Merge tag 'android15-6.6.98_r00' into android15-6.6

This merges the android15-6.6.98_r00 tag into the android15-6.6 branch,
catching it up with the latest LTS releases.

It contains the following commits:

*   0c2af81954 Merge 6.6.98 into android15-6.6-lts
|\
| * 9247f4e657 Linux 6.6.98
| * 20aa3d5198 x86/CPU/AMD: Properly check the TSA microcode
* | 66b0293d12 Merge android15-6.6 into android15-6.6-lts
* | 81020b2287 Revert "scsi: ufs: core: Fix abnormal scale up after last cmd finish"
* | 0b225c3d7e Revert "scsi: ufs: core: Add OPP support for scaling clocks and regulators"
* | b3d28c180f Revert "scsi: ufs: core: Fix clk scaling to be conditional in reset and restore"
* | 881548d590 ANDROID: GKI: add fput() to db854c symbol list
* | f67e22675d Merge 6.6.97 into android15-6.6-lts
|\|
| * 59a2de10b8 Linux 6.6.97
| * 897761d165 f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
| * 8c19449058 x86/process: Move the buffer clearing before MONITOR
| * 6fb766d53f x86/microcode/AMD: Add TSA microcode SHAs
| * 276499bb69 KVM: SVM: Advertise TSA CPUID bits to guests
| * 90293047df x86/bugs: Add a Transient Scheduler Attacks mitigation
| * 2b6a5fbe9d x86/bugs: Rename MDS machinery to something more generic
| * 8a7ac27372 powerpc/kernel: Fix ppc_save_regs inclusion in build
| * 63cff9f57e usb: typec: displayport: Fix potential deadlock
| * 4b91b77af2 platform/x86: think-lmi: Fix sysfs group cleanup
| * 98002f1ac9 platform/x86: think-lmi: Fix kobject cleanup
| * cb3e3244d8 platform/x86: think-lmi: Create ksets consecutively
| * 3605463628 powercap: intel_rapl: Do not change CLAMPING bit if ENABLE bit cannot be changed
| * 73d43c2150 iommu/rockchip: prevent iommus dead loop when two masters share one IOMMU
| * 6052862ba3 Logitech C-270 even more broken
| * 6358cb9c2a i2c/designware: Fix an initialization issue
| * d8eab407c0 dma-buf: fix timeout handling in dma_resv_wait_timeout v2
| * 59205a3e93 smb: client: fix readdir returning wrong type with POSIX extensions
| * 937f49be49 usb: chipidea: udc: disconnect/reconnect from host when do suspend/resume
| * afbec8c344 usb: cdnsp: do not disable slot for disabled slot
| * c9a841fd2e Input: iqs7222 - explicitly define number of external channels
| * 2cd5e7c169 Input: xpad - support Acer NGR 200 Controller
| * c16b75aa6f xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS
| * 881c927424 xhci: dbc: Flush queued requests before stopping dbc
| * 897d1170c2 xhci: dbctty: disable ECHO flag by default
| * 7609899eb6 usb: xhci: quirk for data loss in ISOC transfers
| * 204bdc7a8b NFSv4/flexfiles: Fix handling of NFS level errors in I/O
| * e3eed01347 fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
| * adb29b437f module: Provide EXPORT_SYMBOL_GPL_FOR_MODULES() helper
| * a6069306f4 platform/x86: hp-bioscfg: Fix class device unregistration
| * 8570c219cd platform/x86: hp-bioscfg: Directly use firmware_attributes_class
| * 387da3b6d1 drm/v3d: Disable interrupts before resetting the GPU
| * 817662f9bd rcu: Return early if callback is not specified
| * d5c1e3f329 mtd: spinand: fix memory leak of ECC engine conf
| * d547779e72 ACPICA: Refuse to evaluate a method if arguments are missing
| * 347827bd0c wifi: ath6kl: remove WARN on bad firmware input
| * 5aebb9aa53 wifi: mac80211: drop invalid source address OCB frames
| * 270d637100 aoe: defer rexmit timer downdev work to workqueue
| * 55dfffc5e9 scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
| * 7b9203afeb regulator: fan53555: add enable_time support and soft-start times
| * a1d10fee07 ASoC: amd: yc: update quirk data for HP Victus
| * 871beab5b4 powerpc: Fix struct termio related ioctl macros
| * ba91173127 platform/x86/amd/pmc: Add PCSpecialist Lafite Pro V 14M to 8042 quirks list
| * 7852005165 ASoC: amd: yc: Add quirk for MSI Bravo 17 D7VF internal mic
| * 69283b3fd4 ata: pata_cs5536: fix build on 32-bit UML
| * 71f89fab5c ata: libata-acpi: Do not assume 40 wire cable if no devices are enabled
| * 6766316c1a ALSA: sb: Force to disable DMAs once when DMA mode is changed
| * c7922052c6 ALSA: sb: Don't allow changing the DMA mode during operations
| * c40ad1c04d drm/msm: Fix another leak in the submit error path
| * fe2695b2f6 drm/msm: Fix a fence leak in submit error path
| * 5df2087c9a drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read
| * ad09bb7cbd drm/simpledrm: Do not upcast in release helpers
| * 51ba658604 scsi: ufs: core: Fix clk scaling to be conditional in reset and restore
| * 847af89aa1 scsi: ufs: core: Add OPP support for scaling clocks and regulators
| * 95ffe73451 scsi: ufs: core: Fix abnormal scale up after last cmd finish
| * 9e67044aa9 f2fs: fix to zero post-eof page
| * d1ccd98edd f2fs: convert f2fs_vm_page_mkwrite() to use folio
| * 7ac8a61e55 f2fs: prevent writing without fallocate() for pinned files
| * b43c3050d2 f2fs: add tracepoint for f2fs_vm_page_mkwrite()
* | 170440ba3c Revert "Bluetooth: hci_core: Fix use-after-free in vhci_flush()"
* | 50ec333673 Merge bceae1daf3 ("x86/traps: Initialize DR6 by writing its architectural reset value") into android15-6.6-lts
|\|
| * bceae1daf3 x86/traps: Initialize DR6 by writing its architectural reset value
| * 16254aa985 bnxt: properly flush XDP redirect lists
| * 6310aafd42 wifi: mac80211: finish link init before RCU publish
| * ebca4264c6 wifi: mac80211: Add link iteration macro for link data
| * 32d0b58079 wifi: mac80211: chan: chandef is non-NULL for reserved
| * bc0819a25e Bluetooth: hci_core: Fix use-after-free in vhci_flush()
| * 64d07a40f8 smb: client: remove \t from TP_printk statements
| * 3499dcb6c5 btrfs: fix qgroup reservation leak on failure to allocate ordered extent
| * ccdd3eaec6 Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1"
| * ca7d5aa7cc smb: client: fix race condition in negotiate timeout by using more precise timing
| * 70b32cba5c amd-xgbe: do not double read link status
| * f680a4643c net/sched: Always pass notifications when child class becomes empty
| * 5ea2a10be7 nui: Fix dma_mapping_error() check
| * 7a1841c960 rose: fix dangling neighbour pointers in rose_rt_device_down()
| * 744cd8baff enic: fix incorrect MTU comparison in enic_change_mtu()
| * a133683c05 amd-xgbe: align CL37 AN sequence as per databook
| * f2ca04cbf0 lib: test_objagg: Set error message in check_expect_hints_stats()
| * 8f4652848b igc: disable L1.2 PCI-E link substate to avoid performance issue
| * 832058110a drm/i915/gsc: mei interrupt top half should be in irq disabled context
| * 40e09506ae drm/i915/gt: Fix timeline left held on VMA alloc error
| * 968a419c95 net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect
| * 0cee638d92 smb: client: fix warning when reconnecting channel
* | c9f588b3cf Merge 33713f7cda ("platform/mellanox: mlxreg-lc: Fix logic error in power state check") into android15-6.6-lts
|\|
| * 33713f7cda platform/mellanox: mlxreg-lc: Fix logic error in power state check
| * 421672fb7f platform/x86: dell-wmi-sysman: Fix class device unregistration
| * dba37f72aa platform/x86: dell-sysman: Directly use firmware_attributes_class
| * 4074f6a15e platform/x86: think-lmi: Fix class device unregistration
| * 093ee65bda platform/x86: think-lmi: Directly use firmware_attributes_class
| * ee813c62af platform/x86: firmware_attributes_class: Simplify API
| * e52b896d5f platform/x86: firmware_attributes_class: Move include linux/device/class.h
| * 9143d22a09 platform/x86: make fw_attr_class constant
| * 3df1e72b7b arm64: dts: qcom: sm8550: add UART14 nodes
| * 0deb3eb78e platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
| * 55a90f82d4 drm/i915/selftests: Change mock_request() to return error pointers
| * 822c05444f spi: spi-fsl-dspi: Clear completion counter before initiating transfer
| * 1fc5dc9301 drm/exynos: fimd: Guard display clock control with runtime PM calls
| * 7e6423f80b dpaa2-eth: fix xdp_rxq_info leak
| * 31afd30797 ethernet: atl1: Add missing DMA mapping error checks and count errors
| * 2a7ac29f10 btrfs: use btrfs_record_snapshot_destroy() during rmdir
| * d77a168028 btrfs: propagate last_unlink_trans earlier when doing a rmdir
| * 65d7f92db8 btrfs: rename err to ret in btrfs_rmdir()
| * 2d11d274e2 btrfs: fix iteration of extrefs during log replay
| * 79b025ebc1 btrfs: fix missing error handling when searching for inode refs during log replay
| * 529281206f Bluetooth: Prevent unintended pause by checking if advertising is active
| * e373354ecf platform/mellanox: nvsw-sn2201: Fix bus number in adapter error message
| * d8a1ad180c RDMA/mlx5: Fix vport loopback for MPV device
| * efb3413f6b RDMA/mlx5: Fix CC counters query for MPV
| * 301303d14d RDMA/mlx5: Fix HW counters query for non-representor devices
| * ee9cb28675 scsi: ufs: core: Fix spelling of a sysfs attribute name
| * 39dac98aca scsi: qla4xxx: Fix missing DMA mapping error in qla4xxx_alloc_pdu()
| * c3ec87fbb0 scsi: qla2xxx: Fix DMA mapping test in qla24xx_get_port_database()
| * 8ca65fa710 NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
| * d0877c479f nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
| * 23a3b32a27 RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert
| * edca475158 platform/mellanox: mlxbf-tmfifo: fix vring_desc.len assignment
| * 3962e5a384 arm64: dts: apple: t8103: Fix PCIe BCM4377 nodename
| * b935c1e734 mtk-sd: reset host->mrq on prepare_data() error
| * 61cdd66356 mtk-sd: Prevent memory corruption from DMA map failure
| * b3b00e9b03 mtk-sd: Fix a pagefault in dma_unmap_sg() for not prepared data
| * 45e9444b3b usb: typec: altmodes/displayport: do not index invalid pin_assignments
| * 24418bc77a regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods
| * 0506547f6e Bluetooth: MGMT: mesh_send: check instances prior disabling advertising
| * 8af1406949 Bluetooth: MGMT: set_mesh: update LE scan interval and window
| * 7e88ad41b6 Bluetooth: hci_sync: revert some mesh modifications
| * 3c0c18ef4c mmc: core: sd: Apply BROKEN_SD_DISCARD quirk earlier
| * c4fad2460c Revert "mmc: sdhci: Disable SD card clock before changing parameters"
| * 3855b7ace3 mmc: sdhci: Add a helper function for dump register in dynamic debug mode
| * 94d0c326cb vsock/vmci: Clear the vmci transport packet properly when initializing it
| * e7191481d6 s390/pci: Do not try re-enabling load/store if device is disabled
| * 80b971be4c virtio-net: ensure the received length does not exceed allocated size
| * 39617dc3fa rtc: cmos: use spin_lock_irqsave in cmos_interrupt
| * 5cdd1f7340 rtc: pcf2127: fix SPI command byte for PCF2131
| * 1cb814dbb0 rtc: pcf2127: add missing semicolon after statement
* | 06215a5745 ANDROID: GKI: add devm_regulator_bulk_get_enable to db845c symbol list
* | 3925dd0a8c Revert "firmware: arm_scmi: Add a common helper to check if a message is supported"
* | cecf7b3cb1 Merge 6.6.96 into android15-6.6-lts
|\|
| * a5df3a702b Linux 6.6.96
| * 18d3f9b8e4 ARM: 9354/1: ptrace: Use bitfield helpers
| * f9917821c5 firmware: arm_scmi: Ensure that the message-id supports fastchannel
| * 67a50f5721 firmware: arm_scmi: Add a common helper to check if a message is supported
| * 6f27bbf3de nvme: always punt polled uring_cmd end_io work to task_work
| * cdfb20e4b3 spi: spi-cadence-quadspi: Fix pm runtime unbalance
| * c46358d027 Revert "ipv6: save dontfrag in cork"
| * 1583d908cc x86/tools: Drop duplicate unlikely() definition in insn_decoder_test.c
| * ed1f395ea5 Kunit to check the longest symbol length
| * 5f4787834c s390/entry: Fix last breaking event handling in case of stack corruption
| * 56aa7679c9 media: uvcvideo: Rollback non processed entities on error
| * f165d04c41 kbuild: rpm-pkg: simplify installkernel %post
| * cca5bb42b7 scripts: clean up IA-64 code
| * b90dc5d67b ksmbd: remove unsafe_memcpy use in session setup
| * 107a48df3f ksmbd: Use unsafe_memcpy() for ntlm_negotiate
| * 8302adf60a drm/amdgpu: switch job hw_fence to amdgpu_fence
| * a5d7cc1647 drm/amdgpu: Add kicker device detection
| * f640d01108 drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1
| * a8ceffaeb7 drm/amdgpu: amdgpu_vram_mgr_new(): Clamp lpfn to total vram
| * 5148c7ea69 drm/amd/display: Add null pointer check for get_first_active_display()
| * ede04b4715 drm/bridge: cdns-dsi: Wait for Clk and Data Lanes to be ready
| * 252e6e96f9 drm/bridge: cdns-dsi: Check return value when getting default PHY config
| * c4ee1b31a5 drm/bridge: cdns-dsi: Fix connecting to next bridge
| * f9b819c39d drm/bridge: cdns-dsi: Fix phy de-init and flag it so
| * 2565ff3ac3 drm/bridge: cdns-dsi: Fix the clock variable for mode_valid()
| * 76115eafad drm/amdkfd: Fix race in GWS queue scheduling
| * 7946a10f8d drm/msm/gpu: Fix crash when throttling GPU immediately during boot
| * 50e48e9403 drm/udl: Unregister device before cleaning up on disconnect
| * 5ff3636bcc drm/tegra: Fix a possible null pointer dereference
| * 23134a5227 drm/tegra: Assign plane type before registration
| * 9ec447c237 drm/etnaviv: Protect the scheduler's pending list with its lock
| * 6d7b814c52 drm/cirrus-qemu: Fix pitch programming
| * 66f122e672 drm/ast: Fix comment on modeset lock
| * bf2c1643ab scsi: megaraid_sas: Fix invalid node index
| * 42cf4f0161 HID: wacom: fix kobject reference count leak
| * f531651c39 HID: wacom: fix memory leak on sysfs attribute creation failure
| * 33acbeeb5a HID: wacom: fix memory leak on kobject creation failure
| * f0ffc8076d HID: lenovo: Restrict F7/9/11 mode to compact keyboards only
| * 8a89e9c27b net: libwx: fix the creation of page_pool
| * 9052c7bca3 btrfs: update superblock's device bytes_used when dropping chunk
| * aeeae8feea btrfs: fix a race between renames and directory logging
| * 6ad80378f9 dm-raid: fix variable in journal device check
| * e395e34b06 Bluetooth: L2CAP: Fix L2CAP MTU negotiation
| * f90d78d65c serial: imx: Restore original RXTL for console to fix data loss
| * 40f62f8cf8 dt-bindings: serial: 8250: Make clocks and clock-frequency exclusive
| * f89c40520f staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()
| * e5e6a5aa39 EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs
| * c82c704125 smb: client: fix potential deadlock when reconnecting channels
| * ced8eff11a drm/bridge: ti-sn65dsi86: Add HPD for DisplayPort connector type
| * 1c9a8a84c5 drm/bridge: ti-sn65dsi86: make use of debugfs_init callback
| * ee800ff711 drm/i915: fix build error some more
| * 0804d77fd6 net: selftests: fix TCP packet checksum
| * 5b63793da8 ALSA: hda/realtek: Fix built-in mic on ASUS VivoBook X507UAR
| * cabed6ba92 atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister().
| * 63528d6067 net: enetc: Correct endianness handling in _enetc_rd_reg64
| * ad9c4941d3 libbpf: Fix possible use-after-free for externs
| * c61e284d72 um: ubd: Add missing error check in start_io_thread()
| * 8f96a2ae16 vsock/uapi: fix linux/vm_sockets.h userspace compilation errors
| * d58343f813 af_unix: Don't set -ECONNRESET for consumed OOB skb.
| * 86136c6705 wifi: mac80211: fix beacon interval calculation overflow
| * 9b9a87f0bd libbpf: Fix null pointer dereference in btf_dump__free on allocation failure
| * 591f796257 attach_recursive_mnt(): do not lock the covering tree when sliding something under it
| * 74fcb3852a ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3()
| * 3c709dce16 atm: clip: prevent NULL deref in clip_push()
| * 64a99eff8d lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()
| * 88f3869649 s390/pkey: Prevent overflow in size calculation for memdup_user()
| * db33aa6c5c ASoC: amd: yc: Add DMI quirk for Lenovo IdeaPad Slim 5 15
| * 490a43d07f mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path on write
| * c9036b6390 i2c: robotfuzz-osif: disable zero-length read messages
| * 4841060d2e i2c: tiny-usb: disable zero-length read messages
| * fad0a2c160 af_unix: Don't leave consecutive consumed OOB skbs.
| * aabb458c33 af_unix: Don't call skb_get() for OOB skb.
| * 0919388ac4 af_unix: Define locking order for U_RECVQ_LOCK_EMBRYO in unix_collect_skb().
| * fd3af69c14 af_unix: Define locking order for U_LOCK_SECOND in unix_state_double_lock().
| * b7904e2fcc af_unix: Define locking order for unix_table_double_lock().
| * 47847495a6 platform/x86: ideapad-laptop: use usleep_range() for EC polling
| * 6e7af3d4f6 platform/x86: ideapad-laptop: move ACPI helpers from header to source file
| * f8761b11f1 platform/x86: ideapad-laptop: move ymc_trigger_ec from lenovo-ymc
| * d19ae7b033 platform/x86: ideapad-laptop: introduce a generic notification chain
| * b6b5bcae7a dummycon: Trigger redraw when switching consoles with deferred takeover
| * 8853bad763 tty: vt: make consw::con_switch() return a bool
| * e9ba8c528b tty: vt: sanitize arguments of consw::con_clear()
| * 0b10b5ab7d tty: vt: make init parameter of consw::con_init() a bool
| * 7bf946a284 PCI: apple: Set only available ports up
| * b8704eef56 PCI: apple: Use helper function for_each_child_of_node_scoped()
| * df1d7e879e uio_hv_generic: Align ring size to system page
| * ca0198894b uio_hv_generic: Query the ringbuffer size for device
| * ebba6cc078 Drivers: hv: vmbus: Add utility function for querying ring size
| * 3bc5abf8e7 f2fs: don't over-report free space or inodes in statvfs
| * 9830ef1803 ASoC: codecs: wcd9335: Fix missing free of regulator supplies
| * 28b6ef1ab6 ASoC: codec: wcd9335: Convert to GPIO descriptors
| * 99d6968422 ASoC: codecs: wcd9335: Handle nicer probe deferral and simplify with dev_err_probe()
| * 0c40fa81f8 jfs: validate AG parameters in dbMount() to prevent crashes
| * 7747d3f9a5 fs/jfs: consolidate sanity checking in dbMount
| * fc97a116dc btrfs: handle csum tree error with rescue=ibadroots correctly
| * 2cbeb47ea9 ovl: Check for NULL d_inode() in ovl_dentry_upper()
| * d120737a6d scsi: ufs: core: Don't perform UFS clkscaling during host async scan
| * acc1d4cc47 ceph: fix possible integer overflow in ceph_zero_objects()
| * f3465bb320 ALSA: usb-audio: Add a quirk for Lenovo Thinkpad Thunderbolt 3 dock
| * 789a3f63bd ALSA: hda: Add new pci id for AMD GPU display HD audio controller
| * b8cd384c53 ALSA: hda: Ignore unsol events for cards being shut down
| * 23fe269bfa usb: typec: mux: do not return on EOPNOTSUPP in {mux, switch}_set
| * 8851e40587 usb: typec: displayport: Receive DP Status Update NAK request exit dp altmode
| * 00626325db usb: cdc-wdm: avoid setting WDM_READ for ZLP-s
| * 433cb3e70d usb: Add checks for snprintf() calls in usb_alloc_dev()
| * 0aaf810416 usb: common: usb-conn-gpio: use a unique name for usb connector device
| * 8e958d10dd tty: serial: uartlite: register uart driver in init
| * a33f507f36 usb: potential integer overflow in usbg_make_tpg()
| * a8d1b4f219 misc: tps6594-pfsm: Add NULL pointer check in tps6594_pfsm_probe()
| * 1063c586a3 iio: adc: ad_sigma_delta: Fix use of uninitialized status_pos
| * 41732f9feb usb: dwc2: also exit clock_gating when stopping udc while suspended
| * 8217fa7d92 coresight: Only check bottom two claim bits
| * 8dbc01f09c um: use proper care when taking mmap lock during segfault
| * 265ca17410 um: Add cmpxchg8b_emu and checksum functions to asm-prototypes.h
| * 462215a2a3 iio: pressure: zpa2326: Use aligned_s64 for the timestamp
| * c5734f9bab drm/scheduler: signal scheduled fence when kill job
| * 553f560e0a bcache: fix NULL pointer in cache_set_flush()
| * 9d578589e3 amd/amdkfd: fix a kfd_process ref leak
| * 2fb2470bc6 md/md-bitmap: fix dm-raid max_write_behind setting
| * aaef4f1f44 PCI: apple: Fix missing OF node reference in apple_pcie_setup_port
| * 969c9646f0 PCI: dwc: Make link training more robust by setting PORT_LOGIC_LINK_WIDTH to one lane
| * 7d942dbcd1 dmaengine: xilinx_dma: Set dma_device directions
| * e0051a3daa dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
| * c765f592ad rust: module: place cleanup_module() in .exit.text section
| * efe5db9d98 ksmbd: provide zero as a unique ID to the Mac client
| * f72093f270 ksmbd: allow a filename to contain special characters on SMB3.1.1 posix extension
| * ad804e3648 hwmon: (pmbus/max34440) Fix support for max34451
| * 2d8b3898ca NFSv4: xattr handlers should check for absent nfs filehandles
| * 9d90ab45d3 cxl/region: Add a dev_err() on missing target list entries
| * 96715eb1a1 fuse: fix race between concurrent setattrs from multiple nodes
| * a13b2634dd leds: multicolor: Fix intensity setting while SW blinking
| * c3616dfddf sunrpc: don't immediately retransmit on seqno miss
| * f0ba7e6d06 mfd: max14577: Fix wakeup source leaks on device unbind
| * 35cda8619d mailbox: Not protect module_put with spin_lock_irqsave
| * 7d03b140af NFSv4.2: fix listxattr to return selinux security label
| * cad6f283f6 NFSv4: Always set NLINK even if the server doesn't support it
| * 670c1c546c cifs: Fix encoding of SMB1 Session Setup NTLMSSP Request in non-UNICODE mode
| * 0e7f0e6e14 cifs: Fix cifs_query_path_info() for Windows NT servers
| * 4a6499ffc8 cifs: Correctly set SMB1 SessionKey field in Session Setup Request
* | d3539418f9 Merge 6.6.95 into android15-6.6-lts
|\|
| * 3f5b4c104b Linux 6.6.95
| * 218c3629fb cifs: Remove duplicate fattr->cf_dtype assignment from wsl_to_fattr() function
| * 6b4311f78a gpio: mlxbf3: only get IRQ for device instance 0
| * f6071c3cfe perf evsel: Missed close() when probing hybrid core PMUs
| * 2a673aca82 RISC-V: KVM: Don't treat SBI HFENCE calls as NOPs
| * e20f0f44ec RISC-V: KVM: Fix the size parameter check in SBI SFENCE calls
| * a77d0a14ed scsi: elx: efct: Fix memory leak in efct_hw_parse_filter()
| * 21da6d3561 arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth()
| * 7c631e5cd3 perf/core: Fix WARN in perf_cgroup_switch()
| * bddec73050 perf: Fix cgroup state vs ERROR
| * 2ee6044a69 perf: Fix sample vs do_exit()
| * 4ca4f418b7 s390/pci: Fix __pcilg_mio_inuser() inline assembly
| * d7094ad351 platform/loongarch: laptop: Add backlight power control support
| * 7b47919aff smb: client: fix first command failure during re-negotiation
| * cc77844d61 Revert "cpufreq: tegra186: Share policy per cluster"
| * eb74c6f1b2 ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
| * 94ec33e960 ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
| * 2f38986e93 platform/x86: ideapad-laptop: add missing Ideapad Pro 5 fn keys
| * e9a011fc6b serial: sh-sci: Increment the runtime usage counter for the earlycon device
| * cfa7fa0207 net: make for_each_netdev_dump() a little more bug-proof
| * b8ced2b9a2 smb: Log an error when close_all_cached_dirs fails
| * aaaa689aa2 dt-bindings: i2c: nvidia,tegra20-i2c: Specify the required properties
| * 6377977485 EDAC/amd64: Correct number of UMCs for family 19h models 70h-7fh
| * a5e3a14426 net: atm: fix /proc/net/atm/lec handling
| * dffd03422a net: atm: add lec_mutex
| * bde8833eb0 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().
| * 3162d8235c ublk: santizize the arguments from userspace when adding a device
| * 66bba1fd5b net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
| * 7382b6f7d1 net: microchip: lan743x: Reduce PTP timeout on HW failure
| * 235aa081e2 tcp: fix passive TFO socket having invalid NAPI ID
| * d3dfe821df tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
| * 9d0ddfb574 tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
| * 3261c017a7 atm: atmtcp: Free invalid length skb in atmtcp_c_send().
| * a060781640 mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
| * 4e9ab5c48a wifi: carl9170: do not ping device which has failed to load firmware
| * 43e3433a48 ptp: allow reading of currently dialed frequency to succeed on free-running clocks
| * a8c669bbc8 ptp: fix breakage after ptp_vclock_in_use() rework
| * aaef8e3a54 e1000e: set fixed clock frequency indication for Nahum 11 and Nahum 13
| * f4c19a8e51 net: ice: Perform accurate aRFS flow match
| * 8662ac79a6 aoe: clean device rq_list in aoedev_downdev()
