || t->iopl_emul != 3)
+		return false;
+
+	ip = insn_get_effective_ip(regs);
+	if (!ip)
+		return false;
+
+	if (get_user(byte, (const char __user *)ip))
+		return false;
+
+	if (byte != 0xfa && byte != 0xfb)
+		return false;
+
+	if (!t->iopl_warn && printk_ratelimit()) {
+		pr_err("%s[%d] attempts to use CLI/STI, pretending it's a NOP, ip:%lx",
+		       current->comm, task_pid_nr(current), ip);
+		print_vma_addr(KERN_CONT " in ", ip);
+		pr_cont("\n");
+		t->iopl_warn = 1;
+	}
+
+	regs->ip += 1;
+	return true;
+}
+
 DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
 {
 	char desc[sizeof(GPFSTR) + 50 + 2*sizeof(unsigned long) + 1] = GPFSTR;
@@ -548,6 +579,9 @@ DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
 	tsk = current;
 
 	if (user_mode(regs)) {
+		if (fixup_iopl_exception(regs))
+			goto exit;
+
 		tsk->thread.error_code = error_code;
 		tsk->thread.trap_nr = X86_TRAP_GP;
 
diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c
index bb0b3fe1e0a0..c6a19c88af54 100644
--- a/arch/x86/lib/insn-eval.c
+++ b/arch/x86/lib/insn-eval.c
@@ -1415,7 +1415,7 @@ void __user *insn_get_addr_ref(struct insn *insn, struct pt_regs *regs)
 	}
 }
 
-static unsigned long insn_get_effective_ip(struct pt_regs *regs)
+unsigned long insn_get_effective_ip(struct pt_regs *regs)
 {
 	unsigned long seg_base = 0;
 

From c49bfdfe535c65fe14041cf11b7f36950f26f317 Mon Sep 17 00:00:00 2001
From: Sven Schnelle <svens@stackframe.org>
Date: Sat, 13 Nov 2021 20:41:17 +0100
Subject: [PATCH 1739/1750] parisc/entry: fix trace test in syscall exit path

commit 3ec18fc7831e7d79e2d536dd1f3bc0d3ba425e8a upstream.

commit 8779e05ba8aa ("parisc: Fix ptrace check on syscall return")
fixed testing of TI_FLAGS. This uncovered a bug in the test mask.
syscall_restore_rfi is only used when the kernel needs to exit to
usespace with single or block stepping and the recovery counter
enabled. The test however used _TIF_SYSCALL_TRACE_MASK, which
includes a lot of bits that shouldn't be tested here.

Fix this by using TIF_SINGLESTEP and TIF_BLOCKSTEP directly.

I encountered this bug by enabling syscall tracepoints. Both in qemu and
on real hardware. As soon as i enabled the tracepoint (sys_exit_read,
but i guess it doesn't really matter which one), i got random page
faults in userspace almost immediately.

Signed-off-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/kernel/entry.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
index 9c76d50a5654..3da39140babc 100644
--- a/arch/parisc/kernel/entry.S
+++ b/arch/parisc/kernel/entry.S
@@ -1849,7 +1849,7 @@ syscall_restore:
 
 	/* Are we being ptraced? */
 	LDREG	TI_FLAGS-THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r19
-	ldi	_TIF_SYSCALL_TRACE_MASK,%r2
+	ldi	_TIF_SINGLESTEP|_TIF_BLOCKSTEP,%r2
 	and,COND(=)	%r19,%r2,%r0
 	b,n	syscall_restore_rfi
 

From 9b61500ee536adc38929852259d8c84ab6b908bc Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 9 Nov 2021 14:53:57 +0100
Subject: [PATCH 1740/1750] PCI/MSI: Destroy sysfs before freeing entries

commit 3735459037114d31e5acd9894fad9aed104231a0 upstream.

free_msi_irqs() frees the MSI entries before destroying the sysfs entries
which are exposing them. Nothing prevents a concurrent free while a sysfs
file is read and accesses the possibly freed entry.

Move the sysfs release ahead of freeing the entries.

Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Bjorn Helgaas <helgaas@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87sfw5305m.ffs@tglx
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index a7a1c7411348..2982403e3213 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -396,18 +396,6 @@ static void free_msi_irqs(struct pci_dev *dev)
 			for (i = 0; i < entry->nvec_used; i++)
 				BUG_ON(irq_has_action(entry->irq + i));
 
-	pci_msi_teardown_msi_irqs(dev);
-
-	list_for_each_entry_safe(entry, tmp, msi_list, list) {
-		if (entry->msi_attrib.is_msix) {
-			if (list_is_last(&entry->list, msi_list))
-				iounmap(entry->mask_base);
-		}
-
-		list_del(&entry->list);
-		free_msi_entry(entry);
-	}
-
 	if (dev->msi_irq_groups) {
 		sysfs_remove_groups(&dev->dev.kobj, dev->msi_irq_groups);
 		msi_attrs = dev->msi_irq_groups[0]->attrs;
@@ -423,6 +411,18 @@ static void free_msi_irqs(struct pci_dev *dev)
 		kfree(dev->msi_irq_groups);
 		dev->msi_irq_groups = NULL;
 	}
+
+	pci_msi_teardown_msi_irqs(dev);
+
+	list_for_each_entry_safe(entry, tmp, msi_list, list) {
+		if (entry->msi_attrib.is_msix) {
+			if (list_is_last(&entry->list, msi_list))
+				iounmap(entry->mask_base);
+		}
+
+		list_del(&entry->list);
+		free_msi_entry(entry);
+	}
 }
 
 static void pci_intx_for_msi(struct pci_dev *dev, int enable)

From f28c620e1ac1b7312519516217240556193c2618 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Thu, 4 Nov 2021 18:01:29 +0000
Subject: [PATCH 1741/1750] PCI/MSI: Deal with devices lying about their MSI
 mask capability

commit 2226667a145db2e1f314d7f57fd644fe69863ab9 upstream.

It appears that some devices are lying about their mask capability,
pretending that they don't have it, while they actually do.
The net result is that now that we don't enable MSIs on such
endpoint.

Add a new per-device flag to deal with this. Further patches will
make use of it, sadly.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20211104180130.3825416-2-maz@kernel.org
Cc: Bjorn Helgaas <helgaas@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/msi.c   | 3 +++
 include/linux/pci.h | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 2982403e3213..db7475dc601f 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -592,6 +592,9 @@ msi_setup_entry(struct pci_dev *dev, int nvec, struct irq_affinity *affd)
 		goto out;
 
 	pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &control);
+	/* Lies, damned lies, and MSIs */
+	if (dev->dev_flags & PCI_DEV_FLAGS_HAS_MSI_MASKING)
+		control |= PCI_MSI_FLAGS_MASKBIT;
 
 	entry->msi_attrib.is_msix	= 0;
 	entry->msi_attrib.is_64		= !!(control & PCI_MSI_FLAGS_64BIT);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index a55097b4d992..4519bd12643f 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -227,6 +227,8 @@ enum pci_dev_flags {
 	PCI_DEV_FLAGS_NO_FLR_RESET = (__force pci_dev_flags_t) (1 << 10),
 	/* Don't use Relaxed Ordering for TLPs directed at this device */
 	PCI_DEV_FLAGS_NO_RELAXED_ORDERING = (__force pci_dev_flags_t) (1 << 11),
+	/* Device does honor MSI masking despite saying otherwise */
+	PCI_DEV_FLAGS_HAS_MSI_MASKING = (__force pci_dev_flags_t) (1 << 12),
 };
 
 enum pci_irq_reroute_variant {

From 5bf5f464831c26dca627bf32d4e51067dcd39d64 Mon Sep 17 00:00:00 2001
From: Marc Zyngier <maz@kernel.org>
Date: Thu, 4 Nov 2021 18:01:30 +0000
Subject: [PATCH 1742/1750] PCI: Add MSI masking quirk for Nvidia ION AHCI

commit f21082fb20dbfb3e42b769b59ef21c2a7f2c7c1f upstream.

The ION AHCI device pretends that MSI masking isn't a thing, while it
actually implements it and needs MSIs to be unmasked to work. Add a quirk
to that effect.