| * 9311d6d1a5 pldmfw: Select CRC32 when PLDMFW is selected
| * 4c8f5b0483 hwmon: (occ) fix unaligned accesses
| * 1312d9bf88 hwmon: (occ) Rework attribute registration for stack usage
| * ff3dcf7f81 drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled
| * af2f5f2159 drm/nouveau/bl: increase buffer size to avoid truncate warning
| * b599b31038 ionic: Prevent driver/fw getting out of sync on devcmd(s)
| * 002aa3ed19 drm/msm/dsi/dsi_phy_10nm: Fix missing initial VCO rate
| * 77087a7977 drm/msm/disp: Correct porch timing for SDM845
| * 7e6980c225 smb: fix secondary channel creation issue with kerberos by populating hostname when adding channels
| * 599c489eea sunrpc: handle SVC_GARBAGE during svc auth processing as auth error
| * 5e5d2ad976 erofs: remove unused trace event erofs_destroy_inode
| * 2536810df1 bpf: Fix L4 csum update on IPv6 in CHECKSUM_COMPLETE
| * f6393e5cb9 net: Fix checksum update for ILA adj-transport
* | 041da35be7 Merge 3977946f61 ("mm/huge_memory: fix dereferencing invalid pmd migration entry") into android15-6.6-lts
|\|
| * 3977946f61 mm/huge_memory: fix dereferencing invalid pmd migration entry
* | 71c8356f59 Merge af6cfcd0ef ("mm/hugetlb: unshare page tables during VMA split, not before") into android15-6.6-lts
|\|
| * af6cfcd0ef mm/hugetlb: unshare page tables during VMA split, not before
| * 39c86833f9 iio: accel: fxls8962af: Fix temperature calculation
| * 3d849cc3df ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
| * f80e551050 ALSA: hda/intel: Add Thinkpad E15 to PM deny list
| * d61975567d ALSA: usb-audio: Rename ALSA kcontrol PCM and PCM1 for the KTMicro sound card
| * 6562806f32 arm64: Restrict pagetable teardown to avoid false warning
| * 66bde385a1 wifi: rtw89: pci: use DBI function for 8852AE/8852BE/8851BE
| * eeacfbab98 wifi: cfg80211: init wiphy_work before allocating rfkill fails
| * 6d60d82280 Input: sparcspkr - avoid unannotated fall-through
| * 3902205ead atm: Revert atm_account_tx() if copy_from_iter_full() fails.
| * c1a2081f03 platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL
| * 2753481c40 selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
| * 0902625a24 ksmbd: fix null pointer dereference in destroy_previous_session
| * 2a03531c00 selftests/x86: Add a test to detect infinite SIGTRAP handler loop
| * 372b511e93 udmabuf: use sgtable-based scatterlist wrappers
| * bfa4d86e13 net: clear the dst when changing skb protocol
| * 0357da9149 net_sched: sch_sfq: reject invalid perturb period
| * bb9d4ffff6 scsi: s390: zfcp: Ensure synchronous unit_add
| * 8d60df50e6 scsi: storvsc: Increase the timeouts to storvsc_timeout
| * a504536c29 smb: improve directory cache reuse for readdir operations
| * 202d7e8389 cifs: do not disable interface polling on failure
| * 58021a32f2 cifs: serialize other channels when query server interfaces is pending
| * b530c44e1f cifs: deal with the channel loading lag while picking channels
| * cd42ddddd7 jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
| * 3f46644a51 jffs2: check that raw node were preallocated before writing summary
| * b427d98d55 LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
| * 099cfcb98f LoongArch: Avoid using $r0/$r1 as "mask" for csrxchg
| * 782baee5d9 platform/loongarch: laptop: Unregister generic_sub_drivers on exit
| * 3bce9e6be0 platform/loongarch: laptop: Get brightness setting from EC on probe
| * 1921781ec4 drivers/rapidio/rio_cm.c: prevent possible heap overwrite
| * 675d90ee87 io_uring: fix task leak issue in io_wq_create()
| * 3c3c7c66bd Revert "x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2" on v6.6 and older
| * af4ed5262d powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
| * a7f3cfc1eb powerpc/vdso: Fix build of VDSO32 with pcrel
| * dd95b3e003 platform/x86: dell_rbu: Stop overwriting data buffer
| * f3b840fb15 platform/x86: dell_rbu: Fix list usage
| * 523e2f8a7f platform/x86/amd: pmc: Clear metrics table at start of cycle
| * 7d71ba5b0a fs/xattr.c: fix simple_xattr_list()
| * 897e6d88f0 Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
| * cdc1b9b47b tee: Prevent size calculation wraparound on 32-bit kernels
| * 59b7304d0d ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
| * bca6fe52bd bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
| * c85311a73d watchdog: da9052_wdt: respect TWDMIN
| * 519ba75728 fbcon: Make sure modelist not set on unregistered console
| * 8df53ee74c wifi: ath12k: Pass correct values of center freq1 and center freq2 for 160 MHz
| * 2304e2b5e4 wifi: ath12k: fix incorrect CE addresses
| * 9db1bf9014 wifi: ath12k: fix link valid field initialization in the monitor Rx
| * 6bd0f2e71b wifi: ath11k: determine PM policy based on machine model
| * 42d0bfbe02 octeontx2-pf: Add error log forcn10k_map_unmap_rq_policer()
| * a37888a435 net: ethernet: cortina: Use TOE/TSO on all TCP
| * 38c4106cb4 bpf, sockmap: Fix data lost during EAGAIN retries
| * bdb4da9e19 f2fs: fix to set atomic write status more clear
| * a3c32f17ac usbnet: asix AX88772: leave the carrier control to phylink
| * e036d64877 ice: fix check for existing switch rule
| * 8cde755f56 i40e: fix MMIO write access to an invalid page in i40e_clear_hw
| * 52a16bafda sock: Correct error checking condition for (assign|release)_proto_idx()
| * 34c0a67055 scsi: lpfc: Use memcpy() for BIOS version
| * 79dc5e78d1 wifi: ath12k: fix failed to set mhi state error during reboot with hardware grouping
| * 5cf32cef3a pinctrl: mcp23s08: Reset all pins to input at probe
| * f9397cf7bf software node: Correct a OOB check in software_node_get_reference_args()
| * 03545901ec net: ethernet: ti: am65-cpsw: handle -EPROBE_DEFER
| * c0d8c14d9b vxlan: Do not treat dst cache initialization errors as fatal
| * b4c83b3749 net: bridge: mcast: re-implement br_multicast_{enable, disable}_port functions
| * cd97899361 net: bridge: mcast: update multicast contex when vlan state is changed
| * a0ab9e9148 wifi: iwlwifi: Add missing MODULE_FIRMWARE for Qu-c0-jf-b0
| * 172d1e4a68 wifi: mac80211: VLAN traffic in multicast path
| * 4fc2b3c065 wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled
| * 2077cef44d wifi: iwlwifi: pcie: make sure to lock rxq->read
| * 920fcc7adc iommu/amd: Ensure GA log notifier callbacks finish running before module unload
| * 32f25633f3 scsi: lpfc: Fix lpfc_check_sli_ndlp() handling for GEN_REQUEST64 commands
| * c697dac969 libbpf: Add identical pointer detection to btf_dedup_is_equiv()
| * f11cfb48f2 clk: rockchip: rk3036: mark ddrphy as critical
| * dfec43c503 wifi: mac80211: do not offer a mesh path if forwarding is disabled
| * efa7997ce8 wireless: purelifi: plfxlc: fix memory leak in plfxlc_usb_wreq_asyn()
| * 187829fb0c net: vertexcom: mse102x: Return code for mse102x_rx_pkt_spi
| * 84d34bd55d net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
| * ae48bc0b8b pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
| * 8a15a5438c pinctrl: armada-37xx: propagate error from armada_37xx_pmx_gpio_set_direction()
| * 02c966a886 pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get_direction()
| * 14a26f6692 pinctrl: armada-37xx: propagate error from armada_37xx_pmx_set_by_name()
| * 79f3e44df6 net: atlantic: generate software timestamp just before the doorbell
| * 9121c2ddd1 ipv4/route: Use this_cpu_inc() for stats on PREEMPT_RT
| * 62b62a2a6d x86/sgx: Prevent attempts to reclaim poisoned pages
| * c1025a5428 tcp: fix initial tp->rcvq_space.space value for passive TS enabled flows
| * 156b6bac76 tcp: always seek for minimal rtt in tcp_rcv_rtt_update()
| * 969d61aa16 wifi: rtw89: leave idle mode when setting WEP encryption for AP mode
| * f11520c617 wifi: ath11k: Fix QMI memory reuse logic
| * dcf7bb4397 wifi: ath12k: fix a possible dead lock caused by ab->base_lock
| * 7c4b6d8bd7 wifi: ath12k: fix macro definition HAL_RX_MSDU_PKT_LENGTH_GET
| * 6f79eb2e68 net: dlink: add synchronization for stats update
| * 04fa1bef29 i2c: npcm: Add clock toggle recovery
| * be5f6a6550 i2c: tegra: check msg length in SMBUS block read
| * 762325441e cpufreq: scmi: Skip SCMI devices that aren't used by the CPUs
| * a620f66675 sctp: Do not wake readers in __sctp_write_space()
| * a0b91fa813 wifi: mt76: mt7921: add 160 MHz AP for mt7922 device
| * bf3dcb53ba wifi: mt76: mt76x2: Add support for LiteOn WN4516R,WN4519R
| * 2c1a2d863b emulex/benet: correct command version selection in be_cmd_get_stats()
| * 24900688ee wifi: mt76: mt7996: drop fragments with multicast or broadcast RA
| * 775fdb4042 i2c: designware: Invoke runtime suspend on quick slave re-registration
| * 7bf4461f1c bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
| * 61fc32485d f2fs: use vmalloc instead of kvmalloc in .init_{,de}compress_ctx
| * 92dbc2a2e2 tipc: use kfree_sensitive() for aead cleanup
| * 088279ff18 net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices
| * d2a25ca413 net: macb: Check return value of dma_set_mask_and_coherent()
| * c148af1f39 ACPI: battery: negate current when discharging
| * 6635356483 PM: runtime: fix denying of auto suspend in pm_suspend_timer_fn()
| * 6a7c583f56 gpiolib: of: Add polarity quirk for s5m8767
| * 5505ec191f ASoC: tegra210_ahub: Add check to of_device_get_match_data()
| * cf961a38e4 ACPICA: utilities: Fix overflow check in vsnprintf()
| * 558ba4afdf power: supply: bq27xxx: Retrieve again when busy
| * 1fee4324b5 ACPICA: fix acpi parse and parseext cache leaks
| * 8621fbeb4d ACPI: Add missing prototype for non CONFIG_SUSPEND/CONFIG_X86 case
| * 0ab90839bf ACPI: bus: Bail out if acpi_kobj registration fails
| * 7d346ca11a ASoC: tas2770: Power cycle amp on ISENSE/VSENSE change
| * 30e11a8cff ACPICA: Avoid sequence overread in call to strncmp()
| * 58cf7ba36b mmc: Add quirk to disable DDR50 tuning
| * 74f765e85d power: supply: collie: Fix wakeup source leaks on device unbind
| * 1c24a73897 clocksource: Fix the CPUs' choice in the watchdog per CPU verification
| * 28ecaebbed ASoC: amd: yc: Add quirk for Lenovo Yoga Pro 7 14ASP9
| * 755a8006b7 ACPICA: fix acpi operand cache leak in dswstate.c
| * 3175377e8e iio: adc: ad7606_spi: fix reg write value mask
| * f6a5b84f45 iio: imu: inv_icm42600: Fix temperature calculation
| * fe68429041 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
| * 6a86053630 iio: accel: fxls8962af: Fix temperature scan element sign
| * a9f6c1ad6c PCI: dw-rockchip: Fix PHY function call sequence in rockchip_pcie_phy_deinit()
| * 0b522796a8 PCI: Fix lock symmetry in pci_slot_unlock()
| * 7f6a2d3784 PCI: Add ACS quirk for Loongson PCIe
| * 9895f9d9b5 PCI: cadence-ep: Correct PBA offset in .set_msix() callback
| * 7ca06d696a uio_hv_generic: Use correct size for interrupt and monitor pages
| * 6f824cdd82 Drivers: hv: Allocate interrupt and monitor pages aligned to system page boundary
| * 37166d63e4 smb: client: add NULL check in automount_fullpath
| * 39ff377469 cifs: dns resolution is needed only for primary channel
| * 5713127da8 cifs: update dstaddr whenever channel iface is updated
| * 9d80e1d37e cifs: reset connections for all channels when reconnect requested
| * 3ee979709e remoteproc: core: Release rproc->clean_table after rproc_attach() fails
| * 9515d74c9d remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_attach()
| * a4df96e2e8 regulator: max14577: Add error check for max14577_read_reg()
| * 231f6a1de1 mips: Add -std= flag specified in KBUILD_CFLAGS to vdso CFLAGS
| * dfa9ef978d staging: iio: ad5933: Correct settling cycles encoding per datasheet
| * cc3cc41ed6 video: screen_info: Relocate framebuffers behind PCI bridges
| * fa2118e9e2 KVM: s390: rename PROT_NONE to PROT_TYPE_DUMMY
| * 6bd2569d0b net: ch9200: fix uninitialised access during mii_nway_restart
| * b1bf167f46 phy: fsl-imx8mq-usb: fix phy_tx_vboost_level_from_property()
| * 83a692a979 ftrace: Fix UAF when lookup kallsym after ftrace disabled
| * 6737c4551d mtd: rawnand: qcom: Fix read len for onfi param page
| * df4918c0bb dm-verity: fix a memory leak if some arguments are specified multiple times
| * 61850a1b26 dm-mirror: fix a tiny race condition
| * fe0ff7d801 KVM: VMX: Flush shadow VMCS on emergency reboot
| * 0d7a2ea435 KVM: SVM: Clear current_vmcb during vCPU free for all *possible* CPUs
| * 7775ab2d53 mtd: nand: sunxi: Add randomizer configuration before randomizer enable
| * e06a1dadc4 mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
| * d3abf0066b mm: fix ratelimit_pages update error in dirty_ratio_handler()
| * 23a707bbcb RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
| * 442e80dcf6 watchdog: fix watchdog may detect false positive of softlockup
| * 5180561aff ipc: fix to protect IPCS lookups using RCU
| * f24d422452 clk: meson-g12a: add missing fclk_div2 to spicc
| * ebb8060561 parisc: fix building with gcc-15
| * 2f4040a585 vgacon: Add check for vc_origin address range in vgacon_scroll()
| * 7f27859721 parisc/unaligned: Fix hex output to show 8 hex chars
| * 3ca78032a3 fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var
| * e32a40db67 EDAC/altera: Use correct write width with the INTTEST register
| * 0909b2b49c fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var
| * 061a5dd666 net: ftgmac100: select FIXED_PHY
| * 8c5713ce1c net/sched: fix use-after-free in taprio_dev_notifier
| * a8acc7080a NFC: nci: uart: Set tty->disc_data only in success path
| * d95d87841d hwmon: (ftsteutates) Fix TOCTOU race in fts_read()
| * 79ef8a6c4e f2fs: fix to do sanity check on sit_bitmap_size
| * a87cbcc909 f2fs: prevent kernel warning due to negative i_nlink from corrupted image
| * aaddc6c696 f2fs: fix to do sanity check on ino and xnid
| * 0f7100e8d9 Input: gpio-keys - fix possible concurrent access in gpio_keys_irq_timer()
| * 17474a56ac Input: ims-pcu - check record size in ims_pcu_flash_firmware()
| * cf6a4c4ac7 ext4: only dirty folios when data journaling regular files
| * 3e8a5163bc ext4: ensure i_size is smaller than maxbytes
| * 68cea04f1f ext4: factor out ext4_get_maxbytes()
| * 223091c989 ext4: fix calculation of credits for extent tree modification
| * 26e09d1859 ext4: inline: fix len overflow in ext4_prepare_inline_data
| * 55995f1725 bus: fsl-mc: fix GET/SET_TAILDROP command ids
| * 1e474b5fab bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device
| * 8edfed4439 ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
| * 48f35a3294 cgroup,freezer: fix incomplete freezing when attaching tasks
| * 96707ff581 ceph: set superblock s_magic for IMA fsmagic matching
| * 636391e8c9 can: tcan4x5x: fix power regulator retrieval during probe
| * d5d4be47e0 bus: mhi: host: Fix conflict between power_up and SYSERR
| * 44b9620e82 bus: mhi: ep: Update read pointer only after buffer is written
| * 838d63de34 ARM: omap: pmic-cpcap: do not mess around without CPCAP or OMAP4
| * c592d3ceca ARM: 9447/1: arm/memremap: fix arch_memremap_can_ram_remap()
| * 12cffd5bd1 arm64/mm: Close theoretical race where stale TLB entry remains valid
| * a31dce9b56 media: uvcvideo: Fix deferred probing error
| * c51c0a0be2 media: uvcvideo: Send control events for partial succeeds
| * d314f99b6f media: uvcvideo: Return the number of processed controls
| * ec26be7d63 media: imx-jpeg: Cleanup after an allocation error
| * 20a6db0ef3 media: imx-jpeg: Reset slot data pointers when freed
| * 683a1db680 media: imx-jpeg: Move mxc_jpeg_free_slot_data() ahead
| * 350d4af049 media: imx-jpeg: Drop the first error frames
| * f6b1b0f8ba media: vivid: Change the siize of the composing
| * 9824e1732a media: vidtv: Terminating the subsequent process of initialization failure
| * 17cb043ea1 media: videobuf2: use sgtable-based scatterlist wrappers
| * 36318ff3d6 media: venus: Fix probe error handling
| * ae7b143e05 media: v4l2-dev: fix error handling in __video_register_device()
| * dfb2add0ba media: omap3isp: use sgtable-based scatterlist wrappers
| * ac3a8e37cb media: mediatek: vcodec: Correct vsi_core framebuffer size
| * 025a943c49 media: gspca: Add error handling for stv06xx_read_sensor()
| * ec5c328606 media: davinci: vpif: Fix memory leak in probe error path
| * 04354c529c media: cxusb: no longer judge rbuf when the write fails
| * 4425db511b media: ccs-pll: Check for too high VT PLL multiplier in dual PLL case
| * 1e4b3f1667 media: ccs-pll: Correct the upper limit of maximum op_pre_pll_clk_div
| * b9e314231f media: ccs-pll: Start OP pre-PLL multiplier search from correct value
| * ae2fe66065 media: ccs-pll: Start VT pre-PLL multiplier search from correct value
| * eb7a4ea0a1 media: i2c: ds90ub913: Fix returned fmt from .set_fmt()
| * ecaf904a55 media: nxp: imx8-isi: better handle the m2m usage_count
| * 585acb3549 media: ov5675: suppress probe deferral errors
| * ce4a5a34a2 media: ov8856: suppress probe deferral errors
| * aaf516bb73 wifi: rtlwifi: disable ASPM for RTL8723BE with subsystem ID 11ad:1723
| * d4356ce8f8 wifi: rtw88: usb: Reduce control message timeout to 500 ms
| * 2e7c64d7a9 jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata()
| * 1eeecd9be9 wifi: ath12k: fix ring-buffer corruption
| * 14f5549ad1 fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
| * 5ee9a07b45 SUNRPC: Prevent hang on NFS mount with xprtsec=[m]tls
| * 5060e1a5fe nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
| * e7e943ddd1 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
| * f08689fe31 wifi: ath11k: fix ring-buffer corruption
| * 68b2923577 wifi: ath11k: fix rx completion meta data corruption
| * 0e4dc15042 wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
| * 782b3aff67 net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid()
| * 477e4319c3 net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr()
| * 278a92b874 regulator: max20086: Change enable gpio to optional
| * 420f6942f1 regulator: max20086: Fix MAX200086 chip id
| * bf70b3c3df powerpc/pseries/msi: Avoid reading PCI device registers in reduced power states
| * 0257c26bbc io_uring/kbuf: account ring io_buffer_list memory
| * a8b5ef3554 io_uring: account drain memory to cgroup
| * abf80985f4 ASoC: meson: meson-card-utils: use of_property_present() for DT parsing
| * 3895a7590e ASoC: qcom: sdm845: Add error handling in sdm845_slim_snd_hw_params()
| * 40aefac870 gfs2: move msleep to sleepable context
| * f5b9144715 crypto: marvell/cesa - Do not chain submitted requests
| * 0df5e4c7de configfs: Do not override creating attribute file failure in populate_attrs()
* | 6a12f866df Revert "Bluetooth: MGMT: Protect mgmt_pending list with its own lock"
* | 2ed4312ac3 Revert "usb: typec: ucsi: fix Clang -Wsign-conversion warning"
* | 83acbc66b0 Merge 6.6.94 into android15-6.6-lts
|\|
| * 6282921b68 Linux 6.6.94
| * d0e22b854a drm/meson: Use 1000ULL when operating with mode->clock
| * 65e20c5d99 net: usb: aqc111: debug info before sanitation
| * 0fcfc93576 regulator: dt-bindings: mt6357: Drop fixed compatible requirement
| * 1380f68517 calipso: unlock rcu before returning -EAFNOSUPPORT
| * 2cfcbe1554 x86/iopl: Cure TIF_IO_BITMAP inconsistencies
| * 8884c41bae xen/arm: call uaccess_ttbr0_enable for dm_op hypercall
| * b0e35d5639 usb: typec: tcpm/tcpci_maxim: Fix bounds check in process_rx()
| * 3c7e52cfa8 usb: Flush altsetting 0 endpoints before reinitializating them after reset.
| * c40b5e0aad usb: cdnsp: Fix issue with detecting USB 3.2 speed
| * 81dc3db4c3 usb: cdnsp: Fix issue with detecting command completion event
| * 6e3af83680 VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify
| * 97f5b57eca usb: usbtmc: Fix read_stb function and get_stb ioctl
| * b0630d1845 kbuild: Disable -Wdefault-const-init-unsafe
| * 2c72fe18cc posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
| * 99bc5248a4 Revert "io_uring: ensure deferred completions are posted for multishot"
| * 029d39ae7e io_uring/rw: fix wrong NOWAIT check in io_rw_init_file()
| * 62d5d980b5 io_uring/rw: allow pollable non-blocking attempts for !FMODE_NOWAIT
| * 90e11232a6 io_uring: add io_file_can_poll() helper
| * 4fa7831cf0 HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
| * dd4b8e05f2 ALSA: usb-audio: Add implicit feedback quirk for RODE AI-1
| * 37a75cd83d tools/resolve_btfids: Fix build when cross compiling kernel with clang.
| * c9a2e81583 block: Fix bvec_set_folio() for very large folios
| * 9e263d9459 bio: Fix bio_first_folio() for SPARSEMEM without VMEMMAP
| * 51c695986f perf: Ensure bpf_perf_link path is properly serialized
| * efcd52ba64 nvmet-fcloop: access fcpreq only when holding reqlock
| * 84ead78a3c fs/filesystems: Fix potential unsigned integer underflow in fs_name()
| * 0383b25488 net_sched: ets: fix a race in ets_qdisc_change()
| * 057f7a61b0 net_sched: tbf: fix a race in tbf_change()
| * 2a71924ca4 net_sched: red: fix a race in __red_change()
| * 46c15c9d0f net_sched: prio: fix a race in prio_tune()
| * 77a72d7497 net/mlx5e: Fix leak of Geneve TLV option object
| * a810e48477 net/mlx5: Fix return value when searching for existing flow group
| * 5953ae44df net/mlx5: Fix ECVF vports unload on shutdown flow
| * 7fb33ed598 net/mlx5: Ensure fw pages are always allocated on same NUMA
| * 3c40cfcbf1 Bluetooth: MGMT: Fix sparse errors
| * c621211b30 Bluetooth: hci_sync: Fix broadcast/PA when using an existing instance
| * 4bf2991057 Bluetooth: Fix NULL pointer deference on eir_get_service_data
| * abb0605ca0 net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
| * bab6bca083 net/mdiobus: Fix potential out-of-bounds read/write access
| * 7bafe26d73 macsec: MACsec SCI assignment for ES = 0
| * ff55c85a92 net: Fix TOCTOU issue in sk_is_readable()
| * c6dad167aa ACPI: CPPC: Fix NULL pointer dereference when nosmp is used
| * 987c3b8859 i40e: retry VFLR handling if there is ongoing VF reset
| * dd184939f4 i40e: return false from i40e_reset_vf if reset is in progress
| * dc5fc562f1 drm/meson: fix more rounding issues with 59.94Hz modes
| * 8133122997 drm/meson: use vclk_freq instead of pixel_freq in debug print
| * e9a5fe7817 drm/meson: fix debug log statement when setting the HDMI clocks
| * 1f8d03fb90 drm/meson: use unsigned long long / Hz for frequency types
| * d2fc85c90b powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
| * 8635e325b8 powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
| * b4e9bab601 net_sched: sch_sfq: fix a potential crash on gso_skb handling
| * d4cbcf274c scsi: iscsi: Fix incorrect error path labels for flashnode operations
| * 581b7c3d80 pinctrl: qcom: pinctrl-qcm2290: Add missing pins
| * de2adfaa95 regulator: max20086: Fix refcount leak in max20086_parse_regulators_dt()
| * 6e32977114 wifi: ath11k: validate ath11k_crypto_mode on top of ath11k_core_qmi_firmware_ready
| * e8e4057570 wifi: ath11k: don't wait when there is no vdev started
| * a0ec9e39cb wifi: ath11k: don't use static variables in ath11k_debugfs_fw_stats_process()
| * e57c74d760 wifi: ath11k: avoid burning CPU in ath11k_debugfs_fw_stats_request()
| * 452f557615 wifi: ath11k: convert timeouts to secs_to_jiffies()
| * d66fd9591f wifi: ath11k: fix soc_dp_stats debugfs file permission
| * 748da2fc1c ath10k: snoc: fix unbalanced IRQ enable in crash recovery
| * 2591195952 ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use()
| * bdd56875c6 Bluetooth: MGMT: Protect mgmt_pending list with its own lock
| * 5e64376da2 Bluetooth: MGMT: Remove unused mgmt_pending_find_data
| * 9f66b6531c Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete
| * 6edb171845 Bluetooth: hci_core: fix list_for_each_entry_rcu usage
| * 21f071261f scsi: core: ufs: Fix a hang in the error handler
| * 44ab21d74f serial: sh-sci: Clean sci_ports[0] after at earlycon exit
| * 9d50955bf2 serial: sh-sci: Move runtime PM enable to sci_probe_single()
| * f8f07ea231 serial: sh-sci: Check if TX data was written to device in .tx_empty()
| * 6b60251cab arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators
| * 9333ced86c arm64: dts: ti: k3-j721e-sk: Add support for multiple CAN instances