Reported-by: Rui Salvaterra <rsalvaterra@gmail.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Bjorn Helgaas <helgaas@kernel.org>
Link: https://lore.kernel.org/r/CALjTZvbzYfBuLB+H=fj2J+9=DxjQ2Uqcy0if_PvmJ-nU-qEgkg@mail.gmail.com
Link: https://lore.kernel.org/r/20211104180130.3825416-3-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/pci/quirks.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index fb91b2d7b1c5..bb863ddb59bf 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5756,3 +5756,9 @@ static void apex_pci_fixup_class(struct pci_dev *pdev)
 }
 DECLARE_PCI_FIXUP_CLASS_HEADER(0x1ac1, 0x089a,
 			       PCI_CLASS_NOT_DEFINED, 8, apex_pci_fixup_class);
+
+static void nvidia_ion_ahci_fixup(struct pci_dev *pdev)
+{
+	pdev->dev_flags |= PCI_DEV_FLAGS_HAS_MSI_MASKING;
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, 0x0ab8, nvidia_ion_ahci_fixup);

From 6c1ad56b2d78725034bfed17782dc1264149563d Mon Sep 17 00:00:00 2001
From: Yue Hu <huyue2@yulong.com>
Date: Tue, 16 Nov 2021 09:08:18 +0800
Subject: [PATCH 1743/1750] erofs: remove the occupied parameter from
 z_erofs_pagevec_enqueue()

commit 7dea3de7d384f4c8156e8bd93112ba6db1eb276c upstream.

No any behavior to variable occupied in z_erofs_attach_page() which
is only caller to z_erofs_pagevec_enqueue().

Link: https://lore.kernel.org/r/20210419102623.2015-1-zbestahu@gmail.com
Signed-off-by: Yue Hu <huyue2@yulong.com>
Reviewed-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <xiang@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/erofs/zdata.c | 4 +---
 fs/erofs/zpvec.h | 5 +----
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index 86fd3bf62af6..ca27d3e47857 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -282,7 +282,6 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt,
 			       enum z_erofs_page_type type)
 {
 	int ret;
-	bool occupied;
 
 	/* give priority for inplaceio */
 	if (clt->mode >= COLLECT_PRIMARY &&
@@ -290,8 +289,7 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt,
 	    z_erofs_try_inplace_io(clt, page))
 		return 0;
 
-	ret = z_erofs_pagevec_enqueue(&clt->vector,
-				      page, type, &occupied);
+	ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
 	clt->cl->vcnt += (unsigned int)ret;
 
 	return ret ? 0 : -EAGAIN;
diff --git a/fs/erofs/zpvec.h b/fs/erofs/zpvec.h
index 1d67cbd38704..95a620739e6a 100644
--- a/fs/erofs/zpvec.h
+++ b/fs/erofs/zpvec.h
@@ -107,10 +107,8 @@ static inline void z_erofs_pagevec_ctor_init(struct z_erofs_pagevec_ctor *ctor,
 
 static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
 					   struct page *page,
-					   enum z_erofs_page_type type,
-					   bool *occupied)
+					   enum z_erofs_page_type type)
 {
-	*occupied = false;
 	if (!ctor->next && type)
 		if (ctor->index + 1 == ctor->nr)
 			return false;
@@ -125,7 +123,6 @@ static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
 	/* should remind that collector->next never equal to 1, 2 */
 	if (type == (uintptr_t)ctor->next) {
 		ctor->next = page;
-		*occupied = true;
 	}
 	ctor->pages[ctor->index++] = tagptr_fold(erofs_vtptr_t, page, type);
 	return true;

From be3f6035831a667f5d316be180176a3a8d8460b5 Mon Sep 17 00:00:00 2001
From: Gao Xiang <hsiangkao@linux.alibaba.com>
Date: Tue, 16 Nov 2021 09:08:19 +0800
Subject: [PATCH 1744/1750] erofs: fix unsafe pagevec reuse of hooked pclusters

commit 86432a6dca9bed79111990851df5756d3eb5f57c upstream.

There are pclusters in runtime marked with Z_EROFS_PCLUSTER_TAIL
before actual I/O submission. Thus, the decompression chain can be
extended if the following pcluster chain hooks such tail pcluster.

As the related comment mentioned, if some page is made of a hooked
pcluster and another followed pcluster, it can be reused for in-place
I/O (since I/O should be submitted anyway):
 _______________________________________________________________
|  tail (partial) page |          head (partial) page           |
|_____PRIMARY_HOOKED___|____________PRIMARY_FOLLOWED____________|

However, it's by no means safe to reuse as pagevec since if such
PRIMARY_HOOKED pclusters finally move into bypass chain without I/O
submission. It's somewhat hard to reproduce with LZ4 and I just found
it (general protection fault) by ro_fsstressing a LZMA image for long
time.