| * b18568bae6 arm64: dts: ti: k3-j721e-sk: Model CSI2RX connector mux
| * 1e3db0a98c arm64: dts: ti: k3-am65-main: Add missing taps to sdhci0
| * 869aafe49c arm64: dts: ti: k3-am65-main: Fix sdhci node properties
| * c789d2c138 kasan: use unchecked __memset internally
| * 91d14d9961 Input: synaptics-rmi - fix crash with unsupported versions of F34
| * 73b8f31337 pmdomain: core: Fix error checking in genpd_dev_pm_attach_by_id()
| * 4f091ad086 do_change_type(): refuse to operate on unmounted/not ours mounts
| * 3d1ea8e048 fix propagation graph breakage by MOVE_MOUNT_SET_GROUP move_mount(2)
| * 3b699b9472 path_overmount(): avoid false negatives
| * 3aed255ae4 ASoC: ti: omap-hdmi: Re-add dai_link->platform to fix card init
| * cc03c899e6 ASoC: Intel: avs: Verify content returned by parse_int_array()
| * ea739a5492 ASoC: Intel: avs: Fix deadlock when the failing IPC is SET_D0IX
| * 9836cc310e ASoC: codecs: hda: Fix RPM usage count underflow
| * 0fd2ae4017 scsi: ufs: qcom: Prevent calling phy_exit() before phy_init()
| * d2507aeea4 seg6: Fix validation of nexthop addresses
| * 8c9e9cd398 wireguard: device: enable threaded NAPI
| * a21a493772 net: dsa: b53: allow RGMII for bcm63xx RGMII ports
| * 02c03865d2 net: dsa: b53: do not enable RGMII delay on bcm63xx
| * 1c7a023b0c netfilter: nf_nat: also check reverse tuple to obtain clashing entry
| * 39bab2d351 netfilter: nf_set_pipapo_avx2: fix initial map fill
| * 7f6265fce3 gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO
| * 9c49728b61 PM: sleep: Fix power.is_suspended cleanup for direct-complete devices
| * c07c61ef70 vmxnet3: correctly report gso type for UDP tunnels
| * cc89f457d9 net: wwan: t7xx: Fix napi rx poll issue
| * 85eef1748c net: fix udp gso skb_segment after pull from frag_list
| * b263088ee8 net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping
| * 2e02edb664 net: dsa: tag_brcm: legacy: fix pskb_may_pull length
| * 18e6481630 ice: fix rebuilding the Tx scheduler tree for large queue counts
| * d78e538b65 ice: create new Tx scheduler nodes for new queues only
| * 1d3c5d0dec ice: fix Tx scheduler error handling in XDP callback
| * 55dd722521 Bluetooth: L2CAP: Fix not responding with L2CAP_CR_LE_ENCRYPTION
| * 59d5f3134b spi: bcm63xx-hsspi: fix shared reset
| * 29abb7fc82 spi: bcm63xx-spi: fix shared reset
| * d888397397 net: lan966x: Make sure to insert the vlan tags also in host mode
| * 1b2e54f447 net/mlx4_en: Prevent potential integer overflow calculating Hz
| * 2e3d96ad95 driver: net: ethernet: mtk_star_emac: fix suspend/resume issue
| * acab7ca5ff net: tipc: fix refcount warning in tipc_aead_encrypt
| * 633a80216a gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt
| * 6ee70ca1fd net: stmmac: platform: guarantee uniqueness of bus_id
| * 7a8e875685 vt: remove VT_RESIZE and VT_RESIZEX from vt_compat_ioctl()
| * b3b4efa2e6 coresight: prevent deactivate active config while enabling the config
| * e69e2cfd8b fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt()
| * 32b3f3382d counter: interrupt-cnt: Protect enable/disable OPs with mutex
| * 72166de0a1 MIPS: Loongson64: Add missing '#interrupt-cells' for loongson64c_ls7a
| * ec20928ecb iio: adc: ad7124: Fix 3dB filter frequency reading
| * ca0012a632 iio: filter: admv8818: Support frequencies >= 2^32
| * 786cdbd4da iio: filter: admv8818: fix range calculation
| * 61b3b2d628 iio: filter: admv8818: fix integer overflow
| * 31fa7dd09a iio: filter: admv8818: fix band 4, state 15
| * f2829faa3f thunderbolt: Fix a logic error in wake on connect
| * a6c7c36573 serial: Fix potential null-ptr-deref in mlb_usio_probe()
| * db96a4fd86 usb: renesas_usbhs: Reorder clock handling and power management in probe
| * 63df0a22da rtc: loongson: Add missing alarm notifications for ACPI RTC events
| * 5603562786 PCI/DPC: Initialize aer_err_info before using it
| * b79e10050d dmaengine: ti: Add NULL check in udma_probe()
| * 127dfb4f1c phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
| * 248f52ad6e PCI: apple: Use gpiod_set_value_cansleep in probe flow
| * 004316d2de PCI: cadence: Fix runtime atomic count underflow
| * 92d879eff4 PCI: Print the actual delay time in pci_bridge_wait_for_secondary_bus()
| * 2e6d9128fe rtc: sh: assign correct interrupts with DT
| * 848d78e362 cifs: Fix validation of SMB1 query reparse point response
| * c050dc2669 nfs: ignore SB_RDONLY when remounting nfs
| * c9d9a8995f nfs: clear SB_RDONLY before getting superblock
| * 7101de2396 perf trace: Always print return value for syscalls returning a pid
| * 494395071e perf record: Fix incorrect --user-regs comments
| * 5ec729bc5b perf tests switch-tracking: Fix timestamp comparison
| * a20bbd9162 mfd: stmpe-spi: Correct the name used in MODULE_DEVICE_TABLE
| * 611efa317b mfd: exynos-lpass: Avoid calling exynos_lpass_disable() twice in exynos_lpass_remove()
| * 85322ddd44 rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
| * 3b726bc126 remoteproc: k3-r5: Drop check performed in k3_r5_rproc_{mbox_callback/kick}
| * f1a3c8ceb2 remoteproc: qcom_wcnss_iris: Add missing put_device() on error in probe
| * 41581d392c perf scripts python: exported-sql-viewer.py: Fix pattern matching with Python 3
| * 53385a400a perf intel-pt: Fix PEBS-via-PT data_src
| * 1737865a12 perf trace: Fix leaks of 'struct thread' in set_filter_loop_pids()
| * 8412696035 dm-flakey: make corrupting read bios work
| * 1aef0e1083 dm-flakey: error all IOs when num_features is absent
| * 4e9e45746b hwmon: (asus-ec-sensors) check sensor index in read_string()
| * a0d9d9b5a4 mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
| * fde3144453 backlight: pm8941: Add NULL check in wled_configure()
| * 06f41679d3 dm: free table mempools if not used in __bind
| * 679d40ca03 dm: don't change md if dm_table_set_restrictions() fails
| * e431cc956d perf ui browser hists: Set actions->thread before calling do_zoom_thread()
| * 34e124dc21 perf build: Warn when libdebuginfod devel files are not available
| * 655d3c6f8c randstruct: gcc-plugin: Fix attribute addition
| * c64a16344c randstruct: gcc-plugin: Remove bogus void member
| * ab91647acd fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
| * 8312b1f776 soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop()
| * b828083b3d soc: aspeed: lpc: Fix impossible judgment condition
| * fc5a7a9664 ARM: aspeed: Don't select SRAM
| * e774ce479f arm64: dts: mt6359: Rename RTC node to match binding expectations
| * 5b91fc48dc arm64: dts: renesas: white-hawk-ard-audio: Fix TPU0 groups
| * 0d5dd35f7a arm64: dts: rockchip: disable unrouted USB controllers and PHY on RK3399 Puma with Haikou
| * 867dd8a356 arm64: defconfig: mediatek: enable PHY drivers
| * 978991404a ARM: dts: qcom: apq8064 merge hw splinlock into corresponding syscon device
| * 9337a54bc6 ARM: dts: qcom: apq8064: add missing clocks to the timer node
| * 4ca90f54bc dt-bindings: vendor-prefixes: Add Liontron name
| * 4b23c46eb2 bus: fsl-mc: fix double-free on mc_dev
| * 8b8e296647 nilfs2: do not propagate ENOENT error from nilfs_btree_propagate()
| * 9ab3008bf9 nilfs2: add pointer check for nilfs_direct_propagate()
| * 681a35b1dc ocfs2: fix possible memory leak in ocfs2_finish_quota_recovery
| * 4f99357dad Squashfs: check return result of sb_min_blocksize
| * 2d4ad56428 arm64: dts: ti: k3-j721e-common-proc-board: Enable OSPI1 on J721E
| * 38caeda97b arm64: tegra: Drop remaining serial clock-names and reset-names
| * 1aaffafdd4 arm64: dts: rockchip: Update eMMC for NanoPi R5 series
| * 850fd99f22 arm64: dts: qcom: sda660-ifc6560: Fix dt-validate warning
| * ac25c30462 arm64: dts: qcom: sdm660-lavender: Add missing USB phy supply
| * 6145c491d6 arm64: dts: mt6359: Add missing 'compatible' property to regulators node
| * 018324818a arm64: dts: mediatek: mt6357: Drop regulator-fixed compatibles
| * d6d756d3ea arm64: dts: imx8mn-beacon: Set SAI5 MCLK direction to output for HDMI audio
| * 2eb09d84a0 arm64: dts: imx8mm-beacon: Set SAI5 MCLK direction to output for HDMI audio
| * 7a276effd5 arm64: dts: imx8mp-beacon: Fix RTC capacitive load
| * 75b985ef1e arm64: dts: imx8mn-beacon: Fix RTC capacitive load
| * 986c6c52d4 arm64: dts: imx8mm-beacon: Fix RTC capacitive load
| * c8658f43df arm64: dts: qcom: sdm660-xiaomi-lavender: Add missing SD card detect GPIO
| * 62f142f9b8 arm64: dts: mediatek: mt8195: Reparent vdec1/2 and venc1 power domains
| * 8af84ebd27 ARM: dts: at91: at91sam9263: fix NAND chip selects
| * e6ef5b282e ARM: dts: at91: usb_a9263: fix GPIO for Dataflash chip select
| * 3c94729890 arm64: dts: qcom: sc8280xp-x13s: Drop duplicate DMIC supplies
| * b1253f7c65 arm64: dts: qcom: sm8250: Fix CPU7 opp table
| * ac0df85cc5 arm64: dts: qcom: sm8350: Reenable crypto & cryptobam
| * 072b6f8e39 arm64: dts: qcom: sdm845-starqltechn: remove excess reserved gpios
| * 618060fc56 arm64: dts: qcom: sdm845-starqltechn: refactor node order
| * 2bf235c5dd arm64: dts: qcom: sdm845-starqltechn: fix usb regulator mistake
| * 8218e21030 arm64: dts: qcom: sdm845-starqltechn: remove wifi
| * c4f2f90ebb f2fs: fix to correct check conditions in f2fs_cross_rename
| * 67b800b6d7 f2fs: use d_inode(dentry) cleanup dentry->d_inode
| * 857b4d2bbe net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames
| * 8ebcd311b4 net: openvswitch: Fix the dead loop of MPLS parse
| * 946bfdfcb7 calipso: Don't call calipso functions for AF_INET sk.
| * 5df8db01d6 octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback
| * 0b40aeaf83 net: phy: mscc: Fix memory leak when using one step timestamping
| * 6486f11cce net: lan743x: rename lan743x_reset_phy to lan743x_hw_reset_phy
| * 4744a5d71d net: phy: fix up const issues in to_mdio_device() and to_phy_device()
| * 363fdf2777 net: phy: clear phydev->devlink when the link is deleted
| * 6f639c25bf bpf: Avoid __bpf_prog_ret0_warn when jit fails
| * 8d5bc5ec6c net: lan966x: Fix 1-step timestamping over ipv4 or ipv6
| * ac7897c012 RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
| * 60790d287c net: usb: aqc111: fix error handling of usbnet read calls
| * 333262e5dd RISC-V: KVM: lock the correct mp_state during reset
| * 68b69b50df netfilter: nft_tunnel: fix geneve_opt dump
| * 4c6fa65ab2 bpf, sockmap: Avoid using sk_socket after free when sending
| * 9c73afd7f1 Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()
| * 801677040b vfio/type1: Fix error unwind in migration dirty bitmap allocation
| * cf008d9a08 netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy
| * 1e8b2048f9 wifi: mt76: mt7996: fix RX buffer size of MCU event
| * 800f7e73a6 wifi: mt76: mt7996: set EHT max ampdu length capability
| * e9f9cef187 wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init()
| * 6c81f1c781 kernfs: Relax constraint in draining guard
| * 713b9bfa93 scsi: ufs: mcq: Delete ufshcd_release_scsi_cmd() in ufshcd_mcq_abort()
| * 5482ef9875 wifi: ath9k_htc: Abort software beacon handling if disabled
| * b5ef128926 hisi_acc_vfio_pci: bugfix live migration function without VF device driver
| * 5be5cd86d1 hisi_acc_vfio_pci: add eq and aeq interruption restore
| * f0423873e7 hisi_acc_vfio_pci: fix XQE dma address error
| * 99dbad1b01 wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event
| * 4b1cf1f040 iommu: remove duplicate selection of DMAR_TABLE
| * 74e18211c2 wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
| * f61b8fecec s390/bpf: Store backchain even for leaf progs
| * fbd4d6293b clk: qcom: gcc-msm8939: Fix mclk0 & mclk1 for 24 MHz
| * 6d8f39875a bpf: Fix WARN() in get_bpf_raw_tp_regs
| * eb435bc4c7 pinctrl: at91: Fix possible out-of-boundary access
| * b44672c17c libbpf: Use proper errno value in nlattr
| * 07680e38b7 ktls, sockmap: Fix missing uncharge operation
| * 94ade4147a tracing: Fix error handling in event_trigger_parse()
| * ae015964d7 tracing: Rename event_trigger_alloc() to trigger_data_alloc()
| * 3f7724fcc1 efi/libstub: Describe missing 'out' parameter in efi_load_initrd
| * 3c1adc2f8c clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
| * 012fd59873 clk: qcom: gpucc-sm6350: Add *_wait_val values for GDSCs
| * 7c95e4a31f clk: qcom: gcc-sm6350: Add *_wait_val values for GDSCs
| * f2692b2177 clk: qcom: dispcc-sm6350: Add *_wait_val values for GDSCs
| * a1383eb9d6 clk: qcom: camcc-sm6350: Add *_wait_val values for GDSCs
| * ac7ab38c27 tracing: Move histogram trigger variables from stack to per CPU structure
| * c60f57a496 bpf: Fix uninitialized values in BPF_{CORE,PROBE}_READ
| * 7c4c84cdcc RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
| * 5e4519d8cd netfilter: nft_quota: match correctly when the quota just depleted
| * 585c9ed565 netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it
| * 50bbbd2559 bpf: Allow XDP dev-bound programs to perform XDP_REDIRECT into maps
| * 1066c5a7d0 libbpf: Use proper errno value in linker
| * 1c005c53cf f2fs: fix to detect gcing page in f2fs_is_cp_guaranteed()
| * 43cec28049 f2fs: clean up w/ fscrypt_is_bounce_page()
| * 4b88a4dfbe bonding: assign random address if device address is same as bond
| * 8fa998b842 iommu: Protect against overflow in iommu_pgsize()
| * cb4b936946 Use thread-safe function pointer in libbpf_print
| * 79669facfe libbpf: Remove sample_period init in perf_buffer
| * 624b4cf6c4 scsi: hisi_sas: Call I_T_nexus after soft reset for SATA disk
| * 5edd80d4b9 RDMA/hns: Include hnae3.h in hns_roce_hw_v2.h
| * be049199de wifi: ath12k: fix node corruption in ar->arvifs list
| * c9c9107ffa wifi: ath12k: Add MSDU length validation for TKIP MIC error
| * f76f399004 wifi: rtw88: do not ignore hardware read error during DPK
| * 7b63e52a8b wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally
| * 446fcc230d wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT
| * 6aa81fc0d6 xfrm: Use xdo.dev instead of xdo.real_dev
| * 18eb7b5f1e libbpf: Fix buffer overflow in bpf_object__init_prog
| * 0e9c13ed85 net: ncsi: Fix GCPS 64-bit member variables
| * a39cc43efc f2fs: fix to do sanity check on sbi->total_valid_block_count
| * a93db61dfa wifi: ath12k: Fix WMI tag for EHT rate in peer assoc
| * db1d15a26f bpf, sockmap: Fix panic when calling skb_linearize
| * 34837ae8cd bpf, sockmap: fix duplicated data transmission
| * 2e36a81d38 bpf: fix ktls panic with sockmap
| * 7c969106a8 selftests/bpf: Fix bpf_nf selftest failure
| * b524baecb0 IB/cm: use rwlock for MAD agent lock
| * f50ba7e7b6 wifi: ath11k: fix node corruption in ar->arvifs list
| * 3d6e3849b6 xen/x86: fix initial memory balloon target
| * 7810600b06 drm/mediatek: mtk_drm_drv: Unbind secondary mmsys components on err
| * a2502fd0fa drm/mediatek: Fix kobject put for component sub-drivers
| * 8126855798 drm/mediatek: mtk_drm_drv: Fix kobject put for mtk_mutex device ptr
| * 77511c2d2d perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create()
| * ee96502062 scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
| * e500dff1e4 arm64/fpsimd: Do not discard modified SVE state
| * 99d4011a0a firmware: SDEI: Allow sdei initialization without ACPI_APEI_GHES
| * 3215e000ef drm/tegra: rgb: Fix the unbound reference count
| * 01f73e1042 drm/vkms: Adjust vkms_state->active_planes allocation type
| * 4715d2959d drm: rcar-du: Fix memory leak in rcar_du_vsps_init()
| * 5e99bcff7c selftests/seccomp: fix syscall_restart test for arm compat
| * cf08a1cba0 arm64: Support ARM64_VA_BITS=52 when setting ARCH_MMAP_RND_BITS_MAX
| * 0052f10c25 firmware: psci: Fix refcount leak in psci_dt_init
| * 569829f8fd m68k: mac: Fix macintosh_config for Mac II
| * 428d865fec watchdog: exar: Shorten identity name to fit correctly
| * 701340a25b fs/ntfs3: handle hdr_first_de() return value
| * 94be75619e drm/bridge: lt9611uxc: Fix an error handling path in lt9611uxc_probe()
| * 2f6e645ce6 arm64/fpsimd: Fix merging of FPSIMD state during signal return
| * 43be952e88 arm64/fpsimd: Discard stale CPU state when handling SME traps
| * 8bf6491dab arm64/fpsimd: Avoid RES0 bits in the SME trap handler
| * 0d271c5300 media: rkvdec: Fix frame size enumeration
| * cdf7e1ff99 drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table
| * 079cc1fa46 drm/vc4: tests: Use return instead of assert
| * 83cc36371a drm/vmwgfx: Add seqno waiter for sync_files
| * 8b263e8ab2 ASoC: apple: mca: Constrain channels according to TDM mask
| * 42f7dd4bf5 spi: sh-msiof: Fix maximum DMA transfer size
| * 5174ac310a ACPI: OSI: Stop advertising support for "3.0 _SCP Extensions"
| * fca08cfadd PM: sleep: Print PM debug messages during hibernation
| * aa7b90057b x86/mtrr: Check if fixed-range MTRRs exist in mtrr_save_fixed_ranges()
| * 2b54593806 PM: wakeup: Delete space in the end of string shown by pm_show_wakelocks()
| * 5b71469d77 ASoC: SOF: ipc4-pcm: Adjust pipeline_list->pipelines allocation type
| * d46af758f6 power: reset: at91-reset: Optimize at91_reset()
| * c6c1422679 spi: tegra210-quad: modify chip select (CS) deactivation
| * 41de2c9e30 spi: tegra210-quad: remove redundant error handling code
| * 04034d43e9 spi: tegra210-quad: Fix X1_X2_X4 encoding and support x4 transfers
| * 3ff2422442 EDAC/{skx_common,i10nm}: Fix the loss of saved RRL for HBM pseudo channel 0
| * 3f5d065900 EDAC/skx_common: Fix general protection fault
| * 4191b7669e ASoC: tas2764: Enable main IRQs
| * 8b94e19ada ACPICA: exserial: don't forget to handle FFixedHW opregions for reading
| * f6941e72d3 kunit: Fix wrong parameter to kunit_deactivate_static_stub()
| * 5810e9d402 crypto: sun8i-ce - move fallback ahash_request to the end of the struct
| * 04a39a3c7d crypto: xts - Only add ecb if it is not already there
| * ba2af6855c crypto: lrw - Only add ecb if it is not already there
| * ec91ab135c rcu/cpu_stall_cputime: fix the hardirq count for x86 architecture
| * 402fd6a6fe btrfs: scrub: fix a wrong error type when metadata bytenr mismatches
| * 7cfb9086b6 btrfs: scrub: update device stats when an error is detected
| * 3cf4d9cae4 crypto: marvell/cesa - Avoid empty transfer descriptor
| * 5e9666ac8b crypto: marvell/cesa - Handle zero-length skcipher requests
| * 62af778005 x86/cpu: Sanitize CPUID(0x80000000) output
| * ce167ff4cd x86/microcode/AMD: Do not return error when microcode update is not necessary
| * 4fb2231089 powerpc/crash: Fix non-smp kexec preparation
| * fdc39b3ad8 powerpc: do not build ppc_save_regs.o always
| * cb1e26f53e crypto: sun8i-ss - do not use sg_dma_len before calling DMA functions
| * c62b79c1c5 crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare()
| * 6ce08b3ba5 perf/core: Fix broken throttling when max_samples_per_tick=1
| * eec0dd17db gfs2: gfs2_create_inode error handling fix
| * 76c7b1407a crypto: sun8i-ce-hash - fix error handling in sun8i_ce_hash_run()
| * 5dea6398f2 x86/idle: Remove MFENCEs for X86_BUG_CLFLUSH_MONITOR in mwait_idle_with_hints() and prefer_mwait_c1_over_halt()
| * cc5cd8a171 tools/x86/kcpuid: Fix error handling
| * e9019e2214 Revert "drm/amd/display: more liberal vmin/vmax update for freesync"
| * 9f837b359d dt-bindings: phy: imx8mq-usb: fix fsl,phy-tx-vboost-level-microvolt property
| * 68c5042437 dt-bindings: usb: cypress,hx3: Add support for all variants
| * 5a057f2615 thunderbolt: Do not double dequeue a configuration request
| * 259e4d6e10 usb: usbtmc: Fix timeout value in get_stb
| * 3258d7ff8e serial: jsm: fix NPE during jsm_uart_port_init
| * e2e38c5211 Bluetooth: hci_qca: move the SoC type check to the right place
| * b63f23fb0a usb: typec: ucsi: fix Clang -Wsign-conversion warning
| * 5ec1200da9 USB: serial: pl2303: add new chip PL2303GC-Q20 and PL2303GT-2AB
| * ff835ab115 usb: storage: Ignore UAS driver for SanDisk 3.2 Gen2 storage device
| * 73c50fa3ff usb: quirks: Add NO_LPM quirk for SanDisk Extreme 55AE
| * 32a5f643ce rtc: Fix offset calculation for .start_secs < 0
| * b836d94be8 rtc: Make rtc_time64_to_tm() support dates before 1970
| * dbd568a305 acpi-cpufreq: Fix nominal_freq units to KHz in get_max_boost_ratio()
| * 39ed85ae48 pinctrl: armada-37xx: set GPIO output value before setting direction
| * 8f0f45a312 pinctrl: armada-37xx: use correct OUTPUT_VAL register for GPIOs > 31
| * 4afa9d57ed tracing: Fix compilation warning on arm32
* | 7ebf0f8ffd Revert "coredump: hand a pidfd to the usermode coredump helper"
* | 53788b53c2 Merge 6.6.93 into android15-6.6-lts
|\|
| * c2603c511f Linux 6.6.93
| * c78abb646f ksmbd: use list_first_entry_or_null for opinfo_get_list()
| * 106451492d net: ethernet: ti: am65-cpsw: Lower random mac address error print to info
| * 513b27dbd1 platform/x86: thinkpad_acpi: Ignore battery threshold change event notification
| * 871e44494f platform/x86: fujitsu-laptop: Support Lifebook S2110 hotkeys
| * af7243148f NFS: Avoid flushing data while holding directory locks in nfs_rename()
| * f83097445b nvme-pci: add NVME_QUIRK_NO_DEEPEST_PS quirk for SOLIDIGM P44 Pro
| * e99de95033 spi: spi-sun4i: fix early activation
| * b8435b7697 phy: starfive: jh7110-usb: Fix USB 2.0 host occasional detection failure
| * eae121397e drm/amd/display: fix link_set_dpms_off multi-display MST corner case
| * 4728d56dc5 um: let 'make clean' properly clean underlying SUBARCH as well
| * af288d8e14 platform/x86: thinkpad_acpi: Support also NEC Lavie X1475JAS
| * 764f8cd8aa nfs: don't share pNFS DS connections between net namespaces
| * 98f7c351a1 HID: quirks: Add ADATA XPG alpha wireless mouse support
| * 46a6ce4812 dmaengine: idxd: cdev: Fix uninitialized use of sva in idxd_cdev_open
| * cdb61a705f coredump: hand a pidfd to the usermode coredump helper
| * 1846a7b92b coredump: fix error handling for replace_fd()
| * 0ec1e98bf5 perf/arm-cmn: Initialise cmn->cpu earlier
| * 10778e2f49 perf/arm-cmn: Fix REQ2/SNP2 mixup
| * 295f7c579b net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
| * ee1209b9f5 arm64: dts: ti: k3-am68-sk: Fix regulator hierarchy
| * cf27046208 arm64: dts: qcom: sm8550: Add missing properties for cryptobam
| * feadf31790 arm64: dts: qcom: sm8450: Add missing properties for cryptobam
| * 5dd982ff67 arm64: dts: qcom: sm8350: Fix typo in pil_camera_mem node
| * abf3ffaeef arm64: dts: qcom: ipq9574: Add missing properties for cryptobam
* | c887c9d4e3 Merge ea61eda1f4 ("af_unix: Fix uninit-value in __unix_walk_scc()") into android15-6.6-lts
|\|
| * ea61eda1f4 af_unix: Fix uninit-value in __unix_walk_scc()
| * ed14f8ae9b af_unix: Fix garbage collection of embryos carrying OOB with SCM_RIGHTS
| * c0c8d419da af_unix: Add dead flag to struct scm_fp_list.
| * a288920ff9 af_unix: Don't access successor in unix_del_edges() during GC.
| * 3600729b7f af_unix: Try not to hold unix_gc_lock during accept().
| * 7b1ffbd3b2 af_unix: Remove lock dance in unix_peek_fds().
| * de7921631f af_unix: Replace garbage collection algorithm.
| * 2c2d0c662d af_unix: Detect dead SCC.
| * 324005012f af_unix: Assign a unique index to SCC.
| * d23802221f af_unix: Avoid Tarjan's algorithm if unnecessary.
| * cdaa3499a8 af_unix: Skip GC if no cycle exists.
| * e0e23fc499 af_unix: Save O(n) setup of Tarjan's algo.
| * 27a07364ce af_unix: Fix up unix_edge.successor for embryo socket.
| * 36f924e4bf af_unix: Save listener for embryo socket.
| * 3ee9b24bd6 af_unix: Detect Strongly Connected Components.
| * 856aacbe2c af_unix: Iterate all vertices by DFS.
| * 494accabb5 af_unix: Bulk update unix_tot_inflight/unix_inflight when queuing skb.
| * d2d9f382e2 af_unix: Link struct unix_edge when queuing skb.
| * 4fc7df1c6d af_unix: Allocate struct unix_edge for each inflight AF_UNIX fd.
| * 9e98ba0c73 af_unix: Allocate struct unix_vertex for each inflight AF_UNIX fd.
| * 8eb55b667a af_unix: Remove CONFIG_UNIX_SCM.
| * c0d56c028d af_unix: Remove io_uring code for GC.
| * 36f1f6ac53 af_unix: Replace BUG_ON() with WARN_ON_ONCE().
| * acc97866c1 af_unix: Try to run GC async.
* ce8bd9ef12 Merge android15-6.6 into android15-6.6-lts
* e6f212b36a Merge android15-6.6 into android15-6.6-lts