I'm going to actively clean up related code together with multi-page
folio adaption in the next few months. Let's address it directly for
easier backporting for now.

Call trace for reference:
  z_erofs_decompress_pcluster+0x10a/0x8a0 [erofs]
  z_erofs_decompress_queue.isra.36+0x3c/0x60 [erofs]
  z_erofs_runqueue+0x5f3/0x840 [erofs]
  z_erofs_readahead+0x1e8/0x320 [erofs]
  read_pages+0x91/0x270
  page_cache_ra_unbounded+0x18b/0x240
  filemap_get_pages+0x10a/0x5f0
  filemap_read+0xa9/0x330
  new_sync_read+0x11b/0x1a0
  vfs_read+0xf1/0x190

Link: https://lore.kernel.org/r/20211103182006.4040-1-xiang@kernel.org
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Cc: <stable@vger.kernel.org> # 4.19+
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/erofs/zdata.c | 13 +++++++------
 fs/erofs/zpvec.h | 13 ++++++++++---
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
index ca27d3e47857..8cb2cf612e49 100644
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -278,8 +278,8 @@ static inline bool z_erofs_try_inplace_io(struct z_erofs_collector *clt,
 
 /* callers must be with collection lock held */
 static int z_erofs_attach_page(struct z_erofs_collector *clt,
-			       struct page *page,
-			       enum z_erofs_page_type type)
+			       struct page *page, enum z_erofs_page_type type,
+			       bool pvec_safereuse)
 {
 	int ret;
 
@@ -289,9 +289,9 @@ static int z_erofs_attach_page(struct z_erofs_collector *clt,
 	    z_erofs_try_inplace_io(clt, page))
 		return 0;
 
-	ret = z_erofs_pagevec_enqueue(&clt->vector, page, type);
+	ret = z_erofs_pagevec_enqueue(&clt->vector, page, type,
+				      pvec_safereuse);
 	clt->cl->vcnt += (unsigned int)ret;
-
 	return ret ? 0 : -EAGAIN;
 }
 
@@ -645,7 +645,8 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
 		tight &= (clt->mode >= COLLECT_PRIMARY_FOLLOWED);
 
 retry:
-	err = z_erofs_attach_page(clt, page, page_type);
+	err = z_erofs_attach_page(clt, page, page_type,
+				  clt->mode >= COLLECT_PRIMARY_FOLLOWED);
 	/* should allocate an additional staging page for pagevec */
 	if (err == -EAGAIN) {
 		struct page *const newpage =
@@ -653,7 +654,7 @@ static int z_erofs_do_read_page(struct z_erofs_decompress_frontend *fe,
 
 		newpage->mapping = Z_EROFS_MAPPING_STAGING;
 		err = z_erofs_attach_page(clt, newpage,
-					  Z_EROFS_PAGE_TYPE_EXCLUSIVE);
+					  Z_EROFS_PAGE_TYPE_EXCLUSIVE, true);
 		if (!err)
 			goto retry;
 	}
diff --git a/fs/erofs/zpvec.h b/fs/erofs/zpvec.h
index 95a620739e6a..52898176ef31 100644
--- a/fs/erofs/zpvec.h
+++ b/fs/erofs/zpvec.h
@@ -107,11 +107,18 @@ static inline void z_erofs_pagevec_ctor_init(struct z_erofs_pagevec_ctor *ctor,
 
 static inline bool z_erofs_pagevec_enqueue(struct z_erofs_pagevec_ctor *ctor,
 					   struct page *page,
-					   enum z_erofs_page_type type)
+					   enum z_erofs_page_type type,
+					   bool pvec_safereuse)
 {
-	if (!ctor->next && type)
-		if (ctor->index + 1 == ctor->nr)
+	if (!ctor->next) {
+		/* some pages cannot be reused as pvec safely without I/O */
+		if (type == Z_EROFS_PAGE_TYPE_EXCLUSIVE && !pvec_safereuse)
+			type = Z_EROFS_VLE_PAGE_TYPE_TAIL_SHARED;
+
+		if (type != Z_EROFS_PAGE_TYPE_EXCLUSIVE &&
+		    ctor->index + 1 == ctor->nr)
 			return false;
+	}
 
 	if (ctor->index >= ctor->nr)
 		z_erofs_pagevec_ctor_pagedown(ctor, false);

From df58fb431aa3b8371e11b27a94b20f8b765799c7 Mon Sep 17 00:00:00 2001
From: Nathan Chancellor <nathan@kernel.org>
Date: Mon, 15 Nov 2021 09:43:23 -0700
Subject: [PATCH 1745/1750] scripts/lld-version.sh: Rewrite based on upstream
 ld-version.sh

This patch is for linux-5.10.y only.