Change-Id: Ia4eb4acf771fe16d413346e2510066720e5f4515
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Documentation/ABI/testing/sysfs-devices-system-cpu

@@ -526,6 +526,7 @@ What:		/sys/devices/system/cpu/vulnerabilities
 		/sys/devices/system/cpu/vulnerabilities/spectre_v1
 		/sys/devices/system/cpu/vulnerabilities/spectre_v2
 		/sys/devices/system/cpu/vulnerabilities/srbds
+		/sys/devices/system/cpu/vulnerabilities/tsa
 		/sys/devices/system/cpu/vulnerabilities/tsx_async_abort
 Date:		January 2018
 Contact:	Linux kernel mailing list <linux-kernel@vger.kernel.org>

Documentation/ABI/testing/sysfs-driver-ufs

@@ -711,7 +711,7 @@ Description:	This file shows the thin provisioning type. This is one of
 
 		The file is read only.
 
-What:		/sys/class/scsi_device/*/device/unit_descriptor/physical_memory_resourse_count
+What:		/sys/class/scsi_device/*/device/unit_descriptor/physical_memory_resource_count
 Date:		February 2018
 Contact:	Stanislav Nijnikov <stanislav.nijnikov@wdc.com>
 Description:	This file shows the total physical memory resources. This is

Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst

@@ -157,9 +157,7 @@ This is achieved by using the otherwise unused and obsolete VERW instruction in
 combination with a microcode update. The microcode clears the affected CPU
 buffers when the VERW instruction is executed.
 
-Kernel reuses the MDS function to invoke the buffer clearing:
+Kernel does the buffer clearing with x86_clear_cpu_buffers().
-
-	mds_clear_cpu_buffers()
 
 On MDS affected CPUs, the kernel already invokes CPU buffer clear on
 kernel/userspace, hypervisor/guest and C-state (idle) transitions. No

Documentation/admin-guide/kernel-parameters.txt

@@ -6044,8 +6044,6 @@
 
 			Selecting 'on' will also enable the mitigation
 			against user space to user space task attacks.
-			Selecting specific mitigation does not force enable
-			user mitigations.
 
 			Selecting 'off' will disable both the kernel and
 			the user space protections.
@@ -6722,6 +6720,19 @@
 			If not specified, "default" is used. In this case,
 			the RNG's choice is left to each individual trust source.
 
+	tsa=		[X86] Control mitigation for Transient Scheduler
+			Attacks on AMD CPUs. Search the following in your
+			favourite search engine for more details:
+
+			"Technical guidance for mitigating transient scheduler
+			attacks".
+
+			off		- disable the mitigation
+			on		- enable the mitigation (default)
+			user		- mitigate only user/kernel transitions
+			vm		- mitigate only guest/host transitions
+
+
 	tsc=		Disable clocksource stability checks for TSC.
 			Format: <string>
 			[x86] reliable: mark tsc clocksource as reliable, this

Documentation/arch/x86/mds.rst

@@ -93,7 +93,7 @@ enters a C-state.
 
 The kernel provides a function to invoke the buffer clearing:
 
-    mds_clear_cpu_buffers()
+    x86_clear_cpu_buffers()
 
 Also macro CLEAR_CPU_BUFFERS can be used in ASM late in exit-to-user path.
 Other than CFLAGS.ZF, this macro doesn't clobber any registers.
@@ -185,9 +185,9 @@ Mitigation points
    idle clearing would be a window dressing exercise and is therefore not
    activated.
 
-   The invocation is controlled by the static key mds_idle_clear which is
+   The invocation is controlled by the static key cpu_buf_idle_clear which is
-   switched depending on the chosen mitigation mode and the SMT state of
+   switched depending on the chosen mitigation mode and the SMT state of the
-   the system.
+   system.
 
    The buffer clear is only invoked before entering the C-State to prevent
    that stale data from the idling CPU from spilling to the Hyper-Thread

Documentation/core-api/symbol-namespaces.rst

@@ -28,6 +28,9 @@ kernel. As of today, modules that make use of symbols exported into namespaces,
 are required to import the namespace. Otherwise the kernel will, depending on
 its configuration, reject loading the module or warn about a missing import.
 
+Additionally, it is possible to put symbols into a module namespace, strictly
+limiting which modules are allowed to use these symbols.
+
 2. How to define Symbol Namespaces
 ==================================
 
@@ -84,6 +87,22 @@ unit as preprocessor statement. The above example would then read::
 within the corresponding compilation unit before any EXPORT_SYMBOL macro is
 used.
 
+2.3 Using the EXPORT_SYMBOL_GPL_FOR_MODULES() macro
+===================================================
+
+Symbols exported using this macro are put into a module namespace. This
+namespace cannot be imported.
+
+The macro takes a comma separated list of module names, allowing only those
+modules to access this symbol. Simple tail-globs are supported.
+
+For example:
+
+  EXPORT_SYMBOL_GPL_FOR_MODULES(preempt_notifier_inc, "kvm,kvm-*")
+
+will limit usage of this symbol to modules whoes name matches the given
+patterns.
+
 3. How to use Symbols exported in Namespaces
 ============================================
 
@@ -155,3 +174,6 @@ in-tree modules::
 You can also run nsdeps for external module builds. A typical usage is::
 
 	$ make -C <path_to_kernel_src> M=$PWD nsdeps
+
+Note: it will happily generate an import statement for the module namespace;
+which will not work and generates build and runtime failures.

Documentation/devicetree/bindings/i2c/nvidia,tegra20-i2c.yaml

@@ -103,7 +103,10 @@ properties:
 
   resets:
     items:
-      - description: module reset
+      - description:
+          Module reset. This property is optional for controllers in Tegra194,
+          Tegra234 etc where an internal software reset is available as an
+          alternative.
 
   reset-names:
     items:
@@ -119,6 +122,13 @@ properties:
       - const: rx
       - const: tx
 
+required:
+  - compatible
+  - reg
+  - interrupts
+  - clocks
+  - clock-names
+
 allOf:
   - $ref: /schemas/i2c/i2c-controller.yaml
   - if:
@@ -172,6 +182,18 @@ allOf:
           items:
             - description: phandle to the VENC power domain
 
+  - if:
+      not:
+        properties:
+          compatible:
+            contains:
+              enum:
+                - nvidia,tegra194-i2c
+    then:
+      required:
+        - resets
+        - reset-names
+
 unevaluatedProperties: false
 
 examples:

Documentation/devicetree/bindings/phy/fsl,imx8mq-usb-phy.yaml

@@ -58,8 +58,7 @@ properties:
   fsl,phy-tx-vboost-level-microvolt:
     description:
       Adjust the boosted transmit launch pk-pk differential amplitude
-    minimum: 880
+    enum: [844, 1008, 1156]
-    maximum: 1120
 
   fsl,phy-comp-dis-tune-percent:
     description:

Documentation/devicetree/bindings/regulator/mediatek,mt6357-regulator.yaml

@@ -33,7 +33,7 @@ patternProperties:
 
   "^ldo-v(camio18|aud28|aux18|io18|io28|rf12|rf18|cn18|cn28|fe28)$":
     type: object
-    $ref: fixed-regulator.yaml#
+    $ref: regulator.yaml#
     unevaluatedProperties: false
     description:
       Properties for single fixed LDO regulator.
@@ -112,7 +112,6 @@ examples:
           regulator-enable-ramp-delay = <220>;
         };
         mt6357_vfe28_reg: ldo-vfe28 {
-          compatible = "regulator-fixed";
           regulator-name = "vfe28";
           regulator-min-microvolt = <2800000>;
           regulator-max-microvolt = <2800000>;
@@ -125,14 +124,12 @@ examples:
           regulator-enable-ramp-delay = <110>;
         };
         mt6357_vrf18_reg: ldo-vrf18 {
-          compatible = "regulator-fixed";
           regulator-name = "vrf18";
           regulator-min-microvolt = <1800000>;
           regulator-max-microvolt = <1800000>;
           regulator-enable-ramp-delay = <110>;
         };
         mt6357_vrf12_reg: ldo-vrf12 {
-          compatible = "regulator-fixed";
           regulator-name = "vrf12";
           regulator-min-microvolt = <1200000>;
           regulator-max-microvolt = <1200000>;
@@ -157,14 +154,12 @@ examples:
           regulator-enable-ramp-delay = <264>;
         };
         mt6357_vcn28_reg: ldo-vcn28 {
-          compatible = "regulator-fixed";
           regulator-name = "vcn28";
           regulator-min-microvolt = <2800000>;
           regulator-max-microvolt = <2800000>;
           regulator-enable-ramp-delay = <264>;
         };
         mt6357_vcn18_reg: ldo-vcn18 {
-          compatible = "regulator-fixed";
           regulator-name = "vcn18";
           regulator-min-microvolt = <1800000>;
           regulator-max-microvolt = <1800000>;
@@ -183,7 +178,6 @@ examples:
           regulator-enable-ramp-delay = <264>;
         };
         mt6357_vcamio_reg: ldo-vcamio18 {
-          compatible = "regulator-fixed";
           regulator-name = "vcamio";
           regulator-min-microvolt = <1800000>;
           regulator-max-microvolt = <1800000>;
@@ -212,28 +206,24 @@ examples:
           regulator-always-on;
         };
         mt6357_vaux18_reg: ldo-vaux18 {
-          compatible = "regulator-fixed";
           regulator-name = "vaux18";
           regulator-min-microvolt = <1800000>;
           regulator-max-microvolt = <1800000>;
           regulator-enable-ramp-delay = <264>;
         };
         mt6357_vaud28_reg: ldo-vaud28 {
-          compatible = "regulator-fixed";
           regulator-name = "vaud28";
           regulator-min-microvolt = <2800000>;
           regulator-max-microvolt = <2800000>;
           regulator-enable-ramp-delay = <264>;
         };
         mt6357_vio28_reg: ldo-vio28 {
-          compatible = "regulator-fixed";
           regulator-name = "vio28";
           regulator-min-microvolt = <2800000>;
           regulator-max-microvolt = <2800000>;
           regulator-enable-ramp-delay = <264>;
         };
         mt6357_vio18_reg: ldo-vio18 {
-          compatible = "regulator-fixed";
           regulator-name = "vio18";
           regulator-min-microvolt = <1800000>;
           regulator-max-microvolt = <1800000>;

Documentation/devicetree/bindings/serial/8250.yaml

@@ -45,7 +45,7 @@ allOf:
                   - ns16550
                   - ns16550a
     then:
-      anyOf:
+      oneOf:
         - required: [ clock-frequency ]
         - required: [ clocks ]
 

Documentation/devicetree/bindings/usb/cypress,hx3.yaml

@@ -14,9 +14,22 @@ allOf:
 
 properties:
   compatible:
-    enum:
+    oneOf:
+      - enum:
           - usb4b4,6504
           - usb4b4,6506
+      - items:
+          - enum:
+              - usb4b4,6500
+              - usb4b4,6508
+          - const: usb4b4,6504
+      - items:
+          - enum:
+              - usb4b4,6502
+              - usb4b4,6503
+              - usb4b4,6507
+              - usb4b4,650a
+          - const: usb4b4,6506
 
   reg: true
 

Documentation/devicetree/bindings/vendor-prefixes.yaml

@@ -773,6 +773,8 @@ patternProperties:
     description: Linux-specific binding
   "^linx,.*":
     description: Linx Technologies
+  "^liontron,.*":
+    description: Shenzhen Liontron Technology Co., Ltd
   "^liteon,.*":
     description: LITE-ON Technology Corp.
   "^litex,.*":

Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 6
 PATCHLEVEL = 6
-SUBLEVEL = 92
+SUBLEVEL = 98
 EXTRAVERSION =
 NAME = Pinguïn Aangedreven
 

android/abi_gki_aarch64_db845c

@@ -153,6 +153,7 @@
   __devm_regmap_init_i2c
   __devm_regmap_init_mmio_clk
   devm_regulator_bulk_get
+  devm_regulator_bulk_get_enable
   devm_regulator_get
   devm_regulator_get_optional
   devm_regulator_register
@@ -269,6 +270,7 @@
   flush_work
   __flush_workqueue
   fortify_panic
+  fput
   free_io_pgtable_ops
   free_irq
   fwnode_handle_put

arch/arm/boot/dts/microchip/at91sam9263ek.dts

@@ -152,7 +152,7 @@
 				nand@3 {
 					reg = <0x3 0x0 0x800000>;
 					rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>;
-					cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>;
+					cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>;
 					nand-bus-width = <8>;
 					nand-ecc-mode = "soft";
 					nand-on-flash-bbt;

arch/arm/boot/dts/microchip/tny_a9263.dts

@@ -64,7 +64,7 @@
 				nand@3 {
 					reg = <0x3 0x0 0x800000>;
 					rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>;
-					cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>;
+					cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>;
 					nand-bus-width = <8>;
 					nand-ecc-mode = "soft";
 					nand-on-flash-bbt;

arch/arm/boot/dts/microchip/usb_a9263.dts

@@ -58,7 +58,7 @@
 			};
 
 			spi0: spi@fffa4000 {
-				cs-gpios = <&pioB 15 GPIO_ACTIVE_HIGH>;
+				cs-gpios = <&pioA 5 GPIO_ACTIVE_LOW>;
 				status = "okay";
 				flash@0 {
 					compatible = "atmel,at45", "atmel,dataflash";
@@ -84,7 +84,7 @@
 				nand@3 {
 					reg = <0x3 0x0 0x800000>;
 					rb-gpios = <&pioA 22 GPIO_ACTIVE_HIGH>;
-					cs-gpios = <&pioA 15 GPIO_ACTIVE_HIGH>;
+					cs-gpios = <&pioD 15 GPIO_ACTIVE_HIGH>;
 					nand-bus-width = <8>;
 					nand-ecc-mode = "soft";
 					nand-on-flash-bbt;

arch/arm/boot/dts/qcom/qcom-apq8064.dtsi

@@ -213,12 +213,6 @@
 		};
 	};
 
-	sfpb_mutex: hwmutex {
-		compatible = "qcom,sfpb-mutex";
-		syscon = <&sfpb_wrapper_mutex 0x604 0x4>;
-		#hwlock-cells = <1>;
-	};
-
 	smem {
 		compatible = "qcom,smem";
 		memory-region = <&smem_region>;
@@ -322,9 +316,10 @@
 			pinctrl-0 = <&ps_hold>;
 		};
 
-		sfpb_wrapper_mutex: syscon@1200000 {
+		sfpb_mutex: hwmutex@1200600 {
-			compatible = "syscon";
+			compatible = "qcom,sfpb-mutex";
-			reg = <0x01200000 0x8000>;
+			reg = <0x01200600 0x100>;
+			#hwlock-cells = <1>;
 		};
 
 		intc: interrupt-controller@2000000 {
@@ -343,6 +338,8 @@
 				     <1 3 0x301>;
 			reg = <0x0200a000 0x100>;
 			clock-frequency = <27000000>;
+			clocks = <&sleep_clk>;
+			clock-names = "sleep";
 			cpu-offset = <0x80000>;
 		};
 

arch/arm/boot/dts/ti/omap/am335x-bone-common.dtsi

@@ -385,7 +385,7 @@
 		/* Support GPIO reset on revision C3 boards */
 		reset-gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
 		reset-assert-us = <300>;
-		reset-deassert-us = <6500>;
+		reset-deassert-us = <50000>;
 	};
 };
 

arch/arm/include/asm/ptrace.h

@@ -10,6 +10,7 @@
 #include <uapi/asm/ptrace.h>
 
 #ifndef __ASSEMBLY__
+#include <linux/bitfield.h>
 #include <linux/types.h>
 
 struct pt_regs {
@@ -35,8 +36,8 @@ struct svc_pt_regs {
 
 #ifndef CONFIG_CPU_V7M
 #define isa_mode(regs) \
-	((((regs)->ARM_cpsr & PSR_J_BIT) >> (__ffs(PSR_J_BIT) - 1)) | \
+	(FIELD_GET(PSR_J_BIT, (regs)->ARM_cpsr) << 1 | \
-	 (((regs)->ARM_cpsr & PSR_T_BIT) >> (__ffs(PSR_T_BIT))))
+	 FIELD_GET(PSR_T_BIT, (regs)->ARM_cpsr))
 #else
 #define isa_mode(regs) 1 /* Thumb */
 #endif

arch/arm/mach-aspeed/Kconfig

@@ -2,7 +2,6 @@
 menuconfig ARCH_ASPEED
 	bool "Aspeed BMC architectures"
 	depends on (CPU_LITTLE_ENDIAN && ARCH_MULTI_V5) || ARCH_MULTI_V6 || ARCH_MULTI_V7
-	select SRAM
 	select WATCHDOG
 	select ASPEED_WATCHDOG
 	select MFD_SYSCON

arch/arm/mach-omap2/clockdomain.h

@@ -48,6 +48,7 @@
 #define CLKDM_NO_AUTODEPS			(1 << 4)
 #define CLKDM_ACTIVE_WITH_MPU			(1 << 5)
 #define CLKDM_MISSING_IDLE_REPORTING		(1 << 6)
+#define CLKDM_STANDBY_FORCE_WAKEUP		BIT(7)
 
 #define CLKDM_CAN_HWSUP		(CLKDM_CAN_ENABLE_AUTO | CLKDM_CAN_DISABLE_AUTO)
 #define CLKDM_CAN_SWSUP		(CLKDM_CAN_FORCE_SLEEP | CLKDM_CAN_FORCE_WAKEUP)

arch/arm/mach-omap2/clockdomains33xx_data.c

@@ -19,7 +19,7 @@ static struct clockdomain l4ls_am33xx_clkdm = {
 	.pwrdm		= { .name = "per_pwrdm" },
 	.cm_inst	= AM33XX_CM_PER_MOD,
 	.clkdm_offs	= AM33XX_CM_PER_L4LS_CLKSTCTRL_OFFSET,
-	.flags		= CLKDM_CAN_SWSUP,
+	.flags		= CLKDM_CAN_SWSUP | CLKDM_STANDBY_FORCE_WAKEUP,
 };
 
 static struct clockdomain l3s_am33xx_clkdm = {

arch/arm/mach-omap2/cm33xx.c

@@ -20,6 +20,9 @@
 #include "cm-regbits-34xx.h"
 #include "cm-regbits-33xx.h"
 #include "prm33xx.h"
+#if IS_ENABLED(CONFIG_SUSPEND)
+#include <linux/suspend.h>
+#endif
 
 /*
  * CLKCTRL_IDLEST_*: possible values for the CM_*_CLKCTRL.IDLEST bitfield:
@@ -328,8 +331,17 @@ static int am33xx_clkdm_clk_disable(struct clockdomain *clkdm)
 {
 	bool hwsup = false;
 
+#if IS_ENABLED(CONFIG_SUSPEND)
+	/*
+	 * In case of standby, Don't put the l4ls clk domain to sleep.
+	 * Since CM3 PM FW doesn't wake-up/enable the l4ls clk domain
+	 * upon wake-up, CM3 PM FW fails to wake-up th MPU.
+	 */
+	if (pm_suspend_target_state == PM_SUSPEND_STANDBY &&
+	    (clkdm->flags & CLKDM_STANDBY_FORCE_WAKEUP))
+		return 0;
+#endif
 	hwsup = am33xx_cm_is_clkdm_in_hwsup(clkdm->cm_inst, clkdm->clkdm_offs);
-
 	if (!hwsup && (clkdm->flags & CLKDM_CAN_FORCE_SLEEP))
 		am33xx_clkdm_sleep(clkdm);
 

arch/arm/mach-omap2/pmic-cpcap.c

@@ -264,6 +264,10 @@ int __init omap4_cpcap_init(void)
 
 static int __init cpcap_late_init(void)
 {
+	if (!of_find_compatible_node(NULL, NULL, "motorola,cpcap"))
+		return 0;
+
+	if (soc_is_omap443x() || soc_is_omap446x() || soc_is_omap447x())
 		omap4_vc_set_pmic_signaling(PWRDM_POWER_RET);
 
 	return 0;

arch/arm/mm/ioremap.c

@@ -515,7 +515,5 @@ void __init early_ioremap_init(void)
 bool arch_memremap_can_ram_remap(resource_size_t offset, size_t size,
 				 unsigned long flags)
 {
-	unsigned long pfn = PHYS_PFN(offset);
+	return memblock_is_map_memory(offset);
-
-	return memblock_is_map_memory(pfn);
 }

arch/arm64/Kconfig

@@ -308,9 +308,9 @@ config ARCH_MMAP_RND_BITS_MAX
 	default 24 if ARM64_VA_BITS=39
 	default 27 if ARM64_VA_BITS=42
 	default 30 if ARM64_VA_BITS=47
-	default 29 if ARM64_VA_BITS=48 && ARM64_64K_PAGES
+	default 29 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_64K_PAGES
-	default 31 if ARM64_VA_BITS=48 && ARM64_16K_PAGES
+	default 31 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52) && ARM64_16K_PAGES
-	default 33 if ARM64_VA_BITS=48
+	default 33 if (ARM64_VA_BITS=48 || ARM64_VA_BITS=52)
 	default 14 if ARM64_64K_PAGES
 	default 16 if ARM64_16K_PAGES
 	default 18

arch/arm64/boot/dts/apple/t8103-jxxx.dtsi

@@ -71,7 +71,7 @@
  */
 &port00 {
 	bus-range = <1 1>;
-	wifi0: network@0,0 {
+	wifi0: wifi@0,0 {
 		compatible = "pci14e4,4425";
 		reg = <0x10000 0x0 0x0 0x0 0x0>;
 		/* To be filled by the loader */

arch/arm64/boot/dts/freescale/imx8mm-beacon-kit.dts

@@ -124,6 +124,7 @@
 	assigned-clock-parents = <&clk IMX8MM_AUDIO_PLL1_OUT>;
 	assigned-clock-rates = <24576000>;
 	#sound-dai-cells = <0>;
+	fsl,sai-mclk-direction-output;
 	status = "okay";
 };
 

arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi

@@ -231,6 +231,7 @@
 	rtc: rtc@51 {
 		compatible = "nxp,pcf85263";
 		reg = <0x51>;
+		quartz-load-femtofarads = <12500>;
 	};
 };
 

arch/arm64/boot/dts/freescale/imx8mn-beacon-kit.dts

@@ -126,6 +126,7 @@
 	assigned-clock-parents = <&clk IMX8MN_AUDIO_PLL1_OUT>;
 	assigned-clock-rates = <24576000>;
 	#sound-dai-cells = <0>;
+	fsl,sai-mclk-direction-output;
 	status = "okay";
 };
 

arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi

@@ -240,6 +240,7 @@
 	rtc: rtc@51 {
 		compatible = "nxp,pcf85263";
 		reg = <0x51>;
+		quartz-load-femtofarads = <12500>;
 	};
 };
 

arch/arm64/boot/dts/freescale/imx8mp-beacon-som.dtsi

@@ -192,6 +192,7 @@
 	rtc: rtc@51 {
 		compatible = "nxp,pcf85263";
 		reg = <0x51>;
+		quartz-load-femtofarads = <12500>;
 	};
 };
 

arch/arm64/boot/dts/mediatek/mt6357.dtsi

@@ -60,7 +60,6 @@
 			};
 
 			mt6357_vfe28_reg: ldo-vfe28 {
-				compatible = "regulator-fixed";
 				regulator-name = "vfe28";
 				regulator-min-microvolt = <2800000>;
 				regulator-max-microvolt = <2800000>;
@@ -75,7 +74,6 @@
 			};
 
 			mt6357_vrf18_reg: ldo-vrf18 {
-				compatible = "regulator-fixed";
 				regulator-name = "vrf18";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
@@ -83,7 +81,6 @@
 			};
 
 			mt6357_vrf12_reg: ldo-vrf12 {
-				compatible = "regulator-fixed";
 				regulator-name = "vrf12";
 				regulator-min-microvolt = <1200000>;
 				regulator-max-microvolt = <1200000>;
@@ -112,7 +109,6 @@
 			};
 
 			mt6357_vcn28_reg: ldo-vcn28 {
-				compatible = "regulator-fixed";
 				regulator-name = "vcn28";
 				regulator-min-microvolt = <2800000>;
 				regulator-max-microvolt = <2800000>;
@@ -120,7 +116,6 @@
 			};
 
 			mt6357_vcn18_reg: ldo-vcn18 {
-				compatible = "regulator-fixed";
 				regulator-name = "vcn18";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
@@ -142,7 +137,6 @@
 			};
 
 			mt6357_vcamio_reg: ldo-vcamio18 {
-				compatible = "regulator-fixed";
 				regulator-name = "vcamio";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
@@ -175,7 +169,6 @@
 			};
 
 			mt6357_vaux18_reg: ldo-vaux18 {
-				compatible = "regulator-fixed";
 				regulator-name = "vaux18";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;
@@ -183,7 +176,6 @@
 			};
 
 			mt6357_vaud28_reg: ldo-vaud28 {
-				compatible = "regulator-fixed";
 				regulator-name = "vaud28";
 				regulator-min-microvolt = <2800000>;
 				regulator-max-microvolt = <2800000>;
@@ -191,7 +183,6 @@
 			};
 
 			mt6357_vio28_reg: ldo-vio28 {
-				compatible = "regulator-fixed";
 				regulator-name = "vio28";
 				regulator-min-microvolt = <2800000>;
 				regulator-max-microvolt = <2800000>;
@@ -199,7 +190,6 @@
 			};
 
 			mt6357_vio18_reg: ldo-vio18 {
-				compatible = "regulator-fixed";
 				regulator-name = "vio18";
 				regulator-min-microvolt = <1800000>;
 				regulator-max-microvolt = <1800000>;

arch/arm64/boot/dts/mediatek/mt6359.dtsi

@@ -18,6 +18,8 @@
 		};
 
 		regulators {
+			compatible = "mediatek,mt6359-regulator";
+
 			mt6359_vs1_buck_reg: buck_vs1 {
 				regulator-name = "vs1";
 				regulator-min-microvolt = <800000>;
@@ -296,7 +298,7 @@
 			};
 		};
 
-		mt6359rtc: mt6359rtc {
+		mt6359rtc: rtc {
 			compatible = "mediatek,mt6358-rtc";
 		};
 	};

arch/arm64/boot/dts/mediatek/mt8195.dtsi

@@ -617,22 +617,6 @@
 					#size-cells = <0>;
 					#power-domain-cells = <1>;
 
-					power-domain@MT8195_POWER_DOMAIN_VDEC1 {
-						reg = <MT8195_POWER_DOMAIN_VDEC1>;
-						clocks = <&vdecsys CLK_VDEC_LARB1>;
-						clock-names = "vdec1-0";
-						mediatek,infracfg = <&infracfg_ao>;
-						#power-domain-cells = <0>;
-					};
-
-					power-domain@MT8195_POWER_DOMAIN_VENC_CORE1 {
-						reg = <MT8195_POWER_DOMAIN_VENC_CORE1>;
-						clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>;
-						clock-names = "venc1-larb";
-						mediatek,infracfg = <&infracfg_ao>;
-						#power-domain-cells = <0>;
-					};
-
 					power-domain@MT8195_POWER_DOMAIN_VDOSYS0 {
 						reg = <MT8195_POWER_DOMAIN_VDOSYS0>;
 						clocks = <&topckgen CLK_TOP_CFG_VDO0>,
@@ -678,6 +662,15 @@
 							clocks = <&vdecsys_soc CLK_VDEC_SOC_LARB1>;
 							clock-names = "vdec0-0";
 							mediatek,infracfg = <&infracfg_ao>;
+							#address-cells = <1>;
+							#size-cells = <0>;
+							#power-domain-cells = <0>;
+
+							power-domain@MT8195_POWER_DOMAIN_VDEC1 {
+								reg = <MT8195_POWER_DOMAIN_VDEC1>;
+								clocks = <&vdecsys CLK_VDEC_LARB1>;
+								clock-names = "vdec1-0";
+								mediatek,infracfg = <&infracfg_ao>;
 								#power-domain-cells = <0>;
 							};
 
@@ -688,13 +681,24 @@
 								mediatek,infracfg = <&infracfg_ao>;
 								#power-domain-cells = <0>;
 							};
+						};
 
 						power-domain@MT8195_POWER_DOMAIN_VENC {
 							reg = <MT8195_POWER_DOMAIN_VENC>;
 							clocks = <&vencsys CLK_VENC_LARB>;
 							clock-names = "venc0-larb";
 							mediatek,infracfg = <&infracfg_ao>;
+							#address-cells = <1>;
+							#size-cells = <0>;
 							#power-domain-cells = <0>;
+
+							power-domain@MT8195_POWER_DOMAIN_VENC_CORE1 {
+								reg = <MT8195_POWER_DOMAIN_VENC_CORE1>;
+								clocks = <&vencsys_core1 CLK_VENC_CORE1_LARB>;
+								clock-names = "venc1-larb";
+								mediatek,infracfg = <&infracfg_ao>;
+								#power-domain-cells = <0>;
+							};
 						};
 
 						power-domain@MT8195_POWER_DOMAIN_VDOSYS1 {

arch/arm64/boot/dts/nvidia/tegra186.dtsi

@@ -621,9 +621,7 @@
 		reg-shift = <2>;
 		interrupts = <GIC_SPI 113 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&bpmp TEGRA186_CLK_UARTB>;
-		clock-names = "serial";
 		resets = <&bpmp TEGRA186_RESET_UARTB>;
-		reset-names = "serial";
 		status = "disabled";
 	};
 
@@ -633,9 +631,7 @@
 		reg-shift = <2>;
 		interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&bpmp TEGRA186_CLK_UARTD>;
-		clock-names = "serial";
 		resets = <&bpmp TEGRA186_RESET_UARTD>;
-		reset-names = "serial";
 		status = "disabled";
 	};
 
@@ -645,9 +641,7 @@
 		reg-shift = <2>;
 		interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&bpmp TEGRA186_CLK_UARTE>;
-		clock-names = "serial";
 		resets = <&bpmp TEGRA186_RESET_UARTE>;
-		reset-names = "serial";
 		status = "disabled";
 	};
 
@@ -657,9 +651,7 @@
 		reg-shift = <2>;
 		interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&bpmp TEGRA186_CLK_UARTF>;
-		clock-names = "serial";
 		resets = <&bpmp TEGRA186_RESET_UARTF>;
-		reset-names = "serial";
 		status = "disabled";
 	};
 
@@ -1236,9 +1228,7 @@
 		reg-shift = <2>;
 		interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&bpmp TEGRA186_CLK_UARTC>;
-		clock-names = "serial";
 		resets = <&bpmp TEGRA186_RESET_UARTC>;
-		reset-names = "serial";
 		status = "disabled";
 	};
 
@@ -1248,9 +1238,7 @@
 		reg-shift = <2>;
 		interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
 		clocks = <&bpmp TEGRA186_CLK_UARTG>;
-		clock-names = "serial";
 		resets = <&bpmp TEGRA186_RESET_UARTG>;
-		reset-names = "serial";
 		status = "disabled";
 	};
 

arch/arm64/boot/dts/nvidia/tegra194.dtsi

@@ -766,9 +766,7 @@
 			reg-shift = <2>;
 			interrupts = <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&bpmp TEGRA194_CLK_UARTD>;
-			clock-names = "serial";
 			resets = <&bpmp TEGRA194_RESET_UARTD>;
-			reset-names = "serial";
 			status = "disabled";
 		};
 
@@ -778,9 +776,7 @@
 			reg-shift = <2>;
 			interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&bpmp TEGRA194_CLK_UARTE>;
-			clock-names = "serial";
 			resets = <&bpmp TEGRA194_RESET_UARTE>;
-			reset-names = "serial";
 			status = "disabled";
 		};
 
@@ -790,9 +786,7 @@
 			reg-shift = <2>;
 			interrupts = <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&bpmp TEGRA194_CLK_UARTF>;
-			clock-names = "serial";
 			resets = <&bpmp TEGRA194_RESET_UARTF>;
-			reset-names = "serial";
 			status = "disabled";
 		};
 
@@ -817,9 +811,7 @@
 			reg-shift = <2>;
 			interrupts = <GIC_SPI 207 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&bpmp TEGRA194_CLK_UARTH>;
-			clock-names = "serial";
 			resets = <&bpmp TEGRA194_RESET_UARTH>;
-			reset-names = "serial";
 			status = "disabled";
 		};
 
@@ -1616,9 +1608,7 @@
 			reg-shift = <2>;
 			interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&bpmp TEGRA194_CLK_UARTC>;
-			clock-names = "serial";
 			resets = <&bpmp TEGRA194_RESET_UARTC>;
-			reset-names = "serial";
 			status = "disabled";
 		};
 
@@ -1628,9 +1618,7 @@
 			reg-shift = <2>;
 			interrupts = <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&bpmp TEGRA194_CLK_UARTG>;
-			clock-names = "serial";
 			resets = <&bpmp TEGRA194_RESET_UARTG>;
-			reset-names = "serial";
 			status = "disabled";
 		};
 

arch/arm64/boot/dts/qcom/ipq9574.dtsi

@@ -231,6 +231,8 @@
 			interrupts = <GIC_SPI 207 IRQ_TYPE_LEVEL_HIGH>;
 			#dma-cells = <1>;
 			qcom,ee = <1>;
+			qcom,num-ees = <4>;
+			num-channels = <16>;
 			qcom,controlled-remotely;
 		};
 

arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts

@@ -985,9 +985,6 @@
 		"VA DMIC0", "MIC BIAS1",
 		"VA DMIC1", "MIC BIAS1",
 		"VA DMIC2", "MIC BIAS3",
-		"VA DMIC0", "VA MIC BIAS1",
-		"VA DMIC1", "VA MIC BIAS1",
-		"VA DMIC2", "VA MIC BIAS3",
 		"TX SWR_ADC1", "ADC2_OUTPUT";
 
 	wcd-playback-dai-link {

arch/arm64/boot/dts/qcom/sda660-inforce-ifc6560.dts

@@ -155,6 +155,7 @@
 	 * BAM DMA interconnects support is in place.
 	 */
 	/delete-property/ clocks;
+	/delete-property/ clock-names;
 };
 
 &blsp1_uart2 {
@@ -167,6 +168,7 @@
 	 * BAM DMA interconnects support is in place.
 	 */
 	/delete-property/ clocks;
+	/delete-property/ clock-names;
 };
 
 &blsp2_uart1 {

arch/arm64/boot/dts/qcom/sdm660-xiaomi-lavender.dts

@@ -107,6 +107,7 @@
 	status = "okay";
 
 	vdd-supply = <&vreg_l1b_0p925>;
+	vdda-pll-supply = <&vreg_l10a_1p8>;
 	vdda-phy-dpdm-supply = <&vreg_l7b_3p125>;
 };
 
@@ -404,6 +405,8 @@
 &sdhc_2 {
 	status = "okay";
 
+	cd-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>;
+
 	vmmc-supply = <&vreg_l5b_2p95>;
 	vqmmc-supply = <&vreg_l2b_2p95>;
 };

arch/arm64/boot/dts/qcom/sdm845-samsung-starqltechn.dts

@@ -135,8 +135,6 @@
 		vdda_sp_sensor:
 		vdda_ufs1_core:
 		vdda_ufs2_core:
-		vdda_usb1_ss_core:
-		vdda_usb2_ss_core:
 		vreg_l1a_0p875: ldo1 {
 			regulator-min-microvolt = <880000>;
 			regulator-max-microvolt = <880000>;
@@ -157,6 +155,7 @@
 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
 		};
 
+		vdda_usb1_ss_core:
 		vdd_wcss_cx:
 		vdd_wcss_mx:
 		vdda_wcss_pll:
@@ -383,8 +382,8 @@
 };
 
 &sdhc_2 {
-	pinctrl-names = "default";
 	pinctrl-0 = <&sdc2_clk_state &sdc2_cmd_state &sdc2_data_state &sd_card_det_n_state>;
+	pinctrl-names = "default";
 	cd-gpios = <&tlmm 126 GPIO_ACTIVE_LOW>;
 	vmmc-supply = <&vreg_l21a_2p95>;
 	vqmmc-supply = <&vddpx_2>;
@@ -418,16 +417,9 @@
 	status = "okay";
 };
 
-&wifi {
-	vdd-0.8-cx-mx-supply = <&vreg_l5a_0p8>;
-	vdd-1.8-xo-supply = <&vreg_l7a_1p8>;
-	vdd-1.3-rfa-supply = <&vreg_l17a_1p3>;
-	vdd-3.3-ch0-supply = <&vreg_l25a_3p3>;
-	status = "okay";
-};
-
 &tlmm {
-	gpio-reserved-ranges = <0 4>, <27 4>, <81 4>, <85 4>;
+	gpio-reserved-ranges = <27 4>, /* SPI (eSE - embedded Secure Element) */
+			       <85 4>; /* SPI (fingerprint reader) */
 
 	sdc2_clk_state: sdc2-clk-state {
 		pins = "sdc2_clk";

arch/arm64/boot/dts/qcom/sm8250.dtsi

@@ -601,7 +601,7 @@
 		};
 
 		cpu7_opp9: opp-1747200000 {
-			opp-hz = /bits/ 64 <1708800000>;
+			opp-hz = /bits/ 64 <1747200000>;
 			opp-peak-kBps = <5412000 42393600>;
 		};
 

arch/arm64/boot/dts/qcom/sm8350.dtsi

@@ -442,7 +442,7 @@
 			no-map;
 		};
 
-		pil_camera_mem: mmeory@85200000 {
+		pil_camera_mem: memory@85200000 {
 			reg = <0x0 0x85200000 0x0 0x500000>;
 			no-map;
 		};
@@ -1754,11 +1754,11 @@
 			interrupts = <GIC_SPI 272 IRQ_TYPE_LEVEL_HIGH>;
 			#dma-cells = <1>;
 			qcom,ee = <0>;
+			qcom,num-ees = <4>;
+			num-channels = <16>;
 			qcom,controlled-remotely;
 			iommus = <&apps_smmu 0x594 0x0011>,
 				 <&apps_smmu 0x596 0x0011>;
-			/* FIXME: Probing BAM DMA causes some abort and system hang */
-			status = "fail";
 		};
 
 		crypto: crypto@1dfa000 {
@@ -1770,8 +1770,6 @@
 				 <&apps_smmu 0x596 0x0011>;
 			interconnects = <&aggre2_noc MASTER_CRYPTO 0 &mc_virt SLAVE_EBI1 0>;
 			interconnect-names = "memory";
-			/* FIXME: dependency BAM DMA is disabled */
-			status = "disabled";
 		};
 
 		ipa: ipa@1e40000 {

arch/arm64/boot/dts/qcom/sm8450.dtsi

@@ -4233,6 +4233,8 @@
 			interrupts = <GIC_SPI 272 IRQ_TYPE_LEVEL_HIGH>;
 			#dma-cells = <1>;
 			qcom,ee = <0>;
+			qcom,num-ees = <4>;
+			num-channels = <16>;
 			qcom,controlled-remotely;
 			iommus = <&apps_smmu 0x584 0x11>,
 				 <&apps_smmu 0x588 0x0>,

arch/arm64/boot/dts/qcom/sm8550.dtsi

@@ -1064,6 +1064,20 @@
 				status = "disabled";
 			};
 
+			uart14: serial@898000 {
+				compatible = "qcom,geni-uart";
+				reg = <0 0x898000 0 0x4000>;
+				clock-names = "se";
+				clocks = <&gcc GCC_QUPV3_WRAP2_S6_CLK>;
+				pinctrl-names = "default";
+				pinctrl-0 = <&qup_uart14_default>, <&qup_uart14_cts_rts>;
+				interrupts = <GIC_SPI 461 IRQ_TYPE_LEVEL_HIGH>;
+				interconnects = <&clk_virt MASTER_QUP_CORE_2 0 &clk_virt SLAVE_QUP_CORE_2 0>,
+						<&gem_noc MASTER_APPSS_PROC 0 &config_noc SLAVE_QUP_2 0>;
+				interconnect-names = "qup-core", "qup-config";
+				status = "disabled";
+			};
+
 			i2c15: i2c@89c000 {
 				compatible = "qcom,geni-i2c";
 				reg = <0 0x0089c000 0 0x4000>;
@@ -1866,6 +1880,8 @@
 			interrupts = <GIC_SPI 272 IRQ_TYPE_LEVEL_HIGH>;
 			#dma-cells = <1>;
 			qcom,ee = <0>;
+			qcom,num-ees = <4>;
+			num-channels = <20>;
 			qcom,controlled-remotely;
 			iommus = <&apps_smmu 0x480 0x0>,
 				 <&apps_smmu 0x481 0x0>;
@@ -3638,6 +3654,22 @@
 				bias-disable;
 			};
 