When scripts/lld-version.sh was initially written, it did not account
for the LLD_VENDOR cmake flag, which changes the output of ld.lld's
--version flag slightly.

Without LLD_VENDOR:

$ ld.lld --version
LLD 14.0.0 (compatible with GNU linkers)

With LLD_VENDOR:

$ ld.lld --version
Debian LLD 14.0.0 (compatible with GNU linkers)

As a result, CONFIG_LLD_VERSION is messed up and configuration values
that are dependent on it cannot be selected:

scripts/lld-version.sh: 20: printf: LLD: expected numeric value
scripts/lld-version.sh: 20: printf: LLD: expected numeric value
scripts/lld-version.sh: 20: printf: LLD: expected numeric value
init/Kconfig:52:warning: 'LLD_VERSION': number is invalid
.config:11:warning: symbol value '00000' invalid for LLD_VERSION
.config:8800:warning: override: CPU_BIG_ENDIAN changes choice state

This was fixed upstream by commit 1f09af062556 ("kbuild: Fix
ld-version.sh script if LLD was built with LLD_VENDOR") in 5.12 but that
was done to ld-version.sh after it was massively rewritten in
commit 02aff8592204 ("kbuild: check the minimum linker version in
Kconfig").

To avoid bringing in that change plus its prerequisites and fixes, just
modify lld-version.sh to make it similar to the upstream ld-version.sh,
which handles ld.lld with or without LLD_VENDOR and ld.bfd without any
errors.

Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 scripts/lld-version.sh | 35 ++++++++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 9 deletions(-)

diff --git a/scripts/lld-version.sh b/scripts/lld-version.sh
index d70edb4d8a4f..f1eeee450a23 100755
--- a/scripts/lld-version.sh
+++ b/scripts/lld-version.sh
@@ -6,15 +6,32 @@
 # Print the linker version of `ld.lld' in a 5 or 6-digit form
 # such as `100001' for ld.lld 10.0.1 etc.
 
-linker_string="$($* --version)"
+set -e
 
-if ! ( echo $linker_string | grep -q LLD ); then
+# Convert the version string x.y.z to a canonical 5 or 6-digit form.
+get_canonical_version()
+{
+	IFS=.
+	set -- $1
+
+	# If the 2nd or 3rd field is missing, fill it with a zero.
+	echo $((10000 * $1 + 100 * ${2:-0} + ${3:-0}))
+}
+
+# Get the first line of the --version output.
+IFS='
+'
+set -- $(LC_ALL=C "$@" --version)
+
+# Split the line on spaces.
+IFS=' '
+set -- $1
+
+while [ $# -gt 1 -a "$1" != "LLD" ]; do
+	shift
+done
+if [ "$1" = LLD ]; then
+	echo $(get_canonical_version ${2%-*})
+else
 	echo 0
-	exit 1
 fi
-
-VERSION=$(echo $linker_string | cut -d ' ' -f 2)
-MAJOR=$(echo $VERSION | cut -d . -f 1)
-MINOR=$(echo $VERSION | cut -d . -f 2)
-PATCHLEVEL=$(echo $VERSION | cut -d . -f 3)
-printf "%d%02d%02d\\n" $MAJOR $MINOR $PATCHLEVEL

From bd40513d0bee24095948abfaa17d3ad8f444a85b Mon Sep 17 00:00:00 2001
From: Greg Thelen <gthelen@google.com>
Date: Wed, 10 Nov 2021 18:18:14 -0800
Subject: [PATCH 1746/1750] perf/core: Avoid put_page() when GUP fails

commit 4716023a8f6a0f4a28047f14dd7ebdc319606b84 upstream.