+			qup_uart14_default: qup-uart14-default-state {
+				/* TX, RX */
+				pins = "gpio78", "gpio79";
+				function = "qup2_se6";
+				drive-strength = <2>;
+				bias-pull-up;
+			};
+
+			qup_uart14_cts_rts: qup-uart14-cts-rts-state {
+				/* CTS, RTS */
+				pins = "gpio76", "gpio77";
+				function = "qup2_se6";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+
 			sdc2_sleep: sdc2-sleep-state {
 				clk-pins {
 					pins = "sdc2_clk";

arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-ard-audio-da7212.dtso

@@ -108,7 +108,7 @@
 	};
 
 	tpu0_pins: tpu0 {
-		groups = "tpu_to0_a";
+		groups = "tpu_to0_b";
 		function = "tpu";
 	};
 };

arch/arm64/boot/dts/rockchip/rk3399-puma-haikou.dts

@@ -251,14 +251,6 @@
 	status = "okay";
 };
 
-&usb_host0_ehci {
-	status = "okay";
-};
-
-&usb_host0_ohci {
-	status = "okay";
-};
-
 &vopb {
 	status = "okay";
 };

arch/arm64/boot/dts/rockchip/rk3568-nanopi-r5s.dtsi

@@ -486,9 +486,12 @@
 &sdhci {
 	bus-width = <8>;
 	max-frequency = <200000000>;
+	mmc-hs200-1_8v;
 	non-removable;
 	pinctrl-names = "default";
-	pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd>;
+	pinctrl-0 = <&emmc_bus8 &emmc_clk &emmc_cmd &emmc_datastrobe>;
+	vmmc-supply = <&vcc_3v3>;
+	vqmmc-supply = <&vcc_1v8>;
 	status = "okay";
 };
 

arch/arm64/boot/dts/ti/k3-am65-main.dtsi

@@ -436,6 +436,8 @@
 		interrupts = <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
 		mmc-ddr-1_8v;
 		mmc-hs200-1_8v;
+		ti,clkbuf-sel = <0x7>;
+		ti,trm-icp = <0x8>;
 		ti,otap-del-sel-legacy = <0x0>;
 		ti,otap-del-sel-mmc-hs = <0x0>;
 		ti,otap-del-sel-sd-hs = <0x0>;
@@ -446,8 +448,9 @@
 		ti,otap-del-sel-ddr50 = <0x5>;
 		ti,otap-del-sel-ddr52 = <0x5>;
 		ti,otap-del-sel-hs200 = <0x5>;
-		ti,otap-del-sel-hs400 = <0x0>;
+		ti,itap-del-sel-legacy = <0xa>;
-		ti,trm-icp = <0x8>;
+		ti,itap-del-sel-mmc-hs = <0x1>;
+		ti,itap-del-sel-ddr52 = <0x0>;
 		dma-coherent;
 	};
 
@@ -458,18 +461,22 @@
 		clocks = <&k3_clks 48 0>, <&k3_clks 48 1>;
 		clock-names = "clk_ahb", "clk_xin";
 		interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+		ti,clkbuf-sel = <0x7>;
+		ti,trm-icp = <0x8>;
 		ti,otap-del-sel-legacy = <0x0>;
 		ti,otap-del-sel-mmc-hs = <0x0>;
 		ti,otap-del-sel-sd-hs = <0x0>;
-		ti,otap-del-sel-sdr12 = <0x0>;
+		ti,otap-del-sel-sdr12 = <0xf>;
-		ti,otap-del-sel-sdr25 = <0x0>;
+		ti,otap-del-sel-sdr25 = <0xf>;
 		ti,otap-del-sel-sdr50 = <0x8>;
 		ti,otap-del-sel-sdr104 = <0x7>;
 		ti,otap-del-sel-ddr50 = <0x4>;
 		ti,otap-del-sel-ddr52 = <0x4>;
 		ti,otap-del-sel-hs200 = <0x7>;
-		ti,clkbuf-sel = <0x7>;
+		ti,itap-del-sel-legacy = <0xa>;
-		ti,trm-icp = <0x8>;
+		ti,itap-del-sel-sd-hs = <0x1>;
+		ti,itap-del-sel-sdr12 = <0xa>;
+		ti,itap-del-sel-sdr25 = <0x1>;
 		dma-coherent;
 	};
 

arch/arm64/boot/dts/ti/k3-am68-sk-base-board.dts

@@ -43,6 +43,17 @@
 		regulator-boot-on;
 	};
 
+	vsys_5v0: regulator-vsys5v0 {
+		/* Output of LM61460 */
+		compatible = "regulator-fixed";
+		regulator-name = "vsys_5v0";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		vin-supply = <&vusb_main>;
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
 	vsys_3v3: regulator-vsys3v3 {
 		/* Output of LM5141 */
 		compatible = "regulator-fixed";
@@ -75,7 +86,7 @@
 		regulator-min-microvolt = <1800000>;
 		regulator-max-microvolt = <3300000>;
 		regulator-boot-on;
-		vin-supply = <&vsys_3v3>;
+		vin-supply = <&vsys_5v0>;
 		gpios = <&main_gpio0 49 GPIO_ACTIVE_HIGH>;
 		states = <1800000 0x0>,
 			 <3300000 0x1>;

arch/arm64/boot/dts/ti/k3-j721e-common-proc-board.dts

@@ -557,6 +557,7 @@
 &ospi1 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&mcu_fss0_ospi1_pins_default>;
+	status = "okay";
 
 	flash@0 {
 		compatible = "jedec,spi-nor";

arch/arm64/boot/dts/ti/k3-j721e-sk.dts

@@ -183,6 +183,17 @@
 		regulator-boot-on;
 	};
 
+	vsys_5v0: fixedregulator-vsys5v0 {
+		/* Output of LM61460 */
+		compatible = "regulator-fixed";
+		regulator-name = "vsys_5v0";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		vin-supply = <&vusb_main>;
+		regulator-always-on;
+		regulator-boot-on;
+	};
+
 	vdd_mmc1: fixedregulator-sd {
 		compatible = "regulator-fixed";
 		pinctrl-names = "default";
@@ -210,6 +221,56 @@
 			 <3300000 0x1>;
 	};
 
+	vdd_sd_dv: gpio-regulator-TLV71033 {
+		compatible = "regulator-gpio";
+		pinctrl-names = "default";
+		pinctrl-0 = <&vdd_sd_dv_pins_default>;
+		regulator-name = "tlv71033";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		vin-supply = <&vsys_5v0>;
+		gpios = <&main_gpio0 118 GPIO_ACTIVE_HIGH>;
+		states = <1800000 0x0>,
+			 <3300000 0x1>;
+	};
+
+	transceiver1: can-phy1 {
+		compatible = "ti,tcan1042";
+		#phy-cells = <0>;
+		max-bitrate = <5000000>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&mcu_mcan0_gpio_pins_default>;
+		standby-gpios = <&wkup_gpio0 3 GPIO_ACTIVE_HIGH>;
+	};
+
+	transceiver2: can-phy2 {
+		compatible = "ti,tcan1042";
+		#phy-cells = <0>;
+		max-bitrate = <5000000>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&main_mcan0_gpio_pins_default>;
+		standby-gpios = <&main_gpio0 65 GPIO_ACTIVE_HIGH>;
+	};
+
+	transceiver3: can-phy3 {
+		compatible = "ti,tcan1042";
+		#phy-cells = <0>;
+		max-bitrate = <5000000>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&main_mcan5_gpio_pins_default>;
+		standby-gpios = <&main_gpio0 66 GPIO_ACTIVE_HIGH>;
+	};
+
+	transceiver4: can-phy4 {
+		compatible = "ti,tcan1042";
+		#phy-cells = <0>;
+		max-bitrate = <5000000>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&main_mcan9_gpio_pins_default>;
+		standby-gpios = <&main_gpio0 67 GPIO_ACTIVE_HIGH>;
+	};
+
 	dp_pwr_3v3: fixedregulator-dp-prw {
 		compatible = "regulator-fixed";
 		regulator-name = "dp-pwr";
@@ -286,6 +347,15 @@
 			};
 		};
 	};
+
+	csi_mux: mux-controller {
+		compatible = "gpio-mux";
+		#mux-state-cells = <1>;
+		mux-gpios = <&main_gpio0 88 GPIO_ACTIVE_HIGH>;
+		idle-state = <0>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&main_csi_mux_sel_pins_default>;
+	};
 };
 
 &main_pmx0 {
@@ -352,6 +422,51 @@
 		>;
 	};
 
+	main_csi_mux_sel_pins_default: main-csi-mux-sel-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x164, PIN_OUTPUT, 7) /* (V29) RGMII5_TD2 */
+		>;
+	};
+
+	main_mcan0_pins_default: main-mcan0-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x208, PIN_INPUT, 0) /* (W5) MCAN0_RX */
+			J721E_IOPAD(0x20c, PIN_OUTPUT, 0) /* (W6) MCAN0_TX */
+		>;
+	};
+
+	main_mcan0_gpio_pins_default: main-mcan0-gpio-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x108, PIN_INPUT, 7) /* (AD27) PRG0_PRU1_GPO2.GPIO0_65 */
+		>;
+	};
+
+	main_mcan5_pins_default: main-mcan5-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x050, PIN_INPUT, 6) /* (AE21) PRG1_PRU0_GPO18.MCAN5_RX */
+			J721E_IOPAD(0x04c, PIN_OUTPUT, 6) /* (AJ21) PRG1_PRU0_GPO17.MCAN5_TX */
+		>;
+	};
+
+	main_mcan5_gpio_pins_default: main-mcan5-gpio-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x10c, PIN_INPUT, 7) /* (AC25) PRG0_PRU1_GPO3.GPIO0_66 */
+		>;
+	};
+
+	main_mcan9_pins_default: main-mcan9-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x0d0, PIN_INPUT, 6) /* (AC27) PRG0_PRU0_GPO8.MCAN9_RX */
+			J721E_IOPAD(0x0cc, PIN_OUTPUT, 6) /* (AC28) PRG0_PRU0_GPO7.MCAN9_TX */
+		>;
+	};
+
+	main_mcan9_gpio_pins_default: main-mcan9-gpio-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x110, PIN_INPUT, 7) /* (AD29) PRG0_PRU1_GPO4.GPIO0_67 */
+		>;
+	};
+
 	dp0_pins_default: dp0-default-pins {
 		pinctrl-single,pins = <
 			J721E_IOPAD(0x1c4, PIN_INPUT, 5) /* SPI0_CS1.DP0_HPD */
@@ -511,6 +626,12 @@
 		>;
 	};
 
+	vdd_sd_dv_pins_default: vdd-sd-dv-default-pins {
+		pinctrl-single,pins = <
+			J721E_IOPAD(0x1dc, PIN_OUTPUT, 7) /* (Y1) SPI1_CLK.GPIO0_118 */
+		>;
+	};
+
 	wkup_uart0_pins_default: wkup-uart0-default-pins {
 		pinctrl-single,pins = <
 			J721E_WKUP_IOPAD(0xa0, PIN_INPUT, 0) /* (J29) WKUP_UART0_RXD */
@@ -534,6 +655,19 @@
 		>;
 	};
 
+	mcu_mcan0_pins_default: mcu-mcan0-default-pins {
+		pinctrl-single,pins = <
+			J721E_WKUP_IOPAD(0x0ac, PIN_INPUT, 0) /* (C29) MCU_MCAN0_RX */
+			J721E_WKUP_IOPAD(0x0a8, PIN_OUTPUT, 0) /* (D29) MCU_MCAN0_TX */
+		>;
+	};
+
+	mcu_mcan0_gpio_pins_default: mcu-mcan0-gpio-default-pins {
+		pinctrl-single,pins = <
+			J721E_WKUP_IOPAD(0x0bc, PIN_INPUT, 7) /* (F27) WKUP_GPIO0_3 */
+		>;
+	};
+
 	/* Reset for M.2 M Key slot on PCIe1  */
 	mkey_reset_pins_default: mkey-reset-pns-default-pins {
 		pinctrl-single,pins = <
@@ -707,14 +841,14 @@
 		reg = <0x70>;
 
 		/* CSI0 I2C */
-		i2c@0 {
+		cam0_i2c: i2c@0 {
 			#address-cells = <1>;
 			#size-cells = <0>;
 			reg = <0>;
 		};
 
 		/* CSI1 I2C */
-		i2c@1 {
+		cam1_i2c: i2c@1 {
 			#address-cells = <1>;
 			#size-cells = <0>;
 			reg = <1>;
@@ -942,6 +1076,34 @@
 	num-lanes = <2>;
 };
 
+&mcu_mcan0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mcu_mcan0_pins_default>;
+	phys = <&transceiver1>;
+	status = "okay";
+};
+
+&main_mcan0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&main_mcan0_pins_default>;
+	phys = <&transceiver2>;
+	status = "okay";
+};
+
+&main_mcan5 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&main_mcan5_pins_default>;
+	phys = <&transceiver3>;
+	status = "okay";
+};
+
+&main_mcan9 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&main_mcan9_pins_default>;
+	phys = <&transceiver4>;
+	status = "okay";
+};
+
 &ufs_wrapper {
 	status = "disabled";
 };

arch/arm64/configs/defconfig

@@ -1412,6 +1412,9 @@ CONFIG_PHY_HISTB_COMBPHY=y
 CONFIG_PHY_HISI_INNO_USB2=y
 CONFIG_PHY_MVEBU_CP110_COMPHY=y
 CONFIG_PHY_MTK_TPHY=y
+CONFIG_PHY_MTK_HDMI=m
+CONFIG_PHY_MTK_MIPI_DSI=m
+CONFIG_PHY_MTK_DP=m
 CONFIG_PHY_QCOM_EDP=m
 CONFIG_PHY_QCOM_EUSB2_REPEATER=m
 CONFIG_PHY_QCOM_PCIE2=m

arch/arm64/include/asm/esr.h

@@ -366,12 +366,14 @@
 /*
  * ISS values for SME traps
  */
+#define ESR_ELx_SME_ISS_SMTC_MASK		GENMASK(2, 0)
+#define ESR_ELx_SME_ISS_SMTC(esr)		((esr) & ESR_ELx_SME_ISS_SMTC_MASK)
 
-#define ESR_ELx_SME_ISS_SME_DISABLED	0
+#define ESR_ELx_SME_ISS_SMTC_SME_DISABLED	0
-#define ESR_ELx_SME_ISS_ILL		1
+#define ESR_ELx_SME_ISS_SMTC_ILL		1
-#define ESR_ELx_SME_ISS_SM_DISABLED	2
+#define ESR_ELx_SME_ISS_SMTC_SM_DISABLED	2
-#define ESR_ELx_SME_ISS_ZA_DISABLED	3
+#define ESR_ELx_SME_ISS_SMTC_ZA_DISABLED	3
-#define ESR_ELx_SME_ISS_ZT_DISABLED	4
+#define ESR_ELx_SME_ISS_SMTC_ZT_DISABLED	4
 
 /* ISS field definitions for MOPS exceptions */
 #define ESR_ELx_MOPS_ISS_MEM_INST	(UL(1) << 24)

arch/arm64/include/asm/fpsimd.h

@@ -6,6 +6,7 @@
 #define __ASM_FP_H
 
 #include <asm/errno.h>
+#include <asm/percpu.h>
 #include <asm/ptrace.h>
 #include <asm/processor.h>
 #include <asm/sigcontext.h>
@@ -69,6 +70,8 @@ struct cpu_fp_state {
 	enum fp_type to_save;
 };
 
+DECLARE_PER_CPU(struct cpu_fp_state, fpsimd_last_state);
+
 extern void fpsimd_bind_state_to_cpu(struct cpu_fp_state *fp_state);
 
 extern void fpsimd_flush_task_state(struct task_struct *target);

arch/arm64/include/asm/tlbflush.h

@@ -304,13 +304,14 @@ static inline bool arch_tlbbatch_should_defer(struct mm_struct *mm)
 }
 
 /*
- * If mprotect/munmap/etc occurs during TLB batched flushing, we need to
+ * If mprotect/munmap/etc occurs during TLB batched flushing, we need to ensure
- * synchronise all the TLBI issued with a DSB to avoid the race mentioned in
+ * all the previously issued TLBIs targeting mm have completed. But since we
- * flush_tlb_batched_pending().
+ * can be executing on a remote CPU, a DSB cannot guarantee this like it can
+ * for arch_tlbbatch_flush(). Our only option is to flush the entire mm.
  */
 static inline void arch_flush_tlb_batched_pending(struct mm_struct *mm)
 {
-	dsb(ish);
+	flush_tlb_mm(mm);
 }
 
 /*

arch/arm64/kernel/entry-common.c

@@ -363,20 +363,16 @@ static bool cortex_a76_erratum_1463225_debug_handler(struct pt_regs *regs)
  * As per the ABI exit SME streaming mode and clear the SVE state not
  * shared with FPSIMD on syscall entry.
  */
-static inline void fp_user_discard(void)
+static inline void fpsimd_syscall_enter(void)
 {
-	/*
+	/* Ensure PSTATE.SM is clear, but leave PSTATE.ZA as-is. */
-	 * If SME is active then exit streaming mode.  If ZA is active
-	 * then flush the SVE registers but leave userspace access to
-	 * both SVE and SME enabled, otherwise disable SME for the
-	 * task and fall through to disabling SVE too.  This means
-	 * that after a syscall we never have any streaming mode
-	 * register state to track, if this changes the KVM code will
-	 * need updating.
-	 */
 	if (system_supports_sme())
 		sme_smstop_sm();
 
+	/*
+	 * The CPU is not in streaming mode. If non-streaming SVE is not
+	 * supported, there is no SVE state that needs to be discarded.
+	 */
 	if (!system_supports_sve())
 		return;
 
@@ -386,6 +382,33 @@ static inline void fp_user_discard(void)
 		sve_vq_minus_one = sve_vq_from_vl(task_get_sve_vl(current)) - 1;
 		sve_flush_live(true, sve_vq_minus_one);
 	}
+
+	/*
+	 * Any live non-FPSIMD SVE state has been zeroed. Allow
+	 * fpsimd_save_user_state() to lazily discard SVE state until either
+	 * the live state is unbound or fpsimd_syscall_exit() is called.
+	 */
+	__this_cpu_write(fpsimd_last_state.to_save, FP_STATE_FPSIMD);
+}
+
+static __always_inline void fpsimd_syscall_exit(void)
+{
+	if (!system_supports_sve())
+		return;
+
+	/*
+	 * The current task's user FPSIMD/SVE/SME state is now bound to this
+	 * CPU. The fpsimd_last_state.to_save value is either:
+	 *
+	 * - FP_STATE_FPSIMD, if the state has not been reloaded on this CPU
+	 *   since fpsimd_syscall_enter().
+	 *
+	 * - FP_STATE_CURRENT, if the state has been reloaded on this CPU at
+	 *   any point.
+	 *
+	 * Reset this to FP_STATE_CURRENT to stop lazy discarding.
+	 */
+	__this_cpu_write(fpsimd_last_state.to_save, FP_STATE_CURRENT);
 }
 
 UNHANDLED(el1t, 64, sync)
@@ -678,10 +701,11 @@ static void noinstr el0_svc(struct pt_regs *regs)
 {
 	enter_from_user_mode(regs);
 	cortex_a76_erratum_1463225_svc_handler();
-	fp_user_discard();
+	fpsimd_syscall_enter();
 	local_daif_restore(DAIF_PROCCTX);
 	do_el0_svc(regs);
 	exit_to_user_mode(regs);
+	fpsimd_syscall_exit();
 }
 
 static void noinstr el0_fpac(struct pt_regs *regs, unsigned long esr)

arch/arm64/kernel/fpsimd.c

@@ -119,7 +119,7 @@
  *   whatever is in the FPSIMD registers is not saved to memory, but discarded.
  */
 
-static DEFINE_PER_CPU(struct cpu_fp_state, fpsimd_last_state);
+DEFINE_PER_CPU(struct cpu_fp_state, fpsimd_last_state);
 
 __ro_after_init struct vl_info vl_info[ARM64_VEC_MAX] = {
 #ifdef CONFIG_ARM64_SVE
@@ -473,12 +473,15 @@ static void fpsimd_save(void)
 		return;
 
 	/*
-	 * If a task is in a syscall the ABI allows us to only
+	 * Save SVE state if it is live.
-	 * preserve the state shared with FPSIMD so don't bother
+	 *
-	 * saving the full SVE state in that case.
+	 * The syscall ABI discards live SVE state at syscall entry. When
+	 * entering a syscall, fpsimd_syscall_enter() sets to_save to
+	 * FP_STATE_FPSIMD to allow the SVE state to be lazily discarded until
+	 * either new SVE state is loaded+bound or fpsimd_syscall_exit() is
+	 * called prior to a return to userspace.
 	 */
-	if ((last->to_save == FP_STATE_CURRENT && test_thread_flag(TIF_SVE) &&
+	if ((last->to_save == FP_STATE_CURRENT && test_thread_flag(TIF_SVE)) ||
-	     !in_syscall(current_pt_regs())) ||
 	    last->to_save == FP_STATE_SVE) {
 		save_sve_regs = true;
 		save_ffr = true;
@@ -1514,7 +1517,7 @@ void do_sme_acc(unsigned long esr, struct pt_regs *regs)
 	 * If this not a trap due to SME being disabled then something
 	 * is being used in the wrong mode, report as SIGILL.
 	 */
-	if (ESR_ELx_ISS(esr) != ESR_ELx_SME_ISS_SME_DISABLED) {
+	if (ESR_ELx_SME_ISS_SMTC(esr) != ESR_ELx_SME_ISS_SMTC_SME_DISABLED) {
 		force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
 		return;
 	}
@@ -1538,6 +1541,8 @@ void do_sme_acc(unsigned long esr, struct pt_regs *regs)
 		sme_set_vq(vq_minus_one);
 
 		fpsimd_bind_task_to_cpu();
+	} else {
+		fpsimd_flush_task_state(current);
 	}
 
 	put_cpu_fpsimd_context();
@@ -1803,7 +1808,7 @@ void fpsimd_update_current_state(struct user_fpsimd_state const *state)
 	get_cpu_fpsimd_context();
 
 	current->thread.uw.fpsimd_state = *state;
-	if (test_thread_flag(TIF_SVE))
+	if (current->thread.fp_type == FP_STATE_SVE)
 		fpsimd_to_sve(current);
 
 	task_fpsimd_load();

arch/arm64/kernel/ptrace.c

@@ -141,7 +141,7 @@ unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, unsigned int n)
 
 	addr += n;
 	if (regs_within_kernel_stack(regs, (unsigned long)addr))
-		return *addr;
+		return READ_ONCE_NOCHECK(*addr);
 	else
 		return 0;
 }

arch/arm64/mm/mmu.c

@@ -1253,6 +1253,7 @@ int pud_free_pmd_page(pud_t *pudp, unsigned long addr)
 	next = addr;
 	end = addr + PUD_SIZE;
 	do {
+		if (pmd_present(pmdp_get(pmdp)))
 			pmd_free_pte_page(pmdp, next);
 	} while (pmdp++, next += PMD_SIZE, next != end);
 

arch/arm64/xen/hypercall.S

@@ -83,7 +83,26 @@ HYPERCALL3(vcpu_op);
 HYPERCALL1(platform_op_raw);
 HYPERCALL2(multicall);
 HYPERCALL2(vm_assist);
-HYPERCALL3(dm_op);
+
+SYM_FUNC_START(HYPERVISOR_dm_op)
+	mov x16, #__HYPERVISOR_dm_op;	\
+	/*
+	 * dm_op hypercalls are issued by the userspace. The kernel needs to
+	 * enable access to TTBR0_EL1 as the hypervisor would issue stage 1
+	 * translations to user memory via AT instructions. Since AT
+	 * instructions are not affected by the PAN bit (ARMv8.1), we only
+	 * need the explicit uaccess_enable/disable if the TTBR0 PAN emulation
+	 * is enabled (it implies that hardware UAO and PAN disabled).
+	 */
+	uaccess_ttbr0_enable x6, x7, x8
+	hvc XEN_IMM
+
+	/*
+	 * Disable userspace access from kernel once the hyp call completed.
+	 */
+	uaccess_ttbr0_disable x6, x7
+	ret
+SYM_FUNC_END(HYPERVISOR_dm_op);
 
 SYM_FUNC_START(privcmd_call)
 	mov x16, x0

arch/loongarch/include/asm/irqflags.h

@@ -14,40 +14,48 @@
 static inline void arch_local_irq_enable(void)
 {
 	u32 flags = CSR_CRMD_IE;
+	register u32 mask asm("t0") = CSR_CRMD_IE;
+
 	__asm__ __volatile__(
 		"csrxchg %[val], %[mask], %[reg]\n\t"
 		: [val] "+r" (flags)
-		: [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD)
+		: [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD)
 		: "memory");
 }
 
 static inline void arch_local_irq_disable(void)
 {
 	u32 flags = 0;
+	register u32 mask asm("t0") = CSR_CRMD_IE;
+
 	__asm__ __volatile__(
 		"csrxchg %[val], %[mask], %[reg]\n\t"
 		: [val] "+r" (flags)
-		: [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD)
+		: [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD)
 		: "memory");
 }
 
 static inline unsigned long arch_local_irq_save(void)
 {
 	u32 flags = 0;
+	register u32 mask asm("t0") = CSR_CRMD_IE;
+
 	__asm__ __volatile__(
 		"csrxchg %[val], %[mask], %[reg]\n\t"
 		: [val] "+r" (flags)
-		: [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD)
+		: [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD)
 		: "memory");
 	return flags;
 }
 
 static inline void arch_local_irq_restore(unsigned long flags)
 {
+	register u32 mask asm("t0") = CSR_CRMD_IE;
+
 	__asm__ __volatile__(
 		"csrxchg %[val], %[mask], %[reg]\n\t"
 		: [val] "+r" (flags)
-		: [mask] "r" (CSR_CRMD_IE), [reg] "i" (LOONGARCH_CSR_CRMD)
+		: [mask] "r" (mask), [reg] "i" (LOONGARCH_CSR_CRMD)
 		: "memory");
 }
 

arch/loongarch/mm/hugetlbpage.c

@@ -47,7 +47,8 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr,
 				pmd = pmd_offset(pud, addr);
 		}
 	}
-	return pmd_none(pmdp_get(pmd)) ? NULL : (pte_t *) pmd;
+
+	return (!pmd || pmd_none(pmdp_get(pmd))) ? NULL : (pte_t *) pmd;
 }
 
 int pmd_huge(pmd_t pmd)

arch/m68k/mac/config.c

@@ -801,7 +801,7 @@ static void __init mac_identify(void)
 	}
 
 	macintosh_config = mac_data_table;
-	for (m = macintosh_config; m->ident != -1; m++) {
+	for (m = &mac_data_table[1]; m->ident != -1; m++) {
 		if (m->ident == model) {
 			macintosh_config = m;
 			break;

arch/mips/boot/dts/loongson/loongson64c_4core_ls7a.dts

@@ -29,6 +29,7 @@
 		compatible = "loongson,pch-msi-1.0";
 		reg = <0 0x2ff00000 0 0x8>;
 		interrupt-controller;
+		#interrupt-cells = <1>;
 		msi-controller;
 		loongson,msi-base-vec = <64>;
 		loongson,msi-num-vecs = <64>;

arch/mips/vdso/Makefile

@@ -30,6 +30,7 @@ endif
 # offsets.
 cflags-vdso := $(ccflags-vdso) \
 	$(filter -W%,$(filter-out -Wa$(comma)%,$(KBUILD_CFLAGS))) \
+	$(filter -std=%,$(KBUILD_CFLAGS)) \
 	-O3 -g -fPIC -fno-strict-aliasing -fno-common -fno-builtin -G 0 \
 	-mrelax-pic-calls $(call cc-option, -mexplicit-relocs) \
 	-fno-stack-protector -fno-jump-tables -DDISABLE_BRANCH_PROFILING \

arch/parisc/boot/compressed/Makefile

@@ -22,6 +22,7 @@ KBUILD_CFLAGS += -fno-PIE -mno-space-regs -mdisable-fpregs -Os
 ifndef CONFIG_64BIT
 KBUILD_CFLAGS += -mfast-indirect-calls
 endif
+KBUILD_CFLAGS += -std=gnu11
 
 LDFLAGS_vmlinux := -X -e startup --as-needed -T
 $(obj)/vmlinux: $(obj)/vmlinux.lds $(addprefix $(obj)/, $(OBJECTS)) $(LIBGCC) FORCE

arch/parisc/kernel/unaligned.c

@@ -24,7 +24,7 @@
 #define DPRINTF(fmt, args...)
 #endif
 
-#define RFMT "%#08lx"
+#define RFMT "0x%08lx"
 
 /* 1111 1100 0000 0000 0001 0011 1100 0000 */
 #define OPCODE1(a,b,c)	((a)<<26|(b)<<12|(c)<<6) 

arch/powerpc/include/asm/ppc_asm.h

@@ -183,7 +183,7 @@
 /*
  * Used to name C functions called from asm
  */
-#ifdef CONFIG_PPC_KERNEL_PCREL
+#if defined(__powerpc64__) && defined(CONFIG_PPC_KERNEL_PCREL)
 #define CFUNC(name) name@notoc
 #else
 #define CFUNC(name) name

arch/powerpc/include/uapi/asm/ioctls.h

@@ -23,10 +23,10 @@
 #define TCSETSW		_IOW('t', 21, struct termios)
 #define TCSETSF		_IOW('t', 22, struct termios)
 
-#define TCGETA		_IOR('t', 23, struct termio)
+#define TCGETA		0x40147417 /* _IOR('t', 23, struct termio) */
-#define TCSETA		_IOW('t', 24, struct termio)
+#define TCSETA		0x80147418 /* _IOW('t', 24, struct termio) */
-#define TCSETAW		_IOW('t', 25, struct termio)
+#define TCSETAW		0x80147419 /* _IOW('t', 25, struct termio) */
-#define TCSETAF		_IOW('t', 28, struct termio)
+#define TCSETAF		0x8014741c /* _IOW('t', 28, struct termio) */
 
 #define TCSBRK		_IO('t', 29)
 #define TCXONC		_IO('t', 30)

arch/powerpc/kernel/Makefile

@@ -165,9 +165,7 @@ endif
 
 obj64-$(CONFIG_PPC_TRANSACTIONAL_MEM)	+= tm.o
 
-ifneq ($(CONFIG_XMON)$(CONFIG_KEXEC_CORE)(CONFIG_PPC_BOOK3S),)
 obj-y				+= ppc_save_regs.o
-endif
 
 obj-$(CONFIG_EPAPR_PARAVIRT)	+= epapr_paravirt.o epapr_hcalls.o
 obj-$(CONFIG_KVM_GUEST)		+= kvm.o kvm_emul.o

arch/powerpc/kernel/eeh.c

@@ -1516,6 +1516,8 @@ int eeh_pe_configure(struct eeh_pe *pe)
 	/* Invalid PE ? */
 	if (!pe)
 		return -ENODEV;
+	else
+		ret = eeh_ops->configure_bridge(pe);
 
 	return ret;
 }

arch/powerpc/kernel/vdso/Makefile

@@ -50,7 +50,7 @@ ldflags-$(CONFIG_LD_ORPHAN_WARN) += -Wl,--orphan-handling=$(CONFIG_LD_ORPHAN_WAR
 ldflags-y += $(filter-out $(CC_AUTO_VAR_INIT_ZERO_ENABLER) $(CC_FLAGS_FTRACE) -Wa$(comma)%, $(KBUILD_CFLAGS))
 
 CC32FLAGS := -m32
-CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc
+CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc -mpcrel
 ifdef CONFIG_CC_IS_CLANG
 # This flag is supported by clang for 64-bit but not 32-bit so it will cause
 # an unused command line flag warning for this file.

arch/powerpc/kexec/crash.c

@@ -356,7 +356,10 @@ void default_machine_crash_shutdown(struct pt_regs *regs)
 	if (TRAP(regs) == INTERRUPT_SYSTEM_RESET)
 		is_via_system_reset = 1;
 
+	if (IS_ENABLED(CONFIG_SMP))
 		crash_smp_send_stop();
+	else
+		crash_kexec_prepare();
 
 	crash_save_cpu(regs, crashing_cpu);
 

arch/powerpc/platforms/book3s/vas-api.c

@@ -521,6 +521,15 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)
 		return -EINVAL;
 	}
 
+	/*
+	 * Map complete page to the paste address. So the user
+	 * space should pass 0ULL to the offset parameter.
+	 */
+	if (vma->vm_pgoff) {
+		pr_debug("Page offset unsupported to map paste address\n");
+		return -EINVAL;
+	}
+
 	/* Ensure instance has an open send window */
 	if (!txwin) {
 		pr_err("No send window open?\n");

arch/powerpc/platforms/powernv/memtrace.c

@@ -48,11 +48,15 @@ static ssize_t memtrace_read(struct file *filp, char __user *ubuf,
 static int memtrace_mmap(struct file *filp, struct vm_area_struct *vma)
 {
 	struct memtrace_entry *ent = filp->private_data;
+	unsigned long ent_nrpages = ent->size >> PAGE_SHIFT;
+	unsigned long vma_nrpages = vma_pages(vma);
 
-	if (ent->size < vma->vm_end - vma->vm_start)
+	/* The requested page offset should be within object's page count */
+	if (vma->vm_pgoff >= ent_nrpages)
 		return -EINVAL;
 
-	if (vma->vm_pgoff << PAGE_SHIFT >= ent->size)
+	/* The requested mapping range should remain within the bounds */
+	if (vma_nrpages > ent_nrpages - vma->vm_pgoff)
 		return -EINVAL;
 
 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);

arch/powerpc/platforms/pseries/msi.c

@@ -519,7 +519,12 @@ static struct msi_domain_info pseries_msi_domain_info = {
 
 static void pseries_msi_compose_msg(struct irq_data *data, struct msi_msg *msg)
 {
+	struct pci_dev *dev = msi_desc_to_pci_dev(irq_data_get_msi_desc(data));
+
+	if (dev->current_state == PCI_D0)
 		__pci_read_msi_msg(irq_data_get_msi_desc(data), msg);
+	else
+		get_cached_msi_msg(data->irq, msg);
 }
 
 static struct irq_chip pseries_msi_irq_chip = {

arch/riscv/kvm/vcpu_sbi.c

@@ -103,9 +103,9 @@ void kvm_riscv_vcpu_sbi_system_reset(struct kvm_vcpu *vcpu,
 	struct kvm_vcpu *tmp;
 
 	kvm_for_each_vcpu(i, tmp, vcpu->kvm) {
-		spin_lock(&vcpu->arch.mp_state_lock);
+		spin_lock(&tmp->arch.mp_state_lock);
 		WRITE_ONCE(tmp->arch.mp_state.mp_state, KVM_MP_STATE_STOPPED);
-		spin_unlock(&vcpu->arch.mp_state_lock);
+		spin_unlock(&tmp->arch.mp_state_lock);
 	}
 	kvm_make_all_cpus_request(vcpu->kvm, KVM_REQ_SLEEP);
 

arch/riscv/kvm/vcpu_sbi_replace.c

@@ -103,7 +103,7 @@ static int kvm_sbi_ext_rfence_handler(struct kvm_vcpu *vcpu, struct kvm_run *run
 		kvm_riscv_vcpu_pmu_incr_fw(vcpu, SBI_PMU_FW_FENCE_I_SENT);
 		break;
 	case SBI_EXT_RFENCE_REMOTE_SFENCE_VMA:
-		if (cp->a2 == 0 && cp->a3 == 0)
+		if ((cp->a2 == 0 && cp->a3 == 0) || cp->a3 == -1UL)
 			kvm_riscv_hfence_vvma_all(vcpu->kvm, hbase, hmask);
 		else
 			kvm_riscv_hfence_vvma_gva(vcpu->kvm, hbase, hmask,
@@ -111,7 +111,7 @@ static int kvm_sbi_ext_rfence_handler(struct kvm_vcpu *vcpu, struct kvm_run *run
 		kvm_riscv_vcpu_pmu_incr_fw(vcpu, SBI_PMU_FW_HFENCE_VVMA_SENT);
 		break;
 	case SBI_EXT_RFENCE_REMOTE_SFENCE_VMA_ASID:
-		if (cp->a2 == 0 && cp->a3 == 0)
+		if ((cp->a2 == 0 && cp->a3 == 0) || cp->a3 == -1UL)
 			kvm_riscv_hfence_vvma_asid_all(vcpu->kvm,
 						       hbase, hmask, cp->a4);
 		else
@@ -127,9 +127,9 @@ static int kvm_sbi_ext_rfence_handler(struct kvm_vcpu *vcpu, struct kvm_run *run
 	case SBI_EXT_RFENCE_REMOTE_HFENCE_VVMA_ASID:
 		/*
 		 * Until nested virtualization is implemented, the
-		 * SBI HFENCE calls should be treated as NOPs
+		 * SBI HFENCE calls should return not supported
+		 * hence fallthrough.
 		 */
-		break;
 	default:
 		retdata->err_val = SBI_ERR_NOT_SUPPORTED;
 	}

arch/s390/kernel/entry.S

@@ -639,7 +639,7 @@ SYM_CODE_START(stack_overflow)
 	stmg	%r0,%r7,__PT_R0(%r11)
 	stmg	%r8,%r9,__PT_PSW(%r11)
 	mvc	__PT_R8(64,%r11),0(%r14)
-	stg	%r10,__PT_ORIG_GPR2(%r11) # store last break to orig_gpr2
+	mvc	__PT_ORIG_GPR2(8,%r11),__LC_PGM_LAST_BREAK
 	xc	__SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
 	lgr	%r2,%r11		# pass pointer to pt_regs
 	jg	kernel_stack_overflow

arch/s390/kvm/gaccess.c

@@ -490,7 +490,7 @@ enum prot_type {
 	PROT_TYPE_DAT  = 3,
 	PROT_TYPE_IEP  = 4,
 	/* Dummy value for passing an initialized value when code != PGM_PROTECTION */
-	PROT_NONE,
+	PROT_TYPE_DUMMY,
 };
 
 static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, u8 ar,
@@ -506,7 +506,7 @@ static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva,
 	switch (code) {
 	case PGM_PROTECTION:
 		switch (prot) {
-		case PROT_NONE:
+		case PROT_TYPE_DUMMY:
 			/* We should never get here, acts like termination */
 			WARN_ON_ONCE(1);
 			break;
@@ -976,7 +976,7 @@ static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
 			gpa = kvm_s390_real_to_abs(vcpu, ga);
 			if (kvm_is_error_gpa(vcpu->kvm, gpa)) {
 				rc = PGM_ADDRESSING;
-				prot = PROT_NONE;
+				prot = PROT_TYPE_DUMMY;
 			}
 		}
 		if (rc)
@@ -1134,7 +1134,7 @@ int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
 		if (rc == PGM_PROTECTION)
 			prot = PROT_TYPE_KEYC;
 		else
-			prot = PROT_NONE;
+			prot = PROT_TYPE_DUMMY;
 		rc = trans_exc_ending(vcpu, rc, ga, ar, mode, prot, terminate);
 	}
 out_unlock:

arch/s390/net/bpf_jit_comp.c

@@ -587,14 +587,12 @@ static void bpf_jit_prologue(struct bpf_jit *jit, struct bpf_prog *fp,
 	}
 	/* Setup stack and backchain */
 	if (is_first_pass(jit) || (jit->seen & SEEN_STACK)) {
-		if (is_first_pass(jit) || (jit->seen & SEEN_FUNC))
 		/* lgr %w1,%r15 (backchain) */
 		EMIT4(0xb9040000, REG_W1, REG_15);
 		/* la %bfp,STK_160_UNUSED(%r15) (BPF frame pointer) */
 		EMIT4_DISP(0x41000000, BPF_REG_FP, REG_15, STK_160_UNUSED);
 		/* aghi %r15,-STK_OFF */
 		EMIT4_IMM(0xa70b0000, REG_15, -(STK_OFF + stack_depth));
-		if (is_first_pass(jit) || (jit->seen & SEEN_FUNC))
 		/* stg %w1,152(%r15) (backchain) */
 		EMIT6_DISP_LH(0xe3000000, 0x0024, REG_W1, REG_0,
 			      REG_15, 152);

arch/s390/pci/pci_event.c

@@ -98,6 +98,10 @@ static pci_ers_result_t zpci_event_do_error_state_clear(struct pci_dev *pdev,
 	struct zpci_dev *zdev = to_zpci(pdev);
 	int rc;
 
+	/* The underlying device may have been disabled by the event */
+	if (!zdev_enabled(zdev))
+		return PCI_ERS_RESULT_NEED_RESET;
+
 	pr_info("%s: Unblocking device access for examination\n", pci_name(pdev));
 	rc = zpci_reset_load_store_blocked(zdev);
 	if (rc) {

arch/s390/pci/pci_mmio.c

@@ -223,7 +223,7 @@ static inline int __pcilg_mio_inuser(
 		[ioaddr_len] "+&d" (ioaddr_len.pair),
 		[cc] "+d" (cc), [val] "=d" (val),
 		[dst] "+a" (dst), [cnt] "+d" (cnt), [tmp] "=d" (tmp),
-		[shift] "+d" (shift)
+		[shift] "+a" (shift)
 		:: "cc", "memory");
 
 	/* did we write everything to the user space buffer? */

arch/um/Makefile

@@ -151,5 +151,6 @@ MRPROPER_FILES += $(HOST_DIR)/include/generated
 archclean:
 	@find . \( -name '*.bb' -o -name '*.bbg' -o -name '*.da' \
 		-o -name '*.gcov' \) -type f -print | xargs rm -f
+	$(Q)$(MAKE) -f $(srctree)/Makefile ARCH=$(HEADER_ARCH) clean
 
 export HEADER_ARCH SUBARCH USER_CFLAGS CFLAGS_NO_HARDENING DEV_NULL_PATH

arch/um/drivers/ubd_user.c

@@ -41,7 +41,7 @@ int start_io_thread(unsigned long sp, int *fd_out)
 	*fd_out = fds[1];
 
 	err = os_set_fd_block(*fd_out, 0);
-	err = os_set_fd_block(kernel_fd, 0);
+	err |= os_set_fd_block(kernel_fd, 0);
 	if (err) {
 		printk("start_io_thread - failed to set nonblocking I/O.\n");
 		goto out_close;

arch/um/include/asm/asm-prototypes.h

@@ -1 +1,6 @@
 #include <asm-generic/asm-prototypes.h>
+#include <asm/checksum.h>
+
+#ifdef CONFIG_UML_X86
+extern void cmpxchg8b_emu(void);
+#endif

arch/um/kernel/trap.c

@@ -17,6 +17,122 @@
 #include <os.h>
 #include <skas.h>
 
+/*
+ * NOTE: UML does not have exception tables. As such, this is almost a copy
+ * of the code in mm/memory.c, only adjusting the logic to simply check whether
+ * we are coming from the kernel instead of doing an additional lookup in the
+ * exception table.
+ * We can do this simplification because we never get here if the exception was
+ * fixable.
+ */
+static inline bool get_mmap_lock_carefully(struct mm_struct *mm, bool is_user)
+{
+	if (likely(mmap_read_trylock(mm)))
+		return true;
+
+	if (!is_user)
+		return false;
+
+	return !mmap_read_lock_killable(mm);
+}
+
+static inline bool mmap_upgrade_trylock(struct mm_struct *mm)
+{
+	/*
+	 * We don't have this operation yet.
+	 *
+	 * It should be easy enough to do: it's basically a
+	 *    atomic_long_try_cmpxchg_acquire()
+	 * from RWSEM_READER_BIAS -> RWSEM_WRITER_LOCKED, but
+	 * it also needs the proper lockdep magic etc.
+	 */
+	return false;
+}
+
+static inline bool upgrade_mmap_lock_carefully(struct mm_struct *mm, bool is_user)
+{
+	mmap_read_unlock(mm);
+	if (!is_user)
+		return false;
+
+	return !mmap_write_lock_killable(mm);
+}
+
+/*
+ * Helper for page fault handling.
+ *
+ * This is kind of equivalend to "mmap_read_lock()" followed
+ * by "find_extend_vma()", except it's a lot more careful about
+ * the locking (and will drop the lock on failure).
+ *
+ * For example, if we have a kernel bug that causes a page
+ * fault, we don't want to just use mmap_read_lock() to get
+ * the mm lock, because that would deadlock if the bug were
+ * to happen while we're holding the mm lock for writing.
+ *
+ * So this checks the exception tables on kernel faults in
+ * order to only do this all for instructions that are actually
+ * expected to fault.
+ *
+ * We can also actually take the mm lock for writing if we
+ * need to extend the vma, which helps the VM layer a lot.
+ */
+static struct vm_area_struct *
+um_lock_mm_and_find_vma(struct mm_struct *mm,
+			unsigned long addr, bool is_user)
+{
+	struct vm_area_struct *vma;
+
+	if (!get_mmap_lock_carefully(mm, is_user))
+		return NULL;
+
+	vma = find_vma(mm, addr);
+	if (likely(vma && (vma->vm_start <= addr)))
+		return vma;
+
+	/*
+	 * Well, dang. We might still be successful, but only
+	 * if we can extend a vma to do so.
+	 */
+	if (!vma || !(vma->vm_flags & VM_GROWSDOWN)) {
+		mmap_read_unlock(mm);
+		return NULL;
+	}
+
+	/*
+	 * We can try to upgrade the mmap lock atomically,
+	 * in which case we can continue to use the vma
+	 * we already looked up.
+	 *
+	 * Otherwise we'll have to drop the mmap lock and
+	 * re-take it, and also look up the vma again,
+	 * re-checking it.
+	 */
+	if (!mmap_upgrade_trylock(mm)) {
+		if (!upgrade_mmap_lock_carefully(mm, is_user))
+			return NULL;
+
+		vma = find_vma(mm, addr);
+		if (!vma)
+			goto fail;
+		if (vma->vm_start <= addr)
+			goto success;
+		if (!(vma->vm_flags & VM_GROWSDOWN))
+			goto fail;
+	}
+
+	if (expand_stack_locked(vma, addr))
+		goto fail;
+
+success:
+	mmap_write_downgrade(mm);
+	return vma;
+
+fail:
+	mmap_write_unlock(mm);
+	return NULL;
+}
+
 /*
  * Note this is constrained to return 0, -EFAULT, -EACCES, -ENOMEM by
  * segv().
@@ -43,21 +159,10 @@ int handle_page_fault(unsigned long address, unsigned long ip,
 	if (is_user)
 		flags |= FAULT_FLAG_USER;
 retry:
-	mmap_read_lock(mm);
+	vma = um_lock_mm_and_find_vma(mm, address, is_user);
-	vma = find_vma(mm, address);
-	if (!vma)
-		goto out;
-	if (vma->vm_start <= address)
-		goto good_area;
-	if (!(vma->vm_flags & VM_GROWSDOWN))
-		goto out;
-	if (is_user && !ARCH_IS_STACKGROW(address))
-		goto out;
-	vma = expand_stack(mm, address);
 	if (!vma)
 		goto out_nosemaphore;
 
-good_area:
 	*code_out = SEGV_ACCERR;
 	if (is_write) {
 		if (!(vma->vm_flags & VM_WRITE))

arch/x86/Kconfig

@@ -2621,6 +2621,15 @@ config MITIGATION_ITS
 	  disabled, mitigation cannot be enabled via cmdline.
 	  See <file:Documentation/admin-guide/hw-vuln/indirect-target-selection.rst>
 
+config MITIGATION_TSA
+	bool "Mitigate Transient Scheduler Attacks"
+	depends on CPU_SUP_AMD
+	default y
+	help
+	  Enable mitigation for Transient Scheduler Attacks. TSA is a hardware
+	  security vulnerability on AMD CPUs which can lead to forwarding of
+	  invalid info to subsequent instructions and thus can affect their
+	  timing and thereby cause a leakage.
 endif
 
 config ARCH_HAS_ADD_PAGES

arch/x86/entry/entry.S

@@ -31,20 +31,20 @@ EXPORT_SYMBOL_GPL(entry_ibpb);
 