PEBS PERF_SAMPLE_PHYS_ADDR events use perf_virt_to_phys() to convert PMU
sampled virtual addresses to physical using get_user_page_fast_only()
and page_to_phys().

Some get_user_page_fast_only() error cases return false, indicating no
page reference, but still initialize the output page pointer with an
unreferenced page. In these error cases perf_virt_to_phys() calls
put_page(). This causes page reference count underflow, which can lead
to unintentional page sharing.

Fix perf_virt_to_phys() to only put_page() if get_user_page_fast_only()
returns a referenced page.

Fixes: fc7ce9c74c3ad ("perf/core, x86: Add PERF_SAMPLE_PHYS_ADDR")
Signed-off-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211111021814.757086-1-gthelen@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index c81151926171..908417736f4e 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7036,7 +7036,6 @@ void perf_output_sample(struct perf_output_handle *handle,
 static u64 perf_virt_to_phys(u64 virt)
 {
 	u64 phys_addr = 0;
-	struct page *p = NULL;
 
 	if (!virt)
 		return 0;
@@ -7055,14 +7054,15 @@ static u64 perf_virt_to_phys(u64 virt)
 		 * If failed, leave phys_addr as 0.
 		 */
 		if (current->mm != NULL) {
+			struct page *p;
+
 			pagefault_disable();
-			if (get_user_page_fast_only(virt, 0, &p))
+			if (get_user_page_fast_only(virt, 0, &p)) {
 				phys_addr = page_to_phys(p) + virt % PAGE_SIZE;
+				put_page(p);
+			}
 			pagefault_enable();
 		}
-
-		if (p)
-			put_page(p);
 	}
 
 	return phys_addr;

From 6a315471cb6a07f651e1d3adc8962730f4fcccac Mon Sep 17 00:00:00 2001
From: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
Date: Thu, 4 Nov 2021 16:57:07 -0700
Subject: [PATCH 1747/1750] thermal: Fix NULL pointer dereferences in
 of_thermal_ functions

commit 96cfe05051fd8543cdedd6807ec59a0e6c409195 upstream.

of_parse_thermal_zones() parses the thermal-zones node and registers a
thermal_zone device for each subnode. However, if a thermal zone is
consuming a thermal sensor and that thermal sensor device hasn't probed
yet, an attempt to set trip_point_*_temp for that thermal zone device
can cause a NULL pointer dereference. Fix it.

 console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp
 ...
 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020
 ...
 Call trace:
  of_thermal_set_trip_temp+0x40/0xc4
  trip_point_temp_store+0xc0/0x1dc
  dev_attr_store+0x38/0x88
  sysfs_kf_write+0x64/0xc0
  kernfs_fop_write_iter+0x108/0x1d0
  vfs_write+0x2f4/0x368
  ksys_write+0x7c/0xec
  __arm64_sys_write+0x20/0x30
  el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc
  do_el0_svc+0x28/0xa0
  el0_svc+0x14/0x24
  el0_sync_handler+0x88/0xec
  el0_sync+0x1c0/0x200

While at it, fix the possible NULL pointer dereference in other
functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(),
of_thermal_get_trend().

Suggested-by: David Collins <quic_collinsd@quicinc.com>
Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/thermal/thermal_of.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/thermal/thermal_of.c b/drivers/thermal/thermal_of.c
index 6379f26a335f..9233f7e74454 100644
--- a/drivers/thermal/thermal_of.c
+++ b/drivers/thermal/thermal_of.c
@@ -89,7 +89,7 @@ static int of_thermal_get_temp(struct thermal_zone_device *tz,
 {
 	struct __thermal_zone *data = tz->devdata;
 
-	if (!data->ops->get_temp)
+	if (!data->ops || !data->ops->get_temp)
 		return -EINVAL;
 
 	return data->ops->get_temp(data->sensor_data, temp);
@@ -186,6 +186,9 @@ static int of_thermal_set_emul_temp(struct thermal_zone_device *tz,
 {
 	struct __thermal_zone *data = tz->devdata;
 
+	if (!data->ops || !data->ops->set_emul_temp)
+		return -EINVAL;
+
 	return data->ops->set_emul_temp(data->sensor_data, temp);
 }
 
@@ -194,7 +197,7 @@ static int of_thermal_get_trend(struct thermal_zone_device *tz, int trip,
 {
 	struct __thermal_zone *data = tz->devdata;
 