 /*
  * Define the VERW operand that is disguised as entry code so that
- * it can be referenced with KPTI enabled. This ensure VERW can be
+ * it can be referenced with KPTI enabled. This ensures VERW can be
  * used late in exit-to-user path after page tables are switched.
  */
 .pushsection .entry.text, "ax"
 
 .align L1_CACHE_BYTES, 0xcc
-SYM_CODE_START_NOALIGN(mds_verw_sel)
+SYM_CODE_START_NOALIGN(x86_verw_sel)
 	UNWIND_HINT_UNDEFINED
 	ANNOTATE_NOENDBR
 	.word __KERNEL_DS
 .align L1_CACHE_BYTES, 0xcc
-SYM_CODE_END(mds_verw_sel);
+SYM_CODE_END(x86_verw_sel);
 /* For KVM */
-EXPORT_SYMBOL_GPL(mds_verw_sel);
+EXPORT_SYMBOL_GPL(x86_verw_sel);
 
 .popsection
 

arch/x86/include/asm/cpu.h

@@ -81,4 +81,16 @@ int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type);
 
 extern struct cpumask cpus_stop_mask;
 
+union zen_patch_rev {
+	struct {
+		__u32 rev	 : 8,
+		      stepping	 : 4,
+		      model	 : 4,
+		      __reserved : 4,
+		      ext_model	 : 4,
+		      ext_fam	 : 8;
+	};
+	__u32 ucode_rev;
+};
+
 #endif /* _ASM_X86_CPU_H */

arch/x86/include/asm/cpufeatures.h

@@ -449,6 +449,7 @@
 /* AMD-defined Extended Feature 2 EAX, CPUID level 0x80000021 (EAX), word 20 */
 #define X86_FEATURE_NO_NESTED_DATA_BP	(20*32+ 0) /* "" No Nested Data Breakpoints */
 #define X86_FEATURE_LFENCE_RDTSC	(20*32+ 2) /* "" LFENCE always serializing / synchronizes RDTSC */
+#define X86_FEATURE_VERW_CLEAR		(20*32+ 5) /* "" The memory form of VERW mitigates TSA */
 #define X86_FEATURE_NULL_SEL_CLR_BASE	(20*32+ 6) /* "" Null Selector Clears Base */
 #define X86_FEATURE_AUTOIBRS		(20*32+ 8) /* "" Automatic IBRS */
 #define X86_FEATURE_NO_SMM_CTL_MSR	(20*32+ 9) /* "" SMM_CTL MSR is not present */
@@ -470,6 +471,10 @@
 #define X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT (21*32+ 4) /* "" Clear branch history at vmexit using SW loop */
 #define X86_FEATURE_INDIRECT_THUNK_ITS	(21*32 + 5) /* "" Use thunk for indirect branches in lower half of cacheline */
 
+#define X86_FEATURE_TSA_SQ_NO          (21*32+11) /* "" AMD CPU not vulnerable to TSA-SQ */
+#define X86_FEATURE_TSA_L1_NO          (21*32+12) /* "" AMD CPU not vulnerable to TSA-L1 */
+#define X86_FEATURE_CLEAR_CPU_BUF_VM   (21*32+13) /* "" Clear CPU buffers using VERW before VMRUN */
+
 /*
  * BUG word(s)
  */
@@ -521,4 +526,5 @@
 #define X86_BUG_IBPB_NO_RET		X86_BUG(1*32 + 4) /* "ibpb_no_ret" IBPB omits return target predictions */
 #define X86_BUG_ITS			X86_BUG(1*32 + 5) /* CPU is affected by Indirect Target Selection */
 #define X86_BUG_ITS_NATIVE_ONLY		X86_BUG(1*32 + 6) /* CPU is affected by ITS, VMX is not affected */
+#define X86_BUG_TSA			X86_BUG(1*32+ 9) /* "tsa" CPU is affected by Transient Scheduler Attacks */
 #endif /* _ASM_X86_CPUFEATURES_H */

arch/x86/include/asm/irqflags.h

@@ -44,13 +44,13 @@ static __always_inline void native_irq_enable(void)
 
 static __always_inline void native_safe_halt(void)
 {
-	mds_idle_clear_cpu_buffers();
+	x86_idle_clear_cpu_buffers();
 	asm volatile("sti; hlt": : :"memory");
 }
 
 static __always_inline void native_halt(void)
 {
-	mds_idle_clear_cpu_buffers();
+	x86_idle_clear_cpu_buffers();
 	asm volatile("hlt": : :"memory");
 }
 

arch/x86/include/asm/mwait.h

@@ -44,8 +44,6 @@ static __always_inline void __monitorx(const void *eax, unsigned long ecx,
 
 static __always_inline void __mwait(unsigned long eax, unsigned long ecx)
 {
-	mds_idle_clear_cpu_buffers();
-
 	/* "mwait %eax, %ecx;" */
 	asm volatile(".byte 0x0f, 0x01, 0xc9;"
 		     :: "a" (eax), "c" (ecx));
@@ -80,7 +78,7 @@ static __always_inline void __mwait(unsigned long eax, unsigned long ecx)
 static __always_inline void __mwaitx(unsigned long eax, unsigned long ebx,
 				     unsigned long ecx)
 {
-	/* No MDS buffer clear as this is AMD/HYGON only */
+	/* No need for TSA buffer clearing on AMD */
 
 	/* "mwaitx %eax, %ebx, %ecx;" */
 	asm volatile(".byte 0x0f, 0x01, 0xfb;"
@@ -89,7 +87,7 @@ static __always_inline void __mwaitx(unsigned long eax, unsigned long ebx,
 
 static __always_inline void __sti_mwait(unsigned long eax, unsigned long ecx)
 {
-	mds_idle_clear_cpu_buffers();
+
 	/* "mwait %eax, %ecx;" */
 	asm volatile("sti; .byte 0x0f, 0x01, 0xc9;"
 		     :: "a" (eax), "c" (ecx));
@@ -107,16 +105,20 @@ static __always_inline void __sti_mwait(unsigned long eax, unsigned long ecx)
  */
 static __always_inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx)
 {
+	if (need_resched())
+		return;
+
+	x86_idle_clear_cpu_buffers();
+
 	if (static_cpu_has_bug(X86_BUG_MONITOR) || !current_set_polling_and_test()) {
-		if (static_cpu_has_bug(X86_BUG_CLFLUSH_MONITOR)) {
+		const void *addr = &current_thread_info()->flags;
-			mb();
-			clflush((void *)&current_thread_info()->flags);
-			mb();
-		}
 
-		__monitor((void *)&current_thread_info()->flags, 0, 0);
+		alternative_input("", "clflush (%[addr])", X86_BUG_CLFLUSH_MONITOR, [addr] "a" (addr));
+		__monitor(addr, 0, 0);
+
+		if (need_resched())
+			goto out;
 
-		if (!need_resched()) {
 		if (ecx & 1) {
 			__mwait(eax, ecx);
 		} else {
@@ -124,7 +126,8 @@ static __always_inline void mwait_idle_with_hints(unsigned long eax, unsigned lo
 			raw_local_irq_disable();
 		}
 	}
-	}
+
+out:
 	current_clr_polling();
 }
 

arch/x86/include/asm/nospec-branch.h

@@ -324,25 +324,31 @@
 .endm
 
 /*
- * Macro to execute VERW instruction that mitigate transient data sampling
+ * Macro to execute VERW insns that mitigate transient data sampling
- * attacks such as MDS. On affected systems a microcode update overloaded VERW
+ * attacks such as MDS or TSA. On affected systems a microcode update
- * instruction to also clear the CPU buffers. VERW clobbers CFLAGS.ZF.
+ * overloaded VERW insns to also clear the CPU buffers. VERW clobbers
- *
+ * CFLAGS.ZF.
  * Note: Only the memory operand variant of VERW clears the CPU buffers.
  */
-.macro CLEAR_CPU_BUFFERS
+.macro __CLEAR_CPU_BUFFERS feature
 #ifdef CONFIG_X86_64
-	ALTERNATIVE "", "verw mds_verw_sel(%rip)", X86_FEATURE_CLEAR_CPU_BUF
+	ALTERNATIVE "", "verw x86_verw_sel(%rip)", \feature
 #else
 	/*
 	 * In 32bit mode, the memory operand must be a %cs reference. The data
 	 * segments may not be usable (vm86 mode), and the stack segment may not
 	 * be flat (ESPFIX32).
 	 */
-	ALTERNATIVE "", "verw %cs:mds_verw_sel", X86_FEATURE_CLEAR_CPU_BUF
+	ALTERNATIVE "", "verw %cs:x86_verw_sel", \feature
 #endif
 .endm
 
+#define CLEAR_CPU_BUFFERS \
+	__CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF
+
+#define VM_CLEAR_CPU_BUFFERS \
+	__CLEAR_CPU_BUFFERS X86_FEATURE_CLEAR_CPU_BUF_VM
+
 #ifdef CONFIG_X86_64
 .macro CLEAR_BRANCH_HISTORY
 	ALTERNATIVE "", "call clear_bhb_loop", X86_FEATURE_CLEAR_BHB_LOOP
@@ -592,24 +598,24 @@ DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp);
 DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
 DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
 
-DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+DECLARE_STATIC_KEY_FALSE(cpu_buf_idle_clear);
 
 DECLARE_STATIC_KEY_FALSE(switch_mm_cond_l1d_flush);
 
 DECLARE_STATIC_KEY_FALSE(mmio_stale_data_clear);
 
-extern u16 mds_verw_sel;
+extern u16 x86_verw_sel;
 
 #include <asm/segment.h>
 
 /**
- * mds_clear_cpu_buffers - Mitigation for MDS and TAA vulnerability
+ * x86_clear_cpu_buffers - Buffer clearing support for different x86 CPU vulns
  *
  * This uses the otherwise unused and obsolete VERW instruction in
  * combination with microcode which triggers a CPU buffer flush when the
  * instruction is executed.
  */
-static __always_inline void mds_clear_cpu_buffers(void)
+static __always_inline void x86_clear_cpu_buffers(void)
 {
 	static const u16 ds = __KERNEL_DS;
 
@@ -626,14 +632,15 @@ static __always_inline void mds_clear_cpu_buffers(void)
 }
 
 /**
- * mds_idle_clear_cpu_buffers - Mitigation for MDS vulnerability
+ * x86_idle_clear_cpu_buffers - Buffer clearing support in idle for the MDS
+ * and TSA vulnerabilities.
  *
  * Clear CPU buffers if the corresponding static key is enabled
  */
-static __always_inline void mds_idle_clear_cpu_buffers(void)
+static __always_inline void x86_idle_clear_cpu_buffers(void)
 {
-	if (static_branch_likely(&mds_idle_clear))
+	if (static_branch_likely(&cpu_buf_idle_clear))
-		mds_clear_cpu_buffers();
+		x86_clear_cpu_buffers();
 }
 
 #endif /* __ASSEMBLY__ */

arch/x86/include/uapi/asm/debugreg.h

@@ -15,7 +15,26 @@
    which debugging register was responsible for the trap.  The other bits
    are either reserved or not of interest to us. */
 
-/* Define reserved bits in DR6 which are always set to 1 */
+/*
+ * Define bits in DR6 which are set to 1 by default.
+ *
+ * This is also the DR6 architectural value following Power-up, Reset or INIT.
+ *
+ * Note, with the introduction of Bus Lock Detection (BLD) and Restricted
+ * Transactional Memory (RTM), the DR6 register has been modified:
+ *
+ * 1) BLD flag (bit 11) is no longer reserved to 1 if the CPU supports
+ *    Bus Lock Detection.  The assertion of a bus lock could clear it.
+ *
+ * 2) RTM flag (bit 16) is no longer reserved to 1 if the CPU supports
+ *    restricted transactional memory.  #DB occurred inside an RTM region
+ *    could clear it.
+ *
+ * Apparently, DR6.BLD and DR6.RTM are active low bits.
+ *
+ * As a result, DR6_RESERVED is an incorrect name now, but it is kept for
+ * compatibility.
+ */
 #define DR6_RESERVED	(0xFFFF0FF0)
 
 #define DR_TRAP0	(0x1)		/* db0 */

arch/x86/kernel/cpu/amd.c

@@ -539,6 +539,64 @@ static void early_init_amd_mc(struct cpuinfo_x86 *c)
 #endif
 }
 
+static bool amd_check_tsa_microcode(void)
+{
+	struct cpuinfo_x86 *c = &boot_cpu_data;
+	union zen_patch_rev p;
+	u32 min_rev = 0;
+
+	p.ext_fam	= c->x86 - 0xf;
+	p.model		= c->x86_model;
+	p.ext_model	= c->x86_model >> 4;
+	p.stepping	= c->x86_stepping;
+
+	if (cpu_has(c, X86_FEATURE_ZEN3) ||
+	    cpu_has(c, X86_FEATURE_ZEN4)) {
+		switch (p.ucode_rev >> 8) {
+		case 0xa0011:	min_rev = 0x0a0011d7; break;
+		case 0xa0012:	min_rev = 0x0a00123b; break;
+		case 0xa0082:	min_rev = 0x0a00820d; break;
+		case 0xa1011:	min_rev = 0x0a10114c; break;
+		case 0xa1012:	min_rev = 0x0a10124c; break;
+		case 0xa1081:	min_rev = 0x0a108109; break;
+		case 0xa2010:	min_rev = 0x0a20102e; break;
+		case 0xa2012:	min_rev = 0x0a201211; break;
+		case 0xa4041:	min_rev = 0x0a404108; break;
+		case 0xa5000:	min_rev = 0x0a500012; break;
+		case 0xa6012:	min_rev = 0x0a60120a; break;
+		case 0xa7041:	min_rev = 0x0a704108; break;
+		case 0xa7052:	min_rev = 0x0a705208; break;
+		case 0xa7080:	min_rev = 0x0a708008; break;
+		case 0xa70c0:	min_rev = 0x0a70c008; break;
+		case 0xaa002:	min_rev = 0x0aa00216; break;
+		default:
+			pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n",
+				 __func__, p.ucode_rev, c->microcode);
+			return false;
+		}
+	}
+
+	if (!min_rev)
+		return false;
+
+	return c->microcode >= min_rev;
+}
+
+static void tsa_init(struct cpuinfo_x86 *c)
+{
+	if (cpu_has(c, X86_FEATURE_HYPERVISOR))
+		return;
+
+	if (cpu_has(c, X86_FEATURE_ZEN3) ||
+	    cpu_has(c, X86_FEATURE_ZEN4)) {
+		if (amd_check_tsa_microcode())
+			setup_force_cpu_cap(X86_FEATURE_VERW_CLEAR);
+	} else {
+		setup_force_cpu_cap(X86_FEATURE_TSA_SQ_NO);
+		setup_force_cpu_cap(X86_FEATURE_TSA_L1_NO);
+	}
+}
+
 static void bsp_init_amd(struct cpuinfo_x86 *c)
 {
 	if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) {
@@ -645,6 +703,9 @@ static void bsp_init_amd(struct cpuinfo_x86 *c)
 		break;
 	}
 
+
+	tsa_init(c);
+
 	return;
 
 warn:

arch/x86/kernel/cpu/bugs.c

@@ -50,6 +50,7 @@ static void __init l1d_flush_select_mitigation(void);
 static void __init srso_select_mitigation(void);
 static void __init gds_select_mitigation(void);
 static void __init its_select_mitigation(void);
+static void __init tsa_select_mitigation(void);
 
 /* The base value of the SPEC_CTRL MSR without task-specific bits set */
 u64 x86_spec_ctrl_base;
@@ -122,9 +123,9 @@ DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
 /* Control unconditional IBPB in switch_mm() */
 DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
 
-/* Control MDS CPU buffer clear before idling (halt, mwait) */
+/* Control CPU buffer clear before idling (halt, mwait) */
-DEFINE_STATIC_KEY_FALSE(mds_idle_clear);
+DEFINE_STATIC_KEY_FALSE(cpu_buf_idle_clear);
-EXPORT_SYMBOL_GPL(mds_idle_clear);
+EXPORT_SYMBOL_GPL(cpu_buf_idle_clear);
 
 /*
  * Controls whether l1d flush based mitigations are enabled,
@@ -185,6 +186,7 @@ void __init cpu_select_mitigations(void)
 	srso_select_mitigation();
 	gds_select_mitigation();
 	its_select_mitigation();
+	tsa_select_mitigation();
 }
 
 /*
@@ -445,7 +447,7 @@ static void __init mmio_select_mitigation(void)
 	 * is required irrespective of SMT state.
 	 */
 	if (!(x86_arch_cap_msr & ARCH_CAP_FBSDP_NO))
-		static_branch_enable(&mds_idle_clear);
+		static_branch_enable(&cpu_buf_idle_clear);
 
 	/*
 	 * Check if the system has the right microcode.
@@ -1442,13 +1444,9 @@ static __ro_after_init enum spectre_v2_mitigation_cmd spectre_v2_cmd;
 static enum spectre_v2_user_cmd __init
 spectre_v2_parse_user_cmdline(void)
 {
-	enum spectre_v2_user_cmd mode;
 	char arg[20];
 	int ret, i;
 
-	mode = IS_ENABLED(CONFIG_MITIGATION_SPECTRE_V2) ?
-		SPECTRE_V2_USER_CMD_AUTO : SPECTRE_V2_USER_CMD_NONE;
-
 	switch (spectre_v2_cmd) {
 	case SPECTRE_V2_CMD_NONE:
 		return SPECTRE_V2_USER_CMD_NONE;
@@ -1461,7 +1459,7 @@ spectre_v2_parse_user_cmdline(void)
 	ret = cmdline_find_option(boot_command_line, "spectre_v2_user",
 				  arg, sizeof(arg));
 	if (ret < 0)
-		return mode;
+		return SPECTRE_V2_USER_CMD_AUTO;
 
 	for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) {
 		if (match_option(arg, ret, v2_user_options[i].option)) {
@@ -1471,8 +1469,8 @@ spectre_v2_parse_user_cmdline(void)
 		}
 	}
 
-	pr_err("Unknown user space protection option (%s). Switching to default\n", arg);
+	pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg);
-	return mode;
+	return SPECTRE_V2_USER_CMD_AUTO;
 }
 
 static inline bool spectre_v2_in_ibrs_mode(enum spectre_v2_mitigation mode)
@@ -2086,10 +2084,10 @@ static void update_mds_branch_idle(void)
 		return;
 
 	if (sched_smt_active()) {
-		static_branch_enable(&mds_idle_clear);
+		static_branch_enable(&cpu_buf_idle_clear);
 	} else if (mmio_mitigation == MMIO_MITIGATION_OFF ||
 		   (x86_arch_cap_msr & ARCH_CAP_FBSDP_NO)) {
-		static_branch_disable(&mds_idle_clear);
+		static_branch_disable(&cpu_buf_idle_clear);
 	}
 }
 
@@ -2097,6 +2095,94 @@ static void update_mds_branch_idle(void)
 #define TAA_MSG_SMT "TAA CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html for more details.\n"
 #define MMIO_MSG_SMT "MMIO Stale Data CPU bug present and SMT on, data leak possible. See https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/processor_mmio_stale_data.html for more details.\n"
 
+#undef pr_fmt
+#define pr_fmt(fmt)	"Transient Scheduler Attacks: " fmt
+
+enum tsa_mitigations {
+	TSA_MITIGATION_NONE,
+	TSA_MITIGATION_UCODE_NEEDED,
+	TSA_MITIGATION_USER_KERNEL,
+	TSA_MITIGATION_VM,
+	TSA_MITIGATION_FULL,
+};
+
+static const char * const tsa_strings[] = {
+	[TSA_MITIGATION_NONE]		= "Vulnerable",
+	[TSA_MITIGATION_UCODE_NEEDED]	= "Vulnerable: Clear CPU buffers attempted, no microcode",
+	[TSA_MITIGATION_USER_KERNEL]	= "Mitigation: Clear CPU buffers: user/kernel boundary",
+	[TSA_MITIGATION_VM]		= "Mitigation: Clear CPU buffers: VM",
+	[TSA_MITIGATION_FULL]		= "Mitigation: Clear CPU buffers",
+};
+
+static enum tsa_mitigations tsa_mitigation __ro_after_init =
+	IS_ENABLED(CONFIG_MITIGATION_TSA) ? TSA_MITIGATION_FULL : TSA_MITIGATION_NONE;
+
+static int __init tsa_parse_cmdline(char *str)
+{
+	if (!str)
+		return -EINVAL;
+
+	if (!strcmp(str, "off"))
+		tsa_mitigation = TSA_MITIGATION_NONE;
+	else if (!strcmp(str, "on"))
+		tsa_mitigation = TSA_MITIGATION_FULL;
+	else if (!strcmp(str, "user"))
+		tsa_mitigation = TSA_MITIGATION_USER_KERNEL;
+	else if (!strcmp(str, "vm"))
+		tsa_mitigation = TSA_MITIGATION_VM;
+	else
+		pr_err("Ignoring unknown tsa=%s option.\n", str);
+
+	return 0;
+}
+early_param("tsa", tsa_parse_cmdline);
+
+static void __init tsa_select_mitigation(void)
+{
+	if (tsa_mitigation == TSA_MITIGATION_NONE)
+		return;
+
+	if (cpu_mitigations_off() || !boot_cpu_has_bug(X86_BUG_TSA)) {
+		tsa_mitigation = TSA_MITIGATION_NONE;
+		return;
+	}
+
+	if (!boot_cpu_has(X86_FEATURE_VERW_CLEAR))
+		tsa_mitigation = TSA_MITIGATION_UCODE_NEEDED;
+
+	switch (tsa_mitigation) {
+	case TSA_MITIGATION_USER_KERNEL:
+		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
+		break;
+
+	case TSA_MITIGATION_VM:
+		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
+		break;
+
+	case TSA_MITIGATION_UCODE_NEEDED:
+		if (!boot_cpu_has(X86_FEATURE_HYPERVISOR))
+			goto out;
+
+		pr_notice("Forcing mitigation on in a VM\n");
+
+		/*
+		 * On the off-chance that microcode has been updated
+		 * on the host, enable the mitigation in the guest just
+		 * in case.
+		 */
+		fallthrough;
+	case TSA_MITIGATION_FULL:
+		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF);
+		setup_force_cpu_cap(X86_FEATURE_CLEAR_CPU_BUF_VM);
+		break;
+	default:
+		break;
+	}
+
+out:
+	pr_info("%s\n", tsa_strings[tsa_mitigation]);
+}
+
 void cpu_bugs_smt_update(void)
 {
 	mutex_lock(&spec_ctrl_mutex);
@@ -2150,6 +2236,24 @@ void cpu_bugs_smt_update(void)
 		break;
 	}
 
+	switch (tsa_mitigation) {
+	case TSA_MITIGATION_USER_KERNEL:
+	case TSA_MITIGATION_VM:
+	case TSA_MITIGATION_FULL:
+	case TSA_MITIGATION_UCODE_NEEDED:
+		/*
+		 * TSA-SQ can potentially lead to info leakage between
+		 * SMT threads.
+		 */
+		if (sched_smt_active())
+			static_branch_enable(&cpu_buf_idle_clear);
+		else
+			static_branch_disable(&cpu_buf_idle_clear);
+		break;
+	case TSA_MITIGATION_NONE:
+		break;
+	}
+
 	mutex_unlock(&spec_ctrl_mutex);
 }
 
@@ -3079,6 +3183,11 @@ static ssize_t gds_show_state(char *buf)
 	return sysfs_emit(buf, "%s\n", gds_strings[gds_mitigation]);
 }
 
+static ssize_t tsa_show_state(char *buf)
+{
+	return sysfs_emit(buf, "%s\n", tsa_strings[tsa_mitigation]);
+}
+
 static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
 			       char *buf, unsigned int bug)
 {
@@ -3140,6 +3249,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 	case X86_BUG_ITS:
 		return its_show_state(buf);
 
+	case X86_BUG_TSA:
+		return tsa_show_state(buf);
+
 	default:
 		break;
 	}
@@ -3224,4 +3336,9 @@ ssize_t cpu_show_indirect_target_selection(struct device *dev, struct device_att
 {
 	return cpu_show_common(dev, attr, buf, X86_BUG_ITS);
 }
+
+ssize_t cpu_show_tsa(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	return cpu_show_common(dev, attr, buf, X86_BUG_TSA);
+}
 #endif