-	if (!data->ops->get_trend)
+	if (!data->ops || !data->ops->get_trend)
 		return -EINVAL;
 
 	return data->ops->get_trend(data->sensor_data, trip, trend);
@@ -301,7 +304,7 @@ static int of_thermal_set_trip_temp(struct thermal_zone_device *tz, int trip,
 	if (trip >= data->ntrips || trip < 0)
 		return -EDOM;
 
-	if (data->ops->set_trip_temp) {
+	if (data->ops && data->ops->set_trip_temp) {
 		int ret;
 
 		ret = data->ops->set_trip_temp(data->sensor_data, trip, temp);

From 0685efd9840f7d017ea7cef1f49aa746329fa73d Mon Sep 17 00:00:00 2001
From: Borislav Petkov <bp@suse.de>
Date: Fri, 29 Oct 2021 19:27:32 +0200
Subject: [PATCH 1748/1750] selftests/x86/iopl: Adjust to the faked iopl
 CLI/STI usage

commit a72fdfd21e01c626273ddcf5ab740d4caef4be54 upstream.

Commit in Fixes changed the iopl emulation to not #GP on CLI and STI
because it would break some insane luserspace tools which would toggle
interrupts.

The corresponding selftest would rely on the fact that executing CLI/STI
would trigger a #GP and thus detect it this way but since that #GP is
not happening anymore, the detection is now wrong too.

Extend the test to actually look at the IF flag and whether executing
those insns had any effect on it. The STI detection needs to have the
fact that interrupts were previously disabled, passed in so do that from
the previous CLI test, i.e., STI test needs to follow a previous CLI one
for it to make sense.

Fixes: b968e84b509d ("x86/iopl: Fake iopl(3) CLI/STI usage")
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20211030083939.13073-1-bp@alien8.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/testing/selftests/x86/iopl.c | 78 ++++++++++++++++++++++--------
 1 file changed, 58 insertions(+), 20 deletions(-)

diff --git a/tools/testing/selftests/x86/iopl.c b/tools/testing/selftests/x86/iopl.c
index bab2f6e06b63..7e3e09c1abac 100644
--- a/tools/testing/selftests/x86/iopl.c
+++ b/tools/testing/selftests/x86/iopl.c
@@ -85,48 +85,88 @@ static void expect_gp_outb(unsigned short port)
 	printf("[OK]\toutb to 0x%02hx failed\n", port);
 }
 
-static bool try_cli(void)
+#define RET_FAULTED	0
+#define RET_FAIL	1
+#define RET_EMUL	2
+
+static int try_cli(void)
 {
+	unsigned long flags;
+
 	sethandler(SIGSEGV, sigsegv, SA_RESETHAND);
 	if (sigsetjmp(jmpbuf, 1) != 0) {
-		return false;
+		return RET_FAULTED;
 	} else {
-		asm volatile ("cli");
-		return true;
+		asm volatile("cli; pushf; pop %[flags]"
+				: [flags] "=rm" (flags));
+
+		/* X86_FLAGS_IF */
+		if (!(flags & (1 << 9)))
+			return RET_FAIL;
+		else
+			return RET_EMUL;
 	}
 	clearhandler(SIGSEGV);
 }
 
-static bool try_sti(void)
+static int try_sti(bool irqs_off)
 {
+	unsigned long flags;
+
 	sethandler(SIGSEGV, sigsegv, SA_RESETHAND);
 	if (sigsetjmp(jmpbuf, 1) != 0) {
-		return false;
+		return RET_FAULTED;
 	} else {
-		asm volatile ("sti");
-		return true;
+		asm volatile("sti; pushf; pop %[flags]"
+				: [flags] "=rm" (flags));
+
+		/* X86_FLAGS_IF */
+		if (irqs_off && (flags & (1 << 9)))
+			return RET_FAIL;
+		else
+			return RET_EMUL;
 	}
 	clearhandler(SIGSEGV);
 }
 
-static void expect_gp_sti(void)
+static void expect_gp_sti(bool irqs_off)
 {
-	if (try_sti()) {
+	int ret = try_sti(irqs_off);
+
+	switch (ret) {
+	case RET_FAULTED:
+		printf("[OK]\tSTI faulted\n");
+		break;
+	case RET_EMUL:
+		printf("[OK]\tSTI NOPped\n");
+		break;
+	default:
 		printf("[FAIL]\tSTI worked\n");
 		nerrs++;
-	} else {
-		printf("[OK]\tSTI faulted\n");
 	}
 }
 
-static void expect_gp_cli(void)
+/*
+ * Returns whether it managed to disable interrupts.
+ */
+static bool test_cli(void)
 {
-	if (try_cli()) {
+	int ret = try_cli();
+
+	switch (ret) {
+	case RET_FAULTED:
+		printf("[OK]\tCLI faulted\n");
+		break;
+	case RET_EMUL:
+		printf("[OK]\tCLI NOPped\n");
+		break;
+	default:
 		printf("[FAIL]\tCLI worked\n");
 		nerrs++;
-	} else {
-		printf("[OK]\tCLI faulted\n");
+		return true;
 	}
+
+	return false;
 }
 
 int main(void)
@@ -152,8 +192,7 @@ int main(void)
 	}
 
 	/* Make sure that CLI/STI are blocked even with IOPL level 3 */
-	expect_gp_cli();
-	expect_gp_sti();
+	expect_gp_sti(test_cli());
 	expect_ok_outb(0x80);
 
 	/* Establish an I/O bitmap to test the restore */
@@ -204,8 +243,7 @@ int main(void)
 	printf("[RUN]\tparent: write to 0x80 (should fail)\n");
 
 	expect_gp_outb(0x80);
-	expect_gp_cli();
-	expect_gp_sti();
+	expect_gp_sti(test_cli());
 
 	/* Test the capability checks. */
 	printf("\tiopl(3)\n");

From 99957dcea4e9702cc9060f576233ac1ac84c2a39 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Sun, 21 Nov 2021 13:46:37 +0100
Subject: [PATCH 1749/1750] Linux 5.10.81

Link: https://lore.kernel.org/r/20211119171443.892729043@linuxfoundation.org
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Fox Chen <foxhlchen@gmail.com>
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Tested-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 71fdc74801e0..1baeadb574f1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 80
+SUBLEVEL = 81
 EXTRAVERSION =
 NAME = Dare mighty things
 

From 4b644356291a7e075c1b2a276b67d25042d20694 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@google.com>
Date: Sun, 21 Nov 2021 14:52:36 +0100
Subject: [PATCH 1750/1750] ANDROID: GKI: disable CONFIG_FORTIFY_SOURCE

This build option is broken for clang and upstream removed it in commit
eaafc590053b ("fortify: Explicitly disable Clang support") so we have to
also remove it for the gki defconfigs.

Fixes: eaafc590053b ("fortify: Explicitly disable Clang support")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8d4a1d38b736ee1fd4a6febfbab4d1a3c1c4d351
---
 arch/arm64/configs/gki_defconfig | 1 -
 arch/x86/configs/gki_defconfig   | 1 -
 2 files changed, 2 deletions(-)

diff --git a/arch/arm64/configs/gki_defconfig b/arch/arm64/configs/gki_defconfig
index 3ae364535af6..bed9e0724ed5 100644
--- a/arch/arm64/configs/gki_defconfig
+++ b/arch/arm64/configs/gki_defconfig
@@ -638,7 +638,6 @@ CONFIG_SECURITYFS=y
 CONFIG_SECURITY_NETWORK=y
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_FALLBACK is not set
-CONFIG_FORTIFY_SOURCE=y
 CONFIG_STATIC_USERMODEHELPER=y
 CONFIG_STATIC_USERMODEHELPER_PATH=""
 CONFIG_SECURITY_SELINUX=y
diff --git a/arch/x86/configs/gki_defconfig b/arch/x86/configs/gki_defconfig
index 7c344566df2a..180f696da923 100644
--- a/arch/x86/configs/gki_defconfig
+++ b/arch/x86/configs/gki_defconfig
@@ -571,7 +571,6 @@ CONFIG_SECURITYFS=y
 CONFIG_SECURITY_NETWORK=y
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_FALLBACK is not set
-CONFIG_FORTIFY_SOURCE=y
 CONFIG_STATIC_USERMODEHELPER=y
 CONFIG_STATIC_USERMODEHELPER_PATH=""
 CONFIG_SECURITY_SELINUX=